@nuxt/scripts 1.0.0-beta.2 → 1.0.0-beta.4

package/dist/client/_nuxt/{DvH517bE.js → DdVDSbUA.js}

@@ -1 +1 @@
-import{_ as o,c as s,o as a,a as t,t as r}from"./B8XOar-X.js";import{u as i}from"./DfLgoB--.js";const u={class:"antialiased bg-white dark:bg-[#020420] dark:text-white font-sans grid min-h-screen overflow-hidden place-content-center text-[#020420] tracking-wide"},l={class:"max-w-520px text-center"},c=["textContent"],d=["textContent"],p=["textContent"],f={__name:"error-500",props:{appName:{type:String,default:"Nuxt"},status:{type:Number,default:500},statusText:{type:String,default:"Internal server error"},description:{type:String,default:"This page is temporarily unavailable."},refresh:{type:String,default:"Refresh this page"}},setup(e){const n=e;return i({title:`${n.status} - ${n.statusText} | ${n.appName}`,script:[{innerHTML:`!function(){const e=document.createElement("link").relList;if(!(e&&e.supports&&e.supports("modulepreload"))){for(const e of document.querySelectorAll('link[rel="modulepreload"]'))r(e);new MutationObserver(e=>{for(const o of e)if("childList"===o.type)for(const e of o.addedNodes)"LINK"===e.tagName&&"modulepreload"===e.rel&&r(e)}).observe(document,{childList:!0,subtree:!0})}function r(e){if(e.ep)return;e.ep=!0;const r=function(e){const r={};return e.integrity&&(r.integrity=e.integrity),e.referrerPolicy&&(r.referrerPolicy=e.referrerPolicy),"use-credentials"===e.crossOrigin?r.credentials="include":"anonymous"===e.crossOrigin?r.credentials="omit":r.credentials="same-origin",r}(e);fetch(e.href,r)}}();`}],style:[{innerHTML:'*,:after,:before{border-color:var(--un-default-border-color,#e5e7eb);border-style:solid;border-width:0;box-sizing:border-box}:after,:before{--un-content:""}html{line-height:1.5;-webkit-text-size-adjust:100%;font-family:ui-sans-serif,system-ui,sans-serif,Apple Color Emoji,Segoe UI Emoji,Segoe UI Symbol,Noto Color Emoji;font-feature-settings:normal;font-variation-settings:normal;-moz-tab-size:4;tab-size:4;-webkit-tap-highlight-color:transparent}body{line-height:inherit;margin:0}h1,h2{font-size:inherit;font-weight:inherit}h1,h2,p{margin:0}*,:after,:before{--un-rotate:0;--un-rotate-x:0;--un-rotate-y:0;--un-rotate-z:0;--un-scale-x:1;--un-scale-y:1;--un-scale-z:1;--un-skew-x:0;--un-skew-y:0;--un-translate-x:0;--un-translate-y:0;--un-translate-z:0;--un-pan-x: ;--un-pan-y: ;--un-pinch-zoom: ;--un-scroll-snap-strictness:proximity;--un-ordinal: ;--un-slashed-zero: ;--un-numeric-figure: ;--un-numeric-spacing: ;--un-numeric-fraction: ;--un-border-spacing-x:0;--un-border-spacing-y:0;--un-ring-offset-shadow:0 0 transparent;--un-ring-shadow:0 0 transparent;--un-shadow-inset: ;--un-shadow:0 0 transparent;--un-ring-inset: ;--un-ring-offset-width:0px;--un-ring-offset-color:#fff;--un-ring-width:0px;--un-ring-color:rgba(147,197,253,.5);--un-blur: ;--un-brightness: ;--un-contrast: ;--un-drop-shadow: ;--un-grayscale: ;--un-hue-rotate: ;--un-invert: ;--un-saturate: ;--un-sepia: ;--un-backdrop-blur: ;--un-backdrop-brightness: ;--un-backdrop-contrast: ;--un-backdrop-grayscale: ;--un-backdrop-hue-rotate: ;--un-backdrop-invert: ;--un-backdrop-opacity: ;--un-backdrop-saturate: ;--un-backdrop-sepia: }'}]}),(h,m)=>(a(),s("div",u,[t("div",l,[t("h1",{class:"font-semibold leading-none mb-4 sm:text-[110px] tabular-nums text-[80px]",textContent:r(e.status)},null,8,c),t("h2",{class:"font-semibold mb-2 sm:text-3xl text-2xl",textContent:r(e.statusText)},null,8,d),t("p",{class:"mb-4 px-2 text-[#64748B] text-md",textContent:r(e.description)},null,8,p)])]))}},x=o(f,[["__scopeId","data-v-2367f596"]]);export{x as default};
+import{_ as o,c as s,o as a,a as t,t as r}from"./D-kOnTuH.js";import{u as i}from"./Ds2G8aQM.js";const u={class:"antialiased bg-white dark:bg-[#020420] dark:text-white font-sans grid min-h-screen overflow-hidden place-content-center text-[#020420] tracking-wide"},l={class:"max-w-520px text-center"},c=["textContent"],d=["textContent"],p=["textContent"],f={__name:"error-500",props:{appName:{type:String,default:"Nuxt"},status:{type:Number,default:500},statusText:{type:String,default:"Internal server error"},description:{type:String,default:"This page is temporarily unavailable."},refresh:{type:String,default:"Refresh this page"}},setup(e){const n=e;return i({title:`${n.status} - ${n.statusText} | ${n.appName}`,script:[{innerHTML:`!function(){const e=document.createElement("link").relList;if(!(e&&e.supports&&e.supports("modulepreload"))){for(const e of document.querySelectorAll('link[rel="modulepreload"]'))r(e);new MutationObserver(e=>{for(const o of e)if("childList"===o.type)for(const e of o.addedNodes)"LINK"===e.tagName&&"modulepreload"===e.rel&&r(e)}).observe(document,{childList:!0,subtree:!0})}function r(e){if(e.ep)return;e.ep=!0;const r=function(e){const r={};return e.integrity&&(r.integrity=e.integrity),e.referrerPolicy&&(r.referrerPolicy=e.referrerPolicy),"use-credentials"===e.crossOrigin?r.credentials="include":"anonymous"===e.crossOrigin?r.credentials="omit":r.credentials="same-origin",r}(e);fetch(e.href,r)}}();`}],style:[{innerHTML:'*,:after,:before{border-color:var(--un-default-border-color,#e5e7eb);border-style:solid;border-width:0;box-sizing:border-box}:after,:before{--un-content:""}html{line-height:1.5;-webkit-text-size-adjust:100%;font-family:ui-sans-serif,system-ui,sans-serif,Apple Color Emoji,Segoe UI Emoji,Segoe UI Symbol,Noto Color Emoji;font-feature-settings:normal;font-variation-settings:normal;-moz-tab-size:4;tab-size:4;-webkit-tap-highlight-color:transparent}body{line-height:inherit;margin:0}h1,h2{font-size:inherit;font-weight:inherit}h1,h2,p{margin:0}*,:after,:before{--un-rotate:0;--un-rotate-x:0;--un-rotate-y:0;--un-rotate-z:0;--un-scale-x:1;--un-scale-y:1;--un-scale-z:1;--un-skew-x:0;--un-skew-y:0;--un-translate-x:0;--un-translate-y:0;--un-translate-z:0;--un-pan-x: ;--un-pan-y: ;--un-pinch-zoom: ;--un-scroll-snap-strictness:proximity;--un-ordinal: ;--un-slashed-zero: ;--un-numeric-figure: ;--un-numeric-spacing: ;--un-numeric-fraction: ;--un-border-spacing-x:0;--un-border-spacing-y:0;--un-ring-offset-shadow:0 0 transparent;--un-ring-shadow:0 0 transparent;--un-shadow-inset: ;--un-shadow:0 0 transparent;--un-ring-inset: ;--un-ring-offset-width:0px;--un-ring-offset-color:#fff;--un-ring-width:0px;--un-ring-color:rgba(147,197,253,.5);--un-blur: ;--un-brightness: ;--un-contrast: ;--un-drop-shadow: ;--un-grayscale: ;--un-hue-rotate: ;--un-invert: ;--un-saturate: ;--un-sepia: ;--un-backdrop-blur: ;--un-backdrop-brightness: ;--un-backdrop-contrast: ;--un-backdrop-grayscale: ;--un-backdrop-hue-rotate: ;--un-backdrop-invert: ;--un-backdrop-opacity: ;--un-backdrop-saturate: ;--un-backdrop-sepia: }'}]}),(h,m)=>(a(),s("div",u,[t("div",l,[t("h1",{class:"font-semibold leading-none mb-4 sm:text-[110px] tabular-nums text-[80px]",textContent:r(e.status)},null,8,c),t("h2",{class:"font-semibold mb-2 sm:text-3xl text-2xl",textContent:r(e.statusText)},null,8,d),t("p",{class:"mb-4 px-2 text-[#64748B] text-md",textContent:r(e.description)},null,8,p)])]))}},x=o(f,[["__scopeId","data-v-2367f596"]]);export{x as default};

package/dist/client/_nuxt/{DfLgoB--.js → Ds2G8aQM.js}

@@ -1 +1 @@
-import{u as a,f as s,h as u,i as r,g as h}from"./B8XOar-X.js";function i(t){const e=t||s();return e.ssrContext?.head||e.runWithContext(()=>{if(u()){const n=r(h);if(!n)throw new Error("[nuxt] [unhead] Missing Unhead instance.");return n}})}function d(t,e={}){const n=e.head||i(e.nuxt);return a(t,{head:n,...e})}export{d as u};
+import{u as a,f as s,h as u,i as r,g as h}from"./D-kOnTuH.js";function i(t){const e=t||s();return e.ssrContext?.head||e.runWithContext(()=>{if(u()){const n=r(h);if(!n)throw new Error("[nuxt] [unhead] Missing Unhead instance.");return n}})}function d(t,e={}){const n=e.head||i(e.nuxt);return a(t,{head:n,...e})}export{d as u};

package/dist/client/_nuxt/builds/latest.json

@@ -1 +1 @@
-{"id":"133a46c5-a5c1-4a63-87d1-037947a5bcdb","timestamp":1771947388424}
+{"id":"cc1ba70f-082b-4dc7-8639-5f076fef2cfa","timestamp":1772035753039}

package/dist/client/_nuxt/builds/meta/cc1ba70f-082b-4dc7-8639-5f076fef2cfa.json

@@ -0,0 +1 @@
+{"id":"cc1ba70f-082b-4dc7-8639-5f076fef2cfa","timestamp":1772035753039,"prerendered":[]}

package/dist/client/index.html

@@ -1 +1 @@
-<!DOCTYPE html><html><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1"><link rel="stylesheet" href="/__nuxt-scripts/_nuxt/entry.D45OuV0w.css" crossorigin><link rel="modulepreload" as="script" crossorigin href="/__nuxt-scripts/_nuxt/B8XOar-X.js"><script type="module" src="/__nuxt-scripts/_nuxt/B8XOar-X.js" crossorigin></script></head><body><div id="__nuxt"></div><div id="teleports"></div><script>window.__NUXT__={};window.__NUXT__.config={public:{"nuxt-scripts":{version:"",defaultScriptOptions:{trigger:"onNuxtReady"},googleStaticMapsProxy:""},"nuxt-scripts-sw":{path:"/_nuxt-scripts-sw.js"}},app:{baseURL:"/__nuxt-scripts",buildId:"133a46c5-a5c1-4a63-87d1-037947a5bcdb",buildAssetsDir:"/_nuxt/",cdnURL:""}}</script><script type="application/json" data-nuxt-data="nuxt-app" data-ssr="false" id="__NUXT_DATA__">[{"prerenderedAt":1,"serverRendered":2},1771947392903,false]</script></body></html>
+<!DOCTYPE html><html><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1"><link rel="stylesheet" href="/__nuxt-scripts/_nuxt/entry.D45OuV0w.css" crossorigin><link rel="modulepreload" as="script" crossorigin href="/__nuxt-scripts/_nuxt/D-kOnTuH.js"><script type="module" src="/__nuxt-scripts/_nuxt/D-kOnTuH.js" crossorigin></script></head><body><div id="__nuxt"></div><div id="teleports"></div><script>window.__NUXT__={};window.__NUXT__.config={public:{"nuxt-scripts":{version:"",defaultScriptOptions:{trigger:"onNuxtReady"},googleStaticMapsProxy:""},"nuxt-scripts-sw":{path:"/_nuxt-scripts-sw.js"}},app:{baseURL:"/__nuxt-scripts",buildId:"cc1ba70f-082b-4dc7-8639-5f076fef2cfa",buildAssetsDir:"/_nuxt/",cdnURL:""}}</script><script type="application/json" data-nuxt-data="nuxt-app" data-ssr="false" id="__NUXT_DATA__">[{"prerenderedAt":1,"serverRendered":2},1772035757664,false]</script></body></html>

package/dist/module.d.mts

@@ -1,6 +1,7 @@
 import * as _nuxt_schema from '@nuxt/schema';
 import { FetchOptions } from 'ofetch';
 import { RegistryScripts, NuxtConfigScriptRegistry, NuxtUseScriptOptionsSerializable, NuxtUseScriptInput } from '../dist/runtime/types.js';
+import { ProxyPrivacyInput } from '../dist/runtime/server/utils/privacy.js';
 
 declare module '@nuxt/schema' {
     interface NuxtHooks {
@@ -8,17 +9,21 @@ declare module '@nuxt/schema' {
     }
 }
 /**
- * Privacy mode for first-party proxy requests.
+ * Global privacy override for all first-party proxy requests.
  *
- * - `'anonymize'` (default) - Prevents fingerprinting: anonymizes IP addresses to country-level,
- *   normalizes device info and canvas data. All other data passes through unchanged.
+ * By default (`undefined`), each script uses its own privacy controls declared in the registry.
+ * Setting this overrides all per-script defaults:
  *
- * - `'proxy'` - Minimal modification: forwards headers and data, but strips sensitive
- *   auth/session headers (cookie, authorization) to prevent leaking credentials to
- *   third-party endpoints. Privacy comes from routing requests through your server
- *   (third parties see server IP, not user IP).
+ * - `true` - Full anonymize: anonymizes IP, normalizes User-Agent/language,
+ *   generalizes screen/hardware/canvas/timezone data.
+ *
+ * - `false` - Passthrough: forwards headers and data, but strips sensitive
+ *   auth/session headers (cookie, authorization).
+ *
+ * - `{ ip: false }` - Selective: override individual flags. Unset flags inherit
+ *   from the per-script default.
  */
-type FirstPartyPrivacy = 'proxy' | 'anonymize';
+type FirstPartyPrivacy = ProxyPrivacyInput;
 interface FirstPartyOptions {
     /**
      * Path prefix for serving bundled scripts.
@@ -38,14 +43,16 @@ interface FirstPartyOptions {
      */
     collectPrefix?: string;
     /**
-     * Privacy level for proxied requests.
+     * Global privacy override for all proxied scripts.
      *
-     * Controls what user information is forwarded to third-party analytics services.
+     * By default, each script uses its own privacy controls from the registry.
+     * Set this to override all scripts at once:
      *
-     * - `'anonymize'` - Prevents fingerprinting by anonymizing IPs and device info (default)
-     * - `'proxy'` - No modification, just routes through your server
+     * - `true` - Full anonymize for all scripts
+     * - `false` - Passthrough for all scripts (still strips sensitive auth headers)
+     * - `{ ip: false }` - Selective override (unset flags inherit per-script defaults)
      *
-     * @default 'anonymize'
+     * @default undefined
      */
     privacy?: FirstPartyPrivacy;
 }

package/dist/module.json

@@ -4,7 +4,7 @@
   "compatibility": {
     "nuxt": ">=3.16"
   },
-  "version": "1.0.0-beta.2",
+  "version": "1.0.0-beta.4",
   "builder": {
     "@nuxt/module-builder": "1.0.2",
     "unbuild": "3.6.1"

package/dist/module.mjs

@@ -126,6 +126,8 @@ function setupPublicAssetStrategy(options = {}) {
 function buildProxyConfig(collectPrefix) {
   return {
     googleAnalytics: {
+      // GA4: screen/timezone/UA needed for device, time, and OS reports; rest anonymized safely
+      privacy: { ip: true, userAgent: false, language: true, screen: false, timezone: false, hardware: true },
       rewrite: [
         // Modern gtag.js uses www.google.com/g/collect
         { from: "www.google.com/g/collect", to: `${collectPrefix}/ga/g/collect` },
@@ -156,6 +158,8 @@ function buildProxyConfig(collectPrefix) {
       }
     },
     googleTagManager: {
+      // GTM: container only, passes data through — downstream tags have their own privacy
+      privacy: { ip: false, userAgent: false, language: false, screen: false, timezone: false, hardware: false },
       rewrite: [
         { from: "www.googletagmanager.com", to: `${collectPrefix}/gtm` }
       ],
@@ -164,6 +168,8 @@ function buildProxyConfig(collectPrefix) {
       }
     },
     metaPixel: {
+      // Meta: untrusted ad network — full anonymization
+      privacy: { ip: true, userAgent: true, language: true, screen: true, timezone: true, hardware: true },
       rewrite: [
         // SDK script loading
         { from: "connect.facebook.net", to: `${collectPrefix}/meta` },
@@ -182,6 +188,8 @@ function buildProxyConfig(collectPrefix) {
       }
     },
     tiktokPixel: {
+      // TikTok: untrusted ad network — full anonymization
+      privacy: { ip: true, userAgent: true, language: true, screen: true, timezone: true, hardware: true },
       rewrite: [
         { from: "analytics.tiktok.com", to: `${collectPrefix}/tiktok` }
       ],
@@ -190,6 +198,8 @@ function buildProxyConfig(collectPrefix) {
       }
     },
     segment: {
+      // Segment: trusted data pipeline — needs maximum fidelity for downstream destinations
+      privacy: { ip: false, userAgent: false, language: false, screen: false, timezone: false, hardware: false },
       rewrite: [
         { from: "api.segment.io", to: `${collectPrefix}/segment` },
         { from: "cdn.segment.com", to: `${collectPrefix}/segment-cdn` }
@@ -200,6 +210,8 @@ function buildProxyConfig(collectPrefix) {
       }
     },
     xPixel: {
+      // X/Twitter: untrusted ad network — full anonymization
+      privacy: { ip: true, userAgent: true, language: true, screen: true, timezone: true, hardware: true },
       rewrite: [
         { from: "analytics.twitter.com", to: `${collectPrefix}/x` },
         { from: "t.co", to: `${collectPrefix}/x-t` }
@@ -210,6 +222,8 @@ function buildProxyConfig(collectPrefix) {
       }
     },
     snapchatPixel: {
+      // Snapchat: untrusted ad network — full anonymization
+      privacy: { ip: true, userAgent: true, language: true, screen: true, timezone: true, hardware: true },
       rewrite: [
         { from: "tr.snapchat.com", to: `${collectPrefix}/snap` }
       ],
@@ -218,6 +232,8 @@ function buildProxyConfig(collectPrefix) {
       }
     },
     redditPixel: {
+      // Reddit: untrusted ad network — full anonymization
+      privacy: { ip: true, userAgent: true, language: true, screen: true, timezone: true, hardware: true },
       rewrite: [
         { from: "alb.reddit.com", to: `${collectPrefix}/reddit` }
       ],
@@ -226,6 +242,8 @@ function buildProxyConfig(collectPrefix) {
       }
     },
     clarity: {
+      // Clarity: screen/UA/timezone needed for heatmaps and device filtering; rest anonymized
+      privacy: { ip: true, userAgent: false, language: true, screen: false, timezone: false, hardware: true },
       rewrite: [
         // Main clarity domain
         { from: "www.clarity.ms", to: `${collectPrefix}/clarity` },
@@ -243,7 +261,22 @@ function buildProxyConfig(collectPrefix) {
         [`${collectPrefix}/clarity-events/**`]: { proxy: "https://e.clarity.ms/**" }
       }
     },
+    posthog: {
+      // No rewrites needed - PostHog uses NPM mode, SDK URLs are set via api_host config
+      // PostHog: needs real IP for GeoIP enrichment + feature flag targeting
+      privacy: { ip: false, userAgent: false, language: false, screen: false, timezone: false, hardware: false },
+      routes: {
+        // US region
+        [`${collectPrefix}/ph/static/**`]: { proxy: "https://us-assets.i.posthog.com/static/**" },
+        [`${collectPrefix}/ph/**`]: { proxy: "https://us.i.posthog.com/**" },
+        // EU region
+        [`${collectPrefix}/ph-eu/static/**`]: { proxy: "https://eu-assets.i.posthog.com/static/**" },
+        [`${collectPrefix}/ph-eu/**`]: { proxy: "https://eu.i.posthog.com/**" }
+      }
+    },
     hotjar: {
+      // Hotjar: screen/UA/timezone needed for heatmaps and device segmentation; rest anonymized
+      privacy: { ip: true, userAgent: false, language: true, screen: false, timezone: false, hardware: true },
       rewrite: [
         // Static assets
         { from: "static.hotjar.com", to: `${collectPrefix}/hotjar` },
@@ -652,7 +685,7 @@ function NuxtScriptBundleTransformer(options = {
                             s.appendRight(node.arguments[0].start + 1, ` scriptInput: { src: '${url}'${integrityProps} }, `);
                           }
                         } else {
-                          s.appendRight(node.callee.end, `({ scriptInput: { src: '${url}'${integrityProps} } })`);
+                          s.overwrite(node.callee.end, node.end, `({ scriptInput: { src: '${url}'${integrityProps} } })`);
                         }
                       }
                     });
@@ -1037,7 +1070,7 @@ const module$1 = defineNuxtModule({
     const firstPartyEnabled = !!config.firstParty;
     const firstPartyPrefix = typeof config.firstParty === "object" ? config.firstParty.prefix : void 0;
     const firstPartyCollectPrefix = typeof config.firstParty === "object" ? config.firstParty.collectPrefix || "/_proxy" : "/_proxy";
-    const firstPartyPrivacy = typeof config.firstParty === "object" ? config.firstParty.privacy ?? "anonymize" : "anonymize";
+    const firstPartyPrivacy = typeof config.firstParty === "object" ? config.firstParty.privacy : void 0;
     const assetsPrefix = firstPartyPrefix || config.assets?.prefix || "/_scripts";
     if (config.partytown?.length) {
       config.registry = config.registry || {};
@@ -1225,6 +1258,7 @@ export default defineNuxtPlugin({
         const proxyConfigs = getAllProxyConfigs(firstPartyCollectPrefix);
         const registryKeys = Object.keys(config.registry || {});
         const neededRoutes = {};
+        const routePrivacyOverrides = {};
         const unsupportedScripts = [];
         for (const key of registryKeys) {
           const script = registryScriptsWithImport.find((s) => s.import.name.toLowerCase() === `usescript${key.toLowerCase()}`);
@@ -1233,11 +1267,21 @@ export default defineNuxtPlugin({
             const proxyConfig = proxyConfigs[proxyKey];
             if (proxyConfig?.routes) {
               Object.assign(neededRoutes, proxyConfig.routes);
+              for (const routePath of Object.keys(proxyConfig.routes)) {
+                routePrivacyOverrides[routePath] = proxyConfig.privacy;
+              }
             } else {
               unsupportedScripts.push(key);
             }
           }
         }
+        if (config.registry?.posthog && typeof config.registry.posthog === "object") {
+          const phConfig = config.registry.posthog;
+          if (!phConfig.apiHost) {
+            const region = phConfig.region || "us";
+            phConfig.apiHost = region === "eu" ? `${firstPartyCollectPrefix}/ph-eu` : `${firstPartyCollectPrefix}/ph`;
+          }
+        }
         if (unsupportedScripts.length && nuxt.options.dev) {
           logger.warn(
             `First-party mode is enabled but these scripts don't support it yet: ${unsupportedScripts.join(", ")}.
@@ -1262,13 +1306,17 @@ They will load directly from third-party servers. Request support at https://git
         nuxt.options.runtimeConfig["nuxt-scripts-proxy"] = {
           routes: flatRoutes,
           privacy: firstPartyPrivacy,
+          // undefined = use per-script defaults, set = global override
+          routePrivacy: routePrivacyOverrides,
+          // per-script privacy from registry
           rewrites: allRewrites
         };
         if (Object.keys(neededRoutes).length) {
           if (nuxt.options.dev) {
             const routeCount = Object.keys(neededRoutes).length;
             const scriptsCount = registryKeys.length;
-            logger.success(`First-party mode enabled for ${scriptsCount} script(s), ${routeCount} proxy route(s) configured (privacy: ${firstPartyPrivacy})`);
+            const privacyLabel = firstPartyPrivacy === void 0 ? "per-script" : typeof firstPartyPrivacy === "boolean" ? firstPartyPrivacy ? "anonymize" : "passthrough" : "custom";
+            logger.success(`First-party mode enabled for ${scriptsCount} script(s), ${routeCount} proxy route(s) configured (privacy: ${privacyLabel})`);
             if (logger.level >= 4) {
               for (const [path, config2] of Object.entries(neededRoutes)) {
                 logger.debug(`  ${path} \u2192 ${config2.proxy}`);

package/dist/registry.mjs

@@ -29,6 +29,7 @@ async function registry(resolve) {
     {
       label: "PostHog",
       src: false,
+      proxy: "posthog",
       scriptBundling: false,
       category: "analytics",
       logo: `<svg xmlns="http://www.w3.org/2000/svg" width="32" height="32" viewBox="0 0 128 128"><path fill="#1d4aff" d="M0 .52v32.15l31.79 31.78V32.3L0 .52zm32.3 32.15v32.15l31.78 31.78V64.45L32.3 32.67zM0 64.97v32.15l31.79 31.78V96.75L0 64.97zm64.6-32.3v32.15l31.78 31.78V64.45L64.6 32.67zm31.78 31.78v32.15l31.78 31.78V96.23l-31.78-31.78zm-64.08.52v32.15l31.78 31.78V96.75L32.3 64.97zM64.6 .52v32.15l31.78 31.78V32.3L64.6 .52zm0 64.45v32.15l31.78 31.78V96.75L64.6 64.97z"/></svg>`,

package/dist/runtime/registry/posthog.d.ts

@@ -3,6 +3,7 @@ import type { RegistryScriptInput } from '#nuxt-scripts/types';
 export declare const PostHogOptions: import("valibot").ObjectSchema<{
     readonly apiKey: import("valibot").StringSchema<undefined>;
     readonly region: import("valibot").OptionalSchema<import("valibot").UnionSchema<[import("valibot").LiteralSchema<"us", undefined>, import("valibot").LiteralSchema<"eu", undefined>], undefined>, undefined>;
+    readonly apiHost: import("valibot").OptionalSchema<import("valibot").StringSchema<undefined>, undefined>;
     readonly autocapture: import("valibot").OptionalSchema<import("valibot").BooleanSchema<undefined>, undefined>;
     readonly capturePageview: import("valibot").OptionalSchema<import("valibot").BooleanSchema<undefined>, undefined>;
     readonly capturePageleave: import("valibot").OptionalSchema<import("valibot").BooleanSchema<undefined>, undefined>;

package/dist/runtime/registry/posthog.js

@@ -4,6 +4,7 @@ import { logger } from "../logger.js";
 export const PostHogOptions = object({
   apiKey: string(),
   region: optional(union([literal("us"), literal("eu")])),
+  apiHost: optional(string()),
   autocapture: optional(boolean()),
   capturePageview: optional(boolean()),
   capturePageleave: optional(boolean()),
@@ -47,10 +48,8 @@ export function useScriptPostHog(_options) {
           return;
         }
         const region = options?.region || "us";
-        const apiHost = region === "eu" ? "https://eu.i.posthog.com" : "https://us.i.posthog.com";
-        console.log("[PostHog] Starting dynamic import of posthog-js...");
+        const apiHost = options?.apiHost || (region === "eu" ? "https://eu.i.posthog.com" : "https://us.i.posthog.com");
         window.__posthogInitPromise = import("posthog-js").then(({ default: posthog }) => {
-          console.log("[PostHog] posthog-js imported successfully");
           const config = {
             api_host: apiHost,
             ...options?.config
@@ -63,25 +62,20 @@ export function useScriptPostHog(_options) {
             config.capture_pageleave = options.capturePageleave;
           if (typeof options?.disableSessionRecording === "boolean")
             config.disable_session_recording = options.disableSessionRecording;
-          console.log("[PostHog] Calling posthog.init with apiKey:", options.apiKey, "config:", config);
           const instance = posthog.init(options.apiKey, config);
           if (!instance) {
             logger.error("PostHog init returned undefined - initialization failed");
             delete window._posthogQueue;
             return void 0;
           }
-          console.log("[PostHog] posthog.init succeeded, instance:", instance);
           window.posthog = instance;
           if (window._posthogQueue && window._posthogQueue.length > 0) {
-            console.log("[PostHog] Flushing", window._posthogQueue.length, "queued calls");
             window._posthogQueue.forEach((q) => window.posthog[q.prop]?.(...q.args));
             delete window._posthogQueue;
           }
-          console.log("[PostHog] Initialization complete!");
           return window.posthog;
         }).catch((e) => {
           logger.error("Failed to load posthog-js:", e);
-          console.error("[PostHog] Import/init error:", e);
           delete window._posthogQueue;
           return void 0;
         });

package/dist/runtime/server/proxy-handler.js

@@ -4,20 +4,20 @@ import { useStorage, useNitroApp } from "nitropack/runtime";
 import { hash } from "ohash";
 import { rewriteScriptUrls } from "../utils/pure.js";
 import {
-  FINGERPRINT_HEADERS,
-  IP_HEADERS,
   SENSITIVE_HEADERS,
   anonymizeIP,
   normalizeLanguage,
   normalizeUserAgent,
-  stripPayloadFingerprinting
+  stripPayloadFingerprinting,
+  resolvePrivacy,
+  mergePrivacy
 } from "./utils/privacy.js";
-function stripQueryFingerprinting(query) {
-  const stripped = stripPayloadFingerprinting(query);
+function stripQueryFingerprinting(query, privacy) {
+  const stripped = stripPayloadFingerprinting(query, privacy);
   const params = new URLSearchParams();
   for (const [key, value] of Object.entries(stripped)) {
     if (value !== void 0 && value !== null) {
-      params.set(key, String(value));
+      params.set(key, typeof value === "object" ? JSON.stringify(value) : String(value));
     }
   }
   return params.toString();
@@ -32,7 +32,7 @@ export default defineEventHandler(async (event) => {
       statusMessage: "First-party proxy not configured"
     });
   }
-  const { routes, privacy, cacheTtl = 3600, debug = import.meta.dev } = proxyConfig;
+  const { routes, privacy: globalPrivacy, routePrivacy, cacheTtl = 3600, debug = import.meta.dev } = proxyConfig;
   const path = event.path;
   const log = debug ? (message, ...args) => {
     console.debug(message, ...args);
@@ -40,17 +40,19 @@ export default defineEventHandler(async (event) => {
   };
   let targetBase;
   let matchedPrefix;
+  let matchedRoutePattern;
   const sortedRoutes = Object.entries(routes).sort((a, b) => b[0].length - a[0].length);
   for (const [routePattern, target] of sortedRoutes) {
     const prefix = routePattern.replace(/\/\*\*$/, "");
     if (path.startsWith(prefix)) {
       targetBase = target.replace(/\/\*\*$/, "");
       matchedPrefix = prefix;
+      matchedRoutePattern = routePattern;
       log("[proxy] Matched:", prefix, "->", targetBase);
       break;
     }
   }
-  if (!targetBase || !matchedPrefix) {
+  if (!targetBase || !matchedPrefix || !matchedRoutePattern) {
     log("[proxy] No match for path:", path);
     throw createError({
       statusCode: 404,
@@ -58,54 +60,68 @@ export default defineEventHandler(async (event) => {
       message: `No proxy target found for path: ${path}`
     });
   }
+  const perScriptInput = routePrivacy[matchedRoutePattern];
+  if (debug && perScriptInput === void 0) {
+    log("[proxy] WARNING: No privacy config for route", matchedRoutePattern, "\u2014 defaulting to full anonymization");
+  }
+  const perScriptResolved = resolvePrivacy(perScriptInput ?? true);
+  const privacy = globalPrivacy !== void 0 ? mergePrivacy(perScriptResolved, globalPrivacy) : perScriptResolved;
+  const anyPrivacy = privacy.ip || privacy.userAgent || privacy.language || privacy.screen || privacy.timezone || privacy.hardware;
   let targetPath = path.slice(matchedPrefix.length);
   if (targetPath && !targetPath.startsWith("/")) {
     targetPath = "/" + targetPath;
   }
   let targetUrl = targetBase + targetPath;
-  if (privacy === "anonymize") {
+  if (anyPrivacy) {
     const query = getQuery(event);
     if (Object.keys(query).length > 0) {
-      const strippedQuery = stripQueryFingerprinting(query);
+      const strippedQuery = stripQueryFingerprinting(query, privacy);
       const basePath = targetUrl.split("?")[0] || targetUrl;
       targetUrl = strippedQuery ? `${basePath}?${strippedQuery}` : basePath;
     }
   }
   const originalHeaders = getHeaders(event);
   const headers = {};
-  if (privacy === "proxy") {
-    for (const [key, value] of Object.entries(originalHeaders)) {
-      if (!value) continue;
-      if (SENSITIVE_HEADERS.includes(key.toLowerCase())) continue;
-      headers[key] = value;
+  for (const [key, value] of Object.entries(originalHeaders)) {
+    if (!value) continue;
+    const lowerKey = key.toLowerCase();
+    if (SENSITIVE_HEADERS.includes(lowerKey)) continue;
+    if (anyPrivacy && lowerKey === "content-length") continue;
+    if (lowerKey === "x-forwarded-for" || lowerKey === "x-real-ip" || lowerKey === "forwarded" || lowerKey === "cf-connecting-ip" || lowerKey === "true-client-ip" || lowerKey === "x-client-ip" || lowerKey === "x-cluster-client-ip") {
+      if (privacy.ip) continue;
+      headers[lowerKey] = value;
+      continue;
     }
-  } else {
-    for (const [key, value] of Object.entries(originalHeaders)) {
-      if (!value)
-        continue;
-      const lowerKey = key.toLowerCase();
-      if (IP_HEADERS.includes(lowerKey))
-        continue;
-      if (SENSITIVE_HEADERS.includes(lowerKey))
-        continue;
-      if (lowerKey === "content-length")
-        continue;
-      if (lowerKey === "user-agent") {
-        headers[key] = normalizeUserAgent(value);
-      } else if (lowerKey === "accept-language") {
-        headers[key] = normalizeLanguage(value);
-      } else if (lowerKey === "sec-ch-ua" || lowerKey === "sec-ch-ua-full-version-list") {
-        headers[key] = value.replace(/;v="(\d+)\.[^"]*"/g, ';v="$1"');
-      } else if (FINGERPRINT_HEADERS.includes(lowerKey)) {
-        headers[key] = value;
-      } else {
-        headers[key] = value;
-      }
+    if (lowerKey === "user-agent") {
+      headers[key] = privacy.userAgent ? normalizeUserAgent(value) : value;
+      continue;
+    }
+    if (lowerKey === "accept-language") {
+      headers[key] = privacy.language ? normalizeLanguage(value) : value;
+      continue;
+    }
+    if (lowerKey === "sec-ch-ua" || lowerKey === "sec-ch-ua-full-version-list") {
+      headers[lowerKey] = privacy.hardware ? value.replace(/;v="(\d+)\.[^"]*"/g, ';v="$1"') : value;
+      continue;
     }
+    if (lowerKey === "sec-ch-ua-platform-version" || lowerKey === "sec-ch-ua-arch" || lowerKey === "sec-ch-ua-model" || lowerKey === "sec-ch-ua-bitness") {
+      if (privacy.hardware) continue;
+      headers[lowerKey] = value;
+      continue;
+    }
+    headers[key] = value;
+  }
+  if (!headers["x-forwarded-for"]) {
     const clientIP = getRequestIP(event, { xForwardedFor: true });
     if (clientIP) {
-      headers["x-forwarded-for"] = anonymizeIP(clientIP);
+      if (privacy.ip) {
+        headers["x-forwarded-for"] = anonymizeIP(clientIP);
+      } else {
+        headers["x-forwarded-for"] = clientIP;
+      }
     }
+  } else if (privacy.ip) {
+    headers["x-forwarded-for"] = headers["x-forwarded-for"].split(",").map((ip) => anonymizeIP(ip.trim())).join(", ");
   }
   let body;
   let rawBody;
@@ -114,9 +130,9 @@ export default defineEventHandler(async (event) => {
   const originalQuery = getQuery(event);
   if (method === "POST" || method === "PUT" || method === "PATCH") {
     rawBody = await readBody(event);
-    if (privacy === "anonymize" && rawBody) {
+    if (anyPrivacy && rawBody) {
       if (typeof rawBody === "object") {
-        body = stripPayloadFingerprinting(rawBody);
+        body = stripPayloadFingerprinting(rawBody, privacy);
       } else if (typeof rawBody === "string") {
         if (rawBody.startsWith("{") || rawBody.startsWith("[")) {
           let parsed = null;
@@ -125,7 +141,7 @@ export default defineEventHandler(async (event) => {
           } catch {
           }
           if (parsed && typeof parsed === "object") {
-            body = stripPayloadFingerprinting(parsed);
+            body = stripPayloadFingerprinting(parsed, privacy);
           } else {
             body = rawBody;
           }
@@ -135,7 +151,7 @@ export default defineEventHandler(async (event) => {
           params.forEach((value, key) => {
             obj[key] = value;
           });
-          const stripped = stripPayloadFingerprinting(obj);
+          const stripped = stripPayloadFingerprinting(obj, privacy);
           const stringified = {};
           for (const [k, v] of Object.entries(stripped)) {
             if (v === void 0 || v === null) continue;
@@ -165,7 +181,7 @@ export default defineEventHandler(async (event) => {
     },
     stripped: {
       headers,
-      query: privacy === "anonymize" ? stripPayloadFingerprinting(originalQuery) : originalQuery,
+      query: anyPrivacy ? stripPayloadFingerprinting(originalQuery, privacy) : originalQuery,
       body: body ?? null
     }
   });

package/dist/runtime/server/utils/privacy.d.ts

@@ -1,3 +1,44 @@
+/**
+ * Granular privacy controls for the first-party proxy.
+ * Each flag controls both headers AND body/query params for its domain.
+ */
+export interface ProxyPrivacy {
+    /** Anonymize IP (headers + body). When false, real IP is forwarded via x-forwarded-for. */
+    ip?: boolean;
+    /** Normalize User-Agent (headers + body) */
+    userAgent?: boolean;
+    /** Normalize Accept-Language (headers + body) */
+    language?: boolean;
+    /** Generalize screen resolution, viewport, hardware concurrency, device memory */
+    screen?: boolean;
+    /** Generalize timezone offset and IANA timezone names */
+    timezone?: boolean;
+    /** Anonymize hardware fingerprints: canvas/webgl/audio, plugins/fonts, browser versions, device info */
+    hardware?: boolean;
+}
+/**
+ * Privacy input: `true` = full anonymize, `false` = passthrough (still strips sensitive headers),
+ * or a `ProxyPrivacy` object for granular control (unset flags default to `false` — opt-in).
+ */
+export type ProxyPrivacyInput = boolean | ProxyPrivacy | null;
+/** Resolved privacy with all flags explicitly set. */
+export type ResolvedProxyPrivacy = Required<ProxyPrivacy>;
+/**
+ * Normalize a privacy input to a fully-resolved object.
+ * Privacy is opt-in: unset object flags default to `false`.
+ * Each script in the registry explicitly sets all flags for its needs.
+ * - `true` → all flags true (full anonymize)
+ * - `false` / `undefined` → all flags false (passthrough)
+ * - `{ ip: true, hardware: true }` → only those active, rest off
+ */
+export declare function resolvePrivacy(input?: ProxyPrivacyInput): ResolvedProxyPrivacy;
+/**
+ * Merge privacy settings: `override` fields take precedence over `base` field-by-field.
+ * When `override` is undefined, returns `base` unchanged.
+ * When `override` is a boolean, it fully replaces `base`.
+ * When `override` is an object, only explicitly-set fields override.
+ */
+export declare function mergePrivacy(base: ResolvedProxyPrivacy, override?: ProxyPrivacyInput): ResolvedProxyPrivacy;
 /**
  * Headers that reveal user IP address - stripped in proxy mode,
  * anonymized in anonymize mode.
@@ -93,5 +134,8 @@ export declare function anonymizeDeviceInfo(value: string): string;
  * Recursively anonymize fingerprinting data in payload.
  * Fields are generalized or normalized rather than stripped, so endpoints
  * still receive valid data with reduced fingerprinting precision.
+ *
+ * When `privacy` is provided, only categories with their flag set to `true` are processed.
+ * Default (no arg) = all categories active, so existing callers work unchanged.
  */
-export declare function stripPayloadFingerprinting(payload: Record<string, unknown>): Record<string, unknown>;
+export declare function stripPayloadFingerprinting(payload: Record<string, unknown>, privacy?: ResolvedProxyPrivacy): Record<string, unknown>;