In code asset reference declarations seem trustable

[mikesamuel]

trafficstars

When an asset reference statically includes a module reference, it seems we should privilege that to the same degree we privilege static import.

There's no reason to treat the "foo"s differently in

asset Foo from "foo";

import from "foo";

Perhaps TT could specify a host hook HostStaticAssetReference that, in a browser context, uses the realm's TrustedTypesPolicyFactory to bless "foo".

@bmeck

[bmeck]

This needs likely also needs to cover what happens if asset references are dynamically created. If hosts are the only means to bless [[CodeLike]]s asset references and other proposals need to have some invariant they can follow about what they need to do to integrate with hosts.

[mikesamuel]

Filed w3c/webappsec-trusted-types/issues/247 to track dynamic asset references.