From 43f3975c20d77d6473b00e646194f72e9124ce75 Mon Sep 17 00:00:00 2001
From: naugtur <naugtur@gmail.com>
Date: Wed, 13 Mar 2024 11:43:41 +0100
Subject: [PATCH 1/5] feat(webpack): ability to inline lockdown

---
 packages/webpack/src/buildtime/emitSes.js     | 79 ++++++++++++++-----
 packages/webpack/src/plugin.js                | 66 ++++++++++------
 packages/webpack/src/types.js                 |  2 +
 .../webpack/test/e2e-lockdown-inline.spec.js  | 29 +++++++
 4 files changed, 133 insertions(+), 43 deletions(-)
 create mode 100644 packages/webpack/test/e2e-lockdown-inline.spec.js

diff --git a/packages/webpack/src/buildtime/emitSes.js b/packages/webpack/src/buildtime/emitSes.js
index 43e0190798..f99f8d658e 100644
--- a/packages/webpack/src/buildtime/emitSes.js
+++ b/packages/webpack/src/buildtime/emitSes.js
@@ -1,40 +1,79 @@
 const { readFileSync } = require('node:fs')
+const path = require('node:path')
 const {
-  sources: { RawSource },
+  sources: { RawSource, ConcatSource },
 } = require('webpack')
 
+const lockdownSource = readFileSync(
+  path.join(require.resolve('ses'), '../lockdown.umd.min.js'),
+  'utf-8'
+)
+const lockdownSourcePrefix = `;(function(){\n${lockdownSource}\n})();\n`
+
 module.exports = {
+  /**
+   * @param {object} options
+   * @param {import('webpack').Compilation} options.compilation
+   * @param {string[]} options.inlineLockdown
+   * @returns {() => void}
+   */
+  sesPrefixFiles:
+    ({ compilation, inlineLockdown: files }) =>
+    () => {
+      files.forEach((file) => {
+        const asset = compilation.assets[file]
+        if (!asset) {
+          throw new Error(
+            `LavaMoatPlugin: file specified in inlineLockdown not found in compilation: ${file}`
+          )
+        }
+        compilation.assets[file] = new ConcatSource(lockdownSourcePrefix, asset)
+      })
+    },
+  /**
+   * @param {object} options
+   * @param {import('webpack').Compilation} options.compilation
+   * @param {import('webpack').WebpackPluginInstance} [options.HtmlWebpackPluginInUse]
+   * @param {boolean} [options.HtmlWebpackPluginInterop]
+   * @returns {() => void}
+   */
   sesEmitHook:
     ({ compilation, HtmlWebpackPluginInUse, HtmlWebpackPluginInterop }) =>
     () => {
-      const sesFile = readFileSync(require.resolve('ses'), 'utf-8')
       // TODO: to consider: instead manually copy to compiler.options.output.path
-      const asset = new RawSource(sesFile)
+      const asset = new RawSource(lockdownSource)
 
       compilation.emitAsset('lockdown', asset)
 
       if (HtmlWebpackPluginInUse && HtmlWebpackPluginInterop) {
         HtmlWebpackPluginInUse.constructor
+          // @ts-expect-error - incomplete types
           .getHooks(compilation)
-          .beforeEmit.tapAsync('LavaMoatWebpackPlugin-lockdown', (data, cb) => {
-            const scriptTag = '<script src="./lockdown"></script>'
-            const headTagRegex = /<head[^>]*>/iu
-            const scriptTagRegex = /<script/iu
+          .beforeEmit.tapAsync(
+            'LavaMoatWebpackPlugin-lockdown',
+            (
+              /** @type {{ html: string }} */ data,
+              /** @type {(arg0: null, arg1: any) => void} */ cb
+            ) => {
+              const scriptTag = '<script src="./lockdown"></script>'
+              const headTagRegex = /<head[^>]*>/iu
+              const scriptTagRegex = /<script/iu
 
-            if (headTagRegex.test(data.html)) {
-              data.html = data.html.replace(headTagRegex, `$&${scriptTag}`)
-            } else if (scriptTagRegex.test(data.html)) {
-              data.html = data.html.replace(
-                scriptTagRegex,
-                `${scriptTag}<script`
-              )
-            } else {
-              throw Error(
-                'LavaMoat: Could not insert lockdown script tag, no suitable location found in the html template'
-              )
+              if (headTagRegex.test(data.html)) {
+                data.html = data.html.replace(headTagRegex, `$&${scriptTag}`)
+              } else if (scriptTagRegex.test(data.html)) {
+                data.html = data.html.replace(
+                  scriptTagRegex,
+                  `${scriptTag}<script`
+                )
+              } else {
+                throw Error(
+                  'LavaMoat: Could not insert lockdown script tag, no suitable location found in the html template'
+                )
+              }
+              cb(null, data)
             }
-            cb(null, data)
-          })
+          )
       }
     },
 }
diff --git a/packages/webpack/src/plugin.js b/packages/webpack/src/plugin.js
index 40beea0a62..1e24193872 100644
--- a/packages/webpack/src/plugin.js
+++ b/packages/webpack/src/plugin.js
@@ -25,7 +25,7 @@ const JAVASCRIPT_MODULE_TYPE_ESM = 'javascript/esm'
 // @ts-ignore
 const { RUNTIME_KEY } = require('./ENUM.json')
 const { wrapGeneratorMaker } = require('./buildtime/generator.js')
-const { sesEmitHook } = require('./buildtime/emitSes.js')
+const { sesEmitHook, sesPrefixFiles } = require('./buildtime/emitSes.js')
 const EXCLUDE_LOADER = path.join(__dirname, './excludeLoader.js')
 
 class VirtualRuntimeModule extends RuntimeModule {
@@ -63,13 +63,17 @@ class LavaMoatPlugin {
    * @param {import('./types.js').LavaMoatPluginOptions} [options]
    */
   constructor(options = {}) {
-    if (!options.lockdown) {
-      options.lockdown = lockdownDefaults
+    /**
+     * @type {import('./types.js').LavaMoatPluginOptions & {
+     *   policyLocation: string
+     *   lockdown: object
+     * }}
+     */
+    this.options = {
+      lockdown: lockdownDefaults,
+      policyLocation: path.join('.', 'lavamoat', 'webpack'),
+      ...options,
     }
-    if (!options.policyLocation) {
-      options.policyLocation = path.join('.', 'lavamoat', 'webpack')
-    }
-    this.options = options
 
     diag.level = options.diagnosticsVerbosity || 0
   }
@@ -429,22 +433,38 @@ class LavaMoatPlugin {
           }
         )
 
-        const HtmlWebpackPluginInUse = compiler.options.plugins.find(
-          (plugin) => plugin && plugin.constructor.name === 'HtmlWebpackPlugin'
-        )
-
-        // TODO: avoid minification
-        compilation.hooks.processAssets.tap(
-          {
-            name: PLUGIN_NAME,
-            stage: Compilation.PROCESS_ASSETS_STAGE_ADDITIONAL,
-          },
-          sesEmitHook({
-            compilation,
-            HtmlWebpackPluginInUse,
-            HtmlWebpackPluginInterop: options.HtmlWebpackPluginInterop,
-          })
-        )
+        if (options.inlineLockdown) {
+          compilation.hooks.processAssets.tap(
+            {
+              name: PLUGIN_NAME,
+              stage: Compilation.PROCESS_ASSETS_STAGE_OPTIMIZE_INLINE,
+            },
+            sesPrefixFiles({
+              compilation,
+              inlineLockdown: options.inlineLockdown,
+            })
+          )
+        } else {
+          const HtmlWebpackPluginInUse = compiler.options.plugins.find(
+            /**
+             * @param {unknown} plugin
+             * @returns {plugin is import('webpack').WebpackPluginInstance}
+             */
+            (plugin) =>
+              !!plugin && plugin.constructor.name === 'HtmlWebpackPlugin'
+          )
+          compilation.hooks.processAssets.tap(
+            {
+              name: PLUGIN_NAME,
+              stage: Compilation.PROCESS_ASSETS_STAGE_ADDITIONAL,
+            },
+            sesEmitHook({
+              compilation,
+              HtmlWebpackPluginInUse,
+              HtmlWebpackPluginInterop: !!options.HtmlWebpackPluginInterop,
+            })
+          )
+        }
 
         // TODO: add later hooks to optionally verify correctness and totality
         // of wrapping for the paranoid mode.
diff --git a/packages/webpack/src/types.js b/packages/webpack/src/types.js
index da50c73590..d22e76400c 100644
--- a/packages/webpack/src/types.js
+++ b/packages/webpack/src/types.js
@@ -23,6 +23,8 @@
  * @property {Policy} [policy] - LavaMoat policy object - if programmaticly
  *   created
  * @property {Object} [lockdown] - Options to pass to lockdown
+ * @property {string[]} [inlineLockdown] - Prefix the listed files with lockdown
+ *   code
  */
 
 /**
diff --git a/packages/webpack/test/e2e-lockdown-inline.spec.js b/packages/webpack/test/e2e-lockdown-inline.spec.js
new file mode 100644
index 0000000000..325e4dd5a7
--- /dev/null
+++ b/packages/webpack/test/e2e-lockdown-inline.spec.js
@@ -0,0 +1,29 @@
+const test = require('ava')
+const { scaffold, runScript } = require('./scaffold.js')
+const { makeConfig } = require('./fixtures/main/webpack.config.js')
+
+test.before(async (t) => {
+  const webpackConfig = makeConfig({
+    inlineLockdown: ['app.js'],
+  })
+  await t.notThrowsAsync(async () => {
+    t.context.build = await scaffold(webpackConfig)
+  }, 'Expected the build to succeed')
+  t.context.bundle = t.context.build.snapshot['/dist/app.js']
+})
+
+test('webpack/lockdown-inline - bundle runs under lockdown', (t) => {
+  t.notThrows(() => {
+    runScript(
+      t.context.bundle +
+        `
+    ;;
+    if (!Object.isFrozen(Object.prototype)) {
+      throw Error('expected Object.prototype to be frozen');
+    }
+    if (!Compartment || !harden) {
+      throw Error('expected SES globals to be available');
+    }`
+    )
+  })
+})

From a7b82a2881b5c72b5c1f62e4155698f02e65c337 Mon Sep 17 00:00:00 2001
From: naugtur <naugtur@gmail.com>
Date: Wed, 13 Mar 2024 12:33:30 +0100
Subject: [PATCH 2/5] chore(webpack): refresh README.md

---
 packages/webpack/README.md    | 50 +++++++++++++++++------------------
 packages/webpack/src/types.js |  9 +++----
 2 files changed, 28 insertions(+), 31 deletions(-)

diff --git a/packages/webpack/README.md b/packages/webpack/README.md
index a975237b01..70e1219364 100644
--- a/packages/webpack/README.md
+++ b/packages/webpack/README.md
@@ -14,15 +14,20 @@ LavaMoat Webpack Plugin wraps each module in the bundle in a [Compartment](https
 
 > The plugin is emitting lockdown without the `.js` extension because that's the only way to prevent it from getting minified, which is likely to break it.
 
-The LavaMoat plugin takes an options object with the following properties:
-
-- policy: the LavaMoat policy object. (unstable. This will surely change before v1 or a policy loader export will be provided from the main package to incorporate policy-override files)
-- runChecks: Optional boolean property to indicate whether to check resulting code with wrapping for correctness. Default is false.
-- diagnosticsVerbosity: Optional number property to represent diagnostics output verbosity. A larger number means more overwhelming diagnostics output. Default is 0.  
-  Setting positive verbosity will enable runChecks.
-- readableResourceIds: Decide whether to keep resource IDs human readable (regardless of production/development mode). If false, they are replaced with a sequence of numbers. Keeping them readable may be useful for debugging when a policy violation error is thrown.
-- lockdown: set configuration for [SES lockdown](). Setting the option replaces defaults from LavaMoat.
-- HtmlWebpackPluginInterop: add a script tag to the html output for ./lockdown file if HtmlWebpackPlugin is in use
+The LavaMoat plugin takes an options object with the following properties (all optional):
+
+| property                 | description                                                                                                                                                                                                                                                                                                        | default                  |
+| ------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------ |
+| policyLocation           | Folder to store policy files in.                                                                                                                                                                                                                                                                                   | `./lavamoat/webpack`     |
+| generatePolicy           | Whether to generate the policy.json file. Generated policy is used in the build immediately. `policy-override.json` is applied before bundling, if present.                                                                                                                                                        | `false`                  |
+| emitPolicySnapshot       | If enabled, emits the result of merging policy with overrides into the output folder of webpack build for inspection. The file is not used by the bundle.                                                                                                                                                          | `false`                  |
+| readableResourceIds      | Boolean to decide whether to keep resource IDs human readable (possibly regardless of production/development mode). If false, they are replaced with a sequence of numbers. Keeping them readable may be useful for debugging when a policy violation error is thrown. By default follows the webpack config mode. | `(mode==='development')` |
+| lockdown                 | set configuration for [SES lockdown][]. Setting the option replaces defaults from LavaMoat.                                                                                                                                                                                                                        | reasonable defaults      |
+| HtmlWebpackPluginInterop | Boolean to add a script tag to the html output for ./lockdown file if HtmlWebpackPlugin is in use.                                                                                                                                                                                                                 | `false`                  |
+| inlineLockdown           | array of output filenames to inline lockdown into instead of adding it as a file to the output folder.                                                                                                                                                                                                             |
+| runChecks                | boolean property to indicate whether to check resulting code with wrapping for correctness.                                                                                                                                                                                                                        | `false`                  |
+| diagnosticsVerbosity     | number property to represent diagnostics output verbosity. A larger number means more overwhelming diagnostics output. Setting positive verbosity will enable runChecks.                                                                                                                                           | `0`                      |
+| policy                   | the LavaMoat policy object. (by default policy is loaded from files, this is an override)                                                                                                                                                                                                                          | `undefined`              |
 
 ```js
 const LavaMoatPlugin = require('@lavamoat/webpack')
@@ -31,18 +36,8 @@ module.exports = {
   // ... other webpack configuration properties
   plugins: [
     new LavaMoatPlugin({
-      // policy generated by lavamoat
-      policy: require('./lavamoat/policy.json'),
-      // runChecks: true, // enables checking each wrapped module source if it's still proper JavaScript (in case mismatching braces somehow survived Webpack loaders processing)
-      // readableResourceIds: true, // explicitly decide if resourceIds from policy should be readable in the bundle or turned into numbers. You might want to bundle in production mode but keep the ids for debugging
-      //   diagnosticsVerbosity: 2, // level of output verbosity from the plugin
-      // SES lockdown options to use at runtime
-      // lockdown: {
-      //   errorTaming: "unsafe",
-      //   consoleTaming: "unsafe",
-      //   overrideTaming: "severe"
-      // },
-      // HtmlWebpackPluginInterop: false, // set it to true if you want a script tag for ./lockdown file to automatically be added to your HTML template
+      generatePolicy: true,
+      // ... settings from above, optionally
     }),
   ],
   // ... other webpack configuration properties
@@ -74,7 +69,7 @@ Example: avoid wrapping CSS modules:
           'css-loader',
           LavaMoatPlugin.exclude,
         ],
-        sideEffects: true,
+        // ...
       },
     ],
   },
@@ -107,12 +102,13 @@ Sadly, even treeshaking doesn't eliminate that module. It's left there and faili
 
 This plugin will skip policy enforcement for such ignored modules.
 
-# Security Claims
+# Security
 
-**This is a _beta_ release and does not provide any guarantees; even those listed below. Use at your own risk!**
+**This is an experimental technology. Use at your own risk!**
 
-- SES must be added to the page without any bundling or transforming for any security guarantees to be sustained.
-  - The plugin is attempting to add it as an asset to the compilation for the sake of Developer Experience. Feedback welcome.
+- [SES lockdown][] must be added to the page without any bundling or transforming for any security guarantees to be sustained.
+  - The plugin is attempting to add it as an asset to the compilation for the sake of Developer Experience. `.js` extension is omitted to prevent minification.
+  - Optionally lockdown can be inlined into the bundle files. It's hard to determine which files are loaded when, so providing filenames for scripts that get to load as the first script on the page to apply lockdown only once is how one uses inlining.
 - Each javascript module resulting from the webpack build is scoped to its package's policy
 
 ## Threat Model
@@ -137,3 +133,5 @@ Run `npm test` to start the automated tests.
 - Navigate to `example/`
 - Run `npm ci` and `npm test`
 - Open `dist/index.html` in your browser and inspect the console
+
+[SES lockdown]: https://github.com/endojs/endo/tree/master/packages/ses#lockdown
diff --git a/packages/webpack/src/types.js b/packages/webpack/src/types.js
index d22e76400c..dd772ef7e6 100644
--- a/packages/webpack/src/types.js
+++ b/packages/webpack/src/types.js
@@ -12,19 +12,18 @@
  *   defaults to './lavamoat/webpack'
  * @property {boolean} [emitPolicySnapshot] - Additionally put policy in dist of
  *   webpack compilation
- * @property {boolean} [runChecks] - Check resulting code with wrapping for
- *   correctness
  * @property {boolean} [readableResourceIds] - Should resourceIds be readable or
  *   turned into numbers - defaults to (mode==='development')
  * @property {boolean} [HtmlWebpackPluginInterop] - Add a script tag to the html
  *   output for lockdown.js if HtmlWebpackPlugin is in use
+ * @property {string[]} [inlineLockdown] - Prefix the listed files with lockdown
  * @property {number} [diagnosticsVerbosity] - A number representing diagnostics
  *   output verbosity, the larger the more overwhelming
+ * @property {Object} [lockdown] - Options to pass to lockdown
  * @property {Policy} [policy] - LavaMoat policy object - if programmaticly
  *   created
- * @property {Object} [lockdown] - Options to pass to lockdown
- * @property {string[]} [inlineLockdown] - Prefix the listed files with lockdown
- *   code
+ * @property {boolean} [runChecks] - Check resulting code with wrapping for
+ *   correctness
  */
 
 /**

From c245b235f42b8e8c2f28653094dcf2905b1fe44e Mon Sep 17 00:00:00 2001
From: Zbyszek Tenerowicz <naugtur@gmail.com>
Date: Fri, 22 Mar 2024 15:29:53 +0100
Subject: [PATCH 3/5] chore(webpack): Apply suggestions from code review

Co-authored-by: Christopher Hiller <boneskull@boneskull.com>
---
 packages/webpack/README.md     | 22 +++++++++++-----------
 packages/webpack/src/plugin.js |  2 +-
 2 files changed, 12 insertions(+), 12 deletions(-)

diff --git a/packages/webpack/README.md b/packages/webpack/README.md
index 70e1219364..a1afaa0dd4 100644
--- a/packages/webpack/README.md
+++ b/packages/webpack/README.md
@@ -16,18 +16,18 @@ LavaMoat Webpack Plugin wraps each module in the bundle in a [Compartment](https
 
 The LavaMoat plugin takes an options object with the following properties (all optional):
 
-| property                 | description                                                                                                                                                                                                                                                                                                        | default                  |
+| Property                 | Description                                                                                                                                                                                                                                                                                                        | Default                  |
 | ------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------ |
-| policyLocation           | Folder to store policy files in.                                                                                                                                                                                                                                                                                   | `./lavamoat/webpack`     |
-| generatePolicy           | Whether to generate the policy.json file. Generated policy is used in the build immediately. `policy-override.json` is applied before bundling, if present.                                                                                                                                                        | `false`                  |
-| emitPolicySnapshot       | If enabled, emits the result of merging policy with overrides into the output folder of webpack build for inspection. The file is not used by the bundle.                                                                                                                                                          | `false`                  |
-| readableResourceIds      | Boolean to decide whether to keep resource IDs human readable (possibly regardless of production/development mode). If false, they are replaced with a sequence of numbers. Keeping them readable may be useful for debugging when a policy violation error is thrown. By default follows the webpack config mode. | `(mode==='development')` |
-| lockdown                 | set configuration for [SES lockdown][]. Setting the option replaces defaults from LavaMoat.                                                                                                                                                                                                                        | reasonable defaults      |
-| HtmlWebpackPluginInterop | Boolean to add a script tag to the html output for ./lockdown file if HtmlWebpackPlugin is in use.                                                                                                                                                                                                                 | `false`                  |
-| inlineLockdown           | array of output filenames to inline lockdown into instead of adding it as a file to the output folder.                                                                                                                                                                                                             |
-| runChecks                | boolean property to indicate whether to check resulting code with wrapping for correctness.                                                                                                                                                                                                                        | `false`                  |
-| diagnosticsVerbosity     | number property to represent diagnostics output verbosity. A larger number means more overwhelming diagnostics output. Setting positive verbosity will enable runChecks.                                                                                                                                           | `0`                      |
-| policy                   | the LavaMoat policy object. (by default policy is loaded from files, this is an override)                                                                                                                                                                                                                          | `undefined`              |
+| `policyLocation`           | Folder to store policy files in.                                                                                                                                                                                                                                                                                   | `./lavamoat/webpack`     |
+| `generatePolicy`           | Whether to generate the `policy.json` file. Generated policy is used in the build immediately. `policy-override.json` is applied before bundling, if present.                                                                                                                                                        | `false`                  |
+| `emitPolicySnapshot`       | If enabled, emits the result of merging policy with overrides into the output folder of Webpack build for inspection. The file is not used by the bundle.                                                                                                                                                          | `false`                  |
+| `readableResourceIds`      | Boolean to decide whether to keep resource IDs human readable (possibly regardless of production/development mode). If `false`, they are replaced with a sequence of numbers. Keeping them readable may be useful for debugging when a policy violation error is thrown. By default, follows the Webpack config mode. | `(mode==='development')` |
+| `lockdown`                 | Configuration for [SES lockdown][]. Setting the option replaces defaults from LavaMoat.                                                                                                                                                                                                                        | reasonable defaults      |
+| `HtmlWebpackPluginInterop` | Boolean to add a script tag to the HTML output for `./lockdown` file if `HtmlWebpackPlugin` is in use.                                                                                                                                                                                                                 | `false`                  |
+| `inlineLockdown`           | Array of output filenames in which to inline lockdown (instead of adding it as a file to the output folder).                                                                                                                                                                                                             |
+| `runChecks`                | Boolean property to indicate whether to check resulting code with wrapping for correctness.                                                                                                                                                                                                                        | `false`                  |
+| `diagnosticsVerbosity`     | Number property to represent diagnostics output verbosity. A larger number means more overwhelming diagnostics output. Setting a positive verbosity will enable `runChecks`.                                                                                                                                           | `0`                      |
+| `policy`                   | The LavaMoat policy object (if not loading from file; see `policyLocation`)                                                                                                                                                                                                                          | `undefined`              |
 
 ```js
 const LavaMoatPlugin = require('@lavamoat/webpack')
diff --git a/packages/webpack/src/plugin.js b/packages/webpack/src/plugin.js
index 1e24193872..5c531f8597 100644
--- a/packages/webpack/src/plugin.js
+++ b/packages/webpack/src/plugin.js
@@ -451,7 +451,7 @@ class LavaMoatPlugin {
              * @returns {plugin is import('webpack').WebpackPluginInstance}
              */
             (plugin) =>
-              !!plugin && plugin.constructor.name === 'HtmlWebpackPlugin'
+              !!plugin && typeof plugin === 'object' && plugin.constructor.name === 'HtmlWebpackPlugin'
           )
           compilation.hooks.processAssets.tap(
             {

From 19545317acb5e25fbe049be2b8f55ff97a3ce582 Mon Sep 17 00:00:00 2001
From: naugtur <naugtur@gmail.com>
Date: Mon, 8 Apr 2024 13:34:46 +0200
Subject: [PATCH 4/5] chore(webpack): inlining description tweak

---
 packages/webpack/README.md | 24 ++++++++++++------------
 1 file changed, 12 insertions(+), 12 deletions(-)

diff --git a/packages/webpack/README.md b/packages/webpack/README.md
index a1afaa0dd4..a8e0c05710 100644
--- a/packages/webpack/README.md
+++ b/packages/webpack/README.md
@@ -16,18 +16,18 @@ LavaMoat Webpack Plugin wraps each module in the bundle in a [Compartment](https
 
 The LavaMoat plugin takes an options object with the following properties (all optional):
 
-| Property                 | Description                                                                                                                                                                                                                                                                                                        | Default                  |
-| ------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------ |
-| `policyLocation`           | Folder to store policy files in.                                                                                                                                                                                                                                                                                   | `./lavamoat/webpack`     |
-| `generatePolicy`           | Whether to generate the `policy.json` file. Generated policy is used in the build immediately. `policy-override.json` is applied before bundling, if present.                                                                                                                                                        | `false`                  |
-| `emitPolicySnapshot`       | If enabled, emits the result of merging policy with overrides into the output folder of Webpack build for inspection. The file is not used by the bundle.                                                                                                                                                          | `false`                  |
+| Property                   | Description                                                                                                                                                                                                                                                                                                           | Default                  |
+| -------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------ |
+| `policyLocation`           | Folder to store policy files in.                                                                                                                                                                                                                                                                                      | `./lavamoat/webpack`     |
+| `generatePolicy`           | Whether to generate the `policy.json` file. Generated policy is used in the build immediately. `policy-override.json` is applied before bundling, if present.                                                                                                                                                         | `false`                  |
+| `emitPolicySnapshot`       | If enabled, emits the result of merging policy with overrides into the output folder of Webpack build for inspection. The file is not used by the bundle.                                                                                                                                                             | `false`                  |
 | `readableResourceIds`      | Boolean to decide whether to keep resource IDs human readable (possibly regardless of production/development mode). If `false`, they are replaced with a sequence of numbers. Keeping them readable may be useful for debugging when a policy violation error is thrown. By default, follows the Webpack config mode. | `(mode==='development')` |
-| `lockdown`                 | Configuration for [SES lockdown][]. Setting the option replaces defaults from LavaMoat.                                                                                                                                                                                                                        | reasonable defaults      |
-| `HtmlWebpackPluginInterop` | Boolean to add a script tag to the HTML output for `./lockdown` file if `HtmlWebpackPlugin` is in use.                                                                                                                                                                                                                 | `false`                  |
-| `inlineLockdown`           | Array of output filenames in which to inline lockdown (instead of adding it as a file to the output folder).                                                                                                                                                                                                             |
-| `runChecks`                | Boolean property to indicate whether to check resulting code with wrapping for correctness.                                                                                                                                                                                                                        | `false`                  |
-| `diagnosticsVerbosity`     | Number property to represent diagnostics output verbosity. A larger number means more overwhelming diagnostics output. Setting a positive verbosity will enable `runChecks`.                                                                                                                                           | `0`                      |
-| `policy`                   | The LavaMoat policy object (if not loading from file; see `policyLocation`)                                                                                                                                                                                                                          | `undefined`              |
+| `lockdown`                 | Configuration for [SES lockdown][]. Setting the option replaces defaults from LavaMoat.                                                                                                                                                                                                                               | reasonable defaults      |
+| `HtmlWebpackPluginInterop` | Boolean to add a script tag to the HTML output for `./lockdown` file if `HtmlWebpackPlugin` is in use.                                                                                                                                                                                                                | `false`                  |
+| `inlineLockdown`           | Array of output filenames in which to inline lockdown (instead of adding it as a file to the output folder).                                                                                                                                                                                                          |
+| `runChecks`                | Boolean property to indicate whether to check resulting code with wrapping for correctness.                                                                                                                                                                                                                           | `false`                  |
+| `diagnosticsVerbosity`     | Number property to represent diagnostics output verbosity. A larger number means more overwhelming diagnostics output. Setting a positive verbosity will enable `runChecks`.                                                                                                                                          | `0`                      |
+| `policy`                   | The LavaMoat policy object (if not loading from file; see `policyLocation`)                                                                                                                                                                                                                                           | `undefined`              |
 
 ```js
 const LavaMoatPlugin = require('@lavamoat/webpack')
@@ -108,7 +108,7 @@ This plugin will skip policy enforcement for such ignored modules.
 
 - [SES lockdown][] must be added to the page without any bundling or transforming for any security guarantees to be sustained.
   - The plugin is attempting to add it as an asset to the compilation for the sake of Developer Experience. `.js` extension is omitted to prevent minification.
-  - Optionally lockdown can be inlined into the bundle files. It's hard to determine which files are loaded when, so providing filenames for scripts that get to load as the first script on the page to apply lockdown only once is how one uses inlining.
+  - Optionally lockdown can be inlined into the bundle files. It's hard to determine how entries in the config are deployed and used, so you need to list the scripts that get to load as the first script on theDo we have page to apply lockdown only once when inlined. When you have a single bundle, you just configure a list with one element. It gets more complex with builds for multiple pages.
 - Each javascript module resulting from the webpack build is scoped to its package's policy
 
 ## Threat Model

From 0eaa1d21bfdc73f9c6e6de7dbc7059e622a978db Mon Sep 17 00:00:00 2001
From: Zbyszek Tenerowicz <naugtur@gmail.com>
Date: Mon, 15 Apr 2024 11:34:04 +0200
Subject: [PATCH 5/5] chore(webpack): Apply suggestions from code review

Co-authored-by: legobeat <109787230+legobeat@users.noreply.github.com>
Co-authored-by: Christopher Hiller <boneskull@boneskull.com>
---
 packages/webpack/README.md                | 10 +++++-----
 packages/webpack/src/buildtime/emitSes.js |  2 +-
 packages/webpack/src/types.js             |  2 +-
 3 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/packages/webpack/README.md b/packages/webpack/README.md
index a8e0c05710..fb4b1890e1 100644
--- a/packages/webpack/README.md
+++ b/packages/webpack/README.md
@@ -18,13 +18,13 @@ The LavaMoat plugin takes an options object with the following properties (all o
 
 | Property                   | Description                                                                                                                                                                                                                                                                                                           | Default                  |
 | -------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------ |
-| `policyLocation`           | Folder to store policy files in.                                                                                                                                                                                                                                                                                      | `./lavamoat/webpack`     |
+| `policyLocation`           | Directory to store policy files in.                                                                                                                                                                                                                                                                                   | `./lavamoat/webpack`     |
 | `generatePolicy`           | Whether to generate the `policy.json` file. Generated policy is used in the build immediately. `policy-override.json` is applied before bundling, if present.                                                                                                                                                         | `false`                  |
-| `emitPolicySnapshot`       | If enabled, emits the result of merging policy with overrides into the output folder of Webpack build for inspection. The file is not used by the bundle.                                                                                                                                                             | `false`                  |
+| `emitPolicySnapshot`       | If enabled, emits the result of merging policy with overrides into the output directory of Webpack build for inspection. The file is not used by the bundle.                                                                                                                                                          | `false`                  |
 | `readableResourceIds`      | Boolean to decide whether to keep resource IDs human readable (possibly regardless of production/development mode). If `false`, they are replaced with a sequence of numbers. Keeping them readable may be useful for debugging when a policy violation error is thrown. By default, follows the Webpack config mode. | `(mode==='development')` |
 | `lockdown`                 | Configuration for [SES lockdown][]. Setting the option replaces defaults from LavaMoat.                                                                                                                                                                                                                               | reasonable defaults      |
 | `HtmlWebpackPluginInterop` | Boolean to add a script tag to the HTML output for `./lockdown` file if `HtmlWebpackPlugin` is in use.                                                                                                                                                                                                                | `false`                  |
-| `inlineLockdown`           | Array of output filenames in which to inline lockdown (instead of adding it as a file to the output folder).                                                                                                                                                                                                          |
+| `inlineLockdown`           | Array of output filenames in which to inline lockdown (instead of adding it as a file to the output directory).                                                                                                                                                                                                       |
 | `runChecks`                | Boolean property to indicate whether to check resulting code with wrapping for correctness.                                                                                                                                                                                                                           | `false`                  |
 | `diagnosticsVerbosity`     | Number property to represent diagnostics output verbosity. A larger number means more overwhelming diagnostics output. Setting a positive verbosity will enable `runChecks`.                                                                                                                                          | `0`                      |
 | `policy`                   | The LavaMoat policy object (if not loading from file; see `policyLocation`)                                                                                                                                                                                                                                           | `undefined`              |
@@ -104,11 +104,11 @@ This plugin will skip policy enforcement for such ignored modules.
 
 # Security
 
-**This is an experimental technology. Use at your own risk!**
+**This is an experimental software. Use at your own risk!**
 
 - [SES lockdown][] must be added to the page without any bundling or transforming for any security guarantees to be sustained.
   - The plugin is attempting to add it as an asset to the compilation for the sake of Developer Experience. `.js` extension is omitted to prevent minification.
-  - Optionally lockdown can be inlined into the bundle files. It's hard to determine how entries in the config are deployed and used, so you need to list the scripts that get to load as the first script on theDo we have page to apply lockdown only once when inlined. When you have a single bundle, you just configure a list with one element. It gets more complex with builds for multiple pages.
+  - Optionally lockdown can be inlined into the bundle files. You need to list the scripts that get to load as the first script on the page to apply lockdown only once when inlined. When you have a single bundle, you just configure a list with one element. It gets more complex with builds for multiple pages. The plugin doesn't attempt to guess where to inline lockdown.
 - Each javascript module resulting from the webpack build is scoped to its package's policy
 
 ## Threat Model
diff --git a/packages/webpack/src/buildtime/emitSes.js b/packages/webpack/src/buildtime/emitSes.js
index f99f8d658e..3cd0d5b68d 100644
--- a/packages/webpack/src/buildtime/emitSes.js
+++ b/packages/webpack/src/buildtime/emitSes.js
@@ -64,7 +64,7 @@ module.exports = {
               } else if (scriptTagRegex.test(data.html)) {
                 data.html = data.html.replace(
                   scriptTagRegex,
-                  `${scriptTag}<script`
+                  `${scriptTag}$&`
                 )
               } else {
                 throw Error(
diff --git a/packages/webpack/src/types.js b/packages/webpack/src/types.js
index dd772ef7e6..fd22a3ba50 100644
--- a/packages/webpack/src/types.js
+++ b/packages/webpack/src/types.js
@@ -19,7 +19,7 @@
  * @property {string[]} [inlineLockdown] - Prefix the listed files with lockdown
  * @property {number} [diagnosticsVerbosity] - A number representing diagnostics
  *   output verbosity, the larger the more overwhelming
- * @property {Object} [lockdown] - Options to pass to lockdown
+ * @property {import('ses').LockdownOptions} [lockdown] - Options to pass to lockdown
  * @property {Policy} [policy] - LavaMoat policy object - if programmaticly
  *   created
  * @property {boolean} [runChecks] - Check resulting code with wrapping for