[katayama8000]

Closes #2.

The attributes were fixed, so a crossorigin, a nonce, or a data- attribute a CDN or a monitoring tool asks for meant giving up on ViteAssets and building the markup by hand out of tags().

ViteAssets.builder(manifest)
        .scriptAttribute("crossorigin", "anonymous")
        .scriptAttribute("async")
        .styleAttribute("data-turbo-track", "reload")
        .build();

<link rel="stylesheet" href="/assets/main.css" data-turbo-track="reload">
<script type="module" src="/assets/main.js" crossorigin="anonymous" async></script>

The three questions in the issue

Can an attribute be a flag with no value? Yes, through an overload taking the name alone. Laravel spells this 'async' => true, which reads as a value that happens to mean "no value"; a separate method says it directly and cannot be confused with the string "true".

Is anything refused? The attributes vite4j writes itself: src and type on the script, href and rel on the stylesheets. The issue named src and href; type and rel are there for the same reason, since a <script> that is no longer a module, or a <link> that is no longer a stylesheet, is as quietly broken as one pointing somewhere else. It throws from the builder call rather than at render time, so the stack trace names the line that asked for it.

Names are checked too. A value can be escaped on the way out, a name cannot, so anything that is not an attribute name — "one two", "onload=alert(1) x", a name carrying a quote — is refused rather than concatenated into the tag.

Escaping. Values go through Html.attribute, the same escaping the URLs already get.

Also decided

Attributes render in the order they were added, and adding a name twice keeps the last value. Both are asserted, so neither can drift into being accidental.

Not in here

Preload tags take no attributes yet. Laravel has usePreloadTagAttributes, and modulepreload is a tag that plausibly wants a crossorigin. It is left out because the issue named the two tag kinds it wanted and I would rather you decide whether the third belongs than invent API for it. The rendering is shared, so adding it later is a builder method and a map.

#3 has room. Integrity hashes also add attributes to these tags. Nothing here claims integrity or crossorigin, so that work can set them alongside whatever the application added.

Tests

Eleven new in ViteAssetsTest, 17 in the file now: both tag kinds, the bare attribute, order, last-value-wins, escaping, every refused name, and that the script and style sets stay apart. ./gradlew build passes.

README and README.ja.md document it under Options.