{% comment %}
    Emitted by {% frontend_head %}. Renders nothing unless a GDAPS frontend
    engine is active, so the tag is safe to leave in a base template that is
    also used by projects without a frontend.

    The import map must be inline: external import maps are not supported by
    browsers. Under a Content-Security-Policy this means script-src has to
    allow it — either via the nonce below (django-csp sets request.csp_nonce)
    or by whitelisting the map's hash. See docs/advanced/frontend.md.

    The import map must also come before the first module script on the page,
    and there may only be one per document — which is why GDAPS owns it.

    The stylesheet links belong to the shared libraries: their builds record
    what CSS they emitted, so the host does not have to hardcode paths that a
    hashing static files storage renames. They are ordinary external resources
    — the script nonce does not apply to them, but style-src must allow the
    static origin.
{% endcomment %}
{% if enabled %}
<script type="importmap"{% if nonce %} nonce="{{ nonce }}"{% endif %}>{{ importmap }}</script>
{% for stylesheet in stylesheets %}<link rel="stylesheet" href="{{ stylesheet }}">
{% endfor %}
{{ config|json_script:"gdaps-frontend-config" }}
<script type="module" src="{{ shell_url }}"{% if nonce %} nonce="{{ nonce }}"{% endif %}></script>
{% endif %}