fix: hash finalized public assets for SRI

[maximtrp]

Types of changes

• Bug fix (a non-breaking change which fixes an issue)
• New feature (a non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)

Description

I moved public asset hashing into the async #sri-hashes virtual module factory. Nitro loads this after rollup:before, so SRI hashes are now calculated from the final asset contents.

Previously, nuxt-security generated the manifest in nitro:build:before. This was too early for modules such as @nuxt/fonts, which creates empty font placeholders first and writes the real font data in rollup:before. Nuxt-security therefore hashed the empty files, and browsers rejected the finished fonts because their integrity values did not match.

I noticed this while using @nuxt/fonts: every generated font preload failed in the browser with Failed to find a valid digest in the 'integrity' attribute. The emitted integrity value started with sha384-OLBgp1Gsljh..., which is the SHA-384 digest of an empty file, rather than the digest of the final .woff2 file.

This fix also covers other modules that finalize public assets at the same stage.

I added a regression test that creates an empty public asset, replaces it in rollup:before, and checks that the emitted integrity value matches the final contents.

I confirmed that the test fails with the previous implementation, which emits the known empty-file digest (sha384-OLBgp1Gsljh...).

• yarn lint
• yarn test (155 passed, 1 skipped)
• yarn prepack

Checklist:

• My change requires a change to the documentation.
• I have updated the documentation accordingly.
• I have added tests to cover my changes (if not applicable, please state why)

[vercel]

@maximtrp is attempting to deploy a commit to the Baroshem's projects Team on Vercel.

A member of the Team first needs to authorize it.