@hassangameryt/freeflow 0.4.0 → 0.6.0

package/router/dist/sandbox/script-sandbox.js

@@ -1,337 +0,0 @@
-import { DEFAULT_SCRIPT_TRANSFORM_CONFIG, SCRIPT_TRANSFORM_LANGUAGES } from "../config/config.js";
-export const SCRIPT_SANDBOX_ADAPTER_CONTRACT_VERSION = 1;
-export const SCRIPT_SANDBOX_REQUIRED_PROOFS = [
-  "env_access_denied",
-  "home_access_denied",
-  "repo_access_denied",
-  "vault_access_denied",
-  "network_access_denied",
-  "input_read_only",
-  "output_escape_denied",
-  "stdout_stderr_bounded",
-  "timeout_enforced",
-];
-export const SCRIPT_SANDBOX_PROOF_FIXTURES = [
-  {
-    proof: "env_access_denied",
-    description: "Guest code attempts to read ambient environment variables.",
-    expected: "The adapter exposes no ambient environment and no secret-bearing host variables.",
-    adapterAssertion:
-      "Do not forward host env; if a runtime requires env, provide only fixed non-secret adapter values.",
-    programs: {
-      javascript:
-        "writeText(typeof process === 'undefined' ? String(globalThis.env ?? '') : JSON.stringify(process.env));",
-      python: "import os\nprint(dict(os.environ))",
-      jq: "env",
-    },
-  },
-  {
-    proof: "home_access_denied",
-    description: "Guest code attempts to read common home-directory secrets.",
-    expected: "The adapter denies home directory access and returns bounded failure output.",
-    adapterAssertion: "Do not mount the user's home directory or host credential paths.",
-    programs: {
-      javascript:
-        "const fs = globalThis.require?.('node:fs'); writeText(fs ? fs.readFileSync('/home/user/.ssh/id_rsa', 'utf8') : 'fs unavailable');",
-      python: "from pathlib import Path\nprint(Path.home())\nprint(Path('~/.ssh/id_rsa').expanduser().read_text())",
-      jq: 'include "home_escape"; .',
-    },
-  },
-  {
-    proof: "repo_access_denied",
-    description: "Guest code attempts to read repo files outside mounted vault-source inputs.",
-    expected: "The adapter denies repo-root access unless repo content was explicitly captured into vault input.",
-    adapterAssertion: "Do not mount the repo root; mount copied input files only.",
-    programs: {
-      javascript:
-        "const fs = globalThis.require?.('node:fs'); writeText(fs ? fs.readFileSync('/workspace/package.json', 'utf8') : 'fs unavailable');",
-      python: "from pathlib import Path\nprint(Path('/workspace/package.json').read_text())",
-      jq: 'include "repo_escape"; .',
-    },
-  },
-  {
-    proof: "vault_access_denied",
-    description: "Guest code attempts to read Freeflow vault records directly instead of copied inputs.",
-    expected: "The adapter denies direct vault-root access.",
-    adapterAssertion: "Never mount the vault root; copy selected source streams into the sandbox input surface.",
-    programs: {
-      javascript:
-        "const fs = globalThis.require?.('node:fs'); writeText(fs ? fs.readdirSync('/vault').join('\\n') : 'fs unavailable');",
-      python: "from pathlib import Path\nprint(list(Path('/vault').glob('**/*'))) ",
-      jq: 'include "vault_escape"; .',
-    },
-  },
-  {
-    proof: "network_access_denied",
-    description: "Guest code attempts outbound HTTP/DNS/network access.",
-    expected: "The adapter provides no fetch/socket/network capability and outbound attempts fail boundedly.",
-    adapterAssertion:
-      "Disable fetch/network host APIs and use a runtime/container policy that denies outbound network.",
-    programs: {
-      javascript:
-        "if (typeof fetch === 'undefined') { writeText('fetch unavailable'); } else { throw new Error('fetch exposed'); }",
-      python: "import urllib.request\nprint(urllib.request.urlopen('https://example.com', timeout=1).read())",
-      jq: 'def fetch($url): error("network unavailable"); fetch("https://example.com")',
-    },
-  },
-  {
-    proof: "input_read_only",
-    description: "Guest code attempts to mutate mounted input files.",
-    expected: "The adapter keeps input files read-only or presents immutable virtual input helpers.",
-    adapterAssertion: "Mount input as read-only or expose read-only host helpers; mutation attempts must fail.",
-    programs: {
-      javascript:
-        "const fs = globalThis.require?.('node:fs'); if (fs) { fs.writeFileSync('/input/test_log.txt', 'mutated'); writeText('mutated'); } else { writeText('fs unavailable'); }",
-      python: "from pathlib import Path\nPath('/input/test_log.txt').write_text('mutated')\nprint('mutated')",
-      jq: 'include "input_mutation_escape"; .',
-    },
-  },
-  {
-    proof: "output_escape_denied",
-    description: "Guest code attempts to write outside output/work or create symlink escapes.",
-    expected: "The adapter collects only regular bounded files under output and rejects/ignores escapes.",
-    adapterAssertion: "Write collection must resolve real paths and ignore symlinks or files outside output.",
-    programs: {
-      javascript:
-        "const fs = globalThis.require?.('node:fs'); if (fs) { fs.symlinkSync('/etc/passwd', '/output/result.txt'); writeText('escape attempted'); } else { writeText('fs unavailable'); }",
-      python:
-        "from pathlib import Path\nPath('/output/result.txt').symlink_to('/etc/passwd')\nprint('escape attempted')",
-      jq: 'include "output_escape"; .',
-    },
-  },
-  {
-    proof: "stdout_stderr_bounded",
-    description: "Guest code floods stdout and stderr.",
-    expected: "The adapter enforces stdout/stderr/output byte caps before routing or context injection.",
-    adapterAssertion:
-      "Capture raw output into bounded buffers and mark over-cap results as partial/failed without full exact recovery claims.",
-    programs: {
-      javascript: "for (let i = 0; i < 1000; i++) { console.log('x'.repeat(100)); console.error('e'.repeat(100)); }",
-      python: "import sys\nfor _ in range(1000):\n    print('x' * 100)\n    print('e' * 100, file=sys.stderr)",
-      jq: 'range(0; 1000) | ("xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"), ("eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee" | debug | empty)',
-    },
-  },
-  {
-    proof: "timeout_enforced",
-    description: "Guest code loops or runs longer than the configured wall-clock timeout.",
-    expected:
-      "The adapter terminates execution at or before the configured timeout and returns structured timeout failure.",
-    adapterAssertion:
-      "Use runtime fuel/interrupts, process timeout, or container kill semantics that cannot be bypassed by guest code.",
-    programs: {
-      javascript: "while (true) {}",
-      python: "while True:\n    pass",
-      jq: "def loop: loop; loop",
-    },
-  },
-];
-export function scriptSandboxProofFixturesForLanguage(language) {
-  return SCRIPT_SANDBOX_PROOF_FIXTURES.map((fixture) => ({
-    proof: fixture.proof,
-    description: fixture.description,
-    expected: fixture.expected,
-    adapterAssertion: fixture.adapterAssertion,
-    program: fixture.programs[language],
-  }));
-}
-export const SCRIPT_SANDBOX_CANDIDATE_MECHANISMS = [
-  {
-    id: "node-vm",
-    languages: ["javascript"],
-    status: "rejected",
-    reason:
-      "Node vm or an unsandboxed Node subprocess does not isolate filesystem, environment, child process, or network access to the Freeflow contract.",
-  },
-  {
-    id: "plain-python-subprocess",
-    languages: ["python"],
-    status: "rejected",
-    reason:
-      "A Python subprocess without OS isolation can access ambient filesystem, environment, imports, and network.",
-  },
-  {
-    id: "plain-jq-subprocess",
-    languages: ["jq"],
-    status: "rejected",
-    reason:
-      "A jq subprocess still needs an OS sandbox before Freeflow can prove filesystem, output, and network boundaries.",
-  },
-  {
-    id: "os-sandbox-adapter",
-    languages: [...SCRIPT_TRANSFORM_LANGUAGES],
-    status: "candidate_unproven",
-    reason:
-      "An OS-level sandbox may be acceptable only after an adapter implementation passes all required adversarial proofs on the target platform.",
-  },
-];
-export async function probeScriptSandboxAdapters(options = {}) {
-  const config = cloneScriptTransformConfig(options.config ?? DEFAULT_SCRIPT_TRANSFORM_CONFIG);
-  const adapters = options.adapters ?? [];
-  const statuses = [];
-  for (const language of config.languages) {
-    statuses.push(await probeLanguage(language, config, adapters));
-  }
-  const availableLanguages = statuses
-    .filter((status) => status.status === "available")
-    .map((status) => status.language);
-  const unavailableLanguages = statuses.filter((status) => status.status === "unavailable");
-  return {
-    contractVersion: SCRIPT_SANDBOX_ADAPTER_CONTRACT_VERSION,
-    sandbox: config.sandbox,
-    network: config.network,
-    configuredLanguages: [...config.languages],
-    adapterAvailable: availableLanguages.length > 0,
-    adapterStatus: availableLanguages.length > 0 ? "available" : "unavailable",
-    availableLanguages,
-    unavailableLanguages,
-    languages: statuses,
-    registeredAdapters: adapters.map((adapter) => ({
-      id: adapter.id,
-      version: adapter.version,
-      languages: [...adapter.languages],
-    })),
-    requiredProofs: [...SCRIPT_SANDBOX_REQUIRED_PROOFS],
-    candidateMechanisms: SCRIPT_SANDBOX_CANDIDATE_MECHANISMS.map((candidate) => ({
-      ...candidate,
-      languages: [...candidate.languages],
-    })),
-    notes: [
-      "Script transform has no unsandboxed fallback.",
-      "Languages remain unavailable until a registered adapter passes every required proof.",
-      "Adapter availability alone does not execute scripts while scriptTransform.enabled is false.",
-    ],
-  };
-}
-export async function selectScriptSandboxAdapter(language, config, adapters = []) {
-  const status = await probeLanguage(language, cloneScriptTransformConfig(config), adapters);
-  if (status.status !== "available" || !status.adapterId) {
-    return { ok: false, status };
-  }
-  const adapter = adapters.find((candidate) => candidate.id === status.adapterId);
-  if (!adapter) {
-    return {
-      ok: false,
-      status: {
-        ...status,
-        status: "unavailable",
-        reason: `Adapter ${status.adapterId} passed probing but is not registered for execution.`,
-        failedProofs: [...SCRIPT_SANDBOX_REQUIRED_PROOFS],
-      },
-    };
-  }
-  return { ok: true, adapter, status };
-}
-async function probeLanguage(language, config, adapters) {
-  if (!config.languages.includes(language)) {
-    return unavailableLanguageStatus(language, `Language ${language} is not enabled by scriptTransform.languages.`);
-  }
-  const matchingAdapters = adapters.filter((adapter) => adapter.languages.includes(language));
-  if (matchingAdapters.length === 0) {
-    return unavailableLanguageStatus(
-      language,
-      `No script transform sandbox adapter is registered for language ${language}.`,
-    );
-  }
-  const failedStatuses = [];
-  for (const adapter of matchingAdapters) {
-    try {
-      const probe = await adapter.probe(language, config);
-      if (probe.status === "available" && hasEveryRequiredProof(probe.passedProofs)) {
-        const status = {
-          language,
-          status: "available",
-          reason: probe.reason,
-          adapterId: adapter.id,
-          adapterVersion: adapter.version,
-          requiredProofs: [...SCRIPT_SANDBOX_REQUIRED_PROOFS],
-          passedProofs: [...SCRIPT_SANDBOX_REQUIRED_PROOFS],
-          failedProofs: [],
-        };
-        if (probe.runtime) {
-          status.runtime = probe.runtime;
-        }
-        return status;
-      }
-      const failedProofs = missingRequiredProofs(probe.passedProofs, probe.failedProofs);
-      const status = {
-        language,
-        status: "unavailable",
-        reason: probe.reason || `Adapter ${adapter.id} did not pass every required proof for ${language}.`,
-        adapterId: adapter.id,
-        adapterVersion: adapter.version,
-        requiredProofs: [...SCRIPT_SANDBOX_REQUIRED_PROOFS],
-        passedProofs: dedupeProofs(probe.passedProofs),
-        failedProofs,
-      };
-      if (probe.runtime) {
-        status.runtime = probe.runtime;
-      }
-      failedStatuses.push(status);
-    } catch (error) {
-      failedStatuses.push({
-        ...unavailableLanguageStatus(
-          language,
-          `Adapter ${adapter.id} probe failed for ${language}: ${errorMessage(error)}`,
-        ),
-        adapterId: adapter.id,
-        adapterVersion: adapter.version,
-      });
-    }
-  }
-  const bestFailure = bestUnavailableStatus(failedStatuses);
-  if (bestFailure) {
-    return {
-      ...bestFailure,
-      reason: `No script transform sandbox adapter passed required proofs for language ${language}. Best failure from ${bestFailure.adapterId ?? "unknown adapter"}: ${bestFailure.reason}`,
-    };
-  }
-  return unavailableLanguageStatus(
-    language,
-    `No script transform sandbox adapter passed required proofs for language ${language}.`,
-  );
-}
-function bestUnavailableStatus(statuses) {
-  let best;
-  for (const status of statuses) {
-    if (!best || status.passedProofs.length > best.passedProofs.length) {
-      best = status;
-    }
-  }
-  return best;
-}
-function unavailableLanguageStatus(language, reason) {
-  return {
-    language,
-    status: "unavailable",
-    reason,
-    requiredProofs: [...SCRIPT_SANDBOX_REQUIRED_PROOFS],
-    passedProofs: [],
-    failedProofs: [...SCRIPT_SANDBOX_REQUIRED_PROOFS],
-  };
-}
-function hasEveryRequiredProof(proofs) {
-  return SCRIPT_SANDBOX_REQUIRED_PROOFS.every((proof) => proofs.includes(proof));
-}
-function missingRequiredProofs(passedProofs, failedProofs = []) {
-  const missing = SCRIPT_SANDBOX_REQUIRED_PROOFS.filter((proof) => !passedProofs.includes(proof));
-  return dedupeProofs([...failedProofs, ...missing]);
-}
-function dedupeProofs(proofs) {
-  const result = [];
-  for (const proof of proofs) {
-    if (SCRIPT_SANDBOX_REQUIRED_PROOFS.includes(proof) && !result.includes(proof)) {
-      result.push(proof);
-    }
-  }
-  return result;
-}
-function cloneScriptTransformConfig(config) {
-  return {
-    ...config,
-    languages: [...config.languages],
-    limits: { ...config.limits },
-  };
-}
-function errorMessage(error) {
-  return error instanceof Error ? error.message : String(error);
-}

package/router/dist/setup/script-transform-adapters.d.ts

@@ -1,32 +0,0 @@
-#!/usr/bin/env node
-import type { ScriptTransformLanguage } from "../config/types.js";
-import { type ScriptTransformAdapterLanguage } from "../sandbox/adapter-roots.js";
-interface InstallerOptions {
-  command: "install" | "status";
-  home: string;
-  configPath?: string;
-  writeConfig: boolean;
-  languages: ScriptTransformAdapterLanguage[];
-  json: boolean;
-}
-interface InstallReport {
-  adapterHome: string;
-  installed: boolean;
-  installSpecs: string[];
-  envFile: string;
-  configPath?: string;
-  configUpdated: boolean;
-  configuredLanguages: ScriptTransformLanguage[];
-  availableLanguages: ScriptTransformLanguage[];
-  unavailableLanguages: Array<{
-    language: string;
-    reason?: string;
-  }>;
-  notes: string[];
-}
-export declare function installOrInspect(options: InstallerOptions): Promise<InstallReport>;
-export declare function enableScriptTransformConfig(
-  configPath: string,
-  languages: readonly ScriptTransformLanguage[],
-): Promise<void>;
-export {};

package/router/dist/setup/script-transform-adapters.js

@@ -1,278 +0,0 @@
-#!/usr/bin/env node
-import { spawn } from "node:child_process";
-import { access, mkdir, readFile, writeFile } from "node:fs/promises";
-import { dirname, resolve } from "node:path";
-import { fileURLToPath } from "node:url";
-import { DEFAULT_SCRIPT_TRANSFORM_CONFIG, SCRIPT_TRANSFORM_LANGUAGES } from "../config/config.js";
-import {
-  defaultScriptTransformAdaptersHome,
-  scriptTransformAdapterEnvExports,
-  scriptTransformAdapterInstallSpecs,
-} from "../sandbox/adapter-roots.js";
-import { discoverEryxPythonSandboxAdaptersFromEnv } from "../sandbox/eryx-python-adapter.js";
-import { discoverJqWasmSandboxAdaptersFromEnv } from "../sandbox/jq-wasm-adapter.js";
-import { discoverQuickJsWasiSandboxAdaptersFromEnv } from "../sandbox/quickjs-wasi-adapter.js";
-import { probeScriptSandboxAdapters } from "../sandbox/script-sandbox.js";
-const DEFAULT_LANGUAGES = ["javascript", "jq", "python"];
-async function main(argv) {
-  const options = parseArgs(argv);
-  const report = await installOrInspect(options);
-  if (options.json) {
-    console.log(JSON.stringify(report, null, 2));
-    return;
-  }
-  printHumanReport(report);
-}
-export async function installOrInspect(options) {
-  const adapterHome = resolve(options.home);
-  const installSpecs = scriptTransformAdapterInstallSpecs(options.languages);
-  if (options.command === "install") {
-    await installAdapterPackages(adapterHome, installSpecs);
-  } else {
-    await mkdir(adapterHome, { recursive: true });
-  }
-  const envFile = await writeAdapterEnvFile(adapterHome);
-  const probe = await probeInstalledAdapters(options.languages);
-  const availableLanguages = probe.availableLanguages.filter(isScriptTransformLanguage);
-  const unavailableLanguages = probe.unavailableLanguages.map((status) => ({
-    language: status.language,
-    ...(status.reason !== undefined ? { reason: status.reason } : {}),
-  }));
-  let configUpdated = false;
-  const configuredLanguages = availableLanguages;
-  if (options.command === "install" && options.writeConfig && options.configPath && configuredLanguages.length > 0) {
-    await enableScriptTransformConfig(resolve(options.configPath), configuredLanguages);
-    configUpdated = true;
-  }
-  const notes = [
-    "Adapters are installed in a user-global Freeflow cache, not in the repo.",
-    "Freeflow auto-discovers this global cache; the env file is provided for shells or hosts that prefer explicit roots.",
-  ];
-  if (unavailableLanguages.some((entry) => entry.language === "python")) {
-    notes.push(
-      "Python/Eryx uses a child Node process launched with --experimental-wasm-jspi; if this Node binary cannot run that flag, setup reports Python unavailable instead of enabling it.",
-    );
-  }
-  if (configuredLanguages.length === 0) {
-    notes.push("No adapter passed sandbox proofs, so scriptTransform config was not enabled.");
-  }
-  return {
-    adapterHome,
-    installed: options.command === "install",
-    installSpecs,
-    envFile,
-    ...(options.configPath !== undefined ? { configPath: resolve(options.configPath) } : {}),
-    configUpdated,
-    configuredLanguages,
-    availableLanguages,
-    unavailableLanguages,
-    notes,
-  };
-}
-async function installAdapterPackages(adapterHome, installSpecs) {
-  await mkdir(adapterHome, { recursive: true });
-  const packageJson = resolve(adapterHome, "package.json");
-  if (!(await exists(packageJson))) {
-    await writeFile(packageJson, JSON.stringify({ private: true, type: "module" }, null, 2) + "\n", "utf8");
-  }
-  await run("npm", ["install", "--no-fund", "--no-audit", ...installSpecs], adapterHome);
-}
-async function writeAdapterEnvFile(adapterHome) {
-  const envFile = resolve(adapterHome, "freeflow-adapter-env.sh");
-  const exports = scriptTransformAdapterEnvExports(adapterHome);
-  const lines = [
-    "# Source this file before launching hosts that do not use Freeflow global adapter auto-discovery.",
-    ...Object.entries(exports).map(([key, value]) => `export ${key}=${shellQuote(value)}`),
-    "",
-  ];
-  await writeFile(envFile, lines.join("\n"), "utf8");
-  return envFile;
-}
-async function probeInstalledAdapters(languages) {
-  const adapters = [
-    ...(languages.includes("javascript") ? await discoverQuickJsWasiSandboxAdaptersFromEnv() : []),
-    ...(languages.includes("jq") ? await discoverJqWasmSandboxAdaptersFromEnv() : []),
-    ...(languages.includes("python") ? await discoverEryxPythonSandboxAdaptersFromEnv() : []),
-  ];
-  return probeScriptSandboxAdapters({
-    config: {
-      ...DEFAULT_SCRIPT_TRANSFORM_CONFIG,
-      enabled: true,
-      languages: languages.filter(isScriptTransformLanguage),
-    },
-    adapters,
-  });
-}
-export async function enableScriptTransformConfig(configPath, languages) {
-  await mkdir(dirname(configPath), { recursive: true });
-  const parsed = await readJsonObject(configPath);
-  if (parsed.defaultMode === undefined) {
-    parsed.defaultMode = "workflow";
-  }
-  const outputRouter = isRecord(parsed.outputRouter) ? { ...parsed.outputRouter } : {};
-  const existingScriptTransform = isRecord(outputRouter.scriptTransform)
-    ? outputRouter.scriptTransform
-    : isRecord(parsed.scriptTransform)
-      ? parsed.scriptTransform
-      : {};
-  outputRouter.enabled = true;
-  outputRouter.scriptTransform = {
-    ...existingScriptTransform,
-    enabled: true,
-    languages: [...languages],
-  };
-  parsed.outputRouter = outputRouter;
-  delete parsed.scriptTransform;
-  await writeFile(configPath, JSON.stringify(parsed, null, 2) + "\n", "utf8");
-}
-async function readJsonObject(path) {
-  try {
-    const raw = await readFile(path, "utf8");
-    const parsed = JSON.parse(raw);
-    return isRecord(parsed) ? parsed : {};
-  } catch (error) {
-    if (isNodeError(error) && error.code === "ENOENT") {
-      return {};
-    }
-    throw error;
-  }
-}
-function parseArgs(argv) {
-  let command = "install";
-  let home = defaultScriptTransformAdaptersHome();
-  let configPath;
-  let writeConfig = false;
-  let languages = [...DEFAULT_LANGUAGES];
-  let json = false;
-  const args = [...argv];
-  if (args[0] === "install" || args[0] === "status") {
-    command = args.shift();
-  }
-  for (let index = 0; index < args.length; index += 1) {
-    const arg = args[index];
-    if (arg === "--home") {
-      home = requiredValue(args, ++index, arg);
-      continue;
-    }
-    if (arg === "--config") {
-      configPath = requiredValue(args, ++index, arg);
-      writeConfig = true;
-      continue;
-    }
-    if (arg === "--no-config") {
-      writeConfig = false;
-      configPath = undefined;
-      continue;
-    }
-    if (arg === "--languages") {
-      languages = parseLanguages(requiredValue(args, ++index, arg));
-      continue;
-    }
-    if (arg === "--json") {
-      json = true;
-      continue;
-    }
-    if (arg === "--help" || arg === "-h") {
-      printUsageAndExit();
-    }
-    throw new Error(`Unknown argument: ${arg}`);
-  }
-  const result = { command, home, writeConfig, languages, json };
-  if (configPath !== undefined) {
-    result.configPath = configPath;
-  }
-  return result;
-}
-function parseLanguages(value) {
-  const requested = value
-    .split(",")
-    .map((entry) => entry.trim())
-    .filter(Boolean);
-  const invalid = requested.filter((entry) => !isScriptTransformAdapterLanguage(entry));
-  if (invalid.length > 0) {
-    throw new Error(`Unsupported script transform adapter language(s): ${invalid.join(", ")}`);
-  }
-  return [...new Set(requested)];
-}
-function isScriptTransformLanguage(value) {
-  return SCRIPT_TRANSFORM_LANGUAGES.includes(value);
-}
-function isScriptTransformAdapterLanguage(value) {
-  return value === "javascript" || value === "jq" || value === "python";
-}
-function requiredValue(args, index, flag) {
-  const value = args[index];
-  if (!value) {
-    throw new Error(`${flag} requires a value.`);
-  }
-  return value;
-}
-async function run(command, args, cwd) {
-  return new Promise((resolvePromise, reject) => {
-    const child = spawn(command, [...args], { cwd, stdio: ["ignore", "pipe", "pipe"] });
-    let stdout = "";
-    let stderr = "";
-    child.stdout.setEncoding("utf8");
-    child.stderr.setEncoding("utf8");
-    child.stdout.on("data", (chunk) => {
-      stdout += chunk;
-    });
-    child.stderr.on("data", (chunk) => {
-      stderr += chunk;
-    });
-    child.on("error", reject);
-    child.on("close", (code) => {
-      if (code === 0) {
-        resolvePromise({ stdout, stderr });
-      } else {
-        reject(new Error(`${command} ${args.join(" ")} failed with exitCode=${code}. ${stderr || stdout}`));
-      }
-    });
-  });
-}
-async function exists(path) {
-  try {
-    await access(path);
-    return true;
-  } catch {
-    return false;
-  }
-}
-function isRecord(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function isNodeError(error) {
-  return typeof error === "object" && error !== null && "code" in error;
-}
-function shellQuote(value) {
-  return `'${value.replaceAll("'", `'\\''`)}'`;
-}
-function printHumanReport(report) {
-  console.log(`Freeflow script transform adapters: ${report.installed ? "installed" : "status"}`);
-  console.log(`adapterHome=${report.adapterHome}`);
-  console.log(`envFile=${report.envFile}`);
-  console.log(`available=${report.availableLanguages.join(",") || "none"}`);
-  if (report.configPath) {
-    console.log(
-      `config=${report.configPath} updated=${String(report.configUpdated)} languages=${report.configuredLanguages.join(",") || "none"}`,
-    );
-  }
-  for (const unavailable of report.unavailableLanguages) {
-    console.log(`unavailable ${unavailable.language}: ${unavailable.reason ?? "unknown"}`);
-  }
-  report.notes.forEach((note) => console.log(`note: ${note}`));
-}
-function printUsageAndExit() {
-  console.log(
-    `Usage: node router/dist/setup/script-transform-adapters.js [install|status] [--config .freeflow/config.json] [--home PATH] [--languages javascript,jq,python] [--json]\n\nInstalls Freeflow script transform adapters into a user-global cache and optionally enables scriptTransform for proof-passing languages in a repo config.`,
-  );
-  process.exit(0);
-}
-const isCli = process.argv[1] ? resolve(process.argv[1]) === fileURLToPath(import.meta.url) : false;
-if (isCli) {
-  main(process.argv.slice(2)).catch((error) => {
-    const message = error instanceof Error ? error.message : String(error);
-    console.error(message);
-    process.exit(1);
-  });
-}

package/router/dist/tools/batch.d.ts

@@ -1,33 +0,0 @@
-import { type HostCommandRunner } from "./run.js";
-import type {
-  BatchRoutedResult,
-  BatchStepKind,
-  PreserveMode,
-  RouterThresholds,
-  ScriptTransformConfig,
-  StoragePolicyMode,
-  VaultRetentionPolicy,
-} from "../config/types.js";
-import type { ScriptSandboxAdapter } from "../sandbox/script-sandbox.js";
-export interface FreeflowBatchStepInput {
-  id?: string;
-  kind: BatchStepKind;
-  input: Record<string, unknown>;
-}
-export interface FreeflowBatchOptions {
-  sessionId: string;
-  steps: readonly FreeflowBatchStepInput[];
-  concurrency?: number;
-  preserve?: PreserveMode;
-  vaultRoot?: string;
-  vaultRetention?: VaultRetentionPolicy;
-  thresholds?: Partial<RouterThresholds>;
-  scriptTransform?: ScriptTransformConfig;
-  scriptSandboxAdapters?: readonly ScriptSandboxAdapter[];
-  storagePolicy?: StoragePolicyMode;
-  queries?: readonly string[];
-}
-export declare function freeflowBatch(
-  options: FreeflowBatchOptions,
-  runner: HostCommandRunner,
-): Promise<BatchRoutedResult>;