fix(frontend): Allow new QR code library in the CSP

[AntonioVentilii]

Motivation

To use the new library from QrCodeReader component (PR #12162) we need to allow it in the CSP.

[Copilot]

Pull request overview

Updates the frontend build configuration and CSP to support the new WASM-based QR scanning stack (barcode-detector) introduced for the QrCodeReader component.

Changes:

• Switches Vite “lazy” chunking from html5-qrcode to barcode-detector.
• Updates QrCodeScanner to handle a new nnsQRCodeError event from QrCodeReader.
• Relaxes CSP script-src to include wasm-unsafe-eval to allow WebAssembly compilation.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.

File	Description
vite.config.ts	Updates Rollup manual chunking to treat barcode-detector as a lazily-loaded dependency.
src/frontend/src/lib/components/qr/QrCodeScanner.svelte	Adds handling for QR reader error events during scanning.
scripts/build.csp.mjs	Adjusts CSP script-src to permit WASM compilation required by the new scanner library.

Comments suppressed due to low confidence (1)

vite.config.ts:37

• barcode-detector pulls in zxing-wasm (via dependency), but only barcode-detector was added to the lazy chunk allowlist. With the current manualChunks logic, zxing-wasm modules will likely land in the vendor chunk and be downloaded eagerly, which defeats the purpose of lazy-loading the QR scanning stack. Consider adding zxing-wasm (and any other large transitive deps used exclusively for scanning) to the lazy list so they remain in the lazy chunk.

					const lazy = ['@dfinity/nns', '@dfinity/nns-proto', 'barcode-detector', 'qr-creator'];

					if (
						['@sveltejs', 'svelte', '@dfinity/gix-components', ...lazy].find((lib) =>
							folder.includes(lib)

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.