Verify each finding against the current code and only fix it if needed.

Outside diff comments:
In `@test/fixtures/first-party/nuxt.config.ts`:
- Line 38: Update the runtimeConfig.public.scripts entry for vercelAnalytics to
use an object instead of a boolean: locate runtimeConfig.public.scripts and
change the vercelAnalytics value from true to an empty object (vercelAnalytics:
{}) so it matches the registry format used elsewhere (see the existing registry
entry for vercelAnalytics).

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@src/assets.ts`:
- Line 56: The expression creating cleanPath uses (event.path ||
'').split('?')[0] which TypeScript flags as possibly undefined; update the
assignment in src/assets.ts (the cleanPath declaration) to provide a safe
fallback for the split result before calling .slice(1) — e.g. take the first
element of the split with a nullish/empty-string fallback (so the index access
cannot be undefined) or use destructuring with a default, ensuring the final
value passed to .slice is always a string derived from event.path.

Verify each finding against the current code and only fix it if needed.

Duplicate comments:
In `@src/assets.ts`:
- Line 56: The TS2532 arises because event.path can be undefined and indexed
access split('?')[0] is still considered possibly undefined; replace the
non-null assertion with a safe default so the expression always yields a string.
Change the construction of cleanPath to use a nullish-coalescing default on
event.path (e.g., (event.path ?? '') or String(event.path)) before calling split
and slice so that cleanPath is calculated from a guaranteed string; update the
statement that sets cleanPath accordingly (referencing cleanPath and event.path
in your edit).

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@docs/content/docs/1.guides/2.first-party.md`:
- Around line 24-41: The copy incorrectly states that triggerless registry
entries “are bundled”; update the wording in the scripts.registry explanatory
paragraph to avoid saying they are always bundled and instead say that any
supported infrastructure is prepared/registered (proxy routes, composables,
bundling when applicable) — edit the paragraph that mentions `trigger` and the
examples `googleAnalytics`, `metaPixel`, `plausibleAnalytics` to replace “is
bundled” with phrasing like “infrastructure is prepared/registered” and clarify
that bundling only happens for scripts that require it.

In `@src/normalize.ts`:
- Around line 53-65: The current merge applies legacy scriptOptions last and
thus overwrites hoisted top-level flags; change the merge so top-level values
win by combining legacy then top-level (e.g., set mergedScriptOptions =
Object.assign({}, scriptOptions, mergedScriptOptions)) or iterate scriptOptions
and only assign keys that are undefined in mergedScriptOptions; update the code
around scriptOptions / mergedScriptOptions (references: entry, scriptOptions,
mergedScriptOptions, SCRIPT_OPTION_KEYS, input) accordingly.

In `@src/runtime/types.ts`:
- Line 229: NuxtConfigScriptRegistryEntry's object branch creates an
uninhabitable intersection when T can be boolean literal true (e.g.
ScriptRegistry's carbonAds?: true), so change the object branch to first
normalize true to an empty object before intersecting; add a small helper type
(e.g. ReplaceTrueWithEmpty<T>) that maps true to {} and otherwise returns T,
then use ReplaceTrueWithEmpty<T> & { trigger?:
NuxtUseScriptOptionsSerializable['trigger'], proxy?: boolean, bundle?: boolean,
partytown?: boolean, scriptOptions?: Omit<NuxtUseScriptOptionsSerializable,
'trigger'> } (and keep the existing union members) so zero-input scripts like
true can be expressed as the object form {} or { trigger: ... } without
producing an impossible type.

---

Outside diff comments:
In `@src/first-party/setup.ts`:
- Around line 76-84: The early opt-out check only inspects input?.proxy and
scriptOptions?.proxy but ignores the resolved runtime entry, so proxy:false in
runtimeConfig.public.scripts[registryKey] is not respected; update the guard to
also check rtEntry?.proxy === false (ensure rtEntry is read from
runtimeConfig.public?.scripts[registryKey] before returning) so that if the
runtime entry disables proxy we skip injection, and add a regression test that
sets runtimeConfig.public.scripts[registryKey].proxy = false and verifies
apiHost/endpoint are not auto-injected.

In `@src/plugins/transform.ts`:
- Around line 297-323: The bug is that firstPartyOptOut is computed only from
literal call-site args (fnArg0) so registry-level proxy: false is ignored; fix
by deriving the proxy opt-out from the merged config (mergedOptions) with
call-site values overriding it: after you build mergedOptions = {
...registryConfig, ...fnArg0 } use mergedOptions.proxy as the default when
computing firstPartyOptOut (e.g., set firstPartyOptOut = mergedOptions.proxy ===
false ? true : /*fall back to existing call-site logic*/), and apply the same
change in the other block noted (lines ~401-439) so registry/runtimeConfig-level
proxy:false prevents proxy rewrites unless explicitly overridden by the
call-site.

---

Nitpick comments:
In `@test/unit/proxy-configs.test.ts`:
- Around line 429-462: The ipOnly list in the 'all configs have valid structure'
test is missing several keys that were moved into PRIVACY_IP_ONLY in
src/registry.ts, causing those entries to be only shape-checked; update the test
to either (a) include the full set of keys that live in PRIVACY_IP_ONLY (add
matomoAnalytics, carbonAds, lemonSqueezy, gravatar, vimeoPlayer, youtubePlayer,
etc.) to the ipOnly array, or (b) import PRIVACY_IP_ONLY from src/registry.ts
and use that constant instead of the hardcoded ipOnly array so the test
automatically covers all migrated entries; adjust the assertions that follow
(expect(...).toBe(true / false) checks) to run for that complete set.