@sixb/core 0.1.21 → 0.1.22

package/src/authorization/event-visibility.ts

@@ -9,35 +9,36 @@
  * topic we don't yet model may carry a subject the principal is not allowed to
  * see. Adding an event topic therefore requires an explicit visibility decision
  * here, never a silent default.
+ *
+ * A type the principal views only under a condition holds no view grant, so it is hidden here
+ * unless the caller names it in `conditioned`: it then passes, and the caller decides on the
+ * objects the event names.
  */
 
 import type { StoredDomainEvent } from "../events"
 import { isAllowed } from "./decision"
 import type { AuthorizationContext } from "./types"
 
+const NO_CONDITIONS: ReadonlySet<string> = new Set()
+
 export function canViewEvent(
   authorization: AuthorizationContext | null | undefined,
-  event: StoredDomainEvent
+  event: StoredDomainEvent,
+  conditioned: Pick<ReadonlySet<string>, "has"> = NO_CONDITIONS
 ): boolean {
   if (!authorization) {
     return true
   }
 
+  const viewsObjects = (objectTypeId: string) =>
+    conditioned.has(objectTypeId) || isAllowed(authorization, { kind: "object.view", objectTypeId })
+
   switch (event.topic) {
     case "objects":
     case "telemetry":
-      return isAllowed(authorization, {
-        kind: "object.view",
-        objectTypeId: event.payload.objectTypeId,
-      })
+      return viewsObjects(event.payload.objectTypeId)
     case "links":
-      return (
-        isAllowed(authorization, {
-          kind: "object.view",
-          objectTypeId: event.payload.sourceTypeId,
-        }) &&
-        isAllowed(authorization, { kind: "object.view", objectTypeId: event.payload.targetTypeId })
-      )
+      return viewsObjects(event.payload.sourceTypeId) && viewsObjects(event.payload.targetTypeId)
     case "workflows":
       return isAllowed(authorization, {
         kind: "workflow.run",
@@ -46,10 +47,7 @@ export function canViewEvent(
     case "rules":
       // Rule events carry the object they fired on, so gate on viewing it —
       // otherwise they leak the existence and id of hidden-type objects.
-      return isAllowed(authorization, {
-        kind: "object.view",
-        objectTypeId: event.payload.subject.objectTypeId,
-      })
+      return viewsObjects(event.payload.subject.objectTypeId)
     // Run grant gates the operational stream. These payloads may also carry the
     // produced datasetId/versionId; that target is already visible to a runner
     // through the sync/pipeline catalog (`sync.target.dataset`), so surfacing it
@@ -80,6 +78,9 @@ export function canViewEvent(
         kind: "dataset.view",
         datasetId: event.payload.datasetId,
       })
+    case "users":
+      // Member events carry profiles and invitee emails: the member directory's grant.
+      return isAllowed(authorization, { kind: "users.view" })
     default:
       // Fail closed: an unmodeled topic may carry a subject we don't yet gate.
       return false

package/src/authorization/grant-kinds.ts

@@ -13,6 +13,7 @@ import type { GrantDefinition } from "../security/types"
 export type GrantKind =
   | "view:object"
   | "view:dataset"
+  | "view:users"
   | "edit:object"
   | "append:telemetry"
   | "apply:action"
@@ -21,19 +22,26 @@ export type GrantKind =
   | "run:sync"
   | "run:pipeline"
   | "run:agent"
+  | "run:models"
   | "observe:logs"
   | "observe:aiUsage"
   | "observe:activity"
+  | "observe:agentThreads"
   | "manage:connector"
   | "manage:aiUsage"
+  | "manage:agentMemory"
 
 /** Capabilities over one project-wide surface: held or not, with no ids to select. */
 export type SingletonGrantKind =
+  | "view:users"
   | "run:agent"
+  | "run:models"
   | "observe:logs"
   | "observe:aiUsage"
   | "observe:activity"
+  | "observe:agentThreads"
   | "manage:aiUsage"
+  | "manage:agentMemory"
 export type TargetedGrantKind = Exclude<GrantKind, SingletonGrantKind>
 
 /** Registered id universes a grant kind ranges over, plus subtype expansion. */
@@ -90,6 +98,11 @@ export const GRANT_KINDS: {
     subject: "dataset",
     fix: "Add it to 'datasets/' or pass it to createSixb({ datasets }).",
   },
+  "view:users": {
+    singleton: true,
+    subject: "member directory",
+    fix: "Use can.view(project.users).",
+  },
   // Deliberately no `expandsSubtypes`: granting writes on a parent type must not
   // silently extend to types added under it later. `view:object` expands because
   // a read of a subtype reveals nothing the parent's grant did not already cover.
@@ -133,6 +146,11 @@ export const GRANT_KINDS: {
     subject: "agent",
     fix: "Configure models.language and use the exported agent reference in can.run(agent).",
   },
+  "run:models": {
+    singleton: true,
+    subject: "models",
+    fix: "Use can.run(project.models).",
+  },
   "observe:logs": {
     singleton: true,
     subject: "logs",
@@ -148,6 +166,11 @@ export const GRANT_KINDS: {
     subject: "activity",
     fix: "Use can.observe(project.activity).",
   },
+  "observe:agentThreads": {
+    singleton: true,
+    subject: "Agent conversations",
+    fix: "Use can.observe(agent.threads).",
+  },
   "manage:connector": {
     universeKey: "connectorIds",
     subject: "connector",
@@ -158,6 +181,11 @@ export const GRANT_KINDS: {
     subject: "AI usage",
     fix: "Use can.manage(agent.usage).",
   },
+  "manage:agentMemory": {
+    singleton: true,
+    subject: "Agent memory",
+    fix: "Use can.manage(agent.memory).",
+  },
 }
 
 export const GRANT_KIND_KEYS = Object.keys(GRANT_KINDS) as readonly GrantKind[]
@@ -203,6 +231,7 @@ export function emptyGrantSets(): MutableGrantIndex {
   return {
     "view:object": new Set(),
     "view:dataset": new Set(),
+    "view:users": false,
     "edit:object": new Set(),
     "append:telemetry": new Set(),
     "apply:action": new Set(),
@@ -211,10 +240,13 @@ export function emptyGrantSets(): MutableGrantIndex {
     "run:sync": new Set(),
     "run:pipeline": new Set(),
     "run:agent": false,
+    "run:models": false,
     "observe:logs": false,
     "observe:aiUsage": false,
     "observe:activity": false,
+    "observe:agentThreads": false,
     "manage:connector": new Set(),
     "manage:aiUsage": false,
+    "manage:agentMemory": false,
   }
 }

package/src/authorization/index.ts

@@ -4,6 +4,7 @@ export {
   assertCanAppendTelemetry,
   assertCanEdit,
   assertCanManageConnector,
+  assertModelAccess,
   assertPrivileged,
   assertProviderAccess,
   assertRuntimeAuthorizationBound,
@@ -14,7 +15,11 @@ export {
 export { AuthorizationError } from "./errors"
 export { canViewEvent } from "./event-visibility"
 export type { GrantKind, GrantUniverse } from "./grant-kinds"
-export { resolveAuthorizationContext, resolveRoleGrants } from "./resolve"
+export {
+  resolveAuthorizationContext,
+  resolveRoleGrants,
+  resolveRoleViewConditions,
+} from "./resolve"
 export {
   canViewActionRun,
   canViewPipelineRun,

package/src/authorization/resolve.ts

@@ -1,4 +1,5 @@
 import type { Principal } from "../auth/types"
+import type { ObjectQueryPredicate } from "../objects/query/ir"
 import type { RoleDefinition, Selection } from "../security"
 import {
   emptyGrantSets,
@@ -16,14 +17,19 @@ import type { AuthorizationContext, GrantIndex, ResolvedRole } from "./types"
  *
  * Broad grants (`every.object().except([...])`) expand against the registered
  * universe; object-type grants also expand to subtypes. Resource grants become
- * id sets; grants on one project-wide surface (the Agent, logs, AI usage) become booleans.
+ * id sets; grants on one project-wide surface (the member directory, the Agent, logs, AI usage)
+ * become booleans.
  * The per-kind universe and subtype rules come from the `GRANT_KINDS` table, so
  * this loop never enumerates targets by hand.
+ *
+ * A view grant with a condition grants no type here: see {@link resolveRoleViewConditions}.
  */
 export function resolveRoleGrants(role: RoleDefinition, universe: GrantUniverse): GrantIndex {
   const grants = emptyGrantSets()
 
   for (const grant of role.grants) {
+    if ("condition" in grant && grant.condition !== undefined) continue
+
     const kind = grantKindOf(grant)
     if (isSingletonGrantKind(kind)) {
       grants[kind] = true
@@ -43,6 +49,45 @@ export function resolveRoleGrants(role: RoleDefinition, universe: GrantUniverse)
   return grants
 }
 
+/**
+ * Resolve a role's conditional view grants once at startup, from their validated conditions.
+ *
+ * A condition applies to the type its grant names and to each subtype, as a view grant does.
+ * Several conditions on one type combine with `or`, and a type the role also views without a
+ * condition drops them: the role shows every object of it.
+ */
+export function resolveRoleViewConditions(
+  conditions: readonly {
+    readonly objectTypeId: string
+    readonly predicate: ObjectQueryPredicate
+  }[],
+  grants: GrantIndex,
+  universe: GrantUniverse
+): ReadonlyMap<string, ObjectQueryPredicate> {
+  const byType = new Map<string, ObjectQueryPredicate[]>()
+
+  for (const condition of conditions) {
+    const objectTypeIds = [condition.objectTypeId, ...universe.getSubTypes(condition.objectTypeId)]
+
+    for (const objectTypeId of objectTypeIds) {
+      if (grants["view:object"].has(objectTypeId)) continue
+
+      const predicates = byType.get(objectTypeId) ?? []
+      predicates.push(condition.predicate)
+      byType.set(objectTypeId, predicates)
+    }
+  }
+
+  return new Map(
+    [...byType].map(([objectTypeId, predicates]) => [objectTypeId, anyOf(predicates)] as const)
+  )
+}
+
+function anyOf(predicates: readonly ObjectQueryPredicate[]): ObjectQueryPredicate {
+  if (predicates.length === 1) return predicates[0]!
+  return Object.freeze({ op: "or", items: Object.freeze([...predicates]) })
+}
+
 function expandSelection(
   selection: Selection,
   universe: ReadonlySet<string>,
@@ -75,6 +120,9 @@ function expandSelection(
  * Pure set-union over pre-resolved roles: roles match when their grantedTo
  * groups intersect the principal's memberships, and their concrete id sets
  * and clearances union into the principal's context.
+ *
+ * View conditions union too: the principal sees an object any of them matches. A type one role
+ * views without a condition is viewed whole, whatever conditions the others put on it.
  */
 export function resolveAuthorizationContext(input: {
   readonly principal: Principal
@@ -86,6 +134,7 @@ export function resolveAuthorizationContext(input: {
   const roleIds: string[] = []
   const grants = emptyGrantSets()
   const clearances = new Set<string>()
+  const viewConditions = new Map<string, ObjectQueryPredicate[]>()
 
   for (const role of input.roles) {
     if (!role.grantedToGroupIds.some((groupId) => memberGroupIds.has(groupId))) {
@@ -104,6 +153,13 @@ export function resolveAuthorizationContext(input: {
     for (const markingId of role.clearances ?? []) {
       clearances.add(markingId)
     }
+    for (const [objectTypeId, predicate] of role.viewConditions ?? []) {
+      viewConditions.set(objectTypeId, [...(viewConditions.get(objectTypeId) ?? []), predicate])
+    }
+  }
+
+  for (const objectTypeId of grants["view:object"]) {
+    viewConditions.delete(objectTypeId)
   }
 
   return {
@@ -112,6 +168,7 @@ export function resolveAuthorizationContext(input: {
     groupIds: input.groupIds,
     roleIds,
     grants,
+    ...(viewConditions.size > 0 ? { viewConditions } : {}),
     clearances,
   }
 }

package/src/authorization/run-visibility.ts

@@ -7,6 +7,10 @@ import type { WorkflowRunRecord } from "../storage/workflow-runs"
 import { isAllowed } from "./decision"
 import type { AuthorizationContext } from "./types"
 
+/**
+ * Whether a principal may view a run, by its action and its subject's type. A type the principal
+ * views only through a condition fails here: the subject decides, which `viewableActionRuns` reads.
+ */
 export function canViewActionRun(
   authorization: AuthorizationContext | null | undefined,
   run: Pick<ActionRunRecord, "actionId" | "subject">
@@ -55,7 +59,10 @@ export function canViewPipelineRun(
   )
 }
 
-/** A projection run is viewable when its target object type(s) are viewable. */
+/**
+ * A projection run is viewable when its target object type(s) are viewable. A run, like its
+ * definition, describes every object of the type, so a type viewed through a condition stays closed.
+ */
 export function canViewProjectionRun(
   authorization: AuthorizationContext | null | undefined,
   target: ProjectionTarget

package/src/authorization/types.ts

@@ -8,6 +8,7 @@
  */
 
 import type { Principal } from "../auth/types"
+import type { ObjectQueryPredicate } from "../objects/query/ir"
 import { emptyGrantSets, type GrantKind, type SingletonGrantKind } from "./grant-kinds"
 
 /**
@@ -42,6 +43,12 @@ export interface ResolvedRole {
   readonly id: string
   readonly grantedToGroupIds: readonly string[]
   readonly grants: GrantIndex
+  /**
+   * What the role's `can.view(Type).where(...)` grants show, per concrete type: the type's
+   * conditions, combined with `or`. A type the role also views without a condition is in
+   * `grants["view:object"]` and not here. Absent means none.
+   */
+  readonly viewConditions?: ReadonlyMap<string, ObjectQueryPredicate>
   /** Marking ids this role clears. Absent means none. */
   readonly clearances?: ReadonlySet<string>
 }
@@ -53,6 +60,13 @@ export interface AuthorizationContext {
   /** Roles whose grantedTo groups intersect the principal's memberships. */
   readonly roleIds: readonly string[]
   readonly grants: GrantIndex
+  /**
+   * The object types the principal views only where a condition matches, with one condition per
+   * role that grants it. A type in `grants["view:object"]` is never here, so a check on that grant
+   * denies these types; only the authorized object reader reads them, through these conditions.
+   * Absent means none.
+   */
+  readonly viewConditions?: ReadonlyMap<string, readonly ObjectQueryPredicate[]>
   /**
    * Marking ids the principal may read, unioned from its roles. Absent means none: a context built
    * without clearances reads no marked property.

package/src/errors/catalog.ts

@@ -1,6 +1,11 @@
-interface SixbErrorDefinition {
+export interface SixbErrorDefinition {
   readonly publicMessage: string
   readonly retryable: boolean
+  /**
+   * A failure's explanation, when it has one, is its whole durable message instead of following
+   * `publicMessage`. Only for codes whose explanation is written for the caller on purpose.
+   */
+  readonly explanationIsMessage?: true
 }
 
 /**
@@ -18,6 +23,12 @@ export const SIXB_ERROR_DEFINITIONS = {
     publicMessage: "Data the Action read changed before its commit.",
     retryable: true,
   },
+  // Not a crash: a validator declined the request, with a message written for the caller.
+  "action.rejected": {
+    publicMessage: "The Action rejected the request.",
+    retryable: false,
+    explanationIsMessage: true,
+  },
   "action.run_in_progress": {
     publicMessage: "The Action run is already in progress.",
     retryable: true,
@@ -27,6 +38,12 @@ export const SIXB_ERROR_DEFINITIONS = {
     publicMessage: "The Action exceeded its 30-second time limit.",
     retryable: false,
   },
+  // The requester signed out, their session expired, or they lost access before the call ran.
+  "agent.approval_authority_lost": {
+    publicMessage:
+      "The approved call did not run: the sign-in of whoever asked for it ended first. Ask the Agent again.",
+    retryable: false,
+  },
   "agent.execution_failed": {
     publicMessage: "Agent execution failed.",
     retryable: false,
@@ -115,6 +132,14 @@ export const SIXB_ERROR_DEFINITIONS = {
     publicMessage: "The job could not be enqueued.",
     retryable: true,
   },
+  "object.not_found": {
+    publicMessage: "Object not found.",
+    retryable: false,
+  },
+  "object.unique_violation": {
+    publicMessage: "Another object already has this unique value.",
+    retryable: false,
+  },
   "pipeline.step_failed": {
     publicMessage: "Pipeline step execution failed.",
     retryable: false,

package/src/errors/internal.ts

@@ -1,6 +1,6 @@
 import { cloneJsonValue, isJsonValue, isPlainRecord, type ReadonlyJsonValue } from "../json"
 import { ActionRunFailedError } from "../objects/action/errors"
-import { SIXB_ERROR_CODES, SIXB_ERROR_DEFINITIONS } from "./catalog"
+import { SIXB_ERROR_CODES, SIXB_ERROR_DEFINITIONS, type SixbErrorDefinition } from "./catalog"
 import { failureMessage } from "./failure-message"
 import { createFailureRedactor } from "./redaction"
 import type { SixbErrorCode, SixbFailure } from "./types"
@@ -139,14 +139,8 @@ export function toSixbFailure(
   const redactor = createFailureRedactor()
   const details = error.details === undefined ? undefined : redactor.context(error.details)
   const { detail, truncated, redacted } = findFailureDetail(error, code)
-  const summary = SIXB_ERROR_DEFINITIONS[code].publicMessage
-  const explanation = detail?.message ?? summary
   const message = truncateUtf8(
-    redactor.text(
-      explanation === summary || explanation.startsWith(`${summary} `)
-        ? explanation
-        : `${summary} ${explanation}`
-    ),
+    redactor.text(durableFailureMessage(code, detail?.message)),
     SIXB_FAILURE_MAX_MESSAGE_BYTES
   )
   const failure: SixbFailure = {
@@ -173,6 +167,21 @@ export function toSixbFailure(
   }
 }
 
+/**
+ * The code's public message, followed by the failure's explanation when it has one. A code whose
+ * explanation is written for the caller, such as an Action's rejection, states it alone.
+ */
+function durableFailureMessage(code: SixbErrorCode, explanation: string | undefined): string {
+  const definition: SixbErrorDefinition = SIXB_ERROR_DEFINITIONS[code]
+  const summary = definition.publicMessage
+  if (explanation === undefined) return summary
+  if (definition.explanationIsMessage) return explanation
+
+  return explanation === summary || explanation.startsWith(`${summary} `)
+    ? explanation
+    : `${summary} ${explanation}`
+}
+
 const NETWORK_MESSAGES: Readonly<Record<string, string>> = {
   ECONNREFUSED: "The remote service refused the connection.",
   ECONNRESET: "The remote service reset the connection.",

package/src/events/definitions.ts

@@ -8,6 +8,7 @@ import type { RuleEvent } from "./types/rules"
 import type { ScheduleEvent } from "./types/schedules"
 import type { SyncEvent } from "./types/syncs"
 import type { TelemetryEvent } from "./types/telemetry"
+import type { UserEvent } from "./types/users"
 import type { WorkflowEvent } from "./types/workflows"
 
 export type EventDefinition<Event extends DomainEvent = DomainEvent> = {
@@ -170,6 +171,30 @@ export const DATASET_EVENT_DEFINITIONS = defineEventGroup<DatasetEvent>({
   },
 })
 
+// One stream per member, so their events stay in order. An invitation has no member yet.
+export const USER_EVENT_DEFINITIONS = defineEventGroup<UserEvent>({
+  "user.joined": {
+    topic: "users",
+    partitionKey: (payload) => payload.user.id,
+  },
+  "user.suspended": {
+    topic: "users",
+    partitionKey: (payload) => payload.user.id,
+  },
+  "user.reactivated": {
+    topic: "users",
+    partitionKey: (payload) => payload.user.id,
+  },
+  "user.invited": {
+    topic: "users",
+    partitionKey: (payload) => `invitation:${payload.email}`,
+  },
+  "user.profile.updated": {
+    topic: "users",
+    partitionKey: (payload) => payload.user.id,
+  },
+})
+
 export const EVENT_DEFINITIONS = {
   ...OBJECT_EVENT_DEFINITIONS,
   ...TELEMETRY_EVENT_DEFINITIONS,
@@ -180,6 +205,7 @@ export const EVENT_DEFINITIONS = {
   ...WORKFLOW_EVENT_DEFINITIONS,
   ...DATASET_EVENT_DEFINITIONS,
   ...RULE_EVENT_DEFINITIONS,
+  ...USER_EVENT_DEFINITIONS,
 } as const satisfies EventDefinitionMap
 
 export const EVENT_TYPES = Object.keys(EVENT_DEFINITIONS) as readonly DomainEvent["type"][]

package/src/events/execution.ts

@@ -4,6 +4,7 @@ import {
   type AuthorizedObjectReader,
   readerClearance,
   readerEventClearance,
+  readerViewConditions,
 } from "../execution/authorized-object-reader"
 import type { EventSources } from "../execution/object-reader-clearance"
 import { redactDomainEvent } from "../objects/clearance-redaction"
@@ -16,6 +17,11 @@ import type {
   EventsSubscribeInput,
 } from "./service"
 import type { StoredDomainEvent } from "./types"
+import {
+  type ObjectHistory,
+  visibleUnderConditions,
+  withoutHiddenPriorState,
+} from "./view-conditions"
 
 export interface EventsRuntime {
   /**
@@ -42,6 +48,21 @@ export interface EventsRuntime {
 
 export function createEventsRuntime(runtime: SixbRuntimeContext): EventsRuntime {
   const authority = resolveRuntimeAuthorizationForProject(runtime)
+
+  // Objects an event names that the reader cannot read: storage tells which still exist, and the
+  // log what the others held. Neither answer is shown.
+  const history: ObjectHistory = {
+    existing: async (objects) => {
+      const rows = await runtime.storage.objects.getByPrimaryIdBatch({
+        projectId: runtime.projectId,
+        items: objects,
+      })
+      return new Set(rows.keys())
+    },
+    lastEventBefore: (event, object) =>
+      runtime.events.lastObjectEventBefore({ cursor: event.cursor, ...object }),
+  }
+
   const visible = async (
     events: readonly StoredDomainEvent[]
   ): Promise<readonly StoredDomainEvent[]> => {
@@ -52,17 +73,31 @@ export function createEventsRuntime(runtime: SixbRuntimeContext): EventsRuntime
       case "unrestricted":
         return events
       case "principal": {
-        const viewable = events.filter((event) => canViewEvent(authority.context, event))
+        const reader = runtime.objectReader
+        const conditions = readerViewConditions(reader)
+        const viewable = events.filter((event) =>
+          canViewEvent(authority.context, event, conditions)
+        )
         if (viewable.length === 0) return viewable
 
-        const clearance = await readerClearance(runtime.objectReader)
-        const clearanceFor = await eventClearances(runtime.objectReader, viewable, clearance)
+        const clearance = await readerClearance(reader)
+        const clearanceFor = await eventClearances(reader, viewable, clearance)
 
-        return viewable.flatMap((event) => {
-          if (clearance && readsUnreadable(event, clearance)) return []
+        const readable = clearance
+          ? viewable.filter((event) => !readsUnreadable(event, clearance))
+          : viewable
+        const shown = await visibleUnderConditions(
+          reader,
+          readable,
+          conditions,
+          clearanceFor,
+          history
+        )
 
+        return shown.map((event) => {
           const redacting = clearanceFor(event)
-          return [redacting ? redactDomainEvent(event, redacting) : event]
+          const redacted = redacting ? redactDomainEvent(event, redacting) : event
+          return withoutHiddenPriorState(event, redacted, conditions)
         })
       }
     }
@@ -195,6 +230,8 @@ function readsUnreadable(event: StoredDomainEvent, clearance: PropertyClearance)
     case "objects":
     case "telemetry":
       return clearance.unreadableType(event.payload.objectTypeId) !== undefined
+    case "rules":
+      return clearance.unreadableType(event.payload.subject.objectTypeId) !== undefined
     case "links":
       return (
         clearance.unreadableType(event.payload.sourceTypeId) !== undefined ||

package/src/events/index.ts

@@ -58,6 +58,10 @@ export {
   type SyncEventSelectorContext,
   type SyncEventSelectorEvent,
   type SyncEventToken,
+  type UserEventSelectorBuilder,
+  type UserEventSelectorContext,
+  type UserEventSelectorEvent,
+  type UserEventSelectorOperation,
 } from "./selectors"
 export {
   createDomainEventService,
@@ -73,7 +77,6 @@ export {
   type StableEventEnvelope,
   type StableEventPublisher,
 } from "./service"
-export { toStoredEvent } from "./toStoredEvent"
 export type {
   ActionEventOrigin,
   AuthorableDomainEvent,
@@ -145,6 +148,12 @@ export type {
   TelemetryEvent,
   TelemetryEventOrigin,
   TelemetryEventSource,
+  UserEvent,
+  UserInvitedEvent,
+  UserJoinedEvent,
+  UserProfileUpdatedEvent,
+  UserReactivatedEvent,
+  UserSuspendedEvent,
   WorkflowEvent,
   WorkflowRunFinishedEvent,
   WorkflowRunNodeFinishedEvent,

package/src/events/scope.ts

@@ -50,6 +50,8 @@ export function scopeKeysForEvent(event: DomainEvent): EventScopeKeys {
       return {}
     case "datasets":
       return { datasetId: event.payload.datasetId }
+    case "users":
+      return {}
     default: {
       // Exhaustiveness guard: a new topic must extend the switch above.
       const _exhaustive: never = event