chore: integrate LavaMoat/harden

.npmrc

@@ -0,0 +1,5 @@
+## Make using npm impossible.
+offline=true
+
+## Ignore scripts just in case.
+ignore-scripts=true

.nvmrc

@@ -1 +1 @@
-lts/*
+26

.oxfmtrc.json

@@ -16,5 +16,5 @@
   },
   "tabWidth": 2,
   "trailingComma": "all",
-  "ignorePatterns": [".yarnrc.yml", "merged-packages/**"]
+  "ignorePatterns": [".yarnrc.yml", "merged-packages/**", "lavamoat"]
 }

.yarnrc

@@ -0,0 +1,2 @@
+## Ignore scripts in case yarn1 is accidentally used.
+ignore-scripts true

.yarnrc.yml

@@ -7,10 +7,20 @@ compressionLevel: mixed
 
 enableGlobalCache: false
 
+# Hardened mode to validate lockfile content against remote registries.
+enableHardenedMode: true
+
+# Disable Yarn's mirror feature to avoid writing to the global cache.
+enableMirror: false
+
 enableScripts: false
 
 enableTelemetry: false
 
+# Despite `enableGlobalCache` and `enableMirror` being `false`, Yarn is still
+# writing to the global folder.
+globalFolder: .yarn/global
+
 logFilters:
   - code: YN0004
     level: discard
@@ -29,6 +39,7 @@ npmPreapprovedPackages:
   - "@lavamoat/*"
   - "@ts-bridge/*"
 
+# Protect the runtime of calls to "yarn run" scripts using a local plugin.
 plugins:
-  - path: .yarn/plugins/@yarnpkg/plugin-allow-scripts.cjs
-    spec: "https://raw.githubusercontent.com/LavaMoat/LavaMoat/main/packages/yarn-plugin-allow-scripts/bundles/@yarnpkg/plugin-allow-scripts.js"
+  - path: ./lavamoat/plugin-allow-scripts.js
+  - path: ./lavamoat/.runner-plugin.js

eslint.config.mjs

@@ -81,6 +81,7 @@ const config = createConfig([
       '.platform-api-docs/**',
       '.skills-cache/**',
       '.yarn/**',
+      'lavamoat/',
       'merged-packages/**',
       'packages/wallet-framework-docs/site/build/**',
       'scripts/create-package/package-template/**',

lavamoat/.env.ban.json

@@ -0,0 +1,9 @@
+[
+  "SESSION",
+  "SSH",
+  "KEY",
+  "TOKEN",
+  "SECRET",
+  "PASSWORD",
+  "AUTH"
+]