@nuxt/scripts 1.0.0-beta.20 → 1.0.0-beta.22

package/dist/runtime/server/instagram-embed.js

@@ -1,16 +1,128 @@
 import { createError, defineEventHandler, getQuery, setHeader } from "h3";
 import { $fetch } from "ofetch";
-const LINK_RE = /<link[^>]+rel=["']stylesheet["'][^>]+href=["']([^"']+)["'][^>]*>/gi;
-const LINK_RE_2 = /<link[^>]+href=["']([^"']+)["'][^>]+rel=["']stylesheet["'][^>]*>/gi;
-const RSRC_RE = /url\(\/rsrc\.php([^)]+)\)/g;
-const SCRIPT_RE = /<script[\s\S]*?<\/script>/gi;
-const STYLESHEET_RE = /<link[^>]+rel=["']stylesheet["'][^>]*>/gi;
-const CSS_RE = /<link[^>]+href=["'][^"']+\.css[^"']*["'][^>]*>/gi;
-const NOSCRIPT_RE = /<noscript>[\s\S]*?<\/noscript>/gi;
-const SCONTENT_RE = /https:\/\/scontent[^"'\s),]+\.cdninstagram\.com[^"'\s),]+/g;
-const STATIC_CDN_RE = /https:\/\/static\.cdninstagram\.com[^"'\s),]+/g;
-const LOOKASIDE_RE = /https:\/\/lookaside\.instagram\.com[^"'\s),]+/g;
-const AMP_RE = /&amp;/g;
+import { ELEMENT_NODE, parse, renderSync, TEXT_NODE, walkSync } from "ultrahtml";
+export const RSRC_RE = /url\(\/rsrc\.php([^)]+)\)/g;
+export const AMP_RE = /&amp;/g;
+export const SCONTENT_RE = /https:\/\/scontent[^"'\s),]+\.cdninstagram\.com[^"'\s),]+/g;
+export const STATIC_CDN_RE = /https:\/\/static\.cdninstagram\.com[^"'\s),]+/g;
+export const LOOKASIDE_RE = /https:\/\/lookaside\.instagram\.com[^"'\s),]+/g;
+export const INSTAGRAM_IMAGE_HOSTS = ["scontent.cdninstagram.com", "lookaside.instagram.com"];
+export const INSTAGRAM_ASSET_HOST = "static.cdninstagram.com";
+const CHARSET_RE = /@charset\s[^;]+;/gi;
+const IMPORT_RE = /@import\s[^;]+;/gi;
+const WHITESPACE_RE = /\s/;
+const AT_RULE_NAME_RE = /@([\w-]+)/;
+const MULTI_SPACE_RE = /\s+/g;
+const SRCSET_SPLIT_RE = /\s+/;
+export function proxyImageUrl(url) {
+  return `/_scripts/embed/instagram-image?url=${encodeURIComponent(url.replace(AMP_RE, "&"))}`;
+}
+export function proxyAssetUrl(url) {
+  return `/_scripts/embed/instagram-asset?url=${encodeURIComponent(url.replace(AMP_RE, "&"))}`;
+}
+export function rewriteUrl(url) {
+  try {
+    const parsed = new URL(url);
+    if (parsed.hostname === INSTAGRAM_ASSET_HOST)
+      return proxyAssetUrl(url);
+    if (INSTAGRAM_IMAGE_HOSTS.some((h) => parsed.hostname === h || parsed.hostname.endsWith(`.cdninstagram.com`)))
+      return proxyImageUrl(url);
+  } catch {
+  }
+  return url;
+}
+export function rewriteUrlsInText(text) {
+  return text.replace(SCONTENT_RE, (m) => proxyImageUrl(m)).replace(STATIC_CDN_RE, (m) => proxyAssetUrl(m)).replace(LOOKASIDE_RE, (m) => proxyImageUrl(m));
+}
+function removeNode(node) {
+  node.type = TEXT_NODE;
+  node.value = "";
+  node.name = void 0;
+  node.attributes = {};
+  node.children = [];
+}
+export function scopeCss(css, scopeSelector) {
+  let result = css.replace(CHARSET_RE, "");
+  result = result.replace(IMPORT_RE, "");
+  return processRules(result, scopeSelector);
+}
+function processRules(css, scopeSelector) {
+  const output = [];
+  let i = 0;
+  while (i < css.length) {
+    while (i < css.length && WHITESPACE_RE.test(css[i])) i++;
+    if (i >= css.length)
+      break;
+    if (css[i] === "@") {
+      const atRule = extractAtRule(css, i);
+      if (atRule) {
+        const atName = atRule.content.match(AT_RULE_NAME_RE)?.[1]?.toLowerCase();
+        if (atName === "media" || atName === "supports" || atName === "layer") {
+          const braceStart = atRule.content.indexOf("{");
+          const innerCss = atRule.content.slice(braceStart + 1, -1);
+          const scopedInner = processRules(innerCss, scopeSelector);
+          output.push(`${atRule.content.slice(0, braceStart + 1) + scopedInner}}`);
+        } else if (atName === "keyframes" || atName === "-webkit-keyframes" || atName === "font-face") {
+          output.push(atRule.content);
+        }
+        i = atRule.end;
+        continue;
+      }
+    }
+    const bracePos = css.indexOf("{", i);
+    if (bracePos === -1)
+      break;
+    const selector = css.slice(i, bracePos).trim();
+    const block = extractBlock(css, bracePos);
+    if (!block)
+      break;
+    i = block.end;
+    if (!selector)
+      continue;
+    const selectors = selector.split(",").map((s) => s.trim());
+    const filteredSelectors = selectors.filter((s) => {
+      const normalized = s.replace(MULTI_SPACE_RE, " ").trim().toLowerCase();
+      return normalized !== ":root" && normalized !== "html" && normalized !== "body" && !normalized.startsWith(":root ") && !normalized.startsWith("html ") && !normalized.startsWith("body ") && normalized !== "html, body";
+    });
+    if (filteredSelectors.length === 0)
+      continue;
+    const scopedSelectors = filteredSelectors.map((s) => {
+      return `${scopeSelector} ${s}`;
+    });
+    output.push(`${scopedSelectors.join(", ")} ${block.content}`);
+  }
+  return output.join("\n");
+}
+function extractAtRule(css, start) {
+  const bracePos = css.indexOf("{", start);
+  const semiPos = css.indexOf(";", start);
+  if (semiPos !== -1 && (bracePos === -1 || semiPos < bracePos)) {
+    return { content: css.slice(start, semiPos + 1), end: semiPos + 1 };
+  }
+  if (bracePos === -1)
+    return null;
+  const block = extractBlock(css, bracePos);
+  if (!block)
+    return null;
+  return {
+    content: css.slice(start, bracePos) + block.content,
+    end: block.end
+  };
+}
+function extractBlock(css, openBrace) {
+  let depth = 0;
+  for (let j = openBrace; j < css.length; j++) {
+    if (css[j] === "{") {
+      depth++;
+    } else if (css[j] === "}") {
+      depth--;
+      if (depth === 0) {
+        return { content: css.slice(openBrace, j + 1), end: j + 1 };
+      }
+    }
+  }
+  return null;
+}
 export default defineEventHandler(async (event) => {
   const query = getQuery(event);
   const postUrl = query.url;
@@ -42,7 +154,6 @@ export default defineEventHandler(async (event) => {
   const html = await $fetch(embedUrl, {
     headers: {
       "Accept": "text/html",
-      // Use simple UA - full Chrome UA triggers JS-heavy version without static content
       "User-Agent": "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
     }
   }).catch((error) => {
@@ -51,16 +162,45 @@ export default defineEventHandler(async (event) => {
       statusMessage: error.statusMessage || "Failed to fetch Instagram embed"
     });
   });
+  const ast = parse(html);
   const cssUrls = [];
-  let match;
-  while ((match = LINK_RE.exec(html)) !== null) {
-    if (match[1])
-      cssUrls.push(match[1]);
-  }
-  while ((match = LINK_RE_2.exec(html)) !== null) {
-    if (match[1])
-      cssUrls.push(match[1]);
-  }
+  walkSync(ast, (node) => {
+    if (node.type !== ELEMENT_NODE)
+      return;
+    if (node.name === "link" && node.attributes.rel === "stylesheet" && node.attributes.href) {
+      cssUrls.push(node.attributes.href);
+      removeNode(node);
+      return;
+    }
+    if (node.name === "script" || node.name === "noscript" || node.name === "style") {
+      removeNode(node);
+      return;
+    }
+    for (const attr of ["src", "poster"]) {
+      if (node.attributes[attr])
+        node.attributes[attr] = rewriteUrl(node.attributes[attr]);
+    }
+    if (node.attributes.srcset) {
+      node.attributes.srcset = node.attributes.srcset.split(",").map((entry) => {
+        const parts = entry.trim().split(SRCSET_SPLIT_RE);
+        const url = parts[0];
+        const descriptor = parts.slice(1).join(" ");
+        return url ? `${rewriteUrl(url)}${descriptor ? ` ${descriptor}` : ""}` : entry;
+      }).join(", ");
+    }
+    if (node.attributes.style)
+      node.attributes.style = rewriteUrlsInText(node.attributes.style);
+  });
+  walkSync(ast, (node) => {
+    if (node.type === TEXT_NODE && node.value)
+      node.value = rewriteUrlsInText(node.value);
+  });
+  let bodyNode = null;
+  walkSync(ast, (node) => {
+    if (node.type === ELEMENT_NODE && node.name === "body")
+      bodyNode = node;
+  });
+  const bodyHtml = bodyNode ? bodyNode.children.map((child) => renderSync(child)).join("") : renderSync(ast);
   const cssContents = await Promise.all(
     cssUrls.map(
       (url) => $fetch(url, {
@@ -71,30 +211,19 @@ export default defineEventHandler(async (event) => {
   let combinedCss = cssContents.join("\n");
   combinedCss = combinedCss.replace(
     RSRC_RE,
-    (_m, path) => `url(/api/_scripts/instagram-embed-asset?url=${encodeURIComponent(`https://static.cdninstagram.com/rsrc.php${path}`)})`
+    (_m, path) => `url(/_scripts/embed/instagram-asset?url=${encodeURIComponent(`https://static.cdninstagram.com/rsrc.php${path}`)})`
   );
+  combinedCss = rewriteUrlsInText(combinedCss);
+  combinedCss = scopeCss(combinedCss, ".instagram-embed-root");
   const baseStyles = `
-    html { background: white; max-width: 540px; width: calc(100% - 2px); border-radius: 3px; border: 1px solid rgb(219, 219, 219); display: block; margin: 0px 0px 12px; min-width: 326px; padding: 0px; }
-    #splash-screen { display: none !important; }
-    .Embed { opacity: 1 !important; visibility: visible !important; }
-    .EmbeddedMedia, .EmbeddedMediaImage { display: block !important; visibility: visible !important; }
+    .instagram-embed-root { background: white; max-width: 540px; width: calc(100% - 2px); border-radius: 3px; border: 1px solid rgb(219, 219, 219); display: block; margin: 0px 0px 12px; min-width: 326px; padding: 0px; }
+    .instagram-embed-root #splash-screen { display: none !important; }
+    .instagram-embed-root .Embed { opacity: 1 !important; visibility: visible !important; }
+    .instagram-embed-root .EmbeddedMedia, .instagram-embed-root .EmbeddedMediaImage { display: block !important; visibility: visible !important; }
   `;
-  let rewrittenHtml = html.replace(SCRIPT_RE, "").replace(STYLESHEET_RE, "").replace(CSS_RE, "").replace(NOSCRIPT_RE, "").replace(
-    SCONTENT_RE,
-    (m) => `/api/_scripts/instagram-embed-image?url=${encodeURIComponent(m.replace(AMP_RE, "&"))}`
-  ).replace(
-    STATIC_CDN_RE,
-    (m) => `/api/_scripts/instagram-embed-asset?url=${encodeURIComponent(m.replace(AMP_RE, "&"))}`
-  ).replace(
-    LOOKASIDE_RE,
-    (m) => `/api/_scripts/instagram-embed-image?url=${encodeURIComponent(m.replace(AMP_RE, "&"))}`
-  );
-  rewrittenHtml = rewrittenHtml.replace(
-    "</head>",
-    `<style>${baseStyles}
-${combinedCss}</style></head>`
-  );
+  const result = `<div class="instagram-embed-root"><style>${baseStyles}
+${combinedCss}</style>${bodyHtml}</div>`;
   setHeader(event, "Content-Type", "text/html");
   setHeader(event, "Cache-Control", "public, max-age=600, s-maxage=600");
-  return rewrittenHtml;
+  return result;
 });

package/dist/runtime/server/utils/image-proxy.d.ts

@@ -0,0 +1,12 @@
+export interface ImageProxyConfig {
+    allowedDomains: string[] | ((hostname: string) => boolean);
+    accept?: string;
+    userAgent?: string;
+    cacheMaxAge?: number;
+    contentType?: string;
+    /** Follow redirects (default: true). Set to false to reject redirects (SSRF protection). */
+    followRedirects?: boolean;
+    /** Decode & in URL query parameter */
+    decodeAmpersands?: boolean;
+}
+export declare function createImageProxyHandler(config: ImageProxyConfig): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<any>>;

package/dist/runtime/server/utils/image-proxy.js

@@ -0,0 +1,70 @@
+import { createError, defineEventHandler, getQuery, setHeader } from "h3";
+import { $fetch } from "ofetch";
+const AMP_RE = /&/g;
+export function createImageProxyHandler(config) {
+  const {
+    accept = "image/webp,image/jpeg,image/png,image/*,*/*;q=0.8",
+    userAgent,
+    cacheMaxAge = 3600,
+    contentType = "image/jpeg",
+    followRedirects = true,
+    decodeAmpersands = false
+  } = config;
+  return defineEventHandler(async (event) => {
+    const query = getQuery(event);
+    let url = query.url;
+    if (decodeAmpersands && url)
+      url = url.replace(AMP_RE, "&");
+    if (!url) {
+      throw createError({
+        statusCode: 400,
+        statusMessage: "Image URL is required"
+      });
+    }
+    let parsedUrl;
+    try {
+      parsedUrl = new URL(url);
+    } catch {
+      throw createError({
+        statusCode: 400,
+        statusMessage: "Invalid image URL"
+      });
+    }
+    if (parsedUrl.protocol !== "http:" && parsedUrl.protocol !== "https:") {
+      throw createError({
+        statusCode: 400,
+        statusMessage: "Invalid URL scheme"
+      });
+    }
+    const domainAllowed = typeof config.allowedDomains === "function" ? config.allowedDomains(parsedUrl.hostname) : config.allowedDomains.includes(parsedUrl.hostname);
+    if (!domainAllowed) {
+      throw createError({
+        statusCode: 403,
+        statusMessage: "Domain not allowed"
+      });
+    }
+    const headers = { Accept: accept };
+    if (userAgent)
+      headers["User-Agent"] = userAgent;
+    const response = await $fetch.raw(url, {
+      timeout: 5e3,
+      redirect: followRedirects ? "follow" : "manual",
+      ignoreResponseError: !followRedirects,
+      headers
+    }).catch((error) => {
+      throw createError({
+        statusCode: error.statusCode || 500,
+        statusMessage: error.statusMessage || "Failed to fetch image"
+      });
+    });
+    if (!followRedirects && response.status >= 300 && response.status < 400) {
+      throw createError({
+        statusCode: 403,
+        statusMessage: "Redirects not allowed"
+      });
+    }
+    setHeader(event, "Content-Type", response.headers.get("content-type") || contentType);
+    setHeader(event, "Cache-Control", `public, max-age=${cacheMaxAge}, s-maxage=${cacheMaxAge}`);
+    return response._data;
+  });
+}

package/dist/runtime/server/x-embed-image.js

@@ -1,53 +1,9 @@
-import { createError, defineEventHandler, getQuery, setHeader } from "h3";
-import { $fetch } from "ofetch";
-export default defineEventHandler(async (event) => {
-  const query = getQuery(event);
-  const url = query.url;
-  if (!url) {
-    throw createError({
-      statusCode: 400,
-      statusMessage: "Image URL is required"
-    });
-  }
-  let parsedUrl;
-  try {
-    parsedUrl = new URL(url);
-  } catch {
-    throw createError({
-      statusCode: 400,
-      statusMessage: "Invalid image URL"
-    });
-  }
-  if (parsedUrl.protocol !== "http:" && parsedUrl.protocol !== "https:") {
-    throw createError({
-      statusCode: 400,
-      statusMessage: "Invalid URL scheme"
-    });
-  }
-  const allowedDomains = [
+import { createImageProxyHandler } from "./utils/image-proxy.js";
+export default createImageProxyHandler({
+  allowedDomains: [
     "pbs.twimg.com",
     "abs.twimg.com",
     "video.twimg.com"
-  ];
-  if (!allowedDomains.includes(parsedUrl.hostname)) {
-    throw createError({
-      statusCode: 403,
-      statusMessage: "Domain not allowed"
-    });
-  }
-  const response = await $fetch.raw(url, {
-    timeout: 5e3,
-    headers: {
-      "Accept": "image/webp,image/jpeg,image/png,image/*,*/*;q=0.8",
-      "User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36"
-    }
-  }).catch((error) => {
-    throw createError({
-      statusCode: error.statusCode || 500,
-      statusMessage: error.statusMessage || "Failed to fetch image"
-    });
-  });
-  setHeader(event, "Content-Type", response.headers.get("content-type") || "image/jpeg");
-  setHeader(event, "Cache-Control", "public, max-age=3600, s-maxage=3600");
-  return response._data;
+  ],
+  userAgent: "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36"
 });

package/dist/runtime/types.d.ts

@@ -3,6 +3,7 @@ import type { Script } from '@unhead/vue/types';
 import type { Import } from 'unimport';
 import type { InferInput, ObjectSchema, UnionSchema, ValiError } from 'valibot';
 import type { ComputedRef, Ref } from 'vue';
+import type { BlueskyEmbedInput } from './registry/bluesky-embed.js';
 import type { ClarityInput } from './registry/clarity.js';
 import type { CloudflareWebAnalyticsInput } from './registry/cloudflare-web-analytics.js';
 import type { CrispInput } from './registry/crisp.js';
@@ -155,6 +156,7 @@ export interface NuxtDevToolsScriptInstance {
     }[];
 }
 export interface ScriptRegistry {
+    blueskyEmbed?: BlueskyEmbedInput;
     crisp?: CrispInput;
     clarity?: ClarityInput;
     cloudflareWebAnalytics?: CloudflareWebAnalyticsInput;
@@ -214,7 +216,17 @@ export type RegistryScriptInput<T = EmptyOptionsSchema, Bundelable extends boole
     scriptInput: Required<Pick<ScriptInput, 'src'>> & ScriptInput;
     scriptOptions?: Omit<NuxtUseScriptOptions, Bundelable extends true ? '' : 'bundle' | Usable extends true ? '' : 'use'>;
 } : never);
+export interface RegistryScriptServerHandler {
+    route: string;
+    handler: string;
+    middleware?: boolean;
+}
 export interface RegistryScript {
+    /**
+     * The config key used in `scripts.registry` in nuxt.config (e.g., 'googleAnalytics', 'plausibleAnalytics').
+     * Used for direct lookup from config to script — avoids fragile import name convention matching.
+     */
+    registryKey?: string;
     import?: Import;
     scriptBundling?: false | ((options?: any) => string | false);
     /**
@@ -235,6 +247,10 @@ export interface RegistryScript {
         light: string;
         dark: string;
     };
+    /**
+     * Server handlers (routes/middleware) to register when this script is enabled via registry config.
+     */
+    serverHandlers?: RegistryScriptServerHandler[];
 }
 export type ElementScriptTrigger = 'immediate' | 'visible' | string | string[] | false;
 export type RegistryScripts = RegistryScript[];

package/dist/runtime/utils.d.ts

@@ -14,5 +14,6 @@ type OptionsFn<O> = (options: InferIfSchema<O>, ctx: {
     scriptMode?: 'external' | 'npm';
 });
 export declare function scriptRuntimeConfig<T extends keyof ScriptRegistry>(key: T): ScriptRegistry[T];
+export declare function requireRegistryEndpoint(componentName: string, registryKey: string): void;
 export declare function useRegistryScript<T extends Record<string | symbol, any>, O = EmptyOptionsSchema>(registryKey: keyof ScriptRegistry | string, optionsFn: OptionsFn<O>, _userOptions?: RegistryScriptInput<O>): UseScriptContext<UseFunctionType<NuxtUseScriptOptions<T>, T>>;
 export * from './utils/pure.js';

package/dist/runtime/utils.js

@@ -1,6 +1,6 @@
 import { parse } from "#nuxt-scripts-validator";
 import { defu } from "defu";
-import { useRuntimeConfig } from "nuxt/app";
+import { createError, useRuntimeConfig } from "nuxt/app";
 import { parseQuery, parseURL, withQuery } from "ufo";
 import { useScript } from "./composables/useScript.js";
 import { createNpmScriptStub } from "./npm-script-stub.js";
@@ -21,6 +21,15 @@ function validateScriptInputSchema(key, schema, options) {
 export function scriptRuntimeConfig(key) {
   return (useRuntimeConfig().public.scripts || {})[key];
 }
+export function requireRegistryEndpoint(componentName, registryKey) {
+  const endpoints = useRuntimeConfig().public["nuxt-scripts"]?.endpoints;
+  if (!endpoints?.[registryKey]) {
+    throw createError({
+      message: `${componentName} requires \`scripts.registry.${registryKey}\` to be enabled in nuxt.config`,
+      fatal: import.meta.dev
+    });
+  }
+}
 export function useRegistryScript(registryKey, optionsFn, _userOptions) {
   const scriptConfig = scriptRuntimeConfig(registryKey);
   const userOptions = Object.assign(_userOptions || {}, typeof scriptConfig === "object" ? scriptConfig : {});
@@ -49,7 +58,7 @@ export function useRegistryScript(registryKey, optionsFn, _userOptions) {
     };
   }
   const scriptInput = defu(finalScriptInput, userOptions.scriptInput, { key: registryKey });
-  const scriptOptions = Object.assign(userOptions?.scriptOptions || {}, options.scriptOptions || {});
+  const scriptOptions = { ...userOptions?.scriptOptions, ...options.scriptOptions };
   if (import.meta.dev) {
     const error = new Error("Stack trace for component location");
     const stack = error.stack?.split("\n");

package/dist/stats.mjs

@@ -734,7 +734,7 @@ function deriveMetaKey(importName, label) {
 async function getScriptStats() {
   const { registry } = await import('./registry.mjs');
   const entries = await registry();
-  const proxyConfigs = getAllProxyConfigs("/_scripts");
+  const proxyConfigs = getAllProxyConfigs("/_scripts/assets");
   const sizes = scriptSizes;
   return entries.map((entry) => {
     const metaKey = deriveMetaKey(entry.import?.name, entry.label);

package/dist/types-source.mjs

@@ -193,6 +193,18 @@ const stripe = [
 	}
 ];
 const registryTypes = {
+	"bluesky-embed": [
+	{
+		name: "BlueskyEmbedOptions",
+		kind: "const",
+		code: "export const BlueskyEmbedOptions = object({\n  /**\n   * The Bluesky post URL to embed.\n   * @example 'https://bsky.app/profile/bsky.app/post/3mgnwwvj3u22a'\n   */\n  postUrl: string(),\n  /**\n   * Custom API endpoint for fetching post data.\n   * @default '/_scripts/embed/bluesky'\n   */\n  apiEndpoint: optional(string()),\n  /**\n   * Custom image proxy endpoint.\n   * @default '/_scripts/embed/bluesky-image'\n   */\n  imageProxyEndpoint: optional(string()),\n})"
+	},
+	{
+		name: "BlueskyEmbedPostData",
+		kind: "interface",
+		code: "export interface BlueskyEmbedPostData {\n  uri: string\n  cid: string\n  author: {\n    did: string\n    handle: string\n    displayName: string\n    avatar: string\n    labels: Array<{ val: string }>\n    verification?: {\n      verifiedStatus: string\n    }\n  }\n  record: {\n    $type: string\n    createdAt: string\n    text: string\n    langs?: string[]\n    facets?: Array<{\n      features: Array<{\n        $type: string\n        uri?: string\n        did?: string\n        tag?: string\n      }>\n      index: {\n        byteStart: number\n        byteEnd: number\n      }\n    }>\n    embed?: {\n      $type: string\n      images?: Array<{\n        alt: string\n        image: { ref: { $link: string }, mimeType: string, size: number }\n        aspectRatio?: { width: number, height: number }\n      }>\n      external?: {\n        uri: string\n        title: string\n        description: string\n        thumb?: { ref: { $link: string }, mimeType: string, size: number }\n      }\n    }\n  }\n  embed?: {\n    $type: string\n    images?: Array<{\n      thumb: string\n      fullsize: string\n      alt: string\n      aspectRatio?: { width: number, height: number }\n    }>\n    external?: {\n      uri: string\n      title: string\n      description: string\n      thumb?: string\n    }\n  }\n  likeCount: number\n  repostCount: number\n  replyCount: number\n  quoteCount: number\n  indexedAt: string\n  labels: Array<{ val: string }>\n}"
+	}
+],
 	clarity: clarity,
 	"cloudflare-web-analytics": [
 	{
@@ -499,17 +511,17 @@ const registryTypes = {
 	{
 		name: "InstagramEmbedOptions",
 		kind: "const",
-		code: "export const InstagramEmbedOptions = object({\n  /**\n   * The Instagram post URL to embed.\n   * @example 'https://www.instagram.com/p/C_XXXXXXXXX/'\n   * @see https://developers.facebook.com/docs/instagram/oembed/\n   */\n  postUrl: string(),\n  /**\n   * Whether to include captions in the embed.\n   * @default true\n   */\n  captions: optional(boolean()),\n  /**\n   * Custom API endpoint for fetching embed HTML.\n   * @default '/api/_scripts/instagram-embed'\n   */\n  apiEndpoint: optional(string()),\n})"
+		code: "export const InstagramEmbedOptions = object({\n  /**\n   * The Instagram post URL to embed.\n   * @example 'https://www.instagram.com/p/C_XXXXXXXXX/'\n   * @see https://developers.facebook.com/docs/instagram/oembed/\n   */\n  postUrl: string(),\n  /**\n   * Whether to include captions in the embed.\n   * @default true\n   */\n  captions: optional(boolean()),\n  /**\n   * Custom API endpoint for fetching embed HTML.\n   * @default '/_scripts/embed/instagram'\n   */\n  apiEndpoint: optional(string()),\n})"
 	},
 	{
 		name: "ScriptInstagramEmbedProps",
 		kind: "interface",
-		code: "interface ScriptInstagramEmbedProps {\n  /**\n   * The Instagram post URL to embed\n   * e.g., https://www.instagram.com/p/ABC123/\n   */\n  postUrl: string\n  /**\n   * Whether to include captions in the embed\n   * @default true\n   */\n  captions?: boolean\n  /**\n   * Custom API endpoint for fetching embed HTML\n   * @default '/api/_scripts/instagram-embed'\n   */\n  apiEndpoint?: string\n  /**\n   * Root element attributes\n   */\n  rootAttrs?: HTMLAttributes\n}"
+		code: "interface ScriptInstagramEmbedProps {\n  /**\n   * The Instagram post URL to embed\n   * e.g., https://www.instagram.com/p/ABC123/\n   */\n  postUrl: string\n  /**\n   * Whether to include captions in the embed\n   * @default true\n   */\n  captions?: boolean\n  /**\n   * Custom API endpoint for fetching embed HTML\n   * @default '/_scripts/embed/instagram'\n   */\n  apiEndpoint?: string\n  /**\n   * Root element attributes\n   */\n  rootAttrs?: HTMLAttributes\n}"
 	},
 	{
 		name: "ScriptInstagramEmbedDefaults",
 		kind: "const",
-		code: "const ScriptInstagramEmbedDefaults = {\n  \"captions\": \"true\",\n  \"apiEndpoint\": \"'/api/_scripts/instagram-embed'\"\n}"
+		code: "const ScriptInstagramEmbedDefaults = {\n  \"captions\": \"true\",\n  \"apiEndpoint\": \"'/_scripts/embed/instagram'\"\n}"
 	}
 ],
 	intercom: intercom,
@@ -789,7 +801,7 @@ const registryTypes = {
 	{
 		name: "XEmbedOptions",
 		kind: "const",
-		code: "export const XEmbedOptions = object({\n  /**\n   * The tweet ID to embed.\n   * @example '1754336034228171055'\n   * @see https://developer.x.com/en/docs/twitter-for-websites/embedded-tweets/overview\n   */\n  tweetId: string(),\n  /**\n   * Optional: Custom API endpoint for fetching tweet data.\n   * @default '/api/_scripts/x-embed'\n   */\n  apiEndpoint: optional(string()),\n  /**\n   * Optional: Custom image proxy endpoint.\n   * @default '/api/_scripts/x-embed-image'\n   */\n  imageProxyEndpoint: optional(string()),\n})"
+		code: "export const XEmbedOptions = object({\n  /**\n   * The tweet ID to embed.\n   * @example '1754336034228171055'\n   * @see https://developer.x.com/en/docs/twitter-for-websites/embedded-tweets/overview\n   */\n  tweetId: string(),\n  /**\n   * Optional: Custom API endpoint for fetching tweet data.\n   * @default '/_scripts/embed/x'\n   */\n  apiEndpoint: optional(string()),\n  /**\n   * Optional: Custom image proxy endpoint.\n   * @default '/_scripts/embed/x-image'\n   */\n  imageProxyEndpoint: optional(string()),\n})"
 	},
 	{
 		name: "XEmbedTweetData",
@@ -799,12 +811,12 @@ const registryTypes = {
 	{
 		name: "ScriptXEmbedProps",
 		kind: "interface",
-		code: "interface ScriptXEmbedProps {\n  /**\n   * The tweet ID to embed\n   */\n  tweetId: string\n  /**\n   * Custom API endpoint for fetching tweet data\n   * @default '/api/_scripts/x-embed'\n   */\n  apiEndpoint?: string\n  /**\n   * Custom image proxy endpoint\n   * @default '/_scripts/x-embed-image'\n   */\n  imageProxyEndpoint?: string\n  /**\n   * Root element attributes\n   */\n  rootAttrs?: HTMLAttributes\n}"
+		code: "interface ScriptXEmbedProps {\n  /**\n   * The tweet ID to embed\n   */\n  tweetId: string\n  /**\n   * Custom API endpoint for fetching tweet data\n   * @default '/_scripts/embed/x'\n   */\n  apiEndpoint?: string\n  /**\n   * Custom image proxy endpoint\n   * @default '/_scripts/embed/x-image'\n   */\n  imageProxyEndpoint?: string\n  /**\n   * Root element attributes\n   */\n  rootAttrs?: HTMLAttributes\n}"
 	},
 	{
 		name: "ScriptXEmbedDefaults",
 		kind: "const",
-		code: "const ScriptXEmbedDefaults = {\n  \"apiEndpoint\": \"'/api/_scripts/x-embed'\",\n  \"imageProxyEndpoint\": \"'/api/_scripts/x-embed-image'\"\n}"
+		code: "const ScriptXEmbedDefaults = {\n  \"apiEndpoint\": \"'/_scripts/embed/x'\",\n  \"imageProxyEndpoint\": \"'/_scripts/embed/x-image'\"\n}"
 	}
 ],
 	"x-pixel": [

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@nuxt/scripts",
   "type": "module",
-  "version": "1.0.0-beta.20",
+  "version": "1.0.0-beta.22",
   "description": "Load third-party scripts with better performance, privacy and DX in Nuxt Apps.",
   "author": {
     "name": "Harlan Wilton",
@@ -97,7 +97,7 @@
   },
   "dependencies": {
     "@nuxt/devtools-kit": "^3.2.3",
-    "@nuxt/kit": "^4.3.1",
+    "@nuxt/kit": "^4.4.2",
     "@vueuse/core": "^14.2.1",
     "consola": "^3.4.2",
     "defu": "^6.1.4",
@@ -105,19 +105,20 @@
     "magic-string": "^0.30.21",
     "ofetch": "^1.5.1",
     "ohash": "^2.0.11",
-    "oxc-parser": "^0.117.0",
+    "oxc-parser": "^0.118.0",
     "oxc-walker": "^0.7.0",
     "pathe": "^2.0.3",
     "pkg-types": "^2.3.0",
     "sirv": "^3.0.2",
     "std-env": "^4.0.0",
     "ufo": "^1.6.3",
+    "ultrahtml": "^1.6.0",
     "unplugin": "^3.0.0",
     "unstorage": "^1.17.4",
     "valibot": "^1.2.0"
   },
   "devDependencies": {
-    "@antfu/eslint-config": "^7.7.0",
+    "@antfu/eslint-config": "^7.7.2",
     "@nuxt/devtools-ui-kit": "^3.2.3",
     "@nuxt/module-builder": "^1.0.2",
     "@nuxt/test-utils": "^4.0.0",
@@ -130,18 +131,18 @@
     "bumpp": "^10.4.1",
     "eslint": "^10.0.3",
     "eslint-plugin-harlanzw": "^0.5.17",
-    "happy-dom": "^20.8.3",
+    "happy-dom": "^20.8.4",
     "knitwork": "^1.3.0",
-    "nuxt": "^4.3.1",
+    "nuxt": "^4.4.2",
     "playwright-core": "^1.58.2",
-    "posthog-js": "^1.360.0",
+    "posthog-js": "^1.360.1",
     "shiki": "^4.0.2",
     "typescript": "^5.9.3",
-    "vitest": "^4.0.18",
+    "vitest": "^4.1.0",
     "vue": "^3.5.30",
     "vue-router": "^5.0.3",
     "vue-tsc": "^3.2.5",
-    "@nuxt/scripts": "1.0.0-beta.20"
+    "@nuxt/scripts": "1.0.0-beta.22"
   },
   "resolutions": {
     "@nuxt/scripts": "workspace:*"