fix: only require svelte-trusted-html trusted-types policy when client code ships

[willfarrell]

Previously, setting csp.directives['require-trusted-types-for']: ['script'] without including 'svelte-trusted-html' in trusted-types threw during config validation. This blocked builds of apps where every page has csr: false — those apps ship no client-side code, so the policy is never used.

The check now runs at build time instead, reusing the same statically-analysed page options that decide skip_client_build. If any page ships client code (or its csr option can't be statically analysed), the original error still throws; if all pages have csr: false, the build proceeds.

Note: since the analysis only runs during build, vite dev no longer surfaces the missing policy at startup.

• packages/kit/src/core/config/index.js — removed the check from validate_config
• packages/kit/src/exports/vite/index.js — added the check after skip_client_build is computed

Please don't delete this checklist! Before submitting the PR, please make sure you do the following:

• It's really useful if your PR references an issue where it is discussed ahead of time. In many cases, features are absent for a reason. For large changes, please create an RFC: https://github.com/sveltejs/rfcs
• This message body should clearly illustrate what problems it solves.
• Ideally, include a test that fails without this PR but passes with it.

Tests

• Run the tests with pnpm test and lint the project with pnpm lint and pnpm check

Changesets

• If your PR makes a change that should be noted in one or more packages' changelogs, generate a changeset by running pnpm changeset and following the prompts. Changesets that add features should be minor and those that fix bugs should be patch. Please prefix changeset messages with feat:, fix:, or chore:.

Edits

• Please ensure that 'Allow edits from maintainers' is checked. PRs without this option may be closed.

[pkg-svelte-dev]

Install the latest version of @sveltejs/kit from 65f96d7:

pnpm add https://pkg.svelte.dev/@sveltejs/kit/c/65f96d7f6c16c79139a0842ba512561b6a0e4bda

Open in pkg.svelte.dev: https://pkg.svelte.dev/repos/kit/pr/16866

Note

This PR is from a fork. A maintainer must approve approve each commit before it can be built and installed.

[changeset-bot]

🦋 Changeset detected

Latest commit: 65f96d7

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@sveltejs/kit	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[teemingc]

Thank you for the PR. Can you please rebase it against the version-3 branch?

[willfarrell]

Closing, replacing with #16928 (based off version-3)