module-develop-kit 1.2.4 → 1.3.1

package/dist/vite-plugins/index.d.ts

@@ -3,6 +3,79 @@ import { Options } from '@vitejs/plugin-legacy';
 import { Plugin as Plugin_2 } from 'vite';
 import { PluginOption } from 'vite';
 
+/**
+ * Builds the self-contained runtime statement that is prepended to entry
+ * chunks. The runtime is shipped by serializing `installSriRuntime` with
+ * `.toString()` and embedding the source into the consumer's bundle.
+ *
+ * The plugin itself is bundled with esbuild (via tsup), whose `keepNames`
+ * transform can wrap named function expressions in a module-scoped
+ * `__name(fn, "name")` helper. That helper lives at the top of the plugin's
+ * own output — NOT inside the serialized function — so the injected copy
+ * references an `__name` that is undefined in the consumer bundle. Because the
+ * runtime guards its setup in a best-effort `try/catch`, the resulting
+ * `ReferenceError: __name is not defined` is swallowed and
+ * `globalThis.__sriImport` is never installed; every rewritten dynamic import
+ * then fails with "`__sriImport` is not defined" (issue #30).
+ *
+ * To keep the injected runtime correct regardless of how the plugin is
+ * bundled, the serialized function is evaluated inside a wrapper that defines a
+ * local `__name` shim in its lexical scope. `__name` only needs to return its
+ * first argument; the function-name assignment it performs is cosmetic.
+ *
+ * `opts.base` is the resolved Vite `base` (defaults to "/"). It is forwarded
+ * to the runtime so integrity lookups can strip the base prefix from URLs
+ * observed at runtime — the integrity map keys are '/'-rooted bundle file
+ * names that never include the base.
+ *
+ * @param runtime - Either the runtime function (serialized here via
+ * `.toString()`) or already-serialized source. The plugin passes source that
+ * has been through `minifyRuntimeSource` first, which is why this accepts a
+ * string; passing the function directly yields the unminified form.
+ * @returns The complete statement to prepend to an entry chunk.
+ */
+export declare function buildSriRuntimeCode(runtime: ((sriByPathname: Record<string, string>, opts?: Record<string, unknown>) => void) | string, sriByPathname: Record<string, string>, opts: {
+    crossorigin: "anonymous" | "use-credentials" | undefined;
+    skipResources: string[];
+    enforceDynamicImports: boolean;
+    base?: string;
+}): string;
+
+/**
+ * 为文件内容生成 SRI hash
+ * @param content 文件内容（字符串或 Buffer）
+ * @param algorithm 哈希算法，默认 sha384
+ * @returns SRI hash 字符串，如 "sha384-xxx"
+ */
+export declare function generateSriHash(content: string | Buffer, algorithm?: SriAlgorithm): string;
+
+/**
+ * 为本地文件生成 SRI hash
+ * @param filePath 文件路径（相对或绝对）
+ * @param algorithm 哈希算法，默认 sha384
+ * @returns SRI hash 字符串，如 "sha384-xxx"
+ */
+export declare function generateSriHashFromFile(filePath: string, algorithm?: SriAlgorithm): Promise<string>;
+
+/**
+ * 为多个文件生成 SRI hash 映射
+ * @param files 文件路径数组或映射对象
+ * @param algorithm 哈希算法，默认 sha384
+ * @returns SRI hash 映射对象
+ * @example
+ * // 传入数组
+ * await generateSriHashMap(['dist/app.js', 'dist/vendor.js'])
+ * // 返回: { 'dist/app.js': 'sha384-xxx', 'dist/vendor.js': 'sha384-yyy' }
+ *
+ * // 传入映射对象（key 为最终使用的路径）
+ * await generateSriHashMap({
+ *   '/assets/app-123.js': 'dist/app.js',
+ *   '*legacy-polyfills*.js': 'dist/legacy-polyfills.js'
+ * })
+ * // 返回: { '/assets/app-123.js': 'sha384-xxx', '*legacy-polyfills*.js': 'sha384-yyy' }
+ */
+export declare function generateSriHashMap(files: string[] | Record<string, string>, algorithm?: SriAlgorithm): Promise<Record<string, string>>;
+
 /**
  * 获取legacy/兼容性检测相关插件
  * @param options
@@ -34,6 +107,85 @@ export declare interface IVitePluginLegacyOptions extends Options {
     detectionConfig?: IVitePluginCompatibilityDetectionOptions;
 }
 
+/**
+ * Rewrites every dynamic `import(...)` call expression in a chunk to
+ * `__sriImport(import.meta.url, ...)` so the runtime-injected JS-level
+ * verifier can enforce integrity before executing the module. The original
+ * `import(` syntax inside the runtime itself is preserved because the runtime
+ * is concatenated AFTER this rewrite step.
+ *
+ * `import.meta.url` is threaded through as the first argument because native
+ * `import()` resolves relative specifiers against the IMPORTING MODULE's URL,
+ * not the document URL. Rollup emits inter-chunk dynamic imports as
+ * module-relative specifiers (e.g. `import('./asset.js')` from a chunk in
+ * `assets/js/`), so without the importer's URL the runtime would resolve the
+ * specifier against `location.href` and look up the wrong pathname
+ * (issue #32). The injected `import.meta.url` text is never re-matched by the
+ * rewrite regex: `import` there is followed by `.`, not `(`.
+ */
+export declare function rewriteDynamicImports(code: string): string;
+
+/**
+ * 支持的 SRI 算法
+ */
+export declare type SriAlgorithm = "sha256" | "sha384" | "sha512";
+
+/**
+ * Configuration options for the SRI plugin.
+ * Defines all available settings for customizing SRI generation behavior.
+ */
+export declare interface SriPluginOptions {
+    /** The hashing algorithm to use for generating SRI hashes. */
+    algorithm?: "sha256" | "sha384" | "sha512";
+    /** The CORS setting to use for fetched scripts and styles. */
+    crossorigin?: "anonymous" | "use-credentials";
+    /** Enable in-memory caching for remote fetches. Default: true */
+    fetchCache?: boolean;
+    /** Abort remote fetches after the given milliseconds. Default: 5000 (0 disables). */
+    fetchTimeoutMs?: number;
+    /** Add rel="modulepreload" with integrity for discovered dynamic chunks. Default: true */
+    preloadDynamicChunks?: boolean;
+    /**
+     * Deliver module-graph integrity via an inline `<script type="importmap">`.
+     * Default: true.
+     *
+     * Import maps must be inline — the HTML spec forbids `src` on
+     * `<script type="importmap">` — so a `script-src` without `'unsafe-inline'`,
+     * a matching hash, or a nonce will block the map. A blocked map delivers no
+     * integrity, silently.
+     *
+     * Set to false for strict-CSP deployments: no inline script is emitted, and
+     * the same hashes are delivered as `<link rel="modulepreload" integrity>`
+     * instead, which needs no CSP cooperation. Coverage is preserved — the
+     * preload set widens to the full module graph so chunks reached only by a
+     * static import inside a lazy chunk stay verified. Those chunks are then
+     * fetched eagerly rather than on demand.
+     *
+     * Requires `preloadDynamicChunks` (the default) to remain enabled — that is
+     * the channel the hashes move to. With both off, chunks reached only by a
+     * static import inside a lazy chunk have no channel at all and the build
+     * warns.
+     *
+     * The widened set is bundle-wide, not per page, so in a multi-page build
+     * every HTML file preloads every module-graph chunk, including chunks
+     * private to other pages.
+     */
+    importMapIntegrity?: boolean;
+    /**
+     * Inject a tiny runtime that sets integrity on dynamically inserted
+     * <script>/<link>. Default: true.
+     *
+     * The runtime is minified before injection, independently of how the rest of
+     * the bundle is built, because it is added after the minification stage runs.
+     * Setting Vite's `build.minify: false` opts it out along with everything else.
+     */
+    runtimePatchDynamicLinks?: boolean;
+    /** Skip SRI generation for resources matching these patterns. Supports exact matches and simple glob patterns with '*'. */
+    skipResources?: string[];
+    /** Enable verbose build logging. When false (default), only warnings, errors, and a completion summary are shown. */
+    verboseLogging?: boolean;
+}
+
 /**
  * 兼容性检测
  * @param options 可以选择自定义插入内容
@@ -42,4 +194,13 @@ export declare const vitePluginCompatibilityDetection: (options?: IVitePluginCom
 
 export declare const vitePluginRouterRandomParams: () => Plugin_2;
 
+/**
+ * Vite plugin to add Subresource Integrity (SRI) attributes to external assets in index.html
+ * ESM-only, requires Node 18+ (uses global fetch)
+ *
+ * @param options - Configuration options for the plugin
+ * @returns Vite plugin with SRI processing capabilities
+ */
+export declare function vitePluginSri(options?: SriPluginOptions): PluginOption;
+
 export { }

package/dist/vite-plugins/index.js

@@ -1,8 +1,16 @@
-import { getCompatibilityPlugins as o } from "../src/vite-plugins/getCompatibilityPlugins.js";
-import { vitePluginCompatibilityDetection as r } from "../src/vite-plugins/vitePluginCompatibilityDetection.js";
-import { vitePluginRouterRandomParams as a } from "../src/vite-plugins/vitePluginRouterRandomParams.js";
+import { generateSriHash as r, generateSriHashFromFile as t, generateSriHashMap as o } from "../src/vite-plugins/generateSriHash.js";
+import { getCompatibilityPlugins as m } from "../src/vite-plugins/getCompatibilityPlugins.js";
+import { buildSriRuntimeCode as p, rewriteDynamicImports as g, vitePluginSri as l } from "../src/vite-plugins/vite-plugin-sri/index.js";
+import { vitePluginCompatibilityDetection as s } from "../src/vite-plugins/vitePluginCompatibilityDetection.js";
+import { vitePluginRouterRandomParams as x } from "../src/vite-plugins/vitePluginRouterRandomParams.js";
 export {
-  o as getCompatibilityPlugins,
-  r as vitePluginCompatibilityDetection,
-  a as vitePluginRouterRandomParams
+  p as buildSriRuntimeCode,
+  r as generateSriHash,
+  t as generateSriHashFromFile,
+  o as generateSriHashMap,
+  m as getCompatibilityPlugins,
+  g as rewriteDynamicImports,
+  s as vitePluginCompatibilityDetection,
+  x as vitePluginRouterRandomParams,
+  l as vitePluginSri
 };

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "module-develop-kit",
   "author": "Front-End team",
-  "version": "1.2.4",
+  "version": "1.3.1",
   "type": "module",
   "description": "前端项目通用工具包",
   "module": "dist/main.js",
@@ -48,6 +48,7 @@
     "cross-env": "^10.0.0",
     "eslint": "^9.35.0",
     "jsdom": "^27.0.0",
+    "parse5": "^8.0.1",
     "prettier": "^3.6.2",
     "sdp-transform": "^2.15.0",
     "terser": "^5.44.0",

package/dist/commonjs-virtual-dir/___vite-browser-external.js

@@ -1,6 +0,0 @@
-import * as e from "./__vite-browser-external.js";
-import { getAugmentedNamespace as r } from "./_commonjsHelpers.js";
-const o = /* @__PURE__ */ r(e);
-export {
-  o as default
-};

package/dist/commonjs-virtual-dir/__vite-browser-external.js

@@ -1,4 +0,0 @@
-const e = {};
-export {
-  e as default
-};

package/dist/commonjs-virtual-dir/events.js

@@ -1,4 +0,0 @@
-var e = { exports: {} };
-export {
-  e as __module
-};

package/dist/vendor/events/events.js

@@ -1,216 +0,0 @@
-import { __module as p } from "../../commonjs-virtual-dir/events.js";
-var x;
-function F() {
-  if (x) return p.exports;
-  x = 1;
-  var a = typeof Reflect == "object" ? Reflect : null, d = a && typeof a.apply == "function" ? a.apply : function(e, n, r) {
-    return Function.prototype.apply.call(e, n, r);
-  }, l;
-  a && typeof a.ownKeys == "function" ? l = a.ownKeys : Object.getOwnPropertySymbols ? l = function(e) {
-    return Object.getOwnPropertyNames(e).concat(Object.getOwnPropertySymbols(e));
-  } : l = function(e) {
-    return Object.getOwnPropertyNames(e);
-  };
-  function C(t) {
-    console && console.warn && console.warn(t);
-  }
-  var h = Number.isNaN || function(e) {
-    return e !== e;
-  };
-  function o() {
-    o.init.call(this);
-  }
-  p.exports = o, p.exports.once = M, o.EventEmitter = o, o.prototype._events = void 0, o.prototype._eventsCount = 0, o.prototype._maxListeners = void 0;
-  var m = 10;
-  function v(t) {
-    if (typeof t != "function")
-      throw new TypeError('The "listener" argument must be of type Function. Received type ' + typeof t);
-  }
-  Object.defineProperty(o, "defaultMaxListeners", {
-    enumerable: !0,
-    get: function() {
-      return m;
-    },
-    set: function(t) {
-      if (typeof t != "number" || t < 0 || h(t))
-        throw new RangeError('The value of "defaultMaxListeners" is out of range. It must be a non-negative number. Received ' + t + ".");
-      m = t;
-    }
-  }), o.init = function() {
-    (this._events === void 0 || this._events === Object.getPrototypeOf(this)._events) && (this._events = /* @__PURE__ */ Object.create(null), this._eventsCount = 0), this._maxListeners = this._maxListeners || void 0;
-  }, o.prototype.setMaxListeners = function(e) {
-    if (typeof e != "number" || e < 0 || h(e))
-      throw new RangeError('The value of "n" is out of range. It must be a non-negative number. Received ' + e + ".");
-    return this._maxListeners = e, this;
-  };
-  function L(t) {
-    return t._maxListeners === void 0 ? o.defaultMaxListeners : t._maxListeners;
-  }
-  o.prototype.getMaxListeners = function() {
-    return L(this);
-  }, o.prototype.emit = function(e) {
-    for (var n = [], r = 1; r < arguments.length; r++) n.push(arguments[r]);
-    var i = e === "error", f = this._events;
-    if (f !== void 0)
-      i = i && f.error === void 0;
-    else if (!i)
-      return !1;
-    if (i) {
-      var s;
-      if (n.length > 0 && (s = n[0]), s instanceof Error)
-        throw s;
-      var u = new Error("Unhandled error." + (s ? " (" + s.message + ")" : ""));
-      throw u.context = s, u;
-    }
-    var c = f[e];
-    if (c === void 0)
-      return !1;
-    if (typeof c == "function")
-      d(c, this, n);
-    else
-      for (var O = c.length, P = b(c, O), r = 0; r < O; ++r)
-        d(P[r], this, n);
-    return !0;
-  };
-  function y(t, e, n, r) {
-    var i, f, s;
-    if (v(n), f = t._events, f === void 0 ? (f = t._events = /* @__PURE__ */ Object.create(null), t._eventsCount = 0) : (f.newListener !== void 0 && (t.emit(
-      "newListener",
-      e,
-      n.listener ? n.listener : n
-    ), f = t._events), s = f[e]), s === void 0)
-      s = f[e] = n, ++t._eventsCount;
-    else if (typeof s == "function" ? s = f[e] = r ? [n, s] : [s, n] : r ? s.unshift(n) : s.push(n), i = L(t), i > 0 && s.length > i && !s.warned) {
-      s.warned = !0;
-      var u = new Error("Possible EventEmitter memory leak detected. " + s.length + " " + String(e) + " listeners added. Use emitter.setMaxListeners() to increase limit");
-      u.name = "MaxListenersExceededWarning", u.emitter = t, u.type = e, u.count = s.length, C(u);
-    }
-    return t;
-  }
-  o.prototype.addListener = function(e, n) {
-    return y(this, e, n, !1);
-  }, o.prototype.on = o.prototype.addListener, o.prototype.prependListener = function(e, n) {
-    return y(this, e, n, !0);
-  };
-  function R() {
-    if (!this.fired)
-      return this.target.removeListener(this.type, this.wrapFn), this.fired = !0, arguments.length === 0 ? this.listener.call(this.target) : this.listener.apply(this.target, arguments);
-  }
-  function g(t, e, n) {
-    var r = { fired: !1, wrapFn: void 0, target: t, type: e, listener: n }, i = R.bind(r);
-    return i.listener = n, r.wrapFn = i, i;
-  }
-  o.prototype.once = function(e, n) {
-    return v(n), this.on(e, g(this, e, n)), this;
-  }, o.prototype.prependOnceListener = function(e, n) {
-    return v(n), this.prependListener(e, g(this, e, n)), this;
-  }, o.prototype.removeListener = function(e, n) {
-    var r, i, f, s, u;
-    if (v(n), i = this._events, i === void 0)
-      return this;
-    if (r = i[e], r === void 0)
-      return this;
-    if (r === n || r.listener === n)
-      --this._eventsCount === 0 ? this._events = /* @__PURE__ */ Object.create(null) : (delete i[e], i.removeListener && this.emit("removeListener", e, r.listener || n));
-    else if (typeof r != "function") {
-      for (f = -1, s = r.length - 1; s >= 0; s--)
-        if (r[s] === n || r[s].listener === n) {
-          u = r[s].listener, f = s;
-          break;
-        }
-      if (f < 0)
-        return this;
-      f === 0 ? r.shift() : j(r, f), r.length === 1 && (i[e] = r[0]), i.removeListener !== void 0 && this.emit("removeListener", e, u || n);
-    }
-    return this;
-  }, o.prototype.off = o.prototype.removeListener, o.prototype.removeAllListeners = function(e) {
-    var n, r, i;
-    if (r = this._events, r === void 0)
-      return this;
-    if (r.removeListener === void 0)
-      return arguments.length === 0 ? (this._events = /* @__PURE__ */ Object.create(null), this._eventsCount = 0) : r[e] !== void 0 && (--this._eventsCount === 0 ? this._events = /* @__PURE__ */ Object.create(null) : delete r[e]), this;
-    if (arguments.length === 0) {
-      var f = Object.keys(r), s;
-      for (i = 0; i < f.length; ++i)
-        s = f[i], s !== "removeListener" && this.removeAllListeners(s);
-      return this.removeAllListeners("removeListener"), this._events = /* @__PURE__ */ Object.create(null), this._eventsCount = 0, this;
-    }
-    if (n = r[e], typeof n == "function")
-      this.removeListener(e, n);
-    else if (n !== void 0)
-      for (i = n.length - 1; i >= 0; i--)
-        this.removeListener(e, n[i]);
-    return this;
-  };
-  function _(t, e, n) {
-    var r = t._events;
-    if (r === void 0)
-      return [];
-    var i = r[e];
-    return i === void 0 ? [] : typeof i == "function" ? n ? [i.listener || i] : [i] : n ? N(i) : b(i, i.length);
-  }
-  o.prototype.listeners = function(e) {
-    return _(this, e, !0);
-  }, o.prototype.rawListeners = function(e) {
-    return _(this, e, !1);
-  }, o.listenerCount = function(t, e) {
-    return typeof t.listenerCount == "function" ? t.listenerCount(e) : w.call(t, e);
-  }, o.prototype.listenerCount = w;
-  function w(t) {
-    var e = this._events;
-    if (e !== void 0) {
-      var n = e[t];
-      if (typeof n == "function")
-        return 1;
-      if (n !== void 0)
-        return n.length;
-    }
-    return 0;
-  }
-  o.prototype.eventNames = function() {
-    return this._eventsCount > 0 ? l(this._events) : [];
-  };
-  function b(t, e) {
-    for (var n = new Array(e), r = 0; r < e; ++r)
-      n[r] = t[r];
-    return n;
-  }
-  function j(t, e) {
-    for (; e + 1 < t.length; e++)
-      t[e] = t[e + 1];
-    t.pop();
-  }
-  function N(t) {
-    for (var e = new Array(t.length), n = 0; n < e.length; ++n)
-      e[n] = t[n].listener || t[n];
-    return e;
-  }
-  function M(t, e) {
-    return new Promise(function(n, r) {
-      function i(s) {
-        t.removeListener(e, f), r(s);
-      }
-      function f() {
-        typeof t.removeListener == "function" && t.removeListener("error", i), n([].slice.call(arguments));
-      }
-      E(t, e, f, { once: !0 }), e !== "error" && A(t, i, { once: !0 });
-    });
-  }
-  function A(t, e, n) {
-    typeof t.on == "function" && E(t, "error", e, n);
-  }
-  function E(t, e, n, r) {
-    if (typeof t.on == "function")
-      r.once ? t.once(e, n) : t.on(e, n);
-    else if (typeof t.addEventListener == "function")
-      t.addEventListener(e, function i(f) {
-        r.once && t.removeEventListener(e, i), n(f);
-      });
-    else
-      throw new TypeError('The "emitter" argument must be of type EventEmitter. Received type ' + typeof t);
-  }
-  return p.exports;
-}
-export {
-  F as __require
-};