@sixb/core 0.1.19 → 0.1.21

package/src/storage/artifacts/types.ts

@@ -0,0 +1,209 @@
+import type { ArtifactKind } from "../../artifacts/kinds"
+import type { ArtifactOutline } from "../../artifacts/outline"
+import type { ArtifactReference } from "../../artifacts/references"
+import type { Principal } from "../../auth"
+import type { FileRef } from "../../blob-storage"
+
+export type { ArtifactKind, ArtifactOutline, ArtifactReference }
+
+/** A versioned document, sheet, deck, or file. Its kind never changes. */
+export interface ArtifactRecord {
+  readonly projectId: string
+  readonly id: string
+  readonly kind: ArtifactKind
+  /** The latest version's title. */
+  readonly title: string
+  /** Who created the artifact; reading and publishing are decided from it. */
+  readonly owner: Principal
+  readonly latestVersion: number
+  readonly createdAt: Date
+  /** When the latest version was published. */
+  readonly updatedAt: Date
+}
+
+/** One file of a version, at its path inside the artifact. */
+export interface ArtifactFile {
+  /** Relative, with `/` separators and no `.` or `..` segments. */
+  readonly path: string
+  readonly file: FileRef
+}
+
+/** Where a version was published from. Provenance only: reading never depends on it. */
+export interface ArtifactOrigin {
+  readonly threadId: string
+  readonly runId: string
+}
+
+/** One published version. A version never changes once stored. */
+export interface ArtifactVersionRecord {
+  readonly projectId: string
+  readonly artifactId: string
+  readonly version: number
+  readonly title: string
+  /** The path of the file the kind renders from, one of `files`. */
+  readonly entry: string
+  readonly files: readonly ArtifactFile[]
+  readonly outline: ArtifactOutline
+  readonly references: readonly ArtifactReference[]
+  /** Who published this version. */
+  readonly author: Principal
+  readonly origin?: ArtifactOrigin
+  readonly createdAt: Date
+}
+
+/** A version's content before storage numbers it. */
+export type ArtifactVersionInput = Omit<
+  ArtifactVersionRecord,
+  "projectId" | "artifactId" | "version"
+>
+
+export interface CreateArtifactInput {
+  readonly projectId: string
+  readonly id: string
+  readonly kind: ArtifactKind
+  readonly owner: Principal
+  /** Becomes version 1. */
+  readonly version: ArtifactVersionInput
+}
+
+export interface PublishArtifactVersionInput {
+  readonly projectId: string
+  readonly artifactId: string
+  /** Must be the artifact's kind. */
+  readonly kind: ArtifactKind
+  readonly version: ArtifactVersionInput
+}
+
+export interface PublishedArtifactVersion {
+  readonly artifact: ArtifactRecord
+  readonly version: ArtifactVersionRecord
+}
+
+export interface GetArtifactInput {
+  readonly projectId: string
+  readonly id: string
+}
+
+export interface ListArtifactsInput {
+  readonly projectId: string
+  readonly owner?: Principal
+  /** Only artifacts with a version published from this thread. */
+  readonly originThreadId?: string
+  /** Only artifacts of this kind. */
+  readonly kind?: ArtifactKind
+  readonly limit?: number
+  readonly offset?: number
+}
+
+export interface ListArtifactsResult {
+  readonly artifacts: readonly ArtifactRecord[]
+  readonly hasMore: boolean
+  readonly total: number
+}
+
+export interface GetArtifactVersionInput {
+  readonly projectId: string
+  readonly artifactId: string
+  readonly version: number
+}
+
+export interface ListArtifactVersionsInput {
+  readonly projectId: string
+  readonly artifactId: string
+  readonly limit?: number
+  readonly offset?: number
+}
+
+export interface ListArtifactVersionsResult {
+  readonly versions: readonly ArtifactVersionRecord[]
+  readonly hasMore: boolean
+  readonly total: number
+}
+
+export interface DeleteArtifactInput {
+  readonly projectId: string
+  readonly id: string
+}
+
+export interface ListReferencingVersionsInput {
+  readonly projectId: string
+  /** The artifact the versions refer to. */
+  readonly artifactId: string
+}
+
+/**
+ * A short-lived link to one version, which a sandboxed frame loads a deck's files through. Only
+ * the SHA-256 of the link's token is stored; the token is the credential.
+ */
+export interface ArtifactFrameGrantRecord {
+  readonly projectId: string
+  /** SHA-256 hex of the token. */
+  readonly tokenHash: string
+  readonly artifactId: string
+  readonly version: number
+  /** What the frame may show from other artifacts, decided for its reader when it was issued. */
+  readonly targets: readonly ArtifactFrameTarget[]
+  readonly createdAt: Date
+  readonly expiresAt: Date
+}
+
+/** An address a version embeds, and the version of its target a frame shows. */
+export interface ArtifactFrameTarget {
+  readonly address: string
+  readonly artifactId: string
+  readonly version: number
+}
+
+export interface FindArtifactFrameGrantInput {
+  readonly projectId: string
+  readonly tokenHash: string
+}
+
+export interface DeleteExpiredArtifactFrameGrantsInput {
+  readonly projectId: string
+  readonly expiredBefore: Date
+  readonly limit: number
+}
+
+export interface DeleteArtifactVersionsByOriginInput {
+  readonly projectId: string
+  readonly runId: string
+}
+
+/**
+ * Persistence only: who may read or publish, and what a version may contain, are decided in Core
+ * before a call reaches storage.
+ */
+export interface ArtifactStorage {
+  /** Creates the artifact with its first version. Throws `artifact_exists` when the id is taken. */
+  create(input: CreateArtifactInput): Promise<PublishedArtifactVersion>
+  /**
+   * Stores the next version and makes it the latest. Throws `artifact_not_found` or
+   * `artifact_kind_mismatch`. A version number is never reused, even after its version is deleted.
+   */
+  publish(input: PublishArtifactVersionInput): Promise<PublishedArtifactVersion>
+  get(input: GetArtifactInput): Promise<ArtifactRecord | null>
+  /** Most recently updated first. */
+  list(input: ListArtifactsInput): Promise<ListArtifactsResult>
+  getVersion(input: GetArtifactVersionInput): Promise<ArtifactVersionRecord | null>
+  /** Newest first. */
+  listVersions(input: ListArtifactVersionsInput): Promise<ListArtifactVersionsResult>
+  /**
+   * The latest version of each artifact whose latest version has an address to this artifact, so
+   * a new version can tell which artifacts it breaks. Ordered by artifact id.
+   */
+  listReferencingVersions(input: ListReferencingVersionsInput): Promise<ArtifactVersionRecord[]>
+  /** Stores a frame grant. Throws `artifact_not_found` when its artifact does not exist. */
+  createFrameGrant(record: ArtifactFrameGrantRecord): Promise<void>
+  /** Returns expired grants too; the caller decides whether one still serves. */
+  findFrameGrant(input: FindArtifactFrameGrantInput): Promise<ArtifactFrameGrantRecord | null>
+  /** Deletes up to `limit` grants that expired before `expiredBefore`, and returns the count. */
+  deleteExpiredFrameGrants(input: DeleteExpiredArtifactFrameGrantsInput): Promise<number>
+  /** Deletes the artifact, every version, and its frame grants. `false` when it does not exist. */
+  delete(input: DeleteArtifactInput): Promise<boolean>
+  /**
+   * Deletes the versions a run published and returns how many. An artifact left without versions
+   * is deleted; one that lost its latest version points at its newest remaining one.
+   */
+  deleteVersionsByOrigin(input: DeleteArtifactVersionsByOriginInput): Promise<number>
+}

package/src/storage/auth/in-memory/auth-storage.ts

@@ -222,7 +222,6 @@ export class InMemoryAuthStorage implements AuthStorage {
     }
 
     validateCompleteSessionInput(this.state, projectId, input.session)
-    assertSignInSessionAudience(projectId, input.session.audience, magicLink.audience)
 
     let newUserId: string | undefined
     if (shouldCreateUser) {
@@ -353,7 +352,6 @@ export class InMemoryAuthStorage implements AuthStorage {
     }
 
     validateCompleteSessionInput(this.state, projectId, input.session)
-    assertSignInSessionAudience(projectId, input.session.audience, attempt.audience)
 
     let newUserId: string | undefined
     if (shouldCreateUser) {
@@ -555,7 +553,6 @@ export class InMemoryAuthStorage implements AuthStorage {
       projectId: input.projectId,
       userId: input.userId,
       strategyId: input.strategyId,
-      audience: input.session.audience,
       tokenHash: input.session.tokenHash,
       createdAt: input.session.createdAt,
       expiresAt: input.session.expiresAt,
@@ -587,18 +584,3 @@ function restoreMap<TKey, TValue>(target: Map<TKey, TValue>, snapshot: Map<TKey,
     target.set(key, value)
   }
 }
-
-function assertSignInSessionAudience(
-  projectId: string,
-  sessionAudience: string,
-  storedAudience: string
-): void {
-  if (sessionAudience === storedAudience) {
-    return
-  }
-
-  throw new AuthStorageError(
-    "invalid_input",
-    `[Sixb] Sign-in session audience '${sessionAudience}' does not match stored auth audience '${storedAudience}' for project '${projectId}'.`
-  )
-}

package/src/storage/auth/in-memory/magic-links.ts

@@ -1,4 +1,3 @@
-import { resolveAuthSessionAudience } from "../../../auth/audience"
 import { AuthStorageError } from "../errors"
 import type { AuthMagicLinkStore, CreateAuthMagicLinkInput, MagicLinkRecord } from "../types"
 import type { AuthStorageState } from "./shared"
@@ -22,7 +21,6 @@ export class InMemoryAuthMagicLinkStore implements AuthMagicLinkStore {
     const id = assertNonEmpty(input.id, "Magic link id")
     const projectId = assertNonEmpty(input.projectId, "Project id")
     const strategyId = assertNonEmpty(input.strategyId, "Strategy id")
-    const audience = resolveAuthSessionAudience(input.audience)
     const email = normalizeEmail(input.email)
     const tokenHash = assertNonEmpty(input.tokenHash, "Magic link token hash")
     const key = magicLinkKey(projectId, id)
@@ -40,7 +38,6 @@ export class InMemoryAuthMagicLinkStore implements AuthMagicLinkStore {
       id,
       projectId,
       strategyId,
-      audience,
       email,
       tokenHash,
       returnTo: input.returnTo,

package/src/storage/auth/in-memory/oidc-attempts.ts

@@ -1,4 +1,3 @@
-import { resolveAuthSessionAudience } from "../../../auth/audience"
 import { AuthStorageError } from "../errors"
 import type {
   AuthOidcAuthorizationAttemptStore,
@@ -26,7 +25,6 @@ export class InMemoryAuthOidcAuthorizationAttemptStore
     const id = assertNonEmpty(input.id, "OIDC authorization attempt id")
     const projectId = assertNonEmpty(input.projectId, "Project id")
     const strategyId = assertNonEmpty(input.strategyId, "Strategy id")
-    const audience = resolveAuthSessionAudience(input.audience)
     const stateHash = assertNonEmpty(input.stateHash, "OIDC state hash")
     const nonceHash = assertNonEmpty(input.nonceHash, "OIDC nonce hash")
     const codeVerifier = assertNonEmpty(input.codeVerifier, "OIDC code verifier")
@@ -43,7 +41,6 @@ export class InMemoryAuthOidcAuthorizationAttemptStore
       id,
       projectId,
       strategyId,
-      audience,
       stateHash,
       nonceHash,
       codeVerifier,

package/src/storage/auth/in-memory/sessions.ts

@@ -1,8 +1,9 @@
-import type { AuthSessionAudience } from "../../../auth/audience"
 import { AuthStorageError } from "../errors"
 import type {
   AuthSessionStore,
   CreateAuthSessionInput,
+  ListAuthSessionsInput,
+  ListAuthSessionsResult,
   RotateSessionRefreshTokenResult,
   SessionRecord,
 } from "../types"
@@ -11,7 +12,6 @@ import {
   cloneDate,
   cloneOptionalRecord,
   cloneRecord,
-  compareByCreatedAt,
   createSessionRecord,
   isActiveSession,
   revokeActiveSessionsForUser,
@@ -33,22 +33,6 @@ export class InMemoryAuthSessionStore implements AuthSessionStore {
     return cloneOptionalRecord(record)
   }
 
-  async getActiveByUserId(params: {
-    readonly projectId: string
-    readonly userId: string
-    readonly audience: AuthSessionAudience
-    readonly now: Date
-  }): Promise<SessionRecord | null> {
-    const sessions = [...this.state.sessions.values()]
-      .filter((session) => session.projectId === params.projectId)
-      .filter((session) => session.userId === params.userId)
-      .filter((session) => session.audience === params.audience)
-      .filter((session) => isActiveSession(session, params.now))
-      .sort((a, b) => compareByCreatedAt(a, b, "desc"))
-
-    return cloneOptionalRecord(sessions[0] ?? null)
-  }
-
   async listActiveByUserId(params: {
     readonly projectId: string
     readonly userId: string
@@ -68,10 +52,28 @@ export class InMemoryAuthSessionStore implements AuthSessionStore {
       .map(cloneRecord)
   }
 
+  async listByUserId(params: ListAuthSessionsInput): Promise<ListAuthSessionsResult> {
+    const before = params.before
+    const offset = before?.skip ?? 0
+    const sessions = [...this.state.sessions.values()]
+      .filter((session) => session.projectId === params.projectId)
+      .filter((session) => session.userId === params.userId)
+      .filter((session) => !before || session.createdAt <= before.createdAt)
+      .sort((a, b) => {
+        const created = b.createdAt.getTime() - a.createdAt.getTime()
+        if (created !== 0) return created
+        return a.id < b.id ? 1 : a.id > b.id ? -1 : 0
+      })
+
+    return {
+      sessions: sessions.slice(offset, offset + params.limit).map(cloneRecord),
+      hasMore: sessions.length > offset + params.limit,
+    }
+  }
+
   async findValidByTokenHash(params: {
     readonly projectId: string
     readonly id: string
-    readonly audience: AuthSessionAudience
     readonly tokenHash: string
     readonly now: Date
   }): Promise<SessionRecord | null> {
@@ -79,7 +81,6 @@ export class InMemoryAuthSessionStore implements AuthSessionStore {
     if (
       !session ||
       session.bearer ||
-      session.audience !== params.audience ||
       session.tokenHash !== params.tokenHash ||
       !isActiveSession(session, params.now)
     ) {
@@ -153,7 +154,6 @@ export class InMemoryAuthSessionStore implements AuthSessionStore {
   async renewIfValid(params: {
     readonly projectId: string
     readonly id: string
-    readonly audience: AuthSessionAudience
     readonly tokenHash: string
     readonly now: Date
     readonly expiresAt: Date
@@ -163,7 +163,6 @@ export class InMemoryAuthSessionStore implements AuthSessionStore {
     if (
       !session ||
       session.bearer ||
-      session.audience !== params.audience ||
       session.tokenHash !== params.tokenHash ||
       !isActiveSession(session, params.now)
     ) {
@@ -208,15 +207,13 @@ export class InMemoryAuthSessionStore implements AuthSessionStore {
   async revokeActiveForUser(params: {
     readonly projectId: string
     readonly userId: string
-    readonly audience?: AuthSessionAudience
     readonly revokedAt: Date
   }): Promise<readonly SessionRecord[]> {
     return revokeActiveSessionsForUser(
       this.state,
       params.projectId,
       params.userId,
-      params.revokedAt,
-      params.audience
+      params.revokedAt
     ).map(cloneRecord)
   }
 

package/src/storage/auth/in-memory/shared.ts

@@ -1,4 +1,3 @@
-import { type AuthSessionAudience, resolveAuthSessionAudience } from "../../../auth/audience"
 import { AuthStorageError } from "../errors"
 import type {
   AccessTokenRecord,
@@ -213,8 +212,7 @@ export function revokeActiveSessionsForUser(
   state: AuthStorageState,
   projectId: string,
   userId: string,
-  revokedAt: Date,
-  audience?: AuthSessionAudience
+  revokedAt: Date
 ): readonly SessionRecord[] {
   const revoked: SessionRecord[] = []
 
@@ -223,10 +221,6 @@ export function revokeActiveSessionsForUser(
       continue
     }
 
-    if (audience !== undefined && session.audience !== audience) {
-      continue
-    }
-
     if (!isActiveSession(session, revokedAt)) {
       continue
     }
@@ -290,7 +284,6 @@ export function validateCompleteSessionInput(
   session: CompleteAuthSessionInput
 ): void {
   const sessionId = assertNonEmpty(session.id, "Session id")
-  assertNonEmpty(session.audience, "Session audience")
   assertNonEmpty(session.tokenHash, "Session token hash")
   assertSessionIdAvailable(state, projectId, sessionId)
 }
@@ -303,7 +296,6 @@ export function createSessionRecord(
   const projectId = assertNonEmpty(input.projectId, "Project id")
   const userId = assertNonEmpty(input.userId, "User id")
   const strategyId = assertNonEmpty(input.strategyId, "Strategy id")
-  const audience = resolveAuthSessionAudience(input.audience)
   const tokenHash = assertNonEmpty(input.tokenHash, "Session token hash")
 
   assertSessionIdAvailable(state, projectId, id)
@@ -313,7 +305,6 @@ export function createSessionRecord(
     projectId,
     userId,
     strategyId,
-    audience,
     tokenHash,
     createdAt: cloneDate(input.createdAt),
     expiresAt: cloneDate(input.expiresAt),

package/src/storage/auth/index.ts

@@ -42,6 +42,8 @@ export type {
   ListAuthInvitationsResult,
   ListAuthServiceAccountsInput,
   ListAuthServiceAccountsResult,
+  ListAuthSessionsInput,
+  ListAuthSessionsResult,
   ListAuthUsersInput,
   ListAuthUsersResult,
   MagicLinkRecord,

package/src/storage/auth/types.ts

@@ -1,4 +1,4 @@
-import type { AccessTokenKind, AuthSessionAudience, Principal } from "../../auth"
+import type { AccessTokenKind, Principal } from "../../auth"
 import type { AuthorizablePrincipal } from "../../execution/types"
 
 export type UserStatus = "active" | "suspended"
@@ -57,7 +57,6 @@ export interface SessionRecord {
   readonly userId: string
   readonly strategyId: string
   /** The web app a browser session belongs to. A bearer session belongs to none and ignores it. */
-  readonly audience: AuthSessionAudience
   readonly tokenHash: string
   readonly createdAt: Date
   readonly expiresAt: Date
@@ -142,7 +141,6 @@ export interface MagicLinkRecord {
   readonly id: string
   readonly projectId: string
   readonly strategyId: string
-  readonly audience: AuthSessionAudience
   readonly email: string
   readonly tokenHash: string
   readonly returnTo?: string
@@ -156,7 +154,6 @@ export interface OidcAuthorizationAttemptRecord {
   readonly id: string
   readonly projectId: string
   readonly strategyId: string
-  readonly audience: AuthSessionAudience
   readonly stateHash: string
   readonly nonceHash: string
   readonly codeVerifier: string
@@ -288,7 +285,6 @@ export interface CreateAuthSessionInput {
   readonly projectId: string
   readonly userId: string
   readonly strategyId: string
-  readonly audience: AuthSessionAudience
   readonly tokenHash: string
   readonly createdAt: Date
   readonly expiresAt: Date
@@ -328,9 +324,24 @@ export interface ListAuthAccessTokensResult {
   readonly total: number
 }
 
+export interface ListAuthSessionsInput {
+  readonly projectId: string
+  readonly userId: string
+  readonly limit: number
+  /**
+   * Continue a list: sessions created at or before `createdAt`, past the first `skip` of those
+   * created exactly then, which the previous pages returned.
+   */
+  readonly before?: { readonly createdAt: Date; readonly skip: number }
+}
+
+export interface ListAuthSessionsResult {
+  readonly sessions: readonly SessionRecord[]
+  readonly hasMore: boolean
+}
+
 export interface CompleteAuthSessionInput {
   readonly id: string
-  readonly audience: AuthSessionAudience
   readonly tokenHash: string
   readonly createdAt: Date
   readonly expiresAt: Date
@@ -379,7 +390,6 @@ export interface CreateAuthMagicLinkInput {
   readonly id: string
   readonly projectId: string
   readonly strategyId: string
-  readonly audience: AuthSessionAudience
   readonly email: string
   readonly tokenHash: string
   readonly returnTo?: string
@@ -391,7 +401,6 @@ export interface CreateOidcAuthorizationAttemptInput {
   readonly id: string
   readonly projectId: string
   readonly strategyId: string
-  readonly audience: AuthSessionAudience
   readonly stateHash: string
   readonly nonceHash: string
   readonly codeVerifier: string
@@ -536,24 +545,19 @@ export interface AuthSessionStore {
     readonly projectId: string
     readonly id: string
   }): Promise<SessionRecord | null>
-  getActiveByUserId(params: {
-    readonly projectId: string
-    readonly userId: string
-    readonly audience: AuthSessionAudience
-    readonly now: Date
-  }): Promise<SessionRecord | null>
-  // All active sessions for a user across every audience, most-recently-active
+  // All active sessions for a user, most-recently-active
   // first. Backs the active-sessions view.
   listActiveByUserId(params: {
     readonly projectId: string
     readonly userId: string
     readonly now: Date
   }): Promise<readonly SessionRecord[]>
+  /** Every session of a user, revoked and expired ones too, newest first: a sign-in history. */
+  listByUserId(params: ListAuthSessionsInput): Promise<ListAuthSessionsResult>
   /** A live browser (cookie) session whose secret hashes to `tokenHash`. */
   findValidByTokenHash(params: {
     readonly projectId: string
     readonly id: string
-    readonly audience: AuthSessionAudience
     readonly tokenHash: string
     readonly now: Date
   }): Promise<SessionRecord | null>
@@ -585,7 +589,6 @@ export interface AuthSessionStore {
   renewIfValid(params: {
     readonly projectId: string
     readonly id: string
-    readonly audience: AuthSessionAudience
     readonly tokenHash: string
     readonly now: Date
     readonly expiresAt: Date
@@ -598,7 +601,6 @@ export interface AuthSessionStore {
   revokeActiveForUser(params: {
     readonly projectId: string
     readonly userId: string
-    readonly audience?: AuthSessionAudience
     readonly revokedAt: Date
   }): Promise<readonly SessionRecord[]>
   touch(params: {

package/src/storage/executions/in-memory.ts

@@ -1,7 +1,14 @@
 import type { AuthStorage } from "../auth"
 import type { ShareSessionStorage } from "../share-sessions"
 import { ExecutionStorageError } from "./errors"
-import type { CreateExecutionInput, ExecutionRecord, ExecutionStorage } from "./types"
+import { compareExecutionCreation } from "./provider"
+import type {
+  CreateExecutionInput,
+  ExecutionRecord,
+  ExecutionStorage,
+  ListSessionExecutionsInput,
+  SessionExecutions,
+} from "./types"
 import { cloneExecutionRecord, prepareExecutionRecord } from "./validation"
 
 type RunRootOperation = <T>(run: () => Promise<T> | T) => Promise<T>
@@ -73,6 +80,59 @@ export class InMemoryExecutionStorage implements ExecutionStorage {
       return record ? cloneExecutionRecord(record) : null
     })
   }
+
+  async listBySession(input: ListSessionExecutionsInput): Promise<SessionExecutions> {
+    return this.runRootOperation(() => {
+      const rows = [...this.rows.values()].filter((row) => row.projectId === input.projectId)
+
+      const roots = rows
+        .filter(
+          (row) =>
+            row.source.type !== "execution" &&
+            row.createdAt >= input.from &&
+            row.createdAt < input.to &&
+            isFromSession(row, input.session)
+        )
+        .sort(compareExecutionCreation)
+        .slice(0, input.limit + 1)
+
+      // Level by level, as the SQL providers walk the tree, so truncation keeps roots first.
+      const found = [...roots]
+      let level = roots
+      while (level.length > 0 && found.length <= input.limit) {
+        const parents = new Set(level.map((row) => row.id))
+        level = rows
+          .filter((row) => row.source.type === "execution" && parents.has(row.source.executionId))
+          .sort(compareExecutionCreation)
+        found.push(...level)
+      }
+
+      return {
+        executions: found
+          .slice(0, input.limit)
+          .sort(compareExecutionCreation)
+          .map(cloneExecutionRecord),
+        truncated: found.length > input.limit,
+      }
+    })
+  }
+}
+
+function isFromSession(
+  row: ExecutionRecord,
+  session: ListSessionExecutionsInput["session"]
+): boolean {
+  const ref = row.authorizationRef
+
+  if (session.type === "user") {
+    return (
+      ref.type === "principal" &&
+      ref.credential?.type === "session" &&
+      ref.credential.id === session.id
+    )
+  }
+
+  return ref.type === "delegated" && ref.delegation.sessionId === session.id
 }
 
 export type InMemoryExecutionStorageSnapshot = Map<string, ExecutionRecord>

package/src/storage/executions/index.ts

@@ -12,5 +12,8 @@ export type {
   DurableExecutionExecutor,
   DurableExecutionSource,
   ExecutionRecord,
+  ExecutionSessionRef,
   ExecutionStorage,
+  ListSessionExecutionsInput,
+  SessionExecutions,
 } from "./types"

package/src/storage/executions/provider.ts

@@ -11,6 +11,18 @@ export {
   validateExecutionRecordReferences,
 } from "./validation"
 
+/** Oldest first, then by id compared byte by byte: the order `listBySession` returns. */
+export function compareExecutionCreation(
+  left: Pick<ExecutionRecord, "createdAt" | "id">,
+  right: Pick<ExecutionRecord, "createdAt" | "id">
+): number {
+  const byTime = left.createdAt.getTime() - right.createdAt.getTime()
+  if (byTime !== 0) {
+    return byTime
+  }
+  return left.id < right.id ? -1 : left.id > right.id ? 1 : 0
+}
+
 /** Provider-neutral flattened representation used by the SQL adapters. */
 export interface ExecutionStorageRow {
   readonly projectId: string