@appshell/loader 1.0.0-alpha.0 → 1.0.0-alpha.10

package/CHANGELOG.md

@@ -3,28 +3,45 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
-# 1.0.0-alpha.0 (2026-08-18)
+# [1.0.0-alpha.10](https://github.com/appshell-org/appshell/compare/v1.0.0-alpha.9...v1.0.0-alpha.10) (2026-08-19)
+
+**Note:** Version bump only for package @appshell/loader
+
+# [1.0.0-alpha.9](https://github.com/appshell-org/appshell/compare/v1.0.0-alpha.8...v1.0.0-alpha.9) (2026-08-19)
 
 ### Bug Fixes
 
-- appshell loader override check ([aedda4a](https://github.com/appshell-org/appshell/commit/aedda4abf81560297dce03df09fba68e8785242f))
-- configurable api key header support, minor fixes ([2f0bf02](https://github.com/appshell-org/appshell/commit/2f0bf027b92398f91b8e8cbfbf543d61fe37b7a0))
-- hot module replacement support, example updates ([a67d230](https://github.com/appshell-org/appshell/commit/a67d2303b40f5911373225cc0b4ccf9b67c33d11))
-- registry projection, enable env overwrite, refactor docker workflow, consolidate env names ([33a28fe](https://github.com/appshell-org/appshell/commit/33a28fe76b58e05c5b6b6b33d4b402e52bb29e70))
-- rename @appshell/react-federated-component package to @appshell/react ([0b74498](https://github.com/appshell-org/appshell/commit/0b74498bf17ba73db4d936c8a012af1d3b111a28))
-- replace config intermediate file with template ([9b79e65](https://github.com/appshell-org/appshell/commit/9b79e65b355686a0cca273c89c7164bb031e8437))
-- resolve npm audit vulnerabilities (74 → 4) ([36a2d56](https://github.com/appshell-org/appshell/commit/36a2d56a76dabd55a6886ddb9f020948420fd832))
+- **example:** resolve CSP/module-federation issues blocking local dev ([f8de4e1](https://github.com/appshell-org/appshell/commit/f8de4e1cfe495a7d4ae8e6374189384847c21309))
 
-### Features
+# [1.0.0-alpha.8](https://github.com/appshell-org/appshell/compare/v1.0.0-alpha.7...v1.0.0-alpha.8) (2026-08-19)
 
-- api key support ([9cdcbee](https://github.com/appshell-org/appshell/commit/9cdcbee36e44b8a179b49768d74a25767f1cc5f2))
-- appshell cli api key support, init sync and outdated commands ([#6](https://github.com/appshell-org/appshell/issues/6)) ([acc5fa2](https://github.com/appshell-org/appshell/commit/acc5fa234f91a167038161d5080481c43f8eb8b4))
-- AppshellComponent impl ([2b82621](https://github.com/appshell-org/appshell/commit/2b82621c13302f790a8e1c457f9a82f39903fc1f))
-- **config:** carry the host root and its props in the composition ([ca9ed63](https://github.com/appshell-org/appshell/commit/ca9ed630a5a22cb62d6630b5f191d15c54f1c595))
-- consolidate runtime artifacts ([#26](https://github.com/appshell-org/appshell/issues/26)) ([a29479a](https://github.com/appshell-org/appshell/commit/a29479a49f0c5ec1273c9f8e4c7384096f2d4ba0))
-- environment variable override for federated components ([#27](https://github.com/appshell-org/appshell/issues/27)) ([d32de0b](https://github.com/appshell-org/appshell/commit/d32de0b0d1cbb1792715e1b363c80ed4600df155))
-- foundation refactor wip ([339b930](https://github.com/appshell-org/appshell/commit/339b9306accaa9aba1712f3a0dee6c4cab7ed273))
-- **loader:** pin the runtime wire contract and add a resolver chain ([95dbb10](https://github.com/appshell-org/appshell/commit/95dbb10d2bd0a7c2429852839c8be352a2c1bbe8))
+**Note:** Version bump only for package @appshell/loader
+
+# [1.0.0-alpha.7](https://github.com/appshell-org/appshell/compare/v1.0.0-alpha.6...v1.0.0-alpha.7) (2026-08-18)
+
+**Note:** Version bump only for package @appshell/loader
+
+**Note:** Version bump only for package @appshell/loader
+
+# [1.0.0-alpha.6](https://github.com/appshell-org/appshell/compare/v1.0.0-alpha.5...v1.0.0-alpha.6) (2026-08-18)
+
+**Note:** Version bump only for package @appshell/loader
+
+# [1.0.0-alpha.5](https://github.com/appshell-org/appshell/compare/v1.0.0-alpha.4...v1.0.0-alpha.5) (2026-08-18)
+
+**Note:** Version bump only for package @appshell/loader
+
+**Note:** Version bump only for package @appshell/loader
+
+# [1.0.0-alpha.4](https://github.com/appshell-org/appshell/compare/v1.0.0-alpha.3...v1.0.0-alpha.4) (2026-08-18)
+
+**Note:** Version bump only for package @appshell/loader
+
+**Note:** Version bump only for package @appshell/loader
+
+# [1.0.0-alpha.3](https://github.com/appshell-org/appshell/compare/v1.0.0-alpha.2...v1.0.0-alpha.3) (2026-08-18)
+
+**Note:** Version bump only for package @appshell/loader
 
 # 0.12.0-alpha.0 (2026-04-20)
 

package/dist/main.js

@@ -1 +1 @@
-!function(e,t){if("object"==typeof exports&&"object"==typeof module)module.exports=t();else if("function"==typeof define&&define.amd)define([],t);else{var n=t();for(var o in n)("object"==typeof exports?exports:e)[o]=n[o]}}(self,(()=>(()=>{"use strict";var e={d:(t,n)=>{for(var o in n)e.o(n,o)&&!e.o(t,o)&&Object.defineProperty(t,o,{enumerable:!0,get:n[o]})},o:(e,t)=>Object.prototype.hasOwnProperty.call(e,t),r:e=>{"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})}};(()=>{e.S={};var t={},n={};e.I=(o,r)=>{r||(r=[]);var a=n[o];if(a||(a=n[o]={}),!(r.indexOf(a)>=0)){if(r.push(a),t[o])return t[o];e.o(e.S,o)||(e.S[o]={}),e.S[o];var i=[];return t[o]=i.length?Promise.all(i).then((()=>t[o]=1)):1}}})();var t={};e.r(t),e.d(t,{chainResolvers:()=>l,default:()=>m,inlineResolver:()=>i,legacyManifestResolver:()=>s,registryResolver:()=>c});const n=new Set,o=async e=>{const t=document.createElement("script");return new Promise(((o,r)=>{n.has(e)?o(!1):(n.add(e),t.src=e,t.type="text/javascript",t.async=!0,t.onload=()=>{console.debug(`Remote entry fetched from '${e}'.`),o(!0)},t.onerror=()=>{const t=`Failed to fetch remote entry from '${e}'.`;console.error(t),n.delete(e),r(t)},document.head.appendChild(t))})).finally((()=>{document.head.contains(t)&&document.head.removeChild(t)}))};(Object.getOwnPropertyDescriptor(o,"name")||{}).writable||Object.defineProperty(o,"name",{value:"default",configurable:!0});const r=async(t,n,o="default")=>{console.debug(`loading Appshell component: { scope: ${t}, module: ${n}, shareScope: ${o} }`),await e.I(o);const r=window[t];if(!r)throw new Error(`Failed to find module container ${t}`);await r.init(e.S[o]);const a=await r.get(n);if(!a)throw new Error(`Invalid factory produced by container for module ${n}.`);const i=a();return console.debug(`Appshell component loaded: { scope: ${t}, module: ${n}, shareScope: ${o} }`),i.default};(Object.getOwnPropertyDescriptor(r,"name")||{}).writable||Object.defineProperty(r,"name",{value:"default",configurable:!0});const a=(e,t)=>({remotes:t,environment:e.environment,modules:{}}),i=e=>async t=>{const n=e?.remotes[t];if(e&&n)return{remote:n,environment:e.environment[n.scope]??{},manifest:a(e,e.remotes)}},c=(e,t="")=>async n=>{if(!e)return;const o=`${t}/v1/environments/${e.environmentId}/remotes/${n}`,r=await fetch(o,{credentials:"include"});if(!r.ok)return;const i=await r.json();return{remote:i,environment:e.environment[i.scope]??{},manifest:a(e,{[n]:i})}},s=e=>{const t=new Map;return async n=>{const o=e.index?.[n];if(!o)return;const r=await(e=>{const n=t.get(e);if(n)return n;const o=fetch(e,{credentials:"include"}).then((async t=>{if(!t.ok)throw new Error(`Failed to get manifest from ${e}. ${await t.text()}`);return t.json()}));return t.set(e,o),o})(o),a=r?.remotes[n];return a?{remote:a,environment:{...r.environment[a.scope]??{},...e.overrides?.environment?.[a.scope]??{}},manifest:r}:void 0}},l=(...e)=>async t=>{for(const n of e){const e=await n(t);if(e)return e}},d=new Set,f=(e,t={})=>{const n=t.composition??("undefined"==typeof window?void 0:window.__appshell_config__),a=t.resolver??l(i(n),c(n),s(e));return async e=>{const t=t=>new Error(`Failed to load component '${e}'. ${t?.toString()}`);let n;try{n=await a(e)}catch(e){throw t(e)}if(!n)throw new Error(`Remote resource not found in registry. Expected: ${e}`);const{remote:i,environment:c,manifest:s}=n;try{return window[`__appshell_env__${i.scope}`]=c,d.has(i.remoteEntryUrl)||await o(i.remoteEntryUrl)?(d.add(i.remoteEntryUrl),[await r(i.scope,i.module,i.shareScope),s]):[null,null]}catch(e){throw t(e)}}};(Object.getOwnPropertyDescriptor(f,"name")||{}).writable||Object.defineProperty(f,"name",{value:"default",configurable:!0});const m=f;return t})()));
+!function(e,t){if("object"==typeof exports&&"object"==typeof module)module.exports=t();else if("function"==typeof define&&define.amd)define([],t);else{var n=t();for(var o in n)("object"==typeof exports?exports:e)[o]=n[o]}}(self,(()=>(()=>{"use strict";var e={d:(t,n)=>{for(var o in n)e.o(n,o)&&!e.o(t,o)&&Object.defineProperty(t,o,{enumerable:!0,get:n[o]})},o:(e,t)=>Object.prototype.hasOwnProperty.call(e,t),r:e=>{"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})}};(()=>{e.S={};var t={},n={};e.I=(o,r)=>{r||(r=[]);var i=n[o];if(i||(i=n[o]={}),!(r.indexOf(i)>=0)){if(r.push(i),t[o])return t[o];e.o(e.S,o)||(e.S[o]={}),e.S[o];var a=[];return t[o]=a.length?Promise.all(a).then((()=>t[o]=1)):1}}})();var t={};e.r(t),e.d(t,{chainResolvers:()=>l,default:()=>m,inlineResolver:()=>a,legacyManifestResolver:()=>s,registryResolver:()=>c});const n=new Set,o=async e=>{const t=document.createElement("script"),o=document.querySelector("script[nonce]")?.nonce;return o&&(t.nonce=o),new Promise(((o,r)=>{n.has(e)?o(!1):(n.add(e),t.src=e,t.type="text/javascript",t.async=!0,t.onload=()=>{console.debug(`Remote entry fetched from '${e}'.`),o(!0)},t.onerror=()=>{const t=`Failed to fetch remote entry from '${e}'.`;console.error(t),n.delete(e),r(t)},document.head.appendChild(t))})).finally((()=>{document.head.contains(t)&&document.head.removeChild(t)}))};(Object.getOwnPropertyDescriptor(o,"name")||{}).writable||Object.defineProperty(o,"name",{value:"default",configurable:!0});const r=async(t,n,o="default")=>{console.debug(`loading Appshell component: { scope: ${t}, module: ${n}, shareScope: ${o} }`),await e.I(o);const r=window[t];if(!r)throw new Error(`Failed to find module container ${t}`);await r.init(e.S[o]);const i=await r.get(n);if(!i)throw new Error(`Invalid factory produced by container for module ${n}.`);const a=i();return console.debug(`Appshell component loaded: { scope: ${t}, module: ${n}, shareScope: ${o} }`),a.default};(Object.getOwnPropertyDescriptor(r,"name")||{}).writable||Object.defineProperty(r,"name",{value:"default",configurable:!0});const i=(e,t)=>({remotes:t,environment:e.environment,modules:{}}),a=e=>async t=>{const n=e?.remotes[t];if(e&&n)return{remote:n,environment:e.environment[n.scope]??{},manifest:i(e,e.remotes)}},c=(e,t="")=>async n=>{if(!e)return;const o=`${t}/v1/environments/${e.environmentId}/remotes/${n}`,r=await fetch(o,{credentials:"include"});if(!r.ok)return;const a=await r.json();return{remote:a,environment:e.environment[a.scope]??{},manifest:i(e,{[n]:a})}},s=e=>{const t=new Map;return async n=>{const o=e.index?.[n];if(!o)return;const r=await(e=>{const n=t.get(e);if(n)return n;const o=fetch(e,{credentials:"include"}).then((async t=>{if(!t.ok)throw new Error(`Failed to get manifest from ${e}. ${await t.text()}`);return t.json()}));return t.set(e,o),o})(o),i=r?.remotes[n];return i?{remote:i,environment:{...r.environment[i.scope]??{},...e.overrides?.environment?.[i.scope]??{}},manifest:r}:void 0}},l=(...e)=>async t=>{for(const n of e){const e=await n(t);if(e)return e}},d=new Set,f=(e,t={})=>{const n=t.composition??("undefined"==typeof window?void 0:window.__appshell_config__),i=t.resolver??l(a(n),c(n),s(e));return async e=>{const t=t=>new Error(`Failed to load component '${e}'. ${t?.toString()}`);let n;try{n=await i(e)}catch(e){throw t(e)}if(!n)throw new Error(`Remote resource not found in registry. Expected: ${e}`);const{remote:a,environment:c,manifest:s}=n;try{return window[`__appshell_env__${a.scope}`]=c,d.has(a.remoteEntryUrl)||await o(a.remoteEntryUrl)?(d.add(a.remoteEntryUrl),[await r(a.scope,a.module,a.shareScope),s]):[null,null]}catch(e){throw t(e)}}};(Object.getOwnPropertyDescriptor(f,"name")||{}).writable||Object.defineProperty(f,"name",{value:"default",configurable:!0});const m=f;return t})()));

package/dist/types/config/src/context.d.ts

@@ -0,0 +1,23 @@
+export type AppshellContext = {
+    registry?: string;
+    /** Activation target as `scope/name`. */
+    environment?: string;
+    scopeId: string;
+    token?: string;
+};
+/**
+ * The registry, environment, and token a developer is working against, resolved
+ * the way the CLI resolves them: env var, then `~/.appshell/config`, then a
+ * default. This lets the webpack plugin defer to `appshell config set` and
+ * `appshell login` instead of requiring per-project configuration.
+ */
+export declare const resolveContext: () => AppshellContext;
+/**
+ * What `~/.appshell/config` alone declares, so a caller can warn when an env var
+ * or an explicit option points somewhere other than the developer's CLI context.
+ */
+export declare const persistedContext: () => {
+    registry?: string;
+    environment?: string;
+};
+//# sourceMappingURL=context.d.ts.map

package/dist/types/config/src/context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../../../../../config/src/context.ts"],"names":[],"mappings":"AAKA,MAAM,MAAM,eAAe,GAAG;IAC5B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,yCAAyC;IACzC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAaF;;;;;GAKG;AACH,eAAO,MAAM,cAAc,QAAO,eAQjC,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,gBAAgB,QAAO;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAK5E,CAAC"}

package/dist/types/config/src/credentials.d.ts

@@ -0,0 +1,16 @@
+export type Credential = {
+    accessToken: string;
+    refreshToken?: string;
+    /** Epoch milliseconds. */
+    expiresAt?: number;
+};
+export declare const credentialsPath: () => string;
+export declare const saveCredential: (registry: string, credential: Credential) => void;
+export declare const clearCredential: (registry: string) => void;
+/**
+ * APPSHELL_TOKEN wins so CI never depends on a writable home directory.
+ * Expired tokens are treated as absent; refresh is the caller's concern.
+ */
+export declare const resolveToken: (registry: string) => string | undefined;
+export declare const requireToken: (registry: string) => string;
+//# sourceMappingURL=credentials.d.ts.map

package/dist/types/config/src/credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../../../../../config/src/credentials.ts"],"names":[],"mappings":"AAKA,MAAM,MAAM,UAAU,GAAG;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,0BAA0B;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAKF,eAAO,MAAM,eAAe,cAC6D,CAAC;AAqB1F,eAAO,MAAM,cAAc,aAAc,MAAM,cAAc,UAAU,SAEtE,CAAC;AAEF,eAAO,MAAM,eAAe,aAAc,MAAM,SAI/C,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,YAAY,aAAc,MAAM,KAAG,MAAM,GAAG,SAexD,CAAC;AAEF,eAAO,MAAM,YAAY,aAAc,MAAM,KAAG,MAO/C,CAAC"}

package/dist/types/config/src/index.d.ts

@@ -2,6 +2,10 @@
  * @appshell/config package API
  */
 export { default as configmap } from './configmap';
+export { persistedContext, resolveContext } from './context';
+export type { AppshellContext } from './context';
+export { clearCredential, credentialsPath, requireToken, resolveToken, saveCredential, } from './credentials';
+export type { Credential } from './credentials';
 export { default as deregister } from './deregister';
 export { default as generateEnv } from './generate.env';
 export { default as generateGlobalConfig } from './generate.global-config';

package/dist/types/config/src/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../config/src/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,EAAE,OAAO,IAAI,SAAS,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,EAAE,OAAO,IAAI,UAAU,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,gBAAgB,CAAC;AACxD,OAAO,EAAE,OAAO,IAAI,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAC3E,OAAO,EAAE,OAAO,IAAI,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAClE,OAAO,EAAE,OAAO,IAAI,QAAQ,EAAE,MAAM,YAAY,CAAC;AACjD,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC9C,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAC/D,OAAO,EAAE,OAAO,IAAI,QAAQ,EAAE,MAAM,YAAY,CAAC;AACjD,OAAO,EAAE,OAAO,IAAI,IAAI,EAAE,MAAM,QAAQ,CAAC;AACzC,YAAY,EACV,mBAAmB,EACnB,cAAc,EACd,oBAAoB,EACpB,oBAAoB,EACpB,aAAa,EACb,gBAAgB,EAChB,cAAc,EACd,gBAAgB,EAChB,gBAAgB,EAChB,iBAAiB,EACjB,gBAAgB,EAChB,QAAQ,EACR,6BAA6B,EAC7B,WAAW,EACX,cAAc,EACd,MAAM,EACN,gBAAgB,GACjB,MAAM,SAAS,CAAC;AACjB,OAAO,KAAK,KAAK,MAAM,SAAS,CAAC;AACjC,OAAO,KAAK,UAAU,MAAM,cAAc,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../config/src/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,EAAE,OAAO,IAAI,SAAS,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAC7D,YAAY,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AACjD,OAAO,EACL,eAAe,EACf,eAAe,EACf,YAAY,EACZ,YAAY,EACZ,cAAc,GACf,MAAM,eAAe,CAAC;AACvB,YAAY,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAE,OAAO,IAAI,UAAU,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,gBAAgB,CAAC;AACxD,OAAO,EAAE,OAAO,IAAI,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAC3E,OAAO,EAAE,OAAO,IAAI,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAClE,OAAO,EAAE,OAAO,IAAI,QAAQ,EAAE,MAAM,YAAY,CAAC;AACjD,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC9C,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAC/D,OAAO,EAAE,OAAO,IAAI,QAAQ,EAAE,MAAM,YAAY,CAAC;AACjD,OAAO,EAAE,OAAO,IAAI,IAAI,EAAE,MAAM,QAAQ,CAAC;AACzC,YAAY,EACV,mBAAmB,EACnB,cAAc,EACd,oBAAoB,EACpB,oBAAoB,EACpB,aAAa,EACb,gBAAgB,EAChB,cAAc,EACd,gBAAgB,EAChB,gBAAgB,EAChB,iBAAiB,EACjB,gBAAgB,EAChB,QAAQ,EACR,6BAA6B,EAC7B,WAAW,EACX,cAAc,EACd,MAAM,EACN,gBAAgB,GACjB,MAAM,SAAS,CAAC;AACjB,OAAO,KAAK,KAAK,MAAM,SAAS,CAAC;AACjC,OAAO,KAAK,UAAU,MAAM,cAAc,CAAC"}

package/dist/types/config/src/publish.d.ts

@@ -7,6 +7,8 @@ export type PublishOptions = {
     manifest: AppshellManifest;
     visibility?: 'public' | 'private';
     metadata?: Metadata;
+    /** Ask the registry to overwrite an existing version whose content differs. */
+    force?: boolean;
 };
 export type PublishResult = {
     /** `scope/name@version`. The scope comes from the token, not the caller. */
@@ -15,9 +17,10 @@ export type PublishResult = {
 };
 /**
  * Publishing the same content twice is a no-op; publishing different content
- * under a version that already exists is rejected by the registry.
+ * under a version that already exists is rejected by the registry, unless
+ * `force` is set and the registry is configured to honor it (dev registries).
  */
-export declare const publish: ({ registry, token, name, version, manifest, visibility, metadata, }: PublishOptions) => Promise<PublishResult>;
+export declare const publish: ({ registry, token, name, version, manifest, visibility, metadata, force, }: PublishOptions) => Promise<PublishResult>;
 /**
  * Activating a newer version of an already active app upgrades it in place.
  * @param environment `scope/name`

package/dist/types/config/src/publish.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"publish.d.ts","sourceRoot":"","sources":["../../../../../config/src/publish.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAErD,MAAM,MAAM,cAAc,GAAG;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,UAAU,CAAC,EAAE,QAAQ,GAAG,SAAS,CAAC;IAClC,QAAQ,CAAC,EAAE,QAAQ,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,aAAa,GAAG;IAC1B,4EAA4E;IAC5E,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,OAAO,CAAC;CAClB,CAAC;AAmBF;;;GAGG;AACH,eAAO,MAAM,OAAO,wEAQjB,cAAc,KAAG,OAAO,CAAC,aAAa,CAYxC,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,QAAQ,aACT,MAAM,eACH,MAAM,SACZ,MAAM,UACL,MAAM,KACb,OAAO,CAAC,IAAI,CAgBd,CAAC"}
+{"version":3,"file":"publish.d.ts","sourceRoot":"","sources":["../../../../../config/src/publish.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAErD,MAAM,MAAM,cAAc,GAAG;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,UAAU,CAAC,EAAE,QAAQ,GAAG,SAAS,CAAC;IAClC,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,+EAA+E;IAC/E,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB,CAAC;AAEF,MAAM,MAAM,aAAa,GAAG;IAC1B,4EAA4E;IAC5E,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,OAAO,CAAC;CAClB,CAAC;AAmBF;;;;GAIG;AACH,eAAO,MAAM,OAAO,+EASjB,cAAc,KAAG,OAAO,CAAC,aAAa,CAYxC,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,QAAQ,aACT,MAAM,eACH,MAAM,SACZ,MAAM,UACL,MAAM,KACb,OAAO,CAAC,IAAI,CAgBd,CAAC"}

package/dist/types/loader/src/fetchDynamicScript.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fetchDynamicScript.d.ts","sourceRoot":"","sources":["../../../../src/fetchDynamicScript.ts"],"names":[],"mappings":"8BAE2B,MAAM;AAAjC,wBAqCE"}
+{"version":3,"file":"fetchDynamicScript.d.ts","sourceRoot":"","sources":["../../../../src/fetchDynamicScript.ts"],"names":[],"mappings":"8BAM2B,MAAM;AAAjC,wBA0CE"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@appshell/loader",
-  "version": "1.0.0-alpha.0",
+  "version": "1.0.0-alpha.10",
   "description": "Utility for loading Appshell components",
   "main": "dist/main.js",
   "types": "dist/loader/src/index.d.ts",
@@ -24,5 +24,5 @@
     "appshell"
   ],
   "license": "MIT",
-  "gitHead": "97ee53524d5c729308f49adca6c613d68a262179"
+  "gitHead": "0af7909493bfba483afdfdf0665834e6a8e4b591"
 }

package/src/fetchDynamicScript.ts

@@ -1,7 +1,16 @@
 const urlCache = new Set<string>();
 
+/** Propagates the shell's CSP nonce so browsers that don't trust strict-dynamic propagation still allow it. */
+const cspNonce = (): string | undefined =>
+  document.querySelector<HTMLScriptElement>('script[nonce]')?.nonce;
+
 export default async (url: string) => {
   const element = document.createElement('script');
+  const nonce = cspNonce();
+
+  if (nonce) {
+    element.nonce = nonce;
+  }
 
   const cleanup = (): void => {
     if (document.head.contains(element)) {