@nuxt/scripts 1.0.0-beta.31 → 1.0.0-beta.32

package/dist/registry.mjs

@@ -56,6 +56,20 @@ const LOGOS = {
   snapchatPixel: `<svg width="50" height="50" viewBox="147.353 39.286 514.631 514.631" version="1.1" id="Layer_1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"  xml:space="preserve"><path style="fill:#FFFC00;" d="M147.553,423.021v0.023c0.308,11.424,0.403,22.914,2.33,34.268 c2.042,12.012,4.961,23.725,10.53,34.627c7.529,14.756,17.869,27.217,30.921,37.396c9.371,7.309,19.608,13.111,30.94,16.771 c16.524,5.33,33.571,7.373,50.867,7.473c10.791,0.068,21.575,0.338,32.37,0.293c78.395-0.33,156.792,0.566,235.189-0.484 c10.403-0.141,20.636-1.41,30.846-3.277c19.569-3.582,36.864-11.932,51.661-25.133c17.245-15.381,28.88-34.205,34.132-56.924 c3.437-14.85,4.297-29.916,4.444-45.035v-3.016c0-1.17-0.445-256.892-0.486-260.272c-0.115-9.285-0.799-18.5-2.54-27.636 c-2.117-11.133-5.108-21.981-10.439-32.053c-5.629-10.641-12.68-20.209-21.401-28.57c-13.359-12.81-28.775-21.869-46.722-26.661 c-16.21-4.327-32.747-5.285-49.405-5.27c-0.027-0.004-0.09-0.173-0.094-0.255H278.56c-0.005,0.086-0.008,0.172-0.014,0.255 c-9.454,0.173-18.922,0.102-28.328,1.268c-10.304,1.281-20.509,3.21-30.262,6.812c-15.362,5.682-28.709,14.532-40.11,26.347 c-12.917,13.386-22.022,28.867-26.853,46.894c-4.31,16.084-5.248,32.488-5.271,49.008"/><path style="fill:#FFFFFF;" d="M407.001,473.488c-1.068,0-2.087-0.039-2.862-0.076c-0.615,0.053-1.25,0.076-1.886,0.076 c-22.437,0-37.439-10.607-50.678-19.973c-9.489-6.703-18.438-13.031-28.922-14.775c-5.149-0.854-10.271-1.287-15.22-1.287 c-8.917,0-15.964,1.383-21.109,2.389c-3.166,0.617-5.896,1.148-8.006,1.148c-2.21,0-4.895-0.49-6.014-4.311 c-0.887-3.014-1.523-5.934-2.137-8.746c-1.536-7.027-2.65-11.316-5.281-11.723c-28.141-4.342-44.768-10.738-48.08-18.484 c-0.347-0.814-0.541-1.633-0.584-2.443c-0.129-2.309,1.501-4.334,3.777-4.711c22.348-3.68,42.219-15.492,59.064-35.119 c13.049-15.195,19.457-29.713,20.145-31.316c0.03-0.072,0.065-0.148,0.101-0.217c3.247-6.588,3.893-12.281,1.926-16.916 c-3.626-8.551-15.635-12.361-23.58-14.882c-1.976-0.625-3.845-1.217-5.334-1.808c-7.043-2.782-18.626-8.66-17.083-16.773 c1.124-5.916,8.949-10.036,15.273-10.036c1.756,0,3.312,0.308,4.622,0.923c7.146,3.348,13.575,5.045,19.104,5.045 c6.876,0,10.197-2.618,11-3.362c-0.198-3.668-0.44-7.546-0.674-11.214c0-0.004-0.005-0.048-0.005-0.048 c-1.614-25.675-3.627-57.627,4.546-75.95c24.462-54.847,76.339-59.112,91.651-59.112c0.408,0,6.674-0.062,6.674-0.062 c0.283-0.005,0.59-0.009,0.908-0.009c15.354,0,67.339,4.27,91.816,59.15c8.173,18.335,6.158,50.314,4.539,76.016l-0.076,1.23 c-0.222,3.49-0.427,6.793-0.6,9.995c0.756,0.696,3.795,3.096,9.978,3.339c5.271-0.202,11.328-1.891,17.998-5.014 c2.062-0.968,4.345-1.169,5.895-1.169c2.343,0,4.727,0.456,6.714,1.285l0.106,0.041c5.66,2.009,9.367,6.024,9.447,10.242 c0.071,3.932-2.851,9.809-17.223,15.485c-1.472,0.583-3.35,1.179-5.334,1.808c-7.952,2.524-19.951,6.332-23.577,14.878 c-1.97,4.635-1.322,10.326,1.926,16.912c0.036,0.072,0.067,0.145,0.102,0.221c1,2.344,25.205,57.535,79.209,66.432 c2.275,0.379,3.908,2.406,3.778,4.711c-0.048,0.828-0.248,1.656-0.598,2.465c-3.289,7.703-19.915,14.09-48.064,18.438 c-2.642,0.408-3.755,4.678-5.277,11.668c-0.63,2.887-1.271,5.717-2.146,8.691c-0.819,2.797-2.641,4.164-5.567,4.164h-0.441 c-1.905,0-4.604-0.346-8.008-1.012c-5.95-1.158-12.623-2.236-21.109-2.236c-4.948,0-10.069,0.434-15.224,1.287 c-10.473,1.744-19.421,8.062-28.893,14.758C444.443,462.88,429.436,473.488,407.001,473.488"/><path style="fill:#020202;" d="M408.336,124.235c14.455,0,64.231,3.883,87.688,56.472c7.724,17.317,5.744,48.686,4.156,73.885 c-0.248,3.999-0.494,7.875-0.694,11.576l-0.084,1.591l1.062,1.185c0.429,0.476,4.444,4.672,13.374,5.017l0.144,0.008l0.15-0.003 c5.904-0.225,12.554-2.059,19.776-5.442c1.064-0.498,2.48-0.741,3.978-0.741c1.707,0,3.521,0.321,5.017,0.951l0.226,0.09 c3.787,1.327,6.464,3.829,6.505,6.093c0.022,1.28-0.935,5.891-14.359,11.194c-1.312,0.518-3.039,1.069-5.041,1.7 c-8.736,2.774-21.934,6.96-26.376,17.427c-2.501,5.896-1.816,12.854,2.034,20.678c1.584,3.697,26.52,59.865,82.631,69.111 c-0.011,0.266-0.079,0.557-0.229,0.9c-0.951,2.24-6.996,9.979-44.612,15.783c-5.886,0.902-7.328,7.5-9,15.17 c-0.604,2.746-1.218,5.518-2.062,8.381c-0.258,0.865-0.306,0.914-1.233,0.914c-0.128,0-0.278,0-0.442,0 c-1.668,0-4.2-0.346-7.135-0.922c-5.345-1.041-12.647-2.318-21.982-2.318c-5.21,0-10.577,0.453-15.962,1.352 c-11.511,1.914-20.872,8.535-30.786,15.543c-13.314,9.408-27.075,19.143-48.071,19.143c-0.917,0-1.812-0.031-2.709-0.076 l-0.236-0.01l-0.237,0.018c-0.515,0.045-1.034,0.068-1.564,0.068c-20.993,0-34.76-9.732-48.068-19.143 c-9.916-7.008-19.282-13.629-30.791-15.543c-5.38-0.896-10.752-1.352-15.959-1.352c-9.333,0-16.644,1.428-21.978,2.471 c-2.935,0.574-5.476,1.066-7.139,1.066c-1.362,0-1.388-0.08-1.676-1.064c-0.844-2.865-1.461-5.703-2.062-8.445 c-1.676-7.678-3.119-14.312-9.002-15.215c-37.613-5.809-43.659-13.561-44.613-15.795c-0.149-0.352-0.216-0.652-0.231-0.918 c56.11-9.238,81.041-65.408,82.63-69.119c3.857-7.818,4.541-14.775,2.032-20.678c-4.442-10.461-17.638-14.653-26.368-17.422 c-2.007-0.635-3.735-1.187-5.048-1.705c-11.336-4.479-14.823-8.991-14.305-11.725c0.601-3.153,6.067-6.359,10.837-6.359 c1.072,0,2.012,0.173,2.707,0.498c7.747,3.631,14.819,5.472,21.022,5.472c9.751,0,14.091-4.537,14.557-5.055l1.057-1.182 l-0.085-1.583c-0.197-3.699-0.44-7.574-0.696-11.565c-1.583-25.205-3.563-56.553,4.158-73.871 c23.37-52.396,72.903-56.435,87.525-56.435c0.36,0,6.717-0.065,6.717-0.065C407.744,124.239,408.033,124.235,408.336,124.235 M408.336,115.197h-0.017c-0.333,0-0.646,0-0.944,0.004c-2.376,0.024-6.282,0.062-6.633,0.066c-8.566,0-25.705,1.21-44.115,9.336 c-10.526,4.643-19.994,10.921-28.14,18.66c-9.712,9.221-17.624,20.59-23.512,33.796c-8.623,19.336-6.576,51.905-4.932,78.078 l0.006,0.041c0.176,2.803,0.361,5.73,0.53,8.582c-1.265,0.581-3.316,1.194-6.339,1.194c-4.864,0-10.648-1.555-17.187-4.619 c-1.924-0.896-4.12-1.349-6.543-1.349c-3.893,0-7.997,1.146-11.557,3.239c-4.479,2.63-7.373,6.347-8.159,10.468 c-0.518,2.726-0.493,8.114,5.492,13.578c3.292,3.008,8.128,5.782,14.37,8.249c1.638,0.645,3.582,1.261,5.641,1.914 c7.145,2.271,17.959,5.702,20.779,12.339c1.429,3.365,0.814,7.793-1.823,13.145c-0.069,0.146-0.138,0.289-0.201,0.439 c-0.659,1.539-6.807,15.465-19.418,30.152c-7.166,8.352-15.059,15.332-23.447,20.752c-10.238,6.617-21.316,10.943-32.923,12.855 c-4.558,0.748-7.813,4.809-7.559,9.424c0.078,1.33,0.39,2.656,0.931,3.939c0.004,0.008,0.009,0.016,0.013,0.023 c1.843,4.311,6.116,7.973,13.063,11.203c8.489,3.943,21.185,7.26,37.732,9.855c0.836,1.59,1.704,5.586,2.305,8.322 c0.629,2.908,1.285,5.898,2.22,9.074c1.009,3.441,3.626,7.553,10.349,7.553c2.548,0,5.478-0.574,8.871-1.232 c4.969-0.975,11.764-2.305,20.245-2.305c4.702,0,9.575,0.414,14.48,1.229c9.455,1.574,17.606,7.332,27.037,14 c13.804,9.758,29.429,20.803,53.302,20.803c0.651,0,1.304-0.021,1.949-0.066c0.789,0.037,1.767,0.066,2.799,0.066 c23.88,0,39.501-11.049,53.29-20.799l0.022-0.02c9.433-6.66,17.575-12.41,27.027-13.984c4.903-0.814,9.775-1.229,14.479-1.229 c8.102,0,14.517,1.033,20.245,2.15c3.738,0.736,6.643,1.09,8.872,1.09l0.218,0.004h0.226c4.917,0,8.53-2.699,9.909-7.422 c0.916-3.109,1.57-6.029,2.215-8.986c0.562-2.564,1.46-6.674,2.296-8.281c16.558-2.6,29.249-5.91,37.739-9.852 c6.931-3.215,11.199-6.873,13.053-11.166c0.556-1.287,0.881-2.621,0.954-3.979c0.261-4.607-2.999-8.676-7.56-9.424 c-51.585-8.502-74.824-61.506-75.785-63.758c-0.062-0.148-0.132-0.295-0.205-0.438c-2.637-5.354-3.246-9.777-1.816-13.148 c2.814-6.631,13.621-10.062,20.771-12.332c2.07-0.652,4.021-1.272,5.646-1.914c7.039-2.78,12.07-5.796,15.389-9.221 c3.964-4.083,4.736-7.995,4.688-10.555c-0.121-6.194-4.856-11.698-12.388-14.393c-2.544-1.052-5.445-1.607-8.399-1.607 c-2.011,0-4.989,0.276-7.808,1.592c-6.035,2.824-11.441,4.368-16.082,4.588c-2.468-0.125-4.199-0.66-5.32-1.171 c0.141-2.416,0.297-4.898,0.458-7.486l0.067-1.108c1.653-26.19,3.707-58.784-4.92-78.134c-5.913-13.253-13.853-24.651-23.604-33.892 c-8.178-7.744-17.678-14.021-28.242-18.661C434.052,116.402,416.914,115.197,408.336,115.197"/><rect x="147.553" y="39.443" style="fill:none;" width="514.231" height="514.23"/></svg>`
 };
 
+const PRIVACY_NONE = { ip: false, userAgent: false, language: false, screen: false, timezone: false, hardware: false };
+const PRIVACY_FULL = { ip: true, userAgent: true, language: true, screen: true, timezone: true, hardware: true };
+const PRIVACY_HEATMAP = { ip: true, userAgent: false, language: true, screen: false, timezone: false, hardware: true };
+const PRIVACY_IP_ONLY = { ip: true, userAgent: false, language: false, screen: false, timezone: false, hardware: false };
+const FATHOM_SELF_HOSTED_RE = /\.src\.indexOf\("cdn\.usefathom\.com"\)\s*<\s*0/;
+const RYBBIT_HOST_SPLIT_RE = /\w+\.split\(["']\/script\.js["']\)\[0\]/g;
+const CAP_FULL_PT = { bundle: true, reverseProxyIntercept: true, partytown: true };
+const CAP_FULL = { bundle: true, reverseProxyIntercept: true };
+const CAP_BUNDLE_PT = { bundle: true, partytown: true };
+const CAP_BUNDLE = { bundle: true };
+const CAP_PROXY = { reverseProxyIntercept: true };
+const DEF_FULL = { bundle: true, reverseProxyIntercept: true };
+const DEF_BUNDLE = { bundle: true };
+const DEF_PROXY = { reverseProxyIntercept: true };
 async function registry(resolve) {
   resolve = resolve || ((s) => Promise.resolve(s));
   return [
@@ -63,6 +77,11 @@ async function registry(resolve) {
       registryKey: "plausibleAnalytics",
       label: "Plausible Analytics",
       category: "analytics",
+      capabilities: CAP_FULL_PT,
+      defaultCapability: DEF_FULL,
+      domains: ["plausible.io"],
+      privacy: PRIVACY_NONE,
+      autoInject: { configField: "endpoint", computeValue: (proxyPrefix) => `${proxyPrefix}/plausible.io/api/event` },
       scriptBundling: (options) => {
         if (options?.scriptId)
           return `https://plausible.io/js/pa-${options.scriptId}.js`;
@@ -80,6 +99,10 @@ async function registry(resolve) {
       label: "Cloudflare Web Analytics",
       src: "https://static.cloudflareinsights.com/beacon.min.js",
       category: "analytics",
+      capabilities: CAP_FULL_PT,
+      defaultCapability: DEF_FULL,
+      domains: ["static.cloudflareinsights.com", "cloudflareinsights.com"],
+      privacy: PRIVACY_NONE,
       logo: LOGOS.cloudflareWebAnalytics,
       import: {
         name: "useScriptCloudflareWebAnalytics",
@@ -91,6 +114,10 @@ async function registry(resolve) {
       label: "Vercel Analytics",
       src: "https://va.vercel-scripts.com/v1/script.js",
       category: "analytics",
+      capabilities: CAP_FULL,
+      defaultCapability: DEF_FULL,
+      domains: ["va.vercel-scripts.com"],
+      privacy: PRIVACY_NONE,
       logo: LOGOS.vercelAnalytics,
       import: {
         name: "useScriptVercelAnalytics",
@@ -102,6 +129,18 @@ async function registry(resolve) {
       label: "PostHog",
       src: false,
       scriptBundling: false,
+      capabilities: CAP_PROXY,
+      defaultCapability: DEF_PROXY,
+      domains: ["us-assets.i.posthog.com", "us.i.posthog.com", "eu-assets.i.posthog.com", "eu.i.posthog.com"],
+      privacy: PRIVACY_NONE,
+      autoInject: {
+        configField: "apiHost",
+        computeValue: (proxyPrefix, config) => {
+          const region = config.region || "us";
+          const host = region === "eu" ? "eu.i.posthog.com" : "us.i.posthog.com";
+          return `${proxyPrefix}/${host}`;
+        }
+      },
       category: "analytics",
       logo: LOGOS.posthog,
       import: {
@@ -114,6 +153,13 @@ async function registry(resolve) {
       label: "Fathom Analytics",
       src: "https://cdn.usefathom.com/script.js",
       category: "analytics",
+      capabilities: CAP_FULL_PT,
+      defaultCapability: DEF_FULL,
+      domains: ["cdn.usefathom.com"],
+      privacy: PRIVACY_NONE,
+      postProcess(output) {
+        return output.replace(FATHOM_SELF_HOSTED_RE, '.src.indexOf("cdn.usefathom.com")<-1');
+      },
       logo: LOGOS.fathomAnalytics,
       import: {
         name: "useScriptFathomAnalytics",
@@ -125,6 +171,10 @@ async function registry(resolve) {
       label: "Matomo Analytics",
       scriptBundling: false,
       // breaks script
+      capabilities: CAP_FULL_PT,
+      defaultCapability: DEF_FULL,
+      domains: ["cdn.matomo.cloud"],
+      privacy: PRIVACY_NONE,
       category: "analytics",
       logo: LOGOS.matomoAnalytics,
       import: {
@@ -135,6 +185,17 @@ async function registry(resolve) {
     {
       registryKey: "rybbitAnalytics",
       label: "Rybbit Analytics",
+      capabilities: CAP_FULL,
+      defaultCapability: DEF_FULL,
+      domains: ["app.rybbit.io"],
+      privacy: PRIVACY_NONE,
+      autoInject: { configField: "analyticsHost", computeValue: (proxyPrefix) => `${proxyPrefix}/app.rybbit.io/api` },
+      postProcess(output, rewrites) {
+        const rybbitRewrite = rewrites.find((r) => r.from === "app.rybbit.io");
+        if (rybbitRewrite)
+          output = output.replace(RYBBIT_HOST_SPLIT_RE, `self.location.origin+"${rybbitRewrite.to}/api"`);
+        return output;
+      },
       scriptBundling: (options) => {
         const host = options?.analyticsHost;
         if (host && !host.startsWith("/"))
@@ -151,6 +212,11 @@ async function registry(resolve) {
     {
       registryKey: "databuddyAnalytics",
       label: "Databuddy Analytics",
+      capabilities: CAP_FULL,
+      defaultCapability: DEF_FULL,
+      domains: ["cdn.databuddy.cc", "basket.databuddy.cc"],
+      privacy: PRIVACY_NONE,
+      autoInject: { configField: "apiUrl", computeValue: (proxyPrefix) => `${proxyPrefix}/basket.databuddy.cc` },
       scriptBundling: () => "https://cdn.databuddy.cc/databuddy.js",
       category: "analytics",
       logo: LOGOS.databuddyAnalytics,
@@ -162,6 +228,9 @@ async function registry(resolve) {
     {
       registryKey: "segment",
       label: "Segment",
+      capabilities: CAP_BUNDLE_PT,
+      // reverseProxyIntercept fails: SDK constructs API URLs dynamically
+      defaultCapability: DEF_BUNDLE,
       scriptBundling: (options) => {
         return joinURL("https://cdn.segment.com/analytics.js/v1", options?.writeKey || "", "analytics.min.js");
       },
@@ -175,6 +244,8 @@ async function registry(resolve) {
     {
       registryKey: "mixpanelAnalytics",
       label: "Mixpanel",
+      capabilities: CAP_BUNDLE_PT,
+      defaultCapability: DEF_BUNDLE,
       scriptBundling: (options) => {
         if (!options?.token)
           return false;
@@ -191,6 +262,8 @@ async function registry(resolve) {
       registryKey: "bingUet",
       label: "Bing UET",
       src: "https://bat.bing.com/bat.js",
+      capabilities: CAP_BUNDLE_PT,
+      defaultCapability: DEF_BUNDLE,
       category: "ad",
       logo: LOGOS.bingUet,
       import: {
@@ -203,6 +276,10 @@ async function registry(resolve) {
       label: "Meta Pixel",
       src: "https://connect.facebook.net/en_US/fbevents.js",
       category: "ad",
+      capabilities: CAP_FULL_PT,
+      defaultCapability: DEF_FULL,
+      domains: ["connect.facebook.net", "www.facebook.com", "facebook.com", "pixel.facebook.com"],
+      privacy: PRIVACY_FULL,
       logo: LOGOS.metaPixel,
       import: {
         name: "useScriptMetaPixel",
@@ -214,6 +291,10 @@ async function registry(resolve) {
       label: "X Pixel",
       src: "https://static.ads-twitter.com/uwt.js",
       category: "ad",
+      capabilities: CAP_FULL_PT,
+      defaultCapability: DEF_FULL,
+      domains: ["analytics.twitter.com", "static.ads-twitter.com", "t.co"],
+      privacy: PRIVACY_FULL,
       logo: LOGOS.xPixel,
       import: {
         name: "useScriptXPixel",
@@ -224,6 +305,10 @@ async function registry(resolve) {
       registryKey: "tiktokPixel",
       label: "TikTok Pixel",
       category: "ad",
+      capabilities: CAP_FULL_PT,
+      defaultCapability: DEF_FULL,
+      domains: ["analytics.tiktok.com"],
+      privacy: PRIVACY_FULL,
       logo: LOGOS.tiktokPixel,
       import: {
         name: "useScriptTikTokPixel",
@@ -240,6 +325,10 @@ async function registry(resolve) {
       label: "Snapchat Pixel",
       src: "https://sc-static.net/scevent.min.js",
       category: "ad",
+      capabilities: CAP_FULL_PT,
+      defaultCapability: DEF_FULL,
+      domains: ["sc-static.net", "tr.snapchat.com", "pixel.tapad.com"],
+      privacy: PRIVACY_FULL,
       logo: LOGOS.snapchatPixel,
       import: {
         name: "useScriptSnapchatPixel",
@@ -251,6 +340,10 @@ async function registry(resolve) {
       label: "Reddit Pixel",
       src: "https://www.redditstatic.com/ads/pixel.js",
       category: "ad",
+      capabilities: CAP_FULL_PT,
+      defaultCapability: DEF_FULL,
+      domains: ["www.redditstatic.com", "alb.reddit.com", "pixel-config.reddit.com"],
+      privacy: PRIVACY_FULL,
       logo: LOGOS.redditPixel,
       import: {
         name: "useScriptRedditPixel",
@@ -261,7 +354,10 @@ async function registry(resolve) {
     {
       registryKey: "googleAdsense",
       label: "Google Adsense",
-      proxy: "googleAnalytics",
+      capabilities: CAP_FULL,
+      defaultCapability: DEF_FULL,
+      proxyConfig: "googleAnalytics",
+      // shares GA's domains/privacy
       scriptBundling: (options) => {
         if (!options?.client) {
           return false;
@@ -281,6 +377,10 @@ async function registry(resolve) {
       registryKey: "carbonAds",
       label: "Carbon Ads",
       scriptBundling: false,
+      capabilities: CAP_FULL,
+      defaultCapability: DEF_FULL,
+      domains: ["cdn.carbonads.com"],
+      privacy: PRIVACY_NONE,
       category: "ad",
       logo: LOGOS.carbonAds
     },
@@ -288,6 +388,10 @@ async function registry(resolve) {
     {
       registryKey: "intercom",
       label: "Intercom",
+      capabilities: CAP_FULL,
+      defaultCapability: DEF_FULL,
+      domains: ["widget.intercom.io", "api-iam.intercom.io", "api-iam.eu.intercom.io", "api-iam.au.intercom.io", "js.intercomcdn.com", "downloads.intercomcdn.com", "video-messages.intercomcdn.com"],
+      privacy: PRIVACY_IP_ONLY,
       scriptBundling(options) {
         if (!options?.app_id) {
           return false;
@@ -304,6 +408,10 @@ async function registry(resolve) {
     {
       registryKey: "hotjar",
       label: "Hotjar",
+      capabilities: CAP_FULL,
+      defaultCapability: DEF_FULL,
+      domains: ["static.hotjar.com", "script.hotjar.com", "vars.hotjar.com", "in.hotjar.com", "vc.hotjar.com", "vc.hotjar.io", "metrics.hotjar.io", "insights.hotjar.com", "ask.hotjar.io", "events.hotjar.io", "identify.hotjar.com", "surveystats.hotjar.io"],
+      privacy: PRIVACY_HEATMAP,
       scriptBundling(options) {
         if (!options?.id) {
           return false;
@@ -322,6 +430,10 @@ async function registry(resolve) {
     {
       registryKey: "clarity",
       label: "Clarity",
+      capabilities: CAP_FULL_PT,
+      defaultCapability: DEF_FULL,
+      domains: ["www.clarity.ms", "scripts.clarity.ms", "d.clarity.ms", "e.clarity.ms", "k.clarity.ms"],
+      privacy: PRIVACY_HEATMAP,
       scriptBundling(options) {
         if (!options?.id) {
           return false;
@@ -341,7 +453,6 @@ async function registry(resolve) {
       label: "Stripe",
       scriptBundling: false,
       // needs fingerprinting for fraud detection
-      proxy: false,
       category: "payments",
       logo: LOGOS.stripe,
       import: {
@@ -354,6 +465,10 @@ async function registry(resolve) {
       label: "Lemon Squeezy",
       src: false,
       // should not be bundled
+      capabilities: CAP_FULL,
+      defaultCapability: DEF_FULL,
+      domains: ["assets.lemonsqueezy.com"],
+      privacy: PRIVACY_NONE,
       category: "payments",
       logo: LOGOS.lemonSqueezy,
       import: {
@@ -366,7 +481,6 @@ async function registry(resolve) {
       label: "PayPal",
       src: false,
       // needs fingerprinting for fraud detection
-      proxy: false,
       category: "payments",
       logo: LOGOS.paypal,
       import: {
@@ -378,6 +492,10 @@ async function registry(resolve) {
     {
       registryKey: "vimeoPlayer",
       label: "Vimeo Player",
+      capabilities: CAP_FULL,
+      defaultCapability: DEF_FULL,
+      domains: ["player.vimeo.com"],
+      privacy: PRIVACY_IP_ONLY,
       category: "video",
       logo: LOGOS.vimeoPlayer,
       import: {
@@ -388,6 +506,10 @@ async function registry(resolve) {
     {
       registryKey: "youtubePlayer",
       label: "YouTube Player",
+      capabilities: CAP_FULL,
+      defaultCapability: DEF_FULL,
+      domains: ["www.youtube.com"],
+      privacy: PRIVACY_IP_ONLY,
       category: "video",
       logo: LOGOS.youtubePlayer,
       import: {
@@ -444,6 +566,9 @@ async function registry(resolve) {
     {
       registryKey: "crisp",
       label: "Crisp",
+      capabilities: CAP_BUNDLE,
+      // reverseProxyIntercept fails: SDK loads secondary scripts at runtime
+      defaultCapability: DEF_BUNDLE,
       category: "support",
       logo: LOGOS.crisp,
       import: {
@@ -471,7 +596,6 @@ async function registry(resolve) {
       label: "Google reCAPTCHA",
       scriptBundling: false,
       // needs fingerprinting for bot detection
-      proxy: false,
       category: "utility",
       logo: LOGOS.googleRecaptcha,
       import: {
@@ -485,7 +609,6 @@ async function registry(resolve) {
       src: "https://accounts.google.com/gsi/client",
       scriptBundling: false,
       // CORS prevents bundling, needs fingerprinting for auth
-      proxy: false,
       category: "utility",
       logo: LOGOS.googleSignIn,
       import: {
@@ -496,6 +619,9 @@ async function registry(resolve) {
     {
       registryKey: "googleTagManager",
       label: "Google Tag Manager",
+      capabilities: CAP_BUNDLE,
+      // reverseProxyIntercept fails: GTM dynamically loads scripts at runtime
+      defaultCapability: DEF_BUNDLE,
       category: "tag-manager",
       import: {
         name: "useScriptGoogleTagManager",
@@ -523,6 +649,10 @@ async function registry(resolve) {
     {
       registryKey: "googleAnalytics",
       label: "Google Analytics",
+      capabilities: CAP_FULL_PT,
+      defaultCapability: DEF_FULL,
+      domains: ["www.google-analytics.com", "analytics.google.com", "stats.g.doubleclick.net", "pagead2.googlesyndication.com", "www.googleadservices.com", "googleads.g.doubleclick.net"],
+      privacy: PRIVACY_HEATMAP,
       category: "analytics",
       import: {
         name: "useScriptGoogleAnalytics",
@@ -539,6 +669,11 @@ async function registry(resolve) {
     {
       registryKey: "umamiAnalytics",
       label: "Umami Analytics",
+      capabilities: CAP_FULL_PT,
+      defaultCapability: DEF_FULL,
+      domains: ["cloud.umami.is", "api-gateway.umami.dev"],
+      privacy: PRIVACY_NONE,
+      autoInject: { configField: "hostUrl", computeValue: (proxyPrefix) => `${proxyPrefix}/cloud.umami.is` },
       scriptBundling: () => "https://cloud.umami.is/script.js",
       category: "analytics",
       logo: LOGOS.umamiAnalytics,
@@ -551,6 +686,10 @@ async function registry(resolve) {
       registryKey: "gravatar",
       label: "Gravatar",
       src: "https://secure.gravatar.com/js/gprofiles.js",
+      capabilities: CAP_FULL,
+      defaultCapability: DEF_FULL,
+      domains: ["secure.gravatar.com", "gravatar.com"],
+      privacy: PRIVACY_IP_ONLY,
       category: "utility",
       logo: LOGOS.gravatar,
       import: {
@@ -564,4 +703,4 @@ async function registry(resolve) {
   ];
 }
 
-export { registry };
+export { PRIVACY_FULL, PRIVACY_HEATMAP, PRIVACY_IP_ONLY, PRIVACY_NONE, registry };

package/dist/runtime/registry/gravatar.d.ts

@@ -5,7 +5,7 @@ export type GravatarInput = RegistryScriptInput<typeof GravatarOptions>;
 export interface GravatarApi {
     /**
      * Get a proxied avatar URL for a given SHA256 email hash.
-     * When firstParty mode is enabled, this routes through your server.
+     * When proxy mode is enabled, this routes through your server.
      */
     getAvatarUrl: (hash: string, options?: {
         size?: number;

package/dist/runtime/server/proxy-handler.js

@@ -250,7 +250,6 @@ export default defineEventHandler(async (event) => {
       duplex: passthroughBody ? "half" : void 0
     });
   } catch (err) {
-    clearTimeout(timeoutId);
     log("[proxy] Upstream error:", err);
     throw createError({
       statusCode: 502,

package/dist/runtime/server/utils/privacy.d.ts

@@ -129,12 +129,4 @@ export declare function generalizeTimezone(value: unknown): string | number;
  * (timezone, language, screen dimensions) while keeping low-entropy values.
  */
 export declare function anonymizeDeviceInfo(value: string): string;
-/**
- * Recursively anonymize fingerprinting data in payload.
- * Fields are generalized or normalized rather than stripped, so endpoints
- * still receive valid data with reduced fingerprinting precision.
- *
- * When `privacy` is provided, only categories with their flag set to `true` are processed.
- * Default (no arg) = all categories active, so existing callers work unchanged.
- */
 export declare function stripPayloadFingerprinting(payload: Record<string, unknown>, privacy?: ResolvedProxyPrivacy): Record<string, unknown>;

package/dist/runtime/server/utils/privacy.js

@@ -232,6 +232,13 @@ export function anonymizeDeviceInfo(value) {
   }
   return result.join(sep);
 }
+function matchesParam(key, params) {
+  const lk = key.toLowerCase();
+  return params.some((pm) => {
+    const lp = pm.toLowerCase();
+    return lk === lp || lk.startsWith(`${lp}[`);
+  });
+}
 export function stripPayloadFingerprinting(payload, privacy) {
   const p = privacy || FULL_PRIVACY;
   const result = {};
@@ -245,13 +252,6 @@ export function stripPayloadFingerprinting(payload, privacy) {
   }
   for (const [key, value] of Object.entries(payload)) {
     const lowerKey = key.toLowerCase();
-    const matchesParam = (key2, params) => {
-      const lk = key2.toLowerCase();
-      return params.some((pm) => {
-        const lp = pm.toLowerCase();
-        return lk === lp || lk.startsWith(`${lp}[`);
-      });
-    };
     const isLanguageParam = NORMALIZE_PARAMS.language.some((pm) => lowerKey === pm.toLowerCase());
     if (isLanguageParam) {
       if (Array.isArray(value)) {

package/dist/runtime/types.d.ts

@@ -66,16 +66,16 @@ export type NuxtUseScriptOptions<T extends Record<symbol | string, any> = {}> =
      *
      * Note: Using 'force' may significantly increase build time as scripts will be re-downloaded on every build.
      *
-     * @deprecated Use `scripts.firstParty: true` in nuxt.config instead for bundling and routing scripts through your domain.
+     * @deprecated Bundling is now auto-enabled per-script via capabilities. Set `bundle: false` per-script to disable.
      */
     bundle?: boolean | 'force';
     /**
-     * Opt-out of first-party routing for this specific script when global `scripts.firstParty` is enabled.
-     * Set to `false` to load this script directly from its original source instead of through your domain.
-     *
-     * Note: This option only works as an opt-out. To enable first-party routing, use the global `scripts.firstParty` option in nuxt.config.
+     * Control reverse proxy interception for this script.
+     * When `false`, collection requests go directly to the third-party server.
+     * When `true`, collection requests are proxied through `/_scripts/p/`.
+     * Defaults to the script's `defaultCapability.reverseProxyIntercept` from the registry.
      */
-    firstParty?: false;
+    reverseProxyIntercept?: boolean;
     /**
      * Load the script in a web worker using Partytown.
      * When enabled, adds `type="text/partytown"` to the script tag.
@@ -235,6 +235,36 @@ export interface RegistryScriptServerHandler {
     handler: string;
     middleware?: boolean;
 }
+/**
+ * Declares what optimization modes a script supports and what's active by default.
+ * Each flag is an independent capability that must be explicitly opted into.
+ */
+export interface ScriptCapabilities {
+    /** Script can be downloaded at build time and served from `/_scripts/assets/`. */
+    bundle?: boolean;
+    /**
+     * Collection requests can be proxied through `/_scripts/p/`.
+     * When combined with `bundle`: AST URL rewriting + runtime intercept.
+     * Without `bundle` (npm mode): autoInject sets SDK endpoint to proxy URL.
+     */
+    reverseProxyIntercept?: boolean;
+    /** Script can run in a web worker via Partytown. */
+    partytown?: boolean;
+}
+/**
+ * A third-party domain the script communicates with.
+ * Used for proxy routing, AST rewriting, and connection warming (dns-prefetch/preconnect).
+ */
+export interface ScriptDomain {
+    /** The domain hostname (e.g., 'www.google-analytics.com') */
+    domain: string;
+    /**
+     * Whether this domain is used lazily (e.g., only after user interaction or SDK initialization).
+     * When `true`, connection warming uses `dns-prefetch` instead of `preconnect`.
+     * @default false
+     */
+    lazy?: boolean;
+}
 export interface RegistryScript {
     /**
      * The config key used in `scripts.registry` in nuxt.config (e.g., 'googleAnalytics', 'plausibleAnalytics').
@@ -244,14 +274,42 @@ export interface RegistryScript {
     import?: Import;
     scriptBundling?: false | ((options?: any) => string | false);
     /**
-     * First-party proxy config alias. Only needed when a script shares another script's
-     * proxy config (e.g., googleAdsense uses `proxy: 'googleAnalytics'`).
-     *
-     * By default, the proxy config is looked up by `registryKey`. Set to `false` to
-     * explicitly disable first-party routing for this script.
-     * @internal
+     * What optimization modes this script supports (the ceiling).
+     * Each capability must be explicitly opted in. Omitted flags default to false.
+     */
+    capabilities?: ScriptCapabilities;
+    /**
+     * What capabilities are active by default for users (subset of capabilities).
+     * Users inherit these and can toggle individual flags via scriptOptions.
+     * Omitted flags are not active by default (e.g., partytown requires user opt-in).
+     */
+    defaultCapability?: ScriptCapabilities;
+    /**
+     * Third-party domains this script communicates with.
+     * Used for: proxy routing, AST URL rewriting, connection warming (dns-prefetch/preconnect).
+     * Domains marked `lazy: true` use dns-prefetch; others use preconnect for immediate scripts.
+     */
+    domains?: (string | ScriptDomain)[];
+    /**
+     * Privacy controls for proxied requests to this script's domains.
+     * Only relevant when reverseProxyIntercept capability is active.
+     */
+    privacy?: import('../runtime/server/utils/privacy').ProxyPrivacyInput;
+    /**
+     * Auto-inject proxy endpoint config into the script's SDK options.
+     * For scripts that let you configure the collection endpoint (PostHog, Plausible, etc.).
+     */
+    autoInject?: import('../first-party/types').ProxyAutoInject;
+    /**
+     * SDK-specific post-processing applied after AST URL rewriting.
+     * Used for regex patches that can't be handled by the generic AST rewriter.
+     */
+    postProcess?: (output: string, rewrites: import('../runtime/utils/pure').ProxyRewrite[]) => string;
+    /**
+     * Proxy config alias. When set, inherits domains/privacy/autoInject/postProcess
+     * from another script (e.g., googleAdsense → 'googleAnalytics').
      */
-    proxy?: RegistryScriptKey | false;
+    proxyConfig?: RegistryScriptKey;
     label?: string;
     src?: string | false;
     category?: string;

package/dist/shared/scripts.T4Z99VT8.mjs

@@ -0,0 +1,37 @@
+function buildProxyConfigsFromRegistry(scripts) {
+  const configs = {};
+  const scriptByKey = /* @__PURE__ */ new Map();
+  for (const script of scripts) {
+    if (script.registryKey)
+      scriptByKey.set(script.registryKey, script);
+  }
+  for (const script of scripts) {
+    if (!script.registryKey || !script.capabilities?.reverseProxyIntercept)
+      continue;
+    if (script.proxyConfig) {
+      const source = scriptByKey.get(script.proxyConfig);
+      if (source?.domains) {
+        const domains2 = source.domains.map((d) => typeof d === "string" ? d : d.domain);
+        configs[script.registryKey] = {
+          domains: domains2,
+          privacy: source.privacy || { ip: false, userAgent: false, language: false, screen: false, timezone: false, hardware: false },
+          autoInject: source.autoInject,
+          postProcess: source.postProcess
+        };
+      }
+      continue;
+    }
+    if (!script.domains?.length)
+      continue;
+    const domains = script.domains.map((d) => typeof d === "string" ? d : d.domain);
+    configs[script.registryKey] = {
+      domains,
+      privacy: script.privacy || { ip: false, userAgent: false, language: false, screen: false, timezone: false, hardware: false },
+      autoInject: script.autoInject,
+      postProcess: script.postProcess
+    };
+  }
+  return configs;
+}
+
+export { buildProxyConfigsFromRegistry as b };

package/dist/stats.mjs

@@ -1,4 +1,4 @@
-import { g as getAllProxyConfigs } from './shared/scripts.D7e2ENu6.mjs';
+import { b as buildProxyConfigsFromRegistry } from './shared/scripts.T4Z99VT8.mjs';
 
 const scriptMeta = {
   // Analytics
@@ -3798,13 +3798,13 @@ function deriveMetaKey(importName, label) {
 async function getScriptStats() {
   const { registry } = await import('./registry.mjs');
   const entries = await registry();
-  const proxyConfigs = getAllProxyConfigs();
+  const proxyConfigs = buildProxyConfigsFromRegistry(entries);
   const sizes = scriptSizes;
   return entries.map((entry) => {
     const id = entry.registryKey || deriveMetaKey(entry.import?.name, entry.label);
     const meta = id && id in scriptMeta ? scriptMeta[id] : void 0;
     const size = sizes[id || ""];
-    const proxyConfigKey = entry.proxy === false ? void 0 : entry.proxy || entry.registryKey;
+    const proxyConfigKey = !entry.capabilities?.reverseProxyIntercept ? void 0 : entry.proxyConfig || entry.registryKey;
     const proxyConfig = proxyConfigKey ? proxyConfigs[proxyConfigKey] : void 0;
     let loadingMethod = "cdn";
     if (entry.src === false)

package/dist/types-source.mjs

@@ -429,7 +429,7 @@ const types = {
 		{
 			name: "GravatarApi",
 			kind: "interface",
-			code: "export interface GravatarApi {\n  /**\n   * Get a proxied avatar URL for a given SHA256 email hash.\n   * When firstParty mode is enabled, this routes through your server.\n   */\n  getAvatarUrl: (hash: string, options?: { size?: number, default?: string, rating?: string }) => string\n  /**\n   * Get a proxied avatar URL using the server-side hashing endpoint.\n   * The email is sent to YOUR server (not Gravatar) for hashing.\n   * Only available when the gravatar proxy is enabled.\n   */\n  getAvatarUrlFromEmail: (email: string, options?: { size?: number, default?: string, rating?: string }) => string\n}"
+			code: "export interface GravatarApi {\n  /**\n   * Get a proxied avatar URL for a given SHA256 email hash.\n   * When proxy mode is enabled, this routes through your server.\n   */\n  getAvatarUrl: (hash: string, options?: { size?: number, default?: string, rating?: string }) => string\n  /**\n   * Get a proxied avatar URL using the server-side hashing endpoint.\n   * The email is sent to YOUR server (not Gravatar) for hashing.\n   * Only available when the gravatar proxy is enabled.\n   */\n  getAvatarUrlFromEmail: (email: string, options?: { size?: number, default?: string, rating?: string }) => string\n}"
 		}
 	],
 	hotjar: [

package/dist/types.d.mts

@@ -6,4 +6,4 @@ declare module '@nuxt/schema' {
 
 export { default } from './module.mjs'
 
-export { type FirstPartyOptions, type FirstPartyPrivacy, type ModuleHooks, type ModuleOptions } from './module.mjs'
+export { type FirstPartyPrivacy, type ModuleHooks, type ModuleOptions } from './module.mjs'

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@nuxt/scripts",
   "type": "module",
-  "version": "1.0.0-beta.31",
+  "version": "1.0.0-beta.32",
   "description": "Load third-party scripts with better performance, privacy and DX in Nuxt Apps.",
   "author": {
     "name": "Harlan Wilton",
@@ -144,7 +144,7 @@
     "vue": "^3.5.30",
     "vue-router": "^5.0.4",
     "vue-tsc": "^3.2.6",
-    "@nuxt/scripts": "1.0.0-beta.31"
+    "@nuxt/scripts": "1.0.0-beta.32"
   },
   "resolutions": {
     "@nuxt/scripts": "workspace:*"