@tokenoftrust/storefront-runner 1.4.2-rc.0 → 2.0.1

package/apps/storefront/migrations-apps/meta/_journal.json

@@ -29,6 +29,48 @@
       "when": 1787403061681,
       "tag": "0003_mute_marauders",
       "breakpoints": true
+    },
+    {
+      "idx": 4,
+      "version": "6",
+      "when": 1787675399435,
+      "tag": "0004_deep_morph",
+      "breakpoints": true
+    },
+    {
+      "idx": 5,
+      "version": "6",
+      "when": 1787993394721,
+      "tag": "0005_common_mystique",
+      "breakpoints": true
+    },
+    {
+      "idx": 6,
+      "version": "6",
+      "when": 1788001135182,
+      "tag": "0006_broad_microchip",
+      "breakpoints": true
+    },
+    {
+      "idx": 7,
+      "version": "6",
+      "when": 1788007131463,
+      "tag": "0007_brave_outlaw_kid",
+      "breakpoints": true
+    },
+    {
+      "idx": 8,
+      "version": "6",
+      "when": 1788199945462,
+      "tag": "0008_blue_dazzler",
+      "breakpoints": true
+    },
+    {
+      "idx": 9,
+      "version": "6",
+      "when": 1788226793871,
+      "tag": "0009_bored_shinobi_shaw",
+      "breakpoints": true
     }
   ]
 }

package/apps/storefront/public/apps/tot.demo.analytics/0.1.0/entry.js

@@ -0,0 +1,42 @@
+/**
+ * ToT Demo Analytics — the exact-version entry module for the tot.demo.analytics
+ * tenant-local declaration (ext-kernel-09). Served same-origin and verbatim from
+ * apps/storefront/public/apps/…, it is the module the integration lifecycle runtime
+ * dynamically imports once its `analytics` consent purpose is eligible.
+ *
+ * It exports only the lifecycle contract (init, optional update/dispose). init()
+ * publishes a public window marker so a preview page demonstrably proves the entry
+ * ran, and sends a best-effort cookieless beacon to the declared analytics origin
+ * (permitted by the plan's CSP connect-src). No secret, no cross-origin script.
+ */
+const BEACON_ORIGIN = "https://demo-analytics.tokenoftrust.com";
+
+/** Publish a frozen, public marker other page code / a preview probe can observe. */
+function mark(phase) {
+  try {
+    const w = /** @type {Record<string, unknown>} */ (window);
+    const prior = Array.isArray(w.__TOT_DEMO_ANALYTICS__) ? w.__TOT_DEMO_ANALYTICS__ : [];
+    w.__TOT_DEMO_ANALYTICS__ = Object.freeze([...prior, { phase, at: Date.now() }]);
+  } catch {
+    /* a hardened window may reject the assignment — the marker is best-effort */
+  }
+}
+
+export function init() {
+  mark("init");
+  try {
+    if (typeof navigator !== "undefined" && typeof navigator.sendBeacon === "function") {
+      navigator.sendBeacon(`${BEACON_ORIGIN}/collect`, "tot-demo:init");
+    }
+  } catch {
+    /* beacon is best-effort; a blocked/offline endpoint never breaks the page */
+  }
+}
+
+export function update(reason) {
+  mark(`update:${reason}`);
+}
+
+export function dispose() {
+  mark("dispose");
+}

package/apps/storefront/public/platform/amplitude-http/v1/entry.mjs

@@ -0,0 +1,19 @@
+/**
+ * Data-only marker for the reviewed platform adapter runtime registry.
+ *
+ * This public path proves the exact versioned asset declared by the adapter is
+ * materialized. The lifecycle loader resolves this tuple to Storefront-owned code
+ * from its closed registry; this marker never imports or executes vendor code.
+ */
+export const platformAdapterEntry = Object.freeze({
+  schemaVersion: 1,
+  origin: "platform-adapter",
+  executionTier: "platform-adapter",
+  appId: "platform.amplitude",
+  version: "1.0.0",
+  entry: Object.freeze({
+    url: "/platform/amplitude-http/v1/entry.mjs",
+    format: "module",
+  }),
+  runtime: "native-amplitude-http-v1",
+});

package/apps/storefront/public/platform/google-measurement/v1/entry.mjs

@@ -0,0 +1,19 @@
+/**
+ * Reviewed same-origin marker for the native GA4 platform adapter.
+ *
+ * The lifecycle host imports this exact-version asset, verifies every field, then
+ * constructs the adapter from its bundled @tot/public-runtime implementation with
+ * host-injected fetch. This file executes no vendor code and reads no browser global.
+ */
+export const platformAdapterEntry = Object.freeze({
+  schemaVersion: 1,
+  origin: "platform-adapter",
+  executionTier: "platform-adapter",
+  appId: "platform.google-measurement",
+  version: "1.0.0",
+  entry: Object.freeze({
+    url: "/platform/google-measurement/v1/entry.mjs",
+    format: "module",
+  }),
+  runtime: "native-ga4-v1",
+});

package/apps/storefront/public/shared/commerce-chrome.css

@@ -146,6 +146,17 @@ body { overflow-x: clip; }
   font-size: .62rem; font-weight: 700; min-width: 16px; height: 16px; border-radius: var(--radius-full);
   display: grid; place-items: center; padding: 0 4px;
 }
+.header-cta {
+  border-radius: var(--radius-full); padding: 8px 16px;
+  font-family: var(--font-display, inherit); font-size: .875rem; font-weight: 500;
+  white-space: nowrap; transition: transform .15s ease, opacity .15s ease;
+}
+.header-cta--primary {
+  background: var(--color-accent); color: var(--color-primary-contrast);
+}
+.header-actions .header-cta--primary:hover { color: var(--color-primary-contrast); transform: translateY(-1px); }
+.header-cta--secondary, .header-cta--ghost { border: 1px solid currentColor; }
+.header-actions .header-cta--secondary:hover, .header-actions .header-cta--ghost:hover { opacity: .8; }
 .hamburger { display: none; flex-direction: column; gap: 5px; background: none; border: 0; padding: 6px; }
 .hamburger span { width: 26px; height: 2px; background: var(--color-text); border-radius: 2px; }
 
@@ -346,11 +357,18 @@ a.article-card__tag:hover { text-decoration: underline; }
   .tile-grid { grid-template-columns: repeat(3, 1fr); }
 }
 @media (max-width: 860px) {
-  .primary-nav { position: fixed; inset: 0 0 0 auto; width: min(84vw, 340px); background: var(--color-surface); box-shadow: var(--shadow-lg); transform: translateX(100%); transition: transform .25s ease; padding: 78px 20px 24px; overflow-y: auto; z-index: 120; }
-  .primary-nav.open { transform: none; }
+  /* No-JS base: the primary nav stays a normal, in-flow stacked list — always
+     visible and reachable by scroll/Tab with no script running at all. */
   .primary-nav > ul { flex-direction: column; align-items: stretch; gap: 4px; }
   .primary-nav a, .primary-nav .nav-item > a { display: block; padding: 12px 4px; border-bottom: 1px solid var(--color-border); }
   .hamburger { display: flex; }
+  /* Progressive enhancement only: CHROME_BEHAVIOR_JS stamps .js-nav on <html>
+     as soon as it runs, turning the same nav into an off-canvas drawer toggled
+     by the hamburger. Gating the fixed/off-screen positioning behind .js-nav
+     means a no-JS visitor always sees the nav in place — JS only changes its
+     PRESENTATION, never its reachability. */
+  .js-nav .primary-nav { position: fixed; inset: 0 0 0 auto; width: min(84vw, 340px); background: var(--color-surface); box-shadow: var(--shadow-lg); transform: translateX(100%); transition: transform .25s ease; padding: 78px 20px 24px; overflow-y: auto; z-index: 120; }
+  .js-nav .primary-nav.open { transform: none; }
   /* Mega panels: inline accordion on mobile */
   .mega { position: static; opacity: 1; visibility: visible; transform: none; box-shadow: none; border: 0; border-radius: 0; padding: 4px 4px 8px 14px; min-width: 0; }
   .mega--wide { min-width: 0; }

package/apps/storefront/scripts/build-v84-clean-clone-standalone.mjs

@@ -0,0 +1,68 @@
+/** Deterministically build the committed runtime-only clean-clone replay snapshot. */
+import { readFileSync, writeFileSync } from "node:fs";
+import { createRequire } from "node:module";
+import { dirname, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const scriptsDir = dirname(fileURLToPath(import.meta.url));
+const storefrontDir = dirname(scriptsDir);
+const repositoryRoot = resolve(storefrontDir, "../..");
+const outputPath = resolve(repositoryRoot, "apps/storefront/scripts/generated/v84-clean-clone-replay.bundle.mjs");
+
+export async function buildV84CleanCloneStandaloneBytes() {
+  const require = createRequire(import.meta.url);
+  const tsxRequire = createRequire(require.resolve("tsx/package.json"));
+  const esbuild = tsxRequire("esbuild");
+  if (tsxRequire("esbuild/package.json").version !== "0.28.1") {
+    throw new Error("The pinned standalone replay bundler changed.");
+  }
+  const fixture = readFileSync(resolve(
+    repositoryRoot,
+    "packages/public-runtime/tests/gtm-migration/fixtures/gtm-sample-container-v84.redacted.json",
+  ), "utf8");
+  const runtimeLoaderPath = resolve(
+    repositoryRoot,
+    "packages/public-runtime/src/integration/lifecycle-boot.ts",
+  );
+  const result = await esbuild.build({
+    absWorkingDir: repositoryRoot,
+    entryPoints: ["apps/storefront/scripts/replay-v84-clean-clone-standalone.ts"],
+    outfile: "apps/storefront/scripts/generated/v84-clean-clone-replay.bundle.mjs",
+    bundle: true,
+    write: false,
+    platform: "node",
+    format: "esm",
+    target: "node24",
+    charset: "utf8",
+    legalComments: "none",
+    sourcemap: false,
+    treeShaking: true,
+    plugins: [{
+      name: "remove-unused-standalone-runtime-loader",
+      setup(build) {
+        build.onLoad({ filter: /lifecycle-boot\.ts$/ }, (args) => {
+          if (args.path !== runtimeLoaderPath) {
+            throw new Error("The standalone runtime-loader removal target changed.");
+          }
+          return { contents: "export {};\n", loader: "ts" };
+        });
+      },
+    }],
+    define: { __V84_FIXED_FIXTURE_TEXT__: JSON.stringify(fixture) },
+    logLevel: "silent",
+  });
+  if (result.outputFiles.length !== 1) throw new Error("The standalone replay build output changed.");
+  const bytes = result.outputFiles[0].contents;
+  const source = Buffer.from(bytes).toString("utf8");
+  const loaderMatch = source.match(/\bimport\s*\(|\b(?:createRequire|tsImport)\s*\(/);
+  if (loaderMatch) {
+    throw new Error(`The standalone replay contains a dynamic module loader: ${loaderMatch[0]}`);
+  }
+  return bytes;
+}
+
+const invokedPath = fileURLToPath(import.meta.url) === process.argv[1];
+if (invokedPath) {
+  if (process.argv.length !== 2) throw new Error("The standalone replay build accepts no arguments.");
+  writeFileSync(outputPath, await buildV84CleanCloneStandaloneBytes());
+}

package/apps/storefront/scripts/deny-v84-clean-clone-standalone-capabilities.mjs

@@ -0,0 +1,111 @@
+/** Install the no-network/no-process/no-filesystem-mutation boundary inside the attested bundle. */
+import childProcess from "node:child_process";
+import cluster from "node:cluster";
+import dgram from "node:dgram";
+import dns from "node:dns";
+import fs from "node:fs";
+import http from "node:http";
+import http2 from "node:http2";
+import https from "node:https";
+import net from "node:net";
+import tls from "node:tls";
+import vm from "node:vm";
+import workerThreads from "node:worker_threads";
+import { syncBuiltinESMExports } from "node:module";
+
+const MESSAGE = "Capability access is disabled for the fixed clean-clone replay.";
+const MUTATION_MESSAGE = "Mutation capability is disabled for the fixed clean-clone replay.";
+
+function deny() {
+  throw new Error(MESSAGE);
+}
+function denyMutation() {
+  throw new Error(MUTATION_MESSAGE);
+}
+function replace(target, name, value = deny) {
+  if (typeof target[name] !== "function") return;
+  Object.defineProperty(target, name, { configurable: false, enumerable: true, writable: false, value });
+}
+
+export async function installV84CleanCloneStandaloneCapabilityBoundary() {
+  replace(globalThis, "fetch");
+  replace(globalThis, "WebSocket");
+  replace(globalThis, "EventSource");
+  replace(globalThis, "Worker");
+  if (typeof process.execve === "function") replace(process, "execve");
+  for (const target of [http, https]) {
+    replace(target, "request");
+    replace(target, "get");
+    replace(target, "ClientRequest");
+  }
+  replace(http2, "connect");
+  replace(net, "connect");
+  replace(net, "createConnection");
+  replace(net.Socket.prototype, "connect");
+  replace(tls, "connect");
+  replace(tls.TLSSocket.prototype, "connect");
+  replace(dgram, "createSocket");
+  replace(dgram, "Socket");
+  for (const method of [
+    "lookup", "lookupService", "resolve", "resolve4", "resolve6", "resolveAny", "resolveCaa",
+    "resolveCname", "resolveMx", "resolveNaptr", "resolveNs", "resolvePtr", "resolveSoa", "resolveSrv",
+    "resolveTlsa", "resolveTxt", "reverse",
+  ]) {
+    replace(dns, method);
+    replace(dns.promises, method);
+  }
+  replace(dns, "Resolver");
+  replace(dns.promises, "Resolver");
+  for (const method of ["exec", "execFile", "execFileSync", "execSync", "fork", "spawn", "spawnSync"]) {
+    replace(childProcess, method);
+  }
+  replace(childProcess.ChildProcess.prototype, "spawn");
+  replace(childProcess, "ChildProcess");
+  replace(cluster, "fork");
+  for (const method of ["runInContext", "runInNewContext", "runInThisContext"]) {
+    replace(vm.Script.prototype, method);
+  }
+  for (const method of [
+    "Script", "compileFunction", "createScript", "runInContext", "runInNewContext", "runInThisContext",
+  ]) replace(vm, method);
+  replace(workerThreads, "Worker");
+
+  const WRITE_OPEN_FLAGS = fs.constants.O_WRONLY | fs.constants.O_RDWR |
+    fs.constants.O_CREAT | fs.constants.O_TRUNC | fs.constants.O_APPEND;
+  const readOnlyFlags = (flags) => typeof flags === "number"
+    ? (flags & WRITE_OPEN_FLAGS) === 0
+    : flags === "r" || flags === "rs" || flags === "sr";
+  const guardedOpen = (original) => function (path, flags, ...rest) {
+    if (!readOnlyFlags(flags)) return denyMutation();
+    return Reflect.apply(original, this, [path, flags, ...rest]);
+  };
+  const originalOpen = fs.open;
+  const originalOpenSync = fs.openSync;
+  const originalPromiseOpen = fs.promises.open;
+  const guardFileHandle = await originalPromiseOpen(process.execPath, "r");
+  const fileHandlePrototype = Object.getPrototypeOf(guardFileHandle);
+  await guardFileHandle.close();
+  for (const method of [
+    "appendFile", "appendFileSync", "chmod", "chmodSync", "chown", "chownSync",
+    "copyFile", "copyFileSync", "cp", "cpSync", "createWriteStream", "link", "linkSync",
+    "fchmod", "fchmodSync", "fchown", "fchownSync", "fdatasync", "fdatasyncSync",
+    "fsync", "fsyncSync", "ftruncate", "ftruncateSync", "futimes", "futimesSync",
+    "lchmod", "lchmodSync", "lchown", "lchownSync", "lutimes", "lutimesSync",
+    "mkdir", "mkdirSync", "mkdtemp", "mkdtempSync", "mkdtempDisposable",
+    "mkdtempDisposableSync", "openAsBlob", "rename", "renameSync", "rm", "rmSync",
+    "rmdir", "rmdirSync", "symlink", "symlinkSync", "truncate", "truncateSync",
+    "unlink", "unlinkSync", "utimes", "utimesSync", "write", "writeFile", "writeFileSync",
+    "writeSync", "writev", "writevSync", "FileWriteStream", "WriteStream",
+  ]) {
+    replace(fs, method, denyMutation);
+    replace(fs.promises, method, denyMutation);
+  }
+  for (const method of [
+    "appendFile", "chmod", "chown", "createWriteStream", "datasync", "sync", "truncate",
+    "utimes", "write", "writeFile", "writev",
+  ]) replace(fileHandlePrototype, method, denyMutation);
+  replace(fs, "open", guardedOpen(originalOpen));
+  replace(fs, "openSync", guardedOpen(originalOpenSync));
+  replace(fs.promises, "open", guardedOpen(originalPromiseOpen));
+  syncBuiltinESMExports();
+}

package/apps/storefront/scripts/deny-v84-dogfood-capabilities.mjs

@@ -0,0 +1,2 @@
+/** The common v84 proof guard includes filesystem mutation denial. */
+import "./deny-v84-lifecycle-capabilities.mjs";

package/apps/storefront/scripts/deny-v84-lifecycle-capabilities.mjs

@@ -0,0 +1,247 @@
+/** Fail-closed capability prelude for the fixed offline v84 lifecycle proof. */
+import childProcess from "node:child_process";
+import cluster from "node:cluster";
+import dgram from "node:dgram";
+import dns from "node:dns";
+import fs from "node:fs";
+import http from "node:http";
+import http2 from "node:http2";
+import https from "node:https";
+import net from "node:net";
+import tls from "node:tls";
+import vm from "node:vm";
+import workerThreads from "node:worker_threads";
+import { fileURLToPath } from "node:url";
+import { createRequire, syncBuiltinESMExports } from "node:module";
+
+const MESSAGE = "Capability access is disabled for the fixed lifecycle proof.";
+const MUTATION_MESSAGE = "Mutation capability is disabled for the fixed nonportable-route dogfood proof.";
+const PRODUCER_CAPABILITY = Symbol.for("tot.v84.lifecycle-producer-capability");
+let producerAvailable = globalThis[PRODUCER_CAPABILITY] === "allow-exact-native-install-producer";
+Reflect.deleteProperty(globalThis, PRODUCER_CAPABILITY);
+const PRODUCER_BOOTSTRAP_PATH = fileURLToPath(
+  new URL("./run-fixed-v84-native-install-producer.mjs", import.meta.url),
+);
+const require = createRequire(import.meta.url);
+const tsxRequire = createRequire(require.resolve("tsx/package.json"));
+const ESBUILD_WORKER_PATH = tsxRequire.resolve("esbuild");
+const ESBUILD_VERSION = tsxRequire("esbuild/package.json").version;
+const ESBUILD_DEFAULT_WORKING_DIRECTORY = process.cwd();
+const ESBUILD_WORKER_ENV = Object.freeze(Object.fromEntries(
+  Object.entries(process.env).filter(([name]) => name !== "ESBUILD_BINARY_PATH"),
+));
+if (Object.prototype.hasOwnProperty.call(ESBUILD_WORKER_ENV, "ESBUILD_BINARY_PATH")) {
+  throw new Error("Capability guard could not sanitize the tooling environment.");
+}
+const NODE_EXECUTABLE = process.execPath;
+const PRODUCER_TIMEOUT_MS = 20_000;
+const originalSpawnSync = childProcess.spawnSync;
+const OriginalWorker = workerThreads.Worker;
+function deny(..._args) {
+  throw new Error(MESSAGE);
+}
+const replace = (target, name, value = deny) => {
+  Object.defineProperty(target, name, {
+    configurable: false,
+    enumerable: true,
+    writable: false,
+    value,
+  });
+};
+
+const producerArgs = Object.freeze([PRODUCER_BOOTSTRAP_PATH]);
+const producerOptions = Object.freeze({
+  encoding: "utf8",
+  env: Object.freeze({}),
+  timeout: PRODUCER_TIMEOUT_MS,
+  maxBuffer: 16 * 1024 * 1024,
+});
+const hasExactDataProperties = (value, expected) => {
+  if (value === null || typeof value !== "object") return false;
+  const descriptors = Object.getOwnPropertyDescriptors(value);
+  const keys = Reflect.ownKeys(descriptors);
+  if (keys.length !== Reflect.ownKeys(expected).length) return false;
+  return keys.every((key) => {
+    const descriptor = descriptors[key];
+    return Object.prototype.hasOwnProperty.call(expected, key) &&
+      descriptor !== undefined && "value" in descriptor && descriptor.value === expected[key];
+  });
+};
+const guardedSpawnSync = (command, args, options) => {
+  try {
+    if (!producerAvailable) return deny();
+    const exactArgs = Array.isArray(args) && hasExactDataProperties(args, {
+      0: PRODUCER_BOOTSTRAP_PATH,
+      length: 1,
+    });
+    const optionDescriptors = options !== null && typeof options === "object"
+      ? Object.getOwnPropertyDescriptors(options)
+      : {};
+    const env = optionDescriptors.env && "value" in optionDescriptors.env
+      ? optionDescriptors.env.value
+      : undefined;
+    const exactOptions = hasExactDataProperties(options, {
+      encoding: "utf8",
+      env,
+      timeout: PRODUCER_TIMEOUT_MS,
+      maxBuffer: 16 * 1024 * 1024,
+    }) && hasExactDataProperties(env, {});
+    if (command !== NODE_EXECUTABLE || !exactArgs || !exactOptions) return deny();
+  } catch {
+    return deny();
+  }
+  producerAvailable = false;
+  return originalSpawnSync(NODE_EXECUTABLE, [...producerArgs], {
+    ...producerOptions,
+    env: { ...producerOptions.env },
+  });
+};
+let esbuildWorkerStarted = false;
+const guardedWorker = function (filename, options) {
+  try {
+    const optionDescriptors = options !== null && typeof options === "object"
+      ? Object.getOwnPropertyDescriptors(options)
+      : {};
+    const workerData = optionDescriptors.workerData && "value" in optionDescriptors.workerData
+      ? optionDescriptors.workerData.value
+      : undefined;
+    const transferList = optionDescriptors.transferList && "value" in optionDescriptors.transferList
+      ? optionDescriptors.transferList.value
+      : undefined;
+    const execArgv = optionDescriptors.execArgv && "value" in optionDescriptors.execArgv
+      ? optionDescriptors.execArgv.value
+      : undefined;
+    const dataDescriptors = workerData !== null && typeof workerData === "object"
+      ? Object.getOwnPropertyDescriptors(workerData)
+      : {};
+    const port = dataDescriptors.workerPort && "value" in dataDescriptors.workerPort
+      ? dataDescriptors.workerPort.value
+      : undefined;
+    const exact = !esbuildWorkerStarted && filename === ESBUILD_WORKER_PATH &&
+      port instanceof workerThreads.MessagePort &&
+      hasExactDataProperties(workerData, {
+        workerPort: port,
+        defaultWD: ESBUILD_DEFAULT_WORKING_DIRECTORY,
+        esbuildVersion: ESBUILD_VERSION,
+      }) &&
+      hasExactDataProperties(transferList, { 0: port, length: 1 }) &&
+      hasExactDataProperties(execArgv, { length: 0 }) &&
+      hasExactDataProperties(options, { workerData, transferList, execArgv });
+    if (!exact) return deny();
+    esbuildWorkerStarted = true;
+    return new OriginalWorker(ESBUILD_WORKER_PATH, {
+      workerData: {
+        workerPort: port,
+        defaultWD: ESBUILD_DEFAULT_WORKING_DIRECTORY,
+        esbuildVersion: ESBUILD_VERSION,
+      },
+      transferList: [port],
+      execArgv: [],
+      env: { ...ESBUILD_WORKER_ENV },
+    });
+  } catch {
+    return deny();
+  }
+};
+
+replace(globalThis, "fetch");
+replace(globalThis, "WebSocket");
+replace(globalThis, "EventSource");
+replace(globalThis, "Worker");
+if (typeof process.execve === "function") replace(process, "execve");
+replace(http, "request");
+replace(http, "get");
+replace(http, "ClientRequest");
+replace(https, "request");
+replace(https, "get");
+replace(http2, "connect");
+replace(net, "connect");
+replace(net, "createConnection");
+replace(net.Socket.prototype, "connect");
+replace(tls, "connect");
+replace(tls.TLSSocket.prototype, "connect");
+replace(dgram, "createSocket");
+replace(dgram, "Socket");
+
+const dnsMethods = [
+  "lookup", "lookupService", "resolve", "resolve4", "resolve6", "resolveAny",
+  "resolveCaa", "resolveCname", "resolveMx", "resolveNaptr", "resolveNs",
+  "resolvePtr", "resolveSoa", "resolveSrv", "resolveTlsa", "resolveTxt", "reverse",
+];
+for (const method of dnsMethods) {
+  replace(dns, method);
+  replace(dns.promises, method);
+}
+replace(dns, "Resolver");
+replace(dns.promises, "Resolver");
+
+for (const method of ["exec", "execFile", "execFileSync", "execSync", "fork", "spawn"]) {
+  replace(childProcess, method);
+}
+replace(childProcess.ChildProcess.prototype, "spawn");
+replace(childProcess, "ChildProcess");
+replace(childProcess, "spawnSync", guardedSpawnSync);
+replace(cluster, "fork");
+replace(vm.Script.prototype, "runInContext");
+replace(vm.Script.prototype, "runInNewContext");
+replace(vm.Script.prototype, "runInThisContext");
+for (const method of [
+  "Script", "compileFunction", "createScript", "runInContext", "runInNewContext", "runInThisContext",
+]) {
+  replace(vm, method);
+}
+replace(workerThreads, "Worker", guardedWorker);
+
+function denyMutation(..._args) {
+  throw new Error(MUTATION_MESSAGE);
+}
+function replaceMutation(target, name, value = denyMutation) {
+  if (typeof target[name] !== "function") return;
+  Object.defineProperty(target, name, {
+    configurable: false,
+    enumerable: true,
+    writable: false,
+    value,
+  });
+}
+const WRITE_OPEN_FLAGS = fs.constants.O_WRONLY | fs.constants.O_RDWR |
+  fs.constants.O_CREAT | fs.constants.O_TRUNC | fs.constants.O_APPEND;
+const readOnlyFlags = (flags) => typeof flags === "number"
+  ? (flags & WRITE_OPEN_FLAGS) === 0
+  : flags === "r" || flags === "rs" || flags === "sr";
+const guardedOpen = (original) => function (path, flags, ...rest) {
+  if (!readOnlyFlags(flags)) return denyMutation();
+  return Reflect.apply(original, this, [path, flags, ...rest]);
+};
+const originalOpen = fs.open;
+const originalOpenSync = fs.openSync;
+const originalPromiseOpen = fs.promises.open;
+const guardFileHandle = await originalPromiseOpen(fileURLToPath(import.meta.url), "r");
+const fileHandlePrototype = Object.getPrototypeOf(guardFileHandle);
+await guardFileHandle.close();
+for (const method of [
+  "appendFile", "appendFileSync", "chmod", "chmodSync", "chown", "chownSync",
+  "copyFile", "copyFileSync", "cp", "cpSync", "createWriteStream", "link", "linkSync",
+  "fchmod", "fchmodSync", "fchown", "fchownSync", "fdatasync", "fdatasyncSync",
+  "fsync", "fsyncSync", "ftruncate", "ftruncateSync",
+  "futimes", "futimesSync", "lchmod", "lchmodSync", "lchown", "lchownSync",
+  "lutimes", "lutimesSync", "mkdir", "mkdirSync", "mkdtemp", "mkdtempSync",
+  "mkdtempDisposable", "mkdtempDisposableSync", "openAsBlob", "rename", "renameSync",
+  "rm", "rmSync", "rmdir", "rmdirSync",
+  "symlink", "symlinkSync", "truncate", "truncateSync", "unlink", "unlinkSync",
+  "utimes", "utimesSync", "write", "writeFile", "writeFileSync", "writeSync",
+  "writev", "writevSync", "FileWriteStream", "WriteStream",
+]) {
+  replaceMutation(fs, method);
+  replaceMutation(fs.promises, method);
+}
+for (const method of [
+  "appendFile", "chmod", "chown", "createWriteStream", "datasync", "sync", "truncate",
+  "utimes", "write", "writeFile", "writev",
+]) {
+  replaceMutation(fileHandlePrototype, method);
+}
+replaceMutation(fs, "open", guardedOpen(originalOpen));
+replaceMutation(fs, "openSync", guardedOpen(originalOpenSync));
+replaceMutation(fs.promises, "open", guardedOpen(originalPromiseOpen));
+syncBuiltinESMExports();