@tokenoftrust/storefront-runner 2.0.2 → 2.0.3

package/apps/storefront/scripts/build-v84-clean-clone-standalone.mjs

@@ -1,68 +0,0 @@
-/** Deterministically build the committed runtime-only clean-clone replay snapshot. */
-import { readFileSync, writeFileSync } from "node:fs";
-import { createRequire } from "node:module";
-import { dirname, resolve } from "node:path";
-import { fileURLToPath } from "node:url";
-
-const scriptsDir = dirname(fileURLToPath(import.meta.url));
-const storefrontDir = dirname(scriptsDir);
-const repositoryRoot = resolve(storefrontDir, "../..");
-const outputPath = resolve(repositoryRoot, "apps/storefront/scripts/generated/v84-clean-clone-replay.bundle.mjs");
-
-export async function buildV84CleanCloneStandaloneBytes() {
-  const require = createRequire(import.meta.url);
-  const tsxRequire = createRequire(require.resolve("tsx/package.json"));
-  const esbuild = tsxRequire("esbuild");
-  if (tsxRequire("esbuild/package.json").version !== "0.28.1") {
-    throw new Error("The pinned standalone replay bundler changed.");
-  }
-  const fixture = readFileSync(resolve(
-    repositoryRoot,
-    "packages/public-runtime/tests/gtm-migration/fixtures/gtm-sample-container-v84.redacted.json",
-  ), "utf8");
-  const runtimeLoaderPath = resolve(
-    repositoryRoot,
-    "packages/public-runtime/src/integration/lifecycle-boot.ts",
-  );
-  const result = await esbuild.build({
-    absWorkingDir: repositoryRoot,
-    entryPoints: ["apps/storefront/scripts/replay-v84-clean-clone-standalone.ts"],
-    outfile: "apps/storefront/scripts/generated/v84-clean-clone-replay.bundle.mjs",
-    bundle: true,
-    write: false,
-    platform: "node",
-    format: "esm",
-    target: "node24",
-    charset: "utf8",
-    legalComments: "none",
-    sourcemap: false,
-    treeShaking: true,
-    plugins: [{
-      name: "remove-unused-standalone-runtime-loader",
-      setup(build) {
-        build.onLoad({ filter: /lifecycle-boot\.ts$/ }, (args) => {
-          if (args.path !== runtimeLoaderPath) {
-            throw new Error("The standalone runtime-loader removal target changed.");
-          }
-          return { contents: "export {};\n", loader: "ts" };
-        });
-      },
-    }],
-    define: { __V84_FIXED_FIXTURE_TEXT__: JSON.stringify(fixture) },
-    logLevel: "silent",
-  });
-  if (result.outputFiles.length !== 1) throw new Error("The standalone replay build output changed.");
-  const bytes = result.outputFiles[0].contents;
-  const source = Buffer.from(bytes).toString("utf8");
-  const loaderMatch = source.match(/\bimport\s*\(|\b(?:createRequire|tsImport)\s*\(/);
-  if (loaderMatch) {
-    throw new Error(`The standalone replay contains a dynamic module loader: ${loaderMatch[0]}`);
-  }
-  return bytes;
-}
-
-const invokedPath = fileURLToPath(import.meta.url) === process.argv[1];
-if (invokedPath) {
-  if (process.argv.length !== 2) throw new Error("The standalone replay build accepts no arguments.");
-  writeFileSync(outputPath, await buildV84CleanCloneStandaloneBytes());
-}

package/apps/storefront/scripts/deny-v84-clean-clone-standalone-capabilities.mjs

@@ -1,111 +0,0 @@
-/** Install the no-network/no-process/no-filesystem-mutation boundary inside the attested bundle. */
-import childProcess from "node:child_process";
-import cluster from "node:cluster";
-import dgram from "node:dgram";
-import dns from "node:dns";
-import fs from "node:fs";
-import http from "node:http";
-import http2 from "node:http2";
-import https from "node:https";
-import net from "node:net";
-import tls from "node:tls";
-import vm from "node:vm";
-import workerThreads from "node:worker_threads";
-import { syncBuiltinESMExports } from "node:module";
-
-const MESSAGE = "Capability access is disabled for the fixed clean-clone replay.";
-const MUTATION_MESSAGE = "Mutation capability is disabled for the fixed clean-clone replay.";
-
-function deny() {
-  throw new Error(MESSAGE);
-}
-function denyMutation() {
-  throw new Error(MUTATION_MESSAGE);
-}
-function replace(target, name, value = deny) {
-  if (typeof target[name] !== "function") return;
-  Object.defineProperty(target, name, { configurable: false, enumerable: true, writable: false, value });
-}
-
-export async function installV84CleanCloneStandaloneCapabilityBoundary() {
-  replace(globalThis, "fetch");
-  replace(globalThis, "WebSocket");
-  replace(globalThis, "EventSource");
-  replace(globalThis, "Worker");
-  if (typeof process.execve === "function") replace(process, "execve");
-  for (const target of [http, https]) {
-    replace(target, "request");
-    replace(target, "get");
-    replace(target, "ClientRequest");
-  }
-  replace(http2, "connect");
-  replace(net, "connect");
-  replace(net, "createConnection");
-  replace(net.Socket.prototype, "connect");
-  replace(tls, "connect");
-  replace(tls.TLSSocket.prototype, "connect");
-  replace(dgram, "createSocket");
-  replace(dgram, "Socket");
-  for (const method of [
-    "lookup", "lookupService", "resolve", "resolve4", "resolve6", "resolveAny", "resolveCaa",
-    "resolveCname", "resolveMx", "resolveNaptr", "resolveNs", "resolvePtr", "resolveSoa", "resolveSrv",
-    "resolveTlsa", "resolveTxt", "reverse",
-  ]) {
-    replace(dns, method);
-    replace(dns.promises, method);
-  }
-  replace(dns, "Resolver");
-  replace(dns.promises, "Resolver");
-  for (const method of ["exec", "execFile", "execFileSync", "execSync", "fork", "spawn", "spawnSync"]) {
-    replace(childProcess, method);
-  }
-  replace(childProcess.ChildProcess.prototype, "spawn");
-  replace(childProcess, "ChildProcess");
-  replace(cluster, "fork");
-  for (const method of ["runInContext", "runInNewContext", "runInThisContext"]) {
-    replace(vm.Script.prototype, method);
-  }
-  for (const method of [
-    "Script", "compileFunction", "createScript", "runInContext", "runInNewContext", "runInThisContext",
-  ]) replace(vm, method);
-  replace(workerThreads, "Worker");
-
-  const WRITE_OPEN_FLAGS = fs.constants.O_WRONLY | fs.constants.O_RDWR |
-    fs.constants.O_CREAT | fs.constants.O_TRUNC | fs.constants.O_APPEND;
-  const readOnlyFlags = (flags) => typeof flags === "number"
-    ? (flags & WRITE_OPEN_FLAGS) === 0
-    : flags === "r" || flags === "rs" || flags === "sr";
-  const guardedOpen = (original) => function (path, flags, ...rest) {
-    if (!readOnlyFlags(flags)) return denyMutation();
-    return Reflect.apply(original, this, [path, flags, ...rest]);
-  };
-  const originalOpen = fs.open;
-  const originalOpenSync = fs.openSync;
-  const originalPromiseOpen = fs.promises.open;
-  const guardFileHandle = await originalPromiseOpen(process.execPath, "r");
-  const fileHandlePrototype = Object.getPrototypeOf(guardFileHandle);
-  await guardFileHandle.close();
-  for (const method of [
-    "appendFile", "appendFileSync", "chmod", "chmodSync", "chown", "chownSync",
-    "copyFile", "copyFileSync", "cp", "cpSync", "createWriteStream", "link", "linkSync",
-    "fchmod", "fchmodSync", "fchown", "fchownSync", "fdatasync", "fdatasyncSync",
-    "fsync", "fsyncSync", "ftruncate", "ftruncateSync", "futimes", "futimesSync",
-    "lchmod", "lchmodSync", "lchown", "lchownSync", "lutimes", "lutimesSync",
-    "mkdir", "mkdirSync", "mkdtemp", "mkdtempSync", "mkdtempDisposable",
-    "mkdtempDisposableSync", "openAsBlob", "rename", "renameSync", "rm", "rmSync",
-    "rmdir", "rmdirSync", "symlink", "symlinkSync", "truncate", "truncateSync",
-    "unlink", "unlinkSync", "utimes", "utimesSync", "write", "writeFile", "writeFileSync",
-    "writeSync", "writev", "writevSync", "FileWriteStream", "WriteStream",
-  ]) {
-    replace(fs, method, denyMutation);
-    replace(fs.promises, method, denyMutation);
-  }
-  for (const method of [
-    "appendFile", "chmod", "chown", "createWriteStream", "datasync", "sync", "truncate",
-    "utimes", "write", "writeFile", "writev",
-  ]) replace(fileHandlePrototype, method, denyMutation);
-  replace(fs, "open", guardedOpen(originalOpen));
-  replace(fs, "openSync", guardedOpen(originalOpenSync));
-  replace(fs.promises, "open", guardedOpen(originalPromiseOpen));
-  syncBuiltinESMExports();
-}

package/apps/storefront/scripts/deny-v84-dogfood-capabilities.mjs

@@ -1,2 +0,0 @@
-/** The common v84 proof guard includes filesystem mutation denial. */
-import "./deny-v84-lifecycle-capabilities.mjs";

package/apps/storefront/scripts/deny-v84-lifecycle-capabilities.mjs

@@ -1,247 +0,0 @@
-/** Fail-closed capability prelude for the fixed offline v84 lifecycle proof. */
-import childProcess from "node:child_process";
-import cluster from "node:cluster";
-import dgram from "node:dgram";
-import dns from "node:dns";
-import fs from "node:fs";
-import http from "node:http";
-import http2 from "node:http2";
-import https from "node:https";
-import net from "node:net";
-import tls from "node:tls";
-import vm from "node:vm";
-import workerThreads from "node:worker_threads";
-import { fileURLToPath } from "node:url";
-import { createRequire, syncBuiltinESMExports } from "node:module";
-
-const MESSAGE = "Capability access is disabled for the fixed lifecycle proof.";
-const MUTATION_MESSAGE = "Mutation capability is disabled for the fixed nonportable-route dogfood proof.";
-const PRODUCER_CAPABILITY = Symbol.for("tot.v84.lifecycle-producer-capability");
-let producerAvailable = globalThis[PRODUCER_CAPABILITY] === "allow-exact-native-install-producer";
-Reflect.deleteProperty(globalThis, PRODUCER_CAPABILITY);
-const PRODUCER_BOOTSTRAP_PATH = fileURLToPath(
-  new URL("./run-fixed-v84-native-install-producer.mjs", import.meta.url),
-);
-const require = createRequire(import.meta.url);
-const tsxRequire = createRequire(require.resolve("tsx/package.json"));
-const ESBUILD_WORKER_PATH = tsxRequire.resolve("esbuild");
-const ESBUILD_VERSION = tsxRequire("esbuild/package.json").version;
-const ESBUILD_DEFAULT_WORKING_DIRECTORY = process.cwd();
-const ESBUILD_WORKER_ENV = Object.freeze(Object.fromEntries(
-  Object.entries(process.env).filter(([name]) => name !== "ESBUILD_BINARY_PATH"),
-));
-if (Object.prototype.hasOwnProperty.call(ESBUILD_WORKER_ENV, "ESBUILD_BINARY_PATH")) {
-  throw new Error("Capability guard could not sanitize the tooling environment.");
-}
-const NODE_EXECUTABLE = process.execPath;
-const PRODUCER_TIMEOUT_MS = 20_000;
-const originalSpawnSync = childProcess.spawnSync;
-const OriginalWorker = workerThreads.Worker;
-function deny(..._args) {
-  throw new Error(MESSAGE);
-}
-const replace = (target, name, value = deny) => {
-  Object.defineProperty(target, name, {
-    configurable: false,
-    enumerable: true,
-    writable: false,
-    value,
-  });
-};
-
-const producerArgs = Object.freeze([PRODUCER_BOOTSTRAP_PATH]);
-const producerOptions = Object.freeze({
-  encoding: "utf8",
-  env: Object.freeze({}),
-  timeout: PRODUCER_TIMEOUT_MS,
-  maxBuffer: 16 * 1024 * 1024,
-});
-const hasExactDataProperties = (value, expected) => {
-  if (value === null || typeof value !== "object") return false;
-  const descriptors = Object.getOwnPropertyDescriptors(value);
-  const keys = Reflect.ownKeys(descriptors);
-  if (keys.length !== Reflect.ownKeys(expected).length) return false;
-  return keys.every((key) => {
-    const descriptor = descriptors[key];
-    return Object.prototype.hasOwnProperty.call(expected, key) &&
-      descriptor !== undefined && "value" in descriptor && descriptor.value === expected[key];
-  });
-};
-const guardedSpawnSync = (command, args, options) => {
-  try {
-    if (!producerAvailable) return deny();
-    const exactArgs = Array.isArray(args) && hasExactDataProperties(args, {
-      0: PRODUCER_BOOTSTRAP_PATH,
-      length: 1,
-    });
-    const optionDescriptors = options !== null && typeof options === "object"
-      ? Object.getOwnPropertyDescriptors(options)
-      : {};
-    const env = optionDescriptors.env && "value" in optionDescriptors.env
-      ? optionDescriptors.env.value
-      : undefined;
-    const exactOptions = hasExactDataProperties(options, {
-      encoding: "utf8",
-      env,
-      timeout: PRODUCER_TIMEOUT_MS,
-      maxBuffer: 16 * 1024 * 1024,
-    }) && hasExactDataProperties(env, {});
-    if (command !== NODE_EXECUTABLE || !exactArgs || !exactOptions) return deny();
-  } catch {
-    return deny();
-  }
-  producerAvailable = false;
-  return originalSpawnSync(NODE_EXECUTABLE, [...producerArgs], {
-    ...producerOptions,
-    env: { ...producerOptions.env },
-  });
-};
-let esbuildWorkerStarted = false;
-const guardedWorker = function (filename, options) {
-  try {
-    const optionDescriptors = options !== null && typeof options === "object"
-      ? Object.getOwnPropertyDescriptors(options)
-      : {};
-    const workerData = optionDescriptors.workerData && "value" in optionDescriptors.workerData
-      ? optionDescriptors.workerData.value
-      : undefined;
-    const transferList = optionDescriptors.transferList && "value" in optionDescriptors.transferList
-      ? optionDescriptors.transferList.value
-      : undefined;
-    const execArgv = optionDescriptors.execArgv && "value" in optionDescriptors.execArgv
-      ? optionDescriptors.execArgv.value
-      : undefined;
-    const dataDescriptors = workerData !== null && typeof workerData === "object"
-      ? Object.getOwnPropertyDescriptors(workerData)
-      : {};
-    const port = dataDescriptors.workerPort && "value" in dataDescriptors.workerPort
-      ? dataDescriptors.workerPort.value
-      : undefined;
-    const exact = !esbuildWorkerStarted && filename === ESBUILD_WORKER_PATH &&
-      port instanceof workerThreads.MessagePort &&
-      hasExactDataProperties(workerData, {
-        workerPort: port,
-        defaultWD: ESBUILD_DEFAULT_WORKING_DIRECTORY,
-        esbuildVersion: ESBUILD_VERSION,
-      }) &&
-      hasExactDataProperties(transferList, { 0: port, length: 1 }) &&
-      hasExactDataProperties(execArgv, { length: 0 }) &&
-      hasExactDataProperties(options, { workerData, transferList, execArgv });
-    if (!exact) return deny();
-    esbuildWorkerStarted = true;
-    return new OriginalWorker(ESBUILD_WORKER_PATH, {
-      workerData: {
-        workerPort: port,
-        defaultWD: ESBUILD_DEFAULT_WORKING_DIRECTORY,
-        esbuildVersion: ESBUILD_VERSION,
-      },
-      transferList: [port],
-      execArgv: [],
-      env: { ...ESBUILD_WORKER_ENV },
-    });
-  } catch {
-    return deny();
-  }
-};
-
-replace(globalThis, "fetch");
-replace(globalThis, "WebSocket");
-replace(globalThis, "EventSource");
-replace(globalThis, "Worker");
-if (typeof process.execve === "function") replace(process, "execve");
-replace(http, "request");
-replace(http, "get");
-replace(http, "ClientRequest");
-replace(https, "request");
-replace(https, "get");
-replace(http2, "connect");
-replace(net, "connect");
-replace(net, "createConnection");
-replace(net.Socket.prototype, "connect");
-replace(tls, "connect");
-replace(tls.TLSSocket.prototype, "connect");
-replace(dgram, "createSocket");
-replace(dgram, "Socket");
-
-const dnsMethods = [
-  "lookup", "lookupService", "resolve", "resolve4", "resolve6", "resolveAny",
-  "resolveCaa", "resolveCname", "resolveMx", "resolveNaptr", "resolveNs",
-  "resolvePtr", "resolveSoa", "resolveSrv", "resolveTlsa", "resolveTxt", "reverse",
-];
-for (const method of dnsMethods) {
-  replace(dns, method);
-  replace(dns.promises, method);
-}
-replace(dns, "Resolver");
-replace(dns.promises, "Resolver");
-
-for (const method of ["exec", "execFile", "execFileSync", "execSync", "fork", "spawn"]) {
-  replace(childProcess, method);
-}
-replace(childProcess.ChildProcess.prototype, "spawn");
-replace(childProcess, "ChildProcess");
-replace(childProcess, "spawnSync", guardedSpawnSync);
-replace(cluster, "fork");
-replace(vm.Script.prototype, "runInContext");
-replace(vm.Script.prototype, "runInNewContext");
-replace(vm.Script.prototype, "runInThisContext");
-for (const method of [
-  "Script", "compileFunction", "createScript", "runInContext", "runInNewContext", "runInThisContext",
-]) {
-  replace(vm, method);
-}
-replace(workerThreads, "Worker", guardedWorker);
-
-function denyMutation(..._args) {
-  throw new Error(MUTATION_MESSAGE);
-}
-function replaceMutation(target, name, value = denyMutation) {
-  if (typeof target[name] !== "function") return;
-  Object.defineProperty(target, name, {
-    configurable: false,
-    enumerable: true,
-    writable: false,
-    value,
-  });
-}
-const WRITE_OPEN_FLAGS = fs.constants.O_WRONLY | fs.constants.O_RDWR |
-  fs.constants.O_CREAT | fs.constants.O_TRUNC | fs.constants.O_APPEND;
-const readOnlyFlags = (flags) => typeof flags === "number"
-  ? (flags & WRITE_OPEN_FLAGS) === 0
-  : flags === "r" || flags === "rs" || flags === "sr";
-const guardedOpen = (original) => function (path, flags, ...rest) {
-  if (!readOnlyFlags(flags)) return denyMutation();
-  return Reflect.apply(original, this, [path, flags, ...rest]);
-};
-const originalOpen = fs.open;
-const originalOpenSync = fs.openSync;
-const originalPromiseOpen = fs.promises.open;
-const guardFileHandle = await originalPromiseOpen(fileURLToPath(import.meta.url), "r");
-const fileHandlePrototype = Object.getPrototypeOf(guardFileHandle);
-await guardFileHandle.close();
-for (const method of [
-  "appendFile", "appendFileSync", "chmod", "chmodSync", "chown", "chownSync",
-  "copyFile", "copyFileSync", "cp", "cpSync", "createWriteStream", "link", "linkSync",
-  "fchmod", "fchmodSync", "fchown", "fchownSync", "fdatasync", "fdatasyncSync",
-  "fsync", "fsyncSync", "ftruncate", "ftruncateSync",
-  "futimes", "futimesSync", "lchmod", "lchmodSync", "lchown", "lchownSync",
-  "lutimes", "lutimesSync", "mkdir", "mkdirSync", "mkdtemp", "mkdtempSync",
-  "mkdtempDisposable", "mkdtempDisposableSync", "openAsBlob", "rename", "renameSync",
-  "rm", "rmSync", "rmdir", "rmdirSync",
-  "symlink", "symlinkSync", "truncate", "truncateSync", "unlink", "unlinkSync",
-  "utimes", "utimesSync", "write", "writeFile", "writeFileSync", "writeSync",
-  "writev", "writevSync", "FileWriteStream", "WriteStream",
-]) {
-  replaceMutation(fs, method);
-  replaceMutation(fs.promises, method);
-}
-for (const method of [
-  "appendFile", "chmod", "chown", "createWriteStream", "datasync", "sync", "truncate",
-  "utimes", "write", "writeFile", "writev",
-]) {
-  replaceMutation(fileHandlePrototype, method);
-}
-replaceMutation(fs, "open", guardedOpen(originalOpen));
-replaceMutation(fs, "openSync", guardedOpen(originalOpenSync));
-replaceMutation(fs.promises, "open", guardedOpen(originalPromiseOpen));
-syncBuiltinESMExports();

package/apps/storefront/scripts/dogfood-v84-nonportable-routes.ts

@@ -1,73 +0,0 @@
-/** Fixed-input clean-clone replay for all eight v84 nonportable dispositions. */
-import { createHash } from "node:crypto";
-import { readFileSync } from "node:fs";
-import { fileURLToPath } from "node:url";
-import {
-  MANAGED_ANALYTICS_SCHEMA_VERSION,
-  platformAdapterCatalog,
-  type GetAdapterDefinitionRequest,
-  type GetAdapterDefinitionResponse,
-} from "@tot/public-runtime";
-import { buildV84CloneMigrationEvidence } from "../src/lib/apps/v84CloneMigrationEvidence.js";
-import { buildV84NonportableRouteDogfood } from "../src/lib/apps/v84NonportableRouteDogfood.js";
-
-if (process.argv.length !== 2) {
-  process.stderr.write("refused: fixed-input dogfood command accepts no arguments\n");
-  process.exit(64);
-}
-
-const fixturePath = fileURLToPath(new URL(
-  "../../../packages/public-runtime/tests/gtm-migration/fixtures/gtm-sample-container-v84.redacted.json",
-  import.meta.url,
-));
-const fixture = readFileSync(fixturePath, "utf8");
-const EXPECTED_FIXTURE_SHA256 = "57d28f3ed5da4215599bfb4b74f984d8b0cd8bf7d8b31e0e1172877308e9b688";
-const definitions = platformAdapterCatalog().map((card) => ({
-  schemaVersion: MANAGED_ANALYTICS_SCHEMA_VERSION,
-  adapterId: card.adapterId,
-  adapterVersion: "1.0.0",
-  displayName: card.name,
-  description: card.purpose,
-  availability: "available" as const,
-  configuration: [{
-    key: "destinationId", label: card.idLabel,
-    description: "Public destination identifier used by this reviewed adapter.",
-    kind: "string" as const, required: true,
-  }],
-  eventTypes: [...card.eventTypes],
-  consentPurposes: [...card.consentPurposes],
-  collectionOrigins: [...card.cspOrigins].sort(),
-}));
-const catalogAdapterIds = definitions.map((item) => item.adapterId);
-const catalog = {
-  async getAdapterDefinition(request: GetAdapterDefinitionRequest): Promise<GetAdapterDefinitionResponse> {
-    const found = definitions.find((item) => item.adapterId === request.query.adapterId);
-    if (!found) return { apiVersion: "v1", requestId: "req-dogfood-missing", error: { code: "not_found", message: "The requested adapter was not found." } };
-    return { apiVersion: "v1", requestId: "req-dogfood-catalog", data: found };
-  },
-};
-
-const run = async () => {
-  const imported = await buildV84CloneMigrationEvidence(fixture, catalog);
-  return buildV84NonportableRouteDogfood(imported, catalogAdapterIds);
-};
-const sourceSha256Before = createHash("sha256").update(fixture).digest("hex");
-if (sourceSha256Before !== EXPECTED_FIXTURE_SHA256) throw new Error("The fixed v84 fixture changed.");
-const first = await run();
-const second = await run();
-const sourceSha256After = createHash("sha256").update(readFileSync(fixturePath, "utf8")).digest("hex");
-const canonicalFirst = JSON.stringify(first);
-const canonicalSecond = JSON.stringify(second);
-if (canonicalFirst !== canonicalSecond || sourceSha256Before !== sourceSha256After) {
-  throw new Error("The clean-clone replay was not deterministic or source-read-only.");
-}
-process.stdout.write(`${JSON.stringify({
-  ...first,
-  cleanCloneReplay: {
-    runs: 2,
-    exactReplay: true,
-    sourceSha256Before,
-    sourceSha256After,
-    ledgerSha256: createHash("sha256").update(canonicalFirst).digest("hex"),
-  },
-}, null, 2)}\n`);

package/apps/storefront/scripts/fixed-v84-native-install-producer.ts

@@ -1,79 +0,0 @@
-/** Load the already-reviewed fixed native-install diagnostic as an inert JSON artifact. */
-import { spawnSync } from "node:child_process";
-import { createHash } from "node:crypto";
-import { readFileSync } from "node:fs";
-import { fileURLToPath } from "node:url";
-
-export const FIXED_V84_NATIVE_INSTALL_CLI_SHA256 =
-  "a95ae6b248d50bc034287e307997df6745d02638f1094c09cfecac4da6680b44" as const;
-
-const PRODUCER_FAILURE = "The fixed native-install evidence producer failed safely.";
-const PRODUCER_TIMEOUT_MS = 20_000;
-const PRODUCER_PATH = fileURLToPath(new URL("./install-v84-native-through-ws1.ts", import.meta.url));
-const PRODUCER_BOOTSTRAP_PATH = fileURLToPath(
-  new URL("./run-fixed-v84-native-install-producer.mjs", import.meta.url),
-);
-
-interface ProducerResult {
-  readonly status: number | null;
-  readonly signal: NodeJS.Signals | null;
-  readonly stdout: string;
-  readonly stderr: string;
-  readonly error?: unknown;
-}
-
-interface ProducerDependencies {
-  readonly readSource: (path: string) => string;
-  readonly run: (
-    command: string,
-    args: readonly string[],
-    options: {
-      readonly encoding: "utf8";
-      readonly env: Readonly<Record<string, string>>;
-      readonly timeout: number;
-      readonly maxBuffer: number;
-    },
-  ) => ProducerResult;
-}
-
-const dependencies: ProducerDependencies = {
-  readSource: (path) => readFileSync(path, "utf8"),
-  run: (command, args, options) => spawnSync(command, [...args], options),
-};
-
-/**
- * Run the fixed no-argument producer and return only its parsed JSON value.
- * Every filesystem/process/output failure collapses to one stable, path-free error.
- */
-export function readFixedV84NativeInstallEvidence(
-  deps: ProducerDependencies = dependencies,
-): unknown {
-  try {
-    const source = deps.readSource(PRODUCER_PATH);
-    if (createHash("sha256").update(source).digest("hex") !== FIXED_V84_NATIVE_INSTALL_CLI_SHA256) {
-      throw new Error(PRODUCER_FAILURE);
-    }
-    const result = deps.run(
-      process.execPath,
-      [PRODUCER_BOOTSTRAP_PATH],
-      {
-        encoding: "utf8",
-        env: {},
-        timeout: PRODUCER_TIMEOUT_MS,
-        maxBuffer: 16 * 1024 * 1024,
-      },
-    );
-    if (
-      result.error !== undefined ||
-      result.status !== 0 ||
-      result.signal !== null ||
-      result.stderr !== "" ||
-      result.stdout.length === 0
-    ) {
-      throw new Error(PRODUCER_FAILURE);
-    }
-    return JSON.parse(result.stdout) as unknown;
-  } catch {
-    throw new Error(PRODUCER_FAILURE);
-  }
-}