@nuxt/scripts 1.3.2 → 1.3.4

package/dist/runtime/server/utils/image-proxy.js

@@ -1,5 +1,6 @@
-import { createError, defineEventHandler, getQuery, setHeader } from "h3";
+import { createError, defineEventHandler, getQuery, setHeader } from "#nuxt-scripts/h3";
 import { createCachedBinaryFetch } from "./cached-upstream.js";
+import { isPublicNetworkHostname } from "./network-host.js";
 import { withSigning } from "./withSigning.js";
 const AMP_RE = /&/g;
 export function createImageProxyHandler(config) {
@@ -7,12 +8,19 @@ export function createImageProxyHandler(config) {
     accept = "image/webp,image/jpeg,image/png,image/*,*/*;q=0.8",
     userAgent,
     cacheMaxAge = 3600,
-    contentType = "image/jpeg",
+    contentTypePrefixes = ["image/"],
     followRedirects = true,
     decodeAmpersands = false,
     cacheName = Array.isArray(config.allowedDomains) ? `nuxt-scripts-img:${config.allowedDomains[0] || "default"}` : "nuxt-scripts-img:custom"
   } = config;
-  const cachedFetch = createCachedBinaryFetch(cacheName, cacheMaxAge);
+  const domainAllowed = (hostname) => typeof config.allowedDomains === "function" ? config.allowedDomains(hostname) : config.allowedDomains.includes(hostname);
+  const normalizedContentTypePrefixes = contentTypePrefixes.map((prefix) => prefix.toLowerCase());
+  const contentTypeAllowed = (contentType) => contentType !== "image/svg+xml" && normalizedContentTypePrefixes.some((prefix) => contentType.startsWith(prefix));
+  const urlAllowed = (url) => (url.protocol === "http:" || url.protocol === "https:") && !url.username && !url.password && isPublicNetworkHostname(url.hostname) && domainAllowed(url.hostname);
+  const cachedFetch = createCachedBinaryFetch(cacheName, cacheMaxAge, {
+    allowContentType: contentTypeAllowed,
+    allowUrl: urlAllowed
+  });
   return withSigning(defineEventHandler(async (event) => {
     const query = getQuery(event);
     let url = query.url;
@@ -33,17 +41,10 @@ export function createImageProxyHandler(config) {
         statusMessage: "Invalid image URL"
       });
     }
-    if (parsedUrl.protocol !== "http:" && parsedUrl.protocol !== "https:") {
+    if (!urlAllowed(parsedUrl)) {
       throw createError({
-        statusCode: 400,
-        statusMessage: "Invalid URL scheme"
-      });
-    }
-    const domainAllowed = typeof config.allowedDomains === "function" ? config.allowedDomains(parsedUrl.hostname) : config.allowedDomains.includes(parsedUrl.hostname);
-    if (!domainAllowed) {
-      throw createError({
-        statusCode: 403,
-        statusMessage: "Domain not allowed"
+        statusCode: domainAllowed(parsedUrl.hostname) ? 400 : 403,
+        statusMessage: domainAllowed(parsedUrl.hostname) ? "Invalid image URL" : "Domain not allowed"
       });
     }
     const headers = { Accept: accept };
@@ -52,7 +53,6 @@ export function createImageProxyHandler(config) {
     const result = await cachedFetch(url, {
       timeout: 5e3,
       redirect: followRedirects ? "follow" : "manual",
-      ignoreResponseError: !followRedirects,
       headers
     }).catch((error) => {
       throw createError({
@@ -60,14 +60,24 @@ export function createImageProxyHandler(config) {
         statusMessage: error.statusMessage || "Failed to fetch image"
       });
     });
-    if (!followRedirects && result.status >= 300 && result.status < 400) {
+    if (result.status >= 300 && result.status < 400 && result.status !== 304) {
       throw createError({
         statusCode: 403,
         statusMessage: "Redirects not allowed"
       });
     }
-    setHeader(event, "Content-Type", result.contentType || contentType);
+    const responseContentType = result.contentType;
+    const upstreamContentType = responseContentType?.split(";", 1)[0]?.trim().toLowerCase();
+    if (!responseContentType || !upstreamContentType || !contentTypeAllowed(upstreamContentType)) {
+      throw createError({
+        statusCode: 415,
+        statusMessage: "Unsupported upstream content type"
+      });
+    }
+    setHeader(event, "Content-Type", responseContentType);
     setHeader(event, "Cache-Control", `public, max-age=${cacheMaxAge}, s-maxage=${cacheMaxAge}`);
+    setHeader(event, "Content-Security-Policy", "sandbox; default-src 'none'");
+    setHeader(event, "X-Content-Type-Options", "nosniff");
     return result.body;
   }));
 }

package/dist/runtime/server/utils/instagram-embed.d.ts

@@ -6,6 +6,14 @@ export declare const STATIC_CDN_RE: RegExp;
 export declare const LOOKASIDE_RE: RegExp;
 export declare const INSTAGRAM_IMAGE_HOSTS: string[];
 export declare const INSTAGRAM_ASSET_HOST = "static.cdninstagram.com";
+export declare function isSafeInstagramPostUrl(url: URL): boolean;
+export declare function isSafeInstagramEmbedUrl(url: URL): boolean;
+export declare function isSafeInstagramCssUrl(url: URL): boolean;
+export declare function sanitizeInstagramEmbedHtml(html: string, prefix: string, secret?: string): {
+    bodyHtml: string;
+    cssUrls: string[];
+};
+export declare function sanitizeInstagramEmbedCss(css: string, scopeSelector: string, prefix: string, secret?: string): string;
 export declare function proxyImageUrl(url: string, prefix?: string, secret?: string): string;
 export declare function proxyAssetUrl(url: string, prefix?: string, secret?: string): string;
 export declare function rewriteUrl(url: string, prefix?: string, secret?: string): string;

package/dist/runtime/server/utils/instagram-embed.js

@@ -1,3 +1,4 @@
+import { ELEMENT_NODE, parse, renderSync, TEXT_NODE, walkSync } from "ultrahtml";
 import { buildProxyUrl } from "./proxy-url.js";
 export const RSRC_RE = /url\(\/rsrc\.php([^)]+)\)/g;
 const SHELL_BODY_RE = /id=["'](?:splash-screen|has-finished-comet-page)["']/;
@@ -11,11 +12,165 @@ export const STATIC_CDN_RE = /https:\/\/static\.cdninstagram\.com[^"'\s),]+/g;
 export const LOOKASIDE_RE = /https:\/\/lookaside\.instagram\.com[^"'\s),]+/g;
 export const INSTAGRAM_IMAGE_HOSTS = ["scontent.cdninstagram.com", "lookaside.instagram.com"];
 export const INSTAGRAM_ASSET_HOST = "static.cdninstagram.com";
+const INSTAGRAM_POST_PATH_RE = /^\/(?:p|reel|tv)\/[^/]+\/?$/;
+const INSTAGRAM_EMBED_PATH_RE = /^\/(?:p|reel|tv)\/[^/]+\/embed\/(?:captioned\/)?$/;
+const BLOCKED_EMBED_TAGS = /* @__PURE__ */ new Set([
+  "base",
+  "button",
+  "embed",
+  "form",
+  "iframe",
+  "input",
+  "link",
+  "math",
+  "meta",
+  "noscript",
+  "object",
+  "option",
+  "script",
+  "select",
+  "style",
+  "svg",
+  "template",
+  "textarea"
+]);
+const EMBED_URL_ATTRS = /* @__PURE__ */ new Set(["action", "formaction", "href", "xlink:href"]);
+const CSS_URL_RE = /url\(([^)]*)\)/gi;
+const CSS_IMAGE_SET_RE = /(?:-webkit-)?image-set\((?:[^()]|\([^)]*\))*\)/gi;
+const DANGEROUS_STYLE_RE = /expression\s*\(|@import|-moz-binding|behavior\s*:/i;
+const SRCSET_SPLIT_RE = /\s+/;
+const MAX_INSTAGRAM_STYLESHEETS = 4;
 const CHARSET_RE = /@charset\s[^;]+;/gi;
 const IMPORT_RE = /@import\s[^;]+;/gi;
 const WHITESPACE_RE = /\s/;
 const AT_RULE_NAME_RE = /@([\w-]+)/;
 const MULTI_SPACE_RE = /\s+/g;
+function isSafeInstagramOrigin(url) {
+  return url.protocol === "https:" && !url.username && !url.password && (!url.port || url.port === "443") && (url.hostname === "instagram.com" || url.hostname === "www.instagram.com");
+}
+export function isSafeInstagramPostUrl(url) {
+  return isSafeInstagramOrigin(url) && INSTAGRAM_POST_PATH_RE.test(url.pathname);
+}
+export function isSafeInstagramEmbedUrl(url) {
+  return isSafeInstagramOrigin(url) && INSTAGRAM_EMBED_PATH_RE.test(url.pathname);
+}
+export function isSafeInstagramCssUrl(url) {
+  return url.protocol === "https:" && !url.username && !url.password && (!url.port || url.port === "443") && url.hostname === INSTAGRAM_ASSET_HOST;
+}
+function removeNode(node) {
+  node.type = TEXT_NODE;
+  node.value = "";
+  node.name = void 0;
+  node.attributes = {};
+  node.children = [];
+}
+function isSafeNavigationUrl(value) {
+  if (!/^(?:https?:\/\/|\/|#)/i.test(value))
+    return false;
+  try {
+    const url = new URL(value, "https://www.instagram.com");
+    return (url.protocol === "http:" || url.protocol === "https:") && !url.username && !url.password;
+  } catch {
+    return false;
+  }
+}
+function sanitizeCssUrls(css, proxyPrefix) {
+  const allowedPrefix = `${proxyPrefix}/embed/instagram-`;
+  const withoutUnsafeImageSets = css.replace(CSS_IMAGE_SET_RE, (match) => {
+    const values = [...match.matchAll(/(["'])(.*?)\1/g)].map((result) => result[2] || "");
+    const safe = !/https?:|data:|blob:|file:|\/\//i.test(match.replaceAll(allowedPrefix, "")) && values.every((value) => value.startsWith(allowedPrefix) || /^image\//i.test(value));
+    return safe ? match : "none";
+  });
+  return withoutUnsafeImageSets.replace(CSS_URL_RE, (match, rawValue) => {
+    const trimmed = rawValue.trim();
+    const first = trimmed[0];
+    const value = (first === '"' || first === "'") && trimmed.at(-1) === first ? trimmed.slice(1, -1).trim() : trimmed;
+    return value.startsWith(allowedPrefix) ? match : 'url("")';
+  });
+}
+function rewriteMediaUrl(url, prefix, secret) {
+  const rewritten = rewriteUrl(url, prefix, secret);
+  return rewritten === url ? void 0 : rewritten;
+}
+export function sanitizeInstagramEmbedHtml(html, prefix, secret) {
+  const ast = parse(html);
+  const cssUrls = /* @__PURE__ */ new Set();
+  walkSync(ast, (node) => {
+    if (node.type !== ELEMENT_NODE)
+      return;
+    const tag = String(node.name).toLowerCase();
+    if (tag === "link" && node.attributes.rel?.toLowerCase() === "stylesheet" && node.attributes.href) {
+      try {
+        const cssUrl = new URL(node.attributes.href);
+        if (isSafeInstagramCssUrl(cssUrl) && cssUrls.size < MAX_INSTAGRAM_STYLESHEETS)
+          cssUrls.add(cssUrl.toString());
+      } catch {
+      }
+    }
+    if (BLOCKED_EMBED_TAGS.has(tag)) {
+      removeNode(node);
+      return;
+    }
+    for (const [name, value] of Object.entries(node.attributes)) {
+      const lowerName = name.toLowerCase();
+      if (lowerName.startsWith("on") || lowerName === "srcdoc" || lowerName === "nonce") {
+        delete node.attributes[name];
+        continue;
+      }
+      if (EMBED_URL_ATTRS.has(lowerName) && !isSafeNavigationUrl(value)) {
+        delete node.attributes[name];
+        continue;
+      }
+      if (lowerName === "src" || lowerName === "poster") {
+        const rewritten = rewriteMediaUrl(value, prefix, secret);
+        if (rewritten)
+          node.attributes[name] = rewritten;
+        else
+          delete node.attributes[name];
+        continue;
+      }
+      if (lowerName === "srcset") {
+        const entries = value.split(",").flatMap((entry) => {
+          const [url, descriptor, ...rest] = entry.trim().split(SRCSET_SPLIT_RE);
+          const rewritten = url ? rewriteMediaUrl(url, prefix, secret) : void 0;
+          const safeDescriptor = !descriptor || /^\d+(?:\.\d+)?[wx]$/.test(descriptor);
+          return rewritten && safeDescriptor && rest.length === 0 ? [`${rewritten}${descriptor ? ` ${descriptor}` : ""}`] : [];
+        });
+        if (entries.length)
+          node.attributes[name] = entries.join(", ");
+        else
+          delete node.attributes[name];
+        continue;
+      }
+      if (lowerName === "style") {
+        const rewritten = rewriteUrlsInText(value, prefix, secret);
+        if (DANGEROUS_STYLE_RE.test(rewritten))
+          delete node.attributes[name];
+        else
+          node.attributes[name] = sanitizeCssUrls(rewritten, prefix);
+      }
+    }
+    if (tag === "a" && node.attributes.target?.toLowerCase() === "_blank")
+      node.attributes.rel = "noopener noreferrer";
+  });
+  let bodyNode;
+  walkSync(ast, (node) => {
+    if (node.type === ELEMENT_NODE && node.name === "body")
+      bodyNode = node;
+  });
+  return {
+    bodyHtml: bodyNode ? bodyNode.children.map((child) => renderSync(child)).join("") : renderSync(ast),
+    cssUrls: [...cssUrls]
+  };
+}
+export function sanitizeInstagramEmbedCss(css, scopeSelector, prefix, secret) {
+  const rewritten = rewriteUrlsInText(
+    css.replace(RSRC_RE, (_match, path) => `url(${proxyAssetUrl(`https://${INSTAGRAM_ASSET_HOST}/rsrc.php${path}`, prefix, secret)})`),
+    prefix,
+    secret
+  );
+  return sanitizeCssUrls(scopeCss(rewritten, scopeSelector), prefix).replace(/<\/style/gi, "<\\/style");
+}
 export function proxyImageUrl(url, prefix = "/_scripts", secret) {
   return buildProxyUrl(`${prefix}/embed/instagram-image`, { url: url.replace(AMP_RE, "&") }, secret);
 }

package/dist/runtime/server/utils/network-host.d.ts

@@ -0,0 +1,21 @@
+import type { LookupFunction } from 'node:net';
+interface NetworkAddress {
+    address: string;
+    family: 4 | 6;
+}
+type ResolveNetworkHostname = (hostname: string, callback: (error: Error | null, addresses: NetworkAddress[]) => void) => void;
+export interface PublicNetworkDispatcher {
+    fetch: typeof globalThis.fetch;
+    close: () => Promise<void>;
+}
+/** Close a dispatcher without replacing the request or stream error already in flight. */
+export declare function closePublicNetworkDispatcher(dispatcher: PublicNetworkDispatcher | undefined, primaryError?: unknown): Promise<void>;
+/** Reject hostnames that directly address local, private, link-local, or reserved networks. */
+export declare function isPublicNetworkHostname(input: string): boolean;
+/** Resolve once inside the socket connection, reject mixed/private answers, then pin the selected address. */
+export declare function createPublicNetworkLookup(resolveHostname: ResolveNetworkHostname): LookupFunction;
+/** Create a Node fetch dispatcher whose socket lookup validates and pins every DNS answer. */
+export declare function createPublicNetworkDispatcher(resolveHostnameOverride?: ResolveNetworkHostname): Promise<PublicNetworkDispatcher>;
+/** Detect the tagged DNS policy error through fetch/ofetch cause wrappers. */
+export declare function isPrivateNetworkResolutionError(error: unknown): boolean;
+export {};

package/dist/runtime/server/utils/network-host.js

@@ -0,0 +1,112 @@
+import { runtime } from "std-env";
+const LOCAL_HOST_SUFFIXES = [
+  "home",
+  "internal",
+  "lan",
+  "local",
+  "localdomain",
+  "localhost"
+];
+export async function closePublicNetworkDispatcher(dispatcher, primaryError) {
+  if (!dispatcher)
+    return;
+  await dispatcher.close().catch((cleanupError) => {
+    if (primaryError !== void 0) {
+      if (primaryError && typeof primaryError === "object")
+        Object.assign(primaryError, { cleanupError });
+      return;
+    }
+    throw cleanupError;
+  });
+}
+function parseIPv4(hostname) {
+  const parts = hostname.split(".");
+  if (parts.length !== 4 || parts.some((part) => !/^\d{1,3}$/.test(part)))
+    return;
+  const octets = parts.map(Number);
+  return octets.every((octet) => octet >= 0 && octet <= 255) ? octets : void 0;
+}
+function isPublicIPv4([a, b, c]) {
+  return a !== 0 && a !== 10 && a !== 127 && !(a === 100 && b >= 64 && b <= 127) && !(a === 169 && b === 254) && !(a === 172 && b >= 16 && b <= 31) && !(a === 192 && b === 0 && c === 0) && !(a === 192 && b === 0 && c === 2) && !(a === 192 && b === 88 && c === 99) && !(a === 192 && b === 168) && !(a === 198 && (b === 18 || b === 19)) && !(a === 198 && b === 51 && c === 100) && !(a === 203 && b === 0 && c === 113) && a < 224;
+}
+function isPublicIPv6(hostname) {
+  const groups = hostname.split(":");
+  const firstGroup = Number.parseInt(groups[0] || "0", 16);
+  if (!Number.isInteger(firstGroup) || firstGroup < 8192 || firstGroup > 16383)
+    return false;
+  const secondGroup = Number.parseInt(groups[1] || "0", 16);
+  return !(firstGroup === 8193 && (secondGroup === 0 || secondGroup === 3512)) && firstGroup !== 8194;
+}
+export function isPublicNetworkHostname(input) {
+  const hostname = input.trim().toLowerCase().replace(/^\[|\]$/g, "").split("%", 1)[0].replace(/\.$/, "");
+  if (!hostname)
+    return false;
+  const ipv4 = parseIPv4(hostname);
+  if (ipv4)
+    return isPublicIPv4(ipv4);
+  if (hostname.includes(":"))
+    return isPublicIPv6(hostname);
+  const labels = hostname.split(".");
+  if (labels.length < 2)
+    return false;
+  const suffix = labels.at(-1);
+  return !LOCAL_HOST_SUFFIXES.includes(suffix);
+}
+export function createPublicNetworkLookup(resolveHostname) {
+  const networkLookup = (hostname, options, callback) => {
+    resolveHostname(hostname, (error, addresses) => {
+      if (error) {
+        callback(error, "");
+        return;
+      }
+      if (!addresses.length || addresses.some(({ address }) => !isPublicNetworkHostname(address))) {
+        callback(Object.assign(new Error("Upstream hostname resolved to a non-public address"), {
+          code: "ERR_NUXT_SCRIPTS_PRIVATE_ADDRESS"
+        }), "");
+        return;
+      }
+      if (options.all) {
+        callback(null, addresses);
+        return;
+      }
+      const requestedFamily = options.family === "IPv4" ? 4 : options.family === "IPv6" ? 6 : options.family === 4 || options.family === 6 ? options.family : void 0;
+      const selected = addresses.find(({ family }) => family === requestedFamily) ?? addresses[0];
+      callback(null, selected.address, selected.family);
+    });
+  };
+  return networkLookup;
+}
+export async function createPublicNetworkDispatcher(resolveHostnameOverride) {
+  if (runtime !== "node")
+    return { fetch: globalThis.fetch, close: async () => {
+    } };
+  const { Agent, fetch } = await import("undici");
+  let resolveHostname = resolveHostnameOverride;
+  if (!resolveHostname) {
+    const { lookup } = await import("node:dns");
+    resolveHostname = (hostname, callback) => lookup(hostname, { all: true, verbatim: true }, (error, addresses) => {
+      callback(error, addresses);
+    });
+  }
+  const dispatcher = new Agent({
+    connect: {
+      lookup: createPublicNetworkLookup(resolveHostname)
+    }
+  });
+  return {
+    fetch: ((input, init) => fetch(input, {
+      ...init,
+      dispatcher
+    })),
+    close: () => dispatcher.close()
+  };
+}
+export function isPrivateNetworkResolutionError(error) {
+  let current = error;
+  for (let depth = 0; depth < 5 && current && typeof current === "object"; depth++) {
+    if (current.code === "ERR_NUXT_SCRIPTS_PRIVATE_ADDRESS")
+      return true;
+    current = current.cause;
+  }
+  return false;
+}

package/dist/runtime/server/utils/privacy.js

@@ -92,9 +92,30 @@ export const NORMALIZE_PARAMS = {
   language: ["ul", "lang", "language", "languages"],
   userAgent: ["ua", "useragent", "user_agent", "client_user_agent", "context.useragent"]
 };
+function expandIPv6(address) {
+  const halves = address.split("::");
+  if (halves.length > 2)
+    return;
+  const left = halves[0] ? halves[0].split(":") : [];
+  const right = halves[1] ? halves[1].split(":") : [];
+  const valid = (part) => /^[\da-f]{1,4}$/i.test(part);
+  if (!left.every(valid) || !right.every(valid))
+    return;
+  if (halves.length === 1)
+    return left.length === 8 ? left : void 0;
+  const missing = 8 - left.length - right.length;
+  if (missing < 1)
+    return;
+  return [...left, ...Array.from({ length: missing }).fill("0"), ...right];
+}
 export function anonymizeIP(ip) {
   if (ip.includes(":")) {
-    return `${ip.split(":").slice(0, 3).join(":")}::`;
+    const normalized = ip.split("%", 1)[0] || "";
+    const mappedIPv4 = normalized.match(/^::ffff:(\d{1,3}(?:\.\d{1,3}){3})$/i)?.[1];
+    if (mappedIPv4)
+      return `::ffff:${anonymizeIP(mappedIPv4)}`;
+    const expanded = expandIPv6(normalized);
+    return expanded ? `${expanded.slice(0, 3).join(":")}::` : normalized;
   }
   const parts = ip.split(".");
   if (parts.length === 4) {
@@ -239,15 +260,23 @@ function matchesParam(key, params) {
     return lk === lp || lk.startsWith(`${lp}[`);
   });
 }
+function mapValue(value, transform) {
+  return Array.isArray(value) ? value.map(transform) : transform(value);
+}
+function mapString(value, transform) {
+  return mapValue(value, (item) => typeof item === "string" ? transform(item) : item);
+}
 export function stripPayloadFingerprinting(payload, privacy) {
   const p = privacy || FULL_PRIVACY;
-  const result = {};
-  let deviceClass;
+  const result = /* @__PURE__ */ Object.create(null);
+  let deviceClasses = [];
   for (const [key, value] of Object.entries(payload)) {
     if (key.toLowerCase() === "sw") {
-      const num = typeof value === "number" ? value : Number(value);
-      if (!Number.isNaN(num))
-        deviceClass = getDeviceClass(num);
+      const widths = Array.isArray(value) ? value : [value];
+      deviceClasses = widths.map((width) => {
+        const num = typeof width === "number" ? width : Number(width);
+        return Number.isNaN(num) ? void 0 : getDeviceClass(num);
+      });
     }
   }
   for (const [key, value] of Object.entries(payload)) {
@@ -264,12 +293,12 @@ export function stripPayloadFingerprinting(payload, privacy) {
       continue;
     }
     const isUserAgentParam = NORMALIZE_PARAMS.userAgent.some((pm) => lowerKey === pm.toLowerCase());
-    if (isUserAgentParam && typeof value === "string") {
-      result[key] = p.userAgent ? normalizeUserAgent(value) : value;
+    if (isUserAgentParam) {
+      result[key] = p.userAgent ? mapString(value, normalizeUserAgent) : value;
       continue;
     }
-    if (matchesParam(key, STRIP_PARAMS.ip) && typeof value === "string") {
-      result[key] = p.ip ? anonymizeIP(value) : value;
+    if (matchesParam(key, STRIP_PARAMS.ip)) {
+      result[key] = p.ip ? mapString(value, anonymizeIP) : value;
       continue;
     }
     if (matchesParam(key, STRIP_PARAMS.screen)) {
@@ -279,28 +308,35 @@ export function stripPayloadFingerprinting(payload, privacy) {
       }
       if (["sd", "colordepth", "pixelratio"].includes(lowerKey)) {
         result[key] = value;
-      } else if (lowerKey === "sh" && deviceClass) {
-        const paired = SCREEN_BUCKETS[deviceClass].h;
-        result[key] = typeof value === "number" ? paired : String(paired);
+      } else if (lowerKey === "sh" && deviceClasses.length > 0) {
+        const generalizePairedHeight = (item, index) => {
+          const deviceClass = deviceClasses[index] ?? deviceClasses[0];
+          if (!deviceClass)
+            return generalizeScreen(item, "height");
+          const paired = SCREEN_BUCKETS[deviceClass].h;
+          return typeof item === "number" ? paired : String(paired);
+        };
+        result[key] = Array.isArray(value) ? value.map(generalizePairedHeight) : generalizePairedHeight(value, 0);
       } else {
-        result[key] = generalizeScreen(value, lowerKey === "sw" ? "width" : lowerKey === "sh" ? "height" : void 0);
+        const dimension = lowerKey === "sw" ? "width" : lowerKey === "sh" ? "height" : void 0;
+        result[key] = mapValue(value, (item) => generalizeScreen(item, dimension));
       }
       continue;
     }
     if (matchesParam(key, STRIP_PARAMS.hardware)) {
-      result[key] = p.hardware ? generalizeHardware(value) : value;
+      result[key] = p.hardware ? mapValue(value, generalizeHardware) : value;
       continue;
     }
     if (matchesParam(key, STRIP_PARAMS.version)) {
-      result[key] = p.hardware ? generalizeVersion(value) : value;
+      result[key] = p.hardware ? mapValue(value, generalizeVersion) : value;
       continue;
     }
     if (matchesParam(key, STRIP_PARAMS.browserVersion)) {
-      result[key] = p.hardware ? generalizeBrowserVersions(value) : value;
+      result[key] = p.hardware ? mapValue(value, generalizeBrowserVersions) : value;
       continue;
     }
     if (matchesParam(key, STRIP_PARAMS.location)) {
-      result[key] = p.timezone ? generalizeTimezone(value) : value;
+      result[key] = p.timezone ? mapValue(value, generalizeTimezone) : value;
       continue;
     }
     if (matchesParam(key, STRIP_PARAMS.browserData)) {
@@ -308,7 +344,7 @@ export function stripPayloadFingerprinting(payload, privacy) {
       continue;
     }
     if (matchesParam(key, STRIP_PARAMS.deviceInfo)) {
-      result[key] = p.hardware ? typeof value === "string" ? anonymizeDeviceInfo(value) : "" : value;
+      result[key] = p.hardware ? mapValue(value, (item) => typeof item === "string" ? anonymizeDeviceInfo(item) : "") : value;
       continue;
     }
     if (matchesParam(key, STRIP_PARAMS.platform)) {

package/dist/runtime/server/utils/proxy-query.d.ts

@@ -0,0 +1,2 @@
+/** Remove proxy-only credentials before constructing an upstream URL or cache key. */
+export declare function stripProxyAuthQuery(query: Record<string, unknown>): Record<string, unknown>;

package/dist/runtime/server/utils/proxy-query.js

@@ -0,0 +1,10 @@
+import { PAGE_TOKEN_PARAM, PAGE_TOKEN_TS_PARAM, SIG_PARAM } from "./sign-constants.js";
+const PROXY_AUTH_PARAMS = /* @__PURE__ */ new Set([SIG_PARAM, PAGE_TOKEN_PARAM, PAGE_TOKEN_TS_PARAM]);
+export function stripProxyAuthQuery(query) {
+  const upstreamQuery = /* @__PURE__ */ Object.create(null);
+  for (const [key, value] of Object.entries(query)) {
+    if (!PROXY_AUTH_PARAMS.has(key))
+      upstreamQuery[key] = value;
+  }
+  return upstreamQuery;
+}

package/dist/runtime/server/utils/sign.d.ts

@@ -21,7 +21,7 @@
  * (a billion guesses gives a ~5% hit rate at 2^64). Longer signatures bloat
  * prerendered HTML for no practical gain.
  */
-import type { H3Event } from 'h3';
+import type { H3Event } from '#nuxt-scripts/h3';
 import { PAGE_TOKEN_MAX_AGE, PAGE_TOKEN_PARAM, PAGE_TOKEN_TS_PARAM, SIG_LENGTH, SIG_PARAM } from './sign-constants.js';
 export { PAGE_TOKEN_MAX_AGE, PAGE_TOKEN_PARAM, PAGE_TOKEN_TS_PARAM, SIG_LENGTH, SIG_PARAM };
 /**

package/dist/runtime/server/utils/sign.js

@@ -1,5 +1,5 @@
 import { createHmac } from "node:crypto";
-import { getQuery } from "h3";
+import { getQuery } from "#nuxt-scripts/h3";
 import {
   PAGE_TOKEN_MAX_AGE,
   PAGE_TOKEN_PARAM,

package/dist/runtime/server/utils/withSigning.d.ts

@@ -19,5 +19,5 @@
  * The outer wrapper runs before any handler logic, so unauthorized requests
  * never reach the upstream fetch and cannot consume API quota.
  */
-import type { EventHandler, EventHandlerRequest, EventHandlerResponse } from 'h3';
+import type { EventHandler, EventHandlerRequest, EventHandlerResponse } from '#nuxt-scripts/h3';
 export declare function withSigning<Req extends EventHandlerRequest = EventHandlerRequest, Res extends EventHandlerResponse = EventHandlerResponse>(handler: EventHandler<Req, Res>): EventHandler<Req, any>;

package/dist/runtime/server/utils/withSigning.js

@@ -1,9 +1,9 @@
-import { createError, defineEventHandler } from "h3";
-import { useRuntimeConfig } from "nitropack/runtime";
+import { createError, defineEventHandler } from "#nuxt-scripts/h3";
+import { useRuntimeConfig } from "#nuxt-scripts/nitro";
 import { verifyProxyRequest } from "./sign.js";
 export function withSigning(handler) {
   return defineEventHandler(async (event) => {
-    const runtimeConfig = useRuntimeConfig(event);
+    const runtimeConfig = useRuntimeConfig();
     const scriptsConfig = runtimeConfig["nuxt-scripts"];
     const secret = scriptsConfig?.proxySecret;
     if (!secret)

package/dist/runtime/server/vercel-insights-sink.js

@@ -1,4 +1,4 @@
-import { defineEventHandler, setResponseStatus } from "h3";
+import { defineEventHandler, setResponseStatus } from "#nuxt-scripts/h3";
 export default defineEventHandler((event) => {
   setResponseStatus(event, 204);
   return null;

package/dist/runtime/server/x-embed.js

@@ -1,6 +1,6 @@
-import { createError, defineEventHandler, getQuery, setHeader } from "h3";
-import { useRuntimeConfig } from "nitropack/runtime";
-import { createCachedJsonFetch } from "./utils/cached-upstream.js";
+import { createError, defineEventHandler, getQuery, setHeader } from "#nuxt-scripts/h3";
+import { useRuntimeConfig } from "#nuxt-scripts/nitro";
+import { createCachedJsonFetch, isSafeHttpsUrl } from "./utils/cached-upstream.js";
 import { rewriteTweetImages } from "./utils/embed-rewriters.js";
 import { withSigning } from "./utils/withSigning.js";
 const TWEET_ID_RE = /^\d+$/;
@@ -12,6 +12,10 @@ const cachedTweetFetch = createCachedJsonFetch(
   (url) => {
     const match = url.match(TWEET_ID_FROM_URL_RE);
     return match?.[1] || url;
+  },
+  {
+    allowUrl: (url) => isSafeHttpsUrl(url) && url.hostname === "cdn.syndication.twimg.com",
+    contentTypePrefixes: ["application/json"]
   }
 );
 export default withSigning(defineEventHandler(async (event) => {
@@ -43,7 +47,7 @@ export default withSigning(defineEventHandler(async (event) => {
   const handlerPath = event.path?.split("?")[0] || "";
   const prefix = handlerPath.replace(EMBED_X_SUFFIX_RE, "") || "/_scripts";
   const imagePath = `${prefix}/embed/x-image`;
-  const secret = useRuntimeConfig(event)["nuxt-scripts"]?.proxySecret;
+  const secret = useRuntimeConfig()["nuxt-scripts"]?.proxySecret;
   rewriteTweetImages(tweetData, imagePath, secret);
   setHeader(event, "Content-Type", "application/json");
   setHeader(event, "Cache-Control", "public, max-age=600, s-maxage=600");

package/dist/runtime/unhead-features.d.ts

@@ -0,0 +1 @@
+export declare function isUnheadSourceLessScriptLoaderEnabled(): boolean;

package/dist/runtime/unhead-features.js

@@ -0,0 +1,3 @@
+export function isUnheadSourceLessScriptLoaderEnabled() {
+  return typeof __NUXT_SCRIPTS_UNHEAD_SOURCELESS__ !== "undefined" && __NUXT_SCRIPTS_UNHEAD_SOURCELESS__;
+}

package/dist/runtime/utils/abortable-promise.d.ts

@@ -0,0 +1,8 @@
+export interface AbortablePromiseOptions {
+    signal?: AbortSignal;
+    abortMessage?: string;
+}
+type PromiseSetup<T> = (resolve: (value: T | PromiseLike<T>) => void, reject: (reason?: unknown) => void) => void | (() => void);
+export declare function createAbortError(message?: string): Error;
+export declare function createAbortablePromise<T>(setup: PromiseSetup<T>, options?: AbortablePromiseOptions): Promise<T>;
+export {};