lavamoatRuntimeWrapper = (resourceId, runtimeKit) => {
  if (!LOCKDOWN_ON) {
    // Scope Terminator not being present in the output causes the wrapper closure to run a no-op instaed of the module body
    return create(null)
  }

  if (!compartmentMap.has(resourceId)) {
    // Endow original Math and Date, because SES tames them and we don't need that
    const c = new Compartment({ Math, Date })
    installGlobalsForPolicy(resourceId, c.globalThis)
    compartmentMap.set(resourceId, c)
  }

  const overrides = create(null)

  // modules may reference `require` dynamically, but that's something we don't want to allow
  const { __webpack_require__ } = runtimeKit
  let { module } = runtimeKit

  if (__webpack_require__) {
    // wrap webpack runtime for policy check and hardening
    const policyRequire = wrapRequireWithPolicy(__webpack_require__, resourceId)

    /**
     * Wrapped chunk loader
     *
     * @param {string | number} chunkId
     */
    policyRequire.e = (chunkId) => {
      // Chunk resolution at runtime may be a lookup table or a string concatenation. In the latter case it can be fooled into loading any file from under publicPath. That's why we only want to accept known chunks.
      if (!LAVAMOAT.kch.includes(chunkId)) {
        throw Error(
          `Attempt to load a chunk that was not known at compile time: ${chunkId} from ${resourceId}`
        )
      }
      return __webpack_require__.e(chunkId)
    }
    // TODO: It's possible most of the work here could be done once instead of for each wrapping

    // Webpack has a few one-letter functions in the runtime and built-in plugins that add more runtime functions. We might need to support them eventually.
    // It's a case-by-case basis decision.
    // TODO: print a warning for other functions on the __webpack_require__ namespace that we're not supporting.
    //   It's probably best served at build time though - with runtimeRequirements or looking at the items in webpack runtime when adding lavamoat runtime.
    // The following seem harmless and are used by default: ['O', 'n', 'd', 'o', 'r', 's', 't', 'b']
    // To discover more, go to https://github.com/webpack/webpack/blob/main/lib/RuntimeGlobals.js and/or look at implementations here https://github.com/webpack/webpack/tree/main/lib/runtime/
    // Looking at the runtime chunk in the built bundle is probably the fastest way to learn what these do.

    const supportedRuntimeItems = ['O', 'n', 'd', 'o', 'r', 's', 't', 'b']
    for (const item of supportedRuntimeItems) {
      policyRequire[item] = harden(__webpack_require__[item])
    }

    policyRequire.m = new Proxy(
      {},
      {
        has: (target, prop) => {
          warn(
            `A module attempted to read ${String(
              prop
            )} directly from webpack's module cache`
          )
          return false
        },
      }
    )

    // webpack rewrites regerences to `global` to `__webpack_require__.g` in the bundle
    policyRequire.g = compartmentMap.get(resourceId).globalThis

    // override nmd to limit what it can mutate
    policyRequire.nmd = (/** @type {any} */ moduleReference) =>
      moduleReference === module
        ? __webpack_require__.nmd(module)
        : moduleReference
    // override hmd to limit what it can mutate
    policyRequire.hmd = (/** @type {any} */ moduleReference) =>
      moduleReference === module
        ? __webpack_require__.hmd(module)
        : moduleReference

    overrides.__webpack_require__ = policyRequire
  }
  const runtimeHandler = assign(create(null), runtimeKit, overrides)

  // allow setting, but ignore value for /* module decorator */ module = __webpack_require__.nmd(module)
  defineProperty(runtimeHandler, 'module', {
    get: () => module,
    set: () => {},
  })
  // Make it possible to overwrite `exports` locally despite runtimeHandler being frozen
  let exportsReference = runtimeHandler.exports
  defineProperty(runtimeHandler, 'exports', {
    get: () => exportsReference,
    set: (value) => {
      exportsReference = value
    },
  })
  freeze(runtimeHandler)

  return freeze(
    assign(create(null), {
      [NAME_scopeTerminator]: stricterScopeTerminator,
      [NAME_runtimeHandler]: runtimeHandler,
      [NAME_globalThis]: compartmentMap.get(resourceId).globalThis,
    })
  )
}
Wraps the webpack runtime with Lavamoat security features.

@param {string} resourceId - The identifier of the resource.
@param {object} runtimeKit - The runtime kit containing bits from the webpack
  runtime.
@param {any} [runtimeKit.__webpack_require__] - The webpack require function.
@param {object} [runtimeKit.module] - The module object.
@param {any} [runtimeKit.exports] - The exports object.
@returns {{
  [NAME_scopeTerminator]: Object
  [NAME_runtimeHandler]: Object
  [NAME_globalThis]: Object
}}
  An object containing:

  - [NAME_scopeTerminator]: The stricter scope terminator proxy that prevents
      access to bundler scope
  - [NAME_runtimeHandler]: The frozen runtime handler with wrapped webpack
      functions and security checks
  - [NAME_globalThis]: The compartment's isolated globalThis object for the
      module