vite-plugin-sri4 4.0.0 → 4.1.0

package/dist/index.cjs

@@ -109,8 +109,21 @@ async function checkResourceSupport(url, urlSupportCache, logger = null, retries
 
       clearTimeout(timeoutId);
 
+      // Only `*` can be verified at build time. Injecting integrity also means
+      // injecting crossorigin="anonymous"; if the server answers with a
+      // concrete origin that does not match wherever the HTML ends up being
+      // served from, that turns a working script into a blocked one. Skipping
+      // is the safe outcome, but say so at warn level - silence here is what
+      // makes an unprotected resource easy to miss.
       const corsHeader = response.headers.get('access-control-allow-origin');
-      const isSupported = response.ok && (corsHeader === '*' || corsHeader?.includes('*'));
+      const isSupported = response.ok && corsHeader === '*';
+      if (response.ok && corsHeader && corsHeader !== '*' && logger) {
+        logger.warn(
+          `Skipping SRI for ${url}: Access-Control-Allow-Origin is "${corsHeader}", not "*", ` +
+          'so crossorigin="anonymous" cannot be verified at build time. ' +
+          'Add the domain to bypassDomains to silence this.'
+        );
+      }
       urlSupportCache.set(url, isSupported);
       return isSupported
     } catch (error) {
@@ -182,43 +195,104 @@ async function fetchResource(url, resourceCache, logger = null, retries = 1) {
   return null
 }
 
+/**
+ * Read the hashable source out of a bundle entry (chunk code or asset source)
+ */
+function bundleSource(item) {
+  return item.type === 'chunk' ? item.code : item.source
+}
+
+/**
+ * Compute an SRI string for a source that may be a string, Buffer or Uint8Array
+ */
+function sriHash(source, hashAlgorithm) {
+  const hash = node_crypto.createHash(hashAlgorithm);
+  hash.update(typeof source === 'string' ? source : Buffer.from(source));
+  return `${hashAlgorithm}-${hash.digest('base64')}`
+}
+
+// Anything carrying a scheme (data:, blob:, invalid:) is not a path into the
+// bundle. Protocol-relative `//host/path` is excluded here - it is a real HTTP
+// URL and is fetched, not skipped.
+const SCHEME_RE = /^[a-z][a-z0-9+.-]*:/i;
+const HTTP_RE = /^https?:/i;
+
+/**
+ * The URL to fetch for an external resource, or null if it is not fetchable.
+ */
+function externalUrl(url) {
+  if (HTTP_RE.test(url)) return url
+  // Protocol-relative: same origin scheme as the page, https at build time
+  if (url.startsWith('//')) return `https:${url}`
+  return null
+}
+
 /**
  * Improved method for getting bundle keys
  */
 function getBundleKey(htmlPath, url, config) {
+  // Bundle keys never carry a query string or fragment
+  const cleanUrl = url.replace(/[?#].*$/, '');
+
   // Handle absolute path URLs
-  if (url.startsWith('/')) {
+  if (cleanUrl.startsWith('/')) {
     // Remove leading slash to match keys in bundle
-    return url.substring(1)
+    return cleanUrl.substring(1)
   }
 
-  // Handle relative paths (when config.base is relative)
+  // Handle relative paths (when config.base is relative). `join`, not
+  // `resolve` - bundle keys are relative to the output root, and `resolve`
+  // would make the key absolute against the process CWD.
   if (config.base === './' || config.base === '') {
-    return path.posix.resolve(path.posix.dirname(htmlPath), url)
+    return path.posix.join(path.posix.dirname(htmlPath), cleanUrl)
   }
 
   // Handle other cases, remove base prefix from URL
-  return url.startsWith(config.base)
-    ? url.substring(config.base.length)
-    : url
+  return cleanUrl.startsWith(config.base)
+    ? cleanUrl.substring(config.base.length)
+    : cleanUrl
+}
+
+/**
+ * Find a bundle key for a URL that did not match exactly.
+ *
+ * Matching is anchored on a path separator so `main.js` can never match
+ * `assets/vendor-main.js` - a cross-filename match would inject a valid-looking
+ * but wrong hash, which the browser rejects with no build-time error.
+ */
+function findBundleKey(bundle, bundleKey, logger = null) {
+  const candidates = Object.keys(bundle).filter(key =>
+    key === bundleKey ||
+    key.endsWith(`/${bundleKey}`) ||
+    bundleKey.endsWith(`/${key}`)
+  );
+
+  if (candidates.length > 1 && logger) {
+    logger.warn(
+      `Ambiguous bundle key for "${bundleKey}": ${candidates.join(', ')} - using ${candidates[0]}`
+    );
+  }
+
+  return candidates[0]
 }
 
 /**
  * Calculate SRI integrity hash for a given resource
  */
 async function calculateIntegrity(
-  bundle, 
-  htmlPath, 
-  url, 
-  options, 
-  config, 
+  bundle,
+  htmlPath,
+  url,
+  options,
+  config,
   cacheManager,
   logger = null
 ) {
-  const { 
-    ignoreMissingAsset, 
-    bypassDomains, 
-    hashAlgorithm 
+  const {
+    ignoreMissingAsset,
+    bypassDomains,
+    hashAlgorithm,
+    hashedAssets
   } = options;
 
   // Skip specified domains
@@ -226,32 +300,43 @@ async function calculateIntegrity(
     return null
   }
 
+  // With an absolute `base` (assets on a CDN) Vite emits absolute URLs for our
+  // own build output. Those must be hashed from the bundle, not fetched - the
+  // CDN may not have been deployed yet, and this is the very case SRI exists
+  // for. Checked before the network path.
+  const base = config.base || '/';
+  const ownAsset = (HTTP_RE.test(base) || base.startsWith('//')) && url.startsWith(base);
+  const fetchUrl = ownAsset ? null : externalUrl(url);
+
   let source;
-  if (url.startsWith('http')) {
-    const isSupported = await checkResourceSupport(url, cacheManager.getUrlSupportCache(), logger);
+  let bundleFileName = null;
+  if (fetchUrl) {
+    const isSupported = await checkResourceSupport(fetchUrl, cacheManager.getUrlSupportCache(), logger);
     if (!isSupported) return null
-    source = await fetchResource(url, cacheManager.getResourceCache(), logger);
+    source = await fetchResource(fetchUrl, cacheManager.getResourceCache(), logger);
     if (!source) return null
+  } else if (!ownAsset && SCHEME_RE.test(url)) {
+    // data:/blob: and unknown schemes cannot be resolved to a bundle asset
+    if (logger) {
+      logger.debug(`Skipping URL that is not a bundle asset: ${url}`);
+    }
+    return null
   } else {
     const bundleKey = getBundleKey(htmlPath, url, config);
     const bundleItem = bundle[bundleKey];
 
     if (!bundleItem) {
-      // Fall back to suffix match in either direction to absorb hashed
-      // filenames AND base-prefix mismatches (e.g. URL "/base/main.js" with
-      // bare bundle key "main.js"). A mismatch here just produces a wrong
-      // integrity hash, which the browser rejects — failure-closed.
-      const possibleMatch = Object.keys(bundle).find(key =>
-        key.endsWith(bundleKey) || bundleKey.endsWith(key)
-      );
+      // Fall back to a path-anchored suffix match to absorb hashed filenames
+      // AND base-prefix mismatches (e.g. URL "/base/main.js" with bare bundle
+      // key "main.js").
+      const possibleMatch = findBundleKey(bundle, bundleKey, logger);
 
       if (possibleMatch) {
         if (logger) {
           logger.debug(`Bundle key fallback: ${bundleKey} -> ${possibleMatch}`);
         }
-        source = bundle[possibleMatch].type === 'chunk'
-          ? bundle[possibleMatch].code
-          : bundle[possibleMatch].source;
+        bundleFileName = possibleMatch;
+        source = bundleSource(bundle[possibleMatch]);
       } else if (ignoreMissingAsset) {
         if (logger) {
           logger.warn(`Asset not found in bundle: ${url} (path: ${htmlPath}, key: ${bundleKey})`);
@@ -261,33 +346,65 @@ async function calculateIntegrity(
         throw new Error(`Asset ${url} not found in bundle (path: ${htmlPath}, key: ${bundleKey})`)
       }
     } else {
-      source = bundleItem.type === 'chunk' ? bundleItem.code : bundleItem.source;
+      bundleFileName = bundleKey;
+      source = bundleSource(bundleItem);
     }
   }
 
   // Ensure source is a Uint8Array or string
   if (!source) return null
 
-  if (typeof source === 'string') {
-    return `${hashAlgorithm}-${node_crypto.createHash(hashAlgorithm).update(source).digest('base64')}`
-  }
+  const integrity = sriHash(source, hashAlgorithm);
+  // Recorded so writeBundle can catch a later plugin rewriting these bytes
+  if (bundleFileName && hashedAssets) hashedAssets.set(bundleFileName, integrity);
+  return integrity
+}
+
+/**
+ * Match an attribute regardless of quoting style. Attribute order inside a tag
+ * is not significant in HTML, so attributes are read out of the matched tag
+ * rather than being baked into the tag regex.
+ */
+function attrPattern(name) {
+  // Lookbehind on whitespace, not `\b` - `\b` matches after the hyphen in
+  // `data-src`, and getAttr takes the first match, so a decoy attribute would
+  // hijack the URL.
+  return new RegExp(`(?<=\\s)${name}\\s*=\\s*(?:"([^"]*)"|'([^']*)'|([^\\s"'>]+))`, 'i')
+}
 
-  return `${hashAlgorithm}-${node_crypto.createHash(hashAlgorithm).update(Buffer.from(source)).digest('base64')}`
+// Attributes are always preceded by whitespace inside a tag, so anchoring on
+// it avoids matching `data-integrity`. `crossorigin` is matched with or without
+// a value - Vite emits the valueless form, and duplicating it is invalid HTML.
+const CROSSORIGIN_ATTR_RE = /\scrossorigin(?=[\s=>/]|$)/i;
+const INTEGRITY_ATTR_RE = /\sintegrity\s*=/i;
+
+const SRC_RE = attrPattern('src');
+const HREF_RE = attrPattern('href');
+const REL_RE = attrPattern('rel');
+
+// rel values whose tags carry an integrity attribute
+const SRI_LINK_RELS = new Set(['stylesheet', 'modulepreload']);
+
+function getAttr(tag, re) {
+  const match = tag.match(re);
+  if (!match) return null
+  return match[1] ?? match[2] ?? match[3] ?? null
 }
 
-// Optimized regex patterns for better readability and efficiency
 const HTML_PATTERNS = {
   script: {
-    regex: /<script\b[^>]*?\bsrc\s*=\s*["']([^"']+)["'][^>]*><\/script>/g,
-    endOffset: 10
+    regex: /<script\b[^>]*><\/script>/gi,
+    endOffset: 10, // length of '></script>'
+    getUrl: tag => getAttr(tag, SRC_RE)
   },
-  stylesheet: {
-    regex: /<link\b[^>]*?\brel\s*=\s*["']stylesheet["'][^>]*?\bhref\s*=\s*["']([^"']+)["'][^>]*>/g,
-    endOffset: 1
-  },
-  modulepreload: {
-    regex: /<link\b[^>]*?\brel\s*=\s*["']modulepreload["'][^>]*?\bhref\s*=\s*["']([^"']+)["'][^>]*>/g,
-    endOffset: 1
+  link: {
+    regex: /<link\b[^>]*>/gi,
+    endOffset: 1, // length of '>'
+    getUrl: tag => {
+      const rel = getAttr(tag, REL_RE);
+      if (!rel || !SRI_LINK_RELS.has(rel.trim().toLowerCase())) return null
+      return getAttr(tag, HREF_RE)
+    }
   }
 };
 
@@ -302,29 +419,42 @@ function validateHtmlInput(html, htmlPath, logger) {
   return true
 }
 
+/**
+ * Offset inside the matched tag where new attributes should go: just before the
+ * closing `>`, skipping back over the self-closing slash and any whitespace so
+ * `<link ... />` does not become `<link ... / integrity="...">`.
+ */
+function insertOffset(tag, endOffset) {
+  let at = tag.length - endOffset;
+  while (at > 0 && (tag[at - 1] === '/' || /\s/.test(tag[at - 1]))) at--;
+  return at
+}
+
 /**
  * Process a single match to create an integrity change object
  */
 async function processMatch(
-  match, 
-  endOffset, 
-  bundle, 
-  htmlPath, 
-  options, 
-  config, 
+  match,
+  pattern,
+  bundle,
+  htmlPath,
+  options,
+  config,
   cacheManager,
   logger
 ) {
-  const [, url] = match;
+  const tag = match[0];
+  if (INTEGRITY_ATTR_RE.test(tag)) return null
+
+  const url = pattern.getUrl(tag);
   if (!url) return null
 
-  const end = match.index + match[0].length;
   const integrity = await calculateIntegrity(
-    bundle, 
-    htmlPath, 
-    url, 
-    options, 
-    config, 
+    bundle,
+    htmlPath,
+    url,
+    options,
+    config,
     cacheManager,
     logger
   );
@@ -332,8 +462,8 @@ async function processMatch(
   if (integrity) {
     return {
       integrity,
-      position: end - endOffset,
-      tagStart: match.index,
+      position: match.index + insertOffset(tag, pattern.endOffset),
+      tag,
       url // For logging
     }
   }
@@ -344,22 +474,21 @@ async function processMatch(
  * Process matches for a specific HTML pattern
  */
 async function processPatternMatches(
-  html, 
-  pattern, 
-  bundle, 
-  htmlPath, 
-  options, 
-  config, 
+  html,
+  pattern,
+  bundle,
+  htmlPath,
+  options,
+  config,
   cacheManager,
   logger
 ) {
-  const { regex, endOffset } = pattern;
-  const matches = [...html.matchAll(regex)];
+  const matches = [...html.matchAll(pattern.regex)];
 
   // Process each match in parallel
   const matchResults = await Promise.all(
-    matches.map(match => 
-      processMatch(match, endOffset, bundle, htmlPath, options, config, cacheManager, logger)
+    matches.map(match =>
+      processMatch(match, pattern, bundle, htmlPath, options, config, cacheManager, logger)
     )
   );
 
@@ -371,11 +500,11 @@ async function processPatternMatches(
  * Collect all integrity changes from HTML patterns
  */
 async function collectIntegrityChanges(
-  html, 
-  bundle, 
-  htmlPath, 
-  options, 
-  config, 
+  html,
+  bundle,
+  htmlPath,
+  options,
+  config,
   cacheManager,
   logger
 ) {
@@ -385,12 +514,12 @@ async function collectIntegrityChanges(
   await Promise.all(
     Object.values(HTML_PATTERNS).map(async pattern => {
       const patternChanges = await processPatternMatches(
-        html, 
-        pattern, 
-        bundle, 
-        htmlPath, 
-        options, 
-        config, 
+        html,
+        pattern,
+        bundle,
+        htmlPath,
+        options,
+        config,
         cacheManager,
         logger
       );
@@ -401,22 +530,9 @@ async function collectIntegrityChanges(
   return changes
 }
 
-const CROSSORIGIN_ATTR_RE = /\bcrossorigin\s*=/i;
-const INTEGRITY_ATTR_RE = /\bintegrity\s*=/i;
-
-/**
- * Check if integrity attribute already exists in the same tag
- */
-function hasExistingIntegrity(html, tagStart, position) {
-  return INTEGRITY_ATTR_RE.test(html.slice(tagStart, position))
-}
-
-/**
- * Check if crossorigin attribute already exists in the same tag
- */
-function hasExistingCrossorigin(html, tagStart, position) {
-  return CROSSORIGIN_ATTR_RE.test(html.slice(tagStart, position))
-}
+// Attributes are always preceded by whitespace inside a tag, so anchoring on
+// it avoids matching `data-integrity`. `crossorigin` is matched with or without
+// a value - Vite emits the valueless form, and duplicating it is invalid HTML.
 
 /**
  * Apply integrity changes to HTML content
@@ -425,14 +541,9 @@ function applyIntegrityChanges(html, changes, logger) {
   // Sort by position in descending order to insert from back to front
   changes.sort((a, b) => b.position - a.position);
 
-  for (const { integrity, position, tagStart, url } of changes) {
-    // Skip if integrity attribute already exists on this tag
-    if (hasExistingIntegrity(html, tagStart, position)) {
-      continue
-    }
-
+  for (const { integrity, position, tag, url } of changes) {
     let insertText = ` integrity="${integrity}"`;
-    if (!hasExistingCrossorigin(html, tagStart, position)) {
+    if (!CROSSORIGIN_ATTR_RE.test(tag)) {
       insertText += ' crossorigin="anonymous"';
     }
     html = html.slice(0, position) + insertText + html.slice(position);
@@ -442,15 +553,49 @@ function applyIntegrityChanges(html, changes, logger) {
   return html
 }
 
+const EXISTING_IMPORTMAP_RE = /<script\b[^>]*\btype\s*=\s*["']importmap["']/i;
+const FIRST_SCRIPT_RE = /<script\b/i;
+const HEAD_CLOSE_RE = /<\/head\s*>/i;
+
+/**
+ * Inject an import map carrying an `integrity` map.
+ *
+ * This is the only mechanism that covers modules pulled in at runtime by
+ * `import()` / Vite's preload helper, which have no build-time HTML tag to
+ * rewrite. Engines without support ignore the key rather than failing.
+ */
+function injectImportmapIntegrity(html, integrity, logger) {
+  if (!html || typeof html !== 'string' || Object.keys(integrity).length === 0) {
+    return html
+  }
+
+  if (EXISTING_IMPORTMAP_RE.test(html)) {
+    logger.warn('HTML already contains an import map; skipping SRI import map injection');
+    return html
+  }
+
+  // `<` is escaped so a filename can never close the script element early
+  const json = JSON.stringify({ integrity }).replace(/</g, '\\u003c');
+  const tag = `<script type="importmap">${json}</script>`;
+
+  // Must precede every module script, otherwise the map does not apply to them
+  for (const re of [FIRST_SCRIPT_RE, HEAD_CLOSE_RE]) {
+    const at = html.search(re);
+    if (at !== -1) return html.slice(0, at) + tag + html.slice(at)
+  }
+
+  return html + tag
+}
+
 /**
  * Transform HTML by adding SRI integrity attributes
  */
 async function transformHTML(
-  bundle, 
-  htmlPath, 
-  html, 
-  options, 
-  config, 
+  bundle,
+  htmlPath,
+  html,
+  options,
+  config,
   cacheManager,
   logger
 ) {
@@ -459,11 +604,11 @@ async function transformHTML(
   }
 
   const changes = await collectIntegrityChanges(
-    html, 
-    bundle, 
-    htmlPath, 
-    options, 
-    config, 
+    html,
+    bundle,
+    htmlPath,
+    options,
+    config,
     cacheManager,
     logger
   );
@@ -476,9 +621,9 @@ async function transformHTML(
  */
 function createTransformer(options, config, cacheManager, logger) {
   return {
-    transformHTML: (bundle, htmlPath, html) => 
+    transformHTML: (bundle, htmlPath, html) =>
       transformHTML(bundle, htmlPath, html, options, config, cacheManager, logger),
-    calculateIntegrity: (bundle, htmlPath, url) => 
+    calculateIntegrity: (bundle, htmlPath, url) =>
       calculateIntegrity(bundle, htmlPath, url, options, config, cacheManager, logger)
   }
 }
@@ -499,7 +644,9 @@ class Logger {
       info: 3,
       debug: 4
     };
-    this.currentLevel = this.levels[logLevel] || this.levels.warn;
+    // `??`, not `||` - levels.silent is 0, which `||` treats as absent and
+    // silently downgrades to 'warn', the one level that must suppress output.
+    this.currentLevel = this.levels[logLevel] ?? this.levels.warn;
   }
 
   /**
@@ -557,74 +704,171 @@ class Logger {
   }
 }
 
-// Constants definition
 // Vite 6/7 uses `vite:build-import-analysis`; Vite 8 Rolldown native path
 // adds `native:import-analysis-build`. We patch whichever (or both) is present.
+//
+// Why patch at all, rather than use `transformIndexHtml` (order: 'post') or our
+// own `enforce: 'post'` generateBundle? Both of those run BEFORE this plugin
+// substitutes `__VITE_PRELOAD__` in entry chunks, so any hash taken there
+// describes bytes that never ship. Measured on Vite 8.2.2: at both of those
+// points the entry chunk still ends `import("./about-*.js"),__VITE_PRELOAD__)`,
+// while the written file ends `import("./about-*.js"),[])`. Wrapping this
+// plugin's own handler is the only hook position after that substitution.
+// `test/sri.test.js > injects integrity matching the actual emitted bytes`
+// fails if this is ever "simplified" away.
 const VITE_INTERNAL_ANALYSIS_PLUGINS = [
   'vite:build-import-analysis',
   'native:import-analysis-build'
 ];
 const DEFAULT_HASH_ALGORITHM = 'sha384';
 const DEFAULT_PLUGIN_NAME = 'vite-plugin-sri4';
+const MANIFEST_FILE_NAME = 'sri-manifest.json';
+const HTML_RE = /\.html?$/;
+const JS_MODULE_RE = /\.m?js$/;
+
+function toText(source) {
+  return typeof source === 'string' ? source : Buffer.from(source).toString('utf8')
+}
+
+function withTrailingSlash(base) {
+  if (!base) return '/'
+  return base.endsWith('/') ? base : `${base}/`
+}
+
+/**
+ * Hash every non-HTML output, keyed by bundle file name.
+ */
+function hashBundle(bundle, hashAlgorithm) {
+  const hashes = {};
+  for (const [fileName, item] of Object.entries(bundle)) {
+    if (HTML_RE.test(fileName)) continue
+    const source = bundleSource(item);
+    if (source) hashes[fileName] = sriHash(source, hashAlgorithm);
+  }
+  return hashes
+}
 
 function sri(options = {}) {
   const {
     ignoreMissingAsset = false,
     bypassDomains = [],
     hashAlgorithm = DEFAULT_HASH_ALGORITHM,
-    logLevel = 'warn'
+    logLevel = 'warn',
+    manifest = false,
+    importmap = false
   } = options;
 
   // Create cache manager and logger instances for this plugin instance
   const cacheManager = new CacheManager();
   const logger = new Logger(logLevel, DEFAULT_PLUGIN_NAME);
 
+  // bundle fileName -> the integrity we injected, re-checked in writeBundle
+  const hashedAssets = new Map();
+
   return {
     name: DEFAULT_PLUGIN_NAME,
     enforce: 'post',
     apply: 'build',
 
-    // Cleanup work
-    buildEnd() {
-      // Clear caches
+    // Every generateBundle hook has run by now. A plugin that rewrites chunk
+    // contents after ours (plugin-legacy, in-place compression) would leave the
+    // injected hashes describing bytes that no longer ship - a green build that
+    // only fails in the browser. Fail here instead.
+    writeBundle(_, bundle) {
+      const drifted = [];
+      for (const [fileName, integrity] of hashedAssets) {
+        const item = bundle[fileName];
+        if (!item) continue
+        const source = bundleSource(item);
+        if (source && sriHash(source, hashAlgorithm) !== integrity) {
+          drifted.push(fileName);
+        }
+      }
+      hashedAssets.clear();
+
+      if (drifted.length > 0) {
+        throw new Error(
+          `[${DEFAULT_PLUGIN_NAME}] content changed after integrity was computed: ` +
+          `${drifted.join(', ')}. A plugin running after this one rewrote these ` +
+          `files, so the injected hashes no longer match what ships. Move that ` +
+          `plugin before ${DEFAULT_PLUGIN_NAME}, or drop it.`
+        )
+      }
+    },
+
+    // Cleanup. Note this must not be `buildEnd`, which Rollup runs before the
+    // output phase - clearing there would empty the caches before use.
+    closeBundle() {
       cacheManager.clearAll();
+      hashedAssets.clear();
     },
 
     configResolved(config) {
       const transformer = createTransformer({
         ignoreMissingAsset,
         bypassDomains,
-        hashAlgorithm
+        hashAlgorithm,
+        hashedAssets
       }, config, cacheManager, logger);
 
+      // Both analysis plugin names can be present at once, and each is wrapped.
+      // Without this guard the body runs twice per bundle: `emitFile` throws on
+      // the duplicate manifest fileName, and the import map warns about the one
+      // it just injected. If the skipped pass was the one that finalised chunk
+      // contents, the writeBundle drift check fails the build loudly.
+      const handled = new WeakSet();
+
       const generateBundle = async function(_, bundle) {
+        if (handled.has(bundle)) return
+        handled.add(bundle);
+
+        // Computed before emitting anything so the manifest never hashes itself
+        const hashes = manifest || importmap ? hashBundle(bundle, hashAlgorithm) : null;
+
         const htmlFiles = Object.entries(bundle).filter(
           ([, chunk]) =>
             chunk.type === 'asset' &&
-            /\.html?$/.test(chunk.fileName)
+            HTML_RE.test(chunk.fileName)
         );
 
         if (htmlFiles.length === 0) {
+          // Normal for SSR / library builds, which render HTML at request time
+          // - the manifest below is how those builds get their hashes.
           logger.debug('No HTML files found in bundle');
-          return
         }
 
-        // Process all HTML files in parallel
+        // Errors are intentionally not caught: a resource that cannot be
+        // hashed must fail the build rather than ship without integrity.
         await Promise.all(
           htmlFiles.map(async ([name, chunk]) => {
-            try {
-              const originalContent = chunk.source.toString();
-              chunk.source = await transformer.transformHTML(bundle, name, originalContent);
-
-              if (originalContent !== chunk.source) {
-                logger.debug(`SRI attributes added to ${name}`);
+            const originalContent = toText(chunk.source);
+            let html = await transformer.transformHTML(bundle, name, originalContent);
+
+            if (importmap) {
+              const moduleIntegrity = {};
+              const base = withTrailingSlash(config.base);
+              for (const [fileName, integrity] of Object.entries(hashes)) {
+                if (JS_MODULE_RE.test(fileName)) moduleIntegrity[base + fileName] = integrity;
               }
-            } catch (error) {
-              logger.warn(`Error processing ${name}:`, error);
-              // Keep original content on error
+              html = injectImportmapIntegrity(html, moduleIntegrity, logger);
+            }
+
+            chunk.source = html;
+
+            if (originalContent !== chunk.source) {
+              logger.debug(`SRI attributes added to ${name}`);
             }
           })
         );
+
+        if (manifest) {
+          this.emitFile({
+            type: 'asset',
+            fileName: MANIFEST_FILE_NAME,
+            source: JSON.stringify(hashes, null, 2)
+          });
+          logger.debug(`Emitted ${MANIFEST_FILE_NAME} with ${Object.keys(hashes).length} entries`);
+        }
       };
 
       const targets = config.plugins.filter(