tags:afterResolve Hook

The tags:afterResolve hook is the final hook in the tag-resolution chain. It runs after tags:resolve, but before Unhead removes invalid or empty tags and escapes inline script content.

Both the DOM and SSR renderers use the resulting sanitized array.

Hook Signature

export interface Hook {
  'tags:afterResolve': (ctx: TagResolveContext) => SyncHookResult
}

interface TagResolveContext {
  tagMap: Map<string, HeadTag>
  tags: HeadTag[]
}

This hook is synchronous. Use ctx.tags to change membership or order. Do not implement your own </script> escaping here; the resolver performs that sanitization after the hook.

Usage Example

import { defineHeadPlugin } from 'unhead/plugins'

const integrityManagedScripts = new Set([
  'https://cdn.example.com/widget/4.2.0/widget.min.js',
])

export const reportMissingIntegrityPlugin = defineHeadPlugin({
  key: 'report-missing-integrity',
  hooks: {
    'tags:afterResolve': ({ tags }) => {
      for (const tag of tags) {
        if (tag.tag === 'script' && integrityManagedScripts.has(tag.props.src) && !tag.props.integrity)
          console.warn(`Integrity-managed script has no integrity attribute: ${tag.props.src}`)
      }
    }
  }
})

Keep the allowlist limited to version-pinned assets whose deployed bytes are immutable. For cross-origin scripts, add crossorigin: 'anonymous' to the tag and ensure the response sends an appropriate Access-Control-Allow-Origin header; otherwise SRI cannot verify the resource. Subresource Integrity blocks a resource when its bytes no longer match the recorded hash, so it is a poor fit for mutable or unversioned URLs. See MDN's Subresource Integrity guide.