@nuxt/scripts 1.0.0-rc.1 → 1.0.0-rc.10

package/dist/module.mjs

@@ -1,5 +1,6 @@
-import { existsSync, readdirSync, readFileSync } from 'node:fs';
-import { useNuxt, addDevServerHandler, extendRouteRules, tryUseNuxt, createResolver, extendViteConfig, logger as logger$1, useLogger, addTypeTemplate, defineNuxtModule, addPluginTemplate, addServerHandler, addImports, addComponentsDir, addTemplate, hasNuxtModule, addBuildPlugin } from '@nuxt/kit';
+import { createHash, randomBytes } from 'node:crypto';
+import { existsSync, readFileSync, appendFileSync, writeFileSync, readdirSync } from 'node:fs';
+import { useNuxt, addDevServerHandler, extendRouteRules, tryUseNuxt, createResolver, extendViteConfig, logger as logger$1, useLogger, addTypeTemplate, defineNuxtModule, addPluginTemplate, addServerHandler, addImports, addComponentsDir, addTemplate, hasNuxtModule, addBuildPlugin, addPlugin } from '@nuxt/kit';
 import { defu } from 'defu';
 import { join, resolve } from 'pathe';
 import { resolvePackageJSON, readPackageJSON } from 'pkg-types';
@@ -12,7 +13,6 @@ import { isCI, provider } from 'std-env';
 import { parseAndWalk, ScopeTracker, walk, ScopeTrackerFunction, ScopeTrackerIdentifier, ScopeTrackerFunctionParam, ScopeTrackerVariable } from 'oxc-walker';
 import { createUnplugin } from 'unplugin';
 import { pathToFileURL } from 'node:url';
-import { createHash } from 'node:crypto';
 import fsp from 'node:fs/promises';
 import { colors } from 'consola/utils';
 import MagicString from 'magic-string';
@@ -416,7 +416,8 @@ function NuxtScriptsCheckScripts() {
   });
 }
 
-function generateInterceptPluginContents(proxyPrefix) {
+function generateInterceptPluginContents(proxyPrefix, options) {
+  const testMode = options?.testMode ?? false;
   return `export default defineNuxtPlugin({
   name: 'nuxt-scripts:intercept',
   enforce: 'pre',
@@ -461,8 +462,14 @@ function generateInterceptPluginContents(proxyPrefix) {
       return img;
     }
 
-    globalThis.__nuxtScripts = {
-      sendBeacon: (url, data) => origBeacon(proxyUrl(url), data),
+    globalThis.__nuxtScripts = {${testMode ? `
+      // Test mode: replace sendBeacon with fetch for immediate, observable requests
+      sendBeacon: (url, data) => {
+        const proxied = proxyUrl(url);
+        origFetch(proxied, { method: 'POST', body: data, keepalive: true }).catch(() => {});
+        return true;
+      },` : `
+      sendBeacon: (url, data) => origBeacon(proxyUrl(url), data),`}
       fetch: (url, opts) => {
         if (typeof url === 'string') return origFetch(proxyUrl(url), opts);
         if (url instanceof Request) return origFetch(new Request(proxyUrl(url.url), url), opts);
@@ -908,6 +915,7 @@ function NuxtScriptBundleTransformer(options = {
               const node = _node;
               let scriptSrcNode;
               let src;
+              let registryConfig = {};
               let registryKey;
               if (fnName !== "useScript") {
                 const baseName = fnName.replace(USE_SCRIPT_RE, "");
@@ -930,7 +938,7 @@ function NuxtScriptBundleTransformer(options = {
                 const bundleResolve = getBundleResolve(registryNode);
                 if (!bundleResolve && !registryNode.src)
                   return;
-                const registryConfig = options.registryConfig?.[registryKey || ""] || {};
+                registryConfig = options.registryConfig?.[registryKey || ""] || {};
                 const fnArg0 = {};
                 if (node.arguments[0]?.type === "ObjectExpression") {
                   const optionsNode = node.arguments[0];
@@ -978,12 +986,14 @@ function NuxtScriptBundleTransformer(options = {
                   const registryScript = fnName !== "useScript" ? options.scripts?.find((s2) => s2.import.name === fnName) : void 0;
                   let canBundle = !!registryScript?.bundle;
                   let forceDownload = false;
+                  let explicitBundleInCall = false;
                   if (node.arguments[1]?.type === "ObjectExpression") {
                     const scriptOptionsArg = node.arguments[1];
                     const bundleProperty = scriptOptionsArg.properties.find(
                       (p) => (p.key?.name === "bundle" || p.key?.value === "bundle") && p.type === "Property"
                     );
                     if (bundleProperty && bundleProperty.value.type === "Literal") {
+                      explicitBundleInCall = true;
                       const bundleValue = bundleProperty.value.value;
                       if (bundleValue !== true && bundleValue !== "force" && String(bundleValue) !== "true") {
                         canBundle = false;
@@ -1008,10 +1018,16 @@ function NuxtScriptBundleTransformer(options = {
                     return prop.type === "Property" && prop.key?.name === "bundle" && prop.value.type === "Literal";
                   });
                   if (bundleOption) {
+                    explicitBundleInCall = true;
                     const bundleValue = bundleOption.value.value;
                     canBundle = bundleValue === true || bundleValue === "force" || String(bundleValue) === "true";
                     forceDownload = bundleValue === "force";
                   }
+                  if (!explicitBundleInCall && registryConfig?.scriptOptions?.bundle !== void 0) {
+                    const bundleValue = registryConfig.scriptOptions.bundle;
+                    canBundle = bundleValue === true || bundleValue === "force" || String(bundleValue) === "true";
+                    forceDownload = bundleValue === "force";
+                  }
                   const rpiOption = scriptOptions?.value.properties?.find((prop) => {
                     return prop.type === "Property" && prop.key?.name === "proxy" && prop.value.type === "Literal";
                   });
@@ -1214,14 +1230,15 @@ function templatePlugin(config, registry) {
   for (const [k, c] of Object.entries(config.registry || {})) {
     if (c === false)
       continue;
-    const [, scriptOptions] = c;
+    const entry = c;
+    const [, scriptOptions] = entry;
     if (!scriptOptions?.trigger)
       continue;
     const importDefinition = registry.find((i) => i.import.name.toLowerCase() === `usescript${k.toLowerCase()}`);
     if (importDefinition) {
       resolvedRegistryKeys.push(k);
       imports.unshift(`import { ${importDefinition.import.name} } from '${importDefinition.import.from}'`);
-      const [input] = c;
+      const [input] = entry;
       const opts = { ...scriptOptions };
       const triggerResolved = resolveTriggerForTemplate(opts.trigger);
       if (triggerResolved) {
@@ -1356,6 +1373,42 @@ function fixSelfClosingScriptComponents(nuxt) {
 }
 const UPPER_RE = /([A-Z])/g;
 const toScreamingSnake = (s) => s.replace(UPPER_RE, "_$1").toUpperCase();
+const PROXY_SECRET_ENV_KEY = "NUXT_SCRIPTS_PROXY_SECRET";
+const PROXY_SECRET_ENV_LINE_RE = /^NUXT_SCRIPTS_PROXY_SECRET=/m;
+const PROXY_SECRET_ENV_VALUE_RE = /^NUXT_SCRIPTS_PROXY_SECRET=(.+)$/m;
+function resolveProxySecret(rootDir, isDev, configSecret, autoGenerate = true) {
+  if (configSecret)
+    return { secret: configSecret, ephemeral: false, source: "config" };
+  const envSecret = process.env[PROXY_SECRET_ENV_KEY];
+  if (envSecret)
+    return { secret: envSecret, ephemeral: false, source: "env" };
+  if (!isDev || !autoGenerate)
+    return void 0;
+  const secret = randomBytes(32).toString("hex");
+  const envPath = resolve(rootDir, ".env");
+  const line = `${PROXY_SECRET_ENV_KEY}=${secret}
+`;
+  try {
+    if (existsSync(envPath)) {
+      const contents = readFileSync(envPath, "utf-8");
+      if (PROXY_SECRET_ENV_LINE_RE.test(contents)) {
+        const match = contents.match(PROXY_SECRET_ENV_VALUE_RE);
+        if (match?.[1])
+          return { secret: match[1].trim(), ephemeral: false, source: "dotenv-generated" };
+      }
+      appendFileSync(envPath, contents.endsWith("\n") ? line : `
+${line}`);
+    } else {
+      writeFileSync(envPath, `# Generated by @nuxt/scripts
+${line}`);
+    }
+    process.env[PROXY_SECRET_ENV_KEY] = secret;
+    return { secret, ephemeral: false, source: "dotenv-generated" };
+  } catch {
+    process.env[PROXY_SECRET_ENV_KEY] = secret;
+    return { secret, ephemeral: true, source: "memory-generated" };
+  }
+}
 function isProxyDisabled(registryKey, registry2, runtimeConfig) {
   const entry = registry2?.[registryKey];
   if (!entry)
@@ -1451,17 +1504,23 @@ const module$1 = defineNuxtModule({
         if (entry === false)
           continue;
         const input = entry[0];
+        const scriptOptions = entry[1];
         const envDefaults = scripts.find((s) => s.registryKey === key)?.envDefaults;
+        const base = {};
         if (!envDefaults || !Object.keys(envDefaults).length) {
-          registryWithDefaults[key] = input;
-          continue;
+          Object.assign(base, input);
+        } else {
+          const envResolved = {};
+          for (const [field, defaultValue] of Object.entries(envDefaults)) {
+            const envKey = `NUXT_PUBLIC_SCRIPTS_${toScreamingSnake(key)}_${toScreamingSnake(field)}`;
+            envResolved[field] = process.env[envKey] || defaultValue;
+          }
+          Object.assign(base, defu(input, envResolved));
         }
-        const envResolved = {};
-        for (const [field, defaultValue] of Object.entries(envDefaults)) {
-          const envKey = `NUXT_PUBLIC_SCRIPTS_${toScreamingSnake(key)}_${toScreamingSnake(field)}`;
-          envResolved[field] = process.env[envKey] || defaultValue;
+        if (scriptOptions && Object.keys(scriptOptions).length > 0) {
+          base.scriptOptions = scriptOptions;
         }
-        registryWithDefaults[key] = defu(input, envResolved);
+        registryWithDefaults[key] = base;
       }
       nuxt.options.runtimeConfig.public.scripts = defu(
         nuxt.options.runtimeConfig.public.scripts || {},
@@ -1491,6 +1550,8 @@ const module$1 = defineNuxtModule({
     const composables = [
       "useScript",
       "useScriptEventPage",
+      "useScriptProxyToken",
+      "useScriptProxyUrl",
       "useScriptTriggerConsent",
       "useScriptTriggerElement",
       "useScriptTriggerIdleTimeout",
@@ -1533,10 +1594,23 @@ const module$1 = defineNuxtModule({
         const script = scripts.find((s) => s.registryKey === key);
         if (!script?.schema)
           continue;
-        const requiredFields = extractRequiredFields(script.schema);
-        const missing = requiredFields.filter((f) => !input[f]);
-        if (missing.length) {
-          logger.warn(`[nuxt-scripts] registry.${key}: missing required field${missing.length > 1 ? "s" : ""} ${missing.map((f) => `'${f}'`).join(", ")}. The script infrastructure is registered but will not function without ${missing.length > 1 ? "them" : "it"}.`);
+        const isComponentOnly = !script.import;
+        if (isComponentOnly) {
+          if (scriptOptions && "trigger" in scriptOptions && scriptOptions.trigger !== false) {
+            const pascal = key.charAt(0).toUpperCase() + key.slice(1);
+            logger.warn(
+              `[nuxt-scripts] registry.${key}: \`trigger\` has no effect on component-only scripts. Render <Script${pascal}> in your template to load the embed.`
+            );
+          }
+          continue;
+        }
+        const willAutoLoad = scriptOptions && "trigger" in scriptOptions && scriptOptions.trigger !== false;
+        if (willAutoLoad) {
+          const requiredFields = extractRequiredFields(script.schema);
+          const missing = requiredFields.filter((f) => !input[f]);
+          if (missing.length) {
+            logger.warn(`[nuxt-scripts] registry.${key}: missing required field${missing.length > 1 ? "s" : ""} ${missing.map((f) => `'${f}'`).join(", ")}. The script infrastructure is registered but will not function without ${missing.length > 1 ? "them" : "it"}.`);
+          }
         }
         const envDefaultKeys = new Set(Object.keys(script.envDefaults || {}));
         const userProvidedFields = Object.keys(input).filter((f) => !envDefaultKeys.has(f));
@@ -1649,7 +1723,7 @@ They will load directly from third-party servers.`
         addPluginTemplate({
           filename: "nuxt-scripts-intercept.client.mjs",
           getContents() {
-            return generateInterceptPluginContents(proxyPrefix);
+            return generateInterceptPluginContents(proxyPrefix, { testMode: !!nuxt.options.test });
           }
         });
         nuxt.options.runtimeConfig["nuxt-scripts-proxy"] = {
@@ -1661,12 +1735,12 @@ They will load directly from third-party servers.`
         if (totalDomains > 0 && nuxt.options.dev) {
           logger.success(`Proxy mode enabled for ${registryKeys.length} script(s), ${totalDomains} domain(s) proxied (privacy: ${privacyLabel})`);
         }
-        const staticPresets = ["static", "github-pages", "cloudflare-pages-static", "netlify-static", "azure-static", "firebase-static"];
-        const preset = process.env.NITRO_PRESET || "";
-        if (staticPresets.includes(preset)) {
+        const proxyStaticPresets = ["static", "github-pages", "cloudflare-pages-static", "netlify-static", "azure-static", "firebase-static"];
+        const proxyPreset = process.env.NITRO_PRESET || "";
+        if (proxyStaticPresets.includes(proxyPreset)) {
           logger.warn(
-            `Proxy collection endpoints require a server runtime (detected: ${preset || "static"}).
-Scripts will be bundled, but collection requests will not be proxied.
+            `Proxy collection endpoints require a server runtime (detected: ${proxyPreset || "static"}).
+Scripts will be bundled, but collection requests will not be proxied and URL signing will be unavailable.
 Options: configure platform rewrites, switch to server-rendered mode, or disable with proxy: false.`
           );
         }
@@ -1713,6 +1787,7 @@ Options: configure platform rewrites, switch to server-rendered mode, or disable
     });
     const scriptsPrefix = config.prefix || "/_scripts";
     const enabledEndpoints = {};
+    let anyHandlerRequiresSigning = false;
     for (const script of scripts) {
       if (!script.serverHandlers?.length || !script.registryKey)
         continue;
@@ -1721,11 +1796,14 @@ Options: configure platform rewrites, switch to server-rendered mode, or disable
         continue;
       enabledEndpoints[script.registryKey] = true;
       for (const handler of script.serverHandlers) {
+        const resolvedRoute = handler.route.replace("/_scripts", scriptsPrefix);
         addServerHandler({
-          route: handler.route.replace("/_scripts", scriptsPrefix),
+          route: resolvedRoute,
           handler: handler.handler,
           middleware: handler.middleware
         });
+        if (handler.requiresSigning)
+          anyHandlerRequiresSigning = true;
       }
       if (script.registryKey === "gravatar") {
         const gravatarConfig = config.registry?.gravatar?.[0] || {};
@@ -1745,7 +1823,45 @@ Options: configure platform rewrites, switch to server-rendered mode, or disable
       { endpoints: enabledEndpoints },
       nuxt.options.runtimeConfig.public["nuxt-scripts"]
     );
+    const staticPresets = ["static", "github-pages", "cloudflare-pages-static", "netlify-static", "azure-static", "firebase-static"];
+    const nitroPreset = process.env.NITRO_PRESET || "";
+    const isStaticTarget = staticPresets.includes(nitroPreset);
+    const isSpa = nuxt.options.ssr === false;
+    if (anyHandlerRequiresSigning && (isSpa || isStaticTarget)) {
+      logger.warn(
+        `[security] URL signing requires a server runtime${isStaticTarget ? ` (detected preset: ${nitroPreset})` : " (ssr: false)"}.
+  Proxy endpoints will work without signature verification.
+  To enable signing, deploy with a server-rendered target or configure platform-level rewrites.`
+      );
+    } else if (anyHandlerRequiresSigning) {
+      const proxySecretResolved = resolveProxySecret(
+        nuxt.options.rootDir,
+        !!nuxt.options.dev,
+        config.security?.secret,
+        config.security?.autoGenerateSecret !== false
+      );
+      if (proxySecretResolved?.source === "dotenv-generated")
+        logger.info(`[security] Generated ${PROXY_SECRET_ENV_KEY} in .env for signed proxy URLs.`);
+      else if (proxySecretResolved?.source === "memory-generated")
+        logger.warn(`[security] Generated an in-memory ${PROXY_SECRET_ENV_KEY} (could not write .env). Signed URLs will break across restarts.`);
+      if (proxySecretResolved?.secret) {
+        const scriptsRuntime = nuxt.options.runtimeConfig["nuxt-scripts"];
+        scriptsRuntime.proxySecret = proxySecretResolved.secret;
+        if (config.security?.pageTokenMaxAge !== void 0)
+          scriptsRuntime.pageTokenMaxAge = config.security.pageTokenMaxAge;
+        addPlugin({
+          src: await resolvePath("./runtime/plugins/proxy-token.server"),
+          mode: "server"
+        });
+      } else if (!nuxt.options.dev) {
+        logger.warn(
+          `[security] ${PROXY_SECRET_ENV_KEY} is not set. Proxy endpoints will pass requests through without signature verification.
+  Generate one with: npx @nuxt/scripts generate-secret
+  Then set the env var: ${PROXY_SECRET_ENV_KEY}=<secret>`
+        );
+      }
+    }
   }
 });
 
-export { applyAutoInject, module$1 as default, isProxyDisabled };
+export { applyAutoInject, module$1 as default, isProxyDisabled, resolveProxySecret };

package/dist/registry.d.mts

@@ -1,5 +1,6 @@
 import { ProxyPrivacyInput } from '../dist/runtime/server/utils/privacy.js';
 import { ScriptCapabilities, RegistryScript, RegistryScriptKey, ProxyConfig, ProxyCapability, ProxyAutoInject, ResolvedProxyAutoInject } from '../dist/runtime/types.js';
+export { ScriptCapabilities } from '../dist/runtime/types.js';
 
 interface RegistryScriptMeta {
     /** Registry key (e.g. 'plausibleAnalytics') */

package/dist/registry.d.ts

@@ -1,5 +1,6 @@
 import { ProxyPrivacyInput } from '../dist/runtime/server/utils/privacy.js';
 import { ScriptCapabilities, RegistryScript, RegistryScriptKey, ProxyConfig, ProxyCapability, ProxyAutoInject, ResolvedProxyAutoInject } from '../dist/runtime/types.js';
+export { ScriptCapabilities } from '../dist/runtime/types.js';
 
 interface RegistryScriptMeta {
     /** Registry key (e.g. 'plausibleAnalytics') */

package/dist/registry.mjs

@@ -126,7 +126,7 @@ const registryMeta = [
   m("intercom", "Intercom", "support", "useScriptIntercom", { bundle: true, proxy: true }, PRIVACY_IP_ONLY),
   m("crisp", "Crisp", "support", "useScriptCrisp", { bundle: true }, null),
   // cdn
-  m("npm", "NPM", "cdn", "useScriptNpm", {}, null),
+  m("npm", "NPM", "cdn", "useScriptNpm", { bundle: true }, null),
   // utility
   m("googleRecaptcha", "Google reCAPTCHA", "utility", "useScriptGoogleRecaptcha", {}, null),
   m("googleSignIn", "Google Sign-In", "utility", "useScriptGoogleSignIn", {}, null),
@@ -346,7 +346,7 @@ async function registry(resolve) {
           return "https://cdn.mxpnl.com/libs/mixpanel-2-latest.min.js";
         }
       },
-      partytown: { forwards: ["mixpanel", "mixpanel.init", "mixpanel.track", "mixpanel.identify", "mixpanel.people.set", "mixpanel.reset", "mixpanel.register"] }
+      partytown: { forwards: ["mixpanel", "mixpanel.init", "mixpanel.track", "mixpanel.identify", "mixpanel.people.set", "mixpanel.reset", "mixpanel.register", "mixpanel.opt_in_tracking", "mixpanel.opt_out_tracking"] }
     }),
     // ad
     def("bingUet", {
@@ -401,7 +401,7 @@ async function registry(resolve) {
         domains: ["analytics.tiktok.com", "mon.tiktok.com", "mcs.tiktok.com"],
         privacy: PRIVACY_FULL
       },
-      partytown: { forwards: ["ttq.track", "ttq.page", "ttq.identify"] }
+      partytown: { forwards: ["ttq.track", "ttq.page", "ttq.identify", "ttq.grantConsent", "ttq.revokeConsent", "ttq.holdConsent"] }
     }),
     def("snapchatPixel", {
       schema: SnapTrPixelOptions,
@@ -503,7 +503,7 @@ async function registry(resolve) {
         domains: ["www.clarity.ms", "scripts.clarity.ms", "d.clarity.ms", "e.clarity.ms", "k.clarity.ms", "c.clarity.ms", "a.clarity.ms", "b.clarity.ms"],
         privacy: PRIVACY_HEATMAP
       },
-      partytown: { forwards: [] }
+      partytown: { forwards: ["clarity"] }
     }),
     // payments
     def("stripe", {
@@ -554,8 +554,8 @@ async function registry(resolve) {
       envDefaults: { apiKey: "" },
       category: "content",
       serverHandlers: [
-        { route: "/_scripts/proxy/google-static-maps", handler: "./runtime/server/google-static-maps-proxy" },
-        { route: "/_scripts/proxy/google-maps-geocode", handler: "./runtime/server/google-maps-geocode-proxy" }
+        { route: "/_scripts/proxy/google-static-maps", handler: "./runtime/server/google-static-maps-proxy", requiresSigning: true },
+        { route: "/_scripts/proxy/google-maps-geocode", handler: "./runtime/server/google-maps-geocode-proxy", requiresSigning: true }
       ]
     }),
     def("blueskyEmbed", {
@@ -564,8 +564,8 @@ async function registry(resolve) {
       label: "Bluesky Embed",
       category: "content",
       serverHandlers: [
-        { route: "/_scripts/embed/bluesky", handler: "./runtime/server/bluesky-embed" },
-        { route: "/_scripts/embed/bluesky-image", handler: "./runtime/server/bluesky-embed-image" }
+        { route: "/_scripts/embed/bluesky", handler: "./runtime/server/bluesky-embed", requiresSigning: true },
+        { route: "/_scripts/embed/bluesky-image", handler: "./runtime/server/bluesky-embed-image", requiresSigning: true }
       ]
     }),
     def("instagramEmbed", {
@@ -574,9 +574,9 @@ async function registry(resolve) {
       label: "Instagram Embed",
       category: "content",
       serverHandlers: [
-        { route: "/_scripts/embed/instagram", handler: "./runtime/server/instagram-embed" },
-        { route: "/_scripts/embed/instagram-image", handler: "./runtime/server/instagram-embed-image" },
-        { route: "/_scripts/embed/instagram-asset", handler: "./runtime/server/instagram-embed-asset" }
+        { route: "/_scripts/embed/instagram", handler: "./runtime/server/instagram-embed", requiresSigning: true },
+        { route: "/_scripts/embed/instagram-image", handler: "./runtime/server/instagram-embed-image", requiresSigning: true },
+        { route: "/_scripts/embed/instagram-asset", handler: "./runtime/server/instagram-embed-asset", requiresSigning: true }
       ]
     }),
     def("xEmbed", {
@@ -585,8 +585,8 @@ async function registry(resolve) {
       label: "X Embed",
       category: "content",
       serverHandlers: [
-        { route: "/_scripts/embed/x", handler: "./runtime/server/x-embed" },
-        { route: "/_scripts/embed/x-image", handler: "./runtime/server/x-embed-image" }
+        { route: "/_scripts/embed/x", handler: "./runtime/server/x-embed", requiresSigning: true },
+        { route: "/_scripts/embed/x-image", handler: "./runtime/server/x-embed-image", requiresSigning: true }
       ]
     }),
     // support
@@ -690,7 +690,7 @@ async function registry(resolve) {
         privacy: PRIVACY_IP_ONLY
       },
       serverHandlers: [
-        { route: "/_scripts/proxy/gravatar", handler: "./runtime/server/gravatar-proxy" }
+        { route: "/_scripts/proxy/gravatar", handler: "./runtime/server/gravatar-proxy", requiresSigning: true }
       ]
     })
   ]);