{% comment %}
    Emitted by {% frontend_head %}. Renders nothing unless a GDAPS frontend
    engine is active, so the tag is safe to leave in a base template that is
    also used by projects without a frontend.

    The import map must be inline: external import maps are not supported by
    browsers. Under a Content-Security-Policy this means script-src has to
    allow it — either via the nonce below (django-csp sets request.csp_nonce)
    or by whitelisting the map's hash. See docs/advanced/frontend.md.

    The import map must also come before the first module script on the page,
    and there may only be one per document — which is why GDAPS owns it.
{% endcomment %}
{% if enabled %}
<script type="importmap"{% if nonce %} nonce="{{ nonce }}"{% endif %}>{{ importmap }}</script>
{{ config|json_script:"gdaps-frontend-config" }}
<script type="module" src="{{ shell_url }}"{% if nonce %} nonce="{{ nonce }}"{% endif %}></script>
{% endif %}