ai-workflow-logic 0.1.3 → 0.1.5

package/src/run-freeze.ts

@@ -1,5 +1,6 @@
 import type {
   AIAgentDefinitionProjection,
+  FrozenAIAgentTaskBinding,
   AIWorkflowAgentResourceProjection,
   AIWorkflowAgentTaskRef,
   AIWorkflowResourceProjectionDiagnostic,
@@ -9,11 +10,15 @@ import type {
 } from 'ai-workflow-contract';
 import {
   buildResourceDependencySnapshot,
+  composeLayeredResourceRegistry,
+  loadResourceTree,
+  resolveEffectiveResourceContentIdentities,
   sha256Digest,
   type EffectiveResourceRegistry,
   type ResourceContentIdentity,
   type ResourceDependencyEdge,
 } from 'halfcode-compiler.xnl/resource-core';
+import { projectAIWorkflowAgentResources } from './agent-resources.js';
 import { sourceRegistryForAIWorkflowAgentResourceProjection } from './agent-resource-brand.js';
 
 export interface FreezeAIWorkflowRunResourcesInput {
@@ -23,6 +28,22 @@ export interface FreezeAIWorkflowRunResourcesInput {
   readonly contentIdentities: ReadonlyMap<string, ResourceContentIdentity>;
 }
 
+/** Filesystem adapter that builds an authentic receipt from one complete resource package. */
+export async function freezeAIWorkflowRunResourcesFromDirectory(
+  rootDir: string,
+  task: AIWorkflowAgentTaskRef,
+): Promise<AIWorkflowRunResourceFreezeReceipt> {
+  const tree = await loadResourceTree({ rootDir });
+  const layers = [{ id: 'workspace', tree }] as const;
+  const registry = composeLayeredResourceRegistry({ layers });
+  return freezeAIWorkflowRunResources({
+    registry,
+    projection: projectAIWorkflowAgentResources(registry),
+    task,
+    contentIdentities: resolveEffectiveResourceContentIdentities({ registry, layers }),
+  });
+}
+
 export class AIWorkflowRunResourceFreezeError extends Error {
   constructor(public readonly diagnostics: readonly AIWorkflowResourceProjectionDiagnostic[]) {
     super(`AI workflow run resource freeze failed with ${diagnostics.length} diagnostic(s)`);
@@ -30,6 +51,9 @@ export class AIWorkflowRunResourceFreezeError extends Error {
   }
 }
 
+const authenticFreezeReceipts = new WeakSet<object>();
+const authenticTaskBindings = new WeakSet<object>();
+
 export function freezeAIWorkflowRunResources(
   input: FreezeAIWorkflowRunResourcesInput,
 ): AIWorkflowRunResourceFreezeReceipt {
@@ -85,13 +109,45 @@ export function freezeAIWorkflowRunResources(
     dependencySnapshot.closure,
     dependencySnapshot.edges,
   );
-  return Object.freeze({
+  const receipt = Object.freeze({
     schemaVersion: 'ai-workflow.run-resource-freeze/v1',
     task: frozenTask,
     bindingResourceIds,
     dependencySnapshot,
     semanticFingerprint,
   });
+  authenticFreezeReceipts.add(receipt);
+  return receipt;
+}
+
+/** Projects a dispatch proof only from the exact receipt produced by this run-freeze boundary. */
+export function projectFrozenAIAgentTaskBinding(
+  receipt: AIWorkflowRunResourceFreezeReceipt,
+): FrozenAIAgentTaskBinding {
+  if (!authenticFreezeReceipts.has(receipt as object)) {
+    throw new AIWorkflowRunResourceFreezeError(Object.freeze([
+      diagnostic('AI_RUN_RESOURCE_FREEZE_RECEIPT_UNTRUSTED', 'run-freeze:receipt', 'Task proof requires the authentic receipt produced by run freeze.'),
+    ]));
+  }
+  const binding = Object.freeze({
+    schemaVersion: 'ai-workflow.frozen-agent-task-binding/v1' as const,
+    task: receipt.task,
+    semanticFingerprint: receipt.semanticFingerprint,
+    snapshotRevision: receipt.dependencySnapshot.snapshotRevision,
+    closureResourceIds: Object.freeze(receipt.dependencySnapshot.closure.map((item) => item.resourceId)),
+  });
+  authenticTaskBindings.add(binding);
+  return binding;
+}
+
+/** Runtime assertion; a structurally similar literal is not an admitted authority. */
+export function assertFrozenAIAgentTaskBinding(value: FrozenAIAgentTaskBinding): FrozenAIAgentTaskBinding {
+  if (!authenticTaskBindings.has(value as object)) {
+    throw new AIWorkflowRunResourceFreezeError(Object.freeze([
+      diagnostic('AI_RUN_AGENT_TASK_PROOF_UNTRUSTED', 'run-freeze:task-proof', 'Agent task binding was not projected from an authentic run-freeze receipt.'),
+    ]));
+  }
+  return value;
 }
 
 function validateAndOrderBindings(