feat(workers): add support for trusted types

[sorin-davidoi]

Using fuse.js/worker currently fails for projects that use the require-trusted-types-for Content Security Policy directive:

This document requires 'TrustedScriptURL' assignment. The action has been blocked.
_spawnWorker @fuse-worker.mjs:73
_init        @fuse-worker.mjs:107
_ensureInit  @fuse-worker.mjs:69
search       @fuse-worker.mjs:130

This patch fixes this by creating a TrustedTypePolicy called fuse-trusted-worker-url and spawning the web workers with a TrustedTypeURL instance created from the policy.

It also changes the public API to allow workerUrl to be passed as a TrustedScriptURL, such that consumers can use their own policies.

This change should have no impact on consumers that don't make use of the require-trusted-types-for directive.

See https://developer.mozilla.org/en-US/docs/Web/API/Trusted_Types_API.

Inspired by sveltejs/svelte#16271.

[krisk]

Thanks for this, the CSP gap is real and definitely should be fixed. Two blockers:

1. The published types break. TrustedScriptURL isn't in TS's lib.dom.d.ts and @types/trusted-types is a devDependency, so consumers get TS2304: Cannot find name 'TrustedScriptURL' off dist/fuse-worker.d.ts. That's why package-types.test.ts needed types: [] -> types: ['trusted-types'], but catching that is the whole point of that test. Can you declare a local structural interface instead ({ toString(): string; toJSON(): string })? Keeps the .d.ts self-contained and drops the dep and tsconfig changes with it.

2. createPolicy at module scope can throw on import. It throws when a trusted-types directive doesn't allow-list the name, or on a duplicate name without allow-duplicates. So trusted-types myapp; require-trusted-types-for 'script' crashes on import 'fuse.js/worker', which is the audience for this PR. Make it lazy in the constructor, memoized, in a try/catch that falls back to the plain URL.

Two smaller ones: globalThis.trustedTypes?. rather than gating on window (skips worker scopes), and I'd wrap a consumer-supplied workerUrl too since the policy is identity, otherwise the escape hatch in the docs still throws under CSP.

Also needs a rebase, dist/ has moved since 457fe762.

[sorin-davidoi]

I've fixed the types.

2. createPolicy at module scope can throw on import. It throws when a trusted-types directive doesn't allow-list the name, or on a duplicate name without allow-duplicates. So trusted-types myapp; require-trusted-types-for 'script' crashes on import 'fuse.js/worker', which is the audience for this PR. Make it lazy in the constructor, memoized, in a try/catch that falls back to the plain URL.

The whole point is that it crashes - the consumer either has to add fuse-trusted-worker-url to the policy or pass their own policy via workerUrl . Falling back to the plain URL would also fail, trusted-types myapp; require-trusted-types-for 'script' would prevent it from being loaded.

I'd wrap a consumer-supplied workerUrl too since the policy is identity, otherwise the escape hatch in the docs still throws under CSP.

I'm not sure that grouping these two concept (default URL, derived from inside the package and a user-supplied arbitrary URL) is a good idea. The identity transformation works for the default URL precisely because it's not an arbitrary URL - it's probably not appropriate for user-supplied one, which is precisely why consumers should bring their own policy.

globalThis.trustedTypes?. rather than gating on window (skips worker scopes)

Isn't FuseWorker.ts only executed in window context? As it's not the worker itself, but the file that creates and loads the Web Workers?