vite-plugin-sri4 5.0.0 → 5.1.1

package/README.md

@@ -1,6 +1,6 @@
 # vite-plugin-sri4
 
-![NPM Version](https://img.shields.io/npm/v/vite-plugin-sri4)
+[![NPM Version](https://img.shields.io/npm/v/vite-plugin-sri4)](https://www.npmjs.com/package/vite-plugin-sri4)
 [![codecov](https://codecov.io/gh/7a6163/vite-plugin-sri4/graph/badge.svg?token=GOVB4J3D19)](https://codecov.io/gh/7a6163/vite-plugin-sri4)
 ![License](https://img.shields.io/npm/l/vite-plugin-sri4)
 
@@ -16,9 +16,11 @@ A Vite plugin to generate Subresource Integrity (SRI) hashes for your assets dur
 - [External Resources](#external-resources)
 - [When SRI Actually Helps](#when-sri-actually-helps)
 - [How It Attaches Hashes](#how-it-attaches-hashes)
+- [Differences from vite-plugin-sri3](#differences-from-vite-plugin-sri3)
 - [Example Project](#example-project)
 - [Best Practices](#best-practices)
 - [Troubleshooting](#troubleshooting)
+- [Testing](#testing)
 - [Contributing](#contributing)
 - [Inspiration](#inspiration)
 - [License](#license)
@@ -144,9 +146,11 @@ The `writeBundle` drift check above covers **your own build outputs only**. Ever
 
 An external URL pointing at someone else's origin is different. It is fetched **once, at build time, from your build machine**, and the hash is taken from that copy. An `integrity` attribute pins those bytes forever, so it is only correct on a URL whose bytes never change — and the origin is the only party that knows whether that is true.
 
-So the plugin asks it. An external resource is hashed only when **all three** hold:
+So the plugin asks it. One `GET` does the whole job — it carries both the bytes to hash and the headers the answer depends on. There is no separate `HEAD` probe, so a host that serves `GET` and refuses `HEAD` is not a problem; `js.tappaysdk.com` answers `403` to `HEAD` and `200` to `GET`, and is read correctly.
 
-1. **`HEAD` succeeds.** Otherwise there is nothing to check.
+An external resource is hashed only when **all three** hold:
+
+1. **The request succeeds.** A non-2xx response leaves nothing to check.
 2. **`Access-Control-Allow-Origin: *`.** Injecting `integrity` also injects `crossorigin`, so a response scoped to one specific origin — or to none — would turn a working resource into a blocked one.
 3. **The origin declares the URL immutable**: `Cache-Control: immutable`, or a `max-age` of a year or more — and nothing in the same header contradicting it. `private`, `no-store` and `no-cache` each veto it: freshness and shareability are orthogonal, so a per-client response can carry a long `max-age`, and `no-cache, max-age=<long>` is a real CDN spelling of "cache it, but revalidate every time". Or the host is in `trustDomains`.
 
@@ -180,13 +184,28 @@ A blacklist would have to catch every one of the bottom rows individually, and t
 
 **Pin a version in the URL.** `unpkg.com/react@18.3.1/…` answers `max-age=31536000`; `unpkg.com/react@18/…` answers `max-age=60`. Same for jsdelivr. This is the fix, not a workaround — a floating URL and an integrity attribute are contradictory by construction.
 
-**Or vouch for the host** when you know it is stable and it just does not say so:
+**Or vouch for the host** when you know it is stable and it just does not say so. The shape to look for is a URL that already carries a version, served by an origin that simply sends no `Cache-Control` at all:
+
+```
+https://js.tappaysdk.com/sdk/tpdirect/v5.19.2
+
+  access-control-allow-origin: *
+  (no cache-control header)
+```
+
+The version is in the path, so those bytes are as fixed as any `immutable` response — the origin just never says so. That is what `trustDomains` is for:
 
 ```js
-sri({ trustDomains: ['assets.internal.example'] })
+sri({ trustDomains: ['js.tappaysdk.com'] })
 ```
 
-Do not point `trustDomains` at a vendor's rolling URL. Stripe, for one, documents that `js.stripe.com/v3/` must not be pinned; forcing a hash onto it produces a page that works until their next deploy.
+**When not to use it.** `trustDomains` overrides the one check that stands between you and a hash that stops matching. Do not point it at:
+
+- **a URL without a version in it** — `js.stripe.com/v3/`, `cdn.tailwindcss.com`, `connect.facebook.net/en_US/sdk.js`. Stripe documents that `v3/` must not be pinned; forcing a hash onto it produces a page that works until their next deploy.
+- **a floating range** — `unpkg.com/react@18/…` resolves to whatever 18.x is current.
+- **a host that serves per-client responses** — `fonts.googleapis.com` answers `private` for a reason.
+
+The test is not "do I trust this vendor". It is "will these exact bytes still be at this exact URL after their next release". If the answer comes from the URL itself, `trustDomains` is right; if it comes from hope, use `bypassDomains`.
 
 **Or accept it and silence the warning** with `bypassDomains`. Third-party analytics and widget scripts are usually this case — they are built to auto-update, and there is nothing to pin:
 
@@ -232,7 +251,7 @@ There are three places a Vite plugin can compute SRI hashes, and they are not eq
 
 Only the entry chunk is affected, so a build without a dynamic import will not reveal the difference. As a second safeguard, every hashed file is re-hashed in `writeBundle` and the build fails if anything changed after the hash was taken.
 
-This ordering constraint was first identified by [vite-plugin-sri3](https://github.com/yoyo930021/vite-plugin-sri3), which this plugin began as a fork of. Beyond it, this plugin adds `crossorigin` injection, a CORS pre-check with timeouts and retries for external resources, import map and manifest output for dynamically imported routes, `publicDir` resolution, and the drift check above.
+This ordering constraint was first identified by [vite-plugin-sri3](https://github.com/yoyo930021/vite-plugin-sri3), which this plugin began as a fork of. See [Differences from vite-plugin-sri3](#differences-from-vite-plugin-sri3).
 
 ## Example Project
 
@@ -319,6 +338,20 @@ This will show:
 - Missing asset warnings
 - Bundle-key fallback matches (when a URL is resolved via suffix match)
 
+## Testing
+
+```bash
+npm test              # 174 tests
+npm run test:coverage # the same, with coverage thresholds enforced at 100%
+npm run test:mutation # Stryker, ~4 minutes
+```
+
+Coverage is held at **100%** of statements, branches, functions and lines, enforced by thresholds in `vitest.config.js` — an uncovered path fails the run rather than quietly lowering the number.
+
+Coverage only proves a line ran. Mutation testing changes the code and checks whether a test notices, which is a much harder bar: at 100% coverage this suite still let 162 mutants through on the first run. The gaps it found were real — `no-store` and the qualified `private="…"` / `no-cache="…"` forms were never exercised, the `publicDir` path-traversal guard had no test, `base: './'` and `base: ''` were unreachable from any test, and the immutability tests all used `max-age=31536000, immutable`, where **both** passing conditions hold at once, so neither was actually pinned.
+
+The mutation score is **81.19%**, with a break threshold of 80. The remaining survivors are mostly equivalent mutants — warning message wording, cache clearing that has no observable effect, and `typeof source === 'string' ? source : Buffer.from(source)`, whose two branches hash identically. Killing those would mean asserting log text verbatim, which costs more than it protects.
+
 ## Contributing
 
 We welcome contributions! Here's how you can help:
@@ -335,9 +368,31 @@ Please make sure to:
 - Follow the existing code style
 - Update the CHANGELOG.md
 
-## Inspiration
+## Differences from vite-plugin-sri3
+
+This plugin began as a fork of [vite-plugin-sri3](https://github.com/yoyo930021/vite-plugin-sri3) and the two have since diverged. Compared against sri3 `2.0.0`:
 
-This project was inspired by [vite-plugin-sri3](https://github.com/yoyo930021/vite-plugin-sri3), which provides subresource integrity for Vite. We've built upon its foundation to create an enhanced version with additional features and improved compatibility.
+| | sri3 2.0.0 | sri4 5.1.0 |
+|---|---|---|
+| Vite range | `^3 ‖ ^4 ‖ ^5 ‖ ^6 ‖ ^7 ‖ ^8` | `^6.4 ‖ ^7 ‖ ^8` |
+| Bundle outputs | ✅ | ✅ |
+| `publicDir` assets | ✅ | ✅ |
+| `skip-sri` per-tag opt-out | ✅ | ✅ |
+| TypeScript definitions | ✅ | ✅ |
+| Hash algorithm | `sha384`, fixed | `sha256` / `sha384` / `sha512`, validated at startup |
+| `crossorigin` attribute | not injected | injected, `anonymous` or `use-credentials` |
+| External resources | fetched unconditionally | gated on reachability, CORS and immutability |
+| Timeout / retry / cache on those fetches | ❌ | ✅ |
+| `bypassDomains` / `trustDomains` | ❌ | ✅ |
+| Hash drift detection | ❌ | re-hashed in `writeBundle`, build fails on drift |
+| `import()`-loaded routes, SSR | ❌ | `importmap` and `manifest` options |
+| Hook ordering | monkey-patches Vite's `generateBundle` | repositions itself in `config.plugins` |
+
+**Where sri3 is the better fit:** it supports Vite 3 through 5, which this plugin dropped. If you are on an older Vite, it is the only one of the two that works.
+
+**The difference that matters most:** sri3 injects `integrity` without `crossorigin`. SRI on a cross-origin resource requires CORS, so a browser blocks a cross-origin `<script>` or `<link>` that carries `integrity` and no `crossorigin` — which makes sri3's external-resource support difficult to use for the case SRI is usually reached for. That gap is what most of the column above grew out of: injecting `crossorigin` means the CORS response has to be checked at build time, and checking it exposed everything else worth checking.
+
+## Inspiration
 
 Other projects that influenced this work:
 - [rollup-plugin-sri](https://github.com/JonasKruckenberg/rollup-plugin-sri)

package/dist/index.cjs

@@ -49,20 +49,14 @@ class ResourceCache {
  */
 class CacheManager {
   constructor() {
-    this.urlSupportCache = new ResourceCache();
     this.resourceCache = new ResourceCache();
   }
 
-  getUrlSupportCache() {
-    return this.urlSupportCache
-  }
-
   getResourceCache() {
     return this.resourceCache
   }
 
   clearAll() {
-    this.urlSupportCache.clear();
     this.resourceCache.clear();
   }
 }
@@ -75,7 +69,7 @@ const DEFAULT_TIMEOUT = 5000;
  * Does an external URL's host match one of `domains`, or a subdomain of one?
  * Used by both `bypassDomains` and `trustDomains`.
  */
-function matchesDomain(url, domains = [], logger = null) {
+function matchesDomain(url, domains = [], logger) {
   if (!url || typeof url !== 'string' || !url.startsWith('http')) return false
   if (domains.length === 0) return false
 
@@ -85,9 +79,7 @@ function matchesDomain(url, domains = [], logger = null) {
       urlObj.hostname === domain || urlObj.hostname.endsWith(`.${domain}`)
     )
   } catch (error) {
-    if (logger) {
-      logger.warn(`Invalid URL: ${url}`, error);
-    }
+    logger.warn(`Invalid URL: ${url}`, error);
     return false
   }
 }
@@ -165,35 +157,48 @@ function isImmutableResponse(cacheControl) {
 /**
  * Resource check with retry mechanism
  */
-async function checkResourceSupport(url, urlSupportCache, logger = null, trusted = false, retries = 2) {
-  if (urlSupportCache.has(url)) {
-    return urlSupportCache.get(url)
+/**
+ * Fetch an external resource and return its bytes, or null if it must not be
+ * hashed. The reason is always logged - a tag that silently ships without
+ * integrity is the thing that is easy to miss.
+ *
+ * One GET, not a HEAD probe followed by a GET. The headers the gates need
+ * arrive on the response that carries the bytes anyway, so probing separately
+ * doubled the requests and threw the useful copy away - and made the plugin
+ * depend on HEAD being served at all. It often is not: js.tappaysdk.com
+ * answers 403 to HEAD and 200 to GET, which used to read as "could not be
+ * checked" on a payment SDK, exactly the kind of script SRI is for.
+ *
+ * The cost is that a rejected resource is downloaded before it is rejected.
+ * That is the right side to lose on: the accepted case, which is every build
+ * that actually ships hashes, goes from two requests to one.
+ */
+async function fetchVerifiedResource(url, resourceCache, logger, trusted = false, retries = 1) {
+  if (resourceCache.has(url)) {
+    return resourceCache.get(url)
   }
 
+  const reject = (message) => {
+    logger.warn(message);
+    resourceCache.set(url, null);
+    return null
+  };
+
   let lastError;
   for (let attempt = 0; attempt <= retries; attempt++) {
     try {
       const controller = new AbortController();
       const timeoutId = setTimeout(() => controller.abort(), DEFAULT_TIMEOUT);
 
-      const response = await fetch(url, {
-        method: 'HEAD',
-        signal: controller.signal
-      });
+      const response = await fetch(url, { signal: controller.signal });
 
       clearTimeout(timeoutId);
 
-      // Every path out of here that skips a resource says why. A tag that
-      // silently ships without integrity is the thing that is easy to miss.
       if (!response.ok) {
-        if (logger) {
-          logger.warn(
-            `Skipping SRI for ${url}: HEAD returned ${response.status}, so the resource ` +
-            'could not be checked. Add the domain to bypassDomains to silence this.'
-          );
-        }
-        urlSupportCache.set(url, false);
-        return false
+        return reject(
+          `Skipping SRI for ${url}: the server answered ${response.status}. ` +
+          'Add the domain to bypassDomains to silence this.'
+        )
       }
 
       // Only `*` can be verified at build time. Injecting integrity also means
@@ -202,16 +207,12 @@ async function checkResourceSupport(url, urlSupportCache, logger = null, trusted
       // served from, that turns a working script into a blocked one.
       const corsHeader = response.headers.get('access-control-allow-origin');
       if (corsHeader !== '*') {
-        if (logger) {
-          logger.warn(
-            `Skipping SRI for ${url}: Access-Control-Allow-Origin is ` +
-            `${corsHeader ? `"${corsHeader}", not "*"` : 'absent'}, so crossorigin="anonymous" ` +
-            'cannot be verified at build time. ' +
-            'Add the domain to bypassDomains to silence this.'
-          );
-        }
-        urlSupportCache.set(url, false);
-        return false
+        return reject(
+          `Skipping SRI for ${url}: Access-Control-Allow-Origin is ` +
+          `${corsHeader ? `"${corsHeader}", not "*"` : 'absent'}, so crossorigin="anonymous" ` +
+          'cannot be verified at build time. ' +
+          'Add the domain to bypassDomains to silence this.'
+        )
       }
 
       // Reachable and CORS-eligible is not the same property as byte-stable.
@@ -228,65 +229,14 @@ async function checkResourceSupport(url, urlSupportCache, logger = null, trusted
       // so a vary-based gate would let that resource straight through.
       const cacheControl = response.headers.get('cache-control');
       if (!trusted && !isImmutableResponse(cacheControl)) {
-        if (logger) {
-          logger.warn(
-            `Skipping SRI for ${url}: Cache-Control is ` +
-            `${cacheControl ? `"${cacheControl}"` : 'absent'}, so the origin does not declare ` +
-            'this URL immutable and its bytes may differ from the ones hashed here. Pin a ' +
-            'version in the URL, or add the domain to bypassDomains to accept it unprotected. ' +
-            'Only reach for trustDomains on a host you control - forcing a hash onto a ' +
-            "vendor's rolling URL ships a page that breaks on their next deploy."
-          );
-        }
-        urlSupportCache.set(url, false);
-        return false
-      }
-
-      urlSupportCache.set(url, true);
-      return true
-    } catch (error) {
-      lastError = error;
-      if (error.name === 'AbortError') {
-        if (logger) {
-          logger.warn(`Resource check timed out: ${url}`);
-        }
-        break // Don't retry timeouts
-      }
-
-      // Don't wait after the last failed attempt
-      if (attempt < retries) {
-        await new Promise(resolve => setTimeout(resolve, 1000 * attempt));
-      }
-    }
-  }
-
-  if (logger) {
-    logger.warn(`Failed to check resource support: ${url}`, lastError);
-  }
-  urlSupportCache.set(url, false);
-  return false
-}
-
-/**
- * Optimized resource fetching function with retry mechanism and caching
- */
-async function fetchResource(url, resourceCache, logger = null, retries = 1) {
-  // Check cache
-  if (resourceCache.has(url)) {
-    return resourceCache.get(url)
-  }
-
-  let lastError;
-  for (let attempt = 0; attempt <= retries; attempt++) {
-    try {
-      const controller = new AbortController();
-      const timeoutId = setTimeout(() => controller.abort(), DEFAULT_TIMEOUT);
-
-      const response = await fetch(url, { signal: controller.signal });
-      clearTimeout(timeoutId);
-
-      if (!response.ok) {
-        throw new Error(`HTTP error! status: ${response.status}`)
+        return reject(
+          `Skipping SRI for ${url}: Cache-Control is ` +
+          `${cacheControl ? `"${cacheControl}"` : 'absent'}, so the origin does not declare ` +
+          'this URL immutable and its bytes may differ from the ones hashed here. Pin a ' +
+          'version in the URL, or add the domain to bypassDomains to accept it unprotected. ' +
+          'Only reach for trustDomains on a host you control - forcing a hash onto a ' +
+          "vendor's rolling URL ships a page that breaks on their next deploy."
+        )
       }
 
       const data = new Uint8Array(await response.arrayBuffer());
@@ -295,21 +245,18 @@ async function fetchResource(url, resourceCache, logger = null, retries = 1) {
     } catch (error) {
       lastError = error;
       if (error.name === 'AbortError') {
-        if (logger) {
-          logger.warn(`Resource fetch timed out: ${url}`);
-        }
-        break // Don't retry timeouts
+        return reject(`Skipping SRI for ${url}: the request timed out.`)
       }
 
+      // Don't wait after the last failed attempt
       if (attempt < retries) {
         await new Promise(resolve => setTimeout(resolve, 1000 * attempt));
       }
     }
   }
 
-  if (logger) {
-    logger.warn(`Failed to fetch external resource: ${url}`, lastError);
-  }
+  logger.warn(`Skipping SRI for ${url}: the request failed.`, lastError);
+  resourceCache.set(url, null);
   return null
 }
 
@@ -382,14 +329,14 @@ function getBundleKey(htmlPath, url, config) {
  * `assets/vendor-main.js` - a cross-filename match would inject a valid-looking
  * but wrong hash, which the browser rejects with no build-time error.
  */
-function findBundleKey(bundle, bundleKey, logger = null) {
+function findBundleKey(bundle, bundleKey, logger) {
   const candidates = Object.keys(bundle).filter(key =>
     key === bundleKey ||
     key.endsWith(`/${bundleKey}`) ||
     bundleKey.endsWith(`/${key}`)
   );
 
-  if (candidates.length > 1 && logger) {
+  if (candidates.length > 1) {
     logger.warn(
       `Ambiguous bundle key for "${bundleKey}": ${candidates.join(', ')} - using ${candidates[0]}`
     );
@@ -423,17 +370,13 @@ async function readPublicAsset(config, bundleKey, logger) {
   // A URL must never reach outside publicDir, however it is spelled
   const relative = path.relative(publicDir, filePath);
   if (relative.startsWith('..') || path.isAbsolute(relative)) {
-    if (logger) {
-      logger.warn(`Refusing to read outside publicDir: ${bundleKey}`);
-    }
+    logger.warn(`Refusing to read outside publicDir: ${bundleKey}`);
     return null
   }
 
   try {
     const source = await promises.readFile(filePath);
-    if (logger) {
-      logger.debug(`Resolved from publicDir: ${bundleKey}`);
-    }
+    logger.debug(`Resolved from publicDir: ${bundleKey}`);
     return source
   } catch {
     return null
@@ -450,7 +393,7 @@ async function calculateIntegrity(
   options,
   config,
   cacheManager,
-  logger = null
+  logger
 ) {
   const {
     ignoreMissingAsset,
@@ -481,17 +424,13 @@ async function calculateIntegrity(
   let bundleFileName = null;
   if (fetchUrl) {
     const trusted = matchesDomain(fetchUrl, trustDomains, logger);
-    const isSupported = await checkResourceSupport(
-      fetchUrl, cacheManager.getUrlSupportCache(), logger, trusted
+    source = await fetchVerifiedResource(
+      fetchUrl, cacheManager.getResourceCache(), logger, trusted
     );
-    if (!isSupported) return null
-    source = await fetchResource(fetchUrl, cacheManager.getResourceCache(), logger);
     if (!source) return null
   } else if (!ownAsset && SCHEME_RE.test(url)) {
     // data:/blob: and unknown schemes cannot be resolved to a bundle asset
-    if (logger) {
-      logger.debug(`Skipping URL that is not a bundle asset: ${url}`);
-    }
+    logger.debug(`Skipping URL that is not a bundle asset: ${url}`);
     return null
   } else {
     const bundleKey = getBundleKey(htmlPath, url, config);
@@ -504,9 +443,7 @@ async function calculateIntegrity(
       const possibleMatch = findBundleKey(bundle, bundleKey, logger);
 
       if (possibleMatch) {
-        if (logger) {
-          logger.debug(`Bundle key fallback: ${bundleKey} -> ${possibleMatch}`);
-        }
+        logger.debug(`Bundle key fallback: ${bundleKey} -> ${possibleMatch}`);
         bundleFileName = possibleMatch;
         source = bundleSource(bundle[possibleMatch]);
       } else {
@@ -515,11 +452,9 @@ async function calculateIntegrity(
 
         if (!source) {
           if (ignoreMissingAsset) {
-            if (logger) {
-              logger.warn(
-                `Asset not found in bundle or publicDir: ${url} (path: ${htmlPath}, key: ${bundleKey})`
-              );
-            }
+            logger.warn(
+              `Asset not found in bundle or publicDir: ${url} (path: ${htmlPath}, key: ${bundleKey})`
+            );
             return null
           }
           throw new Error(
@@ -570,7 +505,9 @@ const SRI_LINK_RELS = new Set(['stylesheet', 'modulepreload']);
 function getAttr(tag, re) {
   const match = tag.match(re);
   if (!match) return null
-  return match[1] ?? match[2] ?? match[3] ?? null
+  // One of the three alternatives matched or the regex would not have, and an
+  // empty value is a string rather than undefined - so there is no fourth case.
+  return match[1] ?? match[2] ?? match[3]
 }
 
 const HTML_PATTERNS = {
@@ -822,9 +759,7 @@ async function transformHTML(
 function createTransformer(options, config, cacheManager, logger) {
   return {
     transformHTML: (bundle, htmlPath, html) =>
-      transformHTML(bundle, htmlPath, html, options, config, cacheManager, logger),
-    calculateIntegrity: (bundle, htmlPath, url) =>
-      calculateIntegrity(bundle, htmlPath, url, options, config, cacheManager, logger)
+      transformHTML(bundle, htmlPath, html, options, config, cacheManager, logger)
   }
 }
 
@@ -895,13 +830,6 @@ class Logger {
       console.debug(...this.formatMessage(message, ...args));
     }
   }
-
-  /**
-   * Create a child logger with the same configuration
-   */
-  child(name) {
-    return new Logger(this.logLevel, `${this.pluginName}:${name}`)
-  }
 }
 
 // Vite 6/7 uses `vite:build-import-analysis`; Vite 8 Rolldown native path adds

package/dist/index.js

@@ -45,20 +45,14 @@ class ResourceCache {
  */
 class CacheManager {
   constructor() {
-    this.urlSupportCache = new ResourceCache();
     this.resourceCache = new ResourceCache();
   }
 
-  getUrlSupportCache() {
-    return this.urlSupportCache
-  }
-
   getResourceCache() {
     return this.resourceCache
   }
 
   clearAll() {
-    this.urlSupportCache.clear();
     this.resourceCache.clear();
   }
 }
@@ -71,7 +65,7 @@ const DEFAULT_TIMEOUT = 5000;
  * Does an external URL's host match one of `domains`, or a subdomain of one?
  * Used by both `bypassDomains` and `trustDomains`.
  */
-function matchesDomain(url, domains = [], logger = null) {
+function matchesDomain(url, domains = [], logger) {
   if (!url || typeof url !== 'string' || !url.startsWith('http')) return false
   if (domains.length === 0) return false
 
@@ -81,9 +75,7 @@ function matchesDomain(url, domains = [], logger = null) {
       urlObj.hostname === domain || urlObj.hostname.endsWith(`.${domain}`)
     )
   } catch (error) {
-    if (logger) {
-      logger.warn(`Invalid URL: ${url}`, error);
-    }
+    logger.warn(`Invalid URL: ${url}`, error);
     return false
   }
 }
@@ -161,35 +153,48 @@ function isImmutableResponse(cacheControl) {
 /**
  * Resource check with retry mechanism
  */
-async function checkResourceSupport(url, urlSupportCache, logger = null, trusted = false, retries = 2) {
-  if (urlSupportCache.has(url)) {
-    return urlSupportCache.get(url)
+/**
+ * Fetch an external resource and return its bytes, or null if it must not be
+ * hashed. The reason is always logged - a tag that silently ships without
+ * integrity is the thing that is easy to miss.
+ *
+ * One GET, not a HEAD probe followed by a GET. The headers the gates need
+ * arrive on the response that carries the bytes anyway, so probing separately
+ * doubled the requests and threw the useful copy away - and made the plugin
+ * depend on HEAD being served at all. It often is not: js.tappaysdk.com
+ * answers 403 to HEAD and 200 to GET, which used to read as "could not be
+ * checked" on a payment SDK, exactly the kind of script SRI is for.
+ *
+ * The cost is that a rejected resource is downloaded before it is rejected.
+ * That is the right side to lose on: the accepted case, which is every build
+ * that actually ships hashes, goes from two requests to one.
+ */
+async function fetchVerifiedResource(url, resourceCache, logger, trusted = false, retries = 1) {
+  if (resourceCache.has(url)) {
+    return resourceCache.get(url)
   }
 
+  const reject = (message) => {
+    logger.warn(message);
+    resourceCache.set(url, null);
+    return null
+  };
+
   let lastError;
   for (let attempt = 0; attempt <= retries; attempt++) {
     try {
       const controller = new AbortController();
       const timeoutId = setTimeout(() => controller.abort(), DEFAULT_TIMEOUT);
 
-      const response = await fetch(url, {
-        method: 'HEAD',
-        signal: controller.signal
-      });
+      const response = await fetch(url, { signal: controller.signal });
 
       clearTimeout(timeoutId);
 
-      // Every path out of here that skips a resource says why. A tag that
-      // silently ships without integrity is the thing that is easy to miss.
       if (!response.ok) {
-        if (logger) {
-          logger.warn(
-            `Skipping SRI for ${url}: HEAD returned ${response.status}, so the resource ` +
-            'could not be checked. Add the domain to bypassDomains to silence this.'
-          );
-        }
-        urlSupportCache.set(url, false);
-        return false
+        return reject(
+          `Skipping SRI for ${url}: the server answered ${response.status}. ` +
+          'Add the domain to bypassDomains to silence this.'
+        )
       }
 
       // Only `*` can be verified at build time. Injecting integrity also means
@@ -198,16 +203,12 @@ async function checkResourceSupport(url, urlSupportCache, logger = null, trusted
       // served from, that turns a working script into a blocked one.
       const corsHeader = response.headers.get('access-control-allow-origin');
       if (corsHeader !== '*') {
-        if (logger) {
-          logger.warn(
-            `Skipping SRI for ${url}: Access-Control-Allow-Origin is ` +
-            `${corsHeader ? `"${corsHeader}", not "*"` : 'absent'}, so crossorigin="anonymous" ` +
-            'cannot be verified at build time. ' +
-            'Add the domain to bypassDomains to silence this.'
-          );
-        }
-        urlSupportCache.set(url, false);
-        return false
+        return reject(
+          `Skipping SRI for ${url}: Access-Control-Allow-Origin is ` +
+          `${corsHeader ? `"${corsHeader}", not "*"` : 'absent'}, so crossorigin="anonymous" ` +
+          'cannot be verified at build time. ' +
+          'Add the domain to bypassDomains to silence this.'
+        )
       }
 
       // Reachable and CORS-eligible is not the same property as byte-stable.
@@ -224,65 +225,14 @@ async function checkResourceSupport(url, urlSupportCache, logger = null, trusted
       // so a vary-based gate would let that resource straight through.
       const cacheControl = response.headers.get('cache-control');
       if (!trusted && !isImmutableResponse(cacheControl)) {
-        if (logger) {
-          logger.warn(
-            `Skipping SRI for ${url}: Cache-Control is ` +
-            `${cacheControl ? `"${cacheControl}"` : 'absent'}, so the origin does not declare ` +
-            'this URL immutable and its bytes may differ from the ones hashed here. Pin a ' +
-            'version in the URL, or add the domain to bypassDomains to accept it unprotected. ' +
-            'Only reach for trustDomains on a host you control - forcing a hash onto a ' +
-            "vendor's rolling URL ships a page that breaks on their next deploy."
-          );
-        }
-        urlSupportCache.set(url, false);
-        return false
-      }
-
-      urlSupportCache.set(url, true);
-      return true
-    } catch (error) {
-      lastError = error;
-      if (error.name === 'AbortError') {
-        if (logger) {
-          logger.warn(`Resource check timed out: ${url}`);
-        }
-        break // Don't retry timeouts
-      }
-
-      // Don't wait after the last failed attempt
-      if (attempt < retries) {
-        await new Promise(resolve => setTimeout(resolve, 1000 * attempt));
-      }
-    }
-  }
-
-  if (logger) {
-    logger.warn(`Failed to check resource support: ${url}`, lastError);
-  }
-  urlSupportCache.set(url, false);
-  return false
-}
-
-/**
- * Optimized resource fetching function with retry mechanism and caching
- */
-async function fetchResource(url, resourceCache, logger = null, retries = 1) {
-  // Check cache
-  if (resourceCache.has(url)) {
-    return resourceCache.get(url)
-  }
-
-  let lastError;
-  for (let attempt = 0; attempt <= retries; attempt++) {
-    try {
-      const controller = new AbortController();
-      const timeoutId = setTimeout(() => controller.abort(), DEFAULT_TIMEOUT);
-
-      const response = await fetch(url, { signal: controller.signal });
-      clearTimeout(timeoutId);
-
-      if (!response.ok) {
-        throw new Error(`HTTP error! status: ${response.status}`)
+        return reject(
+          `Skipping SRI for ${url}: Cache-Control is ` +
+          `${cacheControl ? `"${cacheControl}"` : 'absent'}, so the origin does not declare ` +
+          'this URL immutable and its bytes may differ from the ones hashed here. Pin a ' +
+          'version in the URL, or add the domain to bypassDomains to accept it unprotected. ' +
+          'Only reach for trustDomains on a host you control - forcing a hash onto a ' +
+          "vendor's rolling URL ships a page that breaks on their next deploy."
+        )
       }
 
       const data = new Uint8Array(await response.arrayBuffer());
@@ -291,21 +241,18 @@ async function fetchResource(url, resourceCache, logger = null, retries = 1) {
     } catch (error) {
       lastError = error;
       if (error.name === 'AbortError') {
-        if (logger) {
-          logger.warn(`Resource fetch timed out: ${url}`);
-        }
-        break // Don't retry timeouts
+        return reject(`Skipping SRI for ${url}: the request timed out.`)
       }
 
+      // Don't wait after the last failed attempt
       if (attempt < retries) {
         await new Promise(resolve => setTimeout(resolve, 1000 * attempt));
       }
     }
   }
 
-  if (logger) {
-    logger.warn(`Failed to fetch external resource: ${url}`, lastError);
-  }
+  logger.warn(`Skipping SRI for ${url}: the request failed.`, lastError);
+  resourceCache.set(url, null);
   return null
 }
 
@@ -378,14 +325,14 @@ function getBundleKey(htmlPath, url, config) {
  * `assets/vendor-main.js` - a cross-filename match would inject a valid-looking
  * but wrong hash, which the browser rejects with no build-time error.
  */
-function findBundleKey(bundle, bundleKey, logger = null) {
+function findBundleKey(bundle, bundleKey, logger) {
   const candidates = Object.keys(bundle).filter(key =>
     key === bundleKey ||
     key.endsWith(`/${bundleKey}`) ||
     bundleKey.endsWith(`/${key}`)
   );
 
-  if (candidates.length > 1 && logger) {
+  if (candidates.length > 1) {
     logger.warn(
       `Ambiguous bundle key for "${bundleKey}": ${candidates.join(', ')} - using ${candidates[0]}`
     );
@@ -419,17 +366,13 @@ async function readPublicAsset(config, bundleKey, logger) {
   // A URL must never reach outside publicDir, however it is spelled
   const relative = path.relative(publicDir, filePath);
   if (relative.startsWith('..') || path.isAbsolute(relative)) {
-    if (logger) {
-      logger.warn(`Refusing to read outside publicDir: ${bundleKey}`);
-    }
+    logger.warn(`Refusing to read outside publicDir: ${bundleKey}`);
     return null
   }
 
   try {
     const source = await readFile(filePath);
-    if (logger) {
-      logger.debug(`Resolved from publicDir: ${bundleKey}`);
-    }
+    logger.debug(`Resolved from publicDir: ${bundleKey}`);
     return source
   } catch {
     return null
@@ -446,7 +389,7 @@ async function calculateIntegrity(
   options,
   config,
   cacheManager,
-  logger = null
+  logger
 ) {
   const {
     ignoreMissingAsset,
@@ -477,17 +420,13 @@ async function calculateIntegrity(
   let bundleFileName = null;
   if (fetchUrl) {
     const trusted = matchesDomain(fetchUrl, trustDomains, logger);
-    const isSupported = await checkResourceSupport(
-      fetchUrl, cacheManager.getUrlSupportCache(), logger, trusted
+    source = await fetchVerifiedResource(
+      fetchUrl, cacheManager.getResourceCache(), logger, trusted
     );
-    if (!isSupported) return null
-    source = await fetchResource(fetchUrl, cacheManager.getResourceCache(), logger);
     if (!source) return null
   } else if (!ownAsset && SCHEME_RE.test(url)) {
     // data:/blob: and unknown schemes cannot be resolved to a bundle asset
-    if (logger) {
-      logger.debug(`Skipping URL that is not a bundle asset: ${url}`);
-    }
+    logger.debug(`Skipping URL that is not a bundle asset: ${url}`);
     return null
   } else {
     const bundleKey = getBundleKey(htmlPath, url, config);
@@ -500,9 +439,7 @@ async function calculateIntegrity(
       const possibleMatch = findBundleKey(bundle, bundleKey, logger);
 
       if (possibleMatch) {
-        if (logger) {
-          logger.debug(`Bundle key fallback: ${bundleKey} -> ${possibleMatch}`);
-        }
+        logger.debug(`Bundle key fallback: ${bundleKey} -> ${possibleMatch}`);
         bundleFileName = possibleMatch;
         source = bundleSource(bundle[possibleMatch]);
       } else {
@@ -511,11 +448,9 @@ async function calculateIntegrity(
 
         if (!source) {
           if (ignoreMissingAsset) {
-            if (logger) {
-              logger.warn(
-                `Asset not found in bundle or publicDir: ${url} (path: ${htmlPath}, key: ${bundleKey})`
-              );
-            }
+            logger.warn(
+              `Asset not found in bundle or publicDir: ${url} (path: ${htmlPath}, key: ${bundleKey})`
+            );
             return null
           }
           throw new Error(
@@ -566,7 +501,9 @@ const SRI_LINK_RELS = new Set(['stylesheet', 'modulepreload']);
 function getAttr(tag, re) {
   const match = tag.match(re);
   if (!match) return null
-  return match[1] ?? match[2] ?? match[3] ?? null
+  // One of the three alternatives matched or the regex would not have, and an
+  // empty value is a string rather than undefined - so there is no fourth case.
+  return match[1] ?? match[2] ?? match[3]
 }
 
 const HTML_PATTERNS = {
@@ -818,9 +755,7 @@ async function transformHTML(
 function createTransformer(options, config, cacheManager, logger) {
   return {
     transformHTML: (bundle, htmlPath, html) =>
-      transformHTML(bundle, htmlPath, html, options, config, cacheManager, logger),
-    calculateIntegrity: (bundle, htmlPath, url) =>
-      calculateIntegrity(bundle, htmlPath, url, options, config, cacheManager, logger)
+      transformHTML(bundle, htmlPath, html, options, config, cacheManager, logger)
   }
 }
 
@@ -891,13 +826,6 @@ class Logger {
       console.debug(...this.formatMessage(message, ...args));
     }
   }
-
-  /**
-   * Create a child logger with the same configuration
-   */
-  child(name) {
-    return new Logger(this.logLevel, `${this.pluginName}:${name}`)
-  }
 }
 
 // Vite 6/7 uses `vite:build-import-analysis`; Vite 8 Rolldown native path adds

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vite-plugin-sri4",
-  "version": "5.0.0",
+  "version": "5.1.1",
   "description": "A Vite plugin to generate Subresource Integrity (SRI) hashes for output files.",
   "type": "module",
   "main": "./dist/index.cjs",
@@ -24,7 +24,8 @@
     "test": "vitest run",
     "test:watch": "vitest",
     "test:coverage": "vitest run --coverage",
-    "prepublishOnly": "npm run build"
+    "prepublishOnly": "npm run build",
+    "test:mutation": "stryker run"
   },
   "peerDependencies": {
     "vite": "^6.4.0 || ^7.0.0 || ^8.0.0"
@@ -32,6 +33,8 @@
   "devDependencies": {
     "@rollup/plugin-commonjs": "^29.0.3",
     "@rollup/plugin-node-resolve": "^16.0.3",
+    "@stryker-mutator/core": "^10.0.0",
+    "@stryker-mutator/vitest-runner": "^10.0.0",
     "@vitest/coverage-v8": "^5.0.0",
     "oxlint": "^1.82.0",
     "rollup": "^4.63.1",