- Ya
- 20 Agosti 2026, 04:42 UTC
- Mwandishi
- Kamo
- Ahadi ya
- 92bbbac
The report-only console showed two violations, and one of them was the policy component's own doing: This document requires 'TrustedScript' assignment. This script element was modified without use of TrustedScript assignment. That is next/script. It does not merely emit an inline script — it re-injects the content on the client by creating a script element and assigning its text, and assigning a script element's text is itself a TrustedScript sink. So the component tripped the exact violation it exists to prevent, and because the injection happens on the client it also installed the policy after hydration had already run react-dom's innerHTML — which is the second violation. It is a plain `<script dangerouslySetInnerHTML>` now, rendered as the first child of the real <head> in app/[locale]/layout.tsx. A plain inline script is parsed and executed in document order with no client-side re-injection, which is the only behaviour that installs a policy before hydration. Measured on the built page: policy at 6,254 inside <head>, first flight-data push at 193,516. This also corrects the guard, which was asserting the wrong invariant — worth recording, because the wrong one is the intuitive one. It required the policy to precede the first async framework script. That is unsatisfiable, since React hoists `<script async src>` above anything a layout renders, and it is not the real requirement either: those scripts are fetched asynchronously and what matters is when they execute a DOM sink, which is during hydration. The guard now checks the two things that actually hold — the component must not render next/script, and the policy must appear before the first `self.__next_f.push`. That earlier guard is also why moving the policy to app/layout.tsx looked like it had failed. It had not; it was being judged against a condition nothing could meet. Trusted Types stays REPORT-ONLY in this deploy. The point of the change is to clear the violations, and confirming a clean console is what earns enforcement — having already taken the site down once by assuming ordering rather than observing it.