Run & review this pull request in StackBlitz Codeflow.

IIUC if a user is using Content-Security-Policy: trusted-types 'a-policy-name-that-they-use';, then the user has to add 'error-overlay' to that. I wonder if it's better to construct the element with document.createElement (or hyperscript?) so that they don't need to add 'error-overlay'.

If you don't already have hyperscript in the codebase, I'll rewrite it with DOM. NBD.

Ok. I've converted this over to DOM. I added a small pair of helper functions to make reading the creation of the actual element easier.

For me, I'm not a big fan of needing to tweak Vite in order to support CSP. I think it should be additive and not affect how we write code. Personally I would prefer if the changes are done via Vite plugins at the meantime if this change is required. (You can transform() overlay.js)

That said, I've talked with @sapphi-red and @patak-dev about this, and I'm okay if we go with the first commit instead that uses trustedTypes to support this, and we have documentation for how to incorporate this.

But ultimately, I'd prefer a better CSP story altogether before we support this. #14653 is one where IIRC an option might be needed, and the overlay could perhaps leverage it.

Hey all, what's the best way forward here? I've got one approval and one saying no

@Snugug the PR is now in the team board. We'll discuss it live on the next meeting so we can give you a definite answer about how to move forward. I would also like to see this applied, and both approaches are fine to me to be honest.

Sgtm thank you!

/ecosystem-ci run

📝 Ran ecosystem CI on 6f2d871: Open

This seems to have broken this import format inside web workers as document is not available:

fetch('https://esm.run/svelte@next/compiler.cjs').then(res => {
    res.text().then(source => {
        const blob = new Blob([source], { type: 'text/javascript' });
        import(/* @vite-ignore */URL.createObjectURL(blob)).then((_svelte) => {
            svelte = _svelte;
        });
    })
})

@juho would you create an issue with a minimal reproduction so we can properly track it?

This breaks web worker, see #16308

@patak-dev there is a reproduction and issue tracking for this regression in #16277 (comment)