Skip to main content
Every JS script has a Delivery type, set in the Scope & loading sheet:
  • Auto (default): delivered as a module when the code uses import / export, otherwise as a classic script.
  • Classic script: always delivered as a plain <script>.
  • ES module: always delivered as <script type="module">.
CSS is never affected. This setting only exists for JS.
There’s also a site-level “load all scripts as modules” override. When it’s on, Auto scripts are delivered as modules even without import/export syntax.

​
What changes when a script is a module

The editor shows a Delivered as ES module status bar whenever a script will ship as a module, because modules behave differently from classic scripts:
  • Isolated scope: top-level const / let / function declarations stay private to the module, they aren’t global. If another script needs them, assign to window yourself: window.mySlider = mySlider.
  • Deferred: modules run after the HTML is fully parsed, no matter what load order or execution timing you set.
  • import works: you can import packages straight from a CDN:
    Cross-origin imports need the CDN to send CORS headers. The major JS CDNs (jsDelivr, esm.sh, unpkg) all do.

​
Runtime import warnings

When a module imports from a URL, the editor lists every origin the script will load code from at runtime, and flags two situations:
  • Untrusted: the host isn’t on Cairn’s trusted CDN list. The import still works, but you’re trusting that origin to run code on your site.
  • Unpinned: the URL has no version (or uses @latest), so the CDN can serve different code tomorrow than it does today. Pin a version (gsap@3.12.5) so your site doesn’t change behavior without a publish.