Skip to main content
Every JS script has a Delivery type, set in the Scope & loading sheet:
  • Auto (default) — delivered as a module when the code uses import / export, otherwise as a classic script.
  • Classic script — always delivered as a plain <script>.
  • ES module — always delivered as <script type="module">.
CSS is never affected — this setting only exists for JS.
A site-level “load all scripts as modules” override also exists; when it’s on, Auto scripts are delivered as modules even without import/export syntax.

​
What changes when a script is a module

The editor shows a Delivered as ES module status bar whenever a script will ship as a module, because modules behave differently from classic scripts:
  • Isolated scope — top-level const / let / function declarations are private to the module, not global. If another script needs them, assign to window explicitly: window.mySlider = mySlider.
  • Deferred — modules run after the HTML is fully parsed, regardless of the script’s load order or execution-timing settings.
  • import works — you can import packages straight from a CDN: 
    import gsap from 'https://esm.sh/gsap@3.12.5';
    Cross-origin imports require the CDN to send CORS headers; the major JS CDNs (jsDelivr, esm.sh, unpkg) all do.

​
Runtime import warnings

When a module imports from a URL, the editor lists every origin the script will load code from at runtime, and flags two situations:
  • Untrusted — the host isn’t on Cairn’s trusted CDN list. The import still works, but you’re trusting that origin with code execution on your site.
  • Unpinned — the URL has no version (or uses @latest), so the CDN can serve different code tomorrow than it does today. Pin a version (gsap@3.12.5) so your site doesn’t change behavior without a publish.