Add Lavamoat to build system (#9939)

* lavamoat - run build system in lavamoat

* lavamoat/allow-scripts - add missing policy entry

* update viz and lavvamoat

* trim policy file

* bump viz

* prue policy override

* regen policy file

* Update package.json

* Update package.json

* Apply suggestions from code review

Co-authored-by: kumavis <kumavis@users.noreply.github.com>

* update policy, remove redundant patches

* use yarn setup in CI

Co-authored-by: kumavis <aaron@kumavis.me>
Co-authored-by: kumavis <kumavis@users.noreply.github.com>

.circleci/config.yml

@@ -414,6 +414,12 @@ jobs:
       - store_artifacts:
           path: test-artifacts
           destination: test-artifacts
+      # important: generate lavamoat viz AFTER uploading builds as artifacts
+      # Temporarily disabled until we can update to a version of `sesify` with
+      # this fix included: https://github.com/LavaMoat/LavaMoat/pull/121
+      - run:
+          name: build:lavamoat-viz
+          command: ./.circleci/scripts/create-lavamoat-viz
       - store_artifacts:
           path: build-artifacts
           destination: build-artifacts

.circleci/scripts/create-lavamoat-viz

@@ -0,0 +1,17 @@
+#!/usr/bin/env bash
+
+set -x
+set -e
+set -u
+set -o pipefail
+
+BUILD_DEST="./build-artifacts/build-viz/"
+
+# prepare artifacts dir
+mkdir -p "${BUILD_DEST}"
+
+# generate lavamoat debug config
+yarn lavamoat:debug
+
+# generate viz
+npx lavamoat-viz --dest "${BUILD_DEST}"

.circleci/scripts/deps-install.sh

@@ -5,7 +5,7 @@ set -x
 # Exit immediately if a command exits with a non-zero status.
 set -e
 
-yarn --frozen-lockfile --har
+yarn setup-ci
 
 # Move HAR file into directory with consistent name so that we can cache it
 mkdir -p build-artifacts/yarn-install-har
@@ -14,6 +14,3 @@ if [[ -f "${har_files[0]}" ]]
 then
   mv ./*.har build-artifacts/yarn-install-har/
 fi
-
-# use @lavamoat/allow-scripts instead of manually running install scripts so directory change does not persist
-yarn allow-scripts

.eslintrc.js

@@ -31,6 +31,7 @@ module.exports = {
     'test/e2e/send-eth-with-private-key-test/**',
     'nyc_output/**',
     '.vscode/**',
+    'lavamoat/*/policy.json',
   ],
 
   extends: [

.prettierignore

@@ -1,4 +1,5 @@
 node_modules/**
+lavamoat/*/policy.json
 dist/**
 builds/**
 test-*/**

development/build/index.js

@@ -16,6 +16,17 @@ const createStyleTasks = require('./styles');
 const createStaticAssetTasks = require('./static');
 const createEtcTasks = require('./etc');
 
+// packages required dynamically via browserify configuration in dependencies
+require('loose-envify');
+require('@babel/plugin-proposal-object-rest-spread');
+require('@babel/plugin-transform-runtime');
+require('@babel/plugin-proposal-class-properties');
+require('@babel/plugin-proposal-optional-chaining');
+require('@babel/plugin-proposal-nullish-coalescing-operator');
+require('@babel/preset-env');
+require('@babel/preset-react');
+require('@babel/core');
+
 const browserPlatforms = ['firefox', 'chrome', 'brave', 'opera'];
 
 defineAllTasks();

development/build/sass-compiler.js

@@ -0,0 +1,12 @@
+const sass = require('sass');
+
+module.exports = {
+  render: (opts, callback) => {
+    // sass wants its arguments to come from the same Realm as itself
+    // bridgeJson and bridgeFn are added via patch-package to make this possible
+    sass.render(sass.bridgeJson(opts), sass.bridgeFn(callback));
+  },
+  renderSync: () => {
+    throw new Error('sass-wrapper - renderSync not supported');
+  },
+};

development/build/scripts.js

@@ -11,6 +11,8 @@ const browserify = require('browserify');
 const envify = require('loose-envify/custom');
 const sourcemaps = require('gulp-sourcemaps');
 const terser = require('gulp-terser-js');
+const babelify = require('babelify');
+const brfs = require('brfs');
 
 const conf = require('rc')('metamask', {
   INFURA_PROJECT_ID: process.env.INFURA_PROJECT_ID,
@@ -294,8 +296,8 @@ function createScriptTasks({ browserPlatforms, livereload }) {
     }
 
     let bundler = browserify(browserifyOpts)
-      .transform('babelify')
+      .transform(babelify)
-      .transform('brfs');
+      .transform(brfs);
 
     if (opts.buildLib) {
       bundler = bundler.require(opts.dependenciesToBundle);

development/build/styles.js

@@ -1,7 +1,6 @@
 const pify = require('pify');
 const gulp = require('gulp');
 const sass = require('gulp-sass');
-sass.compiler = require('sass');
 const autoprefixer = require('gulp-autoprefixer');
 const gulpStylelint = require('gulp-stylelint');
 const watch = require('gulp-watch');
@@ -11,6 +10,10 @@ const rename = require('gulp-rename');
 const pump = pify(require('pump'));
 const { createTask } = require('./task');
 
+// use our own compiler which runs sass in its own process
+// in order to not pollute the intrinsics
+sass.compiler = require('./sass-compiler.js');
+
 // scss compilation and autoprefixing tasks
 module.exports = createStyleTasks;
 

development/build/task.js

@@ -23,7 +23,7 @@ function detectAndRunEntryTask() {
   if (!taskName) {
     throw new Error(`MetaMask build: No task name specified`);
   }
-  const skipStats = process.argv[3] === '--skip-stats';
+  const skipStats = process.argv.includes('--skip-stats');
 
   runTask(taskName, { skipStats });
 }

development/metamaskbot-build-announce.js

@@ -61,12 +61,17 @@ async function start() {
   const storybookUrl = `${BUILD_LINK_BASE}/storybook/index.html`;
   const storybookLink = `<a href="${storybookUrl}">Storybook</a>`;
 
+  // links to bundle browser builds
+  const depVizUrl = `${BUILD_LINK_BASE}/build-artifacts/build-viz/index.html`;
+  const depVizLink = `<a href="${depVizUrl}">Build System</a>`;
+
   // link to artifacts
   const allArtifactsUrl = `https://circleci.com/gh/MetaMask/metamask-extension/${CIRCLE_BUILD_NUM}#artifacts/containers/0`;
 
   const contentRows = [
     `builds: ${buildLinks}`,
     `bundle viz: ${bundleLinks}`,
+    `build viz: ${depVizLink}`,
     `code coverage: ${coverageLink}`,
     `storybook: ${storybookLink}`,
     `<a href="${allArtifactsUrl}">all artifacts</a>`,

lavamoat/node/policy-override.json

@@ -0,0 +1,33 @@
+{
+  "resources": {
+    "node-sass": {
+      "native": true
+    },
+    "module-deps": {
+      "packages": {
+        "loose-envify": true
+      }
+    },
+    "@babel/core": {
+      "packages": {
+        "<root>": true,
+        "@babel/preset-env": true,
+        "@babel/preset-react": true,
+        "@babel/plugin-transform-runtime": true,
+        "@babel/plugin-proposal-class-properties": true,
+        "@babel/plugin-proposal-object-rest-spread": true,
+        "@babel/plugin-proposal-optional-chaining": true,
+        "@babel/plugin-proposal-nullish-coalescing-operator": true
+      }
+    },
+    "sass": {
+      "env": "unfrozen",
+      "builtin": {
+        "url": true
+      },
+      "globals": {
+        "Buffer": true
+      }
+    }
+  }
+}

package.json

@@ -3,10 +3,11 @@
   "version": "0.0.0",
   "private": true,
   "scripts": {
-    "setup": "yarn install && yarn allow-scripts",
+    "setup": "yarn install && yarn patch-package && yarn allow-scripts",
+    "setup-ci": "yarn install --frozen-lockfile --har && yarn patch-package && yarn allow-scripts",
     "start": "yarn build dev",
     "dist": "yarn build prod",
-    "build": "node development/build/index.js",
+    "build": "lavamoat development/build/index.js",
     "start:test": "yarn build testDev",
     "benchmark:chrome": "SELENIUM_BROWSER=chrome node test/e2e/benchmark.js",
     "benchmark:firefox": "SELENIUM_BROWSER=firefox node test/e2e/benchmark.js",
@@ -52,7 +53,9 @@
     "storybook:build": "build-storybook -c .storybook -o storybook-build --static-dir ./app ./storybook/images",
     "storybook:deploy": "storybook-to-ghpages --existing-output-dir storybook-build --remote storybook --branch master",
     "update-changelog": "./development/auto-changelog.sh",
-    "generate:migration": "./development/generate-migration.sh"
+    "generate:migration": "./development/generate-migration.sh",
+    "lavamoat:auto": "lavamoat ./development/build/index.js --writeAutoPolicy",
+    "lavamoat:debug": "lavamoat ./development/build/index.js --writeAutoPolicyDebug"
   },
   "resolutions": {
     "**/configstore/dot-prop": "^5.1.1",
@@ -244,12 +247,15 @@
     "gulp-zip": "^4.0.0",
     "jsdom": "^11.2.0",
     "koa": "^2.7.0",
+    "lavamoat": "^5.1.4",
+    "lavamoat-viz": "^6.0.4",
     "lockfile-lint": "^4.0.0",
     "loose-envify": "^1.4.0",
     "mocha": "^7.2.0",
     "nock": "^9.0.14",
     "node-fetch": "^2.6.1",
     "nyc": "^15.0.0",
+    "patch-package": "^6.2.2",
     "polyfill-crypto.getrandomvalues": "^1.0.0",
     "prettier": "^2.1.1",
     "prettier-plugin-sort-json": "^0.0.1",

patches/error+7.0.2.patch

@@ -0,0 +1,16 @@
+diff --git a/node_modules/error/typed.js b/node_modules/error/typed.js
+index fe9effd..e554568 100644
+--- a/node_modules/error/typed.js
++++ b/node_modules/error/typed.js
+@@ -22,8 +22,10 @@ function TypedError(args) {
+         args.name = errorName[0].toUpperCase() + errorName.substr(1);
+     }
+ 
+-    extend(createError, args);
+     createError._name = args.name;
++    //remove args.name, name is not extensible under strict mode (lavamoat)
++    delete args.name
++    extend(createError, args);
+ 
+     return createError;
+ 

patches/node-sass+4.14.1.patch

@@ -0,0 +1,13 @@
+diff --git a/node_modules/node-sass/lib/index.js b/node_modules/node-sass/lib/index.js
+index 3f20708..425e97c 100644
+--- a/node_modules/node-sass/lib/index.js
++++ b/node_modules/node-sass/lib/index.js
+@@ -166,6 +166,8 @@ function buildIncludePaths(options) {
+   options.includePaths = options.includePaths || [];
+ 
+   if (process.env.hasOwnProperty('SASS_PATH')) {
++    //quick workaround for SASS_PATH.split undefined under lavamoat
++    process.env.SASS_PATH.split = String.prototype.split
+     options.includePaths = options.includePaths.concat(
+       process.env.SASS_PATH.split(path.delimiter)
+     );

patches/plugin-error+1.0.1.patch

@@ -0,0 +1,12 @@
+diff --git a/node_modules/plugin-error/index.js b/node_modules/plugin-error/index.js
+index a4d360d..d2be4a2 100644
+--- a/node_modules/plugin-error/index.js
++++ b/node_modules/plugin-error/index.js
+@@ -54,7 +54,6 @@ function PluginError(plugin, message, options) {
+       return this._messageWithDetails() + '\nStack:';
+     }.bind(this);
+ 
+-    Error.captureStackTrace(safety, arguments.callee || this.constructor);
+     this.__safety = safety;
+   }
+   if (!this.plugin) {

patches/sass+1.32.4.patch

@@ -0,0 +1,25 @@
+diff --git a/node_modules/sass/sass.dart.js b/node_modules/sass/sass.dart.js
+index fedd867..fef6a8f 100644
+--- a/node_modules/sass/sass.dart.js
++++ b/node_modules/sass/sass.dart.js
+@@ -16,6 +16,9 @@ self.scheduleImmediate = self.setImmediate
+ // CommonJS globals.
+ self.exports = exports;
+ 
++exports.bridgeJson = (target) => JSON.parse(JSON.stringify(target))
++exports.bridgeFn = (target) => ((...args) => target(...args))
++
+ // Node.js specific exports, check to see if they exist & or polyfilled
+ 
+ if (typeof process !== "undefined") {
+@@ -3616,10 +3619,6 @@ self.fs = require("fs");
+         return C.PlainJavaScriptObject_methods;
+       if (proto === Object.prototype)
+         return C.PlainJavaScriptObject_methods;
+-      if (typeof $constructor == "function") {
+-        Object.defineProperty($constructor, J.JS_INTEROP_INTERCEPTOR_TAG(), {value: C.UnknownJavaScriptObject_methods, enumerable: false, writable: true, configurable: true});
+-        return C.UnknownJavaScriptObject_methods;
+-      }
+       return C.UnknownJavaScriptObject_methods;
+     },
+     JS_INTEROP_INTERCEPTOR_TAG: function() {

patches/stylelint+13.6.1.patch

@@ -0,0 +1,28 @@
+diff --git a/node_modules/stylelint/lib/syntaxes/index.js b/node_modules/stylelint/lib/syntaxes/index.js
+index 7afa0c3..73eaa00 100644
+--- a/node_modules/stylelint/lib/syntaxes/index.js
++++ b/node_modules/stylelint/lib/syntaxes/index.js
+@@ -1,16 +1,13 @@
+ 'use strict';
+ 
+-// Use this require pattern so that syntaxes can be bundled separately
+-const importLazy = require('import-lazy')(require);
+-
+ /** @typedef {import('../getPostcssResult').Syntax} Syntax */
+ /** @type {{[k: string]: Syntax}} */
+ module.exports = {
+-	'css-in-js': importLazy('./syntax-css-in-js'),
+-	html: importLazy('./syntax-html'),
+-	less: importLazy('./syntax-less'),
+-	markdown: importLazy('./syntax-markdown'),
+-	sass: importLazy('./syntax-sass'),
+-	scss: importLazy('./syntax-scss'),
+-	sugarss: importLazy('./syntax-sugarss'),
++	'css-in-js': require('./syntax-css-in-js'),
++	html: require('./syntax-html'),
++	less: require('./syntax-less'),
++	markdown: require('./syntax-markdown'),
++	sass: require('./syntax-sass'),
++	scss: require('./syntax-scss'),
++	sugarss: require('./syntax-sugarss'),
+ };

yarn.lock

@@ -347,11 +347,16 @@
     chalk "^2.0.0"
     js-tokens "^4.0.0"
 
-"@babel/parser@^7.12.7", "@babel/parser@^7.7.5":
+"@babel/parser@^7.10.1", "@babel/parser@^7.12.7":
   version "7.12.7"
   resolved "https://registry.yarnpkg.com/@babel/parser/-/parser-7.12.7.tgz#fee7b39fe809d0e73e5b25eecaf5780ef3d73056"
   integrity sha512-oWR02Ubp4xTLCAqPRiNIuMVgNO5Aif/xpXtabhzW2HWUD47XJsAB4Zd/Rg30+XeQA3juXigV7hlquOTmwqLiwg==
 
+"@babel/parser@^7.7.5":
+  version "7.12.3"
+  resolved "https://registry.yarnpkg.com/@babel/parser/-/parser-7.12.3.tgz#a305415ebe7a6c7023b40b5122a0662d928334cd"
+  integrity sha512-kFsOS0IbsuhO5ojF8Hc8z/8vEIOkylVBrjiZUbLTE3XFe0Qi+uu6HjzQixkFaqr0ZPAMZcBVxEwmsnsLPZ2Xsw==
+
 "@babel/plugin-proposal-async-generator-functions@^7.12.1":
   version "7.12.1"
   resolved "https://registry.yarnpkg.com/@babel/plugin-proposal-async-generator-functions/-/plugin-proposal-async-generator-functions-7.12.1.tgz#dc6c1170e27d8aca99ff65f4925bd06b1c90550e"
@@ -1074,6 +1079,21 @@
     "@babel/parser" "^7.12.7"
     "@babel/types" "^7.12.7"
 
+"@babel/traverse@^7.10.1":
+  version "7.12.8"
+  resolved "https://registry.yarnpkg.com/@babel/traverse/-/traverse-7.12.8.tgz#c1c2983bf9ba0f4f0eaa11dff7e77fa63307b2a4"
+  integrity sha512-EIRQXPTwFEGRZyu6gXbjfpNORN1oZvwuzJbxcXjAgWV0iqXYDszN1Hx3FVm6YgZfu1ZQbCVAk3l+nIw95Xll9Q==
+  dependencies:
+    "@babel/code-frame" "^7.10.4"
+    "@babel/generator" "^7.12.5"
+    "@babel/helper-function-name" "^7.10.4"
+    "@babel/helper-split-export-declaration" "^7.11.0"
+    "@babel/parser" "^7.12.7"
+    "@babel/types" "^7.12.7"
+    debug "^4.1.0"
+    globals "^11.1.0"
+    lodash "^4.17.19"
+
 "@babel/traverse@^7.10.4", "@babel/traverse@^7.12.1", "@babel/traverse@^7.12.5", "@babel/traverse@^7.12.9", "@babel/traverse@^7.7.4":
   version "7.12.9"
   resolved "https://registry.yarnpkg.com/@babel/traverse/-/traverse-7.12.9.tgz#fad26c972eabbc11350e0b695978de6cc8e8596f"
@@ -6893,6 +6913,17 @@ clone-buffer@^1.0.0:
   resolved "https://registry.yarnpkg.com/clone-buffer/-/clone-buffer-1.0.0.tgz#e3e25b207ac4e701af721e2cb5a16792cac3dc58"
   integrity sha1-4+JbIHrE5wGvch4staFnksrD3Fg=
 
+clone-deep@^0.2.4:
+  version "0.2.4"
+  resolved "https://registry.yarnpkg.com/clone-deep/-/clone-deep-0.2.4.tgz#4e73dd09e9fb971cc38670c5dced9c1896481cc6"
+  integrity sha1-TnPdCen7lxzDhnDF3O2cGJZIHMY=
+  dependencies:
+    for-own "^0.1.3"
+    is-plain-object "^2.0.1"
+    kind-of "^3.0.2"
+    lazy-cache "^1.0.3"
+    shallow-clone "^0.1.2"
+
 clone-deep@^2.0.1:
   version "2.0.2"
   resolved "https://registry.yarnpkg.com/clone-deep/-/clone-deep-2.0.2.tgz#00db3a1e173656730d1188c3d6aced6d7ea97713"
@@ -11048,7 +11079,7 @@ for-in@^1.0.1, for-in@^1.0.2:
   resolved "https://registry.yarnpkg.com/for-in/-/for-in-1.0.2.tgz#81068d295a8142ec0ac726c6e2200c30fb6d5e80"
   integrity sha1-gQaNKVqBQuwKxybG4iAMMPttXoA=
 
-for-own@^0.1.4:
+for-own@^0.1.3, for-own@^0.1.4:
   version "0.1.5"
   resolved "https://registry.yarnpkg.com/for-own/-/for-own-0.1.5.tgz#5265c681a4f294dabbf17c9509b6763aa84510ce"
   integrity sha1-UmXGgaTylNq78XyVCbZ2OqhFEM4=
@@ -12569,7 +12600,7 @@ html-webpack-plugin@^4.2.1:
     tapable "^1.1.3"
     util.promisify "1.0.0"
 
-htmlescape@^1.1.0:
+htmlescape@^1.1.0, htmlescape@^1.1.1:
   version "1.1.1"
   resolved "https://registry.yarnpkg.com/htmlescape/-/htmlescape-1.1.1.tgz#3a03edc2214bca3b66424a3e7959349509cb0351"
   integrity sha1-OgPtwiFLyjtmQko+eVk0lQnLA1E=
@@ -13697,7 +13728,7 @@ is-boolean-object@^1.0.0:
   resolved "https://registry.yarnpkg.com/is-boolean-object/-/is-boolean-object-1.0.0.tgz#98f8b28030684219a95f375cfbd88ce3405dff93"
   integrity sha1-mPiygDBoQhmpXzdc+9iM40Bd/5M=
 
-is-buffer@^1.1.0, is-buffer@^1.1.5, is-buffer@~1.1.6:
+is-buffer@^1.0.2, is-buffer@^1.1.0, is-buffer@^1.1.5, is-buffer@~1.1.6:
   version "1.1.6"
   resolved "https://registry.yarnpkg.com/is-buffer/-/is-buffer-1.1.6.tgz#efaa2ea9daa0d7ab2ea13a97b2b8ad51fefbe8be"
   integrity sha512-NcdALwpXkTm5Zvvbk7owOUSvVvBKDgKP5/ewfXEznmQFfs4ZRmanOeKBTjRVjka3QFoN6XJ+9F3USqfHqTaU5w==
@@ -13738,6 +13769,13 @@ is-core-module@^2.0.0:
   dependencies:
     has "^1.0.3"
 
+is-core-module@^2.1.0:
+  version "2.1.0"
+  resolved "https://registry.yarnpkg.com/is-core-module/-/is-core-module-2.1.0.tgz#a4cc031d9b1aca63eecbd18a650e13cb4eeab946"
+  integrity sha512-YcV7BgVMRFRua2FqQzKtTDMz8iCuLEyGKjr70q8Zm1yy2qKcurbFEd79PAdHV77oL3NrAaOVQIbMmiHQCHB7ZA==
+  dependencies:
+    has "^1.0.3"
+
 is-data-descriptor@^0.1.4:
   version "0.1.4"
   resolved "https://registry.yarnpkg.com/is-data-descriptor/-/is-data-descriptor-0.1.4.tgz#0b5ee648388e2c860282e793f1856fec3f301b56"
@@ -14989,6 +15027,13 @@ kind-of@^1.1.0:
   resolved "https://registry.yarnpkg.com/kind-of/-/kind-of-1.1.0.tgz#140a3d2d41a36d2efcfa9377b62c24f8495a5c44"
   integrity sha1-FAo9LUGjbS78+pN3tiwk+ElaXEQ=
 
+kind-of@^2.0.1:
+  version "2.0.1"
+  resolved "https://registry.yarnpkg.com/kind-of/-/kind-of-2.0.1.tgz#018ec7a4ce7e3a86cb9141be519d24c8faa981b5"
+  integrity sha1-AY7HpM5+OobLkUG+UZ0kyPqpgbU=
+  dependencies:
+    is-buffer "^1.0.2"
+
 kind-of@^3.0.2, kind-of@^3.0.3, kind-of@^3.2.0:
   version "3.2.2"
   resolved "https://registry.yarnpkg.com/kind-of/-/kind-of-3.2.2.tgz#31ea21a734bab9bbb0f32466d893aea51e4a3c64"
@@ -15148,6 +15193,63 @@ latest-version@^5.0.0:
   dependencies:
     package-json "^6.3.0"
 
+lavamoat-core@^9.0.1:
+  version "9.0.1"
+  resolved "https://registry.yarnpkg.com/lavamoat-core/-/lavamoat-core-9.0.1.tgz#a34a822b4bfabea38f73b7f9bc1a19f86baa9b1f"
+  integrity sha512-FqqasOjl3V6CX/ETniw59r20ukcydOtFhQxtwl6TIEuSc5CJJgY5y9Fi3adk5BTxml3JUMsR3dtygFOV3NuBBw==
+  dependencies:
+    fromentries "^1.2.0"
+    json-stable-stringify "^1.0.1"
+    lavamoat-tofu "^5.1.1"
+    merge-deep "^3.0.2"
+    resolve "^1.15.1"
+
+lavamoat-tofu@^5.1.1:
+  version "5.1.1"
+  resolved "https://registry.yarnpkg.com/lavamoat-tofu/-/lavamoat-tofu-5.1.1.tgz#67d3c5775b587dd439c426f1cd86650b10443760"
+  integrity sha512-LIZTifbbTATA5UClVGI7YGMTOjUXjrVCBOz0DaeUicldLonLlwG81/53/vTIfPM1xV/KA85MIzGPHz4pDdiVkA==
+  dependencies:
+    "@babel/parser" "^7.10.1"
+    "@babel/traverse" "^7.10.1"
+
+lavamoat-viz@^6.0.4:
+  version "6.0.4"
+  resolved "https://registry.yarnpkg.com/lavamoat-viz/-/lavamoat-viz-6.0.4.tgz#00b132cef06c24a6836044842548438e0c144059"
+  integrity sha512-LqSNLLTtodZUCxFihGCFrVVEBBICEs79hu2fSJGZFxe8I+R6FNcKmBMVAwpAuPj9dpKJmvckTi2sP8osZX8KCw==
+  dependencies:
+    lavamoat-core "^9.0.1"
+    ncp "^2.0.0"
+    open "^7.0.3"
+    pify "^4.0.1"
+    serve-handler "^6.1.3"
+    yargs "^16.0.0"
+
+lavamoat@^5.1.4:
+  version "5.1.4"
+  resolved "https://registry.yarnpkg.com/lavamoat/-/lavamoat-5.1.4.tgz#211ea0bb2dfaf624f2f5d85a90d6c93b9c1da599"
+  integrity sha512-NaD8Jyt4OVO2euP8XVnlJuDsAO1Tfdt5Mg4wNwms+E8fe/a6mvH6kQncr1O/X42ky9u29+m2NinFMCQKmd8fQw==
+  dependencies:
+    "@babel/code-frame" "^7.10.4"
+    bindings "^1.5.0"
+    htmlescape "^1.1.1"
+    json-stable-stringify "^1.0.1"
+    lavamoat-core "^9.0.1"
+    lavamoat-tofu "^5.1.1"
+    node-gyp-build "^4.2.3"
+    object.fromentries "^2.0.2"
+    resolve "^1.17.0"
+    yargs "^16.0.0"
+
+lazy-cache@^0.2.3:
+  version "0.2.7"
+  resolved "https://registry.yarnpkg.com/lazy-cache/-/lazy-cache-0.2.7.tgz#7feddf2dcb6edb77d11ef1d117ab5ffdf0ab1b65"
+  integrity sha1-f+3fLctu23fRHvHRF6tf/fCrG2U=
+
+lazy-cache@^1.0.3:
+  version "1.0.4"
+  resolved "https://registry.yarnpkg.com/lazy-cache/-/lazy-cache-1.0.4.tgz#a1d78fc3a50474cb80845d3b3b6e1da49a446e8e"
+  integrity sha1-odePw6UEdMuAhF07O24dpJpEbo4=
+
 lazy-universal-dotenv@^3.0.1:
   version "3.0.1"
   resolved "https://registry.yarnpkg.com/lazy-universal-dotenv/-/lazy-universal-dotenv-3.0.1.tgz#a6c8938414bca426ab8c9463940da451a911db38"
@@ -16596,6 +16698,15 @@ meow@^7.0.1:
     type-fest "^0.13.1"
     yargs-parser "^18.1.3"
 
+merge-deep@^3.0.2:
+  version "3.0.3"
+  resolved "https://registry.yarnpkg.com/merge-deep/-/merge-deep-3.0.3.tgz#1a2b2ae926da8b2ae93a0ac15d90cd1922766003"
+  integrity sha512-qtmzAS6t6grwEkNrunqTBdn0qKwFgNWvlxUbAV8es9M7Ot1EbyApytCnvE0jALPa46ZpKDUo527kKiaWplmlFA==
+  dependencies:
+    arr-union "^3.1.0"
+    clone-deep "^0.2.4"
+    kind-of "^3.0.2"
+
 merge-descriptors@1.0.1, merge-descriptors@~1.0.0:
   version "1.0.1"
   resolved "https://registry.yarnpkg.com/merge-descriptors/-/merge-descriptors-1.0.1.tgz#b00aaa556dd8b44568150ec9d1b953f3f90cbb61"
@@ -17318,6 +17429,11 @@ ncom@^1.0.2:
   dependencies:
     sc-formatter "~3.0.1"
 
+ncp@^2.0.0:
+  version "2.0.0"
+  resolved "https://registry.yarnpkg.com/ncp/-/ncp-2.0.0.tgz#195a21d6c46e361d2fb1281ba38b91e9df7bdbb3"
+  integrity sha1-GVoh1sRuNh0vsSgbo4uR6d9727M=
+
 "ndjson@github:hugomrdias/ndjson#feat/readable-stream3":
   version "1.5.0"
   resolved "https://codeload.github.com/hugomrdias/ndjson/tar.gz/4db16da6b42e5b39bf300c3a7cde62abb3fa3a11"
@@ -17455,7 +17571,7 @@ node-forge@^0.10.0, node-forge@^0.7.1, node-forge@^0.7.5, node-forge@~0.7.6:
   resolved "https://registry.yarnpkg.com/node-forge/-/node-forge-0.10.0.tgz#32dea2afb3e9926f02ee5ce8794902691a676bf3"
   integrity sha512-PPmu8eEeG9saEUvI97fm4OYxXVB6bFvyNTyiUOBichBpFG8A1Ljw3bY62+5oOjDEMHRnd0Y7HQ+x7uzxOzC6JA==
 
-node-gyp-build@^4.2.0:
+node-gyp-build@^4.2.0, node-gyp-build@^4.2.3:
   version "4.2.3"
   resolved "https://registry.yarnpkg.com/node-gyp-build/-/node-gyp-build-4.2.3.tgz#ce6277f853835f718829efb47db20f3e4d9c4739"
   integrity sha512-MN6ZpzmfNCRM+3t57PTJHgHyw/h4OWnZ6mR8P5j/uZtqQr46RRuDE/P+g3n0YR/AiYXeWixZZzaip77gdICfRg==
@@ -18784,7 +18900,7 @@ pascalcase@^0.1.1:
   resolved "https://registry.yarnpkg.com/pascalcase/-/pascalcase-0.1.1.tgz#b363e55e8006ca6fe21784d2db22bd15d7917f14"
   integrity sha1-s2PlXoAGym/iF4TS2yK9FdeRfxQ=
 
-patch-package@6.2.2:
+patch-package@6.2.2, patch-package@^6.2.2:
   version "6.2.2"
   resolved "https://registry.yarnpkg.com/patch-package/-/patch-package-6.2.2.tgz#71d170d650c65c26556f0d0fbbb48d92b6cc5f39"
   integrity sha512-YqScVYkVcClUY0v8fF0kWOjDYopzIM8e3bj/RU1DPeEF14+dCGm6UeOYm4jvCyxqIEQ5/eJzmbWfDWnUleFNMg==
@@ -21407,6 +21523,14 @@ resolve@^1.1.4, resolve@^1.1.5, resolve@^1.1.6, resolve@^1.1.7, resolve@^1.10.0,
     is-core-module "^2.0.0"
     path-parse "^1.0.6"
 
+resolve@^1.15.1:
+  version "1.19.0"
+  resolved "https://registry.yarnpkg.com/resolve/-/resolve-1.19.0.tgz#1af5bf630409734a067cae29318aac7fa29a267c"
+  integrity sha512-rArEXAgsBG4UgRGcynxWIWKFvh/XZCcS8UJdHhwy91zwAvCZIbcs+vAbflgBnNjYMs/i/i+/Ux6IZhML1yPvxg==
+  dependencies:
+    is-core-module "^2.1.0"
+    path-parse "^1.0.6"
+
 resolve@~1.11.1:
   version "1.11.1"
   resolved "https://registry.yarnpkg.com/resolve/-/resolve-1.11.1.tgz#ea10d8110376982fef578df8fc30b9ac30a07a3e"
@@ -22087,6 +22211,20 @@ serve-handler@^6.1.2:
     path-to-regexp "2.2.1"
     range-parser "1.2.0"
 
+serve-handler@^6.1.3:
+  version "6.1.3"
+  resolved "https://registry.yarnpkg.com/serve-handler/-/serve-handler-6.1.3.tgz#1bf8c5ae138712af55c758477533b9117f6435e8"
+  integrity sha512-FosMqFBNrLyeiIDvP1zgO6YoTzFYHxLDEIavhlmQ+knB2Z7l1t+kGLHkZIDN7UVWqQAmKI3D20A6F6jo3nDd4w==
+  dependencies:
+    bytes "3.0.0"
+    content-disposition "0.5.2"
+    fast-url-parser "1.1.3"
+    mime-types "2.1.18"
+    minimatch "3.0.4"
+    path-is-inside "1.0.2"
+    path-to-regexp "2.2.1"
+    range-parser "1.2.0"
+
 serve-static@1.14.1:
   version "1.14.1"
   resolved "https://registry.yarnpkg.com/serve-static/-/serve-static-1.14.1.tgz#666e636dc4f010f7ef29970a88a674320898b2f9"
@@ -22167,6 +22305,16 @@ sha3@^1.2.2:
   dependencies:
     nan "2.13.2"
 
+shallow-clone@^0.1.2:
+  version "0.1.2"
+  resolved "https://registry.yarnpkg.com/shallow-clone/-/shallow-clone-0.1.2.tgz#5909e874ba77106d73ac414cfec1ffca87d97060"
+  integrity sha1-WQnodLp3EG1zrEFM/sH/yofZcGA=
+  dependencies:
+    is-extendable "^0.1.1"
+    kind-of "^2.0.1"
+    lazy-cache "^0.2.3"
+    mixin-object "^2.0.1"
+
 shallow-clone@^1.0.0:
   version "1.0.0"
   resolved "https://registry.yarnpkg.com/shallow-clone/-/shallow-clone-1.0.0.tgz#4480cd06e882ef68b2ad88a3ea54832e2c48b571"
@@ -25874,7 +26022,7 @@ yargs@^15.0.0, yargs@^15.0.2, yargs@^15.3.1:
     y18n "^4.0.0"
     yargs-parser "^18.1.2"
 
-yargs@^16.2.0:
+yargs@^16.0.0, yargs@^16.2.0:
   version "16.2.0"
   resolved "https://registry.yarnpkg.com/yargs/-/yargs-16.2.0.tgz#1c82bf0f6b6a66eafce7ef30e376f49a12477f66"
   integrity sha512-D1mvvtDG0L5ft/jGWkLpG1+m0eQxOfaBvTNELraWj22wSVUMWxZUvYgJYcKh6jGGIkJFhH4IZPQhR4TKpc8mBw==