Because JavaScript is dynamic, you can often rebind things like window.fetch to trace what’s going on (store the old copy and replace with a new one that does something before delegating). If you can arrange your shim to be loaded before any other JS, I guess you could implement something like object capabilities for JavaScript?