@nuxt/scripts 1.3.6 → 2.0.0-beta.1

package/dist/runtime/registry/schemas.d.ts

@@ -9,6 +9,32 @@ export declare const gcmConsentState: import("valibot").ObjectSchema<{
     readonly wait_for_update: import("valibot").OptionalSchema<import("valibot").NumberSchema<undefined>, undefined>;
     readonly region: import("valibot").OptionalSchema<import("valibot").ArraySchema<import("valibot").StringSchema<undefined>, undefined>, undefined>;
 }, undefined>;
+export declare const LeafletOptions: import("valibot").ObjectSchema<{
+    /**
+     * Inject the Leaflet 1.9.4 styles and default marker images when the script
+     * begins loading. Disable this when supplying your own Leaflet stylesheet.
+     * @default true
+     */
+    readonly injectStyles: import("valibot").OptionalSchema<import("valibot").BooleanSchema<undefined>, undefined>;
+}, undefined>;
+export declare const MapLibreOptions: import("valibot").ObjectSchema<{
+    /**
+     * Inject the MapLibre GL JS 5.24.0 stylesheet when the script begins
+     * loading. Disable this when supplying the stylesheet through Nuxt.
+     * @default true
+     */
+    readonly injectStyles: import("valibot").OptionalSchema<import("valibot").BooleanSchema<undefined>, undefined>;
+    /**
+     * Stylesheet URL used when `injectStyles` is enabled.
+     * @default 'https://unpkg.com/maplibre-gl@5.24.0/dist/maplibre-gl.css'
+     */
+    readonly stylesheetUrl: import("valibot").OptionalSchema<import("valibot").StringSchema<undefined>, undefined>;
+    /**
+     * Worker URL for the CSP-compatible MapLibre build. Pair this with a custom
+     * `scriptInput.src` that loads `maplibre-gl-csp.js`.
+     */
+    readonly workerUrl: import("valibot").OptionalSchema<import("valibot").StringSchema<undefined>, undefined>;
+}, undefined>;
 export declare const AhrefsAnalyticsOptions: import("valibot").ObjectSchema<{
     /**
      * Your Ahrefs Web Analytics project key. Set as the `data-key` attribute
@@ -240,6 +266,41 @@ export declare const DatabuddyAnalyticsOptions: import("valibot").ObjectSchema<{
      */
     readonly enableErrorTracking: import("valibot").OptionalSchema<import("valibot").BooleanSchema<undefined>, undefined>;
 }, undefined>;
+export declare const DeskCrewOptions: import("valibot").ObjectSchema<{
+    /**
+     * The DeskCrew public widget key, for example `pub_xxxxxxxx`.
+     * Rendered as the `data-key` attribute. Find it in the DeskCrew dashboard under Install.
+     * @see https://deskcrew.io/integrations/nuxt
+     */
+    readonly widgetKey: import("valibot").SchemaWithPipe<readonly [import("valibot").StringSchema<undefined>, import("valibot").MinLengthAction<string, 1, undefined>]>;
+    /**
+     * The workspace board slug, lowercase letters, numbers and dashes only.
+     * Rendered as the `data-board` attribute. Required for the help centre, changelog and
+     * embedded portal surfaces; the chat launcher works without it.
+     */
+    readonly board: import("valibot").OptionalSchema<import("valibot").StringSchema<undefined>, undefined>;
+    /**
+     * Accent colour as a 6 digit hex value, for example `#4f46e5`.
+     * Rendered as the `data-color` attribute. Overrides the accent configured on the workspace.
+     */
+    readonly color: import("valibot").OptionalSchema<import("valibot").StringSchema<undefined>, undefined>;
+    /**
+     * Which side of the viewport the launcher sits on.
+     * Rendered as the `data-position` attribute.
+     * @default 'right'
+     */
+    readonly position: import("valibot").OptionalSchema<import("valibot").UnionSchema<[import("valibot").LiteralSchema<"left", undefined>, import("valibot").LiteralSchema<"right", undefined>], undefined>, undefined>;
+    /**
+     * Greeting text shown in the widget header, overriding the workspace default.
+     * Rendered as the `data-greeting` attribute.
+     */
+    readonly greeting: import("valibot").OptionalSchema<import("valibot").StringSchema<undefined>, undefined>;
+    /**
+     * Render the workspace logo in the launcher bubble instead of the default icon.
+     * Rendered as the `data-launcher` attribute.
+     */
+    readonly launcher: import("valibot").OptionalSchema<import("valibot").LiteralSchema<"logo", undefined>, undefined>;
+}, undefined>;
 export declare const FathomAnalyticsOptions: import("valibot").ObjectSchema<{
     /**
      * The Fathom Analytics site ID.
@@ -591,11 +652,6 @@ export declare const MatomoAnalyticsOptions: import("valibot").ObjectSchema<{
      * A custom tracker URL. Overrides the default tracker endpoint derived from `matomoUrl` or `cloudId`.
      */
     readonly trackerUrl: import("valibot").OptionalSchema<import("valibot").StringSchema<undefined>, undefined>;
-    /**
-     * Whether to track the initial page view on load.
-     * @deprecated Use `watch: true` (default) for automatic page view tracking.
-     */
-    readonly trackPageView: import("valibot").OptionalSchema<import("valibot").BooleanSchema<undefined>, undefined>;
     /**
      * Enable download and outlink tracking.
      */

package/dist/runtime/registry/schemas.js

@@ -11,6 +11,32 @@ export const gcmConsentState = object({
   wait_for_update: optional(number()),
   region: optional(array(string()))
 });
+export const LeafletOptions = object({
+  /**
+   * Inject the Leaflet 1.9.4 styles and default marker images when the script
+   * begins loading. Disable this when supplying your own Leaflet stylesheet.
+   * @default true
+   */
+  injectStyles: optional(boolean())
+});
+export const MapLibreOptions = object({
+  /**
+   * Inject the MapLibre GL JS 5.24.0 stylesheet when the script begins
+   * loading. Disable this when supplying the stylesheet through Nuxt.
+   * @default true
+   */
+  injectStyles: optional(boolean()),
+  /**
+   * Stylesheet URL used when `injectStyles` is enabled.
+   * @default 'https://unpkg.com/maplibre-gl@5.24.0/dist/maplibre-gl.css'
+   */
+  stylesheetUrl: optional(string()),
+  /**
+   * Worker URL for the CSP-compatible MapLibre build. Pair this with a custom
+   * `scriptInput.src` that loads `maplibre-gl-csp.js`.
+   */
+  workerUrl: optional(string())
+});
 export const AhrefsAnalyticsOptions = object({
   /**
    * Your Ahrefs Web Analytics project key. Set as the `data-key` attribute
@@ -239,6 +265,44 @@ export const DatabuddyAnalyticsOptions = object({
    */
   enableErrorTracking: optional(boolean())
 });
+export const DeskCrewOptions = object({
+  /**
+   * The DeskCrew public widget key, for example `pub_xxxxxxxx`.
+   * Rendered as the `data-key` attribute. Find it in the DeskCrew dashboard under Install.
+   * @see https://deskcrew.io/integrations/nuxt
+   */
+  // minLength(1) rather than a bare string(): envDefaults resolves an unset key to '',
+  // which would validate happily and render data-key="" onto the tag, booting a keyless
+  // widget that silently talks to no workspace. Failing loudly in dev is the point.
+  widgetKey: pipe(string(), minLength(1)),
+  /**
+   * The workspace board slug, lowercase letters, numbers and dashes only.
+   * Rendered as the `data-board` attribute. Required for the help centre, changelog and
+   * embedded portal surfaces; the chat launcher works without it.
+   */
+  board: optional(string()),
+  /**
+   * Accent colour as a 6 digit hex value, for example `#4f46e5`.
+   * Rendered as the `data-color` attribute. Overrides the accent configured on the workspace.
+   */
+  color: optional(string()),
+  /**
+   * Which side of the viewport the launcher sits on.
+   * Rendered as the `data-position` attribute.
+   * @default 'right'
+   */
+  position: optional(union([literal("left"), literal("right")])),
+  /**
+   * Greeting text shown in the widget header, overriding the workspace default.
+   * Rendered as the `data-greeting` attribute.
+   */
+  greeting: optional(string()),
+  /**
+   * Render the workspace logo in the launcher bubble instead of the default icon.
+   * Rendered as the `data-launcher` attribute.
+   */
+  launcher: optional(literal("logo"))
+});
 export const FathomAnalyticsOptions = object({
   /**
    * The Fathom Analytics site ID.
@@ -547,11 +611,6 @@ export const MatomoAnalyticsOptions = object({
    * A custom tracker URL. Overrides the default tracker endpoint derived from `matomoUrl` or `cloudId`.
    */
   trackerUrl: optional(string()),
-  /**
-   * Whether to track the initial page view on load.
-   * @deprecated Use `watch: true` (default) for automatic page view tracking.
-   */
-  trackPageView: optional(boolean()),
   /**
    * Enable download and outlink tracking.
    */

package/dist/runtime/registry/tiktok-pixel.d.ts

@@ -68,18 +68,8 @@ export interface TtqInstance {
     enableCookie: () => void;
     disableCookie: () => void;
 }
-/**
- * Legacy callable signature. Pre-1.2 `useScriptTikTokPixel` exposed `ttq` as an
- * `fbq`-style callable (`ttq('page')`, `ttq('track', …)`); the adapter keeps it
- * working alongside the method form.
- */
-type TtqCallable = ((cmd: 'track', event: StandardEvents | (string & {}), properties?: EventProperties, options?: TrackOptions) => void) & ((cmd: 'page') => void) & ((cmd: 'identify', properties: IdentifyProperties) => void) & ((cmd: (string & {}), ...args: any[]) => void);
-/**
- * The public `ttq` returned by the composable: a callable adapter (legacy form)
- * that also carries the deferred methods (`ttq.page()`, `ttq.track(…)`). The
- * adapter forwards to `window.ttq`, which is TikTok's real array protocol.
- */
-export type Ttq = TtqCallable & TtqInstance & {
+/** The method-based `ttq` API returned by the composable. */
+export type Ttq = TtqInstance & {
     /** Resolve the per-pixel method bag for a specific pixel id. */
     instance: (id: string) => TtqInstance;
 };

package/dist/runtime/registry/tiktok-pixel.js

@@ -24,7 +24,7 @@ function createTtqAdapter() {
       warnUnhashedIdentify(args[0]);
     return window.ttq[method]?.(...args);
   };
-  const adapter = ((method, ...args) => dispatch(method, ...args));
+  const adapter = {};
   for (const method of [...TTQ_METHODS, "instance"])
     adapter[method] = (...args) => dispatch(method, ...args);
   return adapter;

package/dist/runtime/registry/usercentrics.js

@@ -1,7 +1,6 @@
 import { useHead } from "@unhead/vue";
-import { useNuxtApp } from "nuxt/app";
+import { logger } from "../logger.js";
 import { useRegistryScript } from "../utils.js";
-import { attachUsercentricsConsent } from "../utils/usercentrics-consent.js";
 import { UsercentricsOptions } from "./schemas.js";
 export { UsercentricsOptions };
 export function useScriptUsercentrics(_options) {
@@ -25,13 +24,54 @@ export function useScriptUsercentrics(_options) {
       },
       schema: import.meta.dev ? UsercentricsOptions : void 0,
       scriptOptions: {
-        use() {
-          return { ucCmp: window.__ucCmp };
+        resolve({ waitFor }) {
+          return waitFor((resolve) => {
+            const onReady = () => {
+              if (window.__ucCmp)
+                resolve({ ucCmp: window.__ucCmp });
+            };
+            window.addEventListener("UC_CMP_API_READY", onReady);
+            const api = window.__ucCmp;
+            if (api?.isInitialized) {
+              Promise.resolve(api.isInitialized()).then((initialized) => {
+                if (initialized)
+                  onReady();
+              }).catch((error) => {
+                logger.debug("[usercentrics] Waiting for UC_CMP_API_READY after isInitialized() failed", error);
+              });
+            }
+            return () => window.removeEventListener("UC_CMP_API_READY", onReady);
+          });
         }
       }
     };
   }, _options);
-  if (import.meta.client)
-    attachUsercentricsConsent(instance, window, (callback) => useNuxtApp().hooks.hook("app:unmount", callback));
+  if (import.meta.client && !instance.consent) {
+    const whenReady = () => instance.load().then((api) => api.ucCmp);
+    instance.consent = {
+      whenReady,
+      onConsentChange(cb) {
+        if (instance.signal.aborted)
+          return () => {
+          };
+        const handler = (e) => cb(e.detail, e);
+        let active = true;
+        const stop = () => {
+          if (!active)
+            return;
+          active = false;
+          window.removeEventListener("UC_UI_CMP_EVENT", handler);
+          instance.signal.removeEventListener("abort", stop);
+        };
+        window.addEventListener("UC_UI_CMP_EVENT", handler);
+        instance.signal.addEventListener("abort", stop, { once: true });
+        return stop;
+      },
+      showFirstLayer: () => whenReady().then((api) => api.showFirstLayer()),
+      showSecondLayer: () => whenReady().then((api) => api.showSecondLayer()),
+      acceptAll: () => whenReady().then((api) => api.acceptAllConsents()),
+      denyAll: () => whenReady().then((api) => api.denyAllConsents())
+    };
+  }
   return instance;
 }

package/dist/runtime/registry/youtube-player.d.ts

@@ -1,7 +1,6 @@
 import type { RegistryScriptInput, UseScriptContext } from '#nuxt-scripts/types';
-import type { MaybePromise } from '../utils.js';
 export interface YouTubePlayerApi {
-    YT: MaybePromise<{
+    YT: {
         Player: YT.Player;
         PlayerState: YT.PlayerState;
         get: (k: string) => any;
@@ -12,11 +11,11 @@ export interface YouTubePlayerApi {
         setConfig: (config: YT.PlayerOptions) => void;
         subscribe: <EventName extends keyof YT.Events>(event: EventName, listener: YT.Events[EventName], context?: any) => void;
         unsubscribe: <EventName extends keyof YT.Events>(event: EventName, listener: YT.Events[EventName], context?: any) => void;
-    }>;
+    };
 }
 declare global {
     interface Window extends YouTubePlayerApi {
-        onYouTubeIframeAPIReady: () => void;
+        onYouTubeIframeAPIReady?: () => void;
     }
 }
 export type YouTubePlayerInput = RegistryScriptInput;

package/dist/runtime/registry/youtube-player.js

@@ -1,9 +1,6 @@
 import { useHead } from "@unhead/vue";
 import { watch } from "vue";
 import { useRegistryScript } from "../utils.js";
-import { armYouTubeReadiness, useYouTubeReadinessState } from "../utils/youtube-readiness.js";
-const cleanupDecoration = Symbol("nuxt-scripts:youtube-cleanup");
-const readinessDecoration = Symbol("nuxt-scripts:youtube-readiness");
 export function useScriptYouTubePlayer(_options) {
   const instance = useRegistryScript("youtubePlayer", () => ({
     scriptInput: {
@@ -12,29 +9,39 @@ export function useScriptYouTubePlayer(_options) {
       // crossorigin can't be set or it breaks
     },
     scriptOptions: {
-      use() {
-        const readiness = useYouTubeReadinessState();
-        return {
-          YT: window.YT || readiness.promise.then(() => {
-            return window.YT;
-          })
-        };
+      resolve({ waitFor }) {
+        if (typeof window.YT?.Player === "function")
+          return { YT: window.YT };
+        return waitFor((resolve, reject) => {
+          const previousReady = window.onYouTubeIframeAPIReady;
+          let onReady;
+          const restoreReady = () => {
+            if (window.onYouTubeIframeAPIReady !== onReady)
+              return;
+            if (previousReady)
+              window.onYouTubeIframeAPIReady = previousReady;
+            else
+              delete window.onYouTubeIframeAPIReady;
+          };
+          onReady = () => {
+            restoreReady();
+            try {
+              previousReady?.();
+            } catch (error) {
+              if (import.meta.dev)
+                console.error("[nuxt-scripts] Previous onYouTubeIframeAPIReady handler failed:", error);
+            }
+            if (typeof window.YT?.Player === "function")
+              resolve({ YT: window.YT });
+            else
+              reject(new Error("[nuxt-scripts] YouTube reported ready without exposing window.YT.Player"));
+          };
+          window.onYouTubeIframeAPIReady = onReady;
+          return restoreReady;
+        });
       }
-    },
-    clientInit: import.meta.server ? void 0 : () => {
-      armYouTubeReadiness(useYouTubeReadinessState());
     }
   }), _options);
-  const clientInstance = import.meta.server || typeof window === "undefined" ? void 0 : instance;
-  if (clientInstance && !clientInstance[cleanupDecoration]) {
-    clientInstance[cleanupDecoration] = true;
-    clientInstance[readinessDecoration] = useYouTubeReadinessState();
-    const originalRemove = instance.remove;
-    instance.remove = () => {
-      clientInstance[readinessDecoration]?.controller?.abort();
-      return originalRemove();
-    };
-  }
   if (import.meta.client) {
     const _ = watch(instance.status, (status) => {
       if (status === "loading") {

package/dist/runtime/server/bluesky-embed-image.d.ts

@@ -1,2 +1,2 @@
-declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, any>;
+declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<Buffer<ArrayBufferLike>>>;
 export default _default;

package/dist/runtime/server/bluesky-embed.d.ts

@@ -1,2 +1,2 @@
-declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, any>;
+declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<Record<string, any>>>;
 export default _default;

package/dist/runtime/server/bluesky-embed.js

@@ -1,8 +1,6 @@
 import { createError, defineEventHandler, getQuery, setHeader } from "#nuxt-scripts/h3";
-import { useRuntimeConfig } from "#nuxt-scripts/nitro";
 import { createCachedJsonFetch, isSafeHttpsUrl } from "./utils/cached-upstream.js";
 import { rewriteBlueskyPostImages } from "./utils/embed-rewriters.js";
-import { withSigning } from "./utils/withSigning.js";
 const BSKY_POST_URL_RE = /^https:\/\/bsky\.app\/profile\/([^/]+)\/post\/([^/?]+)$/;
 const EMBED_BSKY_SUFFIX_RE = /\/embed\/bluesky$/;
 const allowBlueskyApiUrl = (url) => isSafeHttpsUrl(url) && url.hostname === "public.api.bsky.app";
@@ -24,7 +22,7 @@ const cachedPostFetch = createCachedJsonFetch(
     contentTypePrefixes: ["application/json"]
   }
 );
-export default withSigning(defineEventHandler(async (event) => {
+export default defineEventHandler(async (event) => {
   const query = getQuery(event);
   const postUrl = query.url;
   if (!postUrl) {
@@ -79,9 +77,8 @@ export default withSigning(defineEventHandler(async (event) => {
   const handlerPath = event.path?.split("?")[0] || "";
   const prefix = handlerPath.replace(EMBED_BSKY_SUFFIX_RE, "") || "/_scripts";
   const imagePath = `${prefix}/embed/bluesky-image`;
-  const secret = useRuntimeConfig()["nuxt-scripts"]?.proxySecret;
-  rewriteBlueskyPostImages(post, imagePath, secret);
+  rewriteBlueskyPostImages(post, imagePath);
   setHeader(event, "Content-Type", "application/json");
   setHeader(event, "Cache-Control", "public, max-age=600, s-maxage=600");
   return post;
-}));
+});

package/dist/runtime/server/gravatar-proxy.d.ts

@@ -1,2 +1,2 @@
-declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, any>;
+declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<Buffer<ArrayBufferLike>>>;
 export default _default;

package/dist/runtime/server/gravatar-proxy.js

@@ -2,7 +2,6 @@ import { withQuery } from "ufo";
 import { createError, defineEventHandler, getQuery, setHeader } from "#nuxt-scripts/h3";
 import { useRuntimeConfig } from "#nuxt-scripts/nitro";
 import { createCachedBinaryFetch, isSafeHttpsUrl } from "./utils/cached-upstream.js";
-import { withSigning } from "./utils/withSigning.js";
 const GRAVATAR_HASH_RE = /^[a-f\d]{64}$/i;
 const GRAVATAR_RATINGS = /* @__PURE__ */ new Set(["g", "pg", "r", "x"]);
 function firstString(value) {
@@ -12,7 +11,7 @@ const cachedGravatarFetch = createCachedBinaryFetch("nuxt-scripts-gravatar", 360
   allowContentType: (contentType) => contentType.startsWith("image/") && contentType !== "image/svg+xml",
   allowUrl: (url) => isSafeHttpsUrl(url) && (url.hostname === "gravatar.com" || url.hostname.endsWith(".gravatar.com"))
 });
-export default withSigning(defineEventHandler(async (event) => {
+export default defineEventHandler(async (event) => {
   const runtimeConfig = useRuntimeConfig();
   const proxyConfig = runtimeConfig.public["nuxt-scripts"]?.gravatarProxy;
   const query = getQuery(event);
@@ -80,4 +79,4 @@ export default withSigning(defineEventHandler(async (event) => {
   setHeader(event, "Vary", "Accept-Encoding");
   setHeader(event, "X-Content-Type-Options", "nosniff");
   return result.body;
-}));
+});

package/dist/runtime/server/instagram-embed-asset.d.ts

@@ -1,2 +1,2 @@
-declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, any>;
+declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<Buffer<ArrayBufferLike>>>;
 export default _default;

package/dist/runtime/server/instagram-embed-image.d.ts

@@ -1,2 +1,2 @@
-declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, any>;
+declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<Buffer<ArrayBufferLike>>>;
 export default _default;

package/dist/runtime/server/instagram-embed.d.ts

@@ -1,3 +1,3 @@
 export { proxyAssetUrl, proxyImageUrl, rewriteUrl, rewriteUrlsInText, scopeCss } from './utils/instagram-embed.js';
-declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, any>;
+declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<string>>;
 export default _default;

package/dist/runtime/server/instagram-embed.js

@@ -1,8 +1,6 @@
 import { createError, defineEventHandler, getQuery, setHeader } from "#nuxt-scripts/h3";
-import { useRuntimeConfig } from "#nuxt-scripts/nitro";
 import { createCachedJsonFetch } from "./utils/cached-upstream.js";
 import { isEmbedShell, isSafeInstagramCssUrl, isSafeInstagramEmbedUrl, isSafeInstagramPostUrl, sanitizeInstagramEmbedCss, sanitizeInstagramEmbedHtml } from "./utils/instagram-embed.js";
-import { withSigning } from "./utils/withSigning.js";
 export { proxyAssetUrl, proxyImageUrl, rewriteUrl, rewriteUrlsInText, scopeCss } from "./utils/instagram-embed.js";
 const EMBED_INSTAGRAM_SUFFIX_RE = /\/embed\/instagram$/;
 const cachedEmbedFetch = createCachedJsonFetch(
@@ -38,10 +36,9 @@ const cachedCssFetch = createCachedJsonFetch(
     contentTypePrefixes: ["text/css"]
   }
 );
-export default withSigning(defineEventHandler(async (event) => {
+export default defineEventHandler(async (event) => {
   const handlerPath = event.path?.split("?")[0] || "";
   const prefix = handlerPath.replace(EMBED_INSTAGRAM_SUFFIX_RE, "") || "/_scripts";
-  const secret = useRuntimeConfig()["nuxt-scripts"]?.proxySecret;
   const query = getQuery(event);
   const postUrl = query.url;
   const captions = query.captions === "true";
@@ -84,7 +81,7 @@ export default withSigning(defineEventHandler(async (event) => {
       statusMessage: error.statusMessage || "Failed to fetch Instagram embed"
     });
   });
-  const { bodyHtml, cssUrls } = sanitizeInstagramEmbedHtml(html, prefix, secret);
+  const { bodyHtml, cssUrls } = sanitizeInstagramEmbedHtml(html, prefix);
   const cssContents = await Promise.all(
     cssUrls.map(
       (url) => cachedCssFetch(url, {
@@ -94,7 +91,7 @@ export default withSigning(defineEventHandler(async (event) => {
       })
     )
   );
-  const combinedCss = sanitizeInstagramEmbedCss(cssContents.join("\n"), ".instagram-embed-root", prefix, secret);
+  const combinedCss = sanitizeInstagramEmbedCss(cssContents.join("\n"), ".instagram-embed-root", prefix);
   const baseStyles = `
     .instagram-embed-root { background: white; max-width: 540px; width: calc(100% - 2px); border-radius: 3px; border: 1px solid rgb(219, 219, 219); display: block; margin: 0px 0px 12px; min-width: 326px; padding: 0px; }
     .instagram-embed-root #splash-screen { display: none !important; }
@@ -108,4 +105,4 @@ ${combinedCss}</style>${bodyHtml}</div>`;
   setHeader(event, "Content-Security-Policy", "sandbox; default-src 'none'");
   setHeader(event, "X-Content-Type-Options", "nosniff");
   return result;
-}));
+});

package/dist/runtime/server/utils/cached-upstream.d.ts

@@ -4,17 +4,10 @@ import { Buffer } from 'node:buffer';
  *
  * ## Why
  *
- * Proxy URLs arriving from the client carry per-request auth artefacts (`sig`,
- * `_pt`, `_ts`) that change across renders. CDNs key on full URL so each
- * rotation produces a unique edge cache entry and upstream origins take the hit
- * on every render. Caching the *upstream response* here — keyed on the inner
- * resource URL (or normalized param set) — dedupes those fetches across every
- * request that resolves to the same upstream, regardless of how the caller
- * authenticated.
- *
- * Safe because `withSigning` runs before any cache path: unsigned requests 403
- * before they can do a cache lookup. Cache stores hold only responses produced
- * from legitimately-authenticated requests.
+ * The same upstream resource is often requested under slightly different proxy
+ * URLs across renders. Caching the *upstream response*, keyed on the inner
+ * resource URL or normalized param set, dedupes those fetches across
+ * every request that resolves to the same upstream.
  *
  * ## Binary payloads
  *

package/dist/runtime/server/utils/embed-rewriters.d.ts

@@ -1,13 +1,11 @@
 /**
  * Mutate a tweet (and any quoted tweet) in place so every raw CDN image URL
- * is rewritten to route through the site's `/embed/x-image` proxy. When a
- * `secret` is provided, URLs are HMAC-signed and pass `withSigning` without a
- * page token.
+ * is rewritten to route through the site's `/embed/x-image` proxy.
  *
  * Clone the input first if it came from a shared cache — this function does
  * not copy.
  */
-export declare function rewriteTweetImages(tweet: any, imagePath: string, secret?: string): void;
+export declare function rewriteTweetImages(tweet: any, imagePath: string): void;
 /**
  * Mutate a Bluesky post in place so every CDN image URL routes through the
  * site's `/embed/bluesky-image` proxy. Covers author avatar, embedded images
@@ -16,4 +14,4 @@ export declare function rewriteTweetImages(tweet: any, imagePath: string, secret
  * Clone the input first if it came from a shared cache — this function does
  * not copy.
  */
-export declare function rewriteBlueskyPostImages(post: any, imagePath: string, secret?: string): void;
+export declare function rewriteBlueskyPostImages(post: any, imagePath: string): void;

package/dist/runtime/server/utils/embed-rewriters.js

@@ -1,30 +1,30 @@
 import { buildProxyUrl } from "./proxy-url.js";
-export function rewriteTweetImages(tweet, imagePath, secret) {
+export function rewriteTweetImages(tweet, imagePath) {
   if (!tweet)
     return;
   if (tweet.user?.profile_image_url_https)
-    tweet.user.profile_image_url_https = buildProxyUrl(imagePath, { url: tweet.user.profile_image_url_https }, secret);
+    tweet.user.profile_image_url_https = buildProxyUrl(imagePath, { url: tweet.user.profile_image_url_https });
   if (tweet.photos) {
     for (const photo of tweet.photos) {
       if (photo.url)
-        photo.url = buildProxyUrl(imagePath, { url: photo.url }, secret);
+        photo.url = buildProxyUrl(imagePath, { url: photo.url });
     }
   }
   if (tweet.entities?.media) {
     for (const media of tweet.entities.media) {
       if (media.media_url_https)
-        media.media_url_https = buildProxyUrl(imagePath, { url: media.media_url_https }, secret);
+        media.media_url_https = buildProxyUrl(imagePath, { url: media.media_url_https });
     }
   }
   if (tweet.video?.poster)
-    tweet.video.poster = buildProxyUrl(imagePath, { url: tweet.video.poster }, secret);
+    tweet.video.poster = buildProxyUrl(imagePath, { url: tweet.video.poster });
   if (tweet.quoted_tweet)
-    rewriteTweetImages(tweet.quoted_tweet, imagePath, secret);
+    rewriteTweetImages(tweet.quoted_tweet, imagePath);
 }
-export function rewriteBlueskyPostImages(post, imagePath, secret) {
+export function rewriteBlueskyPostImages(post, imagePath) {
   if (!post)
     return;
-  const proxy = (url) => url ? buildProxyUrl(imagePath, { url }, secret) : url;
+  const proxy = (url) => url ? buildProxyUrl(imagePath, { url }) : url;
   if (post.author?.avatar)
     post.author.avatar = proxy(post.author.avatar);
   const embed = post.embed;

package/dist/runtime/server/utils/image-proxy.d.ts

@@ -12,4 +12,4 @@ export interface ImageProxyConfig {
     /** Unique name for the nitro cache group (defaults to derived from allowedDomains). */
     cacheName?: string;
 }
-export declare function createImageProxyHandler(config: ImageProxyConfig): import("h3").EventHandler<import("h3").EventHandlerRequest, any>;
+export declare function createImageProxyHandler(config: ImageProxyConfig): import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<Buffer<ArrayBufferLike>>>;

package/dist/runtime/server/utils/image-proxy.js

@@ -1,7 +1,6 @@
 import { createError, defineEventHandler, getQuery, setHeader } from "#nuxt-scripts/h3";
 import { createCachedBinaryFetch } from "./cached-upstream.js";
 import { isPublicNetworkHostname } from "./network-host.js";
-import { withSigning } from "./withSigning.js";
 const AMP_RE = /&/g;
 export function createImageProxyHandler(config) {
   const {
@@ -21,7 +20,7 @@ export function createImageProxyHandler(config) {
     allowContentType: contentTypeAllowed,
     allowUrl: urlAllowed
   });
-  return withSigning(defineEventHandler(async (event) => {
+  return defineEventHandler(async (event) => {
     const query = getQuery(event);
     let url = query.url;
     if (decodeAmpersands && url)
@@ -79,5 +78,5 @@ export function createImageProxyHandler(config) {
     setHeader(event, "Content-Security-Policy", "sandbox; default-src 'none'");
     setHeader(event, "X-Content-Type-Options", "nosniff");
     return result.body;
-  }));
+  });
 }

package/dist/runtime/server/utils/instagram-embed.d.ts

@@ -9,15 +9,15 @@ export declare const INSTAGRAM_ASSET_HOST = "static.cdninstagram.com";
 export declare function isSafeInstagramPostUrl(url: URL): boolean;
 export declare function isSafeInstagramEmbedUrl(url: URL): boolean;
 export declare function isSafeInstagramCssUrl(url: URL): boolean;
-export declare function sanitizeInstagramEmbedHtml(html: string, prefix: string, secret?: string): {
+export declare function sanitizeInstagramEmbedHtml(html: string, prefix: string): {
     bodyHtml: string;
     cssUrls: string[];
 };
-export declare function sanitizeInstagramEmbedCss(css: string, scopeSelector: string, prefix: string, secret?: string): string;
-export declare function proxyImageUrl(url: string, prefix?: string, secret?: string): string;
-export declare function proxyAssetUrl(url: string, prefix?: string, secret?: string): string;
-export declare function rewriteUrl(url: string, prefix?: string, secret?: string): string;
-export declare function rewriteUrlsInText(text: string, prefix?: string, secret?: string): string;
+export declare function sanitizeInstagramEmbedCss(css: string, scopeSelector: string, prefix: string): string;
+export declare function proxyImageUrl(url: string, prefix?: string): string;
+export declare function proxyAssetUrl(url: string, prefix?: string): string;
+export declare function rewriteUrl(url: string, prefix?: string): string;
+export declare function rewriteUrlsInText(text: string, prefix?: string): string;
 /**
  * Scope CSS rules under a parent selector and strip global/page-level rules.
  * Removes :root, html, body selectors and @charset/@import at-rules.