GeezerVison

Summary

Fixes #171 (Medium).

createTrustedHtml / getTrustedTypesPolicy existed but no DOM-write path called them — they were only re-exported. So under an enforced require-trusted-types-for 'script' CSP, every innerHTML =/insertAdjacentHTML in dom.ts/collection.ts/element.ts/directives threw (framework fails closed but non-functional), and the documented "Trusted Types / CSP compliance" property was simply absent.

Fix

New trustedHtmlForSink(rawHtml) in security/trusted-types.ts: returns a TrustedHTML when a policy is active (so the write satisfies enforced TT), otherwise the sanitized string — sanitizing exactly once. All sanitized sinks now route through it:

• core/dom.ts: setHtml, createElementFromHtml, insertContent
• core/collection.ts: Collection.html(), insertAll()
• view/directives: bq-html (sanitized branch), bq-html-safe
• element.ts html() inherits it via setHtml

The explicit htmlUnsafe() / sanitize: false escape hatches are deliberately left as raw writes (bypassing sanitization is their documented purpose). The sanitizeHtml JSDoc is corrected to describe actual behavior (returns a branded string; the framework's sinks wrap it for TT).

Verification

• New test proves the positive path: with a mock TT policy installed (fresh module instance to avoid cached-policy leakage), trustedHtmlForSink invokes policy.createHTML and returns the branded TrustedHTML.
• New test for the fallback path: returns a sanitized, sink-safe string in a non-TT environment.
• Existing sink sanitization tests still pass (behavior unchanged without TT).
• Full suite: 2988 pass / 0 fail. tsc --noEmit + eslint clean.

🤖 Generated with Claude Code