vite-plugin-sri4 4.0.0 → 4.2.0

package/dist/index.cjs

@@ -3,8 +3,8 @@
 Object.defineProperty(exports, '__esModule', { value: true });
 
 var node_crypto = require('node:crypto');
+var promises = require('node:fs/promises');
 var path = require('node:path');
-var fetch = require('cross-fetch');
 
 /**
  * Extended caching mechanism with expiration time
@@ -67,6 +67,8 @@ class CacheManager {
   }
 }
 
+// Global fetch, stable since Node 18 - the floor the Vite 6.4 peer range
+// already implies. No dependency needed.
 const DEFAULT_TIMEOUT = 5000;
 
 /**
@@ -109,8 +111,21 @@ async function checkResourceSupport(url, urlSupportCache, logger = null, retries
 
       clearTimeout(timeoutId);
 
+      // Only `*` can be verified at build time. Injecting integrity also means
+      // injecting crossorigin="anonymous"; if the server answers with a
+      // concrete origin that does not match wherever the HTML ends up being
+      // served from, that turns a working script into a blocked one. Skipping
+      // is the safe outcome, but say so at warn level - silence here is what
+      // makes an unprotected resource easy to miss.
       const corsHeader = response.headers.get('access-control-allow-origin');
-      const isSupported = response.ok && (corsHeader === '*' || corsHeader?.includes('*'));
+      const isSupported = response.ok && corsHeader === '*';
+      if (response.ok && corsHeader && corsHeader !== '*' && logger) {
+        logger.warn(
+          `Skipping SRI for ${url}: Access-Control-Allow-Origin is "${corsHeader}", not "*", ` +
+          'so crossorigin="anonymous" cannot be verified at build time. ' +
+          'Add the domain to bypassDomains to silence this.'
+        );
+      }
       urlSupportCache.set(url, isSupported);
       return isSupported
     } catch (error) {
@@ -182,43 +197,150 @@ async function fetchResource(url, resourceCache, logger = null, retries = 1) {
   return null
 }
 
+/**
+ * Read the hashable source out of a bundle entry (chunk code or asset source)
+ */
+function bundleSource(item) {
+  return item.type === 'chunk' ? item.code : item.source
+}
+
+// The only algorithms the SRI spec defines. Browsers reject anything else,
+// which blocks the resource with no build-time error at all.
+const SUPPORTED_HASH_ALGORITHMS = ['sha256', 'sha384', 'sha512'];
+
+/**
+ * Compute an SRI string for a source that may be a string, Buffer or Uint8Array
+ */
+function sriHash(source, hashAlgorithm) {
+  const hash = node_crypto.createHash(hashAlgorithm);
+  hash.update(typeof source === 'string' ? source : Buffer.from(source));
+  return `${hashAlgorithm}-${hash.digest('base64')}`
+}
+
+// Anything carrying a scheme (data:, blob:, invalid:) is not a path into the
+// bundle. Protocol-relative `//host/path` is excluded here - it is a real HTTP
+// URL and is fetched, not skipped.
+const SCHEME_RE = /^[a-z][a-z0-9+.-]*:/i;
+const HTTP_RE = /^https?:/i;
+
+/**
+ * The URL to fetch for an external resource, or null if it is not fetchable.
+ */
+function externalUrl(url) {
+  if (HTTP_RE.test(url)) return url
+  // Protocol-relative: same origin scheme as the page, https at build time
+  if (url.startsWith('//')) return `https:${url}`
+  return null
+}
+
 /**
  * Improved method for getting bundle keys
  */
 function getBundleKey(htmlPath, url, config) {
+  // Bundle keys never carry a query string or fragment
+  const cleanUrl = url.replace(/[?#].*$/, '');
+
   // Handle absolute path URLs
-  if (url.startsWith('/')) {
+  if (cleanUrl.startsWith('/')) {
     // Remove leading slash to match keys in bundle
-    return url.substring(1)
+    return cleanUrl.substring(1)
   }
 
-  // Handle relative paths (when config.base is relative)
+  // Handle relative paths (when config.base is relative). `join`, not
+  // `resolve` - bundle keys are relative to the output root, and `resolve`
+  // would make the key absolute against the process CWD.
   if (config.base === './' || config.base === '') {
-    return path.posix.resolve(path.posix.dirname(htmlPath), url)
+    return path.posix.join(path.posix.dirname(htmlPath), cleanUrl)
   }
 
   // Handle other cases, remove base prefix from URL
-  return url.startsWith(config.base)
-    ? url.substring(config.base.length)
-    : url
+  return cleanUrl.startsWith(config.base)
+    ? cleanUrl.substring(config.base.length)
+    : cleanUrl
+}
+
+/**
+ * Find a bundle key for a URL that did not match exactly.
+ *
+ * Matching is anchored on a path separator so `main.js` can never match
+ * `assets/vendor-main.js` - a cross-filename match would inject a valid-looking
+ * but wrong hash, which the browser rejects with no build-time error.
+ */
+function findBundleKey(bundle, bundleKey, logger = null) {
+  const candidates = Object.keys(bundle).filter(key =>
+    key === bundleKey ||
+    key.endsWith(`/${bundleKey}`) ||
+    bundleKey.endsWith(`/${key}`)
+  );
+
+  if (candidates.length > 1 && logger) {
+    logger.warn(
+      `Ambiguous bundle key for "${bundleKey}": ${candidates.join(', ')} - using ${candidates[0]}`
+    );
+  }
+
+  return candidates[0]
+}
+
+/**
+ * Read an asset that lives in `publicDir` rather than the bundle.
+ *
+ * Files copied verbatim from `public/` never appear as bundle entries, so
+ * without this a perfectly normal `<script src="/sw.js">` fails the build.
+ * Returns null rather than throwing so the caller keeps its own missing-asset
+ * policy.
+ */
+async function readPublicAsset(config, bundleKey, logger) {
+  const publicDir = config.publicDir;
+  if (!publicDir) return null
+
+  // Bundle keys come from URLs, which may be percent-encoded
+  let decoded;
+  try {
+    decoded = decodeURIComponent(bundleKey);
+  } catch {
+    decoded = bundleKey;
+  }
+
+  const filePath = path.resolve(publicDir, decoded);
+
+  // A URL must never reach outside publicDir, however it is spelled
+  const relative = path.relative(publicDir, filePath);
+  if (relative.startsWith('..') || path.isAbsolute(relative)) {
+    if (logger) {
+      logger.warn(`Refusing to read outside publicDir: ${bundleKey}`);
+    }
+    return null
+  }
+
+  try {
+    const source = await promises.readFile(filePath);
+    if (logger) {
+      logger.debug(`Resolved from publicDir: ${bundleKey}`);
+    }
+    return source
+  } catch {
+    return null
+  }
 }
 
 /**
  * Calculate SRI integrity hash for a given resource
  */
 async function calculateIntegrity(
-  bundle, 
-  htmlPath, 
-  url, 
-  options, 
-  config, 
+  bundle,
+  htmlPath,
+  url,
+  options,
+  config,
   cacheManager,
   logger = null
 ) {
-  const { 
-    ignoreMissingAsset, 
-    bypassDomains, 
-    hashAlgorithm 
+  const {
+    ignoreMissingAsset,
+    bypassDomains,
+    hashAlgorithm,
+    hashedAssets
   } = options;
 
   // Skip specified domains
@@ -226,68 +348,121 @@ async function calculateIntegrity(
     return null
   }
 
+  // With an absolute `base` (assets on a CDN) Vite emits absolute URLs for our
+  // own build output. Those must be hashed from the bundle, not fetched - the
+  // CDN may not have been deployed yet, and this is the very case SRI exists
+  // for. Checked before the network path.
+  const base = config.base || '/';
+  const ownAsset = (HTTP_RE.test(base) || base.startsWith('//')) && url.startsWith(base);
+  const fetchUrl = ownAsset ? null : externalUrl(url);
+
   let source;
-  if (url.startsWith('http')) {
-    const isSupported = await checkResourceSupport(url, cacheManager.getUrlSupportCache(), logger);
+  let bundleFileName = null;
+  if (fetchUrl) {
+    const isSupported = await checkResourceSupport(fetchUrl, cacheManager.getUrlSupportCache(), logger);
     if (!isSupported) return null
-    source = await fetchResource(url, cacheManager.getResourceCache(), logger);
+    source = await fetchResource(fetchUrl, cacheManager.getResourceCache(), logger);
     if (!source) return null
+  } else if (!ownAsset && SCHEME_RE.test(url)) {
+    // data:/blob: and unknown schemes cannot be resolved to a bundle asset
+    if (logger) {
+      logger.debug(`Skipping URL that is not a bundle asset: ${url}`);
+    }
+    return null
   } else {
     const bundleKey = getBundleKey(htmlPath, url, config);
     const bundleItem = bundle[bundleKey];
 
     if (!bundleItem) {
-      // Fall back to suffix match in either direction to absorb hashed
-      // filenames AND base-prefix mismatches (e.g. URL "/base/main.js" with
-      // bare bundle key "main.js"). A mismatch here just produces a wrong
-      // integrity hash, which the browser rejects — failure-closed.
-      const possibleMatch = Object.keys(bundle).find(key =>
-        key.endsWith(bundleKey) || bundleKey.endsWith(key)
-      );
+      // Fall back to a path-anchored suffix match to absorb hashed filenames
+      // AND base-prefix mismatches (e.g. URL "/base/main.js" with bare bundle
+      // key "main.js").
+      const possibleMatch = findBundleKey(bundle, bundleKey, logger);
 
       if (possibleMatch) {
         if (logger) {
           logger.debug(`Bundle key fallback: ${bundleKey} -> ${possibleMatch}`);
         }
-        source = bundle[possibleMatch].type === 'chunk'
-          ? bundle[possibleMatch].code
-          : bundle[possibleMatch].source;
-      } else if (ignoreMissingAsset) {
-        if (logger) {
-          logger.warn(`Asset not found in bundle: ${url} (path: ${htmlPath}, key: ${bundleKey})`);
-        }
-        return null
+        bundleFileName = possibleMatch;
+        source = bundleSource(bundle[possibleMatch]);
       } else {
-        throw new Error(`Asset ${url} not found in bundle (path: ${htmlPath}, key: ${bundleKey})`)
+        // Not a build output - it may still be a file copied from publicDir
+        source = await readPublicAsset(config, bundleKey, logger);
+
+        if (!source) {
+          if (ignoreMissingAsset) {
+            if (logger) {
+              logger.warn(
+                `Asset not found in bundle or publicDir: ${url} (path: ${htmlPath}, key: ${bundleKey})`
+              );
+            }
+            return null
+          }
+          throw new Error(
+            `Asset ${url} not found in bundle or publicDir (path: ${htmlPath}, key: ${bundleKey})`
+          )
+        }
       }
     } else {
-      source = bundleItem.type === 'chunk' ? bundleItem.code : bundleItem.source;
+      bundleFileName = bundleKey;
+      source = bundleSource(bundleItem);
     }
   }
 
   // Ensure source is a Uint8Array or string
   if (!source) return null
 
-  if (typeof source === 'string') {
-    return `${hashAlgorithm}-${node_crypto.createHash(hashAlgorithm).update(source).digest('base64')}`
-  }
+  const integrity = sriHash(source, hashAlgorithm);
+  // Recorded so writeBundle can catch a later plugin rewriting these bytes
+  if (bundleFileName && hashedAssets) hashedAssets.set(bundleFileName, integrity);
+  return integrity
+}
+
+/**
+ * Match an attribute regardless of quoting style. Attribute order inside a tag
+ * is not significant in HTML, so attributes are read out of the matched tag
+ * rather than being baked into the tag regex.
+ */
+function attrPattern(name) {
+  // Lookbehind on whitespace, not `\b` - `\b` matches after the hyphen in
+  // `data-src`, and getAttr takes the first match, so a decoy attribute would
+  // hijack the URL.
+  return new RegExp(`(?<=\\s)${name}\\s*=\\s*(?:"([^"]*)"|'([^']*)'|([^\\s"'>]+))`, 'i')
+}
+
+// Attributes are always preceded by whitespace inside a tag, so anchoring on
+// it avoids matching `data-integrity`. `crossorigin` is matched with or without
+// a value - Vite emits the valueless form, and duplicating it is invalid HTML.
+const CROSSORIGIN_ATTR_RE = /\scrossorigin(?=[\s=>/]|$)/i;
+const INTEGRITY_ATTR_RE = /\sintegrity\s*=/i;
+
+const SRC_RE = attrPattern('src');
+const HREF_RE = attrPattern('href');
+const REL_RE = attrPattern('rel');
 
-  return `${hashAlgorithm}-${node_crypto.createHash(hashAlgorithm).update(Buffer.from(source)).digest('base64')}`
+// rel values whose tags carry an integrity attribute
+const SRI_LINK_RELS = new Set(['stylesheet', 'modulepreload']);
+
+function getAttr(tag, re) {
+  const match = tag.match(re);
+  if (!match) return null
+  return match[1] ?? match[2] ?? match[3] ?? null
 }
 
-// Optimized regex patterns for better readability and efficiency
 const HTML_PATTERNS = {
   script: {
-    regex: /<script\b[^>]*?\bsrc\s*=\s*["']([^"']+)["'][^>]*><\/script>/g,
-    endOffset: 10
-  },
-  stylesheet: {
-    regex: /<link\b[^>]*?\brel\s*=\s*["']stylesheet["'][^>]*?\bhref\s*=\s*["']([^"']+)["'][^>]*>/g,
-    endOffset: 1
+    regex: /<script\b[^>]*><\/script>/gi,
+    endOffset: 10, // length of '></script>'
+    getUrl: tag => getAttr(tag, SRC_RE)
   },
-  modulepreload: {
-    regex: /<link\b[^>]*?\brel\s*=\s*["']modulepreload["'][^>]*?\bhref\s*=\s*["']([^"']+)["'][^>]*>/g,
-    endOffset: 1
+  link: {
+    regex: /<link\b[^>]*>/gi,
+    endOffset: 1, // length of '>'
+    getUrl: tag => {
+      const rel = getAttr(tag, REL_RE);
+      if (!rel || !SRI_LINK_RELS.has(rel.trim().toLowerCase())) return null
+      return getAttr(tag, HREF_RE)
+    }
   }
 };
 
@@ -303,63 +478,97 @@ function validateHtmlInput(html, htmlPath, logger) {
 }
 
 /**
- * Process a single match to create an integrity change object
+ * Offset inside the matched tag where new attributes should go: just before the
+ * closing `>`, skipping back over the self-closing slash and any whitespace so
+ * `<link ... />` does not become `<link ... / integrity="...">`.
+ */
+function insertOffset(tag, endOffset) {
+  let at = tag.length - endOffset;
+  while (at > 0 && (tag[at - 1] === '/' || /\s/.test(tag[at - 1]))) at--;
+  return at
+}
+
+/**
+ * Per-tag opt out. `<script skip-sri src="...">` is left alone, and the marker
+ * attribute is stripped so it does not ship to the browser. More granular than
+ * bypassDomains, which only reaches external hosts.
+ */
+const SKIP_SRI_ATTR_RE = /\s+skip-sri(?:\s*=\s*(?:"[^"]*"|'[^']*'|[^\s>/]+))?/i;
+
+/**
+ * Process a single match into a text edit: { start, end, content }. An
+ * insertion has start === end; a removal has empty content.
  */
 async function processMatch(
-  match, 
-  endOffset, 
-  bundle, 
-  htmlPath, 
-  options, 
-  config, 
+  match,
+  pattern,
+  bundle,
+  htmlPath,
+  options,
+  config,
   cacheManager,
   logger
 ) {
-  const [, url] = match;
+  const tag = match[0];
+
+  const skip = SKIP_SRI_ATTR_RE.exec(tag);
+  if (skip) {
+    return {
+      start: match.index + skip.index,
+      end: match.index + skip.index + skip[0].length,
+      content: '',
+      url: pattern.getUrl(tag),
+      skipped: true
+    }
+  }
+
+  // Nothing to do for a tag that already carries its own hash, and computing
+  // one anyway would register it for the writeBundle drift check
+  if (INTEGRITY_ATTR_RE.test(tag)) return null
+
+  const url = pattern.getUrl(tag);
   if (!url) return null
 
-  const end = match.index + match[0].length;
   const integrity = await calculateIntegrity(
-    bundle, 
-    htmlPath, 
-    url, 
-    options, 
-    config, 
+    bundle,
+    htmlPath,
+    url,
+    options,
+    config,
     cacheManager,
     logger
   );
 
-  if (integrity) {
-    return {
-      integrity,
-      position: end - endOffset,
-      tagStart: match.index,
-      url // For logging
-    }
+  if (!integrity) return null
+
+  let content = ` integrity="${integrity}"`;
+  if (!CROSSORIGIN_ATTR_RE.test(tag)) {
+    content += ` crossorigin="${options.crossorigin}"`;
   }
-  return null
+
+  const at = match.index + insertOffset(tag, pattern.endOffset);
+  return { start: at, end: at, content, url }
 }
 
 /**
  * Process matches for a specific HTML pattern
  */
 async function processPatternMatches(
-  html, 
-  pattern, 
-  bundle, 
-  htmlPath, 
-  options, 
-  config, 
+  html,
+  pattern,
+  bundle,
+  htmlPath,
+  options,
+  config,
   cacheManager,
   logger
 ) {
-  const { regex, endOffset } = pattern;
-  const matches = [...html.matchAll(regex)];
+  const matches = [...html.matchAll(pattern.regex)];
 
   // Process each match in parallel
   const matchResults = await Promise.all(
-    matches.map(match => 
-      processMatch(match, endOffset, bundle, htmlPath, options, config, cacheManager, logger)
+    matches.map(match =>
+      processMatch(match, pattern, bundle, htmlPath, options, config, cacheManager, logger)
     )
   );
 
@@ -371,11 +580,11 @@ async function processPatternMatches(
  * Collect all integrity changes from HTML patterns
  */
 async function collectIntegrityChanges(
-  html, 
-  bundle, 
-  htmlPath, 
-  options, 
-  config, 
+  html,
+  bundle,
+  htmlPath,
+  options,
+  config,
   cacheManager,
   logger
 ) {
@@ -385,12 +594,12 @@ async function collectIntegrityChanges(
   await Promise.all(
     Object.values(HTML_PATTERNS).map(async pattern => {
       const patternChanges = await processPatternMatches(
-        html, 
-        pattern, 
-        bundle, 
-        htmlPath, 
-        options, 
-        config, 
+        html,
+        pattern,
+        bundle,
+        htmlPath,
+        options,
+        config,
         cacheManager,
         logger
       );
@@ -401,56 +610,68 @@ async function collectIntegrityChanges(
   return changes
 }
 
-const CROSSORIGIN_ATTR_RE = /\bcrossorigin\s*=/i;
-const INTEGRITY_ATTR_RE = /\bintegrity\s*=/i;
+// Attributes are always preceded by whitespace inside a tag, so anchoring on
+// it avoids matching `data-integrity`. `crossorigin` is matched with or without
+// a value - Vite emits the valueless form, and duplicating it is invalid HTML.
 
 /**
- * Check if integrity attribute already exists in the same tag
+ * Apply integrity changes to HTML content
  */
-function hasExistingIntegrity(html, tagStart, position) {
-  return INTEGRITY_ATTR_RE.test(html.slice(tagStart, position))
-}
+function applyIntegrityChanges(html, changes, logger) {
+  // Back to front, so earlier offsets stay valid as the string is edited
+  changes.sort((a, b) => b.start - a.start);
 
-/**
- * Check if crossorigin attribute already exists in the same tag
- */
-function hasExistingCrossorigin(html, tagStart, position) {
-  return CROSSORIGIN_ATTR_RE.test(html.slice(tagStart, position))
+  for (const { start, end, content, url, skipped } of changes) {
+    html = html.slice(0, start) + content + html.slice(end);
+    logger.debug(skipped ? `Skipped (skip-sri): ${url}` : `Added integrity for: ${url}`);
+  }
+
+  return html
 }
 
+const EXISTING_IMPORTMAP_RE = /<script\b[^>]*\btype\s*=\s*["']importmap["']/i;
+const FIRST_SCRIPT_RE = /<script\b/i;
+const HEAD_CLOSE_RE = /<\/head\s*>/i;
+
 /**
- * Apply integrity changes to HTML content
+ * Inject an import map carrying an `integrity` map.
+ *
+ * This is the only mechanism that covers modules pulled in at runtime by
+ * `import()` / Vite's preload helper, which have no build-time HTML tag to
+ * rewrite. Engines without support ignore the key rather than failing.
  */
-function applyIntegrityChanges(html, changes, logger) {
-  // Sort by position in descending order to insert from back to front
-  changes.sort((a, b) => b.position - a.position);
+function injectImportmapIntegrity(html, integrity, logger) {
+  if (!html || typeof html !== 'string' || Object.keys(integrity).length === 0) {
+    return html
+  }
 
-  for (const { integrity, position, tagStart, url } of changes) {
-    // Skip if integrity attribute already exists on this tag
-    if (hasExistingIntegrity(html, tagStart, position)) {
-      continue
-    }
+  if (EXISTING_IMPORTMAP_RE.test(html)) {
+    logger.warn('HTML already contains an import map; skipping SRI import map injection');
+    return html
+  }
 
-    let insertText = ` integrity="${integrity}"`;
-    if (!hasExistingCrossorigin(html, tagStart, position)) {
-      insertText += ' crossorigin="anonymous"';
-    }
-    html = html.slice(0, position) + insertText + html.slice(position);
-    logger.debug(`Added integrity for: ${url}`);
+  // `<` is escaped so a filename can never close the script element early
+  const json = JSON.stringify({ integrity }).replace(/</g, '\\u003c');
+  const tag = `<script type="importmap">${json}</script>`;
+
+  // Must precede every module script, otherwise the map does not apply to them
+  for (const re of [FIRST_SCRIPT_RE, HEAD_CLOSE_RE]) {
+    const at = html.search(re);
+    if (at !== -1) return html.slice(0, at) + tag + html.slice(at)
   }
 
-  return html
+  return html + tag
 }
 
 /**
  * Transform HTML by adding SRI integrity attributes
  */
 async function transformHTML(
-  bundle, 
-  htmlPath, 
-  html, 
-  options, 
-  config, 
+  bundle,
+  htmlPath,
+  html,
+  options,
+  config,
   cacheManager,
   logger
 ) {
@@ -459,11 +680,11 @@ async function transformHTML(
   }
 
   const changes = await collectIntegrityChanges(
-    html, 
-    bundle, 
-    htmlPath, 
-    options, 
-    config, 
+    html,
+    bundle,
+    htmlPath,
+    options,
+    config,
     cacheManager,
     logger
   );
@@ -476,9 +697,9 @@ async function transformHTML(
  */
 function createTransformer(options, config, cacheManager, logger) {
   return {
-    transformHTML: (bundle, htmlPath, html) => 
+    transformHTML: (bundle, htmlPath, html) =>
       transformHTML(bundle, htmlPath, html, options, config, cacheManager, logger),
-    calculateIntegrity: (bundle, htmlPath, url) => 
+    calculateIntegrity: (bundle, htmlPath, url) =>
       calculateIntegrity(bundle, htmlPath, url, options, config, cacheManager, logger)
   }
 }
@@ -499,7 +720,9 @@ class Logger {
       info: 3,
       debug: 4
     };
-    this.currentLevel = this.levels[logLevel] || this.levels.warn;
+    // `??`, not `||` - levels.silent is 0, which `||` treats as absent and
+    // silently downgrades to 'warn', the one level that must suppress output.
+    this.currentLevel = this.levels[logLevel] ?? this.levels.warn;
   }
 
   /**
@@ -557,101 +780,226 @@ class Logger {
   }
 }
 
-// Constants definition
-// Vite 6/7 uses `vite:build-import-analysis`; Vite 8 Rolldown native path
-// adds `native:import-analysis-build`. We patch whichever (or both) is present.
+// Vite 6/7 uses `vite:build-import-analysis`; Vite 8 Rolldown native path adds
+// `native:import-analysis-build`.
+//
+// Why we care where these sit: they substitute `__VITE_PRELOAD__` in entry
+// chunks inside their own generateBundle, and Vite places them immediately
+// AFTER `enforce: 'post'` user plugins. Measured on Vite 8.2.2, a post plugin
+// is at index 25 and the analysis plugin at 26 - so by default we would hash
+// an entry chunk still containing `import("./x.js"),__VITE_PRELOAD__)` while
+// the written file contains `import("./x.js"),[])`.
+//
+// The fix is to move THIS plugin one place later, not to rewrite someone
+// else's hook. `config.plugins` is a plain, unfrozen array at configResolved
+// time and Rollup reads it afterwards, so repositioning takes effect.
+// `test/sri.test.js > injects integrity matching the actual emitted bytes` is
+// the pin, and the writeBundle drift check is the second net.
 const VITE_INTERNAL_ANALYSIS_PLUGINS = [
   'vite:build-import-analysis',
   'native:import-analysis-build'
 ];
 const DEFAULT_HASH_ALGORITHM = 'sha384';
+const CROSSORIGIN_VALUES = ['anonymous', 'use-credentials'];
 const DEFAULT_PLUGIN_NAME = 'vite-plugin-sri4';
+const MANIFEST_FILE_NAME = 'sri-manifest.json';
+const HTML_RE = /\.html?$/;
+const JS_MODULE_RE = /\.m?js$/;
+
+function toText(source) {
+  return typeof source === 'string' ? source : Buffer.from(source).toString('utf8')
+}
+
+function withTrailingSlash(base) {
+  if (!base) return '/'
+  return base.endsWith('/') ? base : `${base}/`
+}
+
+/**
+ * Hash every non-HTML output, keyed by bundle file name.
+ */
+function hashBundle(bundle, hashAlgorithm) {
+  const hashes = {};
+  for (const [fileName, item] of Object.entries(bundle)) {
+    if (HTML_RE.test(fileName)) continue
+    const source = bundleSource(item);
+    if (source) hashes[fileName] = sriHash(source, hashAlgorithm);
+  }
+  return hashes
+}
+
+/**
+ * Reject configuration that would build cleanly and then fail in the browser.
+ */
+function validateOptions(hashAlgorithm, crossorigin) {
+  if (!SUPPORTED_HASH_ALGORITHMS.includes(hashAlgorithm)) {
+    throw new Error(
+      `[${DEFAULT_PLUGIN_NAME}] unsupported hashAlgorithm "${hashAlgorithm}". ` +
+      `The SRI spec defines ${SUPPORTED_HASH_ALGORITHMS.join(', ')}; browsers reject ` +
+      `anything else, so the build would succeed and the resource would be blocked.`
+    )
+  }
+
+  if (!CROSSORIGIN_VALUES.includes(crossorigin)) {
+    throw new Error(
+      `[${DEFAULT_PLUGIN_NAME}] crossorigin must be one of ${CROSSORIGIN_VALUES.join(', ')}, ` +
+      `got "${crossorigin}"`
+    )
+  }
+}
 
 function sri(options = {}) {
   const {
     ignoreMissingAsset = false,
     bypassDomains = [],
     hashAlgorithm = DEFAULT_HASH_ALGORITHM,
-    logLevel = 'warn'
+    crossorigin = 'anonymous',
+    logLevel = 'warn',
+    manifest = false,
+    importmap = false
   } = options;
 
+  validateOptions(hashAlgorithm, crossorigin);
+
   // Create cache manager and logger instances for this plugin instance
   const cacheManager = new CacheManager();
   const logger = new Logger(logLevel, DEFAULT_PLUGIN_NAME);
 
+  // bundle fileName -> the integrity we injected, re-checked in writeBundle
+  const hashedAssets = new Map();
+
+  let config;
+  let transformer;
+
   return {
     name: DEFAULT_PLUGIN_NAME,
     enforce: 'post',
     apply: 'build',
 
-    // Cleanup work
-    buildEnd() {
-      // Clear caches
+    // Every generateBundle hook has run by now. A plugin that rewrites chunk
+    // contents after ours (plugin-legacy, in-place compression) would leave the
+    // injected hashes describing bytes that no longer ship - a green build that
+    // only fails in the browser. Fail here instead.
+    writeBundle(_, bundle) {
+      const drifted = [];
+      for (const [fileName, integrity] of hashedAssets) {
+        const item = bundle[fileName];
+        if (!item) continue
+        const source = bundleSource(item);
+        if (source && sriHash(source, hashAlgorithm) !== integrity) {
+          drifted.push(fileName);
+        }
+      }
+      hashedAssets.clear();
+
+      if (drifted.length > 0) {
+        throw new Error(
+          `[${DEFAULT_PLUGIN_NAME}] content changed after integrity was computed: ` +
+          `${drifted.join(', ')}. A plugin running after this one rewrote these ` +
+          `files, so the injected hashes no longer match what ships. Move that ` +
+          `plugin before ${DEFAULT_PLUGIN_NAME}, or drop it.`
+        )
+      }
+    },
+
+    // Cleanup. Note this must not be `buildEnd`, which Rollup runs before the
+    // output phase - clearing there would empty the caches before use.
+    closeBundle() {
       cacheManager.clearAll();
+      hashedAssets.clear();
     },
 
-    configResolved(config) {
-      const transformer = createTransformer({
+    configResolved(resolvedConfig) {
+      config = resolvedConfig;
+      transformer = createTransformer({
         ignoreMissingAsset,
         bypassDomains,
-        hashAlgorithm
+        hashAlgorithm,
+        crossorigin,
+        hashedAssets
       }, config, cacheManager, logger);
 
-      const generateBundle = async function(_, bundle) {
-        const htmlFiles = Object.entries(bundle).filter(
-          ([, chunk]) =>
-            chunk.type === 'asset' &&
-            /\.html?$/.test(chunk.fileName)
-        );
-
-        if (htmlFiles.length === 0) {
-          logger.debug('No HTML files found in bundle');
-          return
-        }
+      const plugins = config.plugins;
 
-        // Process all HTML files in parallel
-        await Promise.all(
-          htmlFiles.map(async ([name, chunk]) => {
-            try {
-              const originalContent = chunk.source.toString();
-              chunk.source = await transformer.transformHTML(bundle, name, originalContent);
-
-              if (originalContent !== chunk.source) {
-                logger.debug(`SRI attributes added to ${name}`);
-              }
-            } catch (error) {
-              logger.warn(`Error processing ${name}:`, error);
-              // Keep original content on error
-            }
-          })
-        );
-      };
+      // The last one wins: if both names are present we must follow both
+      let target = -1;
+      for (let i = 0; i < plugins.length; i++) {
+        if (plugins[i] && VITE_INTERNAL_ANALYSIS_PLUGINS.includes(plugins[i].name)) target = i;
+      }
 
-      const targets = config.plugins.filter(
-        p => p && VITE_INTERNAL_ANALYSIS_PLUGINS.includes(p.name)
-      );
-      if (targets.length === 0) {
+      if (target === -1) {
         throw new Error(
-          `[${DEFAULT_PLUGIN_NAME}] could not find a Vite import-analysis plugin to hook into ` +
+          `[${DEFAULT_PLUGIN_NAME}] could not find a Vite import-analysis plugin to run after ` +
           `(looked for: ${VITE_INTERNAL_ANALYSIS_PLUGINS.join(', ')}). ` +
           `Requires Vite 6.0.0 or higher.`
         )
       }
 
-      for (const plugin of targets) {
-        if (typeof plugin.generateBundle === 'object' && plugin.generateBundle.handler) {
-          const originalHandler = plugin.generateBundle.handler;
-          plugin.generateBundle.handler = async function(...args) {
-            await originalHandler.apply(this, args);
-            await generateBundle.apply(this, args);
-          };
-        } else if (typeof plugin.generateBundle === 'function') {
-          const originalHandler = plugin.generateBundle;
-          plugin.generateBundle = async function(...args) {
-            await originalHandler.apply(this, args);
-            await generateBundle.apply(this, args);
-          };
-        }
+      const self = plugins.findIndex(p => p && p.name === DEFAULT_PLUGIN_NAME);
+      if (self === -1) {
+        // Only reachable when the plugin was not registered through Vite, as
+        // in a unit test driving the hook directly. Hashes may then be taken a
+        // step early, which the writeBundle drift check catches.
+        logger.debug('Plugin not present in config.plugins; leaving hook order alone');
+        return
+      }
+
+      if (target > self) {
+        // Removing ourselves shifts target down one, so inserting at `target`
+        // lands immediately after it.
+        const [me] = plugins.splice(self, 1);
+        plugins.splice(target, 0, me);
+        logger.debug(`Repositioned after ${plugins[target - 1].name}`);
+      }
+    },
+
+    async generateBundle(_, bundle) {
+      // Computed before emitting anything so the manifest never hashes itself
+      const hashes = manifest || importmap ? hashBundle(bundle, hashAlgorithm) : null;
+
+      const htmlFiles = Object.entries(bundle).filter(
+        ([, chunk]) =>
+          chunk.type === 'asset' &&
+          HTML_RE.test(chunk.fileName)
+      );
+
+      if (htmlFiles.length === 0) {
+        // Normal for SSR / library builds, which render HTML at request time
+        // - the manifest below is how those builds get their hashes.
+        logger.debug('No HTML files found in bundle');
+      }
+
+      // Errors are intentionally not caught: a resource that cannot be
+      // hashed must fail the build rather than ship without integrity.
+      await Promise.all(
+        htmlFiles.map(async ([name, chunk]) => {
+          const originalContent = toText(chunk.source);
+          let html = await transformer.transformHTML(bundle, name, originalContent);
+
+          if (importmap) {
+            const moduleIntegrity = {};
+            const base = withTrailingSlash(config.base);
+            for (const [fileName, integrity] of Object.entries(hashes)) {
+              if (JS_MODULE_RE.test(fileName)) moduleIntegrity[base + fileName] = integrity;
+            }
+            html = injectImportmapIntegrity(html, moduleIntegrity, logger);
+          }
+
+          chunk.source = html;
+
+          if (originalContent !== chunk.source) {
+            logger.debug(`SRI attributes added to ${name}`);
+          }
+        })
+      );
+
+      if (manifest) {
+        this.emitFile({
+          type: 'asset',
+          fileName: MANIFEST_FILE_NAME,
+          source: JSON.stringify(hashes, null, 2)
+        });
+        logger.debug(`Emitted ${MANIFEST_FILE_NAME} with ${Object.keys(hashes).length} entries`);
       }
     }
   }