refactor: update meta tag handling in Nuxt module and improve CSP header test

Author: yan-ad

src/module.ts

@@ -84,9 +84,7 @@ export default defineNuxtModule<ModuleOptions>({
     // The meta tag MUST appear before the App Bridge script — it reads the API key on load.
     nuxt.hook('app:resolve', () => {
       nuxt.options.app.head = nuxt.options.app.head || {}
-      nuxt.options.app.head.meta = [
-        ...(nuxt.options.app.head.meta || [])
-      ]
+      nuxt.options.app.head.meta = [...(nuxt.options.app.head.meta || [])]
       nuxt.options.app.head.script = [
         // 1. Inline script to create the meta tag imperatively — guarantees it
         //    exists in the DOM before the CDN script executes.

test/basic.test.ts

@@ -1,7 +1,7 @@
 import { createHmac } from 'node:crypto'
 import { fileURLToPath } from 'node:url'
 import { describe, it, expect } from 'vitest'
-import { setup, $fetch } from '@nuxt/test-utils/e2e'
+import { setup, $fetch, url } from '@nuxt/test-utils/e2e'
 
 const TEST_API_KEY = 'test-api-key'
 const TEST_API_SECRET = 'test-api-secret'
@@ -44,9 +44,10 @@ describe('shopify-nuxt module', async () => {
       expect(html).toContain('cdn.shopify.com/shopifycloud/polaris')
     })
 
-    it('includes CSP frame-ancestors meta tag', async () => {
-      const html = await $fetch('/')
-      expect(html).toContain('frame-ancestors')
+    it('includes CSP frame-ancestors header', async () => {
+      const res = await fetch(url('/'))
+      const csp = res.headers.get('content-security-policy')
+      expect(csp).toContain('frame-ancestors')
     })
   })