feat: lavamoat + @endo/compartment-mapper PoC

[boneskull]

Continuation of #742

This is a prototype re-implementation of lavamoat based on @endo/compartment-mapper. There's still work to be done here, but it's now ready for review. We'd like to get it merged into main, but it needn't be published yet (imo).

Ref: endojs/endo#423

[boneskull]

• feat(endomoat): support native modules in policy gen #1076
• feat(endomoat): policy generation implementation #969
• feat: lavamoat + @endo/compartment-mapper PoC #772 👈
• chore: update lockfile post-release (yet again) #1062
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

Join @boneskull and the rest of your teammates on Graphite

[socket-security]

New and removed dependencies detected. Learn more about Socket for GitHub ↗︎

Package	New capabilities	Transitives	Size	Publisher
npm/@endo/compartment-mapper@1.1.3	Transitive: environment	+26	7.48 MB	kriskowal
npm/@endo/eslint-plugin@2.1.0	Transitive: environment, filesystem	+45	36.2 MB	kriskowal
npm/@endo/evasive-transform@1.0.4	Transitive: environment, filesystem, network	+24	7.25 MB	kriskowal
npm/@jessie.js/eslint-plugin@0.4.0	Transitive: filesystem	+1	44 kB	michaelfig
npm/@types/node@18.19.28	None	+1	2.04 MB	types
npm/ses@1.4.1	None	+1	3.35 MB	kriskowal
npm/type-fest@4.14.0	None	0	356 kB	sindresorhus

🚮 Removed packages: npm/ses@1.4.0

View full report↗︎

[boneskull]

CLI is now:

endomoat <entrypoint>

Run an application

Positionals:
  entrypoint  Path to the application entry point            [string] [required]

Options:
      --help                         Show help                         [boolean]
      --version                      Show version number               [boolean]
  -p, --policy                       Filepath to a policy file
                                 [string] [default: "lavamoat/node/policy.json"]
  -o, --policy-override, --override  Filepath to a policy override file
                        [string] [default: "lavamoat/node/policy-override.json"]
      --policy-debug, --pd           Filepath to a policy debug file
                           [string] [default: "lavamoat/node/policy-debug.json"]
      --cwd                          Path to application root directory
                                         [string] [default: (current directory)]

See #969 for how policy gen fits in

[naugtur]

I think it's time to merge this one. I'll dig deeper into some details here and there before we do, but I think the only change I'd want to see in this PR or the 969 one is giving it its final name. (that we're yet to choose)