Add a target suitable for nodejs.

[koto]

That probably means publishing an npm package that

• implements the TT API only (equivalent of api_only.js entry point) (TrustedTypes.createPolicy etc.).
• enforces restrictions (i.e. hook to prototype methods) on a given document-like and window-like objects - and a enforcement configuration (currently this is implemented as a CSP string).

These can be separate modules, but should all be packaged in one package, such that one can (I'm making up the API shape completely here):

import {TrustedTypes} from 'trusted-types/api.js';
import {enforceOn} from 'trusted-types/enforcement.js'; 
enforceOn(document, window, 'default': TrustedTypes.createPolicy('default', ...), violationCallback);

For the time being, this should probably be packaged as CommonJS modules, as ES modules are still experimental in Node 12, but we should explore how to migrate to ES modules eventually. It sounds like we might be able to package both variants together : https://nodejs.org/api/esm.html#esm_package_entry_points.

[koto]

@engelsdamien you probably would depend on the polyfill package?

[koto]

The current node package (api_only as commonjs) unfortunately breaks:

$ node
> require('.')
ReferenceError: HTMLIFrameElement is not defined
    at trustedTypesBuilderTestOnly (/usr/local/google/home/koto/dev/trusted-types/dist/cjs/trustedtypes.api_only.js:357:21)
    at Object.<anonymous> (/usr/local/google/home/koto/dev/trusted-types/dist/cjs/trustedtypes.api_only.js:684:5)
    at Module._compile (internal/modules/cjs/loader.js:701:30)
    at Object.Module._extensions..js (internal/modules/cjs/loader.js:712:10)
    at Module.load (internal/modules/cjs/loader.js:600:32)
    at tryModuleLoad (internal/modules/cjs/loader.js:539:12)
    at Function.Module._load (internal/modules/cjs/loader.js:531:3)
    at Module.require (internal/modules/cjs/loader.js:637:17)
    at require (internal/modules/cjs/helpers.js:22:18)

as we're now expecting a browser environment in trustedtypes.js, to test for browser behavior.

[koto]

https://www.npmjs.com/package/element-closest has something close to what we need. https://github.com/airbnb/browser-shims has a short list of polyfills we might take a look at for comparison.

[mikesamuel]

Is the idea that we provide an API that, given a TrustedTypesPolicyConfiguration and an HTMLDocument, returns a TrustedTypesPolicyFactory?

[koto]

Sorry for the late response. Yes :)