@nuxt/scripts 1.0.0-beta.30 → 1.0.0-beta.32

package/dist/module.mjs

@@ -1,5 +1,5 @@
 import { existsSync, readdirSync, readFileSync } from 'node:fs';
-import { useLogger, addServerHandler, addPluginTemplate, useNuxt, addDevServerHandler, extendRouteRules, tryUseNuxt, extendViteConfig, logger as logger$1, addTypeTemplate, defineNuxtModule, createResolver, hasNuxtModule, addImports, addComponentsDir, addTemplate, addBuildPlugin } from '@nuxt/kit';
+import { useNuxt, addDevServerHandler, extendRouteRules, tryUseNuxt, extendViteConfig, useLogger, addServerHandler, addPluginTemplate, logger as logger$1, addTypeTemplate, defineNuxtModule, createResolver, addImports, addComponentsDir, addTemplate, hasNuxtModule, addBuildPlugin } from '@nuxt/kit';
 import { defu } from 'defu';
 import { join, resolve, relative } from 'pathe';
 import { resolvePackageJSON, readPackageJSON } from 'pkg-types';
@@ -19,48 +19,161 @@ import { colors } from 'consola/utils';
 import MagicString from 'magic-string';
 import { hash } from 'ohash';
 import { registry } from './registry.mjs';
-import { g as getAllProxyConfigs, r as routesToInterceptRules } from './shared/scripts.ViOoYQXH.mjs';
+import { b as buildProxyConfigsFromRegistry } from './shared/scripts.T4Z99VT8.mjs';
 
-function generatePartytownResolveUrl(interceptRules) {
-  const rulesJson = JSON.stringify(interceptRules);
-  return `function(url, location, type) {
-  var rules = ${rulesJson};
-  for (var i = 0; i < rules.length; i++) {
-    var rule = rules[i];
-    if (url.hostname === rule.pattern || url.hostname.endsWith('.' + rule.pattern)) {
-      if (rule.pathPrefix && !url.pathname.startsWith(rule.pathPrefix)) continue;
-      var path = rule.pathPrefix ? url.pathname.slice(rule.pathPrefix.length) : url.pathname;
-      var newPath = rule.target + (path.startsWith('/') ? '' : '/') + path + url.search;
-      return new URL(newPath, location.origin);
+const renderedScript = /* @__PURE__ */ new Map();
+const ONE_YEAR_IN_SECONDS = 60 * 60 * 24 * 365;
+function bundleStorage() {
+  const nuxt = tryUseNuxt();
+  return createStorage({
+    driver: fsDriver({
+      base: resolve(nuxt?.options.rootDir || "", "node_modules/.cache/nuxt/scripts")
+    })
+  });
+}
+function setupPublicAssetStrategy(options = {}) {
+  const assetsBaseURL = options.prefix || "/_scripts/assets";
+  const nuxt = useNuxt();
+  const storage = bundleStorage();
+  addDevServerHandler({
+    route: assetsBaseURL,
+    handler: lazyEventHandler(async () => {
+      return eventHandler(async (event) => {
+        const cleanPath = (event.path || "").split("?")[0]?.slice(1) || "";
+        const filename = cleanPath;
+        const scriptDescriptor = renderedScript.get(join(assetsBaseURL, cleanPath));
+        if (!scriptDescriptor || scriptDescriptor instanceof Error)
+          throw createError({ statusCode: 404 });
+        if (scriptDescriptor.content) {
+          return scriptDescriptor.content;
+        }
+        const key = `bundle:${filename}`;
+        let res = await storage.getItemRaw(key);
+        if (!res) {
+          res = await fetch(scriptDescriptor.src).then((r) => r.arrayBuffer()).then((r) => Buffer.from(r));
+          await storage.setItemRaw(key, res);
+        }
+        return res;
+      });
+    })
+  });
+  if (nuxt.options.dev) {
+    extendRouteRules(joinURL(assetsBaseURL, "**"), {
+      cache: {
+        maxAge: ONE_YEAR_IN_SECONDS
+      }
+    });
+  }
+  const cacheDir = join(nuxt.options.buildDir, "cache", "scripts");
+  nuxt.hook("nitro:config", (nitroConfig) => {
+    nitroConfig.publicAssets ||= [];
+    nitroConfig.publicAssets.push({
+      dir: cacheDir,
+      maxAge: ONE_YEAR_IN_SECONDS,
+      baseURL: assetsBaseURL
+    });
+    nitroConfig.prerender ||= {};
+    nitroConfig.prerender.ignore ||= [];
+    nitroConfig.prerender.ignore.push(assetsBaseURL);
+  });
+  return {
+    renderedScript
+  };
+}
+
+const DEVTOOLS_UI_ROUTE = "/__nuxt-scripts";
+const DEVTOOLS_UI_LOCAL_PORT = 3300;
+
+async function setupDevToolsUI(options, resolve, nuxt = useNuxt()) {
+  const clientPath = await resolve("./client");
+  const isProductionBuild = existsSync(clientPath);
+  if (isProductionBuild) {
+    nuxt.hook("vite:serverCreated", async (server) => {
+      const sirv = await import('sirv').then((r) => r.default || r);
+      server.middlewares.use(
+        DEVTOOLS_UI_ROUTE,
+        sirv(clientPath, { dev: true, single: true })
+      );
+    });
+  } else {
+    extendViteConfig((config) => {
+      config.server = config.server || {};
+      config.server.proxy = config.server.proxy || {};
+      config.server.proxy[DEVTOOLS_UI_ROUTE] = {
+        target: `http://localhost:${DEVTOOLS_UI_LOCAL_PORT}${DEVTOOLS_UI_ROUTE}`,
+        changeOrigin: true,
+        followRedirects: true,
+        rewrite: (path) => path.replace(DEVTOOLS_UI_ROUTE, "")
+      };
+    });
+  }
+  addCustomTab({
+    // unique identifier
+    name: "nuxt-scripts",
+    // title to display in the tab
+    title: "Scripts",
+    // any icon from Iconify, or a URL to an image
+    icon: "carbon:script",
+    // iframe view
+    view: {
+      type: "iframe",
+      src: DEVTOOLS_UI_ROUTE
     }
+  });
+}
+
+function generatePartytownResolveUrl(proxyPrefix) {
+  return `function(url, location, type) {
+  if (url.origin !== location.origin) {
+    return new URL(${JSON.stringify(proxyPrefix)} + '/' + url.host + url.pathname + url.search, location.origin);
   }
 }`;
 }
 
 const logger = useLogger("@nuxt/scripts");
 
-function generateInterceptPluginContents(interceptRules) {
-  const rulesJson = JSON.stringify(interceptRules);
+function resolveCapabilities(script, scriptOptions) {
+  const defaults = script.defaultCapability ?? {};
+  const ceiling = script.capabilities ?? {};
+  const resolved = { ...defaults };
+  if (!scriptOptions)
+    return resolved;
+  const overrideKeys = ["reverseProxyIntercept", "bundle", "partytown"];
+  for (const key of overrideKeys) {
+    if (key in scriptOptions) {
+      const userValue = scriptOptions[key];
+      if (typeof userValue !== "boolean")
+        continue;
+      if (userValue && !ceiling[key]) {
+        if (import.meta.dev) {
+          logger.warn(
+            `[nuxt-scripts] Script "${script.registryKey}" does not support capability "${key}". This override will be ignored. Supported capabilities: ${JSON.stringify(ceiling)}`
+          );
+        }
+        continue;
+      }
+      resolved[key] = userValue;
+    }
+  }
+  return resolved;
+}
+
+function generateInterceptPluginContents(proxyPrefix) {
   return `export default defineNuxtPlugin({
   name: 'nuxt-scripts:intercept',
   enforce: 'pre',
   setup() {
-    const rules = ${rulesJson};
+    const proxyPrefix = ${JSON.stringify(proxyPrefix)};
     const origBeacon = typeof navigator !== 'undefined' && navigator.sendBeacon
       ? navigator.sendBeacon.bind(navigator)
       : () => false;
     const origFetch = globalThis.fetch.bind(globalThis);
 
-    function rewriteUrl(url) {
+    function proxyUrl(url) {
       try {
         const parsed = new URL(url, location.origin);
-        for (const rule of rules) {
-          if (parsed.hostname === rule.pattern || parsed.hostname.endsWith('.' + rule.pattern)) {
-            if (rule.pathPrefix && !parsed.pathname.startsWith(rule.pathPrefix)) continue;
-            const path = rule.pathPrefix ? parsed.pathname.slice(rule.pathPrefix.length) : parsed.pathname;
-            return location.origin + rule.target + (path.startsWith('/') ? '' : '/') + path + parsed.search;
-          }
-        }
+        if (parsed.origin !== location.origin)
+          return location.origin + proxyPrefix + '/' + parsed.host + parsed.pathname + parsed.search;
       } catch {}
       return url;
     }
@@ -70,7 +183,7 @@ function generateInterceptPluginContents(interceptRules) {
     class ProxiedXHR extends OrigXHR {
       open() {
         const args = Array.from(arguments);
-        if (typeof args[1] === 'string') args[1] = rewriteUrl(args[1]);
+        if (typeof args[1] === 'string') args[1] = proxyUrl(args[1]);
         return super.open.apply(this, args);
       }
     }
@@ -83,7 +196,7 @@ function generateInterceptPluginContents(interceptRules) {
       if (origSrcDesc && origSrcDesc.set) {
         Object.defineProperty(img, 'src', {
           get() { return origSrcDesc.get.call(this); },
-          set(v) { origSrcDesc.set.call(this, typeof v === 'string' ? rewriteUrl(v) : v); },
+          set(v) { origSrcDesc.set.call(this, typeof v === 'string' ? proxyUrl(v) : v); },
           configurable: true,
         });
       }
@@ -91,8 +204,12 @@ function generateInterceptPluginContents(interceptRules) {
     }
 
     globalThis.__nuxtScripts = {
-      sendBeacon: (url, data) => origBeacon(rewriteUrl(url), data),
-      fetch: (url, opts) => origFetch(typeof url === 'string' ? rewriteUrl(url) : url, opts),
+      sendBeacon: (url, data) => origBeacon(proxyUrl(url), data),
+      fetch: (url, opts) => {
+        if (typeof url === 'string') return origFetch(proxyUrl(url), opts);
+        if (url instanceof Request) return origFetch(new Request(proxyUrl(url.url), url), opts);
+        return origFetch(url, opts);
+      },
       XMLHttpRequest: ProxiedXHR,
       Image: ProxiedImage,
     };
@@ -102,13 +219,12 @@ function generateInterceptPluginContents(interceptRules) {
 }
 
 async function setupFirstParty(config, resolvePath) {
-  const enabled = !!config.firstParty;
-  const proxyPrefix = typeof config.firstParty === "object" ? config.firstParty.proxyPrefix || "/_scripts/p" : "/_scripts/p";
-  const privacy = typeof config.firstParty === "object" ? config.firstParty.privacy : void 0;
+  const proxyDisabled = config.proxy === false;
+  const proxyPrefix = typeof config.proxy === "object" ? config.proxy.prefix || "/_scripts/p" : "/_scripts/p";
+  const privacy = typeof config.proxy === "object" ? config.proxy.privacy : void 0;
   const assetsPrefix = config.assets?.prefix || "/_scripts/assets";
-  const proxyConfigs = enabled ? getAllProxyConfigs(proxyPrefix) : {};
-  const firstParty = { enabled, proxyPrefix, privacy, assetsPrefix, proxyConfigs };
-  if (enabled) {
+  const firstParty = { enabled: !proxyDisabled, proxyPrefix, privacy, assetsPrefix, proxyConfigs: {} };
+  if (!proxyDisabled) {
     const proxyHandlerPath = await resolvePath("./runtime/server/proxy-handler");
     logger.debug("[nuxt-scripts] Registering proxy handler:", `${proxyPrefix}/**`, "->", proxyHandlerPath);
     addServerHandler({
@@ -123,6 +239,9 @@ function applyAutoInject(registry, runtimeConfig, proxyPrefix, registryKey, auto
   if (!entry)
     return;
   const input = entry[0];
+  const scriptOptions = entry[1];
+  if (input?.reverseProxyIntercept === false || scriptOptions?.reverseProxyIntercept === false)
+    return;
   const rtScripts = runtimeConfig.public?.scripts;
   const rtEntry = rtScripts?.[registryKey];
   const config = rtEntry && typeof rtEntry === "object" ? rtEntry : input;
@@ -133,16 +252,6 @@ function applyAutoInject(registry, runtimeConfig, proxyPrefix, registryKey, auto
   if (rtEntry && typeof rtEntry === "object" && rtEntry !== input)
     rtEntry[autoInject.configField] = value;
 }
-const DOMAIN_RE = /^https?:\/\/([^/]+)/;
-function extractDomains(routes) {
-  const domains = /* @__PURE__ */ new Set();
-  for (const { proxy } of Object.values(routes)) {
-    const match = proxy.match(DOMAIN_RE);
-    if (match?.[1])
-      domains.add(match[1]);
-  }
-  return [...domains].sort();
-}
 function computePrivacyLevel(privacy) {
   const flags = Object.values(privacy);
   if (flags.every(Boolean))
@@ -153,17 +262,19 @@ function computePrivacyLevel(privacy) {
 }
 function finalizeFirstParty(opts) {
   const { firstParty, registryScripts, nuxtOptions } = opts;
-  const { proxyConfigs, proxyPrefix } = firstParty;
+  const { proxyPrefix } = firstParty;
+  const proxyConfigs = buildProxyConfigsFromRegistry(registryScripts);
+  firstParty.proxyConfigs = proxyConfigs;
   const registryKeys = Object.keys(opts.registry || {});
   const scriptByKey = /* @__PURE__ */ new Map();
   for (const script of registryScripts) {
     if (script.registryKey)
       scriptByKey.set(script.registryKey, script);
   }
-  const neededRoutes = {};
-  const routePrivacyOverrides = {};
+  const domainPrivacy = {};
   const unsupportedScripts = [];
   const unmatchedScripts = [];
+  let totalDomains = 0;
   const devtoolsScripts = [];
   for (const key of registryKeys) {
     const script = scriptByKey.get(key);
@@ -171,20 +282,22 @@ function finalizeFirstParty(opts) {
       unmatchedScripts.push(key);
       continue;
     }
-    if (script.proxy === false)
+    if (!script.capabilities?.reverseProxyIntercept)
+      continue;
+    const registryEntry = opts.registry?.[key];
+    const entryScriptOptions = registryEntry?.[1];
+    const entryInput = registryEntry?.[0];
+    if (entryScriptOptions?.reverseProxyIntercept === false || entryInput?.reverseProxyIntercept === false)
       continue;
-    const configKey = script.proxy || key;
+    const configKey = script.proxyConfig || key;
     const proxyConfig = proxyConfigs[configKey];
     if (!proxyConfig) {
-      if (script.scriptBundling !== false)
-        unsupportedScripts.push(key);
+      unsupportedScripts.push(key);
       continue;
     }
-    const scriptRoutes = proxyConfig.routes || {};
-    if (proxyConfig.routes) {
-      Object.assign(neededRoutes, proxyConfig.routes);
-      for (const routePath of Object.keys(proxyConfig.routes))
-        routePrivacyOverrides[routePath] = proxyConfig.privacy;
+    for (const domain of proxyConfig.domains) {
+      domainPrivacy[domain] = proxyConfig.privacy;
+      totalDomains++;
     }
     if (proxyConfig.autoInject && opts.registry)
       applyAutoInject(opts.registry, nuxtOptions.runtimeConfig, proxyPrefix, key, proxyConfig.autoInject);
@@ -200,7 +313,6 @@ function finalizeFirstParty(opts) {
       };
       const logo = script.logo;
       const logoStr = typeof logo === "object" ? logo.dark || logo.light : logo || "";
-      const interceptRules2 = routesToInterceptRules(scriptRoutes);
       devtoolsScripts.push({
         registryKey: key,
         label: script.label || key,
@@ -213,9 +325,7 @@ function finalizeFirstParty(opts) {
         hasPostProcess: !!proxyConfig.postProcess,
         privacy: normalizedPrivacy,
         privacyLevel: computePrivacyLevel(normalizedPrivacy),
-        domains: extractDomains(scriptRoutes),
-        routes: Object.entries(scriptRoutes).map(([local, { proxy }]) => ({ local, target: proxy })),
-        interceptRules: interceptRules2
+        domains: [...proxyConfig.domains]
       });
     }
   }
@@ -231,30 +341,21 @@ These scripts will not have proxy routes registered. Check that the registry key
 They will load directly from third-party servers. Request support at https://github.com/nuxt/scripts/issues`
     );
   }
-  const interceptRules = routesToInterceptRules(neededRoutes);
   addPluginTemplate({
     filename: "nuxt-scripts-intercept.client.mjs",
     getContents() {
-      return generateInterceptPluginContents(interceptRules);
+      return generateInterceptPluginContents(proxyPrefix);
     }
   });
-  const flatRoutes = {};
-  for (const [path, config] of Object.entries(neededRoutes))
-    flatRoutes[path] = config.proxy;
   nuxtOptions.runtimeConfig["nuxt-scripts-proxy"] = {
-    routes: flatRoutes,
-    privacy: firstParty.privacy,
-    routePrivacy: routePrivacyOverrides
+    proxyPrefix,
+    domainPrivacy,
+    privacy: firstParty.privacy
   };
   const privacyLabel = firstParty.privacy === void 0 ? "per-script" : typeof firstParty.privacy === "boolean" ? firstParty.privacy ? "anonymize" : "passthrough" : "custom";
-  if (Object.keys(neededRoutes).length && nuxtOptions.dev) {
-    const routeCount = Object.keys(neededRoutes).length;
+  if (totalDomains > 0 && nuxtOptions.dev) {
     const scriptsCount = registryKeys.length;
-    logger.success(`First-party mode enabled for ${scriptsCount} script(s), ${routeCount} proxy route(s) configured (privacy: ${privacyLabel})`);
-    if (logger.level >= 4) {
-      for (const [path, config] of Object.entries(neededRoutes))
-        logger.debug(`  ${path} \u2192 ${config.proxy}`);
-    }
+    logger.success(`First-party mode enabled for ${scriptsCount} script(s), ${totalDomains} domain(s) proxied (privacy: ${privacyLabel})`);
   }
   const staticPresets = ["static", "github-pages", "cloudflare-pages-static", "netlify-static", "azure-static", "firebase-static"];
   const preset = process.env.NITRO_PRESET || "";
@@ -266,7 +367,7 @@ Scripts will be bundled, but collection requests will not be proxied.
 Options:
   1. Configure platform rewrites (Vercel, Netlify, Cloudflare)
   2. Switch to server-rendered mode (ssr: true)
-  3. Disable with firstParty: false
+  3. Disable with proxy: false
 
 See: https://scripts.nuxt.com/docs/guides/first-party#static-hosting`
     );
@@ -283,112 +384,10 @@ See: https://scripts.nuxt.com/docs/guides/first-party#static-hosting`
       proxyPrefix,
       privacyMode: privacyLabel,
       scripts: devtoolsScripts,
-      totalRoutes: Object.keys(neededRoutes).length,
       totalDomains: allDomains.size
     };
   }
-  return { interceptRules, devtools };
-}
-
-const renderedScript = /* @__PURE__ */ new Map();
-const ONE_YEAR_IN_SECONDS = 60 * 60 * 24 * 365;
-function bundleStorage() {
-  const nuxt = tryUseNuxt();
-  return createStorage({
-    driver: fsDriver({
-      base: resolve(nuxt?.options.rootDir || "", "node_modules/.cache/nuxt/scripts")
-    })
-  });
-}
-function setupPublicAssetStrategy(options = {}) {
-  const assetsBaseURL = options.prefix || "/_scripts/assets";
-  const nuxt = useNuxt();
-  const storage = bundleStorage();
-  addDevServerHandler({
-    route: assetsBaseURL,
-    handler: lazyEventHandler(async () => {
-      return eventHandler(async (event) => {
-        const cleanPath = (event.path || "").split("?")[0]?.slice(1) || "";
-        const filename = cleanPath;
-        const scriptDescriptor = renderedScript.get(join(assetsBaseURL, cleanPath));
-        if (!scriptDescriptor || scriptDescriptor instanceof Error)
-          throw createError({ statusCode: 404 });
-        if (scriptDescriptor.content) {
-          return scriptDescriptor.content;
-        }
-        const key = `bundle:${filename}`;
-        let res = await storage.getItemRaw(key);
-        if (!res) {
-          res = await fetch(scriptDescriptor.src).then((r) => r.arrayBuffer()).then((r) => Buffer.from(r));
-          await storage.setItemRaw(key, res);
-        }
-        return res;
-      });
-    })
-  });
-  if (nuxt.options.dev) {
-    extendRouteRules(joinURL(assetsBaseURL, "**"), {
-      cache: {
-        maxAge: ONE_YEAR_IN_SECONDS
-      }
-    });
-  }
-  const cacheDir = join(nuxt.options.buildDir, "cache", "scripts");
-  nuxt.hook("nitro:config", (nitroConfig) => {
-    nitroConfig.publicAssets ||= [];
-    nitroConfig.publicAssets.push({
-      dir: cacheDir,
-      maxAge: ONE_YEAR_IN_SECONDS,
-      baseURL: assetsBaseURL
-    });
-    nitroConfig.prerender ||= {};
-    nitroConfig.prerender.ignore ||= [];
-    nitroConfig.prerender.ignore.push(assetsBaseURL);
-  });
-  return {
-    renderedScript
-  };
-}
-
-const DEVTOOLS_UI_ROUTE = "/__nuxt-scripts";
-const DEVTOOLS_UI_LOCAL_PORT = 3300;
-
-async function setupDevToolsUI(options, resolve, nuxt = useNuxt()) {
-  const clientPath = await resolve("./client");
-  const isProductionBuild = existsSync(clientPath);
-  if (isProductionBuild) {
-    nuxt.hook("vite:serverCreated", async (server) => {
-      const sirv = await import('sirv').then((r) => r.default || r);
-      server.middlewares.use(
-        DEVTOOLS_UI_ROUTE,
-        sirv(clientPath, { dev: true, single: true })
-      );
-    });
-  } else {
-    extendViteConfig((config) => {
-      config.server = config.server || {};
-      config.server.proxy = config.server.proxy || {};
-      config.server.proxy[DEVTOOLS_UI_ROUTE] = {
-        target: `http://localhost:${DEVTOOLS_UI_LOCAL_PORT}${DEVTOOLS_UI_ROUTE}`,
-        changeOrigin: true,
-        followRedirects: true,
-        rewrite: (path) => path.replace(DEVTOOLS_UI_ROUTE, "")
-      };
-    });
-  }
-  addCustomTab({
-    // unique identifier
-    name: "nuxt-scripts",
-    // title to display in the tab
-    title: "Scripts",
-    // any icon from Iconify, or a URL to an image
-    icon: "carbon:script",
-    // iframe view
-    view: {
-      type: "iframe",
-      src: DEVTOOLS_UI_ROUTE
-    }
-  });
+  return { proxyPrefix, devtools };
 }
 
 const isStackblitz = provider === "stackblitz";
@@ -710,7 +709,8 @@ function rewriteScriptUrlsAST(content, filename, rewrites, postProcess, options)
       }
       if (node.type === "CallExpression" && !options?.skipApiRewrites) {
         const callee = node.callee;
-        const canvasPropName = callee?.type === "MemberExpression" ? callee.computed ? callee.property?.type === "Literal" && typeof callee.property.value === "string" ? callee.property.value : null : callee.property?.name : null;
+        const shouldNeutralizeCanvas = options?.neutralizeCanvas !== false;
+        const canvasPropName = shouldNeutralizeCanvas && callee?.type === "MemberExpression" ? callee.computed ? callee.property?.type === "Literal" && typeof callee.property.value === "string" ? callee.property.value : null : callee.property?.name : null;
         if (canvasPropName === "toDataURL" && callee.object) {
           const blankCanvas = `"${BLANK_CANVAS_DATA_URL}"`;
           if (callee.object.type === "Identifier") {
@@ -817,7 +817,7 @@ function normalizeScriptData(src, assetsBaseURL = "/_scripts/assets") {
   return { url: src };
 }
 async function downloadScript(opts, renderedScript, fetchOptions, cacheMaxAge) {
-  const { src, url, filename, forceDownload, integrity, proxyRewrites, postProcess, skipApiRewrites } = opts;
+  const { src, url, filename, forceDownload, integrity, proxyRewrites, postProcess, skipApiRewrites, neutralizeCanvas } = opts;
   if (src === url || !filename) {
     return;
   }
@@ -855,7 +855,7 @@ async function downloadScript(opts, renderedScript, fetchOptions, cacheMaxAge) {
     await storage.setItemRaw(`bundle:${filename}`, res);
     if (proxyRewrites?.length && res) {
       const content = res.toString("utf-8");
-      const rewritten = rewriteScriptUrlsAST(content, filename || "script.js", proxyRewrites, postProcess, { skipApiRewrites });
+      const rewritten = rewriteScriptUrlsAST(content, filename || "script.js", proxyRewrites, postProcess, { skipApiRewrites, neutralizeCanvas });
       res = Buffer.from(rewritten, "utf-8");
       logger.debug(`Rewrote ${proxyRewrites.length} URL patterns in ${filename}`);
     }
@@ -1035,34 +1035,39 @@ function NuxtScriptBundleTransformer(options = {
                     canBundle = bundleValue === true || bundleValue === "force" || String(bundleValue) === "true";
                     forceDownload = bundleValue === "force";
                   }
-                  const firstPartyOption = scriptOptions?.value.properties?.find((prop) => {
-                    return prop.type === "Property" && prop.key?.name === "firstParty" && prop.value.type === "Literal";
+                  const rpiOption = scriptOptions?.value.properties?.find((prop) => {
+                    return prop.type === "Property" && prop.key?.name === "reverseProxyIntercept" && prop.value.type === "Literal";
                   });
-                  let firstPartyOptOut = firstPartyOption?.value.value === false;
+                  let firstPartyOptOut = rpiOption?.value.value === false;
                   if (!firstPartyOptOut && node.arguments[1]?.type === "ObjectExpression") {
-                    const secondArgFirstPartyProp = node.arguments[1].properties.find(
-                      (p) => p.type === "Property" && p.key?.name === "firstParty" && p.value.type === "Literal"
+                    const secondArgProp = node.arguments[1].properties.find(
+                      (p) => p.type === "Property" && p.key?.name === "reverseProxyIntercept" && p.value.type === "Literal"
                     );
-                    firstPartyOptOut = secondArgFirstPartyProp?.value.value === false;
+                    firstPartyOptOut = secondArgProp?.value.value === false;
                   }
                   if (!firstPartyOptOut && node.arguments[0]?.type === "ObjectExpression") {
-                    const firstArgFirstPartyProp = node.arguments[0].properties.find(
-                      (p) => p.type === "Property" && p.key?.name === "firstParty" && p.value.type === "Literal"
+                    const firstArgProp = node.arguments[0].properties.find(
+                      (p) => p.type === "Property" && p.key?.name === "reverseProxyIntercept" && p.value.type === "Literal"
                     );
-                    firstPartyOptOut = firstArgFirstPartyProp?.value.value === false;
+                    firstPartyOptOut = firstArgProp?.value.value === false;
                   }
                   if (canBundle) {
                     const { url: _url, filename } = normalizeScriptData(src, options.assetsBaseURL);
                     const script = options.scripts?.find((s2) => s2.import.name === fnName);
-                    const proxyConfigKey = script?.proxy !== false ? script?.proxy || registryKey : void 0;
+                    const hasReverseProxy = script?.capabilities?.reverseProxyIntercept;
+                    const proxyConfigKey = hasReverseProxy ? script?.proxyConfig || registryKey : void 0;
                     const proxyConfig = !firstPartyOptOut && proxyConfigKey ? options.proxyConfigs?.[proxyConfigKey] : void 0;
-                    const proxyRewrites = proxyConfig?.rewrite;
+                    const proxyRewrites = proxyConfig?.domains?.map((domain) => ({
+                      from: domain,
+                      to: `${options.proxyPrefix}/${domain}`
+                    }));
                     const postProcess = proxyConfig?.postProcess;
                     const skipApiRewrites = !!(registryKey && options.partytownScripts?.has(registryKey));
+                    const neutralizeCanvas = proxyConfig?.privacy !== void 0 && typeof proxyConfig.privacy === "object" ? proxyConfig.privacy.hardware ?? true : true;
                     deferredOps.push(async () => {
                       let url = _url;
                       try {
-                        await downloadScript({ src, url, filename, forceDownload, proxyRewrites, postProcess, integrity: options.integrity, skipApiRewrites }, renderedScript, options.fetchOptions, options.cacheMaxAge);
+                        await downloadScript({ src, url, filename, forceDownload, proxyRewrites, postProcess, integrity: options.integrity, skipApiRewrites, neutralizeCanvas }, renderedScript, options.fetchOptions, options.cacheMaxAge);
                       } catch (e) {
                         if (options.fallbackOnSrcOnBundleFail) {
                           logger.warn(`[Nuxt Scripts: Bundle Transformer] Failed to bundle ${src}. Fallback to remote loading.`);
@@ -1436,7 +1441,6 @@ const module$1 = defineNuxtModule({
     }
   },
   defaults: {
-    firstParty: true,
     defaultScriptOptions: {
       trigger: "onNuxtReady"
     },
@@ -1513,37 +1517,11 @@ const module$1 = defineNuxtModule({
     };
     if (config.defaultScriptOptions?.bundle !== void 0) {
       logger.warn(
-        "`scripts.defaultScriptOptions.bundle` is deprecated. Use `scripts.firstParty: true` instead. First-party mode is now enabled by default."
+        "`scripts.defaultScriptOptions.bundle` is deprecated. Bundling is now auto-enabled per-script via capabilities. Set `bundle: false` per-script to disable."
       );
     }
     const firstParty = await setupFirstParty(config, resolvePath);
     const assetsPrefix = firstParty.assetsPrefix;
-    if (config.partytown?.length) {
-      config.registry = config.registry || {};
-      const requiredForwards = [];
-      for (const scriptKey of config.partytown) {
-        const forwards = PARTYTOWN_FORWARDS[scriptKey];
-        if (forwards) {
-          requiredForwards.push(...forwards);
-        } else if (import.meta.dev) {
-          logger.warn(`[partytown] "${scriptKey}" has no known Partytown forwards configured. It may not work correctly or may require manual forward configuration.`);
-        }
-        const reg = config.registry;
-        const existing = reg[scriptKey];
-        if (existing) {
-          existing[1] = { ...existing[1], partytown: true };
-        } else {
-          reg[scriptKey] = [{}, { partytown: true }];
-        }
-      }
-      if (requiredForwards.length && hasNuxtModule("@nuxtjs/partytown")) {
-        const partytownConfig = nuxt.options.partytown || {};
-        const existingForwards = partytownConfig.forward || [];
-        const newForwards = [.../* @__PURE__ */ new Set([...existingForwards, ...requiredForwards])];
-        nuxt.options.partytown = { ...partytownConfig, forward: newForwards };
-        logger.info(`[partytown] Auto-configured forwards: ${requiredForwards.join(", ")}`);
-      }
-    }
     const composables = [
       "useScript",
       "useScriptEventPage",
@@ -1600,8 +1578,43 @@ const module$1 = defineNuxtModule({
         });
       }
       const { renderedScript } = setupPublicAssetStrategy(config.assets);
+      const partytownScripts = /* @__PURE__ */ new Set();
+      const scriptByKey = /* @__PURE__ */ new Map();
+      for (const script of registryScripts) {
+        if (script.registryKey)
+          scriptByKey.set(script.registryKey, script);
+      }
+      let anyNeedsProxy = false;
+      const registryKeys = Object.keys(config.registry || {});
+      for (const key of registryKeys) {
+        const script = scriptByKey.get(key);
+        if (!script)
+          continue;
+        const entry = config.registry?.[key];
+        const scriptOptions = entry?.[1] || {};
+        const inputOptions = entry?.[0] || {};
+        const mergedOverrides = { ...inputOptions, ...scriptOptions };
+        const resolved = resolveCapabilities(script, mergedOverrides);
+        if (resolved.reverseProxyIntercept)
+          anyNeedsProxy = true;
+        if (resolved.partytown) {
+          partytownScripts.add(key);
+          const forwards = PARTYTOWN_FORWARDS[key];
+          if (forwards?.length && hasNuxtModule("@nuxtjs/partytown")) {
+            const partytownConfig = nuxt.options.partytown || {};
+            const existingForwards = partytownConfig.forward || [];
+            const newForwards = [.../* @__PURE__ */ new Set([...existingForwards, ...forwards])];
+            nuxt.options.partytown = { ...partytownConfig, forward: newForwards };
+          } else if (!forwards && import.meta.dev) {
+            logger.warn(`[partytown] "${key}" has no known Partytown forwards configured. It may not work correctly or may require manual forward configuration.`);
+          }
+        }
+      }
+      if (firstParty.enabled && !anyNeedsProxy) {
+        firstParty.enabled = false;
+      }
       if (firstParty.enabled) {
-        const { interceptRules, devtools: devtoolsData } = finalizeFirstParty({
+        const { proxyPrefix, devtools: devtoolsData } = finalizeFirstParty({
           firstParty,
           registry: config.registry,
           registryScripts,
@@ -1610,14 +1623,14 @@ const module$1 = defineNuxtModule({
         if (devtoolsData) {
           nuxt.options.runtimeConfig.public["nuxt-scripts-devtools"] = devtoolsData;
         }
-        if (config.partytown?.length && hasNuxtModule("@nuxtjs/partytown") && interceptRules.length) {
+        if (partytownScripts.size && hasNuxtModule("@nuxtjs/partytown")) {
           const partytownConfig = nuxt.options.partytown || {};
           if (!partytownConfig.resolveUrl) {
-            partytownConfig.resolveUrl = generatePartytownResolveUrl(interceptRules);
+            partytownConfig.resolveUrl = generatePartytownResolveUrl(proxyPrefix);
             nuxt.options.partytown = partytownConfig;
             logger.info("[partytown] Auto-configured resolveUrl for first-party proxy");
           } else {
-            logger.warn("[partytown] Custom resolveUrl already set \u2014 first-party proxy URLs will not be auto-rewritten in Partytown worker. Add first-party proxy rules to your resolveUrl manually.");
+            logger.warn("[partytown] Custom resolveUrl already set. Add first-party proxy rules to your resolveUrl manually.");
           }
         }
       }
@@ -1630,7 +1643,8 @@ const module$1 = defineNuxtModule({
         registryConfig: nuxt.options.runtimeConfig.public.scripts,
         defaultBundle: firstParty.enabled || config.defaultScriptOptions?.bundle,
         proxyConfigs: firstParty.proxyConfigs,
-        partytownScripts: new Set(config.partytown || []),
+        proxyPrefix: firstParty.proxyPrefix,
+        partytownScripts,
         moduleDetected(module) {
           if (nuxt.options.dev && module !== "@nuxt/scripts" && !moduleInstallPromises.has(module) && !hasNuxtModule(module))
             moduleInstallPromises.set(module, () => installNuxtModule(module));