vite-plugin-sri4 4.1.0 → 5.0.0

package/package.json

@@ -1,31 +1,31 @@
 {
   "name": "vite-plugin-sri4",
-  "version": "4.1.0",
+  "version": "5.0.0",
   "description": "A Vite plugin to generate Subresource Integrity (SRI) hashes for output files.",
   "type": "module",
   "main": "./dist/index.cjs",
   "module": "./dist/index.js",
   "exports": {
     ".": {
+      "types": "./types/index.d.ts",
       "import": "./dist/index.js",
       "require": "./dist/index.cjs"
     }
   },
   "files": [
-    "dist"
+    "dist",
+    "types",
+    "LICENSE"
   ],
   "scripts": {
     "build": "rollup -c",
     "dev": "rollup -c -w",
-    "lint": "oxlint src test example rollup.config.mjs vitest.config.js",
+    "lint": "oxlint src test types example rollup.config.mjs vitest.config.js",
     "test": "vitest run",
     "test:watch": "vitest",
     "test:coverage": "vitest run --coverage",
     "prepublishOnly": "npm run build"
   },
-  "dependencies": {
-    "cross-fetch": "^4.1.0"
-  },
   "peerDependencies": {
     "vite": "^6.4.0 || ^7.0.0 || ^8.0.0"
   },
@@ -45,7 +45,7 @@
     "subresource integrity"
   ],
   "author": "Zac",
-  "license": "ISC",
+  "license": "MIT",
   "publishConfig": {
     "access": "public"
   },
@@ -56,5 +56,9 @@
   "bugs": {
     "url": "https://github.com/7a6163/vite-plugin-sri4/issues"
   },
-  "homepage": "https://github.com/7a6163/vite-plugin-sri4#readme"
+  "homepage": "https://github.com/7a6163/vite-plugin-sri4#readme",
+  "types": "./types/index.d.ts",
+  "engines": {
+    "node": ">=18"
+  }
 }

package/types/index.d.ts

@@ -0,0 +1,72 @@
+import type { Plugin } from 'vite'
+
+/** The only algorithms the SRI spec defines; browsers reject anything else. */
+export type SriHashAlgorithm = 'sha256' | 'sha384' | 'sha512'
+
+export interface SriOptions {
+  /**
+   * Hash algorithm used to compute the integrity value.
+   * @default 'sha384'
+   */
+  hashAlgorithm?: SriHashAlgorithm
+
+  /**
+   * Value for the injected `crossorigin` attribute. Tags that already declare
+   * one are left alone.
+   * @default 'anonymous'
+   */
+  crossorigin?: 'anonymous' | 'use-credentials'
+
+  /**
+   * Hostnames to leave untouched. Matches the host itself and its subdomains.
+   * Only applies to external URLs, protocol-relative `//host/path` included;
+   * use the `skip-sri` attribute on a tag to opt a single element out.
+   * @default []
+   */
+  bypassDomains?: string[]
+
+  /**
+   * Hostnames whose bytes you vouch for. An external resource is normally only
+   * hashed when its origin declares the URL immutable (`Cache-Control:
+   * immutable`, or a max-age of a year or more); a host listed here is hashed
+   * regardless. Matches the host itself and its subdomains.
+   *
+   * Use it for a stable host that does not set the header - not to force SRI
+   * onto a vendor's rolling URL, which will break on their next deploy.
+   * @default []
+   */
+  trustDomains?: string[]
+
+  /**
+   * Warn instead of failing the build when an asset resolves to neither a
+   * bundle entry nor a file in `publicDir`.
+   * @default false
+   */
+  ignoreMissingAsset?: boolean
+
+  /**
+   * Log verbosity.
+   * @default 'warn'
+   */
+  logLevel?: 'silent' | 'error' | 'warn' | 'info' | 'debug'
+
+  /**
+   * Inject `<script type="importmap">` carrying an `integrity` map for every
+   * JS chunk, covering modules loaded at runtime by `import()` that have no
+   * build-time tag to rewrite.
+   * @default false
+   */
+  importmap?: boolean
+
+  /**
+   * Emit `sri-manifest.json` mapping every non-HTML output file to its hash,
+   * for servers that render HTML per request.
+   * @default false
+   */
+  manifest?: boolean
+}
+
+declare function sri(options?: SriOptions): Plugin
+
+export default sri
+export { sri }