thePR0M3TH3ANandClaude Sonnet 5 e8712f9aa9 Fix widget styles being silently dropped under strict style-src CSP ...

element.ts re-injected the widget's CSS as a fresh inline <style> tag
on every render() call. A host with a strict style-src (e.g.
`style-src 'self'`, no 'unsafe-inline') silently drops an inline
<style>'s rules entirely -- every element inside the shadow root fell
back to unstyled browser defaults. The visible symptom: the brand SVG
rendered at its raw intrinsic ~590x119px instead of the intended
20px-tall lockup, since its `display: block; height: 20px` rule never
took effect.

Build the stylesheet once as a CSSStyleSheet and assign it via
adoptedStyleSheets instead -- not subject to style-src the way a
parsed inline <style> element is, since it's never parsed as untrusted
markup by the HTML parser. render() no longer touches styling at all.

Co-Authored-By: Claude Sonnet 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01DY9UMTuF43Ekc2U4E1eDwX

2026-07-21 22:09:30 -04:00

..

core

Expand built-in vault/discovery relay lists for redundancy

2026-07-21 21:28:38 -04:00

demo

Simplify hero credential card example

2026-07-21 18:48:54 -04:00

widget

Fix widget styles being silently dropped under strict style-src CSP

2026-07-21 22:09:30 -04:00