feat(pack): support output.crossOriginLoading config (#2740)

Author: fireairforce

crates/pack-core/src/client/context.rs

@@ -540,6 +540,10 @@ pub async fn get_client_chunking_context(
         builder = builder.chunk_loading_global(chunk_loading_global.clone());
     }
 
+    if let Some(cross_origin_loading) = &*config.client_cross_origin_loading().await? {
+        builder = builder.cross_origin_loading(cross_origin_loading.clone());
+    }
+
     // Read entry_root_export from config
     if let Some(entry_root_export) = &*config.entry_root_export().await? {
         builder = builder.entry_root_export(Some(entry_root_export.clone()));

crates/pack-core/src/config.rs

@@ -373,6 +373,9 @@ pub struct OutputConfig {
     /// Note: This path will not appear in chunk paths or chunk data on disk,
     /// it only affects the URLs used by the browser to fetch resources.
     pub public_path: Option<RcStr>,
+    /// Controls the `crossorigin` attribute for dynamically loaded JS chunks.
+    /// Webpack-compatible values: false, "anonymous", "use-credentials".
+    pub cross_origin_loading: Option<CrossOriginLoading>,
     /// The global variable name used by the runtime for loading chunks.
     /// This is similar to webpack's `output.chunkLoadingGlobal`.
     /// Default: "TURBOPACK"
@@ -392,6 +395,22 @@ pub enum OutputType {
     Export,
 }
 
+#[turbo_tasks::value]
+#[derive(Clone, Debug, Deserialize, OperationValue)]
+#[serde(rename_all = "kebab-case")]
+pub enum CrossOriginLoadingMode {
+    Anonymous,
+    UseCredentials,
+}
+
+#[turbo_tasks::value]
+#[derive(Clone, Debug, Deserialize, OperationValue)]
+#[serde(untagged)]
+pub enum CrossOriginLoading {
+    Boolean(bool),
+    Mode(CrossOriginLoadingMode),
+}
+
 #[derive(
     Clone,
     PartialEq,
@@ -1021,6 +1040,29 @@ impl Config {
         Ok(Vc::cell(None))
     }
 
+    #[turbo_tasks::function]
+    pub async fn client_cross_origin_loading(&self) -> Result<Vc<Option<RcStr>>> {
+        let cross_origin_loading = self
+            .output
+            .as_ref()
+            .and_then(|o| o.cross_origin_loading.as_ref());
+
+        let value = match cross_origin_loading {
+            Some(CrossOriginLoading::Mode(CrossOriginLoadingMode::Anonymous)) => {
+                Some(rcstr!("anonymous"))
+            }
+            Some(CrossOriginLoading::Mode(CrossOriginLoadingMode::UseCredentials)) => {
+                Some(rcstr!("use-credentials"))
+            }
+            // Webpack-compatible: false disables crossorigin attribute.
+            Some(CrossOriginLoading::Boolean(false)) | None => None,
+            // Treat true as anonymous for compatibility with legacy configs.
+            Some(CrossOriginLoading::Boolean(true)) => Some(rcstr!("anonymous")),
+        };
+
+        Ok(Vc::cell(value))
+    }
+
     #[turbo_tasks::function]
     pub async fn entry_root_export(&self) -> Result<Vc<Option<RcStr>>> {
         // Check if entry_root_export is configured

crates/pack-schema/src/lib.rs

@@ -315,6 +315,14 @@ pub struct SchemaOutputConfig {
     )]
     pub public_path: Option<String>,
 
+    /// Controls the `crossorigin` attribute for dynamically loaded chunks.
+    /// Webpack-compatible values: false, "anonymous", "use-credentials".
+    #[serde(skip_serializing_if = "Option::is_none")]
+    #[schemars(
+        description = "Controls crossorigin for dynamically loaded chunks. Supports false, 'anonymous', or 'use-credentials'."
+    )]
+    pub cross_origin_loading: Option<SchemaCrossOriginLoading>,
+
     /// The global variable name used by the runtime for loading chunks.
     /// This is similar to webpack's `output.chunkLoadingGlobal`.
     /// Default: "TURBOPACK"
@@ -332,6 +340,23 @@ pub struct SchemaOutputConfig {
     pub entry_root_export: Option<String>,
 }
 
+/// Cross-origin loading mode for dynamic chunks.
+#[derive(Debug, Clone, Serialize, Deserialize, JsonSchema)]
+#[serde(rename_all = "kebab-case")]
+pub enum SchemaCrossOriginLoadingMode {
+    Anonymous,
+    UseCredentials,
+}
+
+/// Webpack-compatible `output.crossOriginLoading`.
+/// Supports `false`, `"anonymous"`, and `"use-credentials"`.
+#[derive(Debug, Clone, Serialize, Deserialize, JsonSchema)]
+#[serde(untagged)]
+pub enum SchemaCrossOriginLoading {
+    Boolean(bool),
+    Mode(SchemaCrossOriginLoadingMode),
+}
+
 /// Output type
 #[derive(Debug, Clone, Serialize, Deserialize, JsonSchema)]
 #[serde(rename_all = "kebab-case")]
@@ -954,6 +979,7 @@ mod tests {
         assert!(schema_str.contains("provider"));
         assert!(schema_str.contains("postcss"));
         assert!(schema_str.contains("publicPath"));
+        assert!(schema_str.contains("crossOriginLoading"));
         assert!(schema_str.contains("cssFilename"));
         assert!(schema_str.contains("assetModuleFilename"));
     }
@@ -1022,6 +1048,7 @@ mod tests {
             "chunkFilename": "[name].[contenthash:8].js",
             "cssFilename": "[name].[contenthash:6].css",
             "publicPath": "/assets/",
+            "crossOriginLoading": "anonymous",
             "clean": true
           },
           "optimization": {
@@ -1057,6 +1084,12 @@ mod tests {
             Some("[name].[contenthash:6].css".to_string())
         );
         assert_eq!(output.public_path, Some("/assets/".to_string()));
+        assert!(matches!(
+            output.cross_origin_loading,
+            Some(SchemaCrossOriginLoading::Mode(
+                SchemaCrossOriginLoadingMode::Anonymous
+            ))
+        ));
 
         // Test concatenateModules configuration
         let optimization = config.optimization.as_ref().unwrap();