Integration guide

File	Use it when
vite.esm-browser.js	You want readable sources and stack traces that point at real lines. Larger; fine for a local reproduction.
vite.esm-browser.min.js	Default choice. Same exports, minified, roughly a third of the transfer.
client.mjs	You are reproducing HMR behaviour and need the client half of the dev-server websocket.
env.mjs	Something in your snippet reads import.meta.env and you are not running a dev server to define it.

Every file is an ES module. There is no UMD or IIFE build here — loading one with a plain <script> tag without type="module" will throw on the first export.

Bare specifiers keep the rest of your snippet identical to what a bundled project would contain, which makes copy-pasting a reproduction in and out of a real project much less annoying. Declare the map before any module script:

<script type="importmap">
{
  "imports": {
    "vite": "https://vite.cdnwave.org/v/7.3.1/vite.esm-browser.min.js",
    "vite/client": "https://vite.cdnwave.org/v/7.3.1/client.mjs"
  }
}
</script>

<script type="module">
  import { defineConfig } from "vite";
</script>

An import map cannot carry an integrity value. If you need SRI, reference the full URL directly in a <script type="module" src="..."> tag, or add a matching <link rel="modulepreload"> with the digest set — the preload is what gets verified, and the later import is served from that entry.

URLs carry the version as a path segment, /v/<semver>/<file>. Contents behind a pinned URL never change:

https://vite.cdnwave.org/v/7.3.1/vite.esm-browser.min.js

The rolling alias repoints whenever a new release is mirrored. It is convenient in a bug report — the reader always gets current code — and wrong everywhere else, because its bytes and therefore its digest change under you:

https://vite.cdnwave.org/latest/vite.esm-browser.min.js

Requesting a version that was never published returns 404 rather than falling back to a nearby one. Check the exact string against the version table first.

Each pinned file has a published sha384 digest on the overview and in the version table. Recompute it from the bytes you actually received:

curl -sS https://vite.cdnwave.org/v/7.3.1/vite.esm-browser.min.js \
  | openssl dgst -sha384 -binary | openssl base64 -A

Then put the value in the tag:

<script type="module"
  src="https://vite.cdnwave.org/v/7.3.1/vite.esm-browser.min.js"
  integrity="sha384-8tVEeHFKx6cc9AsSJg3v4eZ1dwAUM+NqfCxCey+88+0y7CvDuNi5YqBMHGpZqT5A"
  crossorigin="anonymous"></script>

A digest that does not match blocks execution instead of running modified code. Keep crossorigin="anonymous" in place — without it the response is opaque to the integrity check and the browser skips verification rather than failing loudly.

Path	Cache-Control	Notes
/v/<version>/*	public, max-age=31536000, immutable	Content-addressed by version. Cached indefinitely at the edge and in the browser; revalidation never fires.
/latest/*	public, max-age=300	Short TTL so a new release shows up within minutes. Weak ETag included for conditional requests.
/*.html	public, max-age=600	These pages. Regenerated when the mirror index changes.

Responses are compressed with brotli when the request advertises it and gzip otherwise; sizes quoted elsewhere on this site are the gzip figures.

Static artifacts are served with Access-Control-Allow-Origin: *, so cross-origin fetch() and dynamic import() work without a proxy in front. No cookies are set and none are read; requests carry no credentials, which is also what makes the anonymous SRI check above valid.

HTTP/2 is negotiated where the client supports it, and range requests are honoured for the larger unminified bundle.

Symptom	Usual cause
Unexpected token 'export'	Missing type="module" on the script tag.
Integrity check failed, pinned URL	Digest copied from a different version's row; compare against the table.
Integrity check failed, /latest/ URL	Expected — the alias moved to a new release. Pin instead.
import.meta.env is undefined	Load env.mjs first, or pin a 7.x release where it ships.