@sixb/core 0.1.20 → 0.1.22

package/src/datasets/column-index.ts

@@ -0,0 +1,19 @@
+import type { DatasetColumnDefinition, DatasetDefinition } from "./types"
+
+const indexes = new WeakMap<DatasetDefinition, ReadonlyMap<string, DatasetColumnDefinition>>()
+
+/**
+ * The columns of a dataset definition by name, built once per definition object. Registered
+ * definitions are not changed after startup, so every check and resolver can share one index.
+ */
+export function columnsByName(
+  dataset: DatasetDefinition
+): ReadonlyMap<string, DatasetColumnDefinition> {
+  let index = indexes.get(dataset)
+  if (!index) {
+    index = new Map(dataset.schema.columns.map((column) => [column.name, column]))
+    indexes.set(dataset, index)
+  }
+
+  return index
+}

package/src/datasets/execution.ts

@@ -11,6 +11,7 @@ import type { DatasetMergeCommitResult } from "../lake-storage/merge"
 import { getDatasetPrimaryKeyColumns } from "../lake-storage/merge-validation"
 import type { DatasetRow, DatasetVersion, LakeStorage } from "../lake-storage/types"
 import type { SixbRuntimeContext } from "../runtime/types"
+import type { DatasetVersionMarkings } from "../security/dataset-version-markings"
 import { missingClearanceRedactions } from "../security/redactions"
 import type { Redactions } from "../security/types"
 import type { MergeChange } from "./changes"
@@ -42,7 +43,7 @@ export interface DatasetRows {
   /** Columns each row holds. Redacted columns are left out. */
   readonly columns: readonly string[]
   /**
-   * Every column of the dataset the reader cannot read, whether or not it was requested. Absent
+   * Every column of the version the reader cannot read, whether or not it was requested. Absent
    * when the reader can read every column.
    */
   readonly redactions?: Redactions
@@ -65,7 +66,8 @@ export function createDatasetsRuntime(
   execution: ExecutionContext,
   source: Pick<DatasetsRuntime, "list" | "getById">,
   lakeStorage: LakeStorage,
-  blobStorage: Pick<BlobStorage, "stat">
+  blobStorage: Pick<BlobStorage, "stat">,
+  versionMarkings: DatasetVersionMarkings
 ): DatasetsRuntime {
   const authority = resolveRuntimeAuthorizationForProject(runtime)
   const allowed = (datasetId: string) =>
@@ -91,7 +93,11 @@ export function createDatasetsRuntime(
           : await lakeStorage.getVersion(registered.id, input.versionId)
       if (!version) return null
 
-      const redacted = redactedColumns(registered, assertRuntimeAuthorizationBound(runtime))
+      const redacted = redactedColumns(
+        version,
+        versionMarkings,
+        assertRuntimeAuthorizationBound(runtime)
+      )
       const selected = selectColumns(version, input.columns)
       const columns = selected.filter((column) => !redacted.has(column))
       const read = (readColumns: readonly string[] | undefined) =>
@@ -181,20 +187,28 @@ function selectColumns(version: DatasetVersion, requested: readonly string[] | u
 }
 
 /**
- * Columns the reader cannot read. Trusted code reads every column, a principal reads what its roles
- * clear, and any other authority is cleared for nothing.
+ * Columns of the version the reader cannot read. Trusted code reads every column, a principal reads
+ * what its roles clear, and any other authority is cleared for nothing.
+ *
+ * No version carries a marking the project does not declare on a column, so a reader cleared for
+ * every declared marking (all readers, when none is declared) reads every column without
+ * classifying the version.
  */
 function redactedColumns(
-  dataset: DatasetDefinition,
+  version: DatasetVersion,
+  versionMarkings: DatasetVersionMarkings,
   authority: ReturnType<typeof assertRuntimeAuthorizationBound>
 ): ReadonlySet<string> {
   if (authority.type === "unrestricted") return new Set()
   const clearances =
     authority.type === "principal" ? (authority.context.clearances ?? new Set()) : new Set()
+  if ([...versionMarkings.everyMarking()].every((id) => clearances.has(id))) return new Set()
+
+  const { columns } = versionMarkings.classify(version)
   return new Set(
-    dataset.schema.columns
-      .filter((column) => column.markings?.some((markingId) => !clearances.has(markingId)))
-      .map((column) => column.name)
+    [...columns]
+      .filter(([, columnMarkings]) => [...columnMarkings].some((id) => !clearances.has(id)))
+      .map(([column]) => column)
   )
 }
 

package/src/errors/catalog.ts

@@ -1,6 +1,11 @@
-interface SixbErrorDefinition {
+export interface SixbErrorDefinition {
   readonly publicMessage: string
   readonly retryable: boolean
+  /**
+   * A failure's explanation, when it has one, is its whole durable message instead of following
+   * `publicMessage`. Only for codes whose explanation is written for the caller on purpose.
+   */
+  readonly explanationIsMessage?: true
 }
 
 /**
@@ -18,6 +23,12 @@ export const SIXB_ERROR_DEFINITIONS = {
     publicMessage: "Data the Action read changed before its commit.",
     retryable: true,
   },
+  // Not a crash: a validator declined the request, with a message written for the caller.
+  "action.rejected": {
+    publicMessage: "The Action rejected the request.",
+    retryable: false,
+    explanationIsMessage: true,
+  },
   "action.run_in_progress": {
     publicMessage: "The Action run is already in progress.",
     retryable: true,
@@ -27,6 +38,12 @@ export const SIXB_ERROR_DEFINITIONS = {
     publicMessage: "The Action exceeded its 30-second time limit.",
     retryable: false,
   },
+  // The requester signed out, their session expired, or they lost access before the call ran.
+  "agent.approval_authority_lost": {
+    publicMessage:
+      "The approved call did not run: the sign-in of whoever asked for it ended first. Ask the Agent again.",
+    retryable: false,
+  },
   "agent.execution_failed": {
     publicMessage: "Agent execution failed.",
     retryable: false,
@@ -115,6 +132,14 @@ export const SIXB_ERROR_DEFINITIONS = {
     publicMessage: "The job could not be enqueued.",
     retryable: true,
   },
+  "object.not_found": {
+    publicMessage: "Object not found.",
+    retryable: false,
+  },
+  "object.unique_violation": {
+    publicMessage: "Another object already has this unique value.",
+    retryable: false,
+  },
   "pipeline.step_failed": {
     publicMessage: "Pipeline step execution failed.",
     retryable: false,

package/src/errors/internal.ts

@@ -1,6 +1,6 @@
 import { cloneJsonValue, isJsonValue, isPlainRecord, type ReadonlyJsonValue } from "../json"
 import { ActionRunFailedError } from "../objects/action/errors"
-import { SIXB_ERROR_CODES, SIXB_ERROR_DEFINITIONS } from "./catalog"
+import { SIXB_ERROR_CODES, SIXB_ERROR_DEFINITIONS, type SixbErrorDefinition } from "./catalog"
 import { failureMessage } from "./failure-message"
 import { createFailureRedactor } from "./redaction"
 import type { SixbErrorCode, SixbFailure } from "./types"
@@ -13,6 +13,7 @@ const SIXB_ERROR_CODE_SET: ReadonlySet<string> = new Set(SIXB_ERROR_CODES)
 type SixbErrorCodeTuple = readonly [SixbErrorCode, ...SixbErrorCode[]]
 
 export { SIXB_ERROR_CODES }
+export { withFailureMessage } from "./failure-message"
 
 export interface SixbErrorOptions {
   readonly cause?: unknown
@@ -138,14 +139,8 @@ export function toSixbFailure(
   const redactor = createFailureRedactor()
   const details = error.details === undefined ? undefined : redactor.context(error.details)
   const { detail, truncated, redacted } = findFailureDetail(error, code)
-  const summary = SIXB_ERROR_DEFINITIONS[code].publicMessage
-  const explanation = detail?.message ?? summary
   const message = truncateUtf8(
-    redactor.text(
-      explanation === summary || explanation.startsWith(`${summary} `)
-        ? explanation
-        : `${summary} ${explanation}`
-    ),
+    redactor.text(durableFailureMessage(code, detail?.message)),
     SIXB_FAILURE_MAX_MESSAGE_BYTES
   )
   const failure: SixbFailure = {
@@ -172,6 +167,21 @@ export function toSixbFailure(
   }
 }
 
+/**
+ * The code's public message, followed by the failure's explanation when it has one. A code whose
+ * explanation is written for the caller, such as an Action's rejection, states it alone.
+ */
+function durableFailureMessage(code: SixbErrorCode, explanation: string | undefined): string {
+  const definition: SixbErrorDefinition = SIXB_ERROR_DEFINITIONS[code]
+  const summary = definition.publicMessage
+  if (explanation === undefined) return summary
+  if (definition.explanationIsMessage) return explanation
+
+  return explanation === summary || explanation.startsWith(`${summary} `)
+    ? explanation
+    : `${summary} ${explanation}`
+}
+
 const NETWORK_MESSAGES: Readonly<Record<string, string>> = {
   ECONNREFUSED: "The remote service refused the connection.",
   ECONNRESET: "The remote service reset the connection.",

package/src/events/definitions.ts

@@ -8,6 +8,7 @@ import type { RuleEvent } from "./types/rules"
 import type { ScheduleEvent } from "./types/schedules"
 import type { SyncEvent } from "./types/syncs"
 import type { TelemetryEvent } from "./types/telemetry"
+import type { UserEvent } from "./types/users"
 import type { WorkflowEvent } from "./types/workflows"
 
 export type EventDefinition<Event extends DomainEvent = DomainEvent> = {
@@ -170,6 +171,30 @@ export const DATASET_EVENT_DEFINITIONS = defineEventGroup<DatasetEvent>({
   },
 })
 
+// One stream per member, so their events stay in order. An invitation has no member yet.
+export const USER_EVENT_DEFINITIONS = defineEventGroup<UserEvent>({
+  "user.joined": {
+    topic: "users",
+    partitionKey: (payload) => payload.user.id,
+  },
+  "user.suspended": {
+    topic: "users",
+    partitionKey: (payload) => payload.user.id,
+  },
+  "user.reactivated": {
+    topic: "users",
+    partitionKey: (payload) => payload.user.id,
+  },
+  "user.invited": {
+    topic: "users",
+    partitionKey: (payload) => `invitation:${payload.email}`,
+  },
+  "user.profile.updated": {
+    topic: "users",
+    partitionKey: (payload) => payload.user.id,
+  },
+})
+
 export const EVENT_DEFINITIONS = {
   ...OBJECT_EVENT_DEFINITIONS,
   ...TELEMETRY_EVENT_DEFINITIONS,
@@ -180,6 +205,7 @@ export const EVENT_DEFINITIONS = {
   ...WORKFLOW_EVENT_DEFINITIONS,
   ...DATASET_EVENT_DEFINITIONS,
   ...RULE_EVENT_DEFINITIONS,
+  ...USER_EVENT_DEFINITIONS,
 } as const satisfies EventDefinitionMap
 
 export const EVENT_TYPES = Object.keys(EVENT_DEFINITIONS) as readonly DomainEvent["type"][]

package/src/events/execution.ts

@@ -1,6 +1,14 @@
 import { assertPrivileged, canViewEvent } from "../authorization"
 import { resolveRuntimeAuthorizationForProject } from "../execution/authorization"
-import { redactDomainEvent, resolvePropertyClearance } from "../objects/property-clearance"
+import {
+  type AuthorizedObjectReader,
+  readerClearance,
+  readerEventClearance,
+  readerViewConditions,
+} from "../execution/authorized-object-reader"
+import type { EventSources } from "../execution/object-reader-clearance"
+import { redactDomainEvent } from "../objects/clearance-redaction"
+import type { PropertyClearance } from "../objects/property-clearance"
 import type { SixbRuntimeContext } from "../runtime/types"
 import type {
   EventsAppendInput,
@@ -9,14 +17,29 @@ import type {
   EventsSubscribeInput,
 } from "./service"
 import type { StoredDomainEvent } from "./types"
+import {
+  type ObjectHistory,
+  visibleUnderConditions,
+  withoutHiddenPriorState,
+} from "./view-conditions"
 
 export interface EventsRuntime {
-  /** The event as this execution may read it: hidden events are `undefined`, others redacted. */
-  readable(event: StoredDomainEvent): StoredDomainEvent | undefined
+  /**
+   * The events this execution may read, in order: hidden events are dropped, the others redacted.
+   * Markings apply as they are now, with those of the versions an object event's values came from:
+   * the version a projection's event applied, and every marking a column declares for projected
+   * values that came from earlier versions.
+   */
+  visible(events: readonly StoredDomainEvent[]): Promise<readonly StoredDomainEvent[]>
   append(input: EventsAppendInput): Promise<readonly StoredDomainEvent[]>
   emit(input: EventsAppendInput, options: EventsEmitOptions): Promise<void>
   read(input?: EventsReadInput): Promise<readonly StoredDomainEvent[]>
   latestCursor(): Promise<string | undefined>
+  /**
+   * Deliver the events this execution may read as they are appended. A batch whose markings cannot
+   * be enforced, because the versions projections applied cannot be read, is dropped with a
+   * warning: read it again with `read({ afterCursor })`.
+   */
   subscribe(
     input: EventsSubscribeInput,
     handler: (events: readonly StoredDomainEvent[]) => unknown
@@ -25,27 +48,63 @@ export interface EventsRuntime {
 
 export function createEventsRuntime(runtime: SixbRuntimeContext): EventsRuntime {
   const authority = resolveRuntimeAuthorizationForProject(runtime)
-  const clearance =
-    authority.type === "principal"
-      ? resolvePropertyClearance(runtime.ontology, authority.context.clearances ?? new Set())
-      : undefined
-  const readable = (event: StoredDomainEvent): StoredDomainEvent | undefined => {
+
+  // Objects an event names that the reader cannot read: storage tells which still exist, and the
+  // log what the others held. Neither answer is shown.
+  const history: ObjectHistory = {
+    existing: async (objects) => {
+      const rows = await runtime.storage.objects.getByPrimaryIdBatch({
+        projectId: runtime.projectId,
+        items: objects,
+      })
+      return new Set(rows.keys())
+    },
+    lastEventBefore: (event, object) =>
+      runtime.events.lastObjectEventBefore({ cursor: event.cursor, ...object }),
+  }
+
+  const visible = async (
+    events: readonly StoredDomainEvent[]
+  ): Promise<readonly StoredDomainEvent[]> => {
     switch (authority.type) {
       case "denied":
       case "delegated":
-        return undefined
-      case "principal":
-        if (!canViewEvent(authority.context, event)) return undefined
-        return clearance ? redactDomainEvent(event, clearance) : event
+        return []
       case "unrestricted":
-        return event
+        return events
+      case "principal": {
+        const reader = runtime.objectReader
+        const conditions = readerViewConditions(reader)
+        const viewable = events.filter((event) =>
+          canViewEvent(authority.context, event, conditions)
+        )
+        if (viewable.length === 0) return viewable
+
+        const clearance = await readerClearance(reader)
+        const clearanceFor = await eventClearances(reader, viewable, clearance)
+
+        const readable = clearance
+          ? viewable.filter((event) => !readsUnreadable(event, clearance))
+          : viewable
+        const shown = await visibleUnderConditions(
+          reader,
+          readable,
+          conditions,
+          clearanceFor,
+          history
+        )
+
+        return shown.map((event) => {
+          const redacting = clearanceFor(event)
+          const redacted = redacting ? redactDomainEvent(event, redacting) : event
+          return withoutHiddenPriorState(event, redacted, conditions)
+        })
+      }
     }
   }
-  const visibleEvents = (events: readonly StoredDomainEvent[]): readonly StoredDomainEvent[] =>
-    events.flatMap((event) => readable(event) ?? [])
 
   return {
-    readable,
+    visible,
     append: (input) => {
       assertPrivileged(runtime, "events.append")
       return runtime.events.append(input)
@@ -63,8 +122,7 @@ export function createEventsRuntime(runtime: SixbRuntimeContext): EventsRuntime
         case "unrestricted":
           break
       }
-      const events = await runtime.events.read(input)
-      return visibleEvents(events)
+      return visible(await runtime.events.read(input))
     },
     latestCursor: () => {
       switch (authority.type) {
@@ -85,10 +143,102 @@ export function createEventsRuntime(runtime: SixbRuntimeContext): EventsRuntime
         case "unrestricted":
           break
       }
-      return runtime.events.subscribe(input, (events) => {
-        const visible = visibleEvents(events)
-        if (visible.length > 0) return handler(visible)
+      return runtime.events.subscribe(input, async (events) => {
+        let shown: readonly StoredDomainEvent[]
+        try {
+          shown = await visible(events)
+        } catch (error) {
+          // Fail closed. Delivery is live and keeps no progress, and a handler error is not a
+          // negative acknowledgement, so the batch is dropped and reported rather than retried.
+          const message = error instanceof Error ? error.message : String(error)
+          console.warn(
+            `[Sixb] Dropped ${events.length} event(s) from cursor '${events[0]?.cursor}' of a subscription, whose markings could not be enforced: ${message}`
+          )
+          return
+        }
+
+        if (shown.length > 0) return handler(shown)
       })
     },
   }
 }
+
+/**
+ * The clearance each event is redacted with, resolved once per kind of event for the whole batch.
+ * An event that holds only values the current markings describe uses the reader's clearance.
+ */
+async function eventClearances(
+  reader: AuthorizedObjectReader,
+  events: readonly StoredDomainEvent[],
+  clearance: PropertyClearance | undefined
+): Promise<(event: StoredDomainEvent) => PropertyClearance | undefined> {
+  const kinds = new Map<string, EventSources>()
+  for (const event of events) {
+    const kind = eventSources(event)
+    if (kind) kinds.set(kind.key, kind.sources)
+  }
+
+  const resolved = await Promise.all(
+    [...kinds].map(
+      async ([key, sources]) => [key, await readerEventClearance(reader, sources)] as const
+    )
+  )
+  const byKind = new Map(resolved)
+
+  return (event) => {
+    const kind = eventSources(event)
+    return kind ? byKind.get(kind.key) : clearance
+  }
+}
+
+/**
+ * Where an object event's values came from, when the current markings do not describe them all.
+ *
+ * - A projection's event holds the values of the version it applied.
+ * - An update or a deletion also holds the values it replaced. An action's or a direct write's
+ *   record of an object holds the values projections had applied then. Both came from versions
+ *   applied before the event, which it does not name: they read like a version that cannot be read.
+ * - Only an object created by an action or a direct write holds nothing but its own values.
+ */
+function eventSources(
+  event: StoredDomainEvent
+): { readonly key: string; readonly sources: EventSources } | undefined {
+  if (event.topic !== "objects") return undefined
+
+  const objectTypeId = event.payload.objectTypeId
+  const earlier = event.type !== "object.created"
+
+  if (event.origin?.kind !== "projection") {
+    if (!earlier) return undefined
+    return { key: JSON.stringify([objectTypeId]), sources: { objectTypeId, earlier } }
+  }
+
+  const { projectionId, datasetId, datasetVersionId } = event.origin
+  const origin = { projectionId, datasetId, datasetVersionId, objectTypeId }
+  return {
+    key: JSON.stringify([objectTypeId, projectionId, datasetId, datasetVersionId, earlier]),
+    sources: { objectTypeId, origin, earlier },
+  }
+}
+
+/**
+ * Whether the event is about an object type or a link the reader cannot read: it reveals ids and
+ * keys, so it is not delivered, as for a type the reader has no view grant for.
+ */
+function readsUnreadable(event: StoredDomainEvent, clearance: PropertyClearance): boolean {
+  switch (event.topic) {
+    case "objects":
+    case "telemetry":
+      return clearance.unreadableType(event.payload.objectTypeId) !== undefined
+    case "rules":
+      return clearance.unreadableType(event.payload.subject.objectTypeId) !== undefined
+    case "links":
+      return (
+        clearance.unreadableType(event.payload.sourceTypeId) !== undefined ||
+        clearance.unreadableType(event.payload.targetTypeId) !== undefined ||
+        clearance.unreadableLink(event.payload.sourceTypeId, event.payload.linkId) !== undefined
+      )
+    default:
+      return false
+  }
+}

package/src/events/index.ts

@@ -58,6 +58,10 @@ export {
   type SyncEventSelectorContext,
   type SyncEventSelectorEvent,
   type SyncEventToken,
+  type UserEventSelectorBuilder,
+  type UserEventSelectorContext,
+  type UserEventSelectorEvent,
+  type UserEventSelectorOperation,
 } from "./selectors"
 export {
   createDomainEventService,
@@ -73,7 +77,6 @@ export {
   type StableEventEnvelope,
   type StableEventPublisher,
 } from "./service"
-export { toStoredEvent } from "./toStoredEvent"
 export type {
   ActionEventOrigin,
   AuthorableDomainEvent,
@@ -145,6 +148,12 @@ export type {
   TelemetryEvent,
   TelemetryEventOrigin,
   TelemetryEventSource,
+  UserEvent,
+  UserInvitedEvent,
+  UserJoinedEvent,
+  UserProfileUpdatedEvent,
+  UserReactivatedEvent,
+  UserSuspendedEvent,
   WorkflowEvent,
   WorkflowRunFinishedEvent,
   WorkflowRunNodeFinishedEvent,

package/src/events/scope.ts

@@ -50,6 +50,8 @@ export function scopeKeysForEvent(event: DomainEvent): EventScopeKeys {
       return {}
     case "datasets":
       return { datasetId: event.payload.datasetId }
+    case "users":
+      return {}
     default: {
       // Exhaustiveness guard: a new topic must extend the switch above.
       const _exhaustive: never = event

package/src/events/selectors/builder.ts

@@ -13,6 +13,8 @@ import type {
   RunEventSelectorOperation,
   SyncEventSelectorContext,
   SyncEventToken,
+  UserEventSelectorContext,
+  UserEventSelectorOperation,
 } from "./types"
 
 type EventPropertySelectorMap<TTokens, TContext> = {
@@ -94,6 +96,17 @@ export interface PipelineEventSelectorBuilder<TPipeline extends PipelineEventTok
   cancelled(): EventSelectorSpec<PipelineEventSelectorContext<TPipeline, "cancelled">>
 }
 
+/** Member events, project-wide: there is one member directory per project. */
+export interface UserEventSelectorBuilder extends EventSelectorSpec<UserEventSelectorContext> {
+  /** A person signed in for the first time, which created their account. */
+  joined(): EventSelectorSpec<UserEventSelectorContext<"joined">>
+  suspended(): EventSelectorSpec<UserEventSelectorContext<"suspended">>
+  reactivated(): EventSelectorSpec<UserEventSelectorContext<"reactivated">>
+  invited(): EventSelectorSpec<UserEventSelectorContext<"invited">>
+  /** A member's name or picture changed, by their own edit or their identity provider. */
+  profileUpdated(): EventSelectorSpec<UserEventSelectorContext<"profileUpdated">>
+}
+
 abstract class EventSelectorSpecView<TContext> implements EventSelectorSpec<TContext> {
   constructor(protected readonly spec: EventSelectorSpec<TContext>) {}
 
@@ -392,6 +405,39 @@ class PipelineEventSelectorBuilderImpl<TPipeline extends PipelineEventToken>
   }
 }
 
+class UserEventSelectorBuilderImpl
+  extends EventSelectorSpecView<UserEventSelectorContext>
+  implements UserEventSelectorBuilder
+{
+  joined(): EventSelectorSpec<UserEventSelectorContext<"joined">> {
+    return this.withType("user.joined")
+  }
+
+  suspended(): EventSelectorSpec<UserEventSelectorContext<"suspended">> {
+    return this.withType("user.suspended")
+  }
+
+  reactivated(): EventSelectorSpec<UserEventSelectorContext<"reactivated">> {
+    return this.withType("user.reactivated")
+  }
+
+  invited(): EventSelectorSpec<UserEventSelectorContext<"invited">> {
+    return this.withType("user.invited")
+  }
+
+  profileUpdated(): EventSelectorSpec<UserEventSelectorContext<"profileUpdated">> {
+    return this.withType("user.profile.updated")
+  }
+
+  private withType<TOperation extends UserEventSelectorOperation>(
+    type: Extract<DomainEvent["type"], `user.${string}`>
+  ): EventSelectorSpec<UserEventSelectorContext<TOperation>> {
+    return { ...this.spec, types: [type] } as EventSelectorSpec<
+      UserEventSelectorContext<TOperation>
+    >
+  }
+}
+
 export interface EventSelectors {
   object<TObjectType extends ObjectTypeWithTokens>(
     objectType: TObjectType
@@ -404,6 +450,7 @@ export interface EventSelectors {
   pipeline<TPipeline extends PipelineEventToken>(
     pipeline: TPipeline
   ): PipelineEventSelectorBuilder<TPipeline>
+  users(): UserEventSelectorBuilder
 }
 
 export const events: EventSelectors = {
@@ -440,6 +487,9 @@ export const events: EventSelectors = {
       pipelineId: pipeline.id,
     } as EventSelectorSpec<PipelineEventSelectorContext<TPipeline>>)
   },
+  users(): UserEventSelectorBuilder {
+    return new UserEventSelectorBuilderImpl({ topic: "users" })
+  },
 }
 
 function createPropertySelectorMap(

package/src/events/selectors/index.ts

@@ -7,6 +7,7 @@ export type {
   PipelineEventSelectorBuilder,
   RuleEventSelectorBuilder,
   SyncEventSelectorBuilder,
+  UserEventSelectorBuilder,
 } from "./builder"
 export { events } from "./builder"
 export { buildEventSelectorPredicate, eventSelectorSpec } from "./predicate"
@@ -33,4 +34,7 @@ export type {
   SyncEventSelectorContext,
   SyncEventSelectorEvent,
   SyncEventToken,
+  UserEventSelectorContext,
+  UserEventSelectorEvent,
+  UserEventSelectorOperation,
 } from "./types"