vite-plugin-sri4 4.1.0 → 4.2.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2025-2026 Zac
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -14,6 +14,7 @@ A Vite plugin to generate Subresource Integrity (SRI) hashes for your assets dur
 - [Plugin Options](#plugin-options)
 - [Dynamic Routes](#dynamic-routes)
 - [When SRI Actually Helps](#when-sri-actually-helps)
+- [How It Attaches Hashes](#how-it-attaches-hashes)
 - [Example Project](#example-project)
 - [Best Practices](#best-practices)
 - [Troubleshooting](#troubleshooting)
@@ -26,7 +27,9 @@ A Vite plugin to generate Subresource Integrity (SRI) hashes for your assets dur
 - **Automatic SRI Generation:** Computes SRI hashes for assets (chunks and files) using a configurable algorithm (default is `sha384`).
 - **HTML Injection:** Automatically injects `integrity` and `crossorigin` attributes into `<script>` and `<link>` tags in your HTML.
 - **CORS Support Check:** For external resources, a CORS check is performed to verify access via `Access-Control-Allow-Origin`.
-- **Bypass Domains:** Option to specify domains to bypass SRI injection.
+- **Bypass Domains:** Option to specify domains to bypass SRI injection, plus a `skip-sri` attribute to opt out a single tag.
+- **Public Directory Support:** Assets served verbatim from `publicDir` are hashed from disk, not just bundle outputs.
+- **Zero Dependencies:** No runtime dependencies, and TypeScript definitions are included.
 - **Missing Asset Handling:** Configurable warning suppression for missing assets.
 - **Robust Content Support:** Handles various content types including strings, Buffer, and Uint8Array.
 - **Dynamic Routes:** Optional import map integrity and an SRI manifest cover `import()`-loaded chunks and SSR builds, which have no build-time HTML tag to rewrite.
@@ -50,8 +53,10 @@ import sri from 'vite-plugin-sri4';
 export default defineConfig({
   plugins: [
     sri({
-      // Optional. The security hash algorithm. Defaults to "sha384".
+      // Optional. 'sha256' | 'sha384' | 'sha512'. Defaults to 'sha384'.
       hashAlgorithm: 'sha384',
+      // Optional. 'anonymous' | 'use-credentials'. Defaults to 'anonymous'.
+      crossorigin: 'anonymous',
       // Optional. Domains to bypass SRI injection.
       bypassDomains: ['example.com'],
       // Optional. Suppress warnings for missing assets.
@@ -85,11 +90,13 @@ Output:
 ## Plugin Options
 
 * `hashAlgorithm` (string):
-  The hash algorithm used for computing SRI. Default is `sha384`. You may change it to other supported algorithms like `sha256` or `sha512`.
+  The hash algorithm used for computing SRI. One of `sha256`, `sha384` (default) or `sha512` — the only three the SRI spec defines. Anything else fails at startup rather than producing an attribute browsers silently reject.
+* `crossorigin` (string):
+  Value for the injected `crossorigin` attribute: `anonymous` (default) or `use-credentials`. Use the latter for a CDN that requires cookies or HTTP auth. Tags that already declare a `crossorigin` are left alone.
 * `bypassDomains` (Array<string>):
   Array of domain names where SRI injection should be skipped. This allows external resources from specified domains to be excluded from SRI checks (for example, when they may not support CORS).
 * `ignoreMissingAsset` (boolean):
-  When true, suppresses warnings for assets that are not found in the bundle. Default is `false`.
+  When true, warns instead of failing the build for assets found in neither the bundle nor `publicDir`. Default is `false`, which fails the build rather than shipping a tag with no integrity.
 * `logLevel` (string):
   Log verbosity. One of `silent`, `error`, `warn`, `info`, `debug`. Default is `warn`. Use `debug` to see per-resource decisions during the build.
 * `importmap` (boolean):
@@ -134,6 +141,40 @@ SRI is worth the most when your HTML and your assets have **different trust boun
 
 If everything is served from a single origin, SRI buys much less than it appears to: an attacker who can rewrite `/assets/index-abc123.js` on your server can usually rewrite the `index.html` carrying its hash just as easily. It is not useless - it narrows some deploy and cache-layer mistakes - but for same-origin builds, a Content Security Policy and Vite's default hashed, immutable filenames do more for you than SRI does. Enable it because it is cheap, not because it closes the hole you think it closes.
 
+### Skipping a Single Tag
+
+`bypassDomains` only reaches external hosts. To exclude one specific element, add `skip-sri` to it. The attribute is stripped from the output:
+
+```html
+<script skip-sri src="/legacy.js"></script>
+```
+
+```html
+<!-- built output -->
+<script src="/legacy.js"></script>
+```
+
+## How It Attaches Hashes
+
+There are three places a Vite plugin can compute SRI hashes, and they are not equivalent. This one matters more than it looks, so it is worth writing down.
+
+**In `transformIndexHtml`.** The obvious choice, and the one that reads best — you get the finished HTML and the bundle on the context. It produces wrong hashes for entry chunks. Vite's import-analysis plugin substitutes `__VITE_PRELOAD__` inside its own `generateBundle`, which runs *after* `transformIndexHtml`, so an entry chunk still reads `import("./route.js"), __VITE_PRELOAD__)` at that point while the written file reads `import("./route.js"), [])`. The hash describes bytes that never ship, and the browser rejects the file with no build error at all.
+
+**In a plain `enforce: 'post'` `generateBundle`.** Same problem. Vite places its import-analysis plugin immediately after post user plugins, so a post hook is still one step too early.
+
+**Where this plugin does it.** During `configResolved` it moves itself after that plugin in `config.plugins`, then works in an ordinary `generateBundle`. Measured on Vite 8.2.2, hashing the entry chunk:
+
+| Hook | Entry chunk | Matches shipped file |
+|---|---|---|
+| `transformIndexHtml` (post) | `io6MKsmc4G5y` | ✗ |
+| `generateBundle` (post) | `io6MKsmc4G5y` | ✗ |
+| after repositioning | `lvFyraHkqPN0` | ✓ |
+| written file | `lvFyraHkqPN0` | — |
+
+Only the entry chunk is affected, so a build without a dynamic import will not reveal the difference. As a second safeguard, every hashed file is re-hashed in `writeBundle` and the build fails if anything changed after the hash was taken.
+
+This ordering constraint was first identified by [vite-plugin-sri3](https://github.com/yoyo930021/vite-plugin-sri3), which this plugin began as a fork of. Beyond it, this plugin adds `crossorigin` injection, a CORS pre-check with timeouts and retries for external resources, import map and manifest output for dynamically imported routes, `publicDir` resolution, and the drift check above.
+
 ## Example Project
 
 The plugin includes an example project in the `example` directory that demonstrates its usage with a simple Vite application. To try it:

package/dist/index.cjs

@@ -3,8 +3,8 @@
 Object.defineProperty(exports, '__esModule', { value: true });
 
 var node_crypto = require('node:crypto');
+var promises = require('node:fs/promises');
 var path = require('node:path');
-var fetch = require('cross-fetch');
 
 /**
  * Extended caching mechanism with expiration time
@@ -67,6 +67,8 @@ class CacheManager {
   }
 }
 
+// Global fetch, stable since Node 18 - the floor the Vite 6.4 peer range
+// already implies. No dependency needed.
 const DEFAULT_TIMEOUT = 5000;
 
 /**
@@ -202,6 +204,10 @@ function bundleSource(item) {
   return item.type === 'chunk' ? item.code : item.source
 }
 
+// The only algorithms the SRI spec defines. Browsers reject anything else,
+// which blocks the resource with no build-time error at all.
+const SUPPORTED_HASH_ALGORITHMS = ['sha256', 'sha384', 'sha512'];
+
 /**
  * Compute an SRI string for a source that may be a string, Buffer or Uint8Array
  */
@@ -276,6 +282,48 @@ function findBundleKey(bundle, bundleKey, logger = null) {
   return candidates[0]
 }
 
+/**
+ * Read an asset that lives in `publicDir` rather than the bundle.
+ *
+ * Files copied verbatim from `public/` never appear as bundle entries, so
+ * without this a perfectly normal `<script src="/sw.js">` fails the build.
+ * Returns null rather than throwing so the caller keeps its own missing-asset
+ * policy.
+ */
+async function readPublicAsset(config, bundleKey, logger) {
+  const publicDir = config.publicDir;
+  if (!publicDir) return null
+
+  // Bundle keys come from URLs, which may be percent-encoded
+  let decoded;
+  try {
+    decoded = decodeURIComponent(bundleKey);
+  } catch {
+    decoded = bundleKey;
+  }
+
+  const filePath = path.resolve(publicDir, decoded);
+
+  // A URL must never reach outside publicDir, however it is spelled
+  const relative = path.relative(publicDir, filePath);
+  if (relative.startsWith('..') || path.isAbsolute(relative)) {
+    if (logger) {
+      logger.warn(`Refusing to read outside publicDir: ${bundleKey}`);
+    }
+    return null
+  }
+
+  try {
+    const source = await promises.readFile(filePath);
+    if (logger) {
+      logger.debug(`Resolved from publicDir: ${bundleKey}`);
+    }
+    return source
+  } catch {
+    return null
+  }
+}
+
 /**
  * Calculate SRI integrity hash for a given resource
  */
@@ -337,13 +385,23 @@ async function calculateIntegrity(
         }
         bundleFileName = possibleMatch;
         source = bundleSource(bundle[possibleMatch]);
-      } else if (ignoreMissingAsset) {
-        if (logger) {
-          logger.warn(`Asset not found in bundle: ${url} (path: ${htmlPath}, key: ${bundleKey})`);
-        }
-        return null
       } else {
-        throw new Error(`Asset ${url} not found in bundle (path: ${htmlPath}, key: ${bundleKey})`)
+        // Not a build output - it may still be a file copied from publicDir
+        source = await readPublicAsset(config, bundleKey, logger);
+
+        if (!source) {
+          if (ignoreMissingAsset) {
+            if (logger) {
+              logger.warn(
+                `Asset not found in bundle or publicDir: ${url} (path: ${htmlPath}, key: ${bundleKey})`
+              );
+            }
+            return null
+          }
+          throw new Error(
+            `Asset ${url} not found in bundle or publicDir (path: ${htmlPath}, key: ${bundleKey})`
+          )
+        }
       }
     } else {
       bundleFileName = bundleKey;
@@ -431,7 +489,15 @@ function insertOffset(tag, endOffset) {
 }
 
 /**
- * Process a single match to create an integrity change object
+ * Per-tag opt out. `<script skip-sri src="...">` is left alone, and the marker
+ * attribute is stripped so it does not ship to the browser. More granular than
+ * bypassDomains, which only reaches external hosts.
+ */
+const SKIP_SRI_ATTR_RE = /\s+skip-sri(?:\s*=\s*(?:"[^"]*"|'[^']*'|[^\s>/]+))?/i;
+
+/**
+ * Process a single match into a text edit: { start, end, content }. An
+ * insertion has start === end; a removal has empty content.
  */
 async function processMatch(
   match,
@@ -444,6 +510,20 @@ async function processMatch(
   logger
 ) {
   const tag = match[0];
+
+  const skip = SKIP_SRI_ATTR_RE.exec(tag);
+  if (skip) {
+    return {
+      start: match.index + skip.index,
+      end: match.index + skip.index + skip[0].length,
+      content: '',
+      url: pattern.getUrl(tag),
+      skipped: true
+    }
+  }
+
+  // Nothing to do for a tag that already carries its own hash, and computing
+  // one anyway would register it for the writeBundle drift check
   if (INTEGRITY_ATTR_RE.test(tag)) return null
 
   const url = pattern.getUrl(tag);
@@ -459,15 +539,15 @@ async function processMatch(
     logger
   );
 
-  if (integrity) {
-    return {
-      integrity,
-      position: match.index + insertOffset(tag, pattern.endOffset),
-      tag,
-      url // For logging
-    }
+  if (!integrity) return null
+
+  let content = ` integrity="${integrity}"`;
+  if (!CROSSORIGIN_ATTR_RE.test(tag)) {
+    content += ` crossorigin="${options.crossorigin}"`;
   }
-  return null
+
+  const at = match.index + insertOffset(tag, pattern.endOffset);
+  return { start: at, end: at, content, url }
 }
 
 /**
@@ -538,16 +618,12 @@ async function collectIntegrityChanges(
  * Apply integrity changes to HTML content
  */
 function applyIntegrityChanges(html, changes, logger) {
-  // Sort by position in descending order to insert from back to front
-  changes.sort((a, b) => b.position - a.position);
+  // Back to front, so earlier offsets stay valid as the string is edited
+  changes.sort((a, b) => b.start - a.start);
 
-  for (const { integrity, position, tag, url } of changes) {
-    let insertText = ` integrity="${integrity}"`;
-    if (!CROSSORIGIN_ATTR_RE.test(tag)) {
-      insertText += ' crossorigin="anonymous"';
-    }
-    html = html.slice(0, position) + insertText + html.slice(position);
-    logger.debug(`Added integrity for: ${url}`);
+  for (const { start, end, content, url, skipped } of changes) {
+    html = html.slice(0, start) + content + html.slice(end);
+    logger.debug(skipped ? `Skipped (skip-sri): ${url}` : `Added integrity for: ${url}`);
   }
 
   return html
@@ -704,23 +780,27 @@ class Logger {
   }
 }
 
-// Vite 6/7 uses `vite:build-import-analysis`; Vite 8 Rolldown native path
-// adds `native:import-analysis-build`. We patch whichever (or both) is present.
+// Vite 6/7 uses `vite:build-import-analysis`; Vite 8 Rolldown native path adds
+// `native:import-analysis-build`.
+//
+// Why we care where these sit: they substitute `__VITE_PRELOAD__` in entry
+// chunks inside their own generateBundle, and Vite places them immediately
+// AFTER `enforce: 'post'` user plugins. Measured on Vite 8.2.2, a post plugin
+// is at index 25 and the analysis plugin at 26 - so by default we would hash
+// an entry chunk still containing `import("./x.js"),__VITE_PRELOAD__)` while
+// the written file contains `import("./x.js"),[])`.
 //
-// Why patch at all, rather than use `transformIndexHtml` (order: 'post') or our
-// own `enforce: 'post'` generateBundle? Both of those run BEFORE this plugin
-// substitutes `__VITE_PRELOAD__` in entry chunks, so any hash taken there
-// describes bytes that never ship. Measured on Vite 8.2.2: at both of those
-// points the entry chunk still ends `import("./about-*.js"),__VITE_PRELOAD__)`,
-// while the written file ends `import("./about-*.js"),[])`. Wrapping this
-// plugin's own handler is the only hook position after that substitution.
-// `test/sri.test.js > injects integrity matching the actual emitted bytes`
-// fails if this is ever "simplified" away.
+// The fix is to move THIS plugin one place later, not to rewrite someone
+// else's hook. `config.plugins` is a plain, unfrozen array at configResolved
+// time and Rollup reads it afterwards, so repositioning takes effect.
+// `test/sri.test.js > injects integrity matching the actual emitted bytes` is
+// the pin, and the writeBundle drift check is the second net.
 const VITE_INTERNAL_ANALYSIS_PLUGINS = [
   'vite:build-import-analysis',
   'native:import-analysis-build'
 ];
 const DEFAULT_HASH_ALGORITHM = 'sha384';
+const CROSSORIGIN_VALUES = ['anonymous', 'use-credentials'];
 const DEFAULT_PLUGIN_NAME = 'vite-plugin-sri4';
 const MANIFEST_FILE_NAME = 'sri-manifest.json';
 const HTML_RE = /\.html?$/;
@@ -748,16 +828,39 @@ function hashBundle(bundle, hashAlgorithm) {
   return hashes
 }
 
+/**
+ * Reject configuration that would build cleanly and then fail in the browser.
+ */
+function validateOptions(hashAlgorithm, crossorigin) {
+  if (!SUPPORTED_HASH_ALGORITHMS.includes(hashAlgorithm)) {
+    throw new Error(
+      `[${DEFAULT_PLUGIN_NAME}] unsupported hashAlgorithm "${hashAlgorithm}". ` +
+      `The SRI spec defines ${SUPPORTED_HASH_ALGORITHMS.join(', ')}; browsers reject ` +
+      `anything else, so the build would succeed and the resource would be blocked.`
+    )
+  }
+
+  if (!CROSSORIGIN_VALUES.includes(crossorigin)) {
+    throw new Error(
+      `[${DEFAULT_PLUGIN_NAME}] crossorigin must be one of ${CROSSORIGIN_VALUES.join(', ')}, ` +
+      `got "${crossorigin}"`
+    )
+  }
+}
+
 function sri(options = {}) {
   const {
     ignoreMissingAsset = false,
     bypassDomains = [],
     hashAlgorithm = DEFAULT_HASH_ALGORITHM,
+    crossorigin = 'anonymous',
     logLevel = 'warn',
     manifest = false,
     importmap = false
   } = options;
 
+  validateOptions(hashAlgorithm, crossorigin);
+
   // Create cache manager and logger instances for this plugin instance
   const cacheManager = new CacheManager();
   const logger = new Logger(logLevel, DEFAULT_PLUGIN_NAME);
@@ -765,6 +868,9 @@ function sri(options = {}) {
   // bundle fileName -> the integrity we injected, re-checked in writeBundle
   const hashedAssets = new Map();
 
+  let config;
+  let transformer;
+
   return {
     name: DEFAULT_PLUGIN_NAME,
     enforce: 'post',
@@ -803,99 +909,97 @@ function sri(options = {}) {
       hashedAssets.clear();
     },
 
-    configResolved(config) {
-      const transformer = createTransformer({
+    configResolved(resolvedConfig) {
+      config = resolvedConfig;
+      transformer = createTransformer({
         ignoreMissingAsset,
         bypassDomains,
         hashAlgorithm,
+        crossorigin,
         hashedAssets
       }, config, cacheManager, logger);
 
-      // Both analysis plugin names can be present at once, and each is wrapped.
-      // Without this guard the body runs twice per bundle: `emitFile` throws on
-      // the duplicate manifest fileName, and the import map warns about the one
-      // it just injected. If the skipped pass was the one that finalised chunk
-      // contents, the writeBundle drift check fails the build loudly.
-      const handled = new WeakSet();
+      const plugins = config.plugins;
 
-      const generateBundle = async function(_, bundle) {
-        if (handled.has(bundle)) return
-        handled.add(bundle);
+      // The last one wins: if both names are present we must follow both
+      let target = -1;
+      for (let i = 0; i < plugins.length; i++) {
+        if (plugins[i] && VITE_INTERNAL_ANALYSIS_PLUGINS.includes(plugins[i].name)) target = i;
+      }
 
-        // Computed before emitting anything so the manifest never hashes itself
-        const hashes = manifest || importmap ? hashBundle(bundle, hashAlgorithm) : null;
+      if (target === -1) {
+        throw new Error(
+          `[${DEFAULT_PLUGIN_NAME}] could not find a Vite import-analysis plugin to run after ` +
+          `(looked for: ${VITE_INTERNAL_ANALYSIS_PLUGINS.join(', ')}). ` +
+          `Requires Vite 6.0.0 or higher.`
+        )
+      }
 
-        const htmlFiles = Object.entries(bundle).filter(
-          ([, chunk]) =>
-            chunk.type === 'asset' &&
-            HTML_RE.test(chunk.fileName)
-        );
+      const self = plugins.findIndex(p => p && p.name === DEFAULT_PLUGIN_NAME);
+      if (self === -1) {
+        // Only reachable when the plugin was not registered through Vite, as
+        // in a unit test driving the hook directly. Hashes may then be taken a
+        // step early, which the writeBundle drift check catches.
+        logger.debug('Plugin not present in config.plugins; leaving hook order alone');
+        return
+      }
 
-        if (htmlFiles.length === 0) {
-          // Normal for SSR / library builds, which render HTML at request time
-          // - the manifest below is how those builds get their hashes.
-          logger.debug('No HTML files found in bundle');
-        }
+      if (target > self) {
+        // Removing ourselves shifts target down one, so inserting at `target`
+        // lands immediately after it.
+        const [me] = plugins.splice(self, 1);
+        plugins.splice(target, 0, me);
+        logger.debug(`Repositioned after ${plugins[target - 1].name}`);
+      }
+    },
 
-        // Errors are intentionally not caught: a resource that cannot be
-        // hashed must fail the build rather than ship without integrity.
-        await Promise.all(
-          htmlFiles.map(async ([name, chunk]) => {
-            const originalContent = toText(chunk.source);
-            let html = await transformer.transformHTML(bundle, name, originalContent);
-
-            if (importmap) {
-              const moduleIntegrity = {};
-              const base = withTrailingSlash(config.base);
-              for (const [fileName, integrity] of Object.entries(hashes)) {
-                if (JS_MODULE_RE.test(fileName)) moduleIntegrity[base + fileName] = integrity;
-              }
-              html = injectImportmapIntegrity(html, moduleIntegrity, logger);
-            }
+    async generateBundle(_, bundle) {
+      // Computed before emitting anything so the manifest never hashes itself
+      const hashes = manifest || importmap ? hashBundle(bundle, hashAlgorithm) : null;
+
+      const htmlFiles = Object.entries(bundle).filter(
+        ([, chunk]) =>
+          chunk.type === 'asset' &&
+          HTML_RE.test(chunk.fileName)
+      );
 
-            chunk.source = html;
+      if (htmlFiles.length === 0) {
+        // Normal for SSR / library builds, which render HTML at request time
+        // - the manifest below is how those builds get their hashes.
+        logger.debug('No HTML files found in bundle');
+      }
 
-            if (originalContent !== chunk.source) {
-              logger.debug(`SRI attributes added to ${name}`);
+      // Errors are intentionally not caught: a resource that cannot be
+      // hashed must fail the build rather than ship without integrity.
+      await Promise.all(
+        htmlFiles.map(async ([name, chunk]) => {
+          const originalContent = toText(chunk.source);
+          let html = await transformer.transformHTML(bundle, name, originalContent);
+
+          if (importmap) {
+            const moduleIntegrity = {};
+            const base = withTrailingSlash(config.base);
+            for (const [fileName, integrity] of Object.entries(hashes)) {
+              if (JS_MODULE_RE.test(fileName)) moduleIntegrity[base + fileName] = integrity;
             }
-          })
-        );
+            html = injectImportmapIntegrity(html, moduleIntegrity, logger);
+          }
 
-        if (manifest) {
-          this.emitFile({
-            type: 'asset',
-            fileName: MANIFEST_FILE_NAME,
-            source: JSON.stringify(hashes, null, 2)
-          });
-          logger.debug(`Emitted ${MANIFEST_FILE_NAME} with ${Object.keys(hashes).length} entries`);
-        }
-      };
+          chunk.source = html;
 
-      const targets = config.plugins.filter(
-        p => p && VITE_INTERNAL_ANALYSIS_PLUGINS.includes(p.name)
+          if (originalContent !== chunk.source) {
+            logger.debug(`SRI attributes added to ${name}`);
+          }
+        })
       );
-      if (targets.length === 0) {
-        throw new Error(
-          `[${DEFAULT_PLUGIN_NAME}] could not find a Vite import-analysis plugin to hook into ` +
-          `(looked for: ${VITE_INTERNAL_ANALYSIS_PLUGINS.join(', ')}). ` +
-          `Requires Vite 6.0.0 or higher.`
-        )
-      }
 
-      for (const plugin of targets) {
-        if (typeof plugin.generateBundle === 'object' && plugin.generateBundle.handler) {
-          const originalHandler = plugin.generateBundle.handler;
-          plugin.generateBundle.handler = async function(...args) {
-            await originalHandler.apply(this, args);
-            await generateBundle.apply(this, args);
-          };
-        } else if (typeof plugin.generateBundle === 'function') {
-          const originalHandler = plugin.generateBundle;
-          plugin.generateBundle = async function(...args) {
-            await originalHandler.apply(this, args);
-            await generateBundle.apply(this, args);
-          };
-        }
+      if (manifest) {
+        this.emitFile({
+          type: 'asset',
+          fileName: MANIFEST_FILE_NAME,
+          source: JSON.stringify(hashes, null, 2)
+        });
+        logger.debug(`Emitted ${MANIFEST_FILE_NAME} with ${Object.keys(hashes).length} entries`);
       }
     }
   }

package/dist/index.js

@@ -1,6 +1,6 @@
 import { createHash } from 'node:crypto';
+import { readFile } from 'node:fs/promises';
 import path from 'node:path';
-import fetch from 'cross-fetch';
 
 /**
  * Extended caching mechanism with expiration time
@@ -63,6 +63,8 @@ class CacheManager {
   }
 }
 
+// Global fetch, stable since Node 18 - the floor the Vite 6.4 peer range
+// already implies. No dependency needed.
 const DEFAULT_TIMEOUT = 5000;
 
 /**
@@ -198,6 +200,10 @@ function bundleSource(item) {
   return item.type === 'chunk' ? item.code : item.source
 }
 
+// The only algorithms the SRI spec defines. Browsers reject anything else,
+// which blocks the resource with no build-time error at all.
+const SUPPORTED_HASH_ALGORITHMS = ['sha256', 'sha384', 'sha512'];
+
 /**
  * Compute an SRI string for a source that may be a string, Buffer or Uint8Array
  */
@@ -272,6 +278,48 @@ function findBundleKey(bundle, bundleKey, logger = null) {
   return candidates[0]
 }
 
+/**
+ * Read an asset that lives in `publicDir` rather than the bundle.
+ *
+ * Files copied verbatim from `public/` never appear as bundle entries, so
+ * without this a perfectly normal `<script src="/sw.js">` fails the build.
+ * Returns null rather than throwing so the caller keeps its own missing-asset
+ * policy.
+ */
+async function readPublicAsset(config, bundleKey, logger) {
+  const publicDir = config.publicDir;
+  if (!publicDir) return null
+
+  // Bundle keys come from URLs, which may be percent-encoded
+  let decoded;
+  try {
+    decoded = decodeURIComponent(bundleKey);
+  } catch {
+    decoded = bundleKey;
+  }
+
+  const filePath = path.resolve(publicDir, decoded);
+
+  // A URL must never reach outside publicDir, however it is spelled
+  const relative = path.relative(publicDir, filePath);
+  if (relative.startsWith('..') || path.isAbsolute(relative)) {
+    if (logger) {
+      logger.warn(`Refusing to read outside publicDir: ${bundleKey}`);
+    }
+    return null
+  }
+
+  try {
+    const source = await readFile(filePath);
+    if (logger) {
+      logger.debug(`Resolved from publicDir: ${bundleKey}`);
+    }
+    return source
+  } catch {
+    return null
+  }
+}
+
 /**
  * Calculate SRI integrity hash for a given resource
  */
@@ -333,13 +381,23 @@ async function calculateIntegrity(
         }
         bundleFileName = possibleMatch;
         source = bundleSource(bundle[possibleMatch]);
-      } else if (ignoreMissingAsset) {
-        if (logger) {
-          logger.warn(`Asset not found in bundle: ${url} (path: ${htmlPath}, key: ${bundleKey})`);
-        }
-        return null
       } else {
-        throw new Error(`Asset ${url} not found in bundle (path: ${htmlPath}, key: ${bundleKey})`)
+        // Not a build output - it may still be a file copied from publicDir
+        source = await readPublicAsset(config, bundleKey, logger);
+
+        if (!source) {
+          if (ignoreMissingAsset) {
+            if (logger) {
+              logger.warn(
+                `Asset not found in bundle or publicDir: ${url} (path: ${htmlPath}, key: ${bundleKey})`
+              );
+            }
+            return null
+          }
+          throw new Error(
+            `Asset ${url} not found in bundle or publicDir (path: ${htmlPath}, key: ${bundleKey})`
+          )
+        }
       }
     } else {
       bundleFileName = bundleKey;
@@ -427,7 +485,15 @@ function insertOffset(tag, endOffset) {
 }
 
 /**
- * Process a single match to create an integrity change object
+ * Per-tag opt out. `<script skip-sri src="...">` is left alone, and the marker
+ * attribute is stripped so it does not ship to the browser. More granular than
+ * bypassDomains, which only reaches external hosts.
+ */
+const SKIP_SRI_ATTR_RE = /\s+skip-sri(?:\s*=\s*(?:"[^"]*"|'[^']*'|[^\s>/]+))?/i;
+
+/**
+ * Process a single match into a text edit: { start, end, content }. An
+ * insertion has start === end; a removal has empty content.
  */
 async function processMatch(
   match,
@@ -440,6 +506,20 @@ async function processMatch(
   logger
 ) {
   const tag = match[0];
+
+  const skip = SKIP_SRI_ATTR_RE.exec(tag);
+  if (skip) {
+    return {
+      start: match.index + skip.index,
+      end: match.index + skip.index + skip[0].length,
+      content: '',
+      url: pattern.getUrl(tag),
+      skipped: true
+    }
+  }
+
+  // Nothing to do for a tag that already carries its own hash, and computing
+  // one anyway would register it for the writeBundle drift check
   if (INTEGRITY_ATTR_RE.test(tag)) return null
 
   const url = pattern.getUrl(tag);
@@ -455,15 +535,15 @@ async function processMatch(
     logger
   );
 
-  if (integrity) {
-    return {
-      integrity,
-      position: match.index + insertOffset(tag, pattern.endOffset),
-      tag,
-      url // For logging
-    }
+  if (!integrity) return null
+
+  let content = ` integrity="${integrity}"`;
+  if (!CROSSORIGIN_ATTR_RE.test(tag)) {
+    content += ` crossorigin="${options.crossorigin}"`;
   }
-  return null
+
+  const at = match.index + insertOffset(tag, pattern.endOffset);
+  return { start: at, end: at, content, url }
 }
 
 /**
@@ -534,16 +614,12 @@ async function collectIntegrityChanges(
  * Apply integrity changes to HTML content
  */
 function applyIntegrityChanges(html, changes, logger) {
-  // Sort by position in descending order to insert from back to front
-  changes.sort((a, b) => b.position - a.position);
+  // Back to front, so earlier offsets stay valid as the string is edited
+  changes.sort((a, b) => b.start - a.start);
 
-  for (const { integrity, position, tag, url } of changes) {
-    let insertText = ` integrity="${integrity}"`;
-    if (!CROSSORIGIN_ATTR_RE.test(tag)) {
-      insertText += ' crossorigin="anonymous"';
-    }
-    html = html.slice(0, position) + insertText + html.slice(position);
-    logger.debug(`Added integrity for: ${url}`);
+  for (const { start, end, content, url, skipped } of changes) {
+    html = html.slice(0, start) + content + html.slice(end);
+    logger.debug(skipped ? `Skipped (skip-sri): ${url}` : `Added integrity for: ${url}`);
   }
 
   return html
@@ -700,23 +776,27 @@ class Logger {
   }
 }
 
-// Vite 6/7 uses `vite:build-import-analysis`; Vite 8 Rolldown native path
-// adds `native:import-analysis-build`. We patch whichever (or both) is present.
+// Vite 6/7 uses `vite:build-import-analysis`; Vite 8 Rolldown native path adds
+// `native:import-analysis-build`.
+//
+// Why we care where these sit: they substitute `__VITE_PRELOAD__` in entry
+// chunks inside their own generateBundle, and Vite places them immediately
+// AFTER `enforce: 'post'` user plugins. Measured on Vite 8.2.2, a post plugin
+// is at index 25 and the analysis plugin at 26 - so by default we would hash
+// an entry chunk still containing `import("./x.js"),__VITE_PRELOAD__)` while
+// the written file contains `import("./x.js"),[])`.
 //
-// Why patch at all, rather than use `transformIndexHtml` (order: 'post') or our
-// own `enforce: 'post'` generateBundle? Both of those run BEFORE this plugin
-// substitutes `__VITE_PRELOAD__` in entry chunks, so any hash taken there
-// describes bytes that never ship. Measured on Vite 8.2.2: at both of those
-// points the entry chunk still ends `import("./about-*.js"),__VITE_PRELOAD__)`,
-// while the written file ends `import("./about-*.js"),[])`. Wrapping this
-// plugin's own handler is the only hook position after that substitution.
-// `test/sri.test.js > injects integrity matching the actual emitted bytes`
-// fails if this is ever "simplified" away.
+// The fix is to move THIS plugin one place later, not to rewrite someone
+// else's hook. `config.plugins` is a plain, unfrozen array at configResolved
+// time and Rollup reads it afterwards, so repositioning takes effect.
+// `test/sri.test.js > injects integrity matching the actual emitted bytes` is
+// the pin, and the writeBundle drift check is the second net.
 const VITE_INTERNAL_ANALYSIS_PLUGINS = [
   'vite:build-import-analysis',
   'native:import-analysis-build'
 ];
 const DEFAULT_HASH_ALGORITHM = 'sha384';
+const CROSSORIGIN_VALUES = ['anonymous', 'use-credentials'];
 const DEFAULT_PLUGIN_NAME = 'vite-plugin-sri4';
 const MANIFEST_FILE_NAME = 'sri-manifest.json';
 const HTML_RE = /\.html?$/;
@@ -744,16 +824,39 @@ function hashBundle(bundle, hashAlgorithm) {
   return hashes
 }
 
+/**
+ * Reject configuration that would build cleanly and then fail in the browser.
+ */
+function validateOptions(hashAlgorithm, crossorigin) {
+  if (!SUPPORTED_HASH_ALGORITHMS.includes(hashAlgorithm)) {
+    throw new Error(
+      `[${DEFAULT_PLUGIN_NAME}] unsupported hashAlgorithm "${hashAlgorithm}". ` +
+      `The SRI spec defines ${SUPPORTED_HASH_ALGORITHMS.join(', ')}; browsers reject ` +
+      `anything else, so the build would succeed and the resource would be blocked.`
+    )
+  }
+
+  if (!CROSSORIGIN_VALUES.includes(crossorigin)) {
+    throw new Error(
+      `[${DEFAULT_PLUGIN_NAME}] crossorigin must be one of ${CROSSORIGIN_VALUES.join(', ')}, ` +
+      `got "${crossorigin}"`
+    )
+  }
+}
+
 function sri(options = {}) {
   const {
     ignoreMissingAsset = false,
     bypassDomains = [],
     hashAlgorithm = DEFAULT_HASH_ALGORITHM,
+    crossorigin = 'anonymous',
     logLevel = 'warn',
     manifest = false,
     importmap = false
   } = options;
 
+  validateOptions(hashAlgorithm, crossorigin);
+
   // Create cache manager and logger instances for this plugin instance
   const cacheManager = new CacheManager();
   const logger = new Logger(logLevel, DEFAULT_PLUGIN_NAME);
@@ -761,6 +864,9 @@ function sri(options = {}) {
   // bundle fileName -> the integrity we injected, re-checked in writeBundle
   const hashedAssets = new Map();
 
+  let config;
+  let transformer;
+
   return {
     name: DEFAULT_PLUGIN_NAME,
     enforce: 'post',
@@ -799,99 +905,97 @@ function sri(options = {}) {
       hashedAssets.clear();
     },
 
-    configResolved(config) {
-      const transformer = createTransformer({
+    configResolved(resolvedConfig) {
+      config = resolvedConfig;
+      transformer = createTransformer({
         ignoreMissingAsset,
         bypassDomains,
         hashAlgorithm,
+        crossorigin,
         hashedAssets
       }, config, cacheManager, logger);
 
-      // Both analysis plugin names can be present at once, and each is wrapped.
-      // Without this guard the body runs twice per bundle: `emitFile` throws on
-      // the duplicate manifest fileName, and the import map warns about the one
-      // it just injected. If the skipped pass was the one that finalised chunk
-      // contents, the writeBundle drift check fails the build loudly.
-      const handled = new WeakSet();
+      const plugins = config.plugins;
 
-      const generateBundle = async function(_, bundle) {
-        if (handled.has(bundle)) return
-        handled.add(bundle);
+      // The last one wins: if both names are present we must follow both
+      let target = -1;
+      for (let i = 0; i < plugins.length; i++) {
+        if (plugins[i] && VITE_INTERNAL_ANALYSIS_PLUGINS.includes(plugins[i].name)) target = i;
+      }
 
-        // Computed before emitting anything so the manifest never hashes itself
-        const hashes = manifest || importmap ? hashBundle(bundle, hashAlgorithm) : null;
+      if (target === -1) {
+        throw new Error(
+          `[${DEFAULT_PLUGIN_NAME}] could not find a Vite import-analysis plugin to run after ` +
+          `(looked for: ${VITE_INTERNAL_ANALYSIS_PLUGINS.join(', ')}). ` +
+          `Requires Vite 6.0.0 or higher.`
+        )
+      }
 
-        const htmlFiles = Object.entries(bundle).filter(
-          ([, chunk]) =>
-            chunk.type === 'asset' &&
-            HTML_RE.test(chunk.fileName)
-        );
+      const self = plugins.findIndex(p => p && p.name === DEFAULT_PLUGIN_NAME);
+      if (self === -1) {
+        // Only reachable when the plugin was not registered through Vite, as
+        // in a unit test driving the hook directly. Hashes may then be taken a
+        // step early, which the writeBundle drift check catches.
+        logger.debug('Plugin not present in config.plugins; leaving hook order alone');
+        return
+      }
 
-        if (htmlFiles.length === 0) {
-          // Normal for SSR / library builds, which render HTML at request time
-          // - the manifest below is how those builds get their hashes.
-          logger.debug('No HTML files found in bundle');
-        }
+      if (target > self) {
+        // Removing ourselves shifts target down one, so inserting at `target`
+        // lands immediately after it.
+        const [me] = plugins.splice(self, 1);
+        plugins.splice(target, 0, me);
+        logger.debug(`Repositioned after ${plugins[target - 1].name}`);
+      }
+    },
 
-        // Errors are intentionally not caught: a resource that cannot be
-        // hashed must fail the build rather than ship without integrity.
-        await Promise.all(
-          htmlFiles.map(async ([name, chunk]) => {
-            const originalContent = toText(chunk.source);
-            let html = await transformer.transformHTML(bundle, name, originalContent);
-
-            if (importmap) {
-              const moduleIntegrity = {};
-              const base = withTrailingSlash(config.base);
-              for (const [fileName, integrity] of Object.entries(hashes)) {
-                if (JS_MODULE_RE.test(fileName)) moduleIntegrity[base + fileName] = integrity;
-              }
-              html = injectImportmapIntegrity(html, moduleIntegrity, logger);
-            }
+    async generateBundle(_, bundle) {
+      // Computed before emitting anything so the manifest never hashes itself
+      const hashes = manifest || importmap ? hashBundle(bundle, hashAlgorithm) : null;
+
+      const htmlFiles = Object.entries(bundle).filter(
+        ([, chunk]) =>
+          chunk.type === 'asset' &&
+          HTML_RE.test(chunk.fileName)
+      );
 
-            chunk.source = html;
+      if (htmlFiles.length === 0) {
+        // Normal for SSR / library builds, which render HTML at request time
+        // - the manifest below is how those builds get their hashes.
+        logger.debug('No HTML files found in bundle');
+      }
 
-            if (originalContent !== chunk.source) {
-              logger.debug(`SRI attributes added to ${name}`);
+      // Errors are intentionally not caught: a resource that cannot be
+      // hashed must fail the build rather than ship without integrity.
+      await Promise.all(
+        htmlFiles.map(async ([name, chunk]) => {
+          const originalContent = toText(chunk.source);
+          let html = await transformer.transformHTML(bundle, name, originalContent);
+
+          if (importmap) {
+            const moduleIntegrity = {};
+            const base = withTrailingSlash(config.base);
+            for (const [fileName, integrity] of Object.entries(hashes)) {
+              if (JS_MODULE_RE.test(fileName)) moduleIntegrity[base + fileName] = integrity;
             }
-          })
-        );
+            html = injectImportmapIntegrity(html, moduleIntegrity, logger);
+          }
 
-        if (manifest) {
-          this.emitFile({
-            type: 'asset',
-            fileName: MANIFEST_FILE_NAME,
-            source: JSON.stringify(hashes, null, 2)
-          });
-          logger.debug(`Emitted ${MANIFEST_FILE_NAME} with ${Object.keys(hashes).length} entries`);
-        }
-      };
+          chunk.source = html;
 
-      const targets = config.plugins.filter(
-        p => p && VITE_INTERNAL_ANALYSIS_PLUGINS.includes(p.name)
+          if (originalContent !== chunk.source) {
+            logger.debug(`SRI attributes added to ${name}`);
+          }
+        })
       );
-      if (targets.length === 0) {
-        throw new Error(
-          `[${DEFAULT_PLUGIN_NAME}] could not find a Vite import-analysis plugin to hook into ` +
-          `(looked for: ${VITE_INTERNAL_ANALYSIS_PLUGINS.join(', ')}). ` +
-          `Requires Vite 6.0.0 or higher.`
-        )
-      }
 
-      for (const plugin of targets) {
-        if (typeof plugin.generateBundle === 'object' && plugin.generateBundle.handler) {
-          const originalHandler = plugin.generateBundle.handler;
-          plugin.generateBundle.handler = async function(...args) {
-            await originalHandler.apply(this, args);
-            await generateBundle.apply(this, args);
-          };
-        } else if (typeof plugin.generateBundle === 'function') {
-          const originalHandler = plugin.generateBundle;
-          plugin.generateBundle = async function(...args) {
-            await originalHandler.apply(this, args);
-            await generateBundle.apply(this, args);
-          };
-        }
+      if (manifest) {
+        this.emitFile({
+          type: 'asset',
+          fileName: MANIFEST_FILE_NAME,
+          source: JSON.stringify(hashes, null, 2)
+        });
+        logger.debug(`Emitted ${MANIFEST_FILE_NAME} with ${Object.keys(hashes).length} entries`);
       }
     }
   }

package/package.json

@@ -1,31 +1,31 @@
 {
   "name": "vite-plugin-sri4",
-  "version": "4.1.0",
+  "version": "4.2.0",
   "description": "A Vite plugin to generate Subresource Integrity (SRI) hashes for output files.",
   "type": "module",
   "main": "./dist/index.cjs",
   "module": "./dist/index.js",
   "exports": {
     ".": {
+      "types": "./types/index.d.ts",
       "import": "./dist/index.js",
       "require": "./dist/index.cjs"
     }
   },
   "files": [
-    "dist"
+    "dist",
+    "types",
+    "LICENSE"
   ],
   "scripts": {
     "build": "rollup -c",
     "dev": "rollup -c -w",
-    "lint": "oxlint src test example rollup.config.mjs vitest.config.js",
+    "lint": "oxlint src test types example rollup.config.mjs vitest.config.js",
     "test": "vitest run",
     "test:watch": "vitest",
     "test:coverage": "vitest run --coverage",
     "prepublishOnly": "npm run build"
   },
-  "dependencies": {
-    "cross-fetch": "^4.1.0"
-  },
   "peerDependencies": {
     "vite": "^6.4.0 || ^7.0.0 || ^8.0.0"
   },
@@ -45,7 +45,7 @@
     "subresource integrity"
   ],
   "author": "Zac",
-  "license": "ISC",
+  "license": "MIT",
   "publishConfig": {
     "access": "public"
   },
@@ -56,5 +56,9 @@
   "bugs": {
     "url": "https://github.com/7a6163/vite-plugin-sri4/issues"
   },
-  "homepage": "https://github.com/7a6163/vite-plugin-sri4#readme"
+  "homepage": "https://github.com/7a6163/vite-plugin-sri4#readme",
+  "types": "./types/index.d.ts",
+  "engines": {
+    "node": ">=18"
+  }
 }

package/types/index.d.ts

@@ -0,0 +1,60 @@
+import type { Plugin } from 'vite'
+
+/** The only algorithms the SRI spec defines; browsers reject anything else. */
+export type SriHashAlgorithm = 'sha256' | 'sha384' | 'sha512'
+
+export interface SriOptions {
+  /**
+   * Hash algorithm used to compute the integrity value.
+   * @default 'sha384'
+   */
+  hashAlgorithm?: SriHashAlgorithm
+
+  /**
+   * Value for the injected `crossorigin` attribute. Tags that already declare
+   * one are left alone.
+   * @default 'anonymous'
+   */
+  crossorigin?: 'anonymous' | 'use-credentials'
+
+  /**
+   * Hostnames to leave untouched. Matches the host itself and its subdomains.
+   * Only applies to external (http/https) URLs; use the `skip-sri` attribute
+   * on a tag to opt a single element out.
+   * @default []
+   */
+  bypassDomains?: string[]
+
+  /**
+   * Warn instead of failing the build when an asset resolves to neither a
+   * bundle entry nor a file in `publicDir`.
+   * @default false
+   */
+  ignoreMissingAsset?: boolean
+
+  /**
+   * Log verbosity.
+   * @default 'warn'
+   */
+  logLevel?: 'silent' | 'error' | 'warn' | 'info' | 'debug'
+
+  /**
+   * Inject `<script type="importmap">` carrying an `integrity` map for every
+   * JS chunk, covering modules loaded at runtime by `import()` that have no
+   * build-time tag to rewrite.
+   * @default false
+   */
+  importmap?: boolean
+
+  /**
+   * Emit `sri-manifest.json` mapping every non-HTML output file to its hash,
+   * for servers that render HTML per request.
+   * @default false
+   */
+  manifest?: boolean
+}
+
+declare function sri(options?: SriOptions): Plugin
+
+export default sri
+export { sri }