d-OAuth-Client/crates/web/bootstrap.js

// External Trunk autoloader for the CSR/WASM app.
//
// Trunk's stock autoloader is an inline `<script type="module">`; the BFF's
// strict `STATIC_CSP` (`script-src 'self' 'wasm-unsafe-eval'`, no
// `'unsafe-inline'`) blocks it, so the production SPA shell never booted.
// `Trunk.toml` sets `inject_scripts = false` and `filehash = false`; this
// same-origin module replaces the inline loader. It imports the stable
// wasm-bindgen artifact, initializes it, and keeps the contract the inline
// loader provided (`window.wasmBindings` + `TrunkApplicationStarted`).

// Theme init: dark is the default; `theme` is the only localStorage key this
// app writes. Static imports are hoisted, but this runs before `init()` (the
// mount gate), so the first painted frame already has the right `data-theme`.
const THEME_KEY = 'theme';
let theme = 'dark';
try {
  theme = localStorage.getItem(THEME_KEY) === 'light' ? 'light' : 'dark';
} catch {
  theme = 'dark';
}
document.documentElement.dataset.theme = theme;

const themeColor = document.querySelector('meta[name="theme-color"]');
if (themeColor) {
  themeColor.setAttribute('content', theme === 'light' ? '#f9fafb' : '#141821');
}

import init, * as bindings from './web-app.js';

const wasm = await init({ module_or_path: new URL('./web-app_bg.wasm', import.meta.url) });

window.wasmBindings = bindings;
dispatchEvent(new CustomEvent('TrunkApplicationStarted', { detail: { wasm } }));