unplugin-version-injector 2.2.1 → 2.3.0

package/README.md

@@ -129,6 +129,7 @@ In your final HTML output:
 | `log`            | `boolean`                         | Whether to inject the console log script               | `true`                 |
 | `formatDate`     | `string \| ((date: Date) => string)` | Custom build time format: a dayjs-style pattern (e.g. `'YYYY-MM-DD HH:mm:ss'`) or a function | ISO 8601 format        |
 | `requestHeaders` | `boolean \| RequestHeadersOptions` | Attach version/build-time headers to outgoing requests | `false`                |
+| `nonce`          | `string`                          | CSP nonce added to the injected inline `<script>` tags | —                      |
 
 > `version` and `name` can be provided independently — whichever is missing falls back to the nearest `package.json`.
 

package/README.zh-CN.md

@@ -135,6 +135,7 @@ export default {
 | `log`        | `boolean` | 是否输出控制台日志               | `true`              |
 | `formatDate` | `string \| ((date: Date) => string)` | 自定义构建时间格式：支持 dayjs 风格字符串（如 `'YYYY-MM-DD HH:mm:ss'`）或函数 | ISO 格式 |
 | `requestHeaders` | `boolean \| RequestHeadersOptions` | 给发出的请求自动附加版本/构建时间请求头 | `false`  |
+| `nonce`      | `string`  | 给注入的内联 `<script>` 加 CSP nonce（严格 CSP 站点需设置） | —  |
 
 > `version` 和 `name` 可以单独传入，缺失的一项会自动从最近的 `package.json` 读取。
 

package/dist/index.d.mts

@@ -1,6 +1,6 @@
 import { UnpluginInstance, UnpluginFactory } from 'unplugin';
-import { V as VersionInjectorOptions } from './types-Cc-nzIS0.mjs';
-export { R as RequestHeadersOptions } from './types-Cc-nzIS0.mjs';
+import { V as VersionInjectorOptions } from './types-CLRw9rBI.mjs';
+export { R as RequestHeadersOptions } from './types-CLRw9rBI.mjs';
 
 declare const unpluginFactory: UnpluginFactory<VersionInjectorOptions | undefined>;
 declare const VersionInjector: UnpluginInstance<VersionInjectorOptions | undefined>;

package/dist/index.d.ts

@@ -1,6 +1,6 @@
 import { UnpluginInstance, UnpluginFactory } from 'unplugin';
-import { V as VersionInjectorOptions } from './types-Cc-nzIS0.js';
-export { R as RequestHeadersOptions } from './types-Cc-nzIS0.js';
+import { V as VersionInjectorOptions } from './types-CLRw9rBI.js';
+export { R as RequestHeadersOptions } from './types-CLRw9rBI.js';
 
 declare const unpluginFactory: UnpluginFactory<VersionInjectorOptions | undefined>;
 declare const VersionInjector: UnpluginInstance<VersionInjectorOptions | undefined>;

package/dist/index.js

@@ -133,6 +133,7 @@ function serializeInclude(patterns) {
   );
   return `[${items.join(", ")}]`;
 }
+var HEAD_OPEN_RE = /<head(\s[^>]*)?>/i;
 function createVersionInjector(options = {}) {
   const pkg = options.version && options.name ? { version: options.version, name: options.name } : getPackageVersion();
   const version = options.version || pkg.version;
@@ -140,11 +141,17 @@ function createVersionInjector(options = {}) {
   const formatDateOpt = options.formatDate;
   const formatDate2 = typeof formatDateOpt === "string" ? (date) => formatDate(date, formatDateOpt) : formatDateOpt != null ? formatDateOpt : defaultFormatDate;
   const headersConfig = normalizeRequestHeaders(options.requestHeaders);
+  let cachedBuildTime = null;
+  const getBuildTime = () => {
+    if (cachedBuildTime === null) cachedBuildTime = formatDate2(/* @__PURE__ */ new Date());
+    return cachedBuildTime;
+  };
+  const nonceAttr = options.nonce ? ` nonce="${escapeHtml(options.nonce)}"` : "";
   const metaTag = `<meta name="version" content="${escapeHtml(version)}">
 <meta name="project" content="${escapeHtml(name)}">
 `;
   const buildLogScript = (buildTime) => `
-<script ${INJECTED_MARK}>
+<script${nonceAttr} ${INJECTED_MARK}>
   (function () {
     try {
       var isDark = window.matchMedia && window.matchMedia('(prefers-color-scheme: dark)').matches;
@@ -159,7 +166,7 @@ function createVersionInjector(options = {}) {
     const versionValue = sanitizeHeaderValue(`${name}/${version}`);
     const buildValue = sanitizeHeaderValue(buildTime);
     return `
-<script ${HEADERS_INJECTED_MARK}>
+<script${nonceAttr} ${HEADERS_INJECTED_MARK}>
   (function () {
     try {
     if (window.__UVI_HEADERS_PATCHED__) return;
@@ -185,13 +192,21 @@ function createVersionInjector(options = {}) {
       }
     }
 
+    function matchesPrefix(href, p) {
+      if (href.indexOf(p) !== 0) return false;
+      // \u524D\u7F00\u672C\u8EAB\u4EE5 / \u7ED3\u5C3E\uFF0C\u6216\u524D\u7F00\u540E\u7D27\u8DDF\u8FB9\u754C\u5B57\u7B26\uFF0C\u907F\u514D 'https://api.x.com' \u547D\u4E2D 'https://api.x.com.evil.com'
+      if (p.charAt(p.length - 1) === '/') return true;
+      var next = href.charAt(p.length);
+      return next === '' || next === '/' || next === '?' || next === '#';
+    }
+
     function shouldInject(url) {
       var u = resolveUrl(url == null ? '' : String(url));
       if (!u || (u.protocol !== 'http:' && u.protocol !== 'https:')) return false;
       if (u.protocol === location.protocol && u.host === location.host) return true;
       for (var i = 0; i < INCLUDE.length; i++) {
         var p = INCLUDE[i];
-        if (typeof p === 'string' ? u.href.indexOf(p) === 0 : p.test(u.href)) return true;
+        if (typeof p === 'string' ? matchesPrefix(u.href, p) : p.test(u.href)) return true;
       }
       return false;
     }
@@ -247,14 +262,14 @@ function createVersionInjector(options = {}) {
   const processHtml = function processHtml2(html) {
     const original = html;
     try {
-      const buildTime = formatDate2(/* @__PURE__ */ new Date());
+      const buildTime = getBuildTime();
       if (!html.includes('<meta name="version"')) {
-        html = html.replace(/<head[^>]*>/i, (match) => `${match}
+        html = html.replace(HEAD_OPEN_RE, (match) => `${match}
   ${metaTag}`);
       }
       if (headersConfig && !html.includes(HEADERS_INJECTED_MARK)) {
         const headerScript = buildHeaderScript(buildTime, headersConfig);
-        html = html.replace(/<head[^>]*>/i, (match) => `${match}
+        html = html.replace(HEAD_OPEN_RE, (match) => `${match}
   ${headerScript}
 `);
       }
@@ -270,6 +285,7 @@ function createVersionInjector(options = {}) {
     }
   };
   processHtml.resetBuildTime = () => {
+    cachedBuildTime = null;
   };
   return processHtml;
 }
@@ -324,6 +340,10 @@ var unpluginFactory = (options = {}) => {
   const inject = createVersionInjector(options);
   return {
     name: PLUGIN_NAME,
+    // 每轮（重）构建开始时重置构建时间缓存：watch 重建刷新时间，同一次构建里 MPA 各页保持一致
+    buildStart() {
+      inject.resetBuildTime();
+    },
     vite: {
       transformIndexHtml(html) {
         return inject(html);

package/dist/index.mjs

@@ -124,6 +124,7 @@ function serializeInclude(patterns) {
   );
   return `[${items.join(", ")}]`;
 }
+var HEAD_OPEN_RE = /<head(\s[^>]*)?>/i;
 function createVersionInjector(options = {}) {
   const pkg = options.version && options.name ? { version: options.version, name: options.name } : getPackageVersion();
   const version = options.version || pkg.version;
@@ -131,11 +132,17 @@ function createVersionInjector(options = {}) {
   const formatDateOpt = options.formatDate;
   const formatDate2 = typeof formatDateOpt === "string" ? (date) => formatDate(date, formatDateOpt) : formatDateOpt != null ? formatDateOpt : defaultFormatDate;
   const headersConfig = normalizeRequestHeaders(options.requestHeaders);
+  let cachedBuildTime = null;
+  const getBuildTime = () => {
+    if (cachedBuildTime === null) cachedBuildTime = formatDate2(/* @__PURE__ */ new Date());
+    return cachedBuildTime;
+  };
+  const nonceAttr = options.nonce ? ` nonce="${escapeHtml(options.nonce)}"` : "";
   const metaTag = `<meta name="version" content="${escapeHtml(version)}">
 <meta name="project" content="${escapeHtml(name)}">
 `;
   const buildLogScript = (buildTime) => `
-<script ${INJECTED_MARK}>
+<script${nonceAttr} ${INJECTED_MARK}>
   (function () {
     try {
       var isDark = window.matchMedia && window.matchMedia('(prefers-color-scheme: dark)').matches;
@@ -150,7 +157,7 @@ function createVersionInjector(options = {}) {
     const versionValue = sanitizeHeaderValue(`${name}/${version}`);
     const buildValue = sanitizeHeaderValue(buildTime);
     return `
-<script ${HEADERS_INJECTED_MARK}>
+<script${nonceAttr} ${HEADERS_INJECTED_MARK}>
   (function () {
     try {
     if (window.__UVI_HEADERS_PATCHED__) return;
@@ -176,13 +183,21 @@ function createVersionInjector(options = {}) {
       }
     }
 
+    function matchesPrefix(href, p) {
+      if (href.indexOf(p) !== 0) return false;
+      // \u524D\u7F00\u672C\u8EAB\u4EE5 / \u7ED3\u5C3E\uFF0C\u6216\u524D\u7F00\u540E\u7D27\u8DDF\u8FB9\u754C\u5B57\u7B26\uFF0C\u907F\u514D 'https://api.x.com' \u547D\u4E2D 'https://api.x.com.evil.com'
+      if (p.charAt(p.length - 1) === '/') return true;
+      var next = href.charAt(p.length);
+      return next === '' || next === '/' || next === '?' || next === '#';
+    }
+
     function shouldInject(url) {
       var u = resolveUrl(url == null ? '' : String(url));
       if (!u || (u.protocol !== 'http:' && u.protocol !== 'https:')) return false;
       if (u.protocol === location.protocol && u.host === location.host) return true;
       for (var i = 0; i < INCLUDE.length; i++) {
         var p = INCLUDE[i];
-        if (typeof p === 'string' ? u.href.indexOf(p) === 0 : p.test(u.href)) return true;
+        if (typeof p === 'string' ? matchesPrefix(u.href, p) : p.test(u.href)) return true;
       }
       return false;
     }
@@ -238,14 +253,14 @@ function createVersionInjector(options = {}) {
   const processHtml = function processHtml2(html) {
     const original = html;
     try {
-      const buildTime = formatDate2(/* @__PURE__ */ new Date());
+      const buildTime = getBuildTime();
       if (!html.includes('<meta name="version"')) {
-        html = html.replace(/<head[^>]*>/i, (match) => `${match}
+        html = html.replace(HEAD_OPEN_RE, (match) => `${match}
   ${metaTag}`);
       }
       if (headersConfig && !html.includes(HEADERS_INJECTED_MARK)) {
         const headerScript = buildHeaderScript(buildTime, headersConfig);
-        html = html.replace(/<head[^>]*>/i, (match) => `${match}
+        html = html.replace(HEAD_OPEN_RE, (match) => `${match}
   ${headerScript}
 `);
       }
@@ -261,6 +276,7 @@ function createVersionInjector(options = {}) {
     }
   };
   processHtml.resetBuildTime = () => {
+    cachedBuildTime = null;
   };
   return processHtml;
 }
@@ -315,6 +331,10 @@ var unpluginFactory = (options = {}) => {
   const inject = createVersionInjector(options);
   return {
     name: PLUGIN_NAME,
+    // 每轮（重）构建开始时重置构建时间缓存：watch 重建刷新时间，同一次构建里 MPA 各页保持一致
+    buildStart() {
+      inject.resetBuildTime();
+    },
     vite: {
       transformIndexHtml(html) {
         return inject(html);

package/dist/rolldown.d.mts

@@ -1,5 +1,5 @@
 import * as unplugin from 'unplugin';
-import { V as VersionInjectorOptions } from './types-Cc-nzIS0.mjs';
+import { V as VersionInjectorOptions } from './types-CLRw9rBI.mjs';
 
 declare const _default: (options?: VersionInjectorOptions | undefined) => unplugin.RolldownPlugin<any> | unplugin.RolldownPlugin<any>[];
 

package/dist/rolldown.d.ts

@@ -1,5 +1,5 @@
 import * as unplugin from 'unplugin';
-import { V as VersionInjectorOptions } from './types-Cc-nzIS0.js';
+import { V as VersionInjectorOptions } from './types-CLRw9rBI.js';
 
 declare const _default: (options?: VersionInjectorOptions | undefined) => unplugin.RolldownPlugin<any> | unplugin.RolldownPlugin<any>[];
 

package/dist/rolldown.js

@@ -131,6 +131,7 @@ function serializeInclude(patterns) {
   );
   return `[${items.join(", ")}]`;
 }
+var HEAD_OPEN_RE = /<head(\s[^>]*)?>/i;
 function createVersionInjector(options = {}) {
   const pkg = options.version && options.name ? { version: options.version, name: options.name } : getPackageVersion();
   const version = options.version || pkg.version;
@@ -138,11 +139,17 @@ function createVersionInjector(options = {}) {
   const formatDateOpt = options.formatDate;
   const formatDate2 = typeof formatDateOpt === "string" ? (date) => formatDate(date, formatDateOpt) : formatDateOpt != null ? formatDateOpt : defaultFormatDate;
   const headersConfig = normalizeRequestHeaders(options.requestHeaders);
+  let cachedBuildTime = null;
+  const getBuildTime = () => {
+    if (cachedBuildTime === null) cachedBuildTime = formatDate2(/* @__PURE__ */ new Date());
+    return cachedBuildTime;
+  };
+  const nonceAttr = options.nonce ? ` nonce="${escapeHtml(options.nonce)}"` : "";
   const metaTag = `<meta name="version" content="${escapeHtml(version)}">
 <meta name="project" content="${escapeHtml(name)}">
 `;
   const buildLogScript = (buildTime) => `
-<script ${INJECTED_MARK}>
+<script${nonceAttr} ${INJECTED_MARK}>
   (function () {
     try {
       var isDark = window.matchMedia && window.matchMedia('(prefers-color-scheme: dark)').matches;
@@ -157,7 +164,7 @@ function createVersionInjector(options = {}) {
     const versionValue = sanitizeHeaderValue(`${name}/${version}`);
     const buildValue = sanitizeHeaderValue(buildTime);
     return `
-<script ${HEADERS_INJECTED_MARK}>
+<script${nonceAttr} ${HEADERS_INJECTED_MARK}>
   (function () {
     try {
     if (window.__UVI_HEADERS_PATCHED__) return;
@@ -183,13 +190,21 @@ function createVersionInjector(options = {}) {
       }
     }
 
+    function matchesPrefix(href, p) {
+      if (href.indexOf(p) !== 0) return false;
+      // \u524D\u7F00\u672C\u8EAB\u4EE5 / \u7ED3\u5C3E\uFF0C\u6216\u524D\u7F00\u540E\u7D27\u8DDF\u8FB9\u754C\u5B57\u7B26\uFF0C\u907F\u514D 'https://api.x.com' \u547D\u4E2D 'https://api.x.com.evil.com'
+      if (p.charAt(p.length - 1) === '/') return true;
+      var next = href.charAt(p.length);
+      return next === '' || next === '/' || next === '?' || next === '#';
+    }
+
     function shouldInject(url) {
       var u = resolveUrl(url == null ? '' : String(url));
       if (!u || (u.protocol !== 'http:' && u.protocol !== 'https:')) return false;
       if (u.protocol === location.protocol && u.host === location.host) return true;
       for (var i = 0; i < INCLUDE.length; i++) {
         var p = INCLUDE[i];
-        if (typeof p === 'string' ? u.href.indexOf(p) === 0 : p.test(u.href)) return true;
+        if (typeof p === 'string' ? matchesPrefix(u.href, p) : p.test(u.href)) return true;
       }
       return false;
     }
@@ -245,14 +260,14 @@ function createVersionInjector(options = {}) {
   const processHtml = function processHtml2(html) {
     const original = html;
     try {
-      const buildTime = formatDate2(/* @__PURE__ */ new Date());
+      const buildTime = getBuildTime();
       if (!html.includes('<meta name="version"')) {
-        html = html.replace(/<head[^>]*>/i, (match) => `${match}
+        html = html.replace(HEAD_OPEN_RE, (match) => `${match}
   ${metaTag}`);
       }
       if (headersConfig && !html.includes(HEADERS_INJECTED_MARK)) {
         const headerScript = buildHeaderScript(buildTime, headersConfig);
-        html = html.replace(/<head[^>]*>/i, (match) => `${match}
+        html = html.replace(HEAD_OPEN_RE, (match) => `${match}
   ${headerScript}
 `);
       }
@@ -268,6 +283,7 @@ function createVersionInjector(options = {}) {
     }
   };
   processHtml.resetBuildTime = () => {
+    cachedBuildTime = null;
   };
   return processHtml;
 }
@@ -322,6 +338,10 @@ var unpluginFactory = (options = {}) => {
   const inject = createVersionInjector(options);
   return {
     name: PLUGIN_NAME,
+    // 每轮（重）构建开始时重置构建时间缓存：watch 重建刷新时间，同一次构建里 MPA 各页保持一致
+    buildStart() {
+      inject.resetBuildTime();
+    },
     vite: {
       transformIndexHtml(html) {
         return inject(html);

package/dist/rolldown.mjs

@@ -124,6 +124,7 @@ function serializeInclude(patterns) {
   );
   return `[${items.join(", ")}]`;
 }
+var HEAD_OPEN_RE = /<head(\s[^>]*)?>/i;
 function createVersionInjector(options = {}) {
   const pkg = options.version && options.name ? { version: options.version, name: options.name } : getPackageVersion();
   const version = options.version || pkg.version;
@@ -131,11 +132,17 @@ function createVersionInjector(options = {}) {
   const formatDateOpt = options.formatDate;
   const formatDate2 = typeof formatDateOpt === "string" ? (date) => formatDate(date, formatDateOpt) : formatDateOpt != null ? formatDateOpt : defaultFormatDate;
   const headersConfig = normalizeRequestHeaders(options.requestHeaders);
+  let cachedBuildTime = null;
+  const getBuildTime = () => {
+    if (cachedBuildTime === null) cachedBuildTime = formatDate2(/* @__PURE__ */ new Date());
+    return cachedBuildTime;
+  };
+  const nonceAttr = options.nonce ? ` nonce="${escapeHtml(options.nonce)}"` : "";
   const metaTag = `<meta name="version" content="${escapeHtml(version)}">
 <meta name="project" content="${escapeHtml(name)}">
 `;
   const buildLogScript = (buildTime) => `
-<script ${INJECTED_MARK}>
+<script${nonceAttr} ${INJECTED_MARK}>
   (function () {
     try {
       var isDark = window.matchMedia && window.matchMedia('(prefers-color-scheme: dark)').matches;
@@ -150,7 +157,7 @@ function createVersionInjector(options = {}) {
     const versionValue = sanitizeHeaderValue(`${name}/${version}`);
     const buildValue = sanitizeHeaderValue(buildTime);
     return `
-<script ${HEADERS_INJECTED_MARK}>
+<script${nonceAttr} ${HEADERS_INJECTED_MARK}>
   (function () {
     try {
     if (window.__UVI_HEADERS_PATCHED__) return;
@@ -176,13 +183,21 @@ function createVersionInjector(options = {}) {
       }
     }
 
+    function matchesPrefix(href, p) {
+      if (href.indexOf(p) !== 0) return false;
+      // \u524D\u7F00\u672C\u8EAB\u4EE5 / \u7ED3\u5C3E\uFF0C\u6216\u524D\u7F00\u540E\u7D27\u8DDF\u8FB9\u754C\u5B57\u7B26\uFF0C\u907F\u514D 'https://api.x.com' \u547D\u4E2D 'https://api.x.com.evil.com'
+      if (p.charAt(p.length - 1) === '/') return true;
+      var next = href.charAt(p.length);
+      return next === '' || next === '/' || next === '?' || next === '#';
+    }
+
     function shouldInject(url) {
       var u = resolveUrl(url == null ? '' : String(url));
       if (!u || (u.protocol !== 'http:' && u.protocol !== 'https:')) return false;
       if (u.protocol === location.protocol && u.host === location.host) return true;
       for (var i = 0; i < INCLUDE.length; i++) {
         var p = INCLUDE[i];
-        if (typeof p === 'string' ? u.href.indexOf(p) === 0 : p.test(u.href)) return true;
+        if (typeof p === 'string' ? matchesPrefix(u.href, p) : p.test(u.href)) return true;
       }
       return false;
     }
@@ -238,14 +253,14 @@ function createVersionInjector(options = {}) {
   const processHtml = function processHtml2(html) {
     const original = html;
     try {
-      const buildTime = formatDate2(/* @__PURE__ */ new Date());
+      const buildTime = getBuildTime();
       if (!html.includes('<meta name="version"')) {
-        html = html.replace(/<head[^>]*>/i, (match) => `${match}
+        html = html.replace(HEAD_OPEN_RE, (match) => `${match}
   ${metaTag}`);
       }
       if (headersConfig && !html.includes(HEADERS_INJECTED_MARK)) {
         const headerScript = buildHeaderScript(buildTime, headersConfig);
-        html = html.replace(/<head[^>]*>/i, (match) => `${match}
+        html = html.replace(HEAD_OPEN_RE, (match) => `${match}
   ${headerScript}
 `);
       }
@@ -261,6 +276,7 @@ function createVersionInjector(options = {}) {
     }
   };
   processHtml.resetBuildTime = () => {
+    cachedBuildTime = null;
   };
   return processHtml;
 }
@@ -315,6 +331,10 @@ var unpluginFactory = (options = {}) => {
   const inject = createVersionInjector(options);
   return {
     name: PLUGIN_NAME,
+    // 每轮（重）构建开始时重置构建时间缓存：watch 重建刷新时间，同一次构建里 MPA 各页保持一致
+    buildStart() {
+      inject.resetBuildTime();
+    },
     vite: {
       transformIndexHtml(html) {
         return inject(html);

package/dist/rollup.d.mts

@@ -1,5 +1,5 @@
 import * as rollup from 'rollup';
-import { V as VersionInjectorOptions } from './types-Cc-nzIS0.mjs';
+import { V as VersionInjectorOptions } from './types-CLRw9rBI.mjs';
 
 declare const _default: (options?: VersionInjectorOptions | undefined) => rollup.Plugin<any> | rollup.Plugin<any>[];
 

package/dist/rollup.d.ts

@@ -1,5 +1,5 @@
 import * as rollup from 'rollup';
-import { V as VersionInjectorOptions } from './types-Cc-nzIS0.js';
+import { V as VersionInjectorOptions } from './types-CLRw9rBI.js';
 
 declare const _default: (options?: VersionInjectorOptions | undefined) => rollup.Plugin<any> | rollup.Plugin<any>[];
 

package/dist/rollup.js

@@ -131,6 +131,7 @@ function serializeInclude(patterns) {
   );
   return `[${items.join(", ")}]`;
 }
+var HEAD_OPEN_RE = /<head(\s[^>]*)?>/i;
 function createVersionInjector(options = {}) {
   const pkg = options.version && options.name ? { version: options.version, name: options.name } : getPackageVersion();
   const version = options.version || pkg.version;
@@ -138,11 +139,17 @@ function createVersionInjector(options = {}) {
   const formatDateOpt = options.formatDate;
   const formatDate2 = typeof formatDateOpt === "string" ? (date) => formatDate(date, formatDateOpt) : formatDateOpt != null ? formatDateOpt : defaultFormatDate;
   const headersConfig = normalizeRequestHeaders(options.requestHeaders);
+  let cachedBuildTime = null;
+  const getBuildTime = () => {
+    if (cachedBuildTime === null) cachedBuildTime = formatDate2(/* @__PURE__ */ new Date());
+    return cachedBuildTime;
+  };
+  const nonceAttr = options.nonce ? ` nonce="${escapeHtml(options.nonce)}"` : "";
   const metaTag = `<meta name="version" content="${escapeHtml(version)}">
 <meta name="project" content="${escapeHtml(name)}">
 `;
   const buildLogScript = (buildTime) => `
-<script ${INJECTED_MARK}>
+<script${nonceAttr} ${INJECTED_MARK}>
   (function () {
     try {
       var isDark = window.matchMedia && window.matchMedia('(prefers-color-scheme: dark)').matches;
@@ -157,7 +164,7 @@ function createVersionInjector(options = {}) {
     const versionValue = sanitizeHeaderValue(`${name}/${version}`);
     const buildValue = sanitizeHeaderValue(buildTime);
     return `
-<script ${HEADERS_INJECTED_MARK}>
+<script${nonceAttr} ${HEADERS_INJECTED_MARK}>
   (function () {
     try {
     if (window.__UVI_HEADERS_PATCHED__) return;
@@ -183,13 +190,21 @@ function createVersionInjector(options = {}) {
       }
     }
 
+    function matchesPrefix(href, p) {
+      if (href.indexOf(p) !== 0) return false;
+      // \u524D\u7F00\u672C\u8EAB\u4EE5 / \u7ED3\u5C3E\uFF0C\u6216\u524D\u7F00\u540E\u7D27\u8DDF\u8FB9\u754C\u5B57\u7B26\uFF0C\u907F\u514D 'https://api.x.com' \u547D\u4E2D 'https://api.x.com.evil.com'
+      if (p.charAt(p.length - 1) === '/') return true;
+      var next = href.charAt(p.length);
+      return next === '' || next === '/' || next === '?' || next === '#';
+    }
+
     function shouldInject(url) {
       var u = resolveUrl(url == null ? '' : String(url));
       if (!u || (u.protocol !== 'http:' && u.protocol !== 'https:')) return false;
       if (u.protocol === location.protocol && u.host === location.host) return true;
       for (var i = 0; i < INCLUDE.length; i++) {
         var p = INCLUDE[i];
-        if (typeof p === 'string' ? u.href.indexOf(p) === 0 : p.test(u.href)) return true;
+        if (typeof p === 'string' ? matchesPrefix(u.href, p) : p.test(u.href)) return true;
       }
       return false;
     }
@@ -245,14 +260,14 @@ function createVersionInjector(options = {}) {
   const processHtml = function processHtml2(html) {
     const original = html;
     try {
-      const buildTime = formatDate2(/* @__PURE__ */ new Date());
+      const buildTime = getBuildTime();
       if (!html.includes('<meta name="version"')) {
-        html = html.replace(/<head[^>]*>/i, (match) => `${match}
+        html = html.replace(HEAD_OPEN_RE, (match) => `${match}
   ${metaTag}`);
       }
       if (headersConfig && !html.includes(HEADERS_INJECTED_MARK)) {
         const headerScript = buildHeaderScript(buildTime, headersConfig);
-        html = html.replace(/<head[^>]*>/i, (match) => `${match}
+        html = html.replace(HEAD_OPEN_RE, (match) => `${match}
   ${headerScript}
 `);
       }
@@ -268,6 +283,7 @@ function createVersionInjector(options = {}) {
     }
   };
   processHtml.resetBuildTime = () => {
+    cachedBuildTime = null;
   };
   return processHtml;
 }
@@ -322,6 +338,10 @@ var unpluginFactory = (options = {}) => {
   const inject = createVersionInjector(options);
   return {
     name: PLUGIN_NAME,
+    // 每轮（重）构建开始时重置构建时间缓存：watch 重建刷新时间，同一次构建里 MPA 各页保持一致
+    buildStart() {
+      inject.resetBuildTime();
+    },
     vite: {
       transformIndexHtml(html) {
         return inject(html);

package/dist/rollup.mjs

@@ -124,6 +124,7 @@ function serializeInclude(patterns) {
   );
   return `[${items.join(", ")}]`;
 }
+var HEAD_OPEN_RE = /<head(\s[^>]*)?>/i;
 function createVersionInjector(options = {}) {
   const pkg = options.version && options.name ? { version: options.version, name: options.name } : getPackageVersion();
   const version = options.version || pkg.version;
@@ -131,11 +132,17 @@ function createVersionInjector(options = {}) {
   const formatDateOpt = options.formatDate;
   const formatDate2 = typeof formatDateOpt === "string" ? (date) => formatDate(date, formatDateOpt) : formatDateOpt != null ? formatDateOpt : defaultFormatDate;
   const headersConfig = normalizeRequestHeaders(options.requestHeaders);
+  let cachedBuildTime = null;
+  const getBuildTime = () => {
+    if (cachedBuildTime === null) cachedBuildTime = formatDate2(/* @__PURE__ */ new Date());
+    return cachedBuildTime;
+  };
+  const nonceAttr = options.nonce ? ` nonce="${escapeHtml(options.nonce)}"` : "";
   const metaTag = `<meta name="version" content="${escapeHtml(version)}">
 <meta name="project" content="${escapeHtml(name)}">
 `;
   const buildLogScript = (buildTime) => `
-<script ${INJECTED_MARK}>
+<script${nonceAttr} ${INJECTED_MARK}>
   (function () {
     try {
       var isDark = window.matchMedia && window.matchMedia('(prefers-color-scheme: dark)').matches;
@@ -150,7 +157,7 @@ function createVersionInjector(options = {}) {
     const versionValue = sanitizeHeaderValue(`${name}/${version}`);
     const buildValue = sanitizeHeaderValue(buildTime);
     return `
-<script ${HEADERS_INJECTED_MARK}>
+<script${nonceAttr} ${HEADERS_INJECTED_MARK}>
   (function () {
     try {
     if (window.__UVI_HEADERS_PATCHED__) return;
@@ -176,13 +183,21 @@ function createVersionInjector(options = {}) {
       }
     }
 
+    function matchesPrefix(href, p) {
+      if (href.indexOf(p) !== 0) return false;
+      // \u524D\u7F00\u672C\u8EAB\u4EE5 / \u7ED3\u5C3E\uFF0C\u6216\u524D\u7F00\u540E\u7D27\u8DDF\u8FB9\u754C\u5B57\u7B26\uFF0C\u907F\u514D 'https://api.x.com' \u547D\u4E2D 'https://api.x.com.evil.com'
+      if (p.charAt(p.length - 1) === '/') return true;
+      var next = href.charAt(p.length);
+      return next === '' || next === '/' || next === '?' || next === '#';
+    }
+
     function shouldInject(url) {
       var u = resolveUrl(url == null ? '' : String(url));
       if (!u || (u.protocol !== 'http:' && u.protocol !== 'https:')) return false;
       if (u.protocol === location.protocol && u.host === location.host) return true;
       for (var i = 0; i < INCLUDE.length; i++) {
         var p = INCLUDE[i];
-        if (typeof p === 'string' ? u.href.indexOf(p) === 0 : p.test(u.href)) return true;
+        if (typeof p === 'string' ? matchesPrefix(u.href, p) : p.test(u.href)) return true;
       }
       return false;
     }
@@ -238,14 +253,14 @@ function createVersionInjector(options = {}) {
   const processHtml = function processHtml2(html) {
     const original = html;
     try {
-      const buildTime = formatDate2(/* @__PURE__ */ new Date());
+      const buildTime = getBuildTime();
       if (!html.includes('<meta name="version"')) {
-        html = html.replace(/<head[^>]*>/i, (match) => `${match}
+        html = html.replace(HEAD_OPEN_RE, (match) => `${match}
   ${metaTag}`);
       }
       if (headersConfig && !html.includes(HEADERS_INJECTED_MARK)) {
         const headerScript = buildHeaderScript(buildTime, headersConfig);
-        html = html.replace(/<head[^>]*>/i, (match) => `${match}
+        html = html.replace(HEAD_OPEN_RE, (match) => `${match}
   ${headerScript}
 `);
       }
@@ -261,6 +276,7 @@ function createVersionInjector(options = {}) {
     }
   };
   processHtml.resetBuildTime = () => {
+    cachedBuildTime = null;
   };
   return processHtml;
 }
@@ -315,6 +331,10 @@ var unpluginFactory = (options = {}) => {
   const inject = createVersionInjector(options);
   return {
     name: PLUGIN_NAME,
+    // 每轮（重）构建开始时重置构建时间缓存：watch 重建刷新时间，同一次构建里 MPA 各页保持一致
+    buildStart() {
+      inject.resetBuildTime();
+    },
     vite: {
       transformIndexHtml(html) {
         return inject(html);

package/dist/rspack.d.mts

@@ -1,5 +1,5 @@
 import * as unplugin from 'unplugin';
-import { V as VersionInjectorOptions } from './types-Cc-nzIS0.mjs';
+import { V as VersionInjectorOptions } from './types-CLRw9rBI.mjs';
 
 declare const _default: (options?: VersionInjectorOptions | undefined) => unplugin.RspackPluginInstance;
 

package/dist/rspack.d.ts

@@ -1,5 +1,5 @@
 import * as unplugin from 'unplugin';
-import { V as VersionInjectorOptions } from './types-Cc-nzIS0.js';
+import { V as VersionInjectorOptions } from './types-CLRw9rBI.js';
 
 declare const _default: (options?: VersionInjectorOptions | undefined) => unplugin.RspackPluginInstance;