Entry and error contract

One public module entry exports one function per plugin plus its option/callback types. Scanning, rendering, transformation, and measurement helpers remain internal.

Runtime option validation applies to JavaScript and dynamically built configurations. Only undefined means omitted; invalid falsy values such as null and empty strings are rejected.

Keep subresourceIntegrity → bundleBudget → compression order; configuration resolution diagnoses reversals. See the risk guide for deployment and trust boundaries.

Import each plugin explicitly into Vite plugins; none is enabled implicitly. Place SRI before budgets and compression so compressed HTML includes final integrity attributes.