module-develop-kit 1.2.3 → 1.3.0

package/dist/src/vite-plugins/vite-plugin-sri/internal.js

@@ -0,0 +1,1173 @@
+import { createHash as Q } from "node:crypto";
+import { createRequire as Y } from "node:module";
+import $ from "node:path";
+import { pathToFileURL as _ } from "node:url";
+import { parse as T } from "../../../vendor/parse5/dist/index.js";
+import { getVitePluginSriBase as Z } from "./config.js";
+import { serialize as H } from "../../../vendor/parse5/dist/serializer/index.js";
+function C(e) {
+  return typeof e == "string" && /^(https?:)?\/\//i.test(e);
+}
+function B(e) {
+  return e.replace(/</g, "\\u003c").replace(/\u2028/g, "\\u2028").replace(/\u2029/g, "\\u2029");
+}
+function F(e) {
+  return typeof e != "string" ? e : e.startsWith("//") ? e.slice(2) : e.startsWith("/") ? e.slice(1) : e.startsWith("./") ? e.slice(2) : e;
+}
+function P(e, t) {
+  if (C(e)) {
+    const n = e.endsWith("/") ? e : `${e}/`, r = t.startsWith("/") ? t.slice(1) : t;
+    return n + r;
+  }
+  return $.posix.join(e, t);
+}
+function tt(e, t, n) {
+  if (C(e) || e.startsWith("/"))
+    return P(e, t);
+  const r = $.posix.dirname(n), i = $.posix.relative(r === "" ? "." : r, t);
+  return i.startsWith("..") ? i : `./${i}`;
+}
+function et(e) {
+  return e.startsWith("/") || C(e);
+}
+function U(e, t, n = [], r = /* @__PURE__ */ new Set()) {
+  if (!et(t)) return null;
+  const i = {};
+  for (const { pathname: s, fileName: f } of q(e, n, r))
+    i[P(t, f)] = e[s];
+  return i;
+}
+function q(e, t = [], n = /* @__PURE__ */ new Set()) {
+  const r = [];
+  for (const i of Object.keys(e)) {
+    if (!/\.m?js(\?|$)/i.test(i)) continue;
+    const s = i.startsWith("/") ? i.slice(1) : i;
+    R(s, t) || n.has(s) || r.push({ pathname: i, fileName: s });
+  }
+  return r;
+}
+function R(e, t) {
+  if (!t || t.length === 0) return !1;
+  for (const n of t)
+    if (A(n, e) || A(n, `/${e}`)) return !0;
+  return !1;
+}
+function nt(e) {
+  if (C(e))
+    try {
+      const n = e.startsWith("//") ? `https:${e}` : e;
+      return new URL(n).pathname;
+    } catch {
+    }
+  const t = F(e);
+  return t.startsWith("/") ? t : `/${t}`;
+}
+function rt(e, t) {
+  if (!e) return null;
+  const n = Object.keys(e);
+  if (e[t]) return e[t];
+  let r = n.find((s) => s === t || s.endsWith(`/${t}`));
+  if (r) return e[r];
+  const i = t.split("/").pop();
+  return i ? (r = n.find((s) => s === i || s.endsWith(`/${i}`)), r ? e[r] : null) : null;
+}
+async function it(e, t, n) {
+  if (!e) return null;
+  const r = n?.enableCache !== !1, i = n?.cache, s = n?.fetchTimeoutMs ?? 0, f = n?.pending;
+  if (C(e)) {
+    const u = e.startsWith("//") ? `https:${e}` : e;
+    if (r && i && i.has(u))
+      return i.get(u) ?? null;
+    let l, d, g;
+    s && s > 0 && typeof AbortController < "u" && (l = new AbortController(), d = l.signal, g = setTimeout(() => l.abort(), s));
+    const p = async () => {
+      let h;
+      try {
+        h = await fetch(u, d ? { signal: d } : void 0);
+      } finally {
+        g && clearTimeout(g);
+      }
+      if (!h.ok)
+        throw new Error(`Failed to fetch ${u}: ${h.status} ${h.statusText}`);
+      return new Uint8Array(await h.arrayBuffer());
+    };
+    if (r && f) {
+      let h = f.get(u);
+      h || (h = p(), f.set(u, h));
+      const m = await h;
+      return r && i && i.set(u, m), m;
+    }
+    const o = await p();
+    return r && i && i.set(u, o), o;
+  }
+  if (!t) return null;
+  const a = F(e);
+  if (typeof a != "string" || !a) return null;
+  const c = rt(t, a);
+  return c ? c.code ?? c.source ?? null : null;
+}
+function J(e, t) {
+  const n = Buffer.from(e), r = Q(t).update(n).digest("base64");
+  return `${t}-${r}`;
+}
+function A(e, t) {
+  if (!e || !t) return !1;
+  if (e === t) return !0;
+  const n = e.replace(/[.+?^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*");
+  return new RegExp(`^${n}$`).test(t);
+}
+function st(e, t) {
+  if (!t || t.length === 0) return !1;
+  const n = w(e, "id"), r = w(e, "src"), i = w(e, "href");
+  for (const s of t)
+    if (n && A(s, n) || r && A(s, r) || i && A(s, i))
+      return !0;
+  return !1;
+}
+function ot(e) {
+  return !e || !e.nodeName ? null : e.nodeName.toLowerCase() === "script" ? "src" : "href";
+}
+function N(e, t) {
+  const n = [];
+  function r(i) {
+    if ("nodeName" in i && "attrs" in i && t(i) && n.push(i), "childNodes" in i && i.childNodes)
+      for (const s of i.childNodes)
+        r(s);
+  }
+  return r(e), n;
+}
+function w(e, t) {
+  return e.attrs.find((r) => r.name === t)?.value;
+}
+function z(e) {
+  if (!e.childNodes) return 0;
+  for (let t = 0; t < e.childNodes.length; t++) {
+    const n = e.childNodes[t];
+    if (!("tagName" in n)) continue;
+    const r = n, i = r.tagName?.toLowerCase();
+    if (i === "meta") {
+      const s = w(r, "http-equiv")?.toLowerCase();
+      if (w(r, "charset") !== void 0 || s === "content-type")
+        return t + 1;
+      continue;
+    }
+    if (i === "script" || i === "link") return 0;
+  }
+  return 0;
+}
+function D(e, t, n) {
+  const r = e.attrs.find((i) => i.name === t);
+  r ? r.value = n : e.attrs.push({ name: t, value: n });
+}
+async function at(e, t, n, r, i, s) {
+  if (!e || !e.attrs || w(e, "integrity")) return;
+  const f = ot(e);
+  if (!f) return;
+  let a = w(e, f);
+  if (!a) return;
+  const c = Z();
+  c && a.startsWith(c) && (a = a.slice(c.length));
+  let u;
+  if (s && a) {
+    const l = nt(a);
+    if (u = s[l], !u) {
+      const d = F(l);
+      u = s[d] || s[`/${d}`];
+    }
+  }
+  if (!u) {
+    const l = await it(a, t, i);
+    if (!l) return;
+    u = J(l, n);
+  }
+  D(e, "integrity", u), r && D(e, "crossorigin", r);
+}
+function ct(e, t) {
+  if (!e.nodeName || !e.attrs || t && st(e, t))
+    return !1;
+  const n = e.nodeName.toLowerCase(), r = w(e, "rel")?.toLowerCase(), i = w(e, "as")?.toLowerCase();
+  return !!(n === "script" && w(e, "src") || n === "link" && w(e, "href") && (r === "stylesheet" || r === "modulepreload" || r === "preload" && (i === "script" || i === "style")));
+}
+async function ft(e, t, n, {
+  algorithm: r = "sha384",
+  crossorigin: i,
+  resourceOpts: s,
+  skipResources: f = [],
+  preComputedHashes: a
+} = {}) {
+  try {
+    const c = T(e, {
+      sourceCodeLocationInfo: !1
+    }), u = N(c, (l) => ct(l, f));
+    return await Promise.all(
+      u.map(
+        (l) => at(l, t, r, i, s, a).catch((d) => {
+          const g = w(l, "src") || w(l, "href") || "unknown";
+          n.error(`Failed to compute integrity for ${g}:`, d?.message || d);
+        })
+      )
+    ), H(c);
+  } catch (c) {
+    return n.error("Failed to parse HTML with parse5", c instanceof Error ? c : void 0), e;
+  }
+}
+function yt(e, t = !1) {
+  if (e && typeof e.warn == "function")
+    return {
+      warn: e.warn.bind(e),
+      info: t ? e.info.bind(e) : () => {
+      },
+      error: e.error.bind(e),
+      summary: e.info.bind(e)
+    };
+  {
+    const n = (r) => console.info(`[vite-plugin-sri-gen] ${r}`);
+    return {
+      warn: (r) => console.warn(`[vite-plugin-sri-gen] ${r}`),
+      info: t ? n : () => {
+      },
+      error: (r, i) => {
+        console.error(`[vite-plugin-sri-gen] ${r}`, i);
+      },
+      summary: n
+    };
+  }
+}
+function wt(e, t) {
+  if (!e || typeof e != "object")
+    return {
+      isValid: !1,
+      shouldWarn: !0,
+      message: "Invalid bundle provided to generateBundle. Bundle must be a valid object."
+    };
+  const n = Object.entries(e);
+  return n.length === 0 ? {
+    isValid: !1,
+    shouldWarn: !0,
+    message: "Empty bundle detected. No assets to process for SRI generation."
+  } : n.some(
+    ([i, s]) => i.toLowerCase().endsWith(".html") && s && s.type === "asset"
+  ) ? { isValid: !0, shouldWarn: !1, message: null } : t ? {
+    isValid: !1,
+    shouldWarn: !0,
+    message: "No emitted HTML detected during SSR build. SRI can only be added to HTML files; pure SSR server output will be skipped."
+  } : {
+    isValid: !1,
+    shouldWarn: !1,
+    message: null
+  };
+}
+function kt(e, t) {
+  const n = e instanceof Error ? e.message : String(e);
+  t.error(`Critical error during SRI generation: ${n}`, e instanceof Error ? e : void 0), n.includes("cheerio") ? t.warn("HTML parsing failed. Ensure cheerio dependency is properly installed and HTML is valid.") : n.includes("fetch") ? t.warn("Remote resource fetching failed. Check network connectivity and resource availability.") : n.includes("integrity") && t.warn("Integrity computation failed. Verify file contents and hashing algorithm support.");
+}
+class St {
+  algorithm;
+  logger;
+  /**
+   * File extension patterns for assets that should have integrity computed.
+   * Includes common JavaScript and CSS variations with query parameter support.
+   *
+   * Supported Extensions:
+   * - .css - Stylesheets
+   * - .js - JavaScript modules
+   * - .mjs - ECMAScript modules
+   * - Query parameters are preserved (e.g., .js?version=123)
+   */
+  PROCESSABLE_EXTENSIONS = /\.(css|js|mjs)($|\?)/i;
+  /**
+   * Constructs a new IntegrityProcessor with specified algorithm and logger.
+   *
+   * @param algorithm - Hash algorithm for integrity computation
+   * @param logger - Logger instance for consistent reporting
+   */
+  constructor(t, n) {
+    this.algorithm = t, this.logger = n;
+  }
+  /**
+   * Builds comprehensive integrity mappings for all processable assets in the bundle.
+   * Processes both chunks (with code) and assets (with source) while maintaining
+   * proper error boundaries for individual asset failures.
+   *
+   * Processing Flow:
+   * 1. Extract all bundle entries for processing
+   * 2. Process entries in parallel with individual error handling
+   * 3. Collect results and statistics
+   * 4. Log processing summary
+   *
+   * @param bundle - Output bundle containing assets and chunks
+   * @param options - Optional filtering options for chunk processing
+   * @param options.excludeEntryChunks - If true, skip entry chunks (for first-pass hashing)
+   * @param options.onlyEntryChunks - If true, only process entry chunks (for post-injection hashing)
+   * @returns Promise<Record<string, string>> - Mapping of pathname to integrity hash
+   */
+  async buildIntegrityMappings(t, n) {
+    const r = {}, i = Object.entries(t);
+    let s = 0, f = 0;
+    const a = n?.excludeEntryChunks ?? !1, c = n?.onlyEntryChunks ?? !1;
+    if (a && c)
+      throw new Error(
+        "Invalid integrity mapping options: 'excludeEntryChunks' and 'onlyEntryChunks' cannot both be true."
+      );
+    const u = a ? "non-entry chunks and assets" : c ? "entry chunks only" : "all bundle assets";
+    this.logger.info(
+      `Processing ${i.length} bundle entries for integrity computation (${u})`
+    );
+    const l = i.map(async ([d, g]) => {
+      try {
+        if (g.type === "chunk") {
+          const o = g.isEntry;
+          if (a && o) {
+            f++;
+            return;
+          }
+          if (c && !o) {
+            f++;
+            return;
+          }
+        } else if (c) {
+          f++;
+          return;
+        }
+        const p = await this.processBundleItem(d, g);
+        p ? (r[p.pathname] = p.integrity, s++) : f++;
+      } catch (p) {
+        this.logger.error(
+          `Failed to process bundle item ${d}: ${p instanceof Error ? p.message : String(p)}`,
+          p instanceof Error ? p : void 0
+        ), f++;
+      }
+    });
+    return await Promise.allSettled(l), this.logger.info(`Integrity mapping completed: ${s} processed, ${f} skipped`), r;
+  }
+  /**
+   * Processes an individual bundle item (asset or chunk) for integrity computation.
+   * Handles type discrimination and source extraction with proper validation.
+   *
+   * Processing Steps:
+   * 1. Check file extension against processable patterns
+   * 2. Extract source content based on item type (asset vs chunk)
+   * 3. Compute integrity hash
+   * 4. Generate pathname for mapping
+   *
+   * @param fileName - Name of the file in the bundle
+   * @param bundleItem - The bundle item (asset or chunk)
+   * @returns Promise<{pathname: string, integrity: string} | null> - Result or null if skipped
+   */
+  async processBundleItem(t, n) {
+    if (!this.PROCESSABLE_EXTENSIONS.test(t))
+      return null;
+    let r;
+    if (n.type === "asset") {
+      const i = n;
+      if (!i.source)
+        return this.logger.warn(`Asset ${t} has no source content, skipping`), null;
+      r = typeof i.source == "string" ? i.source : new Uint8Array(i.source);
+    } else if (n.type === "chunk") {
+      const i = n;
+      if (!i.code)
+        return this.logger.warn(`Chunk ${t} has no code content, skipping`), null;
+      r = i.code;
+    } else
+      return this.logger.warn(`Unknown bundle item type for ${t}, skipping`), null;
+    try {
+      const i = J(r, this.algorithm);
+      return { pathname: $.posix.join("/", t), integrity: i };
+    } catch (i) {
+      return this.logger.error(
+        `Failed to compute integrity for ${t}: ${i instanceof Error ? i.message : String(i)}`,
+        i instanceof Error ? i : void 0
+      ), null;
+    }
+  }
+}
+class bt {
+  logger;
+  /**
+   * Per-bundle memos: analyzeDynamicImports and redundantImportMapChunks
+   * both derive the same chunk list and module-id map from the same bundle
+   * in one generateBundle pass. WeakMap keys mean a new bundle object gets
+   * fresh results and old bundles are garbage-collected with their caches.
+   *
+   * CAUTION: the cache is keyed by bundle object identity, not contents.
+   * Adding or removing bundle chunks between calls on the same analyzer
+   * instance returns stale results — do all bundle-shape mutation (e.g.
+   * runtime injection) BEFORE constructing the analyzer, or construct a
+   * fresh analyzer after mutating.
+   */
+  chunksCache = /* @__PURE__ */ new WeakMap();
+  idMapCache = /* @__PURE__ */ new WeakMap();
+  /**
+   * Constructs a new DynamicImportAnalyzer with the provided logger.
+   *
+   * @param logger - Logger instance for consistent reporting
+   */
+  constructor(t) {
+    this.logger = t;
+  }
+  /**
+   * Analyzes bundle to discover dynamic import relationships and return chunk file names.
+   * Creates multiple mapping strategies to ensure dynamic imports are properly resolved.
+   *
+   * Analysis Flow:
+   * 1. Build comprehensive module ID to file name mappings
+   * 2. Extract all chunks from bundle
+   * 3. Process dynamic imports from each chunk
+   * 4. Resolve import identifiers to actual file names
+   * 5. Collect and deduplicate results
+   *
+   * @param bundle - Output bundle to analyze
+   * @returns Set<string> - Set of dynamic chunk file names
+   */
+  analyzeDynamicImports(t) {
+    const n = /* @__PURE__ */ new Set(), r = this.buildModuleIdMappings(t), i = this.extractChunksFromBundle(t);
+    let s = 0;
+    for (const f of i) {
+      const a = f.dynamicImports || [];
+      s += a.length;
+      for (const c of a) {
+        const u = this.resolveDynamicImport(c, r, t);
+        u ? n.add(u) : this.logger.warn(`Could not resolve dynamic import "${c}" to a chunk file`);
+      }
+    }
+    return this.logger.info(
+      `Dynamic import analysis completed: ${s} imports analyzed, ${n.size} unique chunks discovered`
+    ), n;
+  }
+  /**
+   * Filenames of chunks that are REDUNDANT in the import map: chunks that
+   * (a) no other chunk imports (statically or dynamically) AND (b) are
+   * referenced by an emitted HTML file. Such a chunk is loaded only via a
+   * rendered <script>/<link> tag, whose `integrity` attribute already
+   * protects it — so an import-map entry for it adds nothing (issue #41).
+   * A chunk reached through another chunk's static `import` or dynamic
+   * `import()` — even if it is also a declared entry — is NOT redundant:
+   * its module-graph fetch carries no integrity attribute and needs the
+   * map. Likewise a chunk with no import edges that is NOT referenced by
+   * any emitted HTML (e.g. an extra input consumed by server-rendered
+   * templates, or loaded via a runtime-constructed import(url)) stays in
+   * the map — nothing else protects it.
+   *
+   * Import identifiers are resolved with the same multi-strategy resolver as
+   * analyzeDynamicImports, so identifiers arriving as module IDs, bundle
+   * keys, or chunk names (Rollup/Rolldown/Vite differ here) all resolve.
+   */
+  redundantImportMapChunks(t) {
+    const n = this.buildModuleIdMappings(t), r = this.extractChunksFromBundle(t), i = /* @__PURE__ */ new Set();
+    for (const c of r) {
+      const u = [...c.imports || [], ...c.dynamicImports || []];
+      for (const l of u) {
+        const d = this.resolveDynamicImport(l, n, t);
+        d ? i.add(d) : this.logger.warn(`Could not resolve import "${l}" to a chunk file`);
+      }
+    }
+    const s = [];
+    for (const [c, u] of Object.entries(t)) {
+      if (u.type !== "asset" || !c.toLowerCase().endsWith(".html"))
+        continue;
+      const l = u.source;
+      let d;
+      if (typeof l == "string")
+        d = l;
+      else if (l instanceof Uint8Array)
+        d = Buffer.from(l).toString("utf8");
+      else
+        continue;
+      const g = T(d, { sourceCodeLocationInfo: !1 });
+      for (const p of N(g, (o) => {
+        const h = o.nodeName?.toLowerCase();
+        return h === "script" || h === "link";
+      })) {
+        const o = w(p, p.nodeName.toLowerCase() === "script" ? "src" : "href");
+        o && s.push(o.split(/[?#]/)[0]);
+      }
+    }
+    const f = (c) => s.some((u) => u === c || u.endsWith(`/${c}`)), a = /* @__PURE__ */ new Set();
+    for (const c of r)
+      i.has(c.fileName) || f(c.fileName) && a.add(c.fileName);
+    return a;
+  }
+  /**
+   * Builds comprehensive mappings from module IDs to file names.
+   * Creates multiple mapping strategies for robust dynamic import resolution.
+   *
+   * Mapping Strategies:
+   * 1. Facade Module ID mapping (primary entry point)
+   * 2. Chunk name mapping (fallback identifier)
+   * 3. All module IDs within chunk (comprehensive coverage)
+   *
+   * @param bundle - Output bundle to analyze
+   * @returns Map<string, string> - Module ID to file name mappings
+   */
+  buildModuleIdMappings(t) {
+    const n = this.idMapCache.get(t);
+    if (n) return n;
+    const r = /* @__PURE__ */ new Map(), i = this.extractChunksFromBundle(t);
+    for (const s of i)
+      if (s.facadeModuleId && r.set(s.facadeModuleId, s.fileName), s.name && r.set(s.name, s.fileName), s.modules)
+        for (const f of Object.keys(s.modules))
+          r.set(f, s.fileName);
+    return this.logger.info(`Built module ID mappings for ${r.size} entries`), this.idMapCache.set(t, r), r;
+  }
+  /**
+   * Extracts and validates chunks from bundle, filtering out non-chunk entries.
+   * Ensures type safety by filtering only chunk-type bundle items.
+   *
+   * @param bundle - Output bundle to process
+   * @returns OutputChunk[] - Array of valid chunks
+   */
+  extractChunksFromBundle(t) {
+    const n = this.chunksCache.get(t);
+    if (n) return n;
+    const r = Object.values(t).filter((i) => i.type === "chunk");
+    return this.chunksCache.set(t, r), r;
+  }
+  /**
+   * Resolves a dynamic import identifier to a concrete chunk file name.
+   * Uses multiple resolution strategies with fallback mechanisms.
+   *
+   * Resolution Strategies (in order):
+   * 1. Direct module ID/facade module ID lookup
+   * 2. Direct bundle key lookup (when dynamic import is a bundle key)
+   * 3. Chunk name matching (fallback when facade module ID is missing)
+   *
+   * @param dynamicImport - Dynamic import identifier
+   * @param idToFileMap - Module ID to file name mappings
+   * @param bundle - Output bundle for direct lookups
+   * @returns string | null - Resolved file name or null if not found
+   */
+  resolveDynamicImport(t, n, r) {
+    const i = n.get(t);
+    if (i)
+      return i;
+    const s = r[t];
+    if (s && s.type === "chunk")
+      return s.fileName;
+    const a = this.extractChunksFromBundle(r).find((c) => c.name === t);
+    return a ? a.fileName : null;
+  }
+}
+class vt {
+  config;
+  /**
+   * Constructs a new HtmlProcessor with the provided configuration.
+   *
+   * @param config - Comprehensive configuration for HTML processing behavior
+   */
+  constructor(t) {
+    this.config = t;
+  }
+  /**
+   * Processes all HTML files in the bundle to inject SRI attributes and preload links.
+   * Handles individual file failures gracefully while maintaining overall processing flow.
+   *
+   * Processing Flow:
+   * 1. Extract and validate HTML files from bundle
+   * 2. Process each HTML file with individual error boundaries
+   * 3. Apply SRI attributes to existing elements
+   * 4. Add preload links for dynamic chunks (if enabled)
+   * 5. Update bundle with processed HTML content
+   *
+   * @param bundle - Output bundle containing HTML assets
+   * @param sriByPathname - Mapping of pathnames to integrity hashes
+   * @param dynamicChunkFiles - Set of dynamic chunk file names for preloading
+   * @returns Promise<void> - Completes when all HTML files are processed
+   */
+  async processHtmlFiles(t, n, r, i = /* @__PURE__ */ new Set()) {
+    const s = this.extractHtmlFiles(t);
+    if (s.length === 0) {
+      this.config.logger.warn("No HTML files found in bundle for processing");
+      return;
+    }
+    this.config.logger.info(`Processing ${s.length} HTML files`);
+    const f = s.map(async ([l, d]) => {
+      try {
+        await this.processSingleHtmlFile(
+          l,
+          d,
+          t,
+          n,
+          r,
+          i
+        ), this.config.logger.info(`Successfully processed HTML file: ${l}`);
+      } catch (g) {
+        this.config.logger.error(
+          `Failed to process HTML file ${l}: ${g instanceof Error ? g.message : String(g)}`,
+          g instanceof Error ? g : void 0
+        );
+      }
+    }), a = await Promise.allSettled(f), c = a.filter((l) => l.status === "fulfilled").length, u = a.filter((l) => l.status === "rejected").length;
+    this.config.logger.info(`HTML processing completed: ${c} successful, ${u} failed`);
+  }
+  /**
+   * Extracts HTML assets from bundle with proper type validation.
+   * Filters bundle entries to find only HTML assets with proper type checking.
+   *
+   * @param bundle - Output bundle to search
+   * @returns Array<[string, OutputAsset]> - Array of HTML file name and asset pairs
+   */
+  extractHtmlFiles(t) {
+    const n = [];
+    for (const [r, i] of Object.entries(t))
+      typeof r == "string" && r.toLowerCase().endsWith(".html") && i && i.type === "asset" && n.push([r, i]);
+    return n;
+  }
+  /**
+   * Processes a single HTML file with comprehensive SRI injection and preload generation.
+   *
+   * Processing Steps:
+   * 1. Extract and validate HTML content from asset
+   * 2. Add SRI attributes to existing elements
+   * 3. Add preload links for dynamic chunks (if enabled)
+   * 4. Update asset source with processed HTML
+   *
+   * @param fileName - Name of the HTML file
+   * @param asset - HTML asset from bundle
+   * @param bundle - Complete bundle for resource resolution
+   * @param sriByPathname - Integrity mappings
+   * @param dynamicChunkFiles - Dynamic chunks for preloading
+   * @returns Promise<void> - Completes when file is processed
+   */
+  async processSingleHtmlFile(t, n, r, i, s, f) {
+    const a = this.extractHtmlContent(n, t);
+    if (!a)
+      return;
+    let c = await this.addSriToHtmlContent(a, r, i);
+    const u = this.config.importMapIntegrity === !1 ? /* @__PURE__ */ new Set([
+      ...s,
+      ...q(i, this.config.skipResources, f).map(
+        (l) => l.fileName
+      )
+    ]) : s;
+    this.config.preloadDynamicChunks && u.size > 0 && (c = await this.addDynamicChunkPreloads(c, u, i, t)), this.config.importMapIntegrity !== !1 && (c = this.injectImportMap(c, i, t, f)), n.source = c;
+  }
+  /**
+   * Extracts HTML content from asset with proper validation and type handling.
+   * Handles both string and buffer sources with appropriate error reporting.
+   *
+   * @param asset - HTML asset to extract content from
+   * @param fileName - File name for error reporting
+   * @returns string | null - HTML content or null if invalid
+   */
+  extractHtmlContent(t, n) {
+    if (!t.source)
+      return this.config.logger.warn(`HTML file ${n} has no source content`), null;
+    const r = typeof t.source == "string" ? t.source : String(t.source);
+    return r.trim() ? r : (this.config.logger.warn(`HTML file ${n} appears to be empty`), null);
+  }
+  /**
+   * Adds SRI attributes to existing HTML elements using the internal SRI processor.
+   * Delegates to the established addSriToHtml function with proper configuration.
+   *
+   * @param htmlContent - Original HTML content
+   * @param bundle - Bundle for resource resolution
+   * @param sriByPathname - Pre-computed integrity hashes by pathname
+   * @returns Promise<string> - HTML with SRI attributes added
+   */
+  async addSriToHtmlContent(t, n, r) {
+    return ft(t, n, this.config.logger, {
+      algorithm: this.config.algorithm,
+      crossorigin: this.config.crossorigin,
+      resourceOpts: {
+        cache: this.config.remoteCache,
+        pending: this.config.pending,
+        enableCache: this.config.enableCache,
+        fetchTimeoutMs: this.config.fetchTimeoutMs
+      },
+      skipResources: this.config.skipResources,
+      preComputedHashes: r
+    });
+  }
+  /**
+   * Adds modulepreload links for dynamic chunks with integrity attributes.
+   * Uses parse5 for safe DOM manipulation and duplicate prevention.
+   *
+   * Features:
+   * - Safe DOM manipulation with parse5
+   * - Duplicate link prevention
+   * - Proper integrity and crossorigin attributes
+   * - Error handling with fallback to original HTML
+   *
+   * @param htmlContent - HTML content to modify
+   * @param dynamicChunkFiles - Set of dynamic chunk file names
+   * @param sriByPathname - Integrity mappings
+   * @returns Promise<string> - HTML with preload links added
+   */
+  async addDynamicChunkPreloads(t, n, r, i) {
+    try {
+      const s = T(t, {
+        sourceCodeLocationInfo: !1
+      });
+      let f = 0;
+      const c = N(s, (u) => !!u.nodeName && u.nodeName.toLowerCase() === "head")[0];
+      if (!c)
+        return this.config.logger.warn("No head element found, skipping dynamic chunk preloads"), t;
+      for (const u of n)
+        this.addPreloadLinkForChunk(c, u, r, i) && f++;
+      return this.config.logger.info(`Added ${f} modulepreload links for dynamic chunks`), H(s);
+    } catch (s) {
+      return this.config.logger.error(
+        `Failed to add dynamic chunk preloads: ${s instanceof Error ? s.message : String(s)}`,
+        s instanceof Error ? s : void 0
+      ), t;
+    }
+  }
+  /**
+   * Adds a single preload link for a dynamic chunk with proper duplicate checking.
+   * Implements comprehensive validation and attribute generation.
+   *
+   * Validation Steps:
+   * 1. Build absolute href using base path
+   * 2. Check for existing preload links (duplicate prevention)
+   * 3. Verify integrity availability
+   * 4. Generate and inject preload link with proper attributes
+   *
+   * @param head - Head element from parse5 document
+   * @param chunkFile - Chunk file name
+   * @param sriByPathname - Integrity mappings
+   * @returns boolean - Whether a link was added
+   */
+  addPreloadLinkForChunk(t, n, r, i) {
+    const s = tt(this.config.base, n, i);
+    if (N(t, (u) => {
+      if (u.nodeName?.toLowerCase() !== "link") return !1;
+      const l = w(u, "rel"), d = w(u, "href");
+      return l === "modulepreload" && d === s;
+    }).length > 0 || R(n, this.config.skipResources))
+      return !1;
+    const a = r[$.posix.join("/", n)];
+    if (!a)
+      return this.config.logger.warn(`No integrity found for dynamic chunk: ${n}`), !1;
+    const c = {
+      nodeName: "link",
+      tagName: "link",
+      attrs: [
+        { name: "rel", value: "modulepreload" },
+        { name: "href", value: s },
+        { name: "integrity", value: a }
+      ],
+      namespaceURI: "http://www.w3.org/1999/xhtml",
+      childNodes: [],
+      parentNode: t,
+      sourceCodeLocation: void 0
+    };
+    return this.config.crossorigin && c.attrs.push({
+      name: "crossorigin",
+      value: this.config.crossorigin
+    }), t.childNodes || (t.childNodes = []), t.childNodes.splice(z(t), 0, c), !0;
+  }
+  /**
+   * Injects (or merges into) a `<script type="importmap">` carrying an
+   * `integrity` object for every emitted JS module chunk. Browsers
+   * supporting import map integrity (Chrome 127+, Firefox 138+,
+   * Safari 18+) then enforce SRI natively on static AND dynamic module
+   * imports — single fetch, no TOCTOU. Older browsers ignore the
+   * `integrity` key (progressive enhancement, same model as SRI attributes
+   * generally).
+   *
+   * Must run AFTER addDynamicChunkPreloads: both insert at the same
+   * computed head position (see headInjectionIndex), so running last places
+   * the import map ahead of the injected links — the spec requires it
+   * before any module script or modulepreload link.
+   *
+   * No-ops (returning the input unchanged) when: base is relative (the
+   * resulting keys — bare or document-relative — cannot be used portably
+   * across pages in subdirectories), no JS chunks exist, <head> is missing,
+   * or an existing import map contains unparseable JSON (warned).
+   */
+  injectImportMap(t, n, r, i) {
+    const s = U(
+      n,
+      this.config.base,
+      this.config.skipResources,
+      i
+    );
+    if (s === null || Object.keys(s).length === 0)
+      return t;
+    try {
+      const f = T(t, {
+        sourceCodeLocationInfo: !1
+      }), a = N(f, (l) => l.nodeName?.toLowerCase() === "head")[0];
+      if (!a)
+        return this.config.logger.warn(`No <head> element found in ${r}, skipping import map injection`), t;
+      const c = N(
+        a,
+        (l) => l.nodeName?.toLowerCase() === "base" && C(w(l, "href"))
+      );
+      c.length > 0 && this.config.logger.warn(
+        `${r} contains <base href="${w(c[0], "href")}">; import map integrity keys resolve against the document base URL and may not match the served module URLs`
+      );
+      const u = N(a, (l) => l.nodeName?.toLowerCase() !== "script" ? !1 : w(l, "type")?.toLowerCase() === "importmap");
+      if (u.length > 0) {
+        const l = u[0], d = l.childNodes.find((m) => m.nodeName === "#text");
+        let g;
+        try {
+          g = JSON.parse(d?.value ?? "{}");
+        } catch {
+          return this.config.logger.warn(
+            `Existing <script type="importmap"> in ${r} contains invalid JSON; integrity entries not merged`
+          ), t;
+        }
+        const p = g.integrity ?? {}, o = U(n, this.config.base, this.config.skipResources) ?? {};
+        for (const [m, y] of Object.entries(p))
+          m in o && o[m] !== y && this.config.logger.warn(
+            `Existing import map in ${r} pins integrity for ${m} (${String(y)}) that differs from the build-computed hash (${o[m]}); keeping the existing entry`
+          );
+        g.integrity = {
+          ...s,
+          ...p
+        };
+        const h = B(JSON.stringify(g));
+        d ? d.value = h : l.childNodes.push({
+          nodeName: "#text",
+          value: h,
+          parentNode: l
+        });
+      } else {
+        const d = {
+          nodeName: "#text",
+          value: B(JSON.stringify({ integrity: s })),
+          parentNode: null
+        }, g = {
+          nodeName: "script",
+          tagName: "script",
+          attrs: [{ name: "type", value: "importmap" }],
+          namespaceURI: "http://www.w3.org/1999/xhtml",
+          childNodes: [d],
+          parentNode: a,
+          sourceCodeLocation: void 0
+        };
+        d.parentNode = g, a.childNodes || (a.childNodes = []), a.childNodes.splice(z(a), 0, g);
+      }
+      return H(f);
+    } catch (f) {
+      return this.config.logger.error(
+        `Failed to inject import map into ${r}: ${f instanceof Error ? f.message : String(f)}`,
+        f instanceof Error ? f : void 0
+      ), t;
+    }
+  }
+}
+class L {
+  constructor(t) {
+    this.logger = t;
+  }
+  static KNOWN_MANIFEST_NAMES = /* @__PURE__ */ new Set([".vite/manifest.json", "manifest.json"]);
+  static SSR_MANIFEST_NAME = ".vite/ssr-manifest.json";
+  /**
+   * Finds every Vite-style manifest asset in the bundle and augments each
+   * entry with an integrity value (for the primary `file`) and a parallel
+   * `cssIntegrity` array (for the `css` array, when present).
+   *
+   * @param bundle Rollup OutputBundle
+   * @param sriByPathname Map of pathnames (with leading `/`) to SRI hashes
+   * @param skipResources skipResources patterns — matching files get no integrity
+   * @returns counts of manifest files processed and entries augmented
+   */
+  injectIntegrity(t, n, r) {
+    let i = 0, s = 0;
+    for (const [f, a] of Object.entries(t)) {
+      if (a.type !== "asset" || !this.isManifestCandidate(f)) continue;
+      const c = a, u = this.assetSourceToString(c.source);
+      if (u === null) continue;
+      const l = this.isKnownManifestName(f);
+      let d;
+      try {
+        d = JSON.parse(u);
+      } catch (p) {
+        l && this.logger.warn(
+          `Failed to parse Vite manifest at ${f}; leaving untouched. ${p instanceof Error ? p.message : String(p)}`
+        );
+        continue;
+      }
+      if (!this.isManifestShape(d, f, l) || !l && !this.looksLikeViteManifest(d)) continue;
+      const g = this.augmentManifest(d, n, r, f);
+      g > 0 && (c.source = JSON.stringify(d, null, 2), s += g, i++);
+    }
+    return { processedFiles: i, augmentedEntries: s };
+  }
+  isManifestCandidate(t) {
+    return t === L.SSR_MANIFEST_NAME ? !1 : L.KNOWN_MANIFEST_NAMES.has(t) ? !0 : t.endsWith("manifest.json");
+  }
+  isKnownManifestName(t) {
+    return L.KNOWN_MANIFEST_NAMES.has(t);
+  }
+  assetSourceToString(t) {
+    if (typeof t == "string") return t;
+    if (t instanceof Uint8Array)
+      try {
+        return new TextDecoder().decode(t);
+      } catch {
+        return null;
+      }
+    return null;
+  }
+  isManifestShape(t, n, r) {
+    return !t || typeof t != "object" || Array.isArray(t) ? (r && this.logger.warn(`Vite manifest at ${n} is not a plain object; skipping integrity injection.`), !1) : !0;
+  }
+  /**
+   * Duck-type check: true if the object looks like a Vite build manifest
+   * (at least one own-property value is an object with a string `file`).
+   * Used to filter out unrelated *manifest.json assets emitted by other plugins.
+   */
+  looksLikeViteManifest(t) {
+    for (const n of Object.values(t))
+      if (n && typeof n == "object" && !Array.isArray(n) && typeof n.file == "string")
+        return !0;
+    return !1;
+  }
+  augmentManifest(t, n, r, i) {
+    let s = 0;
+    for (const [f, a] of Object.entries(t)) {
+      if (!a || typeof a != "object" || Array.isArray(a)) {
+        this.logger.warn(`Skipping manifest entry "${f}" in ${i}: not an object.`);
+        continue;
+      }
+      if (typeof a.file != "string") {
+        this.logger.warn(`Skipping manifest entry "${f}" in ${i}: missing string "file".`);
+        continue;
+      }
+      let c = !1;
+      if (typeof a.integrity != "string") {
+        const u = this.lookupHash(a.file, n, r);
+        u && (a.integrity = u, c = !0);
+      }
+      if (Array.isArray(a.css) && a.css.length > 0 && !Array.isArray(a.cssIntegrity)) {
+        const u = [];
+        let l = !1;
+        for (const d of a.css) {
+          if (typeof d != "string") {
+            u.push(null);
+            continue;
+          }
+          const g = this.lookupHash(d, n, r);
+          u.push(g ?? null), g && (l = !0);
+        }
+        l && (a.cssIntegrity = u, c = !0);
+      }
+      c && s++;
+    }
+    return s;
+  }
+  lookupHash(t, n, r) {
+    if (this.isSkipped(t, r)) return;
+    const i = t.startsWith("/") ? t : `/${t}`;
+    return n[i];
+  }
+  isSkipped(t, n) {
+    return R(t, n);
+  }
+}
+const V = "sri-runtime.js";
+async function Et(e, t = () => import("vite")) {
+  try {
+    return await t();
+  } catch {
+    const n = Y(_($.join(e, "package.json")).href), r = $.dirname(n.resolve("vite/package.json"));
+    return await import(_($.join(r, "dist", "node", "index.js")).href);
+  }
+}
+async function $t(e, t, n = () => import("vite")) {
+  try {
+    const r = await n();
+    let i;
+    if (typeof r.minifySync == "function") {
+      const f = r.minifySync(V, e);
+      if (f?.errors?.length)
+        return t?.info(`SRI runtime minification skipped: ${String(f.errors[0])}`), e;
+      i = f?.code;
+    } else if (typeof r.transformWithEsbuild == "function")
+      i = (await r.transformWithEsbuild(e, V, {
+        minify: !0,
+        target: "esnext",
+        keepNames: !1
+      }))?.code;
+    else
+      return t?.info("SRI runtime minification skipped: this Vite version exposes no minifier"), e;
+    const s = typeof i == "string" ? i.trim() : "";
+    return s.startsWith("function") ? s : (t?.info("SRI runtime minification skipped: minifier output was not a bare function declaration"), e);
+  } catch (r) {
+    return t?.info(`SRI runtime minification skipped: ${r instanceof Error ? r.message : String(r)}`), e;
+  }
+}
+function Nt(e, t) {
+  let n;
+  try {
+    const r = new Map(Object.entries(e || {})), i = t && Object.hasOwn(t, "crossorigin") ? t.crossorigin : "anonymous", s = t && t.skipResources || [];
+    let f = "/";
+    try {
+      const o = t && t.base;
+      o && typeof o == "string" && (f = new URL(o, "http://x/").pathname, f.endsWith("/") || (f += "/"));
+    } catch {
+    }
+    const a = (o) => {
+      let h = r.get(o);
+      return h === void 0 && f !== "/" && o.indexOf(f) === 0 && (h = r.get(`/${o.slice(f.length)}`)), h;
+    }, c = (o, h) => {
+      if (!o || !h) return !1;
+      if (o === h) return !0;
+      const m = o.replace(/[.+?^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*");
+      return new RegExp(`^${m}$`).test(h);
+    }, u = (o) => {
+      if (!s || s.length === 0) return !1;
+      const h = o.getAttribute && o.getAttribute("id"), m = o.getAttribute && o.getAttribute("src"), y = o.getAttribute && o.getAttribute("href");
+      for (const S of s)
+        if (h && c(S, h) || m && c(S, m) || y && c(S, y))
+          return !0;
+      return !1;
+    }, l = (o) => {
+      if (!o) return;
+      let h;
+      try {
+        const m = new URL(o, globalThis.location?.href || "");
+        h = a(m.pathname);
+      } catch {
+      }
+      return h;
+    }, d = (o) => {
+      if (!o || u(o)) return;
+      const h = typeof HTMLLinkElement < "u" && o instanceof HTMLLinkElement, m = typeof HTMLScriptElement < "u" && o instanceof HTMLScriptElement;
+      if (!h && !m) return;
+      let y = null;
+      if (h) {
+        const I = (o.rel || "").toLowerCase(), M = (o.getAttribute && o.getAttribute("as") || "").toLowerCase();
+        if (!(I === "stylesheet" || I === "modulepreload" || I === "preload" && (M === "script" || M === "style" || M === "font"))) return;
+        y = o.getAttribute && o.getAttribute("href");
+      } else m && (y = o.getAttribute && o.getAttribute("src"));
+      if (!y) return;
+      const S = l(y);
+      S && (!o.hasAttribute || !o.setAttribute || (o.hasAttribute("integrity") || o.setAttribute("integrity", S), i && !o.hasAttribute("crossorigin") && o.setAttribute("crossorigin", i)));
+    };
+    if (t && t.enforceDynamicImports)
+      try {
+        const o = globalThis, h = (k) => {
+          const E = k.indexOf("-");
+          if (E <= 0) return null;
+          const b = k.slice(0, E);
+          return b === "sha256" ? "SHA-256" : b === "sha384" ? "SHA-384" : b === "sha512" ? "SHA-512" : null;
+        }, m = (k) => {
+          let E = "";
+          for (let v = 0; v < k.length; v += 32768)
+            E += String.fromCharCode.apply(null, k.subarray(v, v + 32768));
+          return btoa(E);
+        }, y = async function(k, E) {
+          if (typeof crypto > "u" || !crypto.subtle || typeof btoa > "u")
+            throw new Error(
+              `[vite-plugin-sri-gen] Cannot verify dynamic import for ${E}: crypto.subtle is unavailable (requires a secure context, e.g. HTTPS or localhost)`
+            );
+          let b;
+          try {
+            b = new URL(E, k || globalThis.location?.href || void 0);
+          } catch (X) {
+            throw new Error(
+              `[vite-plugin-sri-gen] Cannot resolve dynamic import specifier ${E}${k ? ` against ${k}` : ""}`,
+              { cause: X }
+            );
+          }
+          const v = a(b.pathname);
+          if (!v)
+            throw new Error(
+              `[vite-plugin-sri-gen] Refusing dynamic import: no integrity registered for ${E} (resolved to ${b.href})`
+            );
+          const O = h(v);
+          if (!O)
+            throw new Error(`[vite-plugin-sri-gen] Unsupported integrity algorithm: ${v}`);
+          const j = {};
+          i === "use-credentials" ? j.credentials = "include" : j.credentials = "same-origin";
+          const x = await fetch(b.href, j);
+          if (!x.ok)
+            throw new Error(
+              `[vite-plugin-sri-gen] Failed to fetch ${b.href} for integrity verification (HTTP ${x.status})`
+            );
+          const K = await x.arrayBuffer(), G = await crypto.subtle.digest(O, K), W = v.slice(0, v.indexOf("-") + 1) + m(new Uint8Array(G));
+          if (W !== v)
+            throw new Error(
+              `[vite-plugin-sri-gen] Integrity verification failed for ${b.href} (expected ${v}, got ${W})`
+            );
+          return o.__sriNativeImport(b.href);
+        }, S = "__vitePluginSriGen", I = (k) => !!k && k[S] === !0;
+        if (o.__sriImport && !I(o.__sriImport))
+          throw new Error(
+            "[vite-plugin-sri-gen] Refusing to install: globalThis.__sriImport is already defined by another script. This indicates a pre-installation tampering attempt; dynamic import enforcement cannot proceed."
+          );
+        if (o.__sriNativeImport && !I(o.__sriNativeImport))
+          throw new Error(
+            "[vite-plugin-sri-gen] Refusing to install: globalThis.__sriNativeImport is already defined by another script."
+          );
+        const M = (k) => import(
+          /* @vite-ignore */
+          k
+        );
+        M[S] = !0, y[S] = !0, o.__sriNativeImport = M, o.__sriImport = y;
+      } catch (o) {
+        n = o;
+      }
+    const g = Element?.prototype?.setAttribute;
+    g && (Element.prototype.setAttribute = function(o, h) {
+      const m = g.apply(this, arguments);
+      try {
+        const y = String(o || "").toLowerCase();
+        (this instanceof globalThis.HTMLLinkElement && (y === "href" || y === "rel" || y === "as") || this instanceof globalThis.HTMLScriptElement && y === "src") && d(this);
+      } catch {
+      }
+      return m;
+    });
+    const p = (o, h) => {
+      const m = o && o[h];
+      if (!m || typeof m != "function") return;
+      const y = function() {
+        try {
+          const S = arguments[0];
+          S && d(S);
+        } catch {
+        }
+        return m.apply(this, arguments);
+      };
+      try {
+        Object.defineProperty(o, h, {
+          value: y,
+          configurable: !0,
+          writable: !0
+        });
+      } catch {
+        try {
+          o[h] = y;
+        } catch {
+        }
+      }
+    };
+    p(Node.prototype, "appendChild"), p(Node.prototype, "insertBefore"), p(Element.prototype, "append"), p(Element.prototype, "prepend");
+  } catch {
+  }
+  if (n) throw n;
+}
+export {
+  bt as DynamicImportAnalyzer,
+  vt as HtmlProcessor,
+  St as IntegrityProcessor,
+  L as ManifestProcessor,
+  ft as addSriToHtml,
+  U as buildImportIntegrityObject,
+  q as collectModuleChunkFiles,
+  J as computeIntegrity,
+  yt as createLogger,
+  B as escapeForScript,
+  nt as extractPathnameFromResourceUrl,
+  ot as getUrlAttrName,
+  kt as handleGenerateBundleError,
+  Nt as installSriRuntime,
+  ct as isEligibleForSri,
+  C as isHttpUrl,
+  et as isImportMapCapableBase,
+  R as isSkippedResource,
+  P as joinBaseHref,
+  it as loadResource,
+  Et as loadVite,
+  A as matchesPattern,
+  $t as minifyRuntimeSource,
+  F as normalizeBundlePath,
+  tt as preloadHref,
+  at as processElement,
+  st as shouldSkipElement,
+  wt as validateGenerateBundleInputs
+};