@appshell/loader 1.0.0-alpha.8 → 1.0.0-alpha.9

package/CHANGELOG.md

@@ -3,6 +3,12 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# [1.0.0-alpha.9](https://github.com/appshell-org/appshell/compare/v1.0.0-alpha.8...v1.0.0-alpha.9) (2026-08-19)
+
+### Bug Fixes
+
+- **example:** resolve CSP/module-federation issues blocking local dev ([f8de4e1](https://github.com/appshell-org/appshell/commit/f8de4e1cfe495a7d4ae8e6374189384847c21309))
+
 # [1.0.0-alpha.8](https://github.com/appshell-org/appshell/compare/v1.0.0-alpha.7...v1.0.0-alpha.8) (2026-08-19)
 
 **Note:** Version bump only for package @appshell/loader

package/dist/main.js

@@ -1 +1 @@
-!function(e,t){if("object"==typeof exports&&"object"==typeof module)module.exports=t();else if("function"==typeof define&&define.amd)define([],t);else{var n=t();for(var o in n)("object"==typeof exports?exports:e)[o]=n[o]}}(self,(()=>(()=>{"use strict";var e={d:(t,n)=>{for(var o in n)e.o(n,o)&&!e.o(t,o)&&Object.defineProperty(t,o,{enumerable:!0,get:n[o]})},o:(e,t)=>Object.prototype.hasOwnProperty.call(e,t),r:e=>{"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})}};(()=>{e.S={};var t={},n={};e.I=(o,r)=>{r||(r=[]);var a=n[o];if(a||(a=n[o]={}),!(r.indexOf(a)>=0)){if(r.push(a),t[o])return t[o];e.o(e.S,o)||(e.S[o]={}),e.S[o];var i=[];return t[o]=i.length?Promise.all(i).then((()=>t[o]=1)):1}}})();var t={};e.r(t),e.d(t,{chainResolvers:()=>l,default:()=>m,inlineResolver:()=>i,legacyManifestResolver:()=>s,registryResolver:()=>c});const n=new Set,o=async e=>{const t=document.createElement("script");return new Promise(((o,r)=>{n.has(e)?o(!1):(n.add(e),t.src=e,t.type="text/javascript",t.async=!0,t.onload=()=>{console.debug(`Remote entry fetched from '${e}'.`),o(!0)},t.onerror=()=>{const t=`Failed to fetch remote entry from '${e}'.`;console.error(t),n.delete(e),r(t)},document.head.appendChild(t))})).finally((()=>{document.head.contains(t)&&document.head.removeChild(t)}))};(Object.getOwnPropertyDescriptor(o,"name")||{}).writable||Object.defineProperty(o,"name",{value:"default",configurable:!0});const r=async(t,n,o="default")=>{console.debug(`loading Appshell component: { scope: ${t}, module: ${n}, shareScope: ${o} }`),await e.I(o);const r=window[t];if(!r)throw new Error(`Failed to find module container ${t}`);await r.init(e.S[o]);const a=await r.get(n);if(!a)throw new Error(`Invalid factory produced by container for module ${n}.`);const i=a();return console.debug(`Appshell component loaded: { scope: ${t}, module: ${n}, shareScope: ${o} }`),i.default};(Object.getOwnPropertyDescriptor(r,"name")||{}).writable||Object.defineProperty(r,"name",{value:"default",configurable:!0});const a=(e,t)=>({remotes:t,environment:e.environment,modules:{}}),i=e=>async t=>{const n=e?.remotes[t];if(e&&n)return{remote:n,environment:e.environment[n.scope]??{},manifest:a(e,e.remotes)}},c=(e,t="")=>async n=>{if(!e)return;const o=`${t}/v1/environments/${e.environmentId}/remotes/${n}`,r=await fetch(o,{credentials:"include"});if(!r.ok)return;const i=await r.json();return{remote:i,environment:e.environment[i.scope]??{},manifest:a(e,{[n]:i})}},s=e=>{const t=new Map;return async n=>{const o=e.index?.[n];if(!o)return;const r=await(e=>{const n=t.get(e);if(n)return n;const o=fetch(e,{credentials:"include"}).then((async t=>{if(!t.ok)throw new Error(`Failed to get manifest from ${e}. ${await t.text()}`);return t.json()}));return t.set(e,o),o})(o),a=r?.remotes[n];return a?{remote:a,environment:{...r.environment[a.scope]??{},...e.overrides?.environment?.[a.scope]??{}},manifest:r}:void 0}},l=(...e)=>async t=>{for(const n of e){const e=await n(t);if(e)return e}},d=new Set,f=(e,t={})=>{const n=t.composition??("undefined"==typeof window?void 0:window.__appshell_config__),a=t.resolver??l(i(n),c(n),s(e));return async e=>{const t=t=>new Error(`Failed to load component '${e}'. ${t?.toString()}`);let n;try{n=await a(e)}catch(e){throw t(e)}if(!n)throw new Error(`Remote resource not found in registry. Expected: ${e}`);const{remote:i,environment:c,manifest:s}=n;try{return window[`__appshell_env__${i.scope}`]=c,d.has(i.remoteEntryUrl)||await o(i.remoteEntryUrl)?(d.add(i.remoteEntryUrl),[await r(i.scope,i.module,i.shareScope),s]):[null,null]}catch(e){throw t(e)}}};(Object.getOwnPropertyDescriptor(f,"name")||{}).writable||Object.defineProperty(f,"name",{value:"default",configurable:!0});const m=f;return t})()));
+!function(e,t){if("object"==typeof exports&&"object"==typeof module)module.exports=t();else if("function"==typeof define&&define.amd)define([],t);else{var n=t();for(var o in n)("object"==typeof exports?exports:e)[o]=n[o]}}(self,(()=>(()=>{"use strict";var e={d:(t,n)=>{for(var o in n)e.o(n,o)&&!e.o(t,o)&&Object.defineProperty(t,o,{enumerable:!0,get:n[o]})},o:(e,t)=>Object.prototype.hasOwnProperty.call(e,t),r:e=>{"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})}};(()=>{e.S={};var t={},n={};e.I=(o,r)=>{r||(r=[]);var i=n[o];if(i||(i=n[o]={}),!(r.indexOf(i)>=0)){if(r.push(i),t[o])return t[o];e.o(e.S,o)||(e.S[o]={}),e.S[o];var a=[];return t[o]=a.length?Promise.all(a).then((()=>t[o]=1)):1}}})();var t={};e.r(t),e.d(t,{chainResolvers:()=>l,default:()=>m,inlineResolver:()=>a,legacyManifestResolver:()=>s,registryResolver:()=>c});const n=new Set,o=async e=>{const t=document.createElement("script"),o=document.querySelector("script[nonce]")?.nonce;return o&&(t.nonce=o),new Promise(((o,r)=>{n.has(e)?o(!1):(n.add(e),t.src=e,t.type="text/javascript",t.async=!0,t.onload=()=>{console.debug(`Remote entry fetched from '${e}'.`),o(!0)},t.onerror=()=>{const t=`Failed to fetch remote entry from '${e}'.`;console.error(t),n.delete(e),r(t)},document.head.appendChild(t))})).finally((()=>{document.head.contains(t)&&document.head.removeChild(t)}))};(Object.getOwnPropertyDescriptor(o,"name")||{}).writable||Object.defineProperty(o,"name",{value:"default",configurable:!0});const r=async(t,n,o="default")=>{console.debug(`loading Appshell component: { scope: ${t}, module: ${n}, shareScope: ${o} }`),await e.I(o);const r=window[t];if(!r)throw new Error(`Failed to find module container ${t}`);await r.init(e.S[o]);const i=await r.get(n);if(!i)throw new Error(`Invalid factory produced by container for module ${n}.`);const a=i();return console.debug(`Appshell component loaded: { scope: ${t}, module: ${n}, shareScope: ${o} }`),a.default};(Object.getOwnPropertyDescriptor(r,"name")||{}).writable||Object.defineProperty(r,"name",{value:"default",configurable:!0});const i=(e,t)=>({remotes:t,environment:e.environment,modules:{}}),a=e=>async t=>{const n=e?.remotes[t];if(e&&n)return{remote:n,environment:e.environment[n.scope]??{},manifest:i(e,e.remotes)}},c=(e,t="")=>async n=>{if(!e)return;const o=`${t}/v1/environments/${e.environmentId}/remotes/${n}`,r=await fetch(o,{credentials:"include"});if(!r.ok)return;const a=await r.json();return{remote:a,environment:e.environment[a.scope]??{},manifest:i(e,{[n]:a})}},s=e=>{const t=new Map;return async n=>{const o=e.index?.[n];if(!o)return;const r=await(e=>{const n=t.get(e);if(n)return n;const o=fetch(e,{credentials:"include"}).then((async t=>{if(!t.ok)throw new Error(`Failed to get manifest from ${e}. ${await t.text()}`);return t.json()}));return t.set(e,o),o})(o),i=r?.remotes[n];return i?{remote:i,environment:{...r.environment[i.scope]??{},...e.overrides?.environment?.[i.scope]??{}},manifest:r}:void 0}},l=(...e)=>async t=>{for(const n of e){const e=await n(t);if(e)return e}},d=new Set,f=(e,t={})=>{const n=t.composition??("undefined"==typeof window?void 0:window.__appshell_config__),i=t.resolver??l(a(n),c(n),s(e));return async e=>{const t=t=>new Error(`Failed to load component '${e}'. ${t?.toString()}`);let n;try{n=await i(e)}catch(e){throw t(e)}if(!n)throw new Error(`Remote resource not found in registry. Expected: ${e}`);const{remote:a,environment:c,manifest:s}=n;try{return window[`__appshell_env__${a.scope}`]=c,d.has(a.remoteEntryUrl)||await o(a.remoteEntryUrl)?(d.add(a.remoteEntryUrl),[await r(a.scope,a.module,a.shareScope),s]):[null,null]}catch(e){throw t(e)}}};(Object.getOwnPropertyDescriptor(f,"name")||{}).writable||Object.defineProperty(f,"name",{value:"default",configurable:!0});const m=f;return t})()));

package/dist/types/loader/src/fetchDynamicScript.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fetchDynamicScript.d.ts","sourceRoot":"","sources":["../../../../src/fetchDynamicScript.ts"],"names":[],"mappings":"8BAE2B,MAAM;AAAjC,wBAqCE"}
+{"version":3,"file":"fetchDynamicScript.d.ts","sourceRoot":"","sources":["../../../../src/fetchDynamicScript.ts"],"names":[],"mappings":"8BAM2B,MAAM;AAAjC,wBA0CE"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@appshell/loader",
-  "version": "1.0.0-alpha.8",
+  "version": "1.0.0-alpha.9",
   "description": "Utility for loading Appshell components",
   "main": "dist/main.js",
   "types": "dist/loader/src/index.d.ts",
@@ -24,5 +24,5 @@
     "appshell"
   ],
   "license": "MIT",
-  "gitHead": "ced8839a7c8423ad723fb32f9388e0e3d15951eb"
+  "gitHead": "dd1cd33cf2f014563438d29a004ce7939e65dacb"
 }

package/src/fetchDynamicScript.ts

@@ -1,7 +1,16 @@
 const urlCache = new Set<string>();
 
+/** Propagates the shell's CSP nonce so browsers that don't trust strict-dynamic propagation still allow it. */
+const cspNonce = (): string | undefined =>
+  document.querySelector<HTMLScriptElement>('script[nonce]')?.nonce;
+
 export default async (url: string) => {
   const element = document.createElement('script');
+  const nonce = cspNonce();
+
+  if (nonce) {
+    element.nonce = nonce;
+  }
 
   const cleanup = (): void => {
     if (document.head.contains(element)) {