vite-plugin-sri4 4.1.0 → 5.0.0

package/dist/index.js

@@ -1,6 +1,6 @@
 import { createHash } from 'node:crypto';
+import { readFile } from 'node:fs/promises';
 import path from 'node:path';
-import fetch from 'cross-fetch';
 
 /**
  * Extended caching mechanism with expiration time
@@ -63,17 +63,21 @@ class CacheManager {
   }
 }
 
+// Global fetch, stable since Node 18 - the floor the Vite 6.4 peer range
+// already implies. No dependency needed.
 const DEFAULT_TIMEOUT = 5000;
 
 /**
- * Check if URL is from a bypass domain
+ * Does an external URL's host match one of `domains`, or a subdomain of one?
+ * Used by both `bypassDomains` and `trustDomains`.
  */
-function isUrlFromBypassDomain(url, bypassDomains = [], logger = null) {
+function matchesDomain(url, domains = [], logger = null) {
   if (!url || typeof url !== 'string' || !url.startsWith('http')) return false
+  if (domains.length === 0) return false
 
   try {
     const urlObj = new URL(url);
-    return bypassDomains.some(domain =>
+    return domains.some(domain =>
       urlObj.hostname === domain || urlObj.hostname.endsWith(`.${domain}`)
     )
   } catch (error) {
@@ -84,10 +88,80 @@ function isUrlFromBypassDomain(url, bypassDomains = [], logger = null) {
   }
 }
 
+// A year. The conventional encoding of "this URL's bytes will never change",
+// and what every CDN puts on a version-pinned path.
+const IMMUTABLE_MAX_AGE = 31536000;
+
+/**
+ * Does the origin declare this URL's bytes immutable - `Cache-Control:
+ * immutable`, or a max-age of a year or more - and nothing in the same header
+ * contradicting it?
+ *
+ * Measured, because the split is what makes this usable as a gate. Pinned
+ * third-party libraries, the case SRI actually exists for:
+ *
+ *   cdnjs    jquery/3.7.1       max-age=30672000, immutable
+ *   jsdelivr bootstrap@5.3.3    max-age=31536000, immutable
+ *   unpkg    htmx.org@1.9.12    max-age=31536000
+ *   code.jquery.com  3.7.1      max-age=31536000
+ *
+ * Everything that rolls under a stable URL:
+ *
+ *   jsdelivr vue@3              max-age=604800
+ *   fonts.googleapis.com        max-age=86400   (also `private`)
+ *   plausible.io/js/script.js   max-age=86400
+ *   cdn.tailwindcss.com         max-age=14400
+ *   connect.facebook.net        max-age=1200
+ *   js.stripe.com/v3/           max-age=120
+ *   unpkg    react@18           max-age=60
+ *
+ * Nothing lands between 604800 and 30672000, so the threshold is not a
+ * balancing act - it separates two clusters the CDNs themselves created.
+ */
+function isImmutableResponse(cacheControl) {
+  if (!cacheControl) return false
+
+  let immutable = false;
+
+  for (const directive of cacheControl.split(',')) {
+    // Token equality, not substring: `x-immutable` is not this directive
+    const token = directive.trim().toLowerCase();
+
+    // These veto whatever else the header claims, and are checked against the
+    // whole header rather than returning early, because freshness and
+    // shareability are orthogonal - a per-client response can carry a long
+    // max-age, and `no-cache, max-age=<long>` is a real CDN spelling of "cache
+    // it, but revalidate every time", i.e. the bytes may have changed.
+    //
+    // The qualified forms (`private="set-cookie"`, `no-cache="set-cookie"`)
+    // only scope the directive to those headers, so vetoing on them is
+    // stricter than the spec requires. That is the right way to be wrong here:
+    // the cost is losing SRI on a resource that would have been fine, and it
+    // is logged. Not vetoing costs a page that only breaks in the browser.
+    if (
+      token === 'no-store' ||
+      token === 'private' || token.startsWith('private=') ||
+      token === 'no-cache' || token.startsWith('no-cache=')
+    ) {
+      return false
+    }
+
+    if (token === 'immutable') immutable = true;
+
+    if (token.startsWith('max-age=')) {
+      // RFC 9111 permits a quoted-string value: `max-age="31536000"`
+      const seconds = Number(token.slice('max-age='.length).replace(/^"|"$/g, ''));
+      if (Number.isFinite(seconds) && seconds >= IMMUTABLE_MAX_AGE) immutable = true;
+    }
+  }
+
+  return immutable
+}
+
 /**
  * Resource check with retry mechanism
  */
-async function checkResourceSupport(url, urlSupportCache, logger = null, retries = 2) {
+async function checkResourceSupport(url, urlSupportCache, logger = null, trusted = false, retries = 2) {
   if (urlSupportCache.has(url)) {
     return urlSupportCache.get(url)
   }
@@ -105,23 +179,67 @@ async function checkResourceSupport(url, urlSupportCache, logger = null, retries
 
       clearTimeout(timeoutId);
 
+      // Every path out of here that skips a resource says why. A tag that
+      // silently ships without integrity is the thing that is easy to miss.
+      if (!response.ok) {
+        if (logger) {
+          logger.warn(
+            `Skipping SRI for ${url}: HEAD returned ${response.status}, so the resource ` +
+            'could not be checked. Add the domain to bypassDomains to silence this.'
+          );
+        }
+        urlSupportCache.set(url, false);
+        return false
+      }
+
       // Only `*` can be verified at build time. Injecting integrity also means
       // injecting crossorigin="anonymous"; if the server answers with a
       // concrete origin that does not match wherever the HTML ends up being
-      // served from, that turns a working script into a blocked one. Skipping
-      // is the safe outcome, but say so at warn level - silence here is what
-      // makes an unprotected resource easy to miss.
+      // served from, that turns a working script into a blocked one.
       const corsHeader = response.headers.get('access-control-allow-origin');
-      const isSupported = response.ok && corsHeader === '*';
-      if (response.ok && corsHeader && corsHeader !== '*' && logger) {
-        logger.warn(
-          `Skipping SRI for ${url}: Access-Control-Allow-Origin is "${corsHeader}", not "*", ` +
-          'so crossorigin="anonymous" cannot be verified at build time. ' +
-          'Add the domain to bypassDomains to silence this.'
-        );
+      if (corsHeader !== '*') {
+        if (logger) {
+          logger.warn(
+            `Skipping SRI for ${url}: Access-Control-Allow-Origin is ` +
+            `${corsHeader ? `"${corsHeader}", not "*"` : 'absent'}, so crossorigin="anonymous" ` +
+            'cannot be verified at build time. ' +
+            'Add the domain to bypassDomains to silence this.'
+          );
+        }
+        urlSupportCache.set(url, false);
+        return false
       }
-      urlSupportCache.set(url, isSupported);
-      return isSupported
+
+      // Reachable and CORS-eligible is not the same property as byte-stable.
+      // A hash pins one snapshot of bytes forever, so it is only safe on a URL
+      // whose bytes never change - and the origin is the only party that knows.
+      // Require it to say so rather than hunting for reasons to skip: a
+      // blacklist of known-bad origins is never finished (Google Fonts is
+      // `private`, but cdn.tailwindcss.com and plausible.io are ordinary
+      // `public` responses that roll just the same), and every gap in it ships
+      // a build that works today and breaks whenever the vendor deploys.
+      //
+      // Deliberately not `vary`: Google Fonts varies on User-Agent without
+      // declaring it (`vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site`),
+      // so a vary-based gate would let that resource straight through.
+      const cacheControl = response.headers.get('cache-control');
+      if (!trusted && !isImmutableResponse(cacheControl)) {
+        if (logger) {
+          logger.warn(
+            `Skipping SRI for ${url}: Cache-Control is ` +
+            `${cacheControl ? `"${cacheControl}"` : 'absent'}, so the origin does not declare ` +
+            'this URL immutable and its bytes may differ from the ones hashed here. Pin a ' +
+            'version in the URL, or add the domain to bypassDomains to accept it unprotected. ' +
+            'Only reach for trustDomains on a host you control - forcing a hash onto a ' +
+            "vendor's rolling URL ships a page that breaks on their next deploy."
+          );
+        }
+        urlSupportCache.set(url, false);
+        return false
+      }
+
+      urlSupportCache.set(url, true);
+      return true
     } catch (error) {
       lastError = error;
       if (error.name === 'AbortError') {
@@ -198,6 +316,10 @@ function bundleSource(item) {
   return item.type === 'chunk' ? item.code : item.source
 }
 
+// The only algorithms the SRI spec defines. Browsers reject anything else,
+// which blocks the resource with no build-time error at all.
+const SUPPORTED_HASH_ALGORITHMS = ['sha256', 'sha384', 'sha512'];
+
 /**
  * Compute an SRI string for a source that may be a string, Buffer or Uint8Array
  */
@@ -272,6 +394,48 @@ function findBundleKey(bundle, bundleKey, logger = null) {
   return candidates[0]
 }
 
+/**
+ * Read an asset that lives in `publicDir` rather than the bundle.
+ *
+ * Files copied verbatim from `public/` never appear as bundle entries, so
+ * without this a perfectly normal `<script src="/sw.js">` fails the build.
+ * Returns null rather than throwing so the caller keeps its own missing-asset
+ * policy.
+ */
+async function readPublicAsset(config, bundleKey, logger) {
+  const publicDir = config.publicDir;
+  if (!publicDir) return null
+
+  // Bundle keys come from URLs, which may be percent-encoded
+  let decoded;
+  try {
+    decoded = decodeURIComponent(bundleKey);
+  } catch {
+    decoded = bundleKey;
+  }
+
+  const filePath = path.resolve(publicDir, decoded);
+
+  // A URL must never reach outside publicDir, however it is spelled
+  const relative = path.relative(publicDir, filePath);
+  if (relative.startsWith('..') || path.isAbsolute(relative)) {
+    if (logger) {
+      logger.warn(`Refusing to read outside publicDir: ${bundleKey}`);
+    }
+    return null
+  }
+
+  try {
+    const source = await readFile(filePath);
+    if (logger) {
+      logger.debug(`Resolved from publicDir: ${bundleKey}`);
+    }
+    return source
+  } catch {
+    return null
+  }
+}
+
 /**
  * Calculate SRI integrity hash for a given resource
  */
@@ -287,15 +451,11 @@ async function calculateIntegrity(
   const {
     ignoreMissingAsset,
     bypassDomains,
+    trustDomains,
     hashAlgorithm,
     hashedAssets
   } = options;
 
-  // Skip specified domains
-  if (isUrlFromBypassDomain(url, bypassDomains, logger)) {
-    return null
-  }
-
   // With an absolute `base` (assets on a CDN) Vite emits absolute URLs for our
   // own build output. Those must be hashed from the bundle, not fetched - the
   // CDN may not have been deployed yet, and this is the very case SRI exists
@@ -304,10 +464,22 @@ async function calculateIntegrity(
   const ownAsset = (HTTP_RE.test(base) || base.startsWith('//')) && url.startsWith(base);
   const fetchUrl = ownAsset ? null : externalUrl(url);
 
+  // Both domain options match the URL that would actually be fetched.
+  // `matchesDomain` needs a scheme, so matching the raw `url` silently missed
+  // every protocol-relative `//host/path` - and `trustDomains` below, which
+  // already saw the normalized form, would then disagree with `bypassDomains`
+  // about the same tag.
+  if (matchesDomain(fetchUrl ?? url, bypassDomains, logger)) {
+    return null
+  }
+
   let source;
   let bundleFileName = null;
   if (fetchUrl) {
-    const isSupported = await checkResourceSupport(fetchUrl, cacheManager.getUrlSupportCache(), logger);
+    const trusted = matchesDomain(fetchUrl, trustDomains, logger);
+    const isSupported = await checkResourceSupport(
+      fetchUrl, cacheManager.getUrlSupportCache(), logger, trusted
+    );
     if (!isSupported) return null
     source = await fetchResource(fetchUrl, cacheManager.getResourceCache(), logger);
     if (!source) return null
@@ -333,13 +505,23 @@ async function calculateIntegrity(
         }
         bundleFileName = possibleMatch;
         source = bundleSource(bundle[possibleMatch]);
-      } else if (ignoreMissingAsset) {
-        if (logger) {
-          logger.warn(`Asset not found in bundle: ${url} (path: ${htmlPath}, key: ${bundleKey})`);
-        }
-        return null
       } else {
-        throw new Error(`Asset ${url} not found in bundle (path: ${htmlPath}, key: ${bundleKey})`)
+        // Not a build output - it may still be a file copied from publicDir
+        source = await readPublicAsset(config, bundleKey, logger);
+
+        if (!source) {
+          if (ignoreMissingAsset) {
+            if (logger) {
+              logger.warn(
+                `Asset not found in bundle or publicDir: ${url} (path: ${htmlPath}, key: ${bundleKey})`
+              );
+            }
+            return null
+          }
+          throw new Error(
+            `Asset ${url} not found in bundle or publicDir (path: ${htmlPath}, key: ${bundleKey})`
+          )
+        }
       }
     } else {
       bundleFileName = bundleKey;
@@ -427,7 +609,15 @@ function insertOffset(tag, endOffset) {
 }
 
 /**
- * Process a single match to create an integrity change object
+ * Per-tag opt out. `<script skip-sri src="...">` is left alone, and the marker
+ * attribute is stripped so it does not ship to the browser. More granular than
+ * bypassDomains, which only reaches external hosts.
+ */
+const SKIP_SRI_ATTR_RE = /\s+skip-sri(?:\s*=\s*(?:"[^"]*"|'[^']*'|[^\s>/]+))?/i;
+
+/**
+ * Process a single match into a text edit: { start, end, content }. An
+ * insertion has start === end; a removal has empty content.
  */
 async function processMatch(
   match,
@@ -440,6 +630,20 @@ async function processMatch(
   logger
 ) {
   const tag = match[0];
+
+  const skip = SKIP_SRI_ATTR_RE.exec(tag);
+  if (skip) {
+    return {
+      start: match.index + skip.index,
+      end: match.index + skip.index + skip[0].length,
+      content: '',
+      url: pattern.getUrl(tag),
+      skipped: true
+    }
+  }
+
+  // Nothing to do for a tag that already carries its own hash, and computing
+  // one anyway would register it for the writeBundle drift check
   if (INTEGRITY_ATTR_RE.test(tag)) return null
 
   const url = pattern.getUrl(tag);
@@ -455,15 +659,15 @@ async function processMatch(
     logger
   );
 
-  if (integrity) {
-    return {
-      integrity,
-      position: match.index + insertOffset(tag, pattern.endOffset),
-      tag,
-      url // For logging
-    }
+  if (!integrity) return null
+
+  let content = ` integrity="${integrity}"`;
+  if (!CROSSORIGIN_ATTR_RE.test(tag)) {
+    content += ` crossorigin="${options.crossorigin}"`;
   }
-  return null
+
+  const at = match.index + insertOffset(tag, pattern.endOffset);
+  return { start: at, end: at, content, url }
 }
 
 /**
@@ -534,16 +738,12 @@ async function collectIntegrityChanges(
  * Apply integrity changes to HTML content
  */
 function applyIntegrityChanges(html, changes, logger) {
-  // Sort by position in descending order to insert from back to front
-  changes.sort((a, b) => b.position - a.position);
+  // Back to front, so earlier offsets stay valid as the string is edited
+  changes.sort((a, b) => b.start - a.start);
 
-  for (const { integrity, position, tag, url } of changes) {
-    let insertText = ` integrity="${integrity}"`;
-    if (!CROSSORIGIN_ATTR_RE.test(tag)) {
-      insertText += ' crossorigin="anonymous"';
-    }
-    html = html.slice(0, position) + insertText + html.slice(position);
-    logger.debug(`Added integrity for: ${url}`);
+  for (const { start, end, content, url, skipped } of changes) {
+    html = html.slice(0, start) + content + html.slice(end);
+    logger.debug(skipped ? `Skipped (skip-sri): ${url}` : `Added integrity for: ${url}`);
   }
 
   return html
@@ -700,23 +900,27 @@ class Logger {
   }
 }
 
-// Vite 6/7 uses `vite:build-import-analysis`; Vite 8 Rolldown native path
-// adds `native:import-analysis-build`. We patch whichever (or both) is present.
+// Vite 6/7 uses `vite:build-import-analysis`; Vite 8 Rolldown native path adds
+// `native:import-analysis-build`.
+//
+// Why we care where these sit: they substitute `__VITE_PRELOAD__` in entry
+// chunks inside their own generateBundle, and Vite places them immediately
+// AFTER `enforce: 'post'` user plugins. Measured on Vite 8.2.2, a post plugin
+// is at index 25 and the analysis plugin at 26 - so by default we would hash
+// an entry chunk still containing `import("./x.js"),__VITE_PRELOAD__)` while
+// the written file contains `import("./x.js"),[])`.
 //
-// Why patch at all, rather than use `transformIndexHtml` (order: 'post') or our
-// own `enforce: 'post'` generateBundle? Both of those run BEFORE this plugin
-// substitutes `__VITE_PRELOAD__` in entry chunks, so any hash taken there
-// describes bytes that never ship. Measured on Vite 8.2.2: at both of those
-// points the entry chunk still ends `import("./about-*.js"),__VITE_PRELOAD__)`,
-// while the written file ends `import("./about-*.js"),[])`. Wrapping this
-// plugin's own handler is the only hook position after that substitution.
-// `test/sri.test.js > injects integrity matching the actual emitted bytes`
-// fails if this is ever "simplified" away.
+// The fix is to move THIS plugin one place later, not to rewrite someone
+// else's hook. `config.plugins` is a plain, unfrozen array at configResolved
+// time and Rollup reads it afterwards, so repositioning takes effect.
+// `test/sri.test.js > injects integrity matching the actual emitted bytes` is
+// the pin, and the writeBundle drift check is the second net.
 const VITE_INTERNAL_ANALYSIS_PLUGINS = [
   'vite:build-import-analysis',
   'native:import-analysis-build'
 ];
 const DEFAULT_HASH_ALGORITHM = 'sha384';
+const CROSSORIGIN_VALUES = ['anonymous', 'use-credentials'];
 const DEFAULT_PLUGIN_NAME = 'vite-plugin-sri4';
 const MANIFEST_FILE_NAME = 'sri-manifest.json';
 const HTML_RE = /\.html?$/;
@@ -744,16 +948,40 @@ function hashBundle(bundle, hashAlgorithm) {
   return hashes
 }
 
+/**
+ * Reject configuration that would build cleanly and then fail in the browser.
+ */
+function validateOptions(hashAlgorithm, crossorigin) {
+  if (!SUPPORTED_HASH_ALGORITHMS.includes(hashAlgorithm)) {
+    throw new Error(
+      `[${DEFAULT_PLUGIN_NAME}] unsupported hashAlgorithm "${hashAlgorithm}". ` +
+      `The SRI spec defines ${SUPPORTED_HASH_ALGORITHMS.join(', ')}; browsers reject ` +
+      `anything else, so the build would succeed and the resource would be blocked.`
+    )
+  }
+
+  if (!CROSSORIGIN_VALUES.includes(crossorigin)) {
+    throw new Error(
+      `[${DEFAULT_PLUGIN_NAME}] crossorigin must be one of ${CROSSORIGIN_VALUES.join(', ')}, ` +
+      `got "${crossorigin}"`
+    )
+  }
+}
+
 function sri(options = {}) {
   const {
     ignoreMissingAsset = false,
     bypassDomains = [],
+    trustDomains = [],
     hashAlgorithm = DEFAULT_HASH_ALGORITHM,
+    crossorigin = 'anonymous',
     logLevel = 'warn',
     manifest = false,
     importmap = false
   } = options;
 
+  validateOptions(hashAlgorithm, crossorigin);
+
   // Create cache manager and logger instances for this plugin instance
   const cacheManager = new CacheManager();
   const logger = new Logger(logLevel, DEFAULT_PLUGIN_NAME);
@@ -761,6 +989,9 @@ function sri(options = {}) {
   // bundle fileName -> the integrity we injected, re-checked in writeBundle
   const hashedAssets = new Map();
 
+  let config;
+  let transformer;
+
   return {
     name: DEFAULT_PLUGIN_NAME,
     enforce: 'post',
@@ -799,99 +1030,98 @@ function sri(options = {}) {
       hashedAssets.clear();
     },
 
-    configResolved(config) {
-      const transformer = createTransformer({
+    configResolved(resolvedConfig) {
+      config = resolvedConfig;
+      transformer = createTransformer({
         ignoreMissingAsset,
         bypassDomains,
+        trustDomains,
         hashAlgorithm,
+        crossorigin,
         hashedAssets
       }, config, cacheManager, logger);
 
-      // Both analysis plugin names can be present at once, and each is wrapped.
-      // Without this guard the body runs twice per bundle: `emitFile` throws on
-      // the duplicate manifest fileName, and the import map warns about the one
-      // it just injected. If the skipped pass was the one that finalised chunk
-      // contents, the writeBundle drift check fails the build loudly.
-      const handled = new WeakSet();
-
-      const generateBundle = async function(_, bundle) {
-        if (handled.has(bundle)) return
-        handled.add(bundle);
-
-        // Computed before emitting anything so the manifest never hashes itself
-        const hashes = manifest || importmap ? hashBundle(bundle, hashAlgorithm) : null;
-
-        const htmlFiles = Object.entries(bundle).filter(
-          ([, chunk]) =>
-            chunk.type === 'asset' &&
-            HTML_RE.test(chunk.fileName)
-        );
-
-        if (htmlFiles.length === 0) {
-          // Normal for SSR / library builds, which render HTML at request time
-          // - the manifest below is how those builds get their hashes.
-          logger.debug('No HTML files found in bundle');
-        }
-
-        // Errors are intentionally not caught: a resource that cannot be
-        // hashed must fail the build rather than ship without integrity.
-        await Promise.all(
-          htmlFiles.map(async ([name, chunk]) => {
-            const originalContent = toText(chunk.source);
-            let html = await transformer.transformHTML(bundle, name, originalContent);
-
-            if (importmap) {
-              const moduleIntegrity = {};
-              const base = withTrailingSlash(config.base);
-              for (const [fileName, integrity] of Object.entries(hashes)) {
-                if (JS_MODULE_RE.test(fileName)) moduleIntegrity[base + fileName] = integrity;
-              }
-              html = injectImportmapIntegrity(html, moduleIntegrity, logger);
-            }
-
-            chunk.source = html;
+      const plugins = config.plugins;
 
-            if (originalContent !== chunk.source) {
-              logger.debug(`SRI attributes added to ${name}`);
-            }
-          })
-        );
-
-        if (manifest) {
-          this.emitFile({
-            type: 'asset',
-            fileName: MANIFEST_FILE_NAME,
-            source: JSON.stringify(hashes, null, 2)
-          });
-          logger.debug(`Emitted ${MANIFEST_FILE_NAME} with ${Object.keys(hashes).length} entries`);
-        }
-      };
+      // The last one wins: if both names are present we must follow both
+      let target = -1;
+      for (let i = 0; i < plugins.length; i++) {
+        if (plugins[i] && VITE_INTERNAL_ANALYSIS_PLUGINS.includes(plugins[i].name)) target = i;
+      }
 
-      const targets = config.plugins.filter(
-        p => p && VITE_INTERNAL_ANALYSIS_PLUGINS.includes(p.name)
-      );
-      if (targets.length === 0) {
+      if (target === -1) {
         throw new Error(
-          `[${DEFAULT_PLUGIN_NAME}] could not find a Vite import-analysis plugin to hook into ` +
+          `[${DEFAULT_PLUGIN_NAME}] could not find a Vite import-analysis plugin to run after ` +
           `(looked for: ${VITE_INTERNAL_ANALYSIS_PLUGINS.join(', ')}). ` +
           `Requires Vite 6.0.0 or higher.`
         )
       }
 
-      for (const plugin of targets) {
-        if (typeof plugin.generateBundle === 'object' && plugin.generateBundle.handler) {
-          const originalHandler = plugin.generateBundle.handler;
-          plugin.generateBundle.handler = async function(...args) {
-            await originalHandler.apply(this, args);
-            await generateBundle.apply(this, args);
-          };
-        } else if (typeof plugin.generateBundle === 'function') {
-          const originalHandler = plugin.generateBundle;
-          plugin.generateBundle = async function(...args) {
-            await originalHandler.apply(this, args);
-            await generateBundle.apply(this, args);
-          };
-        }
+      const self = plugins.findIndex(p => p && p.name === DEFAULT_PLUGIN_NAME);
+      if (self === -1) {
+        // Only reachable when the plugin was not registered through Vite, as
+        // in a unit test driving the hook directly. Hashes may then be taken a
+        // step early, which the writeBundle drift check catches.
+        logger.debug('Plugin not present in config.plugins; leaving hook order alone');
+        return
+      }
+
+      if (target > self) {
+        // Removing ourselves shifts target down one, so inserting at `target`
+        // lands immediately after it.
+        const [me] = plugins.splice(self, 1);
+        plugins.splice(target, 0, me);
+        logger.debug(`Repositioned after ${plugins[target - 1].name}`);
+      }
+    },
+
+    async generateBundle(_, bundle) {
+      // Computed before emitting anything so the manifest never hashes itself
+      const hashes = manifest || importmap ? hashBundle(bundle, hashAlgorithm) : null;
+
+      const htmlFiles = Object.entries(bundle).filter(
+        ([, chunk]) =>
+          chunk.type === 'asset' &&
+          HTML_RE.test(chunk.fileName)
+      );
+
+      if (htmlFiles.length === 0) {
+        // Normal for SSR / library builds, which render HTML at request time
+        // - the manifest below is how those builds get their hashes.
+        logger.debug('No HTML files found in bundle');
+      }
+
+      // Errors are intentionally not caught: a resource that cannot be
+      // hashed must fail the build rather than ship without integrity.
+      await Promise.all(
+        htmlFiles.map(async ([name, chunk]) => {
+          const originalContent = toText(chunk.source);
+          let html = await transformer.transformHTML(bundle, name, originalContent);
+
+          if (importmap) {
+            const moduleIntegrity = {};
+            const base = withTrailingSlash(config.base);
+            for (const [fileName, integrity] of Object.entries(hashes)) {
+              if (JS_MODULE_RE.test(fileName)) moduleIntegrity[base + fileName] = integrity;
+            }
+            html = injectImportmapIntegrity(html, moduleIntegrity, logger);
+          }
+
+          chunk.source = html;
+
+          if (originalContent !== chunk.source) {
+            logger.debug(`SRI attributes added to ${name}`);
+          }
+        })
+      );
+
+      if (manifest) {
+        this.emitFile({
+          type: 'asset',
+          fileName: MANIFEST_FILE_NAME,
+          source: JSON.stringify(hashes, null, 2)
+        });
+        logger.debug(`Emitted ${MANIFEST_FILE_NAME} with ${Object.keys(hashes).length} entries`);
       }
     }
   }