Guy Bedford

Thanks @caridy that makes sense. Will loader.define still be available for population of modular source text? Would be necessary to allow translation workflows to esm I think? On Fri, 01...

That does remove some use cases for in-browser transpilation eg macros for modules. While it can be done in the service worker, a modular 'eval' through loader.define to a given...

Right, I mean key instead of module name in the above. Ideally modular eval is a function of the key and source text, returning a promise that acts just like...

I have one other concern about this proposal - resolve will now execute as a side-effect for legacy module format cases. But the issue here is that since the loader...

@caridy > I'm not sure this is 100% accurate. For legacy modules, you can still create a reflective module record, passing an evaluator function to apply lazy evaluation, which is...

Thanks @caridy for the clarification. The remaining issue here is then that CommonJS that loads ES modules would need to execute those ES modules within the resolve hook itself (effectively...

(Originally posted at https://github.com/whatwg/loader/issues/100) The current loader hooks effectively provide inline eval support and do not provide the ability to ensure source text integrity. In order to support CSP, SubResource...

@matthewp script execution URLs are bound by the origin policy of the page, so that script location is much more secure than eval. So the origin security policy of the...

Sorry the term origin wasn't meant to relate to same origin policy. I'm talking about the CSP whitelisting of hosts that are able to provide eg `script-src` on the page.

Thanks for the quick response, I don't think the bower version downloads the release zip file as far as I can tell? Otherwise I'd have thought this would be flagged...