From 68e5bd1c1ccbc0c5374258749408a6bd7728ceb1 Mon Sep 17 00:00:00 2001
From: Waleed Latif <walif6@gmail.com>
Date: Fri, 9 Oct 2026 19:01:26 -0700
Subject: [PATCH 1/4] fix(docs): render the FAQ JSON-LD as a native script tag,
 and forbid data-typed next/script

The FAQ component rendered its FAQPage JSON-LD through next/script with the
default afterInteractive strategy, which returns null on the server and injects
the tag from a client effect, so the served HTML never carried it. Render a
native <script> the way #6763 fixed the other docs JSON-LD blocks;
serializeJsonLd already escapes '<'.

check:source-text now also fails on a next/script element in apps/** whose type
is not JavaScript, naming the native-script fix.
---
 apps/docs/components/ui/faq.tsx |   3 +-
 scripts/check-source-text.ts    | 100 +++++++++++++++++++++++++++-----
 2 files changed, 85 insertions(+), 18 deletions(-)

diff --git a/apps/docs/components/ui/faq.tsx b/apps/docs/components/ui/faq.tsx
index 561fe4541e3..67003a0381d 100644
--- a/apps/docs/components/ui/faq.tsx
+++ b/apps/docs/components/ui/faq.tsx
@@ -2,7 +2,6 @@
 
 import { useId, useState } from 'react'
 import { ChevronRight } from '@sim/emcn/icons'
-import Script from 'next/script'
 import { serializeJsonLd } from '@/lib/json-ld'
 import { cn } from '@/lib/utils'
 
@@ -91,7 +90,7 @@ export function FAQ({ items, title = 'Common Questions' }: FAQProps) {
 
   return (
     <div className='mt-12'>
-      <Script
+      <script
         id={`faq-json-ld-${structuredDataId}`}
         type='application/ld+json'
         dangerouslySetInnerHTML={{ __html: serializeJsonLd(faqSchema) }}
diff --git a/scripts/check-source-text.ts b/scripts/check-source-text.ts
index c406242cc8d..188b1f8f191 100644
--- a/scripts/check-source-text.ts
+++ b/scripts/check-source-text.ts
@@ -1,18 +1,26 @@
 #!/usr/bin/env bun
 /**
- * Asserts that no tracked source file contains a raw `U+0000`.
- *
- * Git classifies a file as binary the moment its contents hold a NUL byte, so a
- * single stray `U+0000` written as a literal turns the whole file into
- * `Bin 0 -> 4102 bytes` in every diff — a reviewer sees not one line of it, and
- * `git grep`, formatters, and editors treat it as opaque or silently normalize
- * the byte away. `apps/sim/lib/api/server/nul-byte-boundary.test.ts` shipped
- * exactly that way, and two older files had done the same unnoticed.
+ * Asserts two properties of tracked source text that no linter covers.
  *
+ * No raw `U+0000`. Git classifies a file as binary the moment its contents hold
+ * a NUL byte, so a single stray `U+0000` written as a literal turns the whole
+ * file into `Bin 0 -> 4102 bytes` in every diff — a reviewer sees not one line
+ * of it, and `git grep`, formatters, and editors treat it as opaque or silently
+ * normalize the byte away. `apps/sim/lib/api/server/nul-byte-boundary.test.ts`
+ * shipped exactly that way, and two older files had done the same unnoticed.
  * The escape `'\u0000'` produces an identical string at runtime, so this costs
  * nothing to satisfy. `.gitattributes` forces source files to diff as text as a
  * second layer, which makes a violation visible; this audit is what keeps one
  * from landing in the first place.
+ *
+ * No `next/script` carrying a non-JavaScript `type` (JSON-LD, `application/json`,
+ * a template) in `apps/**`. `next/script` loads and executes JavaScript: its
+ * default `afterInteractive` strategy renders nothing on the server and injects
+ * the tag from an effect, and `beforeInteractive` pushes it onto the
+ * `self.__next_s` client queue, so the data never appears in the served HTML
+ * that crawlers read. The docs JSON-LD shipped that way twice. Data belongs in a
+ * native `<script type='application/ld+json'>` whose payload escapes `<`
+ * (`serializeJsonLd`), as Next's JSON-LD guide prescribes.
  */
 import { spawnSync } from 'node:child_process'
 import path from 'node:path'
@@ -38,6 +46,47 @@ const SOURCE_EXTENSIONS = [
   '*.sh',
 ]
 
+/** `type` values `next/script` exists to load; `text/partytown` is its `worker` strategy. */
+const EXECUTABLE_SCRIPT_TYPES = new Set([
+  '',
+  'module',
+  'text/javascript',
+  'application/javascript',
+  'text/partytown',
+])
+
+const NEXT_SCRIPT_IMPORT = /import\s+(\w+)\s*(?:,\s*\{[^}]*\}\s*)?from\s*['"]next\/script['"]/
+const TYPE_ATTRIBUTE =
+  /\btype\s*=\s*(?:'([^']*)'|"([^"]*)"|\{\s*(?:'([^']*)'|"([^"]*)"|`([^`$]*)`)\s*\})/
+
+/** The attribute text of the JSX opening tag that starts at `start`, skipping `>` inside braces. */
+function openingTagAttributes(source: string, start: number): string {
+  let depth = 0
+  for (let index = start; index < source.length; index++) {
+    const char = source[index]
+    if (char === '{') depth++
+    else if (char === '}') depth--
+    else if (char === '>' && depth === 0) return source.slice(start, index)
+  }
+  return source.slice(start)
+}
+
+/** Line numbers of `next/script` elements in `source` whose `type` is not JavaScript. */
+function findDataNextScripts(source: string): number[] {
+  const localName = NEXT_SCRIPT_IMPORT.exec(source)?.[1]
+  if (!localName) return []
+  const lines: number[] = []
+  for (const match of source.matchAll(new RegExp(`<${localName}\\b`, 'g'))) {
+    const attributes = openingTagAttributes(source, match.index + match[0].length)
+    const typeMatch = TYPE_ATTRIBUTE.exec(attributes)
+    if (!typeMatch) continue
+    const type = typeMatch.slice(1).find((value) => value !== undefined) ?? ''
+    if (EXECUTABLE_SCRIPT_TYPES.has(type.trim().toLowerCase())) continue
+    lines.push(source.slice(0, match.index).split('\n').length)
+  }
+  return lines
+}
+
 const listed = spawnSync('git', ['ls-files', '-z', '--', ...SOURCE_EXTENSIONS], {
   cwd: ROOT,
   encoding: 'buffer',
@@ -54,22 +103,41 @@ const files = listed.stdout
   .split('\0')
   .filter((entry) => entry.length > 0)
 
-const offenders: string[] = []
+const nulOffenders: string[] = []
+const dataScriptOffenders: string[] = []
 for (const file of files) {
   const source = Bun.file(path.join(ROOT, file))
   if (!(await source.exists())) continue
   const bytes = await source.bytes()
-  if (bytes.includes(0)) offenders.push(file)
+  if (bytes.includes(0)) nulOffenders.push(file)
+  if (file.startsWith('apps/') && /\.[jt]sx$/.test(file)) {
+    const text = new TextDecoder().decode(bytes)
+    if (!text.includes('next/script')) continue
+    for (const line of findDataNextScripts(text)) dataScriptOffenders.push(`${file}:${line}`)
+  }
 }
 
-if (offenders.length > 0) {
+if (nulOffenders.length > 0) {
   console.error(
-    `Source-text audit failed: ${offenders.length} tracked source file(s) contain a raw NUL byte,\n` +
+    `Source-text audit failed: ${nulOffenders.length} tracked source file(s) contain a raw NUL byte,\n` +
       'which makes git treat them as binary and hides their contents from review.\n\n' +
-      offenders.map((file) => `  ${file}`).join('\n') +
-      "\n\n  Write the character as the escape '\\u0000' instead — the runtime string is identical."
+      nulOffenders.map((file) => `  ${file}`).join('\n') +
+      "\n\n  Write the character as the escape '\\u0000' instead — the runtime string is identical.\n"
   )
-  process.exit(1)
 }
 
-console.log(`Source-text audit passed (${files.length} files, no raw NUL bytes).`)
+if (dataScriptOffenders.length > 0) {
+  console.error(
+    `Source-text audit failed: ${dataScriptOffenders.length} \`next/script\` element(s) carry a non-JavaScript \`type\`,\n` +
+      'which next/script never writes into the server HTML, so crawlers never see the data.\n\n' +
+      dataScriptOffenders.map((location) => `  ${location}`).join('\n') +
+      "\n\n  Render a native <script type='application/ld+json' dangerouslySetInnerHTML={{ __html: serializeJsonLd(data) }} />\n" +
+      '  instead, as apps/docs/components/structured-data.tsx does.\n'
+  )
+}
+
+if (nulOffenders.length > 0 || dataScriptOffenders.length > 0) process.exit(1)
+
+console.log(
+  `Source-text audit passed (${files.length} files, no raw NUL bytes, no data-typed next/script).`
+)

From 3eb8131e7f32df97195c6c837a97bf9a9f1c5375 Mon Sep 17 00:00:00 2001
From: Waleed Latif <walif6@gmail.com>
Date: Fri, 9 Oct 2026 19:08:37 -0700
Subject: [PATCH 2/4] fix(audits): match only the real type prop, fail closed
 on expression types, and scan MDX pages

---
 scripts/check-source-text.ts | 22 ++++++++++++++--------
 1 file changed, 14 insertions(+), 8 deletions(-)

diff --git a/scripts/check-source-text.ts b/scripts/check-source-text.ts
index 188b1f8f191..a1883c4022c 100644
--- a/scripts/check-source-text.ts
+++ b/scripts/check-source-text.ts
@@ -56,8 +56,10 @@ const EXECUTABLE_SCRIPT_TYPES = new Set([
 ])
 
 const NEXT_SCRIPT_IMPORT = /import\s+(\w+)\s*(?:,\s*\{[^}]*\}\s*)?from\s*['"]next\/script['"]/
-const TYPE_ATTRIBUTE =
-  /\btype\s*=\s*(?:'([^']*)'|"([^"]*)"|\{\s*(?:'([^']*)'|"([^"]*)"|`([^`$]*)`)\s*\})/
+/** The start of the element's own `type` prop — not a suffix like `data-type`. */
+const TYPE_PROP = /(?:^|\s)type\s*=\s*/
+/** A statically known `type` value right after {@link TYPE_PROP}. */
+const LITERAL_TYPE_VALUE = /^(?:'([^']*)'|"([^"]*)"|\{\s*(?:'([^']*)'|"([^"]*)"|`([^`$]*)`)\s*\})/
 
 /** The attribute text of the JSX opening tag that starts at `start`, skipping `>` inside braces. */
 function openingTagAttributes(source: string, start: number): string {
@@ -71,17 +73,21 @@ function openingTagAttributes(source: string, start: number): string {
   return source.slice(start)
 }
 
-/** Line numbers of `next/script` elements in `source` whose `type` is not JavaScript. */
+/**
+ * Line numbers of `next/script` elements in `source` whose `type` is not JavaScript. A `type` set
+ * from an expression fails closed: the audit cannot prove it executable.
+ */
 function findDataNextScripts(source: string): number[] {
   const localName = NEXT_SCRIPT_IMPORT.exec(source)?.[1]
   if (!localName) return []
   const lines: number[] = []
   for (const match of source.matchAll(new RegExp(`<${localName}\\b`, 'g'))) {
     const attributes = openingTagAttributes(source, match.index + match[0].length)
-    const typeMatch = TYPE_ATTRIBUTE.exec(attributes)
-    if (!typeMatch) continue
-    const type = typeMatch.slice(1).find((value) => value !== undefined) ?? ''
-    if (EXECUTABLE_SCRIPT_TYPES.has(type.trim().toLowerCase())) continue
+    const typeProp = TYPE_PROP.exec(attributes)
+    if (!typeProp) continue
+    const literal = LITERAL_TYPE_VALUE.exec(attributes.slice(typeProp.index + typeProp[0].length))
+    const type = literal?.slice(1).find((value) => value !== undefined)
+    if (type !== undefined && EXECUTABLE_SCRIPT_TYPES.has(type.trim().toLowerCase())) continue
     lines.push(source.slice(0, match.index).split('\n').length)
   }
   return lines
@@ -110,7 +116,7 @@ for (const file of files) {
   if (!(await source.exists())) continue
   const bytes = await source.bytes()
   if (bytes.includes(0)) nulOffenders.push(file)
-  if (file.startsWith('apps/') && /\.[jt]sx$/.test(file)) {
+  if (file.startsWith('apps/') && /\.(?:[jt]sx|mdx)$/.test(file)) {
     const text = new TextDecoder().decode(bytes)
     if (!text.includes('next/script')) continue
     for (const line of findDataNextScripts(text)) dataScriptOffenders.push(`${file}:${line}`)

From c4f55aaee4b9626943823913ceea5a4b8450977e Mon Sep 17 00:00:00 2001
From: Waleed Latif <walif6@gmail.com>
Date: Fri, 9 Oct 2026 19:14:46 -0700
Subject: [PATCH 3/4] fix(audits): recognize default-as next/script imports and
 skip MDX code examples

---
 scripts/check-source-text.ts | 15 ++++++++++++---
 1 file changed, 12 insertions(+), 3 deletions(-)

diff --git a/scripts/check-source-text.ts b/scripts/check-source-text.ts
index a1883c4022c..c54d263c3be 100644
--- a/scripts/check-source-text.ts
+++ b/scripts/check-source-text.ts
@@ -55,7 +55,12 @@ const EXECUTABLE_SCRIPT_TYPES = new Set([
   'text/partytown',
 ])
 
-const NEXT_SCRIPT_IMPORT = /import\s+(\w+)\s*(?:,\s*\{[^}]*\}\s*)?from\s*['"]next\/script['"]/
+/** `import Script from 'next/script'` (optionally with named imports) or `import { default as Script }`. */
+const NEXT_SCRIPT_IMPORT =
+  /import\s+(?:(\w+)\s*(?:,\s*\{[^}]*\}\s*)?|\{[^}]*\bdefault\s+as\s+(\w+)[^}]*\}\s*)from\s*['"]next\/script['"]/
+
+/** MDX fenced and inline code, which a docs page displays rather than renders. */
+const MDX_CODE = /```[\s\S]*?```|`[^`\n]*`/g
 /** The start of the element's own `type` prop — not a suffix like `data-type`. */
 const TYPE_PROP = /(?:^|\s)type\s*=\s*/
 /** A statically known `type` value right after {@link TYPE_PROP}. */
@@ -78,7 +83,8 @@ function openingTagAttributes(source: string, start: number): string {
  * from an expression fails closed: the audit cannot prove it executable.
  */
 function findDataNextScripts(source: string): number[] {
-  const localName = NEXT_SCRIPT_IMPORT.exec(source)?.[1]
+  const importMatch = NEXT_SCRIPT_IMPORT.exec(source)
+  const localName = importMatch?.[1] ?? importMatch?.[2]
   if (!localName) return []
   const lines: number[] = []
   for (const match of source.matchAll(new RegExp(`<${localName}\\b`, 'g'))) {
@@ -117,7 +123,10 @@ for (const file of files) {
   const bytes = await source.bytes()
   if (bytes.includes(0)) nulOffenders.push(file)
   if (file.startsWith('apps/') && /\.(?:[jt]sx|mdx)$/.test(file)) {
-    const text = new TextDecoder().decode(bytes)
+    const decoded = new TextDecoder().decode(bytes)
+    const text = file.endsWith('.mdx')
+      ? decoded.replace(MDX_CODE, (code) => code.replace(/[^\n]/g, ' '))
+      : decoded
     if (!text.includes('next/script')) continue
     for (const line of findDataNextScripts(text)) dataScriptOffenders.push(`${file}:${line}`)
   }

From 765cda1a780ffa914a53c6c66e8e61d233594eb7 Mon Sep 17 00:00:00 2001
From: Waleed Latif <walif6@gmail.com>
Date: Fri, 9 Oct 2026 19:20:15 -0700
Subject: [PATCH 4/4] fix(audits): keep JSX template literals intact when
 skipping MDX inline code

---
 scripts/check-source-text.ts | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/scripts/check-source-text.ts b/scripts/check-source-text.ts
index c54d263c3be..f983388e7c4 100644
--- a/scripts/check-source-text.ts
+++ b/scripts/check-source-text.ts
@@ -59,8 +59,12 @@ const EXECUTABLE_SCRIPT_TYPES = new Set([
 const NEXT_SCRIPT_IMPORT =
   /import\s+(?:(\w+)\s*(?:,\s*\{[^}]*\}\s*)?|\{[^}]*\bdefault\s+as\s+(\w+)[^}]*\}\s*)from\s*['"]next\/script['"]/
 
-/** MDX fenced and inline code, which a docs page displays rather than renders. */
-const MDX_CODE = /```[\s\S]*?```|`[^`\n]*`/g
+/**
+ * MDX fenced and inline code, which a docs page displays rather than renders. An inline span
+ * directly inside a JSX expression (`{`…`}`, `=`…, `(`…) is a template literal, not code, so it
+ * is left intact for the `type` check.
+ */
+const MDX_CODE = /```[\s\S]*?```|(?<![{=($\w])`[^`\n]*`/g
 /** The start of the element's own `type` prop — not a suffix like `data-type`. */
 const TYPE_PROP = /(?:^|\s)type\s*=\s*/
 /** A statically known `type` value right after {@link TYPE_PROP}. */