@nuxt/scripts 1.3.5 → 2.0.0-beta.1

package/dist/runtime/server/utils/cached-upstream.js

@@ -6,6 +6,10 @@ import { NUXT_SCRIPTS_CACHE_BASE } from "./cache-config.js";
 import { closePublicNetworkDispatcher, createPublicNetworkDispatcher, isPublicNetworkHostname } from "./network-host.js";
 const DEFAULT_BINARY_MAX_RESPONSE_BYTES = 10 * 1024 * 1024;
 const DEFAULT_JSON_MAX_RESPONSE_BYTES = 2 * 1024 * 1024;
+const TIMEOUT_ERROR_NAMES = /* @__PURE__ */ new Set(["AbortError", "BodyTimeoutError", "HeadersTimeoutError", "TimeoutError"]);
+const DEFAULT_UPSTREAM_TIMEOUT_MS = 1e4;
+const MAX_TRACKED_FAILURES = 512;
+export const UPSTREAM_FAILURE_MAX_AGE = 60;
 export function isSafeHttpsUrl(url) {
   return url.protocol === "https:" && !url.username && !url.password && (!url.port || url.port === "443") && isPublicNetworkHostname(url.hostname);
 }
@@ -15,6 +19,51 @@ function upstreamError(message, statusCode, statusMessage, cause) {
     statusMessage
   });
 }
+function asUpstreamError(error) {
+  if (typeof error?.statusCode === "number")
+    return error;
+  const timedOut = isTimeoutError(error);
+  return upstreamError(
+    `Upstream request failed: ${error?.message || "unknown error"}`,
+    timedOut ? 504 : 502,
+    timedOut ? "Gateway Timeout" : "Upstream request failed",
+    error
+  );
+}
+function isTimeoutError(error) {
+  const candidate = error;
+  const code = candidate?.cause?.code;
+  return TIMEOUT_ERROR_NAMES.has(candidate?.name || "") || TIMEOUT_ERROR_NAMES.has(candidate?.cause?.name || "") || typeof code === "string" && code.includes("TIMEOUT");
+}
+function createFailureGate(maxAge) {
+  const failures = /* @__PURE__ */ new Map();
+  const failureWindow = Math.min(UPSTREAM_FAILURE_MAX_AGE, maxAge) * 1e3;
+  return {
+    replay(key) {
+      const failure = failures.get(key);
+      if (!failure)
+        return;
+      if (Date.now() >= failure.until) {
+        failures.delete(key);
+        return;
+      }
+      throw upstreamError(failure.error.message, failure.error.statusCode, failure.error.statusMessage);
+    },
+    record(key, error) {
+      const failure = error;
+      if (failures.size >= MAX_TRACKED_FAILURES)
+        failures.delete(failures.keys().next().value);
+      failures.set(key, {
+        until: Date.now() + failureWindow,
+        error: {
+          message: failure?.message || "Upstream request failed",
+          statusCode: failure?.statusCode ?? 502,
+          statusMessage: failure?.statusMessage || "Upstream request failed"
+        }
+      });
+    }
+  };
+}
 function resolveMaxResponseBytes(value, fallback) {
   const maxBytes = value ?? fallback;
   if (!Number.isSafeInteger(maxBytes) || maxBytes < 0)
@@ -138,10 +187,11 @@ async function fetchBoundedUpstream(url, options) {
         }
       }
       if (!options.ignoreResponseError && response.status >= 400 && response.status < 600) {
+        const upstreamFault = response.status >= 500;
         await rejectResponse(response, upstreamError(
           `Upstream request failed with status ${response.status}`,
-          response.status,
-          response.statusText || "Upstream request failed"
+          upstreamFault ? 502 : response.status,
+          upstreamFault ? "Upstream request failed" : response.statusText || "Upstream request failed"
         ));
       }
       const contentType = response.headers.get("content-type");
@@ -168,16 +218,35 @@ async function fetchBoundedUpstream(url, options) {
       return { contentType, data, status: response.status };
     }
   } catch (error) {
-    primaryError = error;
-    throw error;
+    primaryError = asUpstreamError(error);
+    throw primaryError;
   } finally {
     await closePublicNetworkDispatcher(network, primaryError);
   }
 }
 export function createCachedBinaryFetch(name, maxAge, config = {}) {
   const maxResponseBytes = resolveMaxResponseBytes(config.maxResponseBytes, DEFAULT_BINARY_MAX_RESPONSE_BYTES);
+  const failureGate = createFailureGate(maxAge);
+  const cacheKey = (url, opts) => {
+    if (!opts)
+      return hash(url);
+    const parts = [url];
+    if (opts.headers) {
+      const entries = Object.entries(opts.headers).sort(([a], [b]) => a.localeCompare(b));
+      for (const [k, v] of entries)
+        parts.push(`${k}=${v}`);
+    }
+    if (opts.redirect)
+      parts.push(`redirect=${opts.redirect}`);
+    if (opts.ignoreResponseError !== void 0)
+      parts.push(`ignoreResponseError=${opts.ignoreResponseError}`);
+    return hash(parts);
+  };
+  const gateKey = (url, opts) => `${cacheKey(url, opts)}:${opts?.timeout ?? DEFAULT_UPSTREAM_TIMEOUT_MS}`;
   const cached = defineCachedFunction(
     async (url, opts) => {
+      const key = gateKey(url, opts);
+      failureGate.replay(key);
       const response = await fetchBoundedUpstream(url, {
         allowContentType: config.allowContentType,
         allowUrl: config.allowUrl,
@@ -186,7 +255,10 @@ export function createCachedBinaryFetch(name, maxAge, config = {}) {
         maxRedirects: config.maxRedirects,
         maxResponseBytes,
         redirect: opts?.redirect ?? (config.allowUrl ? "follow" : "manual"),
-        timeoutMs: opts?.timeout ?? 1e4
+        timeoutMs: opts?.timeout ?? DEFAULT_UPSTREAM_TIMEOUT_MS
+      }).catch((error) => {
+        failureGate.record(key, error);
+        throw error;
       });
       return {
         base64: response.data.byteLength ? Buffer.from(response.data).toString("base64") : "",
@@ -200,21 +272,7 @@ export function createCachedBinaryFetch(name, maxAge, config = {}) {
       maxAge,
       swr: true,
       staleMaxAge: maxAge,
-      getKey: (url, opts) => {
-        if (!opts)
-          return hash(url);
-        const parts = [url];
-        if (opts.headers) {
-          const entries = Object.entries(opts.headers).sort(([a], [b]) => a.localeCompare(b));
-          for (const [k, v] of entries)
-            parts.push(`${k}=${v}`);
-        }
-        if (opts.redirect)
-          parts.push(`redirect=${opts.redirect}`);
-        if (opts.ignoreResponseError !== void 0)
-          parts.push(`ignoreResponseError=${opts.ignoreResponseError}`);
-        return hash(parts);
-      }
+      getKey: cacheKey
     }
   );
   return async (url, opts) => {
@@ -227,8 +285,13 @@ export function createCachedBinaryFetch(name, maxAge, config = {}) {
 }
 export function createCachedJsonFetch(name, maxAge, getKey, config) {
   const maxResponseBytes = resolveMaxResponseBytes(config.maxResponseBytes, DEFAULT_JSON_MAX_RESPONSE_BYTES);
+  const failureGate = createFailureGate(maxAge);
+  const cacheKey = (url, opts) => hash(getKey(url, opts));
+  const gateKey = (url, opts) => `${cacheKey(url, opts)}:${opts?.timeout ?? DEFAULT_UPSTREAM_TIMEOUT_MS}`;
   return defineCachedFunction(
     async (url, opts) => {
+      const key = gateKey(url, opts);
+      failureGate.replay(key);
       const response = await fetchBoundedUpstream(url, {
         allowUrl: config.allowUrl,
         contentTypePrefixes: config.contentTypePrefixes,
@@ -237,7 +300,10 @@ export function createCachedJsonFetch(name, maxAge, getKey, config) {
         maxRedirects: config.maxRedirects,
         maxResponseBytes,
         redirect: "follow",
-        timeoutMs: opts?.timeout ?? 1e4
+        timeoutMs: opts?.timeout ?? DEFAULT_UPSTREAM_TIMEOUT_MS
+      }).catch((error) => {
+        failureGate.record(key, error);
+        throw error;
       });
       const text = new TextDecoder().decode(response.data);
       let data;
@@ -250,7 +316,12 @@ export function createCachedJsonFetch(name, maxAge, getKey, config) {
           throw upstreamError("Upstream response is not valid JSON", 502, "Invalid upstream response", cause);
         }
       }
-      config.validateResponse?.(data);
+      try {
+        config.validateResponse?.(data);
+      } catch (error) {
+        failureGate.record(key, error);
+        throw error;
+      }
       return data;
     },
     {
@@ -259,7 +330,7 @@ export function createCachedJsonFetch(name, maxAge, getKey, config) {
       maxAge,
       swr: true,
       staleMaxAge: maxAge,
-      getKey: (url, opts) => hash(getKey(url, opts))
+      getKey: cacheKey
     }
   );
 }

package/dist/runtime/server/utils/embed-rewriters.d.ts

@@ -1,13 +1,11 @@
 /**
  * Mutate a tweet (and any quoted tweet) in place so every raw CDN image URL
- * is rewritten to route through the site's `/embed/x-image` proxy. When a
- * `secret` is provided, URLs are HMAC-signed and pass `withSigning` without a
- * page token.
+ * is rewritten to route through the site's `/embed/x-image` proxy.
  *
  * Clone the input first if it came from a shared cache — this function does
  * not copy.
  */
-export declare function rewriteTweetImages(tweet: any, imagePath: string, secret?: string): void;
+export declare function rewriteTweetImages(tweet: any, imagePath: string): void;
 /**
  * Mutate a Bluesky post in place so every CDN image URL routes through the
  * site's `/embed/bluesky-image` proxy. Covers author avatar, embedded images
@@ -16,4 +14,4 @@ export declare function rewriteTweetImages(tweet: any, imagePath: string, secret
  * Clone the input first if it came from a shared cache — this function does
  * not copy.
  */
-export declare function rewriteBlueskyPostImages(post: any, imagePath: string, secret?: string): void;
+export declare function rewriteBlueskyPostImages(post: any, imagePath: string): void;

package/dist/runtime/server/utils/embed-rewriters.js

@@ -1,30 +1,30 @@
 import { buildProxyUrl } from "./proxy-url.js";
-export function rewriteTweetImages(tweet, imagePath, secret) {
+export function rewriteTweetImages(tweet, imagePath) {
   if (!tweet)
     return;
   if (tweet.user?.profile_image_url_https)
-    tweet.user.profile_image_url_https = buildProxyUrl(imagePath, { url: tweet.user.profile_image_url_https }, secret);
+    tweet.user.profile_image_url_https = buildProxyUrl(imagePath, { url: tweet.user.profile_image_url_https });
   if (tweet.photos) {
     for (const photo of tweet.photos) {
       if (photo.url)
-        photo.url = buildProxyUrl(imagePath, { url: photo.url }, secret);
+        photo.url = buildProxyUrl(imagePath, { url: photo.url });
     }
   }
   if (tweet.entities?.media) {
     for (const media of tweet.entities.media) {
       if (media.media_url_https)
-        media.media_url_https = buildProxyUrl(imagePath, { url: media.media_url_https }, secret);
+        media.media_url_https = buildProxyUrl(imagePath, { url: media.media_url_https });
     }
   }
   if (tweet.video?.poster)
-    tweet.video.poster = buildProxyUrl(imagePath, { url: tweet.video.poster }, secret);
+    tweet.video.poster = buildProxyUrl(imagePath, { url: tweet.video.poster });
   if (tweet.quoted_tweet)
-    rewriteTweetImages(tweet.quoted_tweet, imagePath, secret);
+    rewriteTweetImages(tweet.quoted_tweet, imagePath);
 }
-export function rewriteBlueskyPostImages(post, imagePath, secret) {
+export function rewriteBlueskyPostImages(post, imagePath) {
   if (!post)
     return;
-  const proxy = (url) => url ? buildProxyUrl(imagePath, { url }, secret) : url;
+  const proxy = (url) => url ? buildProxyUrl(imagePath, { url }) : url;
   if (post.author?.avatar)
     post.author.avatar = proxy(post.author.avatar);
   const embed = post.embed;

package/dist/runtime/server/utils/image-proxy.d.ts

@@ -12,4 +12,4 @@ export interface ImageProxyConfig {
     /** Unique name for the nitro cache group (defaults to derived from allowedDomains). */
     cacheName?: string;
 }
-export declare function createImageProxyHandler(config: ImageProxyConfig): import("h3").EventHandler<import("h3").EventHandlerRequest, any>;
+export declare function createImageProxyHandler(config: ImageProxyConfig): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<Buffer<ArrayBufferLike>>>;

package/dist/runtime/server/utils/image-proxy.js

@@ -1,7 +1,6 @@
 import { createError, defineEventHandler, getQuery, setHeader } from "#nuxt-scripts/h3";
 import { createCachedBinaryFetch } from "./cached-upstream.js";
 import { isPublicNetworkHostname } from "./network-host.js";
-import { withSigning } from "./withSigning.js";
 const AMP_RE = /&/g;
 export function createImageProxyHandler(config) {
   const {
@@ -21,7 +20,7 @@ export function createImageProxyHandler(config) {
     allowContentType: contentTypeAllowed,
     allowUrl: urlAllowed
   });
-  return withSigning(defineEventHandler(async (event) => {
+  return defineEventHandler(async (event) => {
     const query = getQuery(event);
     let url = query.url;
     if (decodeAmpersands && url)
@@ -79,5 +78,5 @@ export function createImageProxyHandler(config) {
     setHeader(event, "Content-Security-Policy", "sandbox; default-src 'none'");
     setHeader(event, "X-Content-Type-Options", "nosniff");
     return result.body;
-  }));
+  });
 }

package/dist/runtime/server/utils/instagram-embed.d.ts

@@ -9,15 +9,15 @@ export declare const INSTAGRAM_ASSET_HOST = "static.cdninstagram.com";
 export declare function isSafeInstagramPostUrl(url: URL): boolean;
 export declare function isSafeInstagramEmbedUrl(url: URL): boolean;
 export declare function isSafeInstagramCssUrl(url: URL): boolean;
-export declare function sanitizeInstagramEmbedHtml(html: string, prefix: string, secret?: string): {
+export declare function sanitizeInstagramEmbedHtml(html: string, prefix: string): {
     bodyHtml: string;
     cssUrls: string[];
 };
-export declare function sanitizeInstagramEmbedCss(css: string, scopeSelector: string, prefix: string, secret?: string): string;
-export declare function proxyImageUrl(url: string, prefix?: string, secret?: string): string;
-export declare function proxyAssetUrl(url: string, prefix?: string, secret?: string): string;
-export declare function rewriteUrl(url: string, prefix?: string, secret?: string): string;
-export declare function rewriteUrlsInText(text: string, prefix?: string, secret?: string): string;
+export declare function sanitizeInstagramEmbedCss(css: string, scopeSelector: string, prefix: string): string;
+export declare function proxyImageUrl(url: string, prefix?: string): string;
+export declare function proxyAssetUrl(url: string, prefix?: string): string;
+export declare function rewriteUrl(url: string, prefix?: string): string;
+export declare function rewriteUrlsInText(text: string, prefix?: string): string;
 /**
  * Scope CSS rules under a parent selector and strip global/page-level rules.
  * Removes :root, html, body selectors and @charset/@import at-rules.

package/dist/runtime/server/utils/instagram-embed.js

@@ -88,11 +88,11 @@ function sanitizeCssUrls(css, proxyPrefix) {
     return value.startsWith(allowedPrefix) ? match : 'url("")';
   });
 }
-function rewriteMediaUrl(url, prefix, secret) {
-  const rewritten = rewriteUrl(url, prefix, secret);
+function rewriteMediaUrl(url, prefix) {
+  const rewritten = rewriteUrl(url, prefix);
   return rewritten === url ? void 0 : rewritten;
 }
-export function sanitizeInstagramEmbedHtml(html, prefix, secret) {
+export function sanitizeInstagramEmbedHtml(html, prefix) {
   const ast = parse(html);
   const cssUrls = /* @__PURE__ */ new Set();
   walkSync(ast, (node) => {
@@ -122,7 +122,7 @@ export function sanitizeInstagramEmbedHtml(html, prefix, secret) {
         continue;
       }
       if (lowerName === "src" || lowerName === "poster") {
-        const rewritten = rewriteMediaUrl(value, prefix, secret);
+        const rewritten = rewriteMediaUrl(value, prefix);
         if (rewritten)
           node.attributes[name] = rewritten;
         else
@@ -132,7 +132,7 @@ export function sanitizeInstagramEmbedHtml(html, prefix, secret) {
       if (lowerName === "srcset") {
         const entries = value.split(",").flatMap((entry) => {
           const [url, descriptor, ...rest] = entry.trim().split(SRCSET_SPLIT_RE);
-          const rewritten = url ? rewriteMediaUrl(url, prefix, secret) : void 0;
+          const rewritten = url ? rewriteMediaUrl(url, prefix) : void 0;
           const safeDescriptor = !descriptor || /^\d+(?:\.\d+)?[wx]$/.test(descriptor);
           return rewritten && safeDescriptor && rest.length === 0 ? [`${rewritten}${descriptor ? ` ${descriptor}` : ""}`] : [];
         });
@@ -143,7 +143,7 @@ export function sanitizeInstagramEmbedHtml(html, prefix, secret) {
         continue;
       }
       if (lowerName === "style") {
-        const rewritten = rewriteUrlsInText(value, prefix, secret);
+        const rewritten = rewriteUrlsInText(value, prefix);
         if (DANGEROUS_STYLE_RE.test(rewritten))
           delete node.attributes[name];
         else
@@ -163,33 +163,32 @@ export function sanitizeInstagramEmbedHtml(html, prefix, secret) {
     cssUrls: [...cssUrls]
   };
 }
-export function sanitizeInstagramEmbedCss(css, scopeSelector, prefix, secret) {
+export function sanitizeInstagramEmbedCss(css, scopeSelector, prefix) {
   const rewritten = rewriteUrlsInText(
-    css.replace(RSRC_RE, (_match, path) => `url(${proxyAssetUrl(`https://${INSTAGRAM_ASSET_HOST}/rsrc.php${path}`, prefix, secret)})`),
-    prefix,
-    secret
+    css.replace(RSRC_RE, (_match, path) => `url(${proxyAssetUrl(`https://${INSTAGRAM_ASSET_HOST}/rsrc.php${path}`, prefix)})`),
+    prefix
   );
   return sanitizeCssUrls(scopeCss(rewritten, scopeSelector), prefix).replace(/<\/style/gi, "<\\/style");
 }
-export function proxyImageUrl(url, prefix = "/_scripts", secret) {
-  return buildProxyUrl(`${prefix}/embed/instagram-image`, { url: url.replace(AMP_RE, "&") }, secret);
+export function proxyImageUrl(url, prefix = "/_scripts") {
+  return buildProxyUrl(`${prefix}/embed/instagram-image`, { url: url.replace(AMP_RE, "&") });
 }
-export function proxyAssetUrl(url, prefix = "/_scripts", secret) {
-  return buildProxyUrl(`${prefix}/embed/instagram-asset`, { url: url.replace(AMP_RE, "&") }, secret);
+export function proxyAssetUrl(url, prefix = "/_scripts") {
+  return buildProxyUrl(`${prefix}/embed/instagram-asset`, { url: url.replace(AMP_RE, "&") });
 }
-export function rewriteUrl(url, prefix = "/_scripts", secret) {
+export function rewriteUrl(url, prefix = "/_scripts") {
   try {
     const parsed = new URL(url);
     if (parsed.hostname === INSTAGRAM_ASSET_HOST)
-      return proxyAssetUrl(url, prefix, secret);
+      return proxyAssetUrl(url, prefix);
     if (INSTAGRAM_IMAGE_HOSTS.some((h) => parsed.hostname === h || parsed.hostname.endsWith(`.cdninstagram.com`)))
-      return proxyImageUrl(url, prefix, secret);
+      return proxyImageUrl(url, prefix);
   } catch {
   }
   return url;
 }
-export function rewriteUrlsInText(text, prefix = "/_scripts", secret) {
-  return text.replace(SCONTENT_RE, (m) => proxyImageUrl(m, prefix, secret)).replace(STATIC_CDN_RE, (m) => proxyAssetUrl(m, prefix, secret)).replace(LOOKASIDE_RE, (m) => proxyImageUrl(m, prefix, secret));
+export function rewriteUrlsInText(text, prefix = "/_scripts") {
+  return text.replace(SCONTENT_RE, (m) => proxyImageUrl(m, prefix)).replace(STATIC_CDN_RE, (m) => proxyAssetUrl(m, prefix)).replace(LOOKASIDE_RE, (m) => proxyImageUrl(m, prefix));
 }
 export function scopeCss(css, scopeSelector) {
   let result = css.replace(CHARSET_RE, "");

package/dist/runtime/server/utils/proxy-url.d.ts

@@ -1,9 +1,8 @@
 /**
- * Build a proxy URL with query params, signing it when a secret is available.
+ * Build a proxy URL with query params.
  *
- * Used by embed handlers that inject proxy URLs into HTML/JSON responses.
- * When `secret` is set, URLs are HMAC-signed so clients can fetch them without
- * needing a page token. When it's undefined, URLs fall back to unsigned form
- * (which is only safe when the `withSigning` middleware has no secret either).
+ * Used by embed handlers that inject proxy URLs into HTML/JSON responses so
+ * the client loads upstream assets through the site origin. The proxy
+ * endpoints are restricted to an allowlist of upstream domains.
  */
-export declare function buildProxyUrl(path: string, query: Record<string, unknown>, secret?: string): string;
+export declare function buildProxyUrl(path: string, query: Record<string, unknown>): string;

package/dist/runtime/server/utils/proxy-url.js

@@ -1,7 +1,4 @@
-import { buildSignedProxyUrl } from "./sign.js";
-export function buildProxyUrl(path, query, secret) {
-  if (secret)
-    return buildSignedProxyUrl(path, query, secret);
+export function buildProxyUrl(path, query) {
   const parts = [];
   for (const [key, value] of Object.entries(query)) {
     if (value === void 0 || value === null)

package/dist/runtime/server/x-embed-image.d.ts

@@ -1,2 +1,2 @@
-declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, any>;
+declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<Buffer<ArrayBufferLike>>>;
 export default _default;

package/dist/runtime/server/x-embed.d.ts

@@ -1,2 +1,49 @@
-declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, any>;
+interface TweetData {
+    id_str: string;
+    text: string;
+    created_at: string;
+    favorite_count: number;
+    conversation_count: number;
+    user: {
+        name: string;
+        screen_name: string;
+        profile_image_url_https: string;
+        verified?: boolean;
+        is_blue_verified?: boolean;
+    };
+    entities?: {
+        media?: Array<{
+            media_url_https: string;
+            type: string;
+            sizes: Record<string, {
+                w: number;
+                h: number;
+            }>;
+        }>;
+        urls?: Array<{
+            url: string;
+            expanded_url: string;
+            display_url: string;
+        }>;
+    };
+    photos?: Array<{
+        url: string;
+        width: number;
+        height: number;
+    }>;
+    video?: {
+        poster: string;
+        variants: Array<{
+            type: string;
+            src: string;
+        }>;
+    };
+    quoted_tweet?: TweetData;
+    parent?: {
+        user: {
+            screen_name: string;
+        };
+    };
+}
+declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<TweetData>>;
 export default _default;

package/dist/runtime/server/x-embed.js

@@ -1,8 +1,6 @@
 import { createError, defineEventHandler, getQuery, setHeader } from "#nuxt-scripts/h3";
-import { useRuntimeConfig } from "#nuxt-scripts/nitro";
 import { createCachedJsonFetch, isSafeHttpsUrl } from "./utils/cached-upstream.js";
 import { rewriteTweetImages } from "./utils/embed-rewriters.js";
-import { withSigning } from "./utils/withSigning.js";
 const TWEET_ID_RE = /^\d+$/;
 const EMBED_X_SUFFIX_RE = /\/embed\/x$/;
 const TWEET_ID_FROM_URL_RE = /[?&]id=(\d+)/;
@@ -18,7 +16,7 @@ const cachedTweetFetch = createCachedJsonFetch(
     contentTypePrefixes: ["application/json"]
   }
 );
-export default withSigning(defineEventHandler(async (event) => {
+export default defineEventHandler(async (event) => {
   const query = getQuery(event);
   const tweetId = query.id;
   if (!tweetId || !TWEET_ID_RE.test(tweetId)) {
@@ -47,9 +45,8 @@ export default withSigning(defineEventHandler(async (event) => {
   const handlerPath = event.path?.split("?")[0] || "";
   const prefix = handlerPath.replace(EMBED_X_SUFFIX_RE, "") || "/_scripts";
   const imagePath = `${prefix}/embed/x-image`;
-  const secret = useRuntimeConfig()["nuxt-scripts"]?.proxySecret;
-  rewriteTweetImages(tweetData, imagePath, secret);
+  rewriteTweetImages(tweetData, imagePath);
   setHeader(event, "Content-Type", "application/json");
   setHeader(event, "Cache-Control", "public, max-age=600, s-maxage=600");
   return tweetData;
-}));
+});

package/dist/runtime/types.d.ts

@@ -1,4 +1,4 @@
-import type { UseScriptInput, UseScriptOptions, VueScriptInstance } from '@unhead/vue/scripts';
+import type { UseScriptInput, UseScriptOptions, VueScriptInstance, VueScriptScope } from '@unhead/vue/scripts';
 import type { Script } from '@unhead/vue/types';
 import type { Import } from 'unimport';
 import type { InferInput, ObjectEntries, ObjectSchema, UnionSchema, ValiError } from 'valibot';
@@ -11,6 +11,7 @@ import type { ClarityInput } from './registry/clarity.js';
 import type { CloudflareWebAnalyticsInput } from './registry/cloudflare-web-analytics.js';
 import type { CrispInput } from './registry/crisp.js';
 import type { DatabuddyAnalyticsInput } from './registry/databuddy-analytics.js';
+import type { DeskCrewInput } from './registry/deskcrew.js';
 import type { FathomAnalyticsInput } from './registry/fathom-analytics.js';
 import type { GoogleAdsenseInput } from './registry/google-adsense.js';
 import type { GoogleAnalyticsInput } from './registry/google-analytics.js';
@@ -22,8 +23,10 @@ import type { GravatarInput } from './registry/gravatar.js';
 import type { HotjarInput } from './registry/hotjar.js';
 import type { InstagramEmbedInput } from './registry/instagram-embed.js';
 import type { IntercomInput } from './registry/intercom.js';
+import type { LeafletInput } from './registry/leaflet.js';
 import type { LemonSqueezyInput } from './registry/lemon-squeezy.js';
 import type { LinkedInInsightInput } from './registry/linkedin-insight.js';
+import type { MapLibreInput } from './registry/maplibre.js';
 import type { MatomoAnalyticsInput } from './registry/matomo-analytics.js';
 import type { MetaPixelInput } from './registry/meta-pixel.js';
 import type { MixpanelAnalyticsInput } from './registry/mixpanel-analytics.js';
@@ -81,7 +84,7 @@ export interface GcmConsentApi {
     /** Push `['consent','update', state]` (or equivalent gtag call) with GCMv2 partial state. */
     update: (state: ConsentState) => void;
 }
-export type UseScriptContext<T extends Record<symbol | string, any>, C = unknown> = VueScriptInstance<T> & {
+export type UseScriptContext<T extends Record<symbol | string, any>, C = unknown> = VueScriptScope<T> & {
     /**
      * Remove and reload the script. Useful for scripts that need to re-execute
      * after SPA navigation (e.g., DOM-scanning scripts like iubenda).
@@ -240,6 +243,7 @@ export interface ScriptRegistry {
     carbonAds?: true;
     calendly?: CalendlyInput;
     crisp?: CrispInput;
+    deskcrew?: DeskCrewInput;
     clarity?: ClarityInput;
     cloudflareWebAnalytics?: CloudflareWebAnalyticsInput;
     databuddyAnalytics?: DatabuddyAnalyticsInput;
@@ -250,6 +254,8 @@ export interface ScriptRegistry {
     googleAdsense?: GoogleAdsenseInput;
     googleAnalytics?: GoogleAnalyticsInput;
     googleMaps?: GoogleMapsInput;
+    leaflet?: LeafletInput;
+    maplibre?: MapLibreInput;
     googleRecaptcha?: GoogleRecaptchaInput;
     googleSignIn?: GoogleSignInInput;
     lemonSqueezy?: LemonSqueezyInput;
@@ -283,14 +289,14 @@ export interface ScriptRegistry {
  * Built-in registry script keys — not affected by module augmentation.
  * Use this to type-check records that must enumerate all built-in scripts (logos, meta, etc.).
  */
-export type BuiltInRegistryScriptKey = 'ahrefsAnalytics' | 'bingUet' | 'blueskyEmbed' | 'calendly' | 'carbonAds' | 'crisp' | 'clarity' | 'cloudflareWebAnalytics' | 'databuddyAnalytics' | 'metaPixel' | 'fathomAnalytics' | 'instagramEmbed' | 'plausibleAnalytics' | 'googleAdsense' | 'googleAnalytics' | 'googleMaps' | 'googleRecaptcha' | 'googleSignIn' | 'lemonSqueezy' | 'googleTagManager' | 'hotjar' | 'intercom' | 'linkedinInsight' | 'paypal' | 'posthog' | 'matomoAnalytics' | 'mixpanelAnalytics' | 'rybbitAnalytics' | 'redditPixel' | 'segment' | 'stripe' | 'tiktokPixel' | 'xEmbed' | 'xPixel' | 'snapchatPixel' | 'speedcurve' | 'youtubePlayer' | 'vercelAnalytics' | 'vimeoPlayer' | 'umamiAnalytics' | 'usercentrics' | 'gravatar' | 'npm';
+export type BuiltInRegistryScriptKey = 'ahrefsAnalytics' | 'bingUet' | 'blueskyEmbed' | 'calendly' | 'carbonAds' | 'crisp' | 'clarity' | 'cloudflareWebAnalytics' | 'databuddyAnalytics' | 'deskcrew' | 'metaPixel' | 'fathomAnalytics' | 'instagramEmbed' | 'plausibleAnalytics' | 'googleAdsense' | 'googleAnalytics' | 'googleMaps' | 'leaflet' | 'maplibre' | 'googleRecaptcha' | 'googleSignIn' | 'lemonSqueezy' | 'googleTagManager' | 'hotjar' | 'intercom' | 'linkedinInsight' | 'paypal' | 'posthog' | 'matomoAnalytics' | 'mixpanelAnalytics' | 'rybbitAnalytics' | 'redditPixel' | 'segment' | 'stripe' | 'tiktokPixel' | 'xEmbed' | 'xPixel' | 'snapchatPixel' | 'speedcurve' | 'youtubePlayer' | 'vercelAnalytics' | 'vimeoPlayer' | 'umamiAnalytics' | 'usercentrics' | 'gravatar' | 'npm';
 /**
  * Union of all explicit registry script keys (excludes npm pattern).
  * Includes both built-in and augmented keys.
  */
 export type RegistryScriptKey = Exclude<keyof ScriptRegistry, `${string}-npm`>;
 type RegistryConfigInput<T> = 0 extends 1 & T ? Record<string, any> : [T] extends [true] ? Record<string, never> : T;
-export type NuxtConfigScriptRegistryEntry<T> = true | false | 'mock' | (RegistryConfigInput<T> & {
+export type NuxtConfigScriptRegistryEntry<T> = false | 'mock' | (RegistryConfigInput<T> & {
     trigger?: NuxtUseScriptOptionsSerializable['trigger'] | false;
     proxy?: boolean;
     bundle?: boolean;
@@ -304,8 +310,10 @@ export interface NuxtConfigScriptRegistry extends _NuxtConfigScriptRegistryEntri
     [key: string]: any;
 }
 export type UseFunctionType<T, U> = T extends {
+    resolve: infer V;
+} ? V extends (...args: any) => any ? NonNullable<Awaited<ReturnType<V>>> : U : T extends {
     use: infer V;
-} ? V extends (...args: any) => any ? ReturnType<V> : U : U;
+} ? V extends (...args: any) => any ? NonNullable<Awaited<ReturnType<V>>> : U : U;
 export type EmptyOptionsSchema = ObjectSchema<ObjectEntries, undefined>;
 type ScriptInput = Script;
 export type InferIfSchema<T> = T extends ObjectSchema<any, any> | UnionSchema<any, any> ? InferInput<T> : T;
@@ -322,14 +330,6 @@ export interface RegistryScriptServerHandler {
     route: string;
     handler: string;
     middleware?: boolean;
-    /**
-     * Whether this handler verifies HMAC signatures via `withSigning()`.
-     *
-     * When any enabled script registers a handler with `requiresSigning: true`,
-     * the module enforces that `NUXT_SCRIPTS_PROXY_SECRET` is set in production,
-     * and the `/_scripts/sign` endpoint will accept this route as a signable path.
-     */
-    requiresSigning?: boolean;
 }
 /**
  * Declares what optimization modes a script supports and what's active by default.