[theinterned]

• Related Support for CSP TrustedTypes #3506
• Related ✨ [RUM-139] Add CSP trusted-types support #4854

Motivation

Applications that enforce Trusted Types and own their worker policy cannot pass a genuine TrustedScriptURL through workerUrl: configuration currently rejects it as a non-string. This also affects intake compression with Session Replay disabled.

Changes

• Accept string | TrustedScriptURL, using the native trustedTypes.isScriptURL() brand check rather than accepting arbitrary stringifiable objects.
• Preserve the trusted object through configuration, getInitConfiguration(), and the Worker constructor. Keep existing string and absent-value behavior.
• Add unit coverage and a Chromium scenario that delivers a compressed RUM action under require-trusted-types-for 'script', with Session Replay sampling set to zero.

This is limited to application-created worker URLs. It creates no SDK policy or worker-factory API and does not address lazy chunks or the asynchronous CDN snippet. The implementation and tests were AI-assisted.

Test instructions

yarn test:unit \
  --spec packages/browser-rum-core/src/domain/configuration/configuration.spec.ts \
  --spec packages/browser-rum-core/src/boot/rumPublicApi.spec.ts \
  --spec packages/browser-rum/src/domain/deflate/deflateWorker.spec.ts
yarn test:e2e transport.scenario.ts -g 'TrustedScriptURL worker'

Locally: 227 unit tests passed; the Chromium scenario passed against freshly built production bundles. Type checking and focused lint/format checks passed. The local browser runner used installed Chrome, allowed static serving from a hidden checkout directory, and omitted unrelated app servers.

Checklist

• Tested locally
• Tested on staging
• Added unit tests for this change.
• Added e2e/integration tests for this change.
• Updated documentation and/or relevant AGENTS.md file

[github-actions]

Thank you for your submission, we really appreciate it. Like many open-source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution. You can sign the CLA by just posting a Pull Request Comment same as the below format.

---

I have read the CLA Document and I hereby sign the CLA

---

_{You can retrigger this bot by commenting recheck in this Pull Request. Posted by the CLA Assistant Lite bot.}

[datadog-official]

More details

Application-created TrustedScriptURL values are preserved through configuration and Worker construction, while arbitrary stringifiable objects remain rejected. Static review identified no actionable defect.

Was this helpful? React 👍 or 👎

_{Open Bits AI session}

_{🤖 Bits Code Review · Commit 9e429e3}