`inlineLockdown` breaks the generated source maps

[jordan-enev]

Hi, recently integrated LavaMoat in a project. Our webpack has 2 entries that need to be protected under LavaMoat. Since we don't have separate HTML files for those entries, we use the inlineLockdown option.

What I found is that inlineLockdown hooks at a later stage (Compilation.PROCESS_ASSETS_STAGE_OPTIMIZE_INLINE), when source maps are already being generated. Injecting the lockdown script into the entries results in incorrect source maps:

LavaMoat/packages/webpack/src/plugin.js

Lines 563 to 574 in 70436d7

	if (STORE.options.inlineLockdown) {
	compilation.hooks.processAssets.tap(
	{
	name: PLUGIN_NAME,
	stage: Compilation.PROCESS_ASSETS_STAGE_OPTIMIZE_INLINE,
	},
	sesPrefixFiles({
	compilation,
	inlineLockdown: STORE.options.inlineLockdown,
	})
	)
	} else {

When I change LavaMoatPlugin to hook at an earlier stage (Compilation.PROCESS_ASSETS_STAGE_DEV_TOOLING - 1), source maps work as expected.

Here's the patch I made:

Here's the Webpack hooks order of execution. As you can see, PROCESS_ASSETS_STAGE_OPTIMIZE_INLINE runs later, when source maps are already generated:

This is my env, most important packages:

"expo": "54.0.32",
"react-native": "0.81.5",
"react": "19.1.0",
"@expo/webpack-config": "19.0.1",
"@lavamoat/webpack": "1.5.8",
"webpack": "5.84.1"

IMO it looks safe to hook LavaMoatPlugin before source maps generation. If you agree, I can submit a PR for the change.

Thanks!