From f1dd75d0b1552417b9a9addab66b280086175c69 Mon Sep 17 00:00:00 2001
From: Harlan Wilton <harlan@harlanzw.com>
Date: Thu, 16 Jul 2026 02:26:47 +1000
Subject: [PATCH 1/6] perf: memory leak hardening

---
 packages/devtools-app/composables/rpc.ts      | 107 +++++++++---
 packages/devtools-app/composables/state.ts    |  35 +++-
 packages/devtools-app/utils/fetch.ts          |   7 +-
 packages/script/src/devtools.ts               |  46 +++++-
 packages/script/src/module.ts                 |  20 +++
 .../GoogleMaps/ScriptGoogleMaps.vue           | 109 ++++++++++---
 .../GoogleMaps/useGoogleMapsResource.ts       |  55 ++++++-
 .../runtime/components/ScriptCarbonAds.vue    |  14 +-
 .../src/runtime/components/ScriptCrisp.vue    |   7 +-
 .../src/runtime/components/ScriptIntercom.vue |   7 +-
 .../runtime/components/ScriptLemonSqueezy.vue |  11 +-
 .../components/ScriptPayPalButtons.vue        |   7 +-
 .../components/ScriptPayPalMessages.vue       |   4 +
 .../components/ScriptStripePricingTable.vue   |   4 +-
 .../runtime/components/ScriptVimeoPlayer.vue  |  13 +-
 .../src/runtime/composables/useScript.ts      | 152 +++++++++++++-----
 .../runtime/composables/useScriptEventPage.ts |  39 +++--
 .../useScriptTriggerIdleTimeout.ts            |  30 +++-
 .../useScriptTriggerInteraction.ts            |  37 +++--
 .../useScriptTriggerServiceWorker.ts          |  42 ++---
 .../devtools-standalone-bridge.client.ts      |  31 +++-
 .../script/src/runtime/npm-script-stub.ts     |   8 +-
 .../script/src/runtime/registry/speedcurve.ts |  35 +++-
 .../src/runtime/registry/usercentrics.ts      |  61 +++++--
 .../src/runtime/registry/youtube-player.ts    |  13 +-
 .../src/runtime/server/instagram-embed.ts     |   2 +
 .../src/runtime/server/proxy-handler.ts       | 106 ++++++++++--
 .../src/runtime/server/utils/cache-config.ts  |  10 ++
 .../runtime/server/utils/cached-upstream.ts   |   3 +
 .../src/runtime/utils/after-next-paint.ts     |  20 ++-
 test/unit/google-maps-lifecycle.test.ts       |  24 +++
 test/unit/speedcurve-after-next-paint.test.ts |  18 +++
 vitest.config.ts                              |   2 +
 33 files changed, 894 insertions(+), 185 deletions(-)
 create mode 100644 packages/script/src/runtime/server/utils/cache-config.ts

diff --git a/packages/devtools-app/composables/rpc.ts b/packages/devtools-app/composables/rpc.ts
index 1dc4e9300..651bf0cbf 100644
--- a/packages/devtools-app/composables/rpc.ts
+++ b/packages/devtools-app/composables/rpc.ts
@@ -4,7 +4,7 @@ import type { $Fetch } from 'nitropack/types'
 import type { Ref } from 'vue'
 import { onDevtoolsClientConnected } from '@nuxt/devtools-kit/iframe-client'
 import { ofetch } from 'ofetch'
-import { onScopeDispose, ref, watch, watchEffect } from 'vue'
+import { ref, watch, watchEffect } from 'vue'
 import { firstPartyData, isConnected, path, query, refreshSources, standaloneUrl, syncScripts, version } from './state'
 
 export const appFetch: Ref<$Fetch | undefined> = ref()
@@ -12,7 +12,7 @@ export const devtools: Ref<NuxtDevtoolsClient | undefined> = ref()
 export const colorMode: Ref<'dark' | 'light'> = ref('dark')
 
 export interface DevtoolsConnectionOptions {
-  onConnected?: (client: any) => void
+  onConnected?: (client: any) => void | (() => void)
   onRouteChange?: (route: any) => void
 }
 
@@ -27,20 +27,33 @@ const STANDALONE_POLL_INTERVAL = 2000
  * - **Embedded**: running inside Nuxt DevTools iframe (automatic)
  * - **Standalone**: running directly in a browser tab with a manual dev server URL
  */
-export function useDevtoolsConnection(options: DevtoolsConnectionOptions = {}): void {
+export function useDevtoolsConnection(options: DevtoolsConnectionOptions = {}): () => void {
   const inIframe = window.parent !== window
+  let disposed = false
+  const connectionCleanups: Array<() => void> = []
+
+  const cleanupConnection = () => {
+    connectionCleanups.splice(0).forEach(cleanup => cleanup())
+    devtools.value = undefined
+  }
 
   // Embedded mode: connect via devtools-kit iframe client
+  let stopClientConnection = () => {}
   if (inIframe) {
-    onDevtoolsClientConnected(async (client) => {
+    stopClientConnection = onDevtoolsClientConnected((client) => {
+      if (disposed)
+        return
+      cleanupConnection()
       isConnected.value = true
       // @ts-expect-error untyped
       appFetch.value = client.host.app.$fetch
-      watchEffect(() => {
+      connectionCleanups.push(watchEffect(() => {
         colorMode.value = client.host.app.colorMode.value
-      })
+      }))
       devtools.value = client.devtools
-      options.onConnected?.(client)
+      const cleanupConnected = options.onConnected?.(client)
+      if (cleanupConnected)
+        connectionCleanups.push(cleanupConnected)
 
       if (options.onRouteChange) {
         const $route = client.host.nuxt.vueApp.config.globalProperties?.$route
@@ -48,22 +61,44 @@ export function useDevtoolsConnection(options: DevtoolsConnectionOptions = {}):
         const removeAfterEach = client.host.nuxt.$router.afterEach((route: any) => {
           options.onRouteChange!(route)
         })
-        // Clean up when devtools client disconnects
-        // @ts-expect-error app:unmount exists at runtime but is not in RuntimeNuxtHooks
-        client.host.nuxt.hook('app:unmount', removeAfterEach)
+        connectionCleanups.push(removeAfterEach)
       }
-    })
+      // @ts-expect-error app:unmount exists at runtime but is not in RuntimeNuxtHooks
+      connectionCleanups.push(client.host.nuxt.hook('app:unmount', cleanupConnection))
+    }) || (() => {})
   }
 
   // Standalone mode: create appFetch from manually entered URL and poll for state
   let pollTimer: ReturnType<typeof setInterval> | undefined
+  let pollController: AbortController | undefined
 
-  watch(() => standaloneUrl.value, (url) => {
-    // Clean up previous polling
+  const stopPolling = () => {
     if (pollTimer) {
       clearInterval(pollTimer)
       pollTimer = undefined
     }
+    pollController?.abort()
+    pollController = undefined
+  }
+
+  const poll = async (url: string) => {
+    // A slow/unreachable app must not accumulate overlapping interval requests.
+    if (pollController)
+      return
+    const controller = new AbortController()
+    pollController = controller
+    try {
+      await pollStandaloneState(url, controller.signal)
+    }
+    finally {
+      if (pollController === controller)
+        pollController = undefined
+    }
+  }
+
+  const stopStandaloneWatch = watch(() => standaloneUrl.value, (url) => {
+    // Clean up previous polling
+    stopPolling()
 
     if (url && !isConnected.value) {
       appFetch.value = ofetch.create({ baseURL: url }) as unknown as $Fetch
@@ -71,22 +106,32 @@ export function useDevtoolsConnection(options: DevtoolsConnectionOptions = {}):
       colorMode.value = window.matchMedia('(prefers-color-scheme: dark)').matches ? 'dark' : 'light'
       refreshSources()
       // Start polling the standalone API for script state
-      pollStandaloneState(url)
-      pollTimer = setInterval(pollStandaloneState, STANDALONE_POLL_INTERVAL, url)
+      void poll(url)
+      pollTimer = setInterval(() => void poll(url), STANDALONE_POLL_INTERVAL)
     }
   }, { immediate: true })
 
-  onScopeDispose(() => {
-    if (pollTimer) {
-      clearInterval(pollTimer)
-    }
-  })
+  return () => {
+    if (disposed)
+      return
+    disposed = true
+    stopPolling()
+    stopStandaloneWatch()
+    stopClientConnection()
+    cleanupConnection()
+    appFetch.value = undefined
+    isConnected.value = false
+  }
 }
 
-async function pollStandaloneState(baseUrl: string) {
+async function pollStandaloneState(baseUrl: string, signal: AbortSignal) {
+  const timeoutController = new AbortController()
+  const timeout = setTimeout(() => timeoutController.abort(), 3000)
+  const onAbort = () => timeoutController.abort()
+  signal.addEventListener('abort', onAbort, { once: true })
   try {
     const res = await fetch(`${baseUrl}${STANDALONE_API_PATH}`, {
-      signal: AbortSignal.timeout(3000),
+      signal: timeoutController.signal,
     })
     if (!res.ok)
       return
@@ -106,15 +151,29 @@ async function pollStandaloneState(baseUrl: string) {
   catch {
     // Standalone API not available or not enabled, silently ignore
   }
+  finally {
+    clearTimeout(timeout)
+    signal.removeEventListener('abort', onAbort)
+  }
 }
 
-useDevtoolsConnection({
+const disposeConnection = useDevtoolsConnection({
   onConnected: (client) => {
-    client.host.nuxt.hooks.hook('scripts:updated', (ctx: any) => {
+    const stopScriptsHook = client.host.nuxt.hooks.hook('scripts:updated', (ctx: any) => {
       syncScripts(ctx.scripts)
     })
     version.value = client.host.nuxt.$config.public['nuxt-scripts'].version
     firstPartyData.value = client.host.nuxt.$config.public['nuxt-scripts-devtools'] || null
     syncScripts(client.host.nuxt._scripts || {})
+    return stopScriptsHook
   },
 })
+
+function disposeModuleConnection() {
+  window.removeEventListener('beforeunload', disposeModuleConnection)
+  disposeConnection()
+}
+
+window.addEventListener('beforeunload', disposeModuleConnection, { once: true })
+if (import.meta.hot)
+  import.meta.hot.dispose(disposeModuleConnection)
diff --git a/packages/devtools-app/composables/state.ts b/packages/devtools-app/composables/state.ts
index 3275c6b84..79a37ce94 100644
--- a/packages/devtools-app/composables/state.ts
+++ b/packages/devtools-app/composables/state.ts
@@ -84,6 +84,7 @@ export const version = ref<string | null>(null)
 export const firstPartyData = ref<FirstPartyDevtoolsData | null>(null)
 
 let _lastSyncedScripts: any[] | null = null
+const scriptFetches = new Map<string, AbortController>()
 
 export async function initRegistry() {
   scriptRegistry.value = await _registryPromise
@@ -107,9 +108,16 @@ export function syncScripts(_scripts: any[]) {
   if (!_scripts || typeof _scripts !== 'object') {
     _lastSyncedScripts = null
     scripts.value = {}
+    pruneScriptState(new Set())
     return
   }
   _lastSyncedScripts = _scripts
+  const activeSources = new Set(
+    Object.values(_scripts)
+      .map((script: any) => script?.src)
+      .filter((src): src is string => typeof src === 'string' && !!src),
+  )
+  pruneScriptState(activeSources)
   scripts.value = Object.fromEntries(
     Object.entries({ ..._scripts })
       .map(([key, script]: [string, any]) => {
@@ -124,9 +132,13 @@ export function syncScripts(_scripts: any[]) {
           script.loadTime = msToHumanReadable(loadedAt - loadingAt)
         const scriptSizeKey = script.src
         // Skip size fetching in standalone mode (cross-origin fetch blocked by CORS)
-        if (!scriptSizes[scriptSizeKey] && script.src && !isStandalone.value) {
-          fetchScript(script.src)
+        if (!scriptSizes[scriptSizeKey] && !scriptErrors[scriptSizeKey] && script.src && !isStandalone.value && !scriptFetches.has(scriptSizeKey)) {
+          const controller = new AbortController()
+          scriptFetches.set(scriptSizeKey, controller)
+          fetchScript(script.src, controller.signal)
             .then((res) => {
+              if (controller.signal.aborted || !activeSources.has(scriptSizeKey))
+                return
               if (res.size) {
                 scriptSizes[scriptSizeKey] = res.size
                 script.size = res.size
@@ -136,12 +148,31 @@ export function syncScripts(_scripts: any[]) {
                 script.error = scriptErrors[scriptSizeKey]
               }
             })
+            .finally(() => {
+              if (scriptFetches.get(scriptSizeKey) === controller)
+                scriptFetches.delete(scriptSizeKey)
+            })
         }
         return [key, script]
       }),
   )
 }
 
+function pruneScriptState(activeSources: Set<string>) {
+  for (const [src, controller] of scriptFetches) {
+    if (!activeSources.has(src)) {
+      controller.abort()
+      scriptFetches.delete(src)
+    }
+  }
+  for (const state of [scriptSizes, scriptErrors, scriptTabs]) {
+    for (const src of Object.keys(state)) {
+      if (!activeSources.has(src))
+        delete state[src]
+    }
+  }
+}
+
 // Script status helper (handles both reactive refs from embedded mode and plain strings from standalone)
 export function getScriptStatus(script: any): string {
   const status = script?.$script?.status
diff --git a/packages/devtools-app/utils/fetch.ts b/packages/devtools-app/utils/fetch.ts
index 3d70db822..47d6d356b 100644
--- a/packages/devtools-app/utils/fetch.ts
+++ b/packages/devtools-app/utils/fetch.ts
@@ -1,5 +1,8 @@
-export async function fetchScript(url: string) {
-  const compressedResponse = await fetch(url, { headers: { 'Accept-Encoding': 'gzip' } }).catch((err) => {
+export async function fetchScript(url: string, signal?: AbortSignal) {
+  const compressedResponse = await fetch(url, {
+    headers: { 'Accept-Encoding': 'gzip' },
+    signal,
+  }).catch((err) => {
     return {
       size: null,
       error: err,
diff --git a/packages/script/src/devtools.ts b/packages/script/src/devtools.ts
index 5a78d289a..5e8a3fb02 100644
--- a/packages/script/src/devtools.ts
+++ b/packages/script/src/devtools.ts
@@ -7,6 +7,7 @@ import { createResolver, extendViteConfig } from '@nuxt/kit'
 const DEVTOOLS_UI_ROUTE = '/__nuxt-scripts'
 const DEVTOOLS_UI_LOCAL_PORT = 3030
 const DEVTOOLS_API_STATE_ROUTE = '/__nuxt-scripts-api/state'
+const DEVTOOLS_API_MAX_BODY_SIZE = 2 * 1024 * 1024
 
 export interface DevtoolsOptions {
   standalone?: boolean
@@ -82,10 +83,41 @@ function setupStandaloneApi(nuxt: Nuxt) {
 
       if (req.method === 'POST') {
         let body = ''
-        req.on('data', (chunk: Buffer) => {
+        let size = 0
+        let finished = false
+
+        function cleanup() {
+          req.off('data', onData)
+          req.off('end', onEnd)
+          req.off('aborted', onAborted)
+          req.off('error', onAborted)
+        }
+        function onAborted() {
+          finished = true
+          body = ''
+          cleanup()
+        }
+        function onData(chunk: Buffer) {
+          if (finished)
+            return
+          size += chunk.byteLength
+          if (size > DEVTOOLS_API_MAX_BODY_SIZE) {
+            finished = true
+            body = ''
+            cleanup()
+            // Drain the remainder so the keep-alive connection can be reused.
+            req.resume()
+            res.statusCode = 413
+            res.end('payload too large')
+            return
+          }
           body += chunk.toString()
-        })
-        req.on('end', () => {
+        }
+        function onEnd() {
+          if (finished)
+            return
+          finished = true
+          cleanup()
           try {
             const data = JSON.parse(body)
             scriptsState = { ...data, updatedAt: Date.now() }
@@ -96,7 +128,13 @@ function setupStandaloneApi(nuxt: Nuxt) {
             res.statusCode = 400
             res.end('invalid json')
           }
-        })
+          body = ''
+        }
+
+        req.on('data', onData)
+        req.on('end', onEnd)
+        req.on('aborted', onAborted)
+        req.on('error', onAborted)
         return
       }
 
diff --git a/packages/script/src/module.ts b/packages/script/src/module.ts
index 99131a99d..59fb668c4 100644
--- a/packages/script/src/module.ts
+++ b/packages/script/src/module.ts
@@ -41,6 +41,12 @@ import { generateInterceptPluginContents } from './plugins/intercept'
 import { NuxtScriptBundleTransformer } from './plugins/transform'
 import { aliasProxyValue, buildDomainAliasMap, invertAliasMap, isSafeAliasSegment } from './proxy-alias'
 import { buildProxyConfigsFromRegistry, generatePartytownResolveUrl, getPartytownForwards, registry, resolveCapabilities } from './registry'
+import {
+  NUXT_SCRIPTS_CACHE_BASE,
+  NUXT_SCRIPTS_CACHE_MAX_ENTRIES,
+  NUXT_SCRIPTS_CACHE_MAX_ENTRY_SIZE,
+  NUXT_SCRIPTS_CACHE_MAX_SIZE,
+} from './runtime/server/utils/cache-config'
 import { registerTypeTemplates, templatePlugin, templateTriggerResolver } from './templates'
 import { validateScriptsEnvVars } from './validate-env'
 
@@ -1093,6 +1099,20 @@ export default defineNuxtModule<ModuleOptions>({
       }
     }
 
+    if (Object.keys(enabledEndpoints).length > 0) {
+      const nitroOptions = nuxt.options.nitro as any
+      nitroOptions.storage ||= {}
+      // Nitro's default memory storage has no eviction policy. Keep proxy and
+      // embed caches bounded unless the application supplied a dedicated
+      // persistent/distributed mount for this namespace.
+      nitroOptions.storage[NUXT_SCRIPTS_CACHE_BASE] ||= {
+        driver: 'lru-cache',
+        max: NUXT_SCRIPTS_CACHE_MAX_ENTRIES,
+        maxSize: NUXT_SCRIPTS_CACHE_MAX_SIZE,
+        maxEntrySize: NUXT_SCRIPTS_CACHE_MAX_ENTRY_SIZE,
+      }
+    }
+
     // Publish enabled endpoints to client for component opt-in checks
     nuxt.options.runtimeConfig.public['nuxt-scripts'] = defu(
       { endpoints: enabledEndpoints },
diff --git a/packages/script/src/runtime/components/GoogleMaps/ScriptGoogleMaps.vue b/packages/script/src/runtime/components/GoogleMaps/ScriptGoogleMaps.vue
index 702e8c02c..292f0354e 100644
--- a/packages/script/src/runtime/components/GoogleMaps/ScriptGoogleMaps.vue
+++ b/packages/script/src/runtime/components/GoogleMaps/ScriptGoogleMaps.vue
@@ -152,7 +152,7 @@ export interface ScriptGoogleMapsSlots {
 <script lang="ts" setup>
 import { defu } from 'defu'
 import { tryUseNuxtApp, useHead, useRuntimeConfig } from 'nuxt/app'
-import { computed, nextTick, onBeforeUnmount, onMounted, provide, ref, shallowRef, toRaw, useAttrs, useTemplateRef, watch } from 'vue'
+import { computed, nextTick, onBeforeUnmount, onMounted, onUnmounted, provide, ref, shallowRef, toRaw, useAttrs, useTemplateRef, watch } from 'vue'
 import { useScriptTriggerElement } from '#nuxt-scripts/composables/useScriptTriggerElement'
 import { useScriptGoogleMaps } from '#nuxt-scripts/registry/google-maps'
 import { scriptRuntimeConfig, scriptsPrefix } from '#nuxt-scripts/utils'
@@ -197,6 +197,8 @@ const currentColorScheme = computed<google.maps.ColorScheme | undefined>(() => {
 })
 
 const mapsApi = shallowRef<typeof google.maps | undefined>()
+const lifecycleController = new AbortController()
+let isUnmounted = false
 
 if (import.meta.dev) {
   if (!apiKey)
@@ -333,6 +335,7 @@ async function resolveQueryToLatLng(query: string) {
   if (endpoints?.googleMaps) {
     const data = await $fetch(`${scriptsPrefix()}/proxy/google-maps-geocode`, {
       params: { address: query },
+      signal: lifecycleController.signal,
     }) as GoogleMapsGeocodeProxyResponse
     if (data.status === 'OK' && data.results?.[0]?.geometry?.location) {
       const loc = data.results[0].geometry.location
@@ -347,7 +350,7 @@ async function resolveQueryToLatLng(query: string) {
   // Map instance: resolveQueryToLatLng is publicly exposed and may be called
   // before onLoaded has populated map.value, so constructing PlacesService
   // without map would throw.
-  await waitForMapsReady({ mapsApi, map, status, load })
+  await waitForMapsReady({ mapsApi, map, status, load, signal: lifecycleController.signal })
 
   const placesService = new mapsApi.value!.places.PlacesService(map.value!)
   const result = await new Promise<google.maps.LatLng>((resolve, reject) => {
@@ -382,12 +385,39 @@ function importLibrary(key: string): Promise<any>
 function importLibrary<T>(key: string): Promise<T> {
   if (libraries.has(key))
     return libraries.get(key)
-  const p = mapsApi.value?.importLibrary(key) || new Promise((resolve) => {
-    const stop = watch(mapsApi, (api) => {
+  if (lifecycleController.signal.aborted) {
+    const error = new Error(`Google Maps library import "${key}" was aborted`)
+    error.name = 'AbortError'
+    return Promise.reject(error)
+  }
+  const p = mapsApi.value?.importLibrary(key) || new Promise((resolve, reject) => {
+    let stop = () => {}
+    let settled = false
+    const cleanup = () => {
+      stop()
+      lifecycleController.signal.removeEventListener('abort', onAbort)
+    }
+    const settle = (fn: () => void) => {
+      if (settled)
+        return
+      settled = true
+      cleanup()
+      fn()
+    }
+    const onAbort = () => settle(() => {
+      const error = new Error(`Google Maps library import "${key}" was aborted`)
+      error.name = 'AbortError'
+      reject(error)
+    })
+
+    if (lifecycleController.signal.aborted) {
+      onAbort()
+      return
+    }
+    lifecycleController.signal.addEventListener('abort', onAbort, { once: true })
+    stop = watch(mapsApi, (api) => {
       if (api) {
-        const p = api.importLibrary(key)
-        resolve(p)
-        stop()
+        settle(() => resolve(api.importLibrary(key)))
       }
     }, { immediate: true })
   })
@@ -475,7 +505,9 @@ onMounted(() => {
     // guard skips the redundant setCenter.
     if (center)
       centerOverride.value = { lat: center.lat(), lng: center.lng() }
-    map.value.unbindAll()
+    const previousMap = map.value
+    mapsApi.value.event.clearInstanceListeners(previousMap)
+    previousMap.unbindAll()
     map.value = undefined
     slotMounted.value = false
     // Clear any DOM children left by the previous Map instance — Google Maps
@@ -510,31 +542,48 @@ onMounted(() => {
   watch([() => getCenterWatchKey(props.center), () => getCenterWatchKey(props.mapOptions?.center)], () => {
     centerOverride.value = undefined
   })
-  watch([controlledCenterKey, isMapReady, map], async () => {
-    if (!map.value) {
+  watch([controlledCenterKey, isMapReady, map], async (_, __, onCleanup) => {
+    const currentMap = map.value
+    if (!currentMap) {
       return
     }
+    let stale = false
+    onCleanup(() => {
+      stale = true
+    })
     let center = toRaw(options.value.center)
     if (center) {
       if (isLocationQuery(center) && isMapReady.value) {
-        center = await resolveQueryToLatLng(center as string)
+        try {
+          center = await resolveQueryToLatLng(center as string)
+        }
+        catch (error: any) {
+          if (error?.name === 'AbortError')
+            return
+          throw error
+        }
       }
+      if (stale || isUnmounted || map.value !== currentMap)
+        return
       // Skip setCenter if the map is already at the same position to avoid
       // resetting user pan interactions on unrelated re-renders.
-      const current = map.value!.getCenter()
+      const current = currentMap.getCenter()
       if (current) {
         const newLat = typeof (center as any).lat === 'function' ? (center as any).lat() : (center as any).lat
         const newLng = typeof (center as any).lng === 'function' ? (center as any).lng() : (center as any).lng
         if (current.lat() === newLat && current.lng() === newLng)
           return
       }
-      map.value!.setCenter(center as google.maps.LatLng)
+      currentMap.setCenter(center as google.maps.LatLng)
     }
   }, {
     immediate: true,
   })
   onLoaded(async (instance: any) => {
-    mapsApi.value = await instance.maps
+    const api = await instance.maps
+    if (isUnmounted || !mapEl.value)
+      return
+    mapsApi.value = api
     // may need to transform the center before we can init the map
     const center = options.value.center as string
     const _options: google.maps.MapOptions = {
@@ -542,11 +591,22 @@ onMounted(() => {
       // @ts-expect-error broken
       center: !center || isLocationQuery(center) ? undefined : center,
     }
-    map.value = new mapsApi.value!.Map(mapEl.value!, _options)
+    map.value = new api.Map(mapEl.value, _options)
     if (center && isLocationQuery(center)) {
-      centerOverride.value = await resolveQueryToLatLng(center)
-      if (centerOverride.value)
-        map.value?.setCenter(centerOverride.value)
+      let resolvedCenter
+      try {
+        resolvedCenter = await resolveQueryToLatLng(center)
+      }
+      catch (error: any) {
+        if (error?.name === 'AbortError')
+          return
+        throw error
+      }
+      if (isUnmounted)
+        return
+      centerOverride.value = resolvedCenter
+      if (resolvedCenter)
+        map.value?.setCenter(resolvedCenter)
     }
     isMapReady.value = true
   })
@@ -602,6 +662,8 @@ const rootAttrs = computed(() => {
 })
 
 onBeforeUnmount(() => {
+  isUnmounted = true
+  lifecycleController.abort()
   // Synchronous cleanup — Vue does not await async lifecycle hooks,
   // so anything after an `await` runs as a detached microtask.
   // Note: do NOT null mapsApi here — children unmount AFTER onBeforeUnmount
@@ -609,11 +671,20 @@ onBeforeUnmount(() => {
   // Note: do NOT remove map DOM here — during page transitions the leave
   // animation is still playing, and tearing out the iframe leaves blank
   // space. Vue removes the parent element on actual unmount.
-  map.value?.unbindAll()
+  if (map.value && mapsApi.value) {
+    mapsApi.value.event.clearInstanceListeners(map.value)
+    map.value.unbindAll()
+  }
   map.value = undefined
+  activeInfoWindow?.close()
+  activeInfoWindow = undefined
   libraries.clear()
   queryToLatLngCache.clear()
 })
+
+onUnmounted(() => {
+  mapsApi.value = undefined
+})
 </script>
 
 <template>
diff --git a/packages/script/src/runtime/components/GoogleMaps/useGoogleMapsResource.ts b/packages/script/src/runtime/components/GoogleMaps/useGoogleMapsResource.ts
index deb5b124e..1d205b4e7 100644
--- a/packages/script/src/runtime/components/GoogleMaps/useGoogleMapsResource.ts
+++ b/packages/script/src/runtime/components/GoogleMaps/useGoogleMapsResource.ts
@@ -135,21 +135,55 @@ export async function waitForMapsReady({
   map,
   status,
   load,
+  signal,
 }: {
   mapsApi: ShallowRef<typeof google.maps | undefined>
   map: ShallowRef<google.maps.Map | undefined>
   status: Ref<string>
   load: () => Promise<unknown> | unknown
+  signal?: AbortSignal
 }): Promise<void> {
+  const abortError = () => {
+    const error = new Error('Google Maps readiness wait was aborted')
+    error.name = 'AbortError'
+    return error
+  }
+  const throwIfAborted = () => {
+    if (signal?.aborted)
+      throw abortError()
+  }
+
+  throwIfAborted()
   if (mapsApi.value && map.value)
     return
   if (status.value === 'error')
     throw new Error('Google Maps script failed to load')
 
-  await load()
+  await new Promise<void>((resolve, reject) => {
+    let settled = false
+    let onAbort: (() => void) | undefined
+    const cleanup = () => {
+      if (onAbort)
+        signal?.removeEventListener('abort', onAbort)
+    }
+    const settle = (fn: () => void) => {
+      if (settled)
+        return
+      settled = true
+      cleanup()
+      fn()
+    }
+    onAbort = () => settle(() => reject(abortError()))
+    signal?.addEventListener('abort', onAbort, { once: true })
+    Promise.resolve(load()).then(
+      () => settle(resolve),
+      error => settle(() => reject(error)),
+    )
+  })
 
   // load() may have populated both refs synchronously — re-check before
   // installing a watcher to avoid the race that hangs the promise forever.
+  throwIfAborted()
   if (mapsApi.value && map.value)
     return
   if (status.value === 'error')
@@ -158,16 +192,31 @@ export async function waitForMapsReady({
   const scope = effectScope(true)
   try {
     await new Promise<void>((resolve, reject) => {
+      let settled = false
+      let onAbort: (() => void) | undefined
+      const cleanup = () => {
+        if (onAbort)
+          signal?.removeEventListener('abort', onAbort)
+      }
+      const settle = (fn: () => void) => {
+        if (settled)
+          return
+        settled = true
+        cleanup()
+        fn()
+      }
+      onAbort = () => settle(() => reject(abortError()))
+      signal?.addEventListener('abort', onAbort, { once: true })
       scope.run(() => {
         watch(
           [mapsApi, map, status],
           ([api, m, s]) => {
             if (api && m) {
-              resolve()
+              settle(resolve)
               return
             }
             if (s === 'error')
-              reject(new Error('Google Maps script failed to load'))
+              settle(() => reject(new Error('Google Maps script failed to load')))
           },
           { immediate: true },
         )
diff --git a/packages/script/src/runtime/components/ScriptCarbonAds.vue b/packages/script/src/runtime/components/ScriptCarbonAds.vue
index 2658bd5ac..ad012f1c6 100644
--- a/packages/script/src/runtime/components/ScriptCarbonAds.vue
+++ b/packages/script/src/runtime/components/ScriptCarbonAds.vue
@@ -29,6 +29,7 @@ const attrId = `_carbonads_js`
 const carbonadsEl = ref<HTMLElement | null>(import.meta.client ? document.getElementById(attrId) : null)
 // syncs to useScript status
 const status = ref('awaitingLoad')
+let scriptEl: HTMLScriptElement | undefined
 
 function loadCarbon() {
   if (!carbonadsEl.value) {
@@ -36,6 +37,7 @@ function loadCarbon() {
   }
   status.value = 'loading'
   const script = document.createElement('script')
+  scriptEl = script
   script.setAttribute('src', withQuery('https://cdn.carbonads.com/carbon.js', {
     serve: props.serve,
     placement: props.placement,
@@ -63,7 +65,10 @@ onMounted(() => {
     loadCarbon()
   }
   else {
-    trigger.then(loadCarbon)
+    trigger.then((triggered) => {
+      if (triggered)
+        loadCarbon()
+    })
   }
 })
 
@@ -74,8 +79,15 @@ const rootAttrs = computed(() => {
 })
 
 onBeforeUnmount(() => {
+  if (scriptEl) {
+    scriptEl.onload = null
+    scriptEl.onerror = null
+    scriptEl.remove()
+    scriptEl = undefined
+  }
   if (carbonadsEl.value) {
     carbonadsEl.value.remove()
+    carbonadsEl.value = null
   }
 })
 </script>
diff --git a/packages/script/src/runtime/components/ScriptCrisp.vue b/packages/script/src/runtime/components/ScriptCrisp.vue
index e6f5774a9..23be1447d 100644
--- a/packages/script/src/runtime/components/ScriptCrisp.vue
+++ b/packages/script/src/runtime/components/ScriptCrisp.vue
@@ -58,15 +58,17 @@ defineExpose({
   crisp,
 })
 
-let observer: MutationObserver
+let observer: MutationObserver | undefined
 onMounted(() => {
   watch(status, (status) => {
     if (status === 'loaded') {
+      observer?.disconnect()
       observer = new MutationObserver(() => {
         if (document.getElementById('crisp-chatbox')) {
           isReady.value = true
           emits('ready', crisp)
-          observer.disconnect()
+          observer?.disconnect()
+          observer = undefined
         }
       })
       observer.observe(document.body, { childList: true, subtree: true })
@@ -78,6 +80,7 @@ onMounted(() => {
 })
 onBeforeUnmount(() => {
   observer?.disconnect()
+  observer = undefined
 })
 
 const rootAttrs = computed(() => {
diff --git a/packages/script/src/runtime/components/ScriptIntercom.vue b/packages/script/src/runtime/components/ScriptIntercom.vue
index e68969a7a..db3da57cc 100644
--- a/packages/script/src/runtime/components/ScriptIntercom.vue
+++ b/packages/script/src/runtime/components/ScriptIntercom.vue
@@ -64,15 +64,17 @@ defineExpose({
   intercom,
 })
 
-let observer: MutationObserver
+let observer: MutationObserver | undefined
 onMounted(() => {
   watch(status, (status) => {
     if (status === 'loading') {
+      observer?.disconnect()
       observer = new MutationObserver(() => {
         if (document.getElementById('intercom-frame')) {
           isReady.value = true
           emits('ready', intercom)
-          observer.disconnect()
+          observer?.disconnect()
+          observer = undefined
         }
       })
       observer.observe(document.body, { childList: true, subtree: true })
@@ -84,6 +86,7 @@ onMounted(() => {
 })
 onBeforeUnmount(() => {
   observer?.disconnect()
+  observer = undefined
 })
 
 const rootAttrs = computed(() => {
diff --git a/packages/script/src/runtime/components/ScriptLemonSqueezy.vue b/packages/script/src/runtime/components/ScriptLemonSqueezy.vue
index 56a43f7bb..57170f529 100644
--- a/packages/script/src/runtime/components/ScriptLemonSqueezy.vue
+++ b/packages/script/src/runtime/components/ScriptLemonSqueezy.vue
@@ -1,7 +1,7 @@
 <script lang="ts" setup>
 import type { LemonSqueezyEventPayload } from '../registry/lemon-squeezy'
 import type { ElementScriptTrigger } from '../types'
-import { computed, onMounted, ref } from 'vue'
+import { computed, onBeforeUnmount, onMounted, ref } from 'vue'
 import { useScriptTriggerElement } from '../composables/useScriptTriggerElement'
 import { useScriptLemonSqueezy } from '../registry/lemon-squeezy'
 
@@ -42,6 +42,15 @@ onMounted(() => {
   })
 })
 
+onBeforeUnmount(() => {
+  // Lemon.js `Setup()` stores a single global `eventHandler`, which captures
+  // this component's `emits` (and therefore the instance). Setup() replaces
+  // rather than appends, so resetting it to a noop on unmount releases the
+  // closure and lets the unmounted instance be garbage-collected.
+  if (import.meta.client && typeof window.LemonSqueezy?.Setup === 'function')
+    window.LemonSqueezy.Setup({ eventHandler() {} })
+})
+
 const rootAttrs = computed(() => {
   return {
     ...(trigger instanceof Promise ? trigger.ssrAttrs || {} : {}),
diff --git a/packages/script/src/runtime/components/ScriptPayPalButtons.vue b/packages/script/src/runtime/components/ScriptPayPalButtons.vue
index aead79261..4483d4985 100644
--- a/packages/script/src/runtime/components/ScriptPayPalButtons.vue
+++ b/packages/script/src/runtime/components/ScriptPayPalButtons.vue
@@ -81,6 +81,7 @@ const rootEl = ref<HTMLDivElement | null>(null)
 const ready = ref(false)
 const failed = ref(false)
 const sdkInstance = shallowRef<SdkInstance<Components[]>>()
+let disposed = false
 
 const { onLoaded, status } = useScriptPayPal({
   ...(props.clientToken ? { clientToken: props.clientToken } : { clientId: props.clientId }),
@@ -103,7 +104,10 @@ onMounted(() => {
     } as CreateInstanceOptions<Components[]>
 
     try {
-      sdkInstance.value = await paypal.createInstance(instanceOptions)
+      const instance = await paypal.createInstance(instanceOptions)
+      if (disposed)
+        return
+      sdkInstance.value = instance
       ready.value = true
       emit('ready', sdkInstance.value)
     }
@@ -116,6 +120,7 @@ onMounted(() => {
 })
 
 onBeforeUnmount(() => {
+  disposed = true
   sdkInstance.value = undefined
 })
 
diff --git a/packages/script/src/runtime/components/ScriptPayPalMessages.vue b/packages/script/src/runtime/components/ScriptPayPalMessages.vue
index e5285bdc8..613613c9b 100644
--- a/packages/script/src/runtime/components/ScriptPayPalMessages.vue
+++ b/packages/script/src/runtime/components/ScriptPayPalMessages.vue
@@ -82,6 +82,7 @@ const rootEl = ref<HTMLDivElement | null>(null)
 const ready = ref(false)
 const failed = ref(false)
 const messagesSession = shallowRef<PayPalMessagesSession>()
+let disposed = false
 
 const { onLoaded, status } = useScriptPayPal({
   ...(props.clientToken ? { clientToken: props.clientToken } : { clientId: props.clientId }),
@@ -107,6 +108,8 @@ onMounted(() => {
 
     try {
       const instance = await paypal.createInstance(instanceOptions) as SdkInstance<['paypal-messages']>
+      if (disposed)
+        return
       messagesSession.value = instance.createPayPalMessages(props.messagesOptions)
       ready.value = true
       emit('ready', messagesSession.value)
@@ -120,6 +123,7 @@ onMounted(() => {
 })
 
 onBeforeUnmount(() => {
+  disposed = true
   messagesSession.value = undefined
 })
 
diff --git a/packages/script/src/runtime/components/ScriptStripePricingTable.vue b/packages/script/src/runtime/components/ScriptStripePricingTable.vue
index 6d9b8a3a4..4e23aabc5 100644
--- a/packages/script/src/runtime/components/ScriptStripePricingTable.vue
+++ b/packages/script/src/runtime/components/ScriptStripePricingTable.vue
@@ -38,6 +38,8 @@ const { onLoaded, status } = instance
 const pricingTable = ref<HTMLElement | undefined>()
 onMounted(() => {
   onLoaded(() => {
+    if (!rootEl.value)
+      return
     const StripePricingTable = window.customElements.get('stripe-pricing-table')!
     const stripePricingTable = new StripePricingTable()
     stripePricingTable.setAttribute('publishable-key', props.publishableKey)
@@ -49,7 +51,7 @@ onMounted(() => {
     if (props.customerSessionClientSecret)
       stripePricingTable.setAttribute('customer-session-client-secret', props.customerSessionClientSecret)
     pricingTable.value = stripePricingTable
-    rootEl.value!.appendChild(stripePricingTable)
+    rootEl.value.appendChild(stripePricingTable)
     emit('ready', instance)
   })
   watch(status, (status) => {
diff --git a/packages/script/src/runtime/components/ScriptVimeoPlayer.vue b/packages/script/src/runtime/components/ScriptVimeoPlayer.vue
index d00422c62..a5733000e 100644
--- a/packages/script/src/runtime/components/ScriptVimeoPlayer.vue
+++ b/packages/script/src/runtime/components/ScriptVimeoPlayer.vue
@@ -319,7 +319,18 @@ const placeholderAttrs = computed(() => {
   } satisfies ImgHTMLAttributes)
 })
 
-onBeforeUnmount(() => player?.unload())
+// destroy() (not unload()) unbinds every player.on() handler and removes the
+// SDK's global window `message` listener; unload() only resets the video and
+// would leak the player instance + its handler closures on every unmount.
+onBeforeUnmount(() => {
+  const currentPlayer = player
+  player = undefined
+  void currentPlayer?.destroy().catch((error) => {
+    // The iframe may already have been detached by Vue; destroy is best-effort.
+    if (import.meta.dev)
+      console.warn('[nuxt-scripts] Vimeo player cleanup failed:', error)
+  })
+})
 </script>
 
 <template>
diff --git a/packages/script/src/runtime/composables/useScript.ts b/packages/script/src/runtime/composables/useScript.ts
index 8eb533217..d7b1f52de 100644
--- a/packages/script/src/runtime/composables/useScript.ts
+++ b/packages/script/src/runtime/composables/useScript.ts
@@ -14,6 +14,15 @@ type NuxtScriptsApp = ReturnType<typeof useNuxtApp> & {
   _scripts: Record<string, NuxtDevToolsScriptInstance>
 }
 
+const DEVTOOLS_EVENT_LIMIT = 250
+const DEVTOOLS_NETWORK_REQUEST_LIMIT = 500
+
+function pushBounded<T>(items: T[], item: T, limit: number): void {
+  items.push(item)
+  if (items.length > limit)
+    items.splice(0, items.length - limit)
+}
+
 /**
  * Devtools network tracking utilities.
  * All functions below are only called inside `import.meta.dev` guards,
@@ -96,6 +105,7 @@ function observeNetworkRequests(
   const proxyPrefix = resolveProxyPrefix()
   const matchesScript = createDomainMatcher(domains, proxyPrefix, scriptSrc)
   const seen = new Set<string>()
+  const seenOrder: string[] = []
 
   function entryKey(entry: PerformanceResourceTiming): string {
     return `${entry.name}@${entry.startTime}`
@@ -108,7 +118,13 @@ function observeNetworkRequests(
     if (!matchesScript(entry))
       return false
     seen.add(key)
-    payload.networkRequests.push(toNetworkRequest(entry, proxyPrefix))
+    seenOrder.push(key)
+    if (seenOrder.length > DEVTOOLS_NETWORK_REQUEST_LIMIT) {
+      const oldest = seenOrder.shift()
+      if (oldest)
+        seen.delete(oldest)
+    }
+    pushBounded(payload.networkRequests, toNetworkRequest(entry, proxyPrefix), DEVTOOLS_NETWORK_REQUEST_LIMIT)
     return true
   }
 
@@ -181,14 +197,34 @@ export function useScript<T extends Record<symbol | string, any> = Record<symbol
     })
     const nuxtApp = useNuxtApp() as NuxtScriptsApp
     ensureScripts(nuxtApp)
+    const existing = nuxtApp.$scripts[src]
+    if (existing)
+      return existing as UseScriptContext<UseFunctionType<NuxtUseScriptOptions<T>, T>>
+
     const status = ref('loaded')
     let disconnectObserver = () => {}
-    const stub = {
+    let stopAppUnmountHook = () => {}
+    let cleaned = false
+    let stub: UseScriptContext<UseFunctionType<NuxtUseScriptOptions<T>, T>>
+    const cleanup = () => {
+      if (cleaned)
+        return
+      cleaned = true
+      disconnectObserver()
+      stopAppUnmountHook()
+      if (nuxtApp.$scripts[src] === stub)
+        delete nuxtApp.$scripts[src]
+      if (import.meta.dev && import.meta.client && nuxtApp._scripts?.[src]) {
+        delete nuxtApp._scripts[src]
+        nuxtApp.hooks.callHook('scripts:updated' as any, { scripts: nuxtApp._scripts })
+      }
+    }
+    stub = {
       id: src,
       status,
       load: () => Promise.resolve({} as T),
       remove: () => {
-        disconnectObserver()
+        cleanup()
         return false
       },
       entry: undefined,
@@ -215,6 +251,8 @@ export function useScript<T extends Record<symbol | string, any> = Record<symbol
       }
 
       function syncScripts() {
+        if (cleaned)
+          return
         nuxtApp._scripts[src] = payload
         nuxtApp.hooks.callHook('scripts:updated' as any, { scripts: nuxtApp._scripts })
       }
@@ -223,6 +261,8 @@ export function useScript<T extends Record<symbol | string, any> = Record<symbol
       syncScripts()
     }
 
+    stopAppUnmountHook = nuxtApp.hooks.hook('app:unmount' as any, cleanup)
+
     return stub
   }
 
@@ -275,40 +315,83 @@ export function useScript<T extends Record<symbol | string, any> = Record<symbol
   }
 
   const instance = _useScript<T>(input, options as any as UseScriptOptions<T>) as UseScriptContext<UseFunctionType<NuxtUseScriptOptions<T>, T>> & { reload: () => Promise<T> }
-  const _remove = instance.remove
+
+  // _useScript still needs to run for repeated calls because @unhead/vue
+  // registers the caller's scoped callbacks. The shared instance itself must
+  // only be decorated once, otherwise every mount stacks app-global hooks and
+  // wrapper closures around the same object.
+  if (exists)
+    return instance as UseScriptContext<UseFunctionType<NuxtUseScriptOptions<T>, T>>
+
+  markRaw(instance as any)
+  ;(instance as any).toJSON = () => ({ id: instance.id, status: instance.status.value })
+
+  const cleanupFns = new Set<() => void>()
+  let cleaned = false
+  const addCleanup = (cleanup: () => void) => {
+    if (cleaned)
+      cleanup()
+    else
+      cleanupFns.add(cleanup)
+  }
+  const cleanupInstance = () => {
+    if (cleaned)
+      return
+    cleaned = true
+    for (const cleanup of cleanupFns)
+      cleanup()
+    cleanupFns.clear()
+    if (nuxtApp.$scripts[id] === instance)
+      delete nuxtApp.$scripts[id]
+    if (import.meta.dev && import.meta.client && nuxtApp._scripts?.[instance.id]) {
+      delete nuxtApp._scripts[instance.id]
+      nuxtApp.hooks.callHook('scripts:updated' as any, { scripts: nuxtApp._scripts })
+    }
+  }
+
+  let currentRemove = instance.remove
+  let currentLoad = instance.load
   instance.remove = () => {
-    nuxtApp.$scripts[id] = undefined
-    return _remove()
+    const result = currentRemove()
+    cleanupInstance()
+    return result
   }
-  const _load = instance.load
   instance.load = async () => {
     if (err) {
       return Promise.reject(err)
     }
-    return _load()
+    return currentLoad()
   }
   // Add reload method for scripts that need to re-execute (e.g., DOM-scanning scripts)
   instance.reload = async () => {
-    instance.remove()
+    // Remove only the current Unhead entry. Runtime observers/hooks belong to
+    // this stable public instance and remain active across the reload.
+    currentRemove()
     // Use unique key to bypass Unhead's deduplication
     const reloadInput = typeof input === 'string'
       ? { src: input, key: `${id}-${Date.now()}` }
       : { ...input, key: `${id}-${Date.now()}` }
     // Re-create the script entry
     const reloaded = _useScript<T>(reloadInput, { ...options, trigger: 'client' } as any as UseScriptOptions<T>)
+    currentRemove = reloaded.remove
+    currentLoad = reloaded.load
     // Copy over the new instance properties
     Object.assign(instance, {
       status: reloaded.status,
       entry: reloaded.entry,
     })
-    return reloaded.load()
+    return currentLoad()
   }
   nuxtApp.$scripts[id] = instance
+  addCleanup(nuxtApp.hooks.hook('app:unmount' as any, () => {
+    currentRemove()
+    cleanupInstance()
+  }))
 
   // Debug logging: emit a structured log per script lifecycle event when debug
   // is enabled at build-time (or in dev). Tagged with registryKey when present
   // (e.g. `googleTagManager`), else the script id (src/key).
-  if (import.meta.client && debugEnabled) {
+  if (import.meta.client && debugEnabled && !exists) {
     const registryKey = options?.devtools?.registryKey as string | undefined
     const src = (input as any)?.src
     const trigger = options?.trigger
@@ -326,7 +409,7 @@ export function useScript<T extends Record<symbol | string, any> = Record<symbol
       ...ctx,
       trigger: typeof trigger === 'object' ? (trigger instanceof Promise ? 'promise' : JSON.stringify(trigger)) : trigger,
     })
-    headHooks.hook('script:updated', (entry) => {
+    addCleanup(headHooks.hook('script:updated', (entry) => {
       if (entry.script.id !== instance.id)
         return
       const status = entry.script.status
@@ -338,7 +421,7 @@ export function useScript<T extends Record<symbol | string, any> = Record<symbol
         payload.loadMs = Math.round(performance.now() - tLoadStart)
       const fn = status === 'error' ? log.warn : log.debug
       fn(`status: ${status}`, payload)
-    })
+    }))
     const _origLoad = instance.load
     instance.load = () => {
       log.debug('load() called', ctx)
@@ -358,9 +441,6 @@ export function useScript<T extends Record<symbol | string, any> = Record<symbol
 
   // used for devtools integration
   if (import.meta.dev && import.meta.client) {
-    if (exists) {
-      return instance as any as UseScriptContext<UseFunctionType<NuxtUseScriptOptions<T>, T>>
-    }
     // sync scripts to nuxtApp with debug details
     const payload: NuxtDevToolsScriptInstance = {
       ...options.devtools,
@@ -372,50 +452,52 @@ export function useScript<T extends Record<symbol | string, any> = Record<symbol
     nuxtApp._scripts = nuxtApp._scripts! || {}
 
     function syncScripts() {
+      if (cleaned)
+        return
       nuxtApp._scripts[instance.id] = payload
       nuxtApp.hooks.callHook('scripts:updated' as any, { scripts: nuxtApp._scripts })
     }
 
     if (!nuxtApp._scripts[instance.id]) {
-      headHooks.hook('script:updated', (ctx) => {
+      addCleanup(headHooks.hook('script:updated', (ctx) => {
         if (ctx.script.id !== instance.id)
           return
         // convert the status to a timestamp
-        payload.events.push({
+        pushBounded(payload.events, {
           type: 'status',
           status: ctx.script.status,
           at: Date.now(),
-        })
+        }, DEVTOOLS_EVENT_LIMIT)
         payload.$script = instance
         syncScripts()
-      })
+      }))
       // @ts-expect-error untyped
-      headHooks.hook('script:instance-fn', (ctx) => {
+      addCleanup(headHooks.hook('script:instance-fn', (ctx) => {
         if (ctx.script.id !== instance.id || String(ctx.fn).startsWith('__v_'))
           return
         // log all events
-        payload.events.push({
+        pushBounded(payload.events, {
           type: 'fn-call',
           fn: ctx.fn,
           at: Date.now(),
-        })
+        }, DEVTOOLS_EVENT_LIMIT)
         syncScripts()
-      })
+      }))
       payload.$script = instance
       if (err) {
-        payload.events.push({
+        pushBounded(payload.events, {
           type: 'status',
           status: 'validation-failed',
           args: err,
           at: Date.now(),
-        })
+        }, DEVTOOLS_EVENT_LIMIT)
       }
-      payload.events.push({
+      pushBounded(payload.events, {
         type: 'status',
         status: 'awaitingLoad',
         trigger: options?.trigger,
         at: Date.now(),
-      })
+      }, DEVTOOLS_EVENT_LIMIT)
 
       // Network request tracking via Resource Timing API
       const scriptHostname = extractExternalHostname(input.src)
@@ -424,28 +506,20 @@ export function useScript<T extends Record<symbol | string, any> = Record<symbol
         ...(options.devtools?.domains || []),
       ])
       let disconnectObserver = observeNetworkRequests(payload, domains, syncScripts, input.src)
+      addCleanup(() => disconnectObserver())
       // Clean up observer when script is removed, but keep it alive across reload()
-      const _origRemove = instance.remove
       const _origReload = instance.reload
-      instance.remove = () => {
-        disconnectObserver()
-        return _origRemove()
-      }
       instance.reload = async () => {
         // Disconnect before reload, reconnect after so new network entries are tracked
         disconnectObserver()
         const result = await _origReload()
-        disconnectObserver = observeNetworkRequests(payload, domains, syncScripts, input.src)
+        if (!cleaned)
+          disconnectObserver = observeNetworkRequests(payload, domains, syncScripts, input.src)
         return result
       }
 
       syncScripts()
     }
   }
-  // Prevent Vue from making the instance deeply reactive, and guard against
-  // circular JSON errors if anything calls JSON.stringify on it (Vue 3.5+
-  // refs have circular `.dep` properties).
-  markRaw(instance as any)
-  ;(instance as any).toJSON = () => ({ id: instance.id, status: instance.status.value })
   return instance as any as UseScriptContext<UseFunctionType<NuxtUseScriptOptions<T>, T>>
 }
diff --git a/packages/script/src/runtime/composables/useScriptEventPage.ts b/packages/script/src/runtime/composables/useScriptEventPage.ts
index 4c4b4b9b5..9f900f7ab 100644
--- a/packages/script/src/runtime/composables/useScriptEventPage.ts
+++ b/packages/script/src/runtime/composables/useScriptEventPage.ts
@@ -15,18 +15,28 @@ export function useScriptEventPage(onChange?: (payload: TrackedPage) => void) {
     return payload
 
   let lastPayload: TrackedPage = { path: '', title: '' }
-  let stopDomWatcher = () => {}
+  let disposed = false
+  const pendingCleanups = new Set<() => void>()
   // TODO make sure useAsyncData isn't running
   const stopPageFinishHook = nuxt.hooks.hook('page:finish', () => {
-    Promise.race([
-      // possibly no head update is needed
-      new Promise(resolve => setTimeout(resolve, 100)),
-      new Promise<void>((resolve) => {
-        stopDomWatcher = head.hooks!.hook('dom:rendered', () => resolve())
-      }),
-    ])
-      .finally(stopDomWatcher)
-      .then(() => {
+    let settled = false
+    let stopDomWatcher = () => {}
+    const timer = setTimeout(finish, 100)
+
+    function cleanup() {
+      clearTimeout(timer)
+      stopDomWatcher()
+      pendingCleanups.delete(cleanup)
+    }
+
+    function finish() {
+      if (settled)
+        return
+      settled = true
+      cleanup()
+      queueMicrotask(() => {
+        if (disposed)
+          return
         payload.value = {
           path: route.fullPath,
           title: document.title,
@@ -38,10 +48,17 @@ export function useScriptEventPage(onChange?: (payload: TrackedPage) => void) {
           lastPayload = payload.value
         }
       })
+    }
+
+    pendingCleanups.add(cleanup)
+    stopDomWatcher = head.hooks!.hook('dom:rendered', finish)
   })
 
   onScopeDispose(() => {
-    stopDomWatcher()
+    disposed = true
+    for (const cleanup of pendingCleanups)
+      cleanup()
+    pendingCleanups.clear()
     stopPageFinishHook()
   })
 
diff --git a/packages/script/src/runtime/composables/useScriptTriggerIdleTimeout.ts b/packages/script/src/runtime/composables/useScriptTriggerIdleTimeout.ts
index ec79e6e84..fffe08f68 100644
--- a/packages/script/src/runtime/composables/useScriptTriggerIdleTimeout.ts
+++ b/packages/script/src/runtime/composables/useScriptTriggerIdleTimeout.ts
@@ -20,17 +20,35 @@ export function useScriptTriggerIdleTimeout(options: IdleTimeoutScriptTriggerOpt
   const { timeout } = options
 
   return new Promise<boolean>((resolve) => {
+    let disposed = false
+    let settled = false
+    let stopTimer = () => {}
+
+    const settle = (value: boolean) => {
+      if (settled)
+        return
+      settled = true
+      stopTimer()
+      resolve(value)
+    }
+
+    // Register disposal while setup's effect scope is active. onNuxtReady may
+    // run later, when there is no active component scope to attach cleanup to.
+    tryOnScopeDispose(() => {
+      disposed = true
+      settle(false)
+    })
+
     onNuxtReady(() => {
+      if (disposed)
+        return
+
       const { start, stop } = useTimeoutFn(() => {
-        resolve(true)
+        settle(true)
       }, timeout, { immediate: false })
 
+      stopTimer = stop
       start()
-
-      tryOnScopeDispose(() => {
-        stop()
-        resolve(false)
-      })
     })
   })
 }
diff --git a/packages/script/src/runtime/composables/useScriptTriggerInteraction.ts b/packages/script/src/runtime/composables/useScriptTriggerInteraction.ts
index 8af93feab..0d362f9de 100644
--- a/packages/script/src/runtime/composables/useScriptTriggerInteraction.ts
+++ b/packages/script/src/runtime/composables/useScriptTriggerInteraction.ts
@@ -25,33 +25,48 @@ export function useScriptTriggerInteraction(options: InteractionScriptTriggerOpt
   const { events, target = document.documentElement } = options
 
   return new Promise<boolean>((resolve) => {
+    let disposed = false
+    let settled = false
+    const cleanupFns: Array<() => void> = []
+
+    const cleanup = () => {
+      cleanupFns.splice(0).forEach(fn => fn())
+    }
+    const settle = (value: boolean) => {
+      if (settled)
+        return
+      settled = true
+      cleanup()
+      resolve(value)
+    }
+
+    // onNuxtReady can run after the component scope has already been stopped,
+    // so disposal must be registered synchronously during setup.
+    tryOnScopeDispose(() => {
+      disposed = true
+      settle(false)
+    })
+
     onNuxtReady(() => {
+      if (disposed)
+        return
       if (!target) {
-        resolve(false)
+        settle(false)
         return
       }
 
-      const cleanupFns: Array<() => void> = []
-
       // Listen for all specified events
       events.forEach((event) => {
         const cleanup = useEventListener(
           target,
           event,
           () => {
-            // Clean up all listeners when any event triggers
-            cleanupFns.forEach(fn => fn())
-            resolve(true)
+            settle(true)
           },
           { once: true, passive: true },
         )
         cleanupFns.push(cleanup)
       })
-
-      tryOnScopeDispose(() => {
-        cleanupFns.forEach(fn => fn())
-        resolve(false)
-      })
     })
   })
 }
diff --git a/packages/script/src/runtime/composables/useScriptTriggerServiceWorker.ts b/packages/script/src/runtime/composables/useScriptTriggerServiceWorker.ts
index 475ebfc9b..c24d386c5 100644
--- a/packages/script/src/runtime/composables/useScriptTriggerServiceWorker.ts
+++ b/packages/script/src/runtime/composables/useScriptTriggerServiceWorker.ts
@@ -16,38 +16,42 @@ export function useScriptTriggerServiceWorker(options?: { timeout?: number }): P
       return
     }
 
-    let resolved = false
-    const done = () => {
-      if (resolved)
+    let settled = false
+    let timer: ReturnType<typeof setTimeout> | undefined
+    const cleanup = () => {
+      navigator.serviceWorker.removeEventListener('controllerchange', onControllerChange)
+      if (timer !== undefined) {
+        clearTimeout(timer)
+        timer = undefined
+      }
+    }
+    const done = (value: boolean) => {
+      if (settled)
         return
-      resolved = true
-      resolve(true)
+      settled = true
+      cleanup()
+      resolve(value)
     }
 
+    function onControllerChange() {
+      done(true)
+    }
+
+    tryOnScopeDispose(() => done(false))
+
     // If SW is already controlling, we're good
     if (navigator.serviceWorker.controller) {
-      done()
+      done(true)
       return
     }
 
     // Wait for SW to take control of this page
-    const onControllerChange = () => {
-      navigator.serviceWorker.removeEventListener('controllerchange', onControllerChange)
-      done()
-    }
     navigator.serviceWorker.addEventListener('controllerchange', onControllerChange)
 
     // Fallback timeout in case SW never takes control
-    const timer = setTimeout(() => {
-      navigator.serviceWorker.removeEventListener('controllerchange', onControllerChange)
+    timer = setTimeout(() => {
       console.warn('[nuxt-scripts] Service worker not controlling after timeout, loading scripts anyway')
-      done()
+      done(true)
     }, timeout)
-
-    tryOnScopeDispose(() => {
-      navigator.serviceWorker.removeEventListener('controllerchange', onControllerChange)
-      clearTimeout(timer)
-      resolve(false)
-    })
   })
 }
diff --git a/packages/script/src/runtime/devtools-standalone-bridge.client.ts b/packages/script/src/runtime/devtools-standalone-bridge.client.ts
index 66481a2ec..1f6d91c89 100644
--- a/packages/script/src/runtime/devtools-standalone-bridge.client.ts
+++ b/packages/script/src/runtime/devtools-standalone-bridge.client.ts
@@ -13,17 +13,25 @@ export default defineNuxtPlugin(() => {
   const firstPartyData = (config.public['nuxt-scripts-devtools'] as any) || null
 
   let lastScripts: Record<string, any> = {}
+  let disposed = false
+  let requestController: AbortController | undefined
 
   function pushState(scripts?: Record<string, any>) {
+    if (disposed)
+      return
     if (scripts)
       lastScripts = scripts
     const route = nuxtApp.$router?.currentRoute?.value
     // Don't report the devtools UI route as the user's current page
     if (route?.path?.startsWith('/__nuxt-scripts'))
       return
+    requestController?.abort()
+    const controller = new AbortController()
+    requestController = controller
     fetch('/__nuxt-scripts-api/state', {
       method: 'POST',
       headers: { 'Content-Type': 'application/json' },
+      signal: controller.signal,
       body: JSON.stringify({
         scripts: serializeScripts(lastScripts),
         version,
@@ -31,20 +39,37 @@ export default defineNuxtPlugin(() => {
         route: route ? { path: route.path, fullPath: route.fullPath, query: route.query } : null,
       }),
     }).catch((error) => {
-      if (import.meta.dev)
+      if (import.meta.dev && error?.name !== 'AbortError')
         console.warn('[nuxt-scripts] Failed to sync standalone devtools state:', error)
+    }).finally(() => {
+      if (requestController === controller)
+        requestController = undefined
     })
   }
 
-  nuxtApp.hooks.hook('scripts:updated' as any, (ctx: { scripts: Record<string, any> }) => {
+  const stopScriptsHook = nuxtApp.hooks.hook('scripts:updated' as any, (ctx: { scripts: Record<string, any> }) => {
     pushState(ctx.scripts)
   })
 
   // Sync route changes
-  nuxtApp.$router?.afterEach(() => {
+  const stopRouterHook = nuxtApp.$router?.afterEach(() => {
     pushState()
   })
 
+  let stopUnmountHook = () => {}
+  const cleanup = () => {
+    if (disposed)
+      return
+    disposed = true
+    requestController?.abort()
+    requestController = undefined
+    lastScripts = {}
+    stopScriptsHook()
+    stopRouterHook?.()
+    stopUnmountHook()
+  }
+  stopUnmountHook = nuxtApp.hooks.hook('app:unmount' as any, cleanup)
+
   // Push initial state on load
   pushState((nuxtApp as any)._scripts || {})
 })
diff --git a/packages/script/src/runtime/npm-script-stub.ts b/packages/script/src/runtime/npm-script-stub.ts
index 28e1ba438..49eccfea7 100644
--- a/packages/script/src/runtime/npm-script-stub.ts
+++ b/packages/script/src/runtime/npm-script-stub.ts
@@ -27,7 +27,6 @@ export function createNpmScriptStub<T = any>(
 ): NpmScriptStub<T> {
   const status = ref<'awaitingLoad' | 'loading' | 'loaded' | 'error'>('awaitingLoad')
   const loadedCallbacks: Array<(api: T) => void> = []
-  let initPromise: Promise<any> | null = null
   let hasInitialized = false
 
   // Get the proxy/API from use() function
@@ -50,8 +49,7 @@ export function createNpmScriptStub<T = any>(
         if (options.clientInit) {
           // eslint-disable-next-line no-console
           console.log(`[NpmScriptStub] Initializing ${options.key}...`)
-          initPromise = Promise.resolve(options.clientInit())
-          await initPromise
+          await options.clientInit()
           // eslint-disable-next-line no-console
           console.log(`[NpmScriptStub] ${options.key} initialized successfully`)
         }
@@ -59,7 +57,9 @@ export function createNpmScriptStub<T = any>(
         status.value = 'loaded'
 
         // Fire all onLoaded callbacks with the proxy
-        loadedCallbacks.forEach((cb) => {
+        // Release callback closures as soon as they have fired. Registry stubs
+        // can live for the app lifetime, while their callers may not.
+        loadedCallbacks.splice(0).forEach((cb) => {
           try {
             cb(proxy)
           }
diff --git a/packages/script/src/runtime/registry/speedcurve.ts b/packages/script/src/runtime/registry/speedcurve.ts
index 48d428763..c3a411660 100644
--- a/packages/script/src/runtime/registry/speedcurve.ts
+++ b/packages/script/src/runtime/registry/speedcurve.ts
@@ -32,6 +32,7 @@ const LUX_USER_CONFIG_KEYS = Object.keys(SpeedCurveOptions.entries).filter(
 ) as (keyof UserConfig)[]
 
 let luxWired = false
+let teardownAutoTracker = () => {}
 
 export function useScriptSpeedCurve<T extends SpeedCurveApi>(_options?: SpeedCurveInput): UseScriptContext<T> {
   return useRegistryScript<T, typeof SpeedCurveOptions>('speedcurve', options => ({
@@ -101,7 +102,7 @@ export function installAutoTracker(options?: SpeedCurveInput): void {
       ? options.label
       : (to: RouteLocationNormalized) => String(to.name ?? to.path)
 
-  router.beforeEach((to) => {
+  const stopBeforeEach = router.beforeEach((to) => {
     const lux = window.LUX
     if (!lux)
       return
@@ -123,7 +124,7 @@ export function installAutoTracker(options?: SpeedCurveInput): void {
   })
 
   // If a guard cancels navigation, seal the phantom beacon with a filterable tag.
-  router.afterEach((_to, _from, failure) => {
+  const stopAfterEach = router.afterEach((_to, _from, failure) => {
     if (!failure)
       return
     const lux = window.LUX
@@ -133,7 +134,33 @@ export function installAutoTracker(options?: SpeedCurveInput): void {
     lux.addData('luxNavFailed', '1')
   })
 
-  nuxt.hook('page:finish', () => {
-    afterNextPaint(() => window.LUX?.markLoadTime())
+  const pendingPaints = new Set<{ cancel: () => void }>()
+  const stopPageFinish = nuxt.hook('page:finish', () => {
+    const pending = { cancel: () => {} }
+    pendingPaints.add(pending)
+    pending.cancel = afterNextPaint(() => {
+      pendingPaints.delete(pending)
+      window.LUX?.markLoadTime()
+    })
   })
+
+  let stopAppUnmount = () => {}
+  const cleanup = () => {
+    if (!luxWired)
+      return
+    luxWired = false
+    stopBeforeEach()
+    stopAfterEach()
+    stopPageFinish()
+    stopAppUnmount()
+    for (const pending of pendingPaints)
+      pending.cancel()
+    pendingPaints.clear()
+    teardownAutoTracker = () => {}
+  }
+  stopAppUnmount = nuxt.hook('app:unmount' as any, cleanup)
+  teardownAutoTracker = cleanup
 }
+
+if (import.meta.hot)
+  import.meta.hot.dispose(() => teardownAutoTracker())
diff --git a/packages/script/src/runtime/registry/usercentrics.ts b/packages/script/src/runtime/registry/usercentrics.ts
index 5549a6d06..93275ba56 100644
--- a/packages/script/src/runtime/registry/usercentrics.ts
+++ b/packages/script/src/runtime/registry/usercentrics.ts
@@ -1,5 +1,7 @@
 import type { RegistryScriptInput, UseScriptContext } from '#nuxt-scripts/types'
 import { useHead } from '@unhead/vue'
+import { useNuxtApp } from 'nuxt/app'
+import { logger } from '../logger'
 import { useRegistryScript } from '../utils'
 import { UsercentricsOptions } from './schemas'
 
@@ -117,16 +119,57 @@ export function useScriptUsercentrics<T extends UsercentricsApi>(
   }, _options) as UseScriptContext<T, UsercentricsConsent>
 
   if (import.meta.client && !instance.consent) {
-    const whenReady = (): Promise<UsercentricsCmp> => new Promise((resolve) => {
-      // __ucCmp is present from loader bootstrap, but methods aren't callable
-      // until UC_CMP_API_READY fires. Resolve on that event (or now if it
-      // already fired and __ucCmp is bound).
-      const onReady = () => {
-        window.removeEventListener('UC_CMP_API_READY', onReady)
-        resolve(window.__ucCmp as UsercentricsCmp)
+    let readyApi: UsercentricsCmp | undefined
+    let readyPromise: Promise<UsercentricsCmp> | undefined
+    let resolveReady: ((api: UsercentricsCmp) => void) | undefined
+
+    const onReady = () => {
+      const api = window.__ucCmp
+      if (!api)
+        return
+      readyApi = api
+      window.removeEventListener('UC_CMP_API_READY', onReady)
+      resolveReady?.(api)
+      resolveReady = undefined
+    }
+    const cleanupReadyListener = () => {
+      window.removeEventListener('UC_CMP_API_READY', onReady)
+      resolveReady = undefined
+    }
+    const whenReady = (): Promise<UsercentricsCmp> => {
+      if (readyApi)
+        return Promise.resolve(readyApi)
+      if (!readyPromise) {
+        // Install the event listener before checking isInitialized() so an
+        // event fired during that async check cannot be missed.
+        readyPromise = new Promise((resolve) => {
+          resolveReady = resolve
+          window.addEventListener('UC_CMP_API_READY', onReady)
+        })
+        const api = window.__ucCmp
+        if (api?.isInitialized) {
+          Promise.resolve(api.isInitialized())
+            .then((initialized) => {
+              if (initialized)
+                onReady()
+            })
+            .catch((error) => {
+              // Some bootstrap stubs throw until the ready event; the event
+              // listener remains the authoritative readiness signal.
+              logger.debug('[usercentrics] Waiting for UC_CMP_API_READY after isInitialized() failed', error)
+            })
+        }
       }
-      window.addEventListener('UC_CMP_API_READY', onReady)
-    })
+      return readyPromise
+    }
+
+    const stopAppUnmount = useNuxtApp().hooks.hook('app:unmount' as any, cleanupReadyListener)
+    const originalRemove = instance.remove
+    instance.remove = () => {
+      cleanupReadyListener()
+      stopAppUnmount()
+      return originalRemove()
+    }
 
     instance.consent = {
       whenReady,
diff --git a/packages/script/src/runtime/registry/youtube-player.ts b/packages/script/src/runtime/registry/youtube-player.ts
index 757fb48d4..b11ab422b 100644
--- a/packages/script/src/runtime/registry/youtube-player.ts
+++ b/packages/script/src/runtime/registry/youtube-player.ts
@@ -56,7 +56,18 @@ export function useScriptYouTubePlayer<T extends YouTubePlayerApi>(_options: You
       ? undefined
       : () => {
           readyPromise = new Promise((resolve) => {
-            window.onYouTubeIframeAPIReady = resolve
+            const previousReady = window.onYouTubeIframeAPIReady
+            const onReady = () => {
+              if (window.onYouTubeIframeAPIReady === onReady) {
+                if (previousReady)
+                  window.onYouTubeIframeAPIReady = previousReady
+                else
+                  delete (window as any).onYouTubeIframeAPIReady
+              }
+              previousReady?.()
+              resolve()
+            }
+            window.onYouTubeIframeAPIReady = onReady
           })
         },
   }), _options)
diff --git a/packages/script/src/runtime/server/instagram-embed.ts b/packages/script/src/runtime/server/instagram-embed.ts
index 3d419abb2..e8dbb91c1 100644
--- a/packages/script/src/runtime/server/instagram-embed.ts
+++ b/packages/script/src/runtime/server/instagram-embed.ts
@@ -2,6 +2,7 @@ import { createError, defineEventHandler, getQuery, setHeader } from 'h3'
 import { defineCachedFunction, useRuntimeConfig } from 'nitropack/runtime'
 import { $fetch } from 'ofetch'
 import { ELEMENT_NODE, parse, renderSync, TEXT_NODE, walkSync } from 'ultrahtml'
+import { NUXT_SCRIPTS_CACHE_BASE } from './utils/cache-config'
 import { createCachedJsonFetch } from './utils/cached-upstream'
 import { isEmbedShell, proxyAssetUrl, rewriteUrl, rewriteUrlsInText, RSRC_RE, scopeCss } from './utils/instagram-embed'
 import { withSigning } from './utils/withSigning'
@@ -26,6 +27,7 @@ const cachedEmbedFetch = defineCachedFunction(
     return html
   },
   {
+    base: NUXT_SCRIPTS_CACHE_BASE,
     // v2 — bump to evict any v1 entries that cached the empty JS shell
     // before the shell-detection / UA fix landed.
     name: 'nuxt-scripts-instagram-embed-v2',
diff --git a/packages/script/src/runtime/server/proxy-handler.ts b/packages/script/src/runtime/server/proxy-handler.ts
index 74113082b..b78774f6e 100644
--- a/packages/script/src/runtime/server/proxy-handler.ts
+++ b/packages/script/src/runtime/server/proxy-handler.ts
@@ -1,5 +1,5 @@
 import type { ProxyPrivacyInput, ResolvedProxyPrivacy } from './utils/privacy'
-import { createError, defineEventHandler, getHeaders, getQuery, getRequestIP, getRequestWebStream, readBody, setResponseHeader, setResponseStatus } from 'h3'
+import { createError, defineEventHandler, getHeaders, getQuery, getRequestIP, getRequestWebStream, setResponseHeader, setResponseStatus } from 'h3'
 import { useNitroApp, useRuntimeConfig } from 'nitropack/runtime'
 import { matchDomain } from './utils/match-domain'
 import {
@@ -27,6 +27,7 @@ interface ProxyConfig {
 
 const COMPRESSION_RE = /gzip|deflate|br|compress|base64/i
 const CLIENT_HINT_VERSION_RE = /;v="(\d+)\.[^"]*"/g
+const MAX_TRANSFORM_BODY_SIZE = 2 * 1024 * 1024
 const SKIP_RESPONSE_HEADERS = new Set(['set-cookie', 'transfer-encoding', 'content-encoding', 'content-length'])
 // Hop-by-hop request headers per RFC 7230 §6.1 — must not be forwarded by a proxy
 export const SKIP_REQUEST_HEADERS = new Set([
@@ -40,6 +41,88 @@ export const SKIP_REQUEST_HEADERS = new Set([
   'upgrade',
 ])
 
+async function readTransformBody(event: Parameters<typeof getRequestWebStream>[0]): Promise<string | undefined> {
+  const contentLength = Number(getHeaders(event)['content-length'] || 0)
+  if (Number.isFinite(contentLength) && contentLength > MAX_TRANSFORM_BODY_SIZE) {
+    throw createError({ statusCode: 413, statusMessage: 'Proxy request body too large' })
+  }
+
+  const stream = getRequestWebStream(event)
+  if (!stream)
+    return undefined
+  const reader = stream.getReader()
+  const chunks: Uint8Array[] = []
+  let total = 0
+  try {
+    while (true) {
+      const { done, value } = await reader.read()
+      if (done)
+        break
+      if (!value)
+        continue
+      total += value.byteLength
+      if (total > MAX_TRANSFORM_BODY_SIZE) {
+        await reader.cancel('Proxy request body too large')
+        throw createError({ statusCode: 413, statusMessage: 'Proxy request body too large' })
+      }
+      chunks.push(value)
+    }
+  }
+  finally {
+    reader.releaseLock()
+  }
+
+  const body = new Uint8Array(total)
+  let offset = 0
+  for (const chunk of chunks) {
+    body.set(chunk, offset)
+    offset += chunk.byteLength
+  }
+  return new TextDecoder().decode(body)
+}
+
+function streamUpstreamResponse(
+  body: ReadableStream<Uint8Array>,
+  controller: AbortController,
+  timeoutId: ReturnType<typeof setTimeout>,
+): ReadableStream<Uint8Array> {
+  const reader = body.getReader()
+  let finished = false
+  const cleanup = () => {
+    if (finished)
+      return
+    finished = true
+    clearTimeout(timeoutId)
+  }
+
+  return new ReadableStream<Uint8Array>({
+    async pull(streamController) {
+      try {
+        const { done, value } = await reader.read()
+        if (done) {
+          cleanup()
+          reader.releaseLock()
+          streamController.close()
+        }
+        else if (value) {
+          streamController.enqueue(value)
+        }
+      }
+      catch (error) {
+        cleanup()
+        reader.releaseLock()
+        streamController.error(error)
+      }
+    },
+    async cancel(reason) {
+      cleanup()
+      controller.abort()
+      await reader.cancel(reason)
+      reader.releaseLock()
+    },
+  })
+}
+
 /**
  * Strip fingerprinting from URL query string.
  * Returns both the query string and the stripped record (to avoid re-computing for hooks).
@@ -280,7 +363,7 @@ export default defineEventHandler(async (event) => {
     }
     else {
       // Text body with privacy transforms — parse and strip fingerprinting
-      rawBody = await readBody(event)
+      rawBody = await readTransformBody(event)
 
       if (rawBody != null) {
         if (Array.isArray(rawBody)) {
@@ -417,6 +500,7 @@ export default defineEventHandler(async (event) => {
     })
   }
   catch (err) {
+    clearTimeout(timeoutId)
     log('[proxy] Upstream error:', err)
     throw createError({
       statusCode: timedOut ? 504 : 502,
@@ -429,9 +513,6 @@ export default defineEventHandler(async (event) => {
       },
     })
   }
-  finally {
-    clearTimeout(timeoutId)
-  }
 
   log('[proxy] Response:', response.status, response.statusText)
 
@@ -444,14 +525,13 @@ export default defineEventHandler(async (event) => {
 
   setResponseStatus(event, response.status, response.statusText)
 
-  // Return the body as text for text-based content, otherwise as buffer
-  const responseContentType = response.headers.get('content-type') || ''
-  const isTextContent = responseContentType.includes('text') || responseContentType.includes('javascript') || responseContentType.includes('json')
-
-  if (isTextContent) {
-    return await response.text()
+  if (!response.body) {
+    clearTimeout(timeoutId)
+    return null
   }
 
-  // For binary content (images, etc.)
-  return Buffer.from(await response.arrayBuffer())
+  // Stream with cancellation propagation. This avoids buffering arbitrarily
+  // large responses and keeps the upstream timeout active until the body is
+  // consumed, cancelled, or errors.
+  return streamUpstreamResponse(response.body, controller, timeoutId)
 })
diff --git a/packages/script/src/runtime/server/utils/cache-config.ts b/packages/script/src/runtime/server/utils/cache-config.ts
new file mode 100644
index 000000000..372213b5f
--- /dev/null
+++ b/packages/script/src/runtime/server/utils/cache-config.ts
@@ -0,0 +1,10 @@
+/** Dedicated Nitro storage mount used by Nuxt Scripts' upstream caches. */
+export const NUXT_SCRIPTS_CACHE_BASE = 'nuxt-scripts-cache'
+
+/**
+ * Conservative defaults for the in-process fallback. Applications can replace
+ * this mount with Redis, KV, filesystem, or their own storage configuration.
+ */
+export const NUXT_SCRIPTS_CACHE_MAX_ENTRIES = 500
+export const NUXT_SCRIPTS_CACHE_MAX_SIZE = 32 * 1024 * 1024
+export const NUXT_SCRIPTS_CACHE_MAX_ENTRY_SIZE = 8 * 1024 * 1024
diff --git a/packages/script/src/runtime/server/utils/cached-upstream.ts b/packages/script/src/runtime/server/utils/cached-upstream.ts
index 7d2fdd4c8..4c491ac51 100644
--- a/packages/script/src/runtime/server/utils/cached-upstream.ts
+++ b/packages/script/src/runtime/server/utils/cached-upstream.ts
@@ -1,6 +1,7 @@
 import { Buffer } from 'node:buffer'
 import { defineCachedFunction } from 'nitropack/runtime'
 import { $fetch } from 'ofetch'
+import { NUXT_SCRIPTS_CACHE_BASE } from './cache-config'
 
 /**
  * Server-side caches for upstream proxy fetches.
@@ -69,6 +70,7 @@ export function createCachedBinaryFetch(
       }
     },
     {
+      base: NUXT_SCRIPTS_CACHE_BASE,
       name,
       maxAge,
       swr: true,
@@ -117,6 +119,7 @@ export function createCachedJsonFetch<T>(
       })
     },
     {
+      base: NUXT_SCRIPTS_CACHE_BASE,
       name,
       maxAge,
       swr: true,
diff --git a/packages/script/src/runtime/utils/after-next-paint.ts b/packages/script/src/runtime/utils/after-next-paint.ts
index e2633f871..365d0731b 100644
--- a/packages/script/src/runtime/utils/after-next-paint.ts
+++ b/packages/script/src/runtime/utils/after-next-paint.ts
@@ -1,5 +1,21 @@
 // One rAF fires before the next paint; two fires after it has committed to screen.
 // Same pattern used by web-vitals.js — no Nuxt/Vue equivalent exists.
-export function afterNextPaint(callback: () => void): void {
-  requestAnimationFrame(() => requestAnimationFrame(callback))
+export function afterNextPaint(callback: () => void): () => void {
+  let cancelled = false
+  let innerFrame: number | undefined
+  const outerFrame = requestAnimationFrame(() => {
+    if (cancelled)
+      return
+    innerFrame = requestAnimationFrame(() => {
+      if (!cancelled)
+        callback()
+    })
+  })
+
+  return () => {
+    cancelled = true
+    cancelAnimationFrame(outerFrame)
+    if (innerFrame !== undefined)
+      cancelAnimationFrame(innerFrame)
+  }
 }
diff --git a/test/unit/google-maps-lifecycle.test.ts b/test/unit/google-maps-lifecycle.test.ts
index dfbd93edc..3637181d9 100644
--- a/test/unit/google-maps-lifecycle.test.ts
+++ b/test/unit/google-maps-lifecycle.test.ts
@@ -475,4 +475,28 @@ describe('waitForMapsReady', () => {
     await expect(promise).resolves.toBeUndefined()
     expect(settled).toBe(true)
   })
+
+  it('stops a detached readiness watcher when its owner aborts', async () => {
+    const mapsApi = shallowRef<any>(undefined)
+    const map = shallowRef<any>(undefined)
+    const status = ref<string>('loading')
+    const controller = new AbortController()
+
+    const promise = waitForMapsReady({
+      mapsApi,
+      map,
+      status,
+      load: () => Promise.resolve(),
+      signal: controller.signal,
+    })
+
+    await nextTick()
+    controller.abort()
+
+    await expect(promise).rejects.toMatchObject({ name: 'AbortError' })
+    // Later ref changes must not revive or re-settle the stopped watcher.
+    mapsApi.value = { places: {} }
+    map.value = {}
+    await nextTick()
+  })
 })
diff --git a/test/unit/speedcurve-after-next-paint.test.ts b/test/unit/speedcurve-after-next-paint.test.ts
index 2308f53cf..75ec5214c 100644
--- a/test/unit/speedcurve-after-next-paint.test.ts
+++ b/test/unit/speedcurve-after-next-paint.test.ts
@@ -50,4 +50,22 @@ describe('afterNextPaint', () => {
     outerCb!(0)
     expect(cb).not.toHaveBeenCalled()
   })
+
+  it('cancels pending frames and releases the callback', () => {
+    const callbacks: FrameRequestCallback[] = []
+    vi.mocked(window.requestAnimationFrame).mockImplementation((cb) => {
+      callbacks.push(cb)
+      return callbacks.length
+    })
+    const cancel = vi.spyOn(window, 'cancelAnimationFrame')
+    const cb = vi.fn()
+
+    const stop = afterNextPaint(cb)
+    callbacks[0]!(0)
+    stop()
+    callbacks[1]!(0)
+
+    expect(cb).not.toHaveBeenCalled()
+    expect(cancel).toHaveBeenCalledTimes(2)
+  })
 })
diff --git a/vitest.config.ts b/vitest.config.ts
index 35b86e87a..523a740f7 100644
--- a/vitest.config.ts
+++ b/vitest.config.ts
@@ -23,11 +23,13 @@ export default defineConfig({
       defineProject({
         resolve: {
           alias: {
+            '@unhead/vue/scripts': new URL('./packages/script/node_modules/@unhead/vue/dist/scripts.mjs', import.meta.url).pathname,
             // Virtual emitted by the Nuxt module at build time; unit tests
             // mock it via `vi.mock('#build/nuxt-scripts-snippets')`, but the
             // import must first resolve to *something* the bundler accepts.
             // The alias points at an empty placeholder.
             '#build/nuxt-scripts-snippets': new URL('./test/unit/__mocks__/empty.ts', import.meta.url).pathname,
+            '#build/nuxt-scripts-trigger-resolver': new URL('./test/unit/__mocks__/empty.ts', import.meta.url).pathname,
           },
         },
         test: {

From 0c4a5acf0a0a0f224eb52bd9d6954fe3e48be33d Mon Sep 17 00:00:00 2001
From: Harlan Wilton <harlan@harlanzw.com>
Date: Thu, 16 Jul 2026 11:01:18 +1000
Subject: [PATCH 2/6] fix: harden lifecycle cleanup

---
 packages/devtools-app/composables/rpc.ts      |  28 ++---
 packages/devtools-app/utils/fetch.ts          |  44 ++++++--
 packages/script/src/devtools.ts               |   3 +
 .../GoogleMaps/ScriptGoogleMaps.vue           |   2 +-
 .../GoogleMaps/useGoogleMapsResource.ts       |  42 ++++---
 .../runtime/components/ScriptLemonSqueezy.vue |  18 ++-
 .../components/ScriptPayPalButtons.vue        |   2 +
 .../components/ScriptPayPalMessages.vue       |   2 +
 .../src/runtime/composables/useScript.ts      |  14 ++-
 .../script/src/runtime/npm-script-stub.ts     |   3 +-
 .../src/runtime/registry/usercentrics.ts      |  30 ++++-
 .../src/runtime/registry/youtube-player.ts    |  56 ++++++++--
 .../src/runtime/server/proxy-handler.ts       |  26 ++++-
 test/unit/cached-upstream-lifecycle.test.ts   |  33 ++++++
 test/unit/fetch-script-lifecycle.test.ts      |  25 +++++
 test/unit/google-maps-lifecycle.test.ts       |  19 ++++
 test/unit/npm-script-stub-lifecycle.test.ts   |  27 +++++
 test/unit/script-trigger-lifecycle.test.ts    |  98 +++++++++++++++++
 test/unit/use-script-lifecycle.test.ts        | 103 ++++++++++++++++++
 19 files changed, 511 insertions(+), 64 deletions(-)
 create mode 100644 test/unit/cached-upstream-lifecycle.test.ts
 create mode 100644 test/unit/fetch-script-lifecycle.test.ts
 create mode 100644 test/unit/npm-script-stub-lifecycle.test.ts
 create mode 100644 test/unit/script-trigger-lifecycle.test.ts
 create mode 100644 test/unit/use-script-lifecycle.test.ts

diff --git a/packages/devtools-app/composables/rpc.ts b/packages/devtools-app/composables/rpc.ts
index 651bf0cbf..e12722369 100644
--- a/packages/devtools-app/composables/rpc.ts
+++ b/packages/devtools-app/composables/rpc.ts
@@ -31,10 +31,23 @@ export function useDevtoolsConnection(options: DevtoolsConnectionOptions = {}):
   const inIframe = window.parent !== window
   let disposed = false
   const connectionCleanups: Array<() => void> = []
+  let pollTimer: ReturnType<typeof setInterval> | undefined
+  let pollController: AbortController | undefined
+
+  const stopPolling = () => {
+    if (pollTimer) {
+      clearInterval(pollTimer)
+      pollTimer = undefined
+    }
+    pollController?.abort()
+    pollController = undefined
+  }
 
   const cleanupConnection = () => {
     connectionCleanups.splice(0).forEach(cleanup => cleanup())
     devtools.value = undefined
+    appFetch.value = undefined
+    isConnected.value = false
   }
 
   // Embedded mode: connect via devtools-kit iframe client
@@ -43,6 +56,7 @@ export function useDevtoolsConnection(options: DevtoolsConnectionOptions = {}):
     stopClientConnection = onDevtoolsClientConnected((client) => {
       if (disposed)
         return
+      stopPolling()
       cleanupConnection()
       isConnected.value = true
       // @ts-expect-error untyped
@@ -69,18 +83,6 @@ export function useDevtoolsConnection(options: DevtoolsConnectionOptions = {}):
   }
 
   // Standalone mode: create appFetch from manually entered URL and poll for state
-  let pollTimer: ReturnType<typeof setInterval> | undefined
-  let pollController: AbortController | undefined
-
-  const stopPolling = () => {
-    if (pollTimer) {
-      clearInterval(pollTimer)
-      pollTimer = undefined
-    }
-    pollController?.abort()
-    pollController = undefined
-  }
-
   const poll = async (url: string) => {
     // A slow/unreachable app must not accumulate overlapping interval requests.
     if (pollController)
@@ -119,8 +121,6 @@ export function useDevtoolsConnection(options: DevtoolsConnectionOptions = {}):
     stopStandaloneWatch()
     stopClientConnection()
     cleanupConnection()
-    appFetch.value = undefined
-    isConnected.value = false
   }
 }
 
diff --git a/packages/devtools-app/utils/fetch.ts b/packages/devtools-app/utils/fetch.ts
index 47d6d356b..07d611f42 100644
--- a/packages/devtools-app/utils/fetch.ts
+++ b/packages/devtools-app/utils/fetch.ts
@@ -12,6 +12,7 @@ export async function fetchScript(url: string, signal?: AbortSignal) {
     return compressedResponse as { size: null, error: Error }
   }
   if (!compressedResponse.ok) {
+    await cancelResponseBody(compressedResponse)
     return {
       size: null,
       error: new Error(`Failed to fetch ${compressedResponse.status} ${compressedResponse.statusText}`),
@@ -20,9 +21,19 @@ export async function fetchScript(url: string, signal?: AbortSignal) {
   // Guard against measuring HTML error pages as script sizes
   const contentType = compressedResponse.headers.get('Content-Type') || ''
   if (contentType.includes('text/html')) {
+    await cancelResponseBody(compressedResponse)
     return { size: null }
   }
-  const size = await getResponseSize(compressedResponse)
+  let size: number | null
+  try {
+    size = await getResponseSize(compressedResponse)
+  }
+  catch (error) {
+    return {
+      size: null,
+      error: error instanceof Error ? error : new Error(String(error)),
+    }
+  }
   if (!size) {
     return {
       size: null,
@@ -34,23 +45,38 @@ export async function fetchScript(url: string, signal?: AbortSignal) {
 }
 
 async function getResponseSize(response: Response) {
-  const reader = response.body?.getReader()
   const contentLength = response.headers.get('Content-Length')
 
   if (contentLength) {
+    await cancelResponseBody(response)
     return Number(contentLength)
   }
+  const reader = response.body?.getReader()
   if (!reader) {
     return null
   }
-  let total = 0
-  let done = false
-  while (!done) {
-    const data = await reader.read()
-    done = data.done
-    total += data.value?.length || 0
+  try {
+    let total = 0
+    let done = false
+    while (!done) {
+      const data = await reader.read()
+      done = data.done
+      total += data.value?.length || 0
+    }
+    return total > 0 ? total : null
+  }
+  finally {
+    reader.releaseLock()
+  }
+}
+
+async function cancelResponseBody(response: Response) {
+  try {
+    await response.body?.cancel()
+  }
+  catch {
+    // The response is being discarded, so cancellation failure is non-fatal.
   }
-  return total > 0 ? total : null
 }
 
 function bytesToSize(bytes: number) {
diff --git a/packages/script/src/devtools.ts b/packages/script/src/devtools.ts
index 5e8a3fb02..215a5942c 100644
--- a/packages/script/src/devtools.ts
+++ b/packages/script/src/devtools.ts
@@ -106,6 +106,9 @@ function setupStandaloneApi(nuxt: Nuxt) {
             body = ''
             cleanup()
             // Drain the remainder so the keep-alive connection can be reused.
+            // `cleanup()` removed the normal error handler, so keep one listener
+            // attached while the unread request bytes are being discarded.
+            req.once('error', () => {})
             req.resume()
             res.statusCode = 413
             res.end('payload too large')
diff --git a/packages/script/src/runtime/components/GoogleMaps/ScriptGoogleMaps.vue b/packages/script/src/runtime/components/GoogleMaps/ScriptGoogleMaps.vue
index 292f0354e..5ca731328 100644
--- a/packages/script/src/runtime/components/GoogleMaps/ScriptGoogleMaps.vue
+++ b/packages/script/src/runtime/components/GoogleMaps/ScriptGoogleMaps.vue
@@ -517,7 +517,7 @@ onMounted(() => {
     await nextTick()
     // Component may have unmounted (or refs been torn down) during nextTick;
     // bail out so we don't spin up a Map against a detached container.
-    if (!mapEl.value || !mapsApi.value)
+    if (isUnmounted || !mapEl.value || !mapsApi.value)
       return
     const _options: google.maps.MapOptions = {
       ...options.value,
diff --git a/packages/script/src/runtime/components/GoogleMaps/useGoogleMapsResource.ts b/packages/script/src/runtime/components/GoogleMaps/useGoogleMapsResource.ts
index 1d205b4e7..12b9a374f 100644
--- a/packages/script/src/runtime/components/GoogleMaps/useGoogleMapsResource.ts
+++ b/packages/script/src/runtime/components/GoogleMaps/useGoogleMapsResource.ts
@@ -175,7 +175,15 @@ export async function waitForMapsReady({
     }
     onAbort = () => settle(() => reject(abortError()))
     signal?.addEventListener('abort', onAbort, { once: true })
-    Promise.resolve(load()).then(
+    let loading: Promise<unknown>
+    try {
+      loading = Promise.resolve(load())
+    }
+    catch (error) {
+      settle(() => reject(error))
+      return
+    }
+    loading.then(
       () => settle(resolve),
       error => settle(() => reject(error)),
     )
@@ -258,20 +266,26 @@ export function useGoogleMapsResource<T>({
   whenever(
     () => mapContext?.map.value && mapContext.mapsApi.value && (!ready || ready()),
     () => {
-      Promise.resolve(create({
-        map: mapContext!.map.value!,
-        mapsApi: mapContext!.mapsApi.value!,
-      }))
-        .then((result) => {
-          if (isUnmounted.value) {
-            // Resource was created during the async gap after unmount — clean it up immediately
-            if (cleanup && mapContext?.mapsApi.value) {
-              cleanup(result, { mapsApi: mapContext.mapsApi.value })
-            }
-            return
+      let creation: Promise<T>
+      try {
+        creation = Promise.resolve(create({
+          map: mapContext!.map.value!,
+          mapsApi: mapContext!.mapsApi.value!,
+        }))
+      }
+      catch (error) {
+        creation = Promise.reject(error)
+      }
+      creation.then((result) => {
+        if (isUnmounted.value) {
+          // Resource was created during the async gap after unmount — clean it up immediately
+          if (cleanup && mapContext?.mapsApi.value) {
+            cleanup(result, { mapsApi: mapContext.mapsApi.value })
           }
-          resource.value = result
-        })
+          return
+        }
+        resource.value = result
+      })
         .catch((err) => {
           if (import.meta.dev) {
             console.error('[nuxt-scripts] Google Maps resource creation failed:', err)
diff --git a/packages/script/src/runtime/components/ScriptLemonSqueezy.vue b/packages/script/src/runtime/components/ScriptLemonSqueezy.vue
index 57170f529..e594bc573 100644
--- a/packages/script/src/runtime/components/ScriptLemonSqueezy.vue
+++ b/packages/script/src/runtime/components/ScriptLemonSqueezy.vue
@@ -1,3 +1,7 @@
+<script lang="ts">
+let activeLemonSqueezyOwner: symbol | undefined
+</script>
+
 <script lang="ts" setup>
 import type { LemonSqueezyEventPayload } from '../registry/lemon-squeezy'
 import type { ElementScriptTrigger } from '../types'
@@ -21,6 +25,8 @@ defineSlots<{
 }>()
 
 const rootEl = ref<HTMLElement | null>(null)
+const owner = Symbol('ScriptLemonSqueezy')
+let disposed = false
 const trigger = useScriptTriggerElement({ trigger: props.trigger, el: rootEl })
 const instance = useScriptLemonSqueezy({
   scriptOptions: {
@@ -32,23 +38,29 @@ onMounted(() => {
     a.classList.add('lemonsqueezy-button')
   })
   instance.onLoaded(({ Setup, Refresh }) => {
+    if (disposed)
+      return
     Setup({
       eventHandler(event) {
         emits('lemonSqueezyEvent', event)
       },
     })
+    activeLemonSqueezyOwner = owner
     Refresh()
     emits('ready', instance)
   })
 })
 
 onBeforeUnmount(() => {
+  disposed = true
   // Lemon.js `Setup()` stores a single global `eventHandler`, which captures
   // this component's `emits` (and therefore the instance). Setup() replaces
-  // rather than appends, so resetting it to a noop on unmount releases the
-  // closure and lets the unmounted instance be garbage-collected.
-  if (import.meta.client && typeof window.LemonSqueezy?.Setup === 'function')
+  // rather than appends. Only the component that most recently installed the
+  // handler may clear it; an older instance can unmount after a newer one.
+  if (activeLemonSqueezyOwner === owner && import.meta.client && typeof window.LemonSqueezy?.Setup === 'function') {
     window.LemonSqueezy.Setup({ eventHandler() {} })
+    activeLemonSqueezyOwner = undefined
+  }
 })
 
 const rootAttrs = computed(() => {
diff --git a/packages/script/src/runtime/components/ScriptPayPalButtons.vue b/packages/script/src/runtime/components/ScriptPayPalButtons.vue
index 4483d4985..7cc4eed59 100644
--- a/packages/script/src/runtime/components/ScriptPayPalButtons.vue
+++ b/packages/script/src/runtime/components/ScriptPayPalButtons.vue
@@ -112,6 +112,8 @@ onMounted(() => {
       emit('ready', sdkInstance.value)
     }
     catch (err) {
+      if (disposed)
+        return
       sdkInstance.value = undefined
       failed.value = true
       emit('error', err)
diff --git a/packages/script/src/runtime/components/ScriptPayPalMessages.vue b/packages/script/src/runtime/components/ScriptPayPalMessages.vue
index 613613c9b..e64783d89 100644
--- a/packages/script/src/runtime/components/ScriptPayPalMessages.vue
+++ b/packages/script/src/runtime/components/ScriptPayPalMessages.vue
@@ -115,6 +115,8 @@ onMounted(() => {
       emit('ready', messagesSession.value)
     }
     catch (err) {
+      if (disposed)
+        return
       messagesSession.value = undefined
       failed.value = true
       emit('error', err)
diff --git a/packages/script/src/runtime/composables/useScript.ts b/packages/script/src/runtime/composables/useScript.ts
index d7b1f52de..b877e958a 100644
--- a/packages/script/src/runtime/composables/useScript.ts
+++ b/packages/script/src/runtime/composables/useScript.ts
@@ -364,6 +364,9 @@ export function useScript<T extends Record<symbol | string, any> = Record<symbol
   }
   // Add reload method for scripts that need to re-execute (e.g., DOM-scanning scripts)
   instance.reload = async () => {
+    if (err)
+      return Promise.reject(err)
+
     // Remove only the current Unhead entry. Runtime observers/hooks belong to
     // this stable public instance and remain active across the reload.
     currentRemove()
@@ -512,10 +515,13 @@ export function useScript<T extends Record<symbol | string, any> = Record<symbol
       instance.reload = async () => {
         // Disconnect before reload, reconnect after so new network entries are tracked
         disconnectObserver()
-        const result = await _origReload()
-        if (!cleaned)
-          disconnectObserver = observeNetworkRequests(payload, domains, syncScripts, input.src)
-        return result
+        try {
+          return await _origReload()
+        }
+        finally {
+          if (!cleaned)
+            disconnectObserver = observeNetworkRequests(payload, domains, syncScripts, input.src)
+        }
       }
 
       syncScripts()
diff --git a/packages/script/src/runtime/npm-script-stub.ts b/packages/script/src/runtime/npm-script-stub.ts
index 49eccfea7..1f59f5e58 100644
--- a/packages/script/src/runtime/npm-script-stub.ts
+++ b/packages/script/src/runtime/npm-script-stub.ts
@@ -69,6 +69,7 @@ export function createNpmScriptStub<T = any>(
         })
       }
       catch (error) {
+        loadedCallbacks.splice(0)
         logger.error(`[NpmScriptStub] Failed to initialize ${options.key}:`, error)
         status.value = 'error'
       }
@@ -79,7 +80,7 @@ export function createNpmScriptStub<T = any>(
         // Already loaded, call immediately
         callback(proxy)
       }
-      else {
+      else if (status.value !== 'error') {
         // Queue for when load completes
         loadedCallbacks.push(callback)
       }
diff --git a/packages/script/src/runtime/registry/usercentrics.ts b/packages/script/src/runtime/registry/usercentrics.ts
index 93275ba56..e5aacabd3 100644
--- a/packages/script/src/runtime/registry/usercentrics.ts
+++ b/packages/script/src/runtime/registry/usercentrics.ts
@@ -122,8 +122,18 @@ export function useScriptUsercentrics<T extends UsercentricsApi>(
     let readyApi: UsercentricsCmp | undefined
     let readyPromise: Promise<UsercentricsCmp> | undefined
     let resolveReady: ((api: UsercentricsCmp) => void) | undefined
+    let rejectReady: ((error: Error) => void) | undefined
+    let disposed = false
+
+    const abortError = () => {
+      const error = new Error('Usercentrics readiness wait was aborted')
+      error.name = 'AbortError'
+      return error
+    }
 
     const onReady = () => {
+      if (disposed)
+        return
       const api = window.__ucCmp
       if (!api)
         return
@@ -131,32 +141,44 @@ export function useScriptUsercentrics<T extends UsercentricsApi>(
       window.removeEventListener('UC_CMP_API_READY', onReady)
       resolveReady?.(api)
       resolveReady = undefined
+      rejectReady = undefined
     }
     const cleanupReadyListener = () => {
+      if (disposed)
+        return
+      disposed = true
       window.removeEventListener('UC_CMP_API_READY', onReady)
+      const reject = rejectReady
       resolveReady = undefined
+      rejectReady = undefined
+      reject?.(abortError())
     }
     const whenReady = (): Promise<UsercentricsCmp> => {
+      if (disposed)
+        return Promise.reject(abortError())
       if (readyApi)
         return Promise.resolve(readyApi)
       if (!readyPromise) {
         // Install the event listener before checking isInitialized() so an
         // event fired during that async check cannot be missed.
-        readyPromise = new Promise((resolve) => {
+        readyPromise = new Promise((resolve, reject) => {
           resolveReady = resolve
+          rejectReady = reject
           window.addEventListener('UC_CMP_API_READY', onReady)
         })
         const api = window.__ucCmp
         if (api?.isInitialized) {
-          Promise.resolve(api.isInitialized())
+          Promise.resolve()
+            .then(() => api.isInitialized())
             .then((initialized) => {
-              if (initialized)
+              if (initialized && !disposed)
                 onReady()
             })
             .catch((error) => {
               // Some bootstrap stubs throw until the ready event; the event
               // listener remains the authoritative readiness signal.
-              logger.debug('[usercentrics] Waiting for UC_CMP_API_READY after isInitialized() failed', error)
+              if (!disposed)
+                logger.debug('[usercentrics] Waiting for UC_CMP_API_READY after isInitialized() failed', error)
             })
         }
       }
diff --git a/packages/script/src/runtime/registry/youtube-player.ts b/packages/script/src/runtime/registry/youtube-player.ts
index b11ab422b..1c4506b6c 100644
--- a/packages/script/src/runtime/registry/youtube-player.ts
+++ b/packages/script/src/runtime/registry/youtube-player.ts
@@ -35,9 +35,11 @@ declare global {
 }
 
 export type YouTubePlayerInput = RegistryScriptInput
+const cleanupDecoratedInstances = new WeakSet<object>()
 
 export function useScriptYouTubePlayer<T extends YouTubePlayerApi>(_options: YouTubePlayerInput): UseScriptContext<T> {
   let readyPromise: Promise<void> = Promise.resolve()
+  let cleanupReady = () => {}
   const instance = useRegistryScript<T>('youtubePlayer', () => ({
     scriptInput: {
       src: 'https://www.youtube.com/iframe_api',
@@ -55,22 +57,58 @@ export function useScriptYouTubePlayer<T extends YouTubePlayerApi>(_options: You
     clientInit: import.meta.server
       ? undefined
       : () => {
-          readyPromise = new Promise((resolve) => {
+          readyPromise = new Promise((resolve, reject) => {
             const previousReady = window.onYouTubeIframeAPIReady
-            const onReady = () => {
-              if (window.onYouTubeIframeAPIReady === onReady) {
-                if (previousReady)
-                  window.onYouTubeIframeAPIReady = previousReady
-                else
-                  delete (window as any).onYouTubeIframeAPIReady
+            let settled = false
+            let onReady: () => void
+            const restoreReady = () => {
+              if (window.onYouTubeIframeAPIReady !== onReady)
+                return
+              if (previousReady)
+                window.onYouTubeIframeAPIReady = previousReady
+              else
+                delete (window as any).onYouTubeIframeAPIReady
+            }
+            onReady = () => {
+              if (settled)
+                return
+              settled = true
+              restoreReady()
+              cleanupReady = () => {}
+              try {
+                previousReady?.()
+              }
+              finally {
+                resolve()
               }
-              previousReady?.()
-              resolve()
+            }
+            cleanupReady = () => {
+              if (settled)
+                return
+              settled = true
+              restoreReady()
+              cleanupReady = () => {}
+              const error = new Error('YouTube API readiness wait was aborted')
+              error.name = 'AbortError'
+              reject(error)
             }
             window.onYouTubeIframeAPIReady = onReady
           })
+          // Removal can reject readiness before any caller has requested YT.
+          // Mark the internal promise handled while preserving rejection for
+          // consumers that do await the promise returned by `use()`.
+          void readyPromise.then(undefined, () => undefined)
         },
   }), _options)
+  if (import.meta.client && !cleanupDecoratedInstances.has(instance)) {
+    cleanupDecoratedInstances.add(instance)
+    const originalRemove = instance.remove
+    instance.remove = () => {
+      cleanupReady()
+      cleanupDecoratedInstances.delete(instance)
+      return originalRemove()
+    }
+  }
   // insert preconnect once we start loading the script
   if (import.meta.client) {
     const _ = watch(instance.status, (status) => {
diff --git a/packages/script/src/runtime/server/proxy-handler.ts b/packages/script/src/runtime/server/proxy-handler.ts
index b78774f6e..9a89daf8a 100644
--- a/packages/script/src/runtime/server/proxy-handler.ts
+++ b/packages/script/src/runtime/server/proxy-handler.ts
@@ -62,7 +62,12 @@ async function readTransformBody(event: Parameters<typeof getRequestWebStream>[0
         continue
       total += value.byteLength
       if (total > MAX_TRANSFORM_BODY_SIZE) {
-        await reader.cancel('Proxy request body too large')
+        try {
+          await reader.cancel('Proxy request body too large')
+        }
+        catch {
+          // The size-limit response takes precedence over cancellation errors.
+        }
         throw createError({ statusCode: 413, statusMessage: 'Proxy request body too large' })
       }
       chunks.push(value)
@@ -88,6 +93,13 @@ function streamUpstreamResponse(
 ): ReadableStream<Uint8Array> {
   const reader = body.getReader()
   let finished = false
+  let readerReleased = false
+  const releaseReader = () => {
+    if (readerReleased)
+      return
+    readerReleased = true
+    reader.releaseLock()
+  }
   const cleanup = () => {
     if (finished)
       return
@@ -101,7 +113,7 @@ function streamUpstreamResponse(
         const { done, value } = await reader.read()
         if (done) {
           cleanup()
-          reader.releaseLock()
+          releaseReader()
           streamController.close()
         }
         else if (value) {
@@ -110,15 +122,19 @@ function streamUpstreamResponse(
       }
       catch (error) {
         cleanup()
-        reader.releaseLock()
+        releaseReader()
         streamController.error(error)
       }
     },
     async cancel(reason) {
       cleanup()
       controller.abort()
-      await reader.cancel(reason)
-      reader.releaseLock()
+      try {
+        await reader.cancel(reason)
+      }
+      finally {
+        releaseReader()
+      }
     },
   })
 }
diff --git a/test/unit/cached-upstream-lifecycle.test.ts b/test/unit/cached-upstream-lifecycle.test.ts
new file mode 100644
index 000000000..3d26ed54a
--- /dev/null
+++ b/test/unit/cached-upstream-lifecycle.test.ts
@@ -0,0 +1,33 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { NUXT_SCRIPTS_CACHE_BASE } from '../../packages/script/src/runtime/server/utils/cache-config'
+import { createCachedBinaryFetch, createCachedJsonFetch } from '../../packages/script/src/runtime/server/utils/cached-upstream'
+
+const { defineCachedFunction } = vi.hoisted(() => ({
+  defineCachedFunction: vi.fn((fn: (...args: any[]) => any) => fn),
+}))
+
+vi.mock('nitropack/runtime', () => ({ defineCachedFunction }))
+
+describe('upstream cache storage ownership', () => {
+  beforeEach(() => {
+    defineCachedFunction.mockClear()
+  })
+
+  it('puts binary proxy payloads in the bounded Nuxt Scripts cache mount', () => {
+    createCachedBinaryFetch('binary-test', 60)
+
+    expect(defineCachedFunction).toHaveBeenCalledWith(
+      expect.any(Function),
+      expect.objectContaining({ base: NUXT_SCRIPTS_CACHE_BASE }),
+    )
+  })
+
+  it('puts JSON proxy payloads in the same bounded cache mount', () => {
+    createCachedJsonFetch('json-test', 60, url => url)
+
+    expect(defineCachedFunction).toHaveBeenCalledWith(
+      expect.any(Function),
+      expect.objectContaining({ base: NUXT_SCRIPTS_CACHE_BASE }),
+    )
+  })
+})
diff --git a/test/unit/fetch-script-lifecycle.test.ts b/test/unit/fetch-script-lifecycle.test.ts
new file mode 100644
index 000000000..189034fc2
--- /dev/null
+++ b/test/unit/fetch-script-lifecycle.test.ts
@@ -0,0 +1,25 @@
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { fetchScript } from '../../packages/devtools-app/utils/fetch'
+
+describe('devtools script-size fetch lifecycle', () => {
+  afterEach(() => {
+    vi.unstubAllGlobals()
+  })
+
+  it('returns body-stream failures instead of rejecting', async () => {
+    const error = new Error('response body aborted')
+    const body = new ReadableStream<Uint8Array>({
+      pull(controller) {
+        controller.error(error)
+      },
+    })
+    vi.stubGlobal('fetch', vi.fn(() => Promise.resolve(new Response(body, {
+      headers: { 'Content-Type': 'application/javascript' },
+    }))))
+
+    await expect(fetchScript('https://example.com/script.js')).resolves.toEqual({
+      size: null,
+      error,
+    })
+  })
+})
diff --git a/test/unit/google-maps-lifecycle.test.ts b/test/unit/google-maps-lifecycle.test.ts
index 3637181d9..db355b18d 100644
--- a/test/unit/google-maps-lifecycle.test.ts
+++ b/test/unit/google-maps-lifecycle.test.ts
@@ -499,4 +499,23 @@ describe('waitForMapsReady', () => {
     map.value = {}
     await nextTick()
   })
+
+  it('removes the abort listener when load throws synchronously', async () => {
+    const mapsApi = shallowRef<any>(undefined)
+    const map = shallowRef<any>(undefined)
+    const status = ref<string>('loading')
+    const controller = new AbortController()
+    const removeEventListener = vi.spyOn(controller.signal, 'removeEventListener')
+    const error = new Error('load failed synchronously')
+
+    await expect(waitForMapsReady({
+      mapsApi,
+      map,
+      status,
+      load: () => { throw error },
+      signal: controller.signal,
+    })).rejects.toBe(error)
+
+    expect(removeEventListener).toHaveBeenCalledWith('abort', expect.any(Function))
+  })
 })
diff --git a/test/unit/npm-script-stub-lifecycle.test.ts b/test/unit/npm-script-stub-lifecycle.test.ts
new file mode 100644
index 000000000..b0f473c32
--- /dev/null
+++ b/test/unit/npm-script-stub-lifecycle.test.ts
@@ -0,0 +1,27 @@
+import { describe, expect, it, vi } from 'vitest'
+import { createNpmScriptStub } from '../../packages/script/src/runtime/npm-script-stub'
+
+vi.mock('../../packages/script/src/runtime/logger', () => ({
+  logger: { error: vi.fn() },
+}))
+
+describe('npm script stub lifecycle', () => {
+  it('does not retain callbacks registered after initialization fails', async () => {
+    vi.spyOn(console, 'log').mockImplementation(() => {})
+    const beforeFailure = vi.fn()
+    const afterFailure = vi.fn()
+    const stub = createNpmScriptStub({
+      key: 'failing-script',
+      clientInit: () => Promise.reject(new Error('initialization failed')),
+    })
+
+    stub.onLoaded(beforeFailure)
+    await stub.load()
+    stub.onLoaded(afterFailure)
+    await stub.load()
+
+    expect(stub.status.value).toBe('error')
+    expect(beforeFailure).not.toHaveBeenCalled()
+    expect(afterFailure).not.toHaveBeenCalled()
+  })
+})
diff --git a/test/unit/script-trigger-lifecycle.test.ts b/test/unit/script-trigger-lifecycle.test.ts
new file mode 100644
index 000000000..55f19e69b
--- /dev/null
+++ b/test/unit/script-trigger-lifecycle.test.ts
@@ -0,0 +1,98 @@
+/**
+ * @vitest-environment happy-dom
+ */
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { effectScope } from 'vue'
+import { useScriptTriggerIdleTimeout } from '../../packages/script/src/runtime/composables/useScriptTriggerIdleTimeout'
+import { useScriptTriggerInteraction } from '../../packages/script/src/runtime/composables/useScriptTriggerInteraction'
+import { useScriptTriggerServiceWorker } from '../../packages/script/src/runtime/composables/useScriptTriggerServiceWorker'
+
+const readyCallbacks: Array<() => void> = []
+
+vi.mock('nuxt/app', () => ({
+  onNuxtReady: (callback: () => void) => readyCallbacks.push(callback),
+}))
+
+describe('script trigger lifecycle cleanup', () => {
+  beforeEach(() => {
+    readyCallbacks.length = 0
+    vi.useFakeTimers()
+  })
+
+  afterEach(() => {
+    vi.useRealTimers()
+    vi.restoreAllMocks()
+  })
+
+  it('does not start an idle timer after its scope is disposed before Nuxt is ready', async () => {
+    const scope = effectScope()
+    let trigger!: Promise<boolean>
+    scope.run(() => {
+      trigger = useScriptTriggerIdleTimeout({ timeout: 1000 })
+    })
+
+    scope.stop()
+    await expect(trigger).resolves.toBe(false)
+    readyCallbacks[0]!()
+    await vi.advanceTimersByTimeAsync(1000)
+
+    expect(vi.getTimerCount()).toBe(0)
+  })
+
+  it('does not install interaction listeners after its scope was disposed', async () => {
+    const target = new EventTarget()
+    const addEventListener = vi.spyOn(target, 'addEventListener')
+    const scope = effectScope()
+    let trigger!: Promise<boolean>
+    scope.run(() => {
+      trigger = useScriptTriggerInteraction({ events: ['click', 'pointerdown'], target })
+    })
+
+    scope.stop()
+    await expect(trigger).resolves.toBe(false)
+    readyCallbacks[0]!()
+
+    expect(addEventListener).not.toHaveBeenCalled()
+  })
+
+  it('removes every interaction listener when one event settles the trigger', async () => {
+    const target = new EventTarget()
+    const removeEventListener = vi.spyOn(target, 'removeEventListener')
+    const scope = effectScope()
+    let trigger!: Promise<boolean>
+    scope.run(() => {
+      trigger = useScriptTriggerInteraction({ events: ['click', 'pointerdown'], target })
+    })
+
+    readyCallbacks[0]!()
+    target.dispatchEvent(new Event('click'))
+
+    await expect(trigger).resolves.toBe(true)
+    expect(removeEventListener.mock.calls.map(([event]) => event)).toEqual(
+      expect.arrayContaining(['click', 'pointerdown']),
+    )
+    scope.stop()
+  })
+
+  it('clears the service-worker fallback timer once controllerchange fires', async () => {
+    const serviceWorker = Object.assign(new EventTarget(), { controller: null })
+    Object.defineProperty(navigator, 'serviceWorker', {
+      configurable: true,
+      value: serviceWorker,
+    })
+    const warn = vi.spyOn(console, 'warn').mockImplementation(() => {})
+    const scope = effectScope()
+    let trigger!: Promise<boolean>
+    scope.run(() => {
+      trigger = useScriptTriggerServiceWorker({ timeout: 1000 })
+    })
+
+    serviceWorker.dispatchEvent(new Event('controllerchange'))
+    await expect(trigger).resolves.toBe(true)
+    await vi.advanceTimersByTimeAsync(1000)
+
+    expect(warn).not.toHaveBeenCalled()
+    expect(vi.getTimerCount()).toBe(0)
+    scope.stop()
+  })
+})
diff --git a/test/unit/use-script-lifecycle.test.ts b/test/unit/use-script-lifecycle.test.ts
new file mode 100644
index 000000000..f0f3aea40
--- /dev/null
+++ b/test/unit/use-script-lifecycle.test.ts
@@ -0,0 +1,103 @@
+/**
+ * @vitest-environment happy-dom
+ */
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { useScript } from '../../packages/script/src/runtime/composables/useScript'
+
+const mocks = vi.hoisted(() => {
+  const baseRemove = vi.fn(() => true)
+  const baseLoad = vi.fn(() => Promise.resolve({}))
+  const instance = {
+    id: 'https://example.com/sdk.js',
+    status: { value: 'awaitingLoad' },
+    entry: undefined,
+    load: baseLoad,
+    remove: baseRemove,
+  }
+  const head = {
+    hooks: {
+      hook: vi.fn(() => vi.fn()),
+    },
+  }
+  const app = {
+    $scripts: {} as Record<string, any>,
+    _scripts: {} as Record<string, any>,
+    hooks: {
+      hook: vi.fn(() => vi.fn()),
+      callHook: vi.fn(),
+    },
+  }
+  return {
+    app,
+    baseLoad,
+    baseRemove,
+    head,
+    instance,
+    unheadUseScript: vi.fn(() => instance),
+  }
+})
+
+vi.mock('@unhead/vue/scripts', () => ({
+  useScript: mocks.unheadUseScript,
+}))
+
+vi.mock('nuxt/app', () => ({
+  injectHead: () => mocks.head,
+  onNuxtReady: vi.fn(),
+  useHead: vi.fn(),
+  useNuxtApp: () => mocks.app,
+  useRuntimeConfig: () => ({
+    public: {
+      'nuxt-scripts': { defaultScriptOptions: {} },
+      'nuxt-scripts-devtools': {},
+    },
+  }),
+}))
+
+vi.mock('#build/nuxt-scripts-trigger-resolver', () => ({
+  resolveTrigger: vi.fn(),
+}))
+
+describe('useScript shared instance lifecycle', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    mocks.app.$scripts = {}
+    mocks.app._scripts = {}
+    Object.assign(mocks.instance, {
+      id: 'https://example.com/sdk.js',
+      status: { value: 'awaitingLoad' },
+      entry: undefined,
+      load: mocks.baseLoad,
+      remove: mocks.baseRemove,
+    })
+    delete (mocks.instance as any).reload
+    delete (mocks.instance as any).toJSON
+  })
+
+  it('decorates a shared Unhead instance only once and removes its registry entry', () => {
+    const first = useScript('https://example.com/sdk.js')
+    const decoratedRemove = first.remove
+    const second = useScript('https://example.com/sdk.js')
+
+    // Unhead still sees both callers so it can register their scoped callbacks.
+    expect(mocks.unheadUseScript).toHaveBeenCalledTimes(2)
+    // App-global wrappers and teardown hooks belong to the shared instance.
+    expect(second).toBe(first)
+    expect(second.remove).toBe(decoratedRemove)
+    expect(mocks.app.hooks.hook).toHaveBeenCalledTimes(1)
+
+    expect(first.remove()).toBe(true)
+    expect(mocks.baseRemove).toHaveBeenCalledOnce()
+    expect(mocks.app.$scripts).not.toHaveProperty('https://example.com/sdk.js')
+  })
+
+  it('does not bypass validation when reload is called', async () => {
+    const validationError = { issues: [{ message: 'invalid test options' }] }
+    const instance = useScript('https://example.com/sdk.js', {
+      _validate: () => validationError,
+    } as any)
+
+    await expect((instance as any).reload()).rejects.toBe(validationError)
+    expect(mocks.baseRemove).not.toHaveBeenCalled()
+  })
+})

From 4c4549ca0f99eebcc99a360b00dfd3a7dc39e0f3 Mon Sep 17 00:00:00 2001
From: Harlan Wilton <harlan@harlanzw.com>
Date: Thu, 16 Jul 2026 11:05:36 +1000
Subject: [PATCH 3/6] test: avoid generated devtools tsconfig dependency

---
 test/unit/fetch-script-lifecycle.test.ts | 25 ------------------------
 1 file changed, 25 deletions(-)
 delete mode 100644 test/unit/fetch-script-lifecycle.test.ts

diff --git a/test/unit/fetch-script-lifecycle.test.ts b/test/unit/fetch-script-lifecycle.test.ts
deleted file mode 100644
index 189034fc2..000000000
--- a/test/unit/fetch-script-lifecycle.test.ts
+++ /dev/null
@@ -1,25 +0,0 @@
-import { afterEach, describe, expect, it, vi } from 'vitest'
-import { fetchScript } from '../../packages/devtools-app/utils/fetch'
-
-describe('devtools script-size fetch lifecycle', () => {
-  afterEach(() => {
-    vi.unstubAllGlobals()
-  })
-
-  it('returns body-stream failures instead of rejecting', async () => {
-    const error = new Error('response body aborted')
-    const body = new ReadableStream<Uint8Array>({
-      pull(controller) {
-        controller.error(error)
-      },
-    })
-    vi.stubGlobal('fetch', vi.fn(() => Promise.resolve(new Response(body, {
-      headers: { 'Content-Type': 'application/javascript' },
-    }))))
-
-    await expect(fetchScript('https://example.com/script.js')).resolves.toEqual({
-      size: null,
-      error,
-    })
-  })
-})

From 2ed0a277c2b84c95c590de309abd4b77aaf30baf Mon Sep 17 00:00:00 2001
From: Harlan Wilton <harlan@harlanzw.com>
Date: Thu, 16 Jul 2026 11:46:23 +1000
Subject: [PATCH 4/6] refactor: centralize abortable readiness

---
 .../GoogleMaps/ScriptGoogleMaps.vue           | 42 +++------
 .../GoogleMaps/useGoogleMapsResource.ts       | 92 +++++--------------
 .../src/runtime/registry/usercentrics.ts      | 76 +++++++--------
 .../src/runtime/registry/youtube-player.ts    | 28 ++----
 .../src/runtime/utils/abortable-promise.ts    | 64 +++++++++++++
 test/unit/abortable-promise.test.ts           | 51 ++++++++++
 6 files changed, 190 insertions(+), 163 deletions(-)
 create mode 100644 packages/script/src/runtime/utils/abortable-promise.ts
 create mode 100644 test/unit/abortable-promise.test.ts

diff --git a/packages/script/src/runtime/components/GoogleMaps/ScriptGoogleMaps.vue b/packages/script/src/runtime/components/GoogleMaps/ScriptGoogleMaps.vue
index 5ca731328..4bb54fd08 100644
--- a/packages/script/src/runtime/components/GoogleMaps/ScriptGoogleMaps.vue
+++ b/packages/script/src/runtime/components/GoogleMaps/ScriptGoogleMaps.vue
@@ -156,6 +156,7 @@ import { computed, nextTick, onBeforeUnmount, onMounted, onUnmounted, provide, r
 import { useScriptTriggerElement } from '#nuxt-scripts/composables/useScriptTriggerElement'
 import { useScriptGoogleMaps } from '#nuxt-scripts/registry/google-maps'
 import { scriptRuntimeConfig, scriptsPrefix } from '#nuxt-scripts/utils'
+import { createAbortablePromise } from '../../utils/abortable-promise'
 import ScriptAriaLoadingIndicator from '../ScriptAriaLoadingIndicator.vue'
 import { defineDeprecatedAlias, MAP_INJECTION_KEY, waitForMapsReady, warnDeprecatedTopLevelMapProps } from './useGoogleMapsResource'
 
@@ -385,41 +386,22 @@ function importLibrary(key: string): Promise<any>
 function importLibrary<T>(key: string): Promise<T> {
   if (libraries.has(key))
     return libraries.get(key)
-  if (lifecycleController.signal.aborted) {
-    const error = new Error(`Google Maps library import "${key}" was aborted`)
-    error.name = 'AbortError'
-    return Promise.reject(error)
-  }
-  const p = mapsApi.value?.importLibrary(key) || new Promise((resolve, reject) => {
+  const p = mapsApi.value?.importLibrary(key) || createAbortablePromise((resolve, reject) => {
     let stop = () => {}
-    let settled = false
-    const cleanup = () => {
-      stop()
-      lifecycleController.signal.removeEventListener('abort', onAbort)
-    }
-    const settle = (fn: () => void) => {
-      if (settled)
-        return
-      settled = true
-      cleanup()
-      fn()
-    }
-    const onAbort = () => settle(() => {
-      const error = new Error(`Google Maps library import "${key}" was aborted`)
-      error.name = 'AbortError'
-      reject(error)
-    })
-
-    if (lifecycleController.signal.aborted) {
-      onAbort()
-      return
-    }
-    lifecycleController.signal.addEventListener('abort', onAbort, { once: true })
     stop = watch(mapsApi, (api) => {
       if (api) {
-        settle(() => resolve(api.importLibrary(key)))
+        try {
+          resolve(api.importLibrary(key))
+        }
+        catch (error) {
+          reject(error)
+        }
       }
     }, { immediate: true })
+    return () => stop()
+  }, {
+    signal: lifecycleController.signal,
+    abortMessage: `Google Maps library import "${key}" was aborted`,
   })
   // Clear cache on failure to allow retry
   const cached = Promise.resolve(p).catch((err) => {
diff --git a/packages/script/src/runtime/components/GoogleMaps/useGoogleMapsResource.ts b/packages/script/src/runtime/components/GoogleMaps/useGoogleMapsResource.ts
index 12b9a374f..96bd94720 100644
--- a/packages/script/src/runtime/components/GoogleMaps/useGoogleMapsResource.ts
+++ b/packages/script/src/runtime/components/GoogleMaps/useGoogleMapsResource.ts
@@ -1,6 +1,7 @@
 import type { InjectionKey, Ref, ShallowRef } from 'vue'
 import { whenever } from '@vueuse/core'
 import { effectScope, inject, onUnmounted, ref, shallowRef, watch } from 'vue'
+import { createAbortablePromise, createAbortError } from '../../utils/abortable-promise'
 
 export const MAP_INJECTION_KEY = Symbol('map') as InjectionKey<{
   map: ShallowRef<google.maps.Map | undefined>
@@ -143,14 +144,10 @@ export async function waitForMapsReady({
   load: () => Promise<unknown> | unknown
   signal?: AbortSignal
 }): Promise<void> {
-  const abortError = () => {
-    const error = new Error('Google Maps readiness wait was aborted')
-    error.name = 'AbortError'
-    return error
-  }
+  const abortMessage = 'Google Maps readiness wait was aborted'
   const throwIfAborted = () => {
     if (signal?.aborted)
-      throw abortError()
+      throw createAbortError(abortMessage)
   }
 
   throwIfAborted()
@@ -159,35 +156,9 @@ export async function waitForMapsReady({
   if (status.value === 'error')
     throw new Error('Google Maps script failed to load')
 
-  await new Promise<void>((resolve, reject) => {
-    let settled = false
-    let onAbort: (() => void) | undefined
-    const cleanup = () => {
-      if (onAbort)
-        signal?.removeEventListener('abort', onAbort)
-    }
-    const settle = (fn: () => void) => {
-      if (settled)
-        return
-      settled = true
-      cleanup()
-      fn()
-    }
-    onAbort = () => settle(() => reject(abortError()))
-    signal?.addEventListener('abort', onAbort, { once: true })
-    let loading: Promise<unknown>
-    try {
-      loading = Promise.resolve(load())
-    }
-    catch (error) {
-      settle(() => reject(error))
-      return
-    }
-    loading.then(
-      () => settle(resolve),
-      error => settle(() => reject(error)),
-    )
-  })
+  await createAbortablePromise<void>((resolve, reject) => {
+    Promise.resolve(load()).then(() => resolve(), reject)
+  }, { signal, abortMessage })
 
   // load() may have populated both refs synchronously — re-check before
   // installing a watcher to avoid the race that hangs the promise forever.
@@ -198,42 +169,23 @@ export async function waitForMapsReady({
     throw new Error('Google Maps script failed to load')
 
   const scope = effectScope(true)
-  try {
-    await new Promise<void>((resolve, reject) => {
-      let settled = false
-      let onAbort: (() => void) | undefined
-      const cleanup = () => {
-        if (onAbort)
-          signal?.removeEventListener('abort', onAbort)
-      }
-      const settle = (fn: () => void) => {
-        if (settled)
-          return
-        settled = true
-        cleanup()
-        fn()
-      }
-      onAbort = () => settle(() => reject(abortError()))
-      signal?.addEventListener('abort', onAbort, { once: true })
-      scope.run(() => {
-        watch(
-          [mapsApi, map, status],
-          ([api, m, s]) => {
-            if (api && m) {
-              settle(resolve)
-              return
-            }
-            if (s === 'error')
-              settle(() => reject(new Error('Google Maps script failed to load')))
-          },
-          { immediate: true },
-        )
-      })
+  await createAbortablePromise<void>((resolve, reject) => {
+    scope.run(() => {
+      watch(
+        [mapsApi, map, status],
+        ([api, m, s]) => {
+          if (api && m) {
+            resolve()
+            return
+          }
+          if (s === 'error')
+            reject(new Error('Google Maps script failed to load'))
+        },
+        { immediate: true },
+      )
     })
-  }
-  finally {
-    scope.stop()
-  }
+    return () => scope.stop()
+  }, { signal, abortMessage })
 }
 
 /**
diff --git a/packages/script/src/runtime/registry/usercentrics.ts b/packages/script/src/runtime/registry/usercentrics.ts
index e5aacabd3..7c1acb83a 100644
--- a/packages/script/src/runtime/registry/usercentrics.ts
+++ b/packages/script/src/runtime/registry/usercentrics.ts
@@ -3,6 +3,7 @@ import { useHead } from '@unhead/vue'
 import { useNuxtApp } from 'nuxt/app'
 import { logger } from '../logger'
 import { useRegistryScript } from '../utils'
+import { createAbortablePromise, createAbortError } from '../utils/abortable-promise'
 import { UsercentricsOptions } from './schemas'
 
 export { UsercentricsOptions }
@@ -121,66 +122,51 @@ export function useScriptUsercentrics<T extends UsercentricsApi>(
   if (import.meta.client && !instance.consent) {
     let readyApi: UsercentricsCmp | undefined
     let readyPromise: Promise<UsercentricsCmp> | undefined
-    let resolveReady: ((api: UsercentricsCmp) => void) | undefined
-    let rejectReady: ((error: Error) => void) | undefined
+    const readyController = new AbortController()
     let disposed = false
-
-    const abortError = () => {
-      const error = new Error('Usercentrics readiness wait was aborted')
-      error.name = 'AbortError'
-      return error
-    }
-
-    const onReady = () => {
-      if (disposed)
-        return
-      const api = window.__ucCmp
-      if (!api)
-        return
-      readyApi = api
-      window.removeEventListener('UC_CMP_API_READY', onReady)
-      resolveReady?.(api)
-      resolveReady = undefined
-      rejectReady = undefined
-    }
     const cleanupReadyListener = () => {
       if (disposed)
         return
       disposed = true
-      window.removeEventListener('UC_CMP_API_READY', onReady)
-      const reject = rejectReady
-      resolveReady = undefined
-      rejectReady = undefined
-      reject?.(abortError())
+      readyController.abort()
     }
     const whenReady = (): Promise<UsercentricsCmp> => {
       if (disposed)
-        return Promise.reject(abortError())
+        return Promise.reject(createAbortError('Usercentrics readiness wait was aborted'))
       if (readyApi)
         return Promise.resolve(readyApi)
       if (!readyPromise) {
         // Install the event listener before checking isInitialized() so an
         // event fired during that async check cannot be missed.
-        readyPromise = new Promise((resolve, reject) => {
-          resolveReady = resolve
-          rejectReady = reject
+        readyPromise = createAbortablePromise<UsercentricsCmp>((resolve) => {
+          const onReady = () => {
+            const api = window.__ucCmp
+            if (!api)
+              return
+            readyApi = api
+            resolve(api)
+          }
           window.addEventListener('UC_CMP_API_READY', onReady)
+          const api = window.__ucCmp
+          if (api?.isInitialized) {
+            Promise.resolve()
+              .then(() => api.isInitialized())
+              .then((initialized) => {
+                if (initialized && !readyController.signal.aborted)
+                  onReady()
+              })
+              .catch((error) => {
+                // Some bootstrap stubs throw until the ready event; the event
+                // listener remains the authoritative readiness signal.
+                if (!readyController.signal.aborted)
+                  logger.debug('[usercentrics] Waiting for UC_CMP_API_READY after isInitialized() failed', error)
+              })
+          }
+          return () => window.removeEventListener('UC_CMP_API_READY', onReady)
+        }, {
+          signal: readyController.signal,
+          abortMessage: 'Usercentrics readiness wait was aborted',
         })
-        const api = window.__ucCmp
-        if (api?.isInitialized) {
-          Promise.resolve()
-            .then(() => api.isInitialized())
-            .then((initialized) => {
-              if (initialized && !disposed)
-                onReady()
-            })
-            .catch((error) => {
-              // Some bootstrap stubs throw until the ready event; the event
-              // listener remains the authoritative readiness signal.
-              if (!disposed)
-                logger.debug('[usercentrics] Waiting for UC_CMP_API_READY after isInitialized() failed', error)
-            })
-        }
       }
       return readyPromise
     }
diff --git a/packages/script/src/runtime/registry/youtube-player.ts b/packages/script/src/runtime/registry/youtube-player.ts
index 1c4506b6c..b4013e2aa 100644
--- a/packages/script/src/runtime/registry/youtube-player.ts
+++ b/packages/script/src/runtime/registry/youtube-player.ts
@@ -4,6 +4,7 @@ import { useHead } from '@unhead/vue'
 /// <reference types="youtube" />
 import { watch } from 'vue'
 import { useRegistryScript } from '../utils'
+import { createAbortablePromise } from '../utils/abortable-promise'
 
 export interface YouTubePlayerApi {
   YT: MaybePromise<{
@@ -39,7 +40,7 @@ const cleanupDecoratedInstances = new WeakSet<object>()
 
 export function useScriptYouTubePlayer<T extends YouTubePlayerApi>(_options: YouTubePlayerInput): UseScriptContext<T> {
   let readyPromise: Promise<void> = Promise.resolve()
-  let cleanupReady = () => {}
+  let readyController: AbortController | undefined
   const instance = useRegistryScript<T>('youtubePlayer', () => ({
     scriptInput: {
       src: 'https://www.youtube.com/iframe_api',
@@ -57,9 +58,10 @@ export function useScriptYouTubePlayer<T extends YouTubePlayerApi>(_options: You
     clientInit: import.meta.server
       ? undefined
       : () => {
-          readyPromise = new Promise((resolve, reject) => {
+          readyController?.abort()
+          readyController = new AbortController()
+          readyPromise = createAbortablePromise((resolve) => {
             const previousReady = window.onYouTubeIframeAPIReady
-            let settled = false
             let onReady: () => void
             const restoreReady = () => {
               if (window.onYouTubeIframeAPIReady !== onReady)
@@ -70,11 +72,7 @@ export function useScriptYouTubePlayer<T extends YouTubePlayerApi>(_options: You
                 delete (window as any).onYouTubeIframeAPIReady
             }
             onReady = () => {
-              if (settled)
-                return
-              settled = true
               restoreReady()
-              cleanupReady = () => {}
               try {
                 previousReady?.()
               }
@@ -82,17 +80,11 @@ export function useScriptYouTubePlayer<T extends YouTubePlayerApi>(_options: You
                 resolve()
               }
             }
-            cleanupReady = () => {
-              if (settled)
-                return
-              settled = true
-              restoreReady()
-              cleanupReady = () => {}
-              const error = new Error('YouTube API readiness wait was aborted')
-              error.name = 'AbortError'
-              reject(error)
-            }
             window.onYouTubeIframeAPIReady = onReady
+            return restoreReady
+          }, {
+            signal: readyController.signal,
+            abortMessage: 'YouTube API readiness wait was aborted',
           })
           // Removal can reject readiness before any caller has requested YT.
           // Mark the internal promise handled while preserving rejection for
@@ -104,7 +96,7 @@ export function useScriptYouTubePlayer<T extends YouTubePlayerApi>(_options: You
     cleanupDecoratedInstances.add(instance)
     const originalRemove = instance.remove
     instance.remove = () => {
-      cleanupReady()
+      readyController?.abort()
       cleanupDecoratedInstances.delete(instance)
       return originalRemove()
     }
diff --git a/packages/script/src/runtime/utils/abortable-promise.ts b/packages/script/src/runtime/utils/abortable-promise.ts
new file mode 100644
index 000000000..1f6d2f3f6
--- /dev/null
+++ b/packages/script/src/runtime/utils/abortable-promise.ts
@@ -0,0 +1,64 @@
+export interface AbortablePromiseOptions {
+  signal?: AbortSignal
+  abortMessage?: string
+}
+
+type PromiseSetup<T> = (
+  resolve: (value: T | PromiseLike<T>) => void,
+  reject: (reason?: unknown) => void,
+) => void | (() => void)
+
+export function createAbortError(message = 'Operation aborted'): Error {
+  const error = new Error(message)
+  error.name = 'AbortError'
+  return error
+}
+
+export function createAbortablePromise<T>(
+  setup: PromiseSetup<T>,
+  options: AbortablePromiseOptions = {},
+): Promise<T> {
+  const { signal, abortMessage } = options
+  return new Promise<T>((outerResolve, outerReject) => {
+    let settled = false
+    let cleanup: (() => void) | undefined
+    let onAbort: () => void
+
+    const finish = (settle: (value: any) => void, value?: unknown) => {
+      if (settled)
+        return
+      settled = true
+      signal?.removeEventListener('abort', onAbort)
+      const currentCleanup = cleanup
+      cleanup = undefined
+      try {
+        currentCleanup?.()
+      }
+      catch (error) {
+        outerReject(error)
+        return
+      }
+      settle(value)
+    }
+    const resolve = (value: T | PromiseLike<T>) => finish(outerResolve, value)
+    const reject = (reason?: unknown) => finish(outerReject, reason)
+    onAbort = () => reject(createAbortError(abortMessage))
+
+    if (signal?.aborted) {
+      onAbort()
+      return
+    }
+
+    signal?.addEventListener('abort', onAbort, { once: true })
+    try {
+      cleanup = setup(resolve, reject) || undefined
+      if (settled) {
+        cleanup?.()
+        cleanup = undefined
+      }
+    }
+    catch (error) {
+      reject(error)
+    }
+  })
+}
diff --git a/test/unit/abortable-promise.test.ts b/test/unit/abortable-promise.test.ts
new file mode 100644
index 000000000..7dc1fc648
--- /dev/null
+++ b/test/unit/abortable-promise.test.ts
@@ -0,0 +1,51 @@
+import { describe, expect, it, vi } from 'vitest'
+import { createAbortablePromise } from '../../packages/script/src/runtime/utils/abortable-promise'
+
+describe('createAbortablePromise', () => {
+  it('runs cleanup once when resolved', async () => {
+    const cleanup = vi.fn()
+    const promise = createAbortablePromise<number>((resolve) => {
+      resolve(42)
+      return cleanup
+    })
+
+    await expect(promise).resolves.toBe(42)
+    expect(cleanup).toHaveBeenCalledOnce()
+  })
+
+  it('rejects with AbortError and runs cleanup when aborted', async () => {
+    const controller = new AbortController()
+    const cleanup = vi.fn()
+    const promise = createAbortablePromise<void>(() => cleanup, {
+      signal: controller.signal,
+      abortMessage: 'SDK readiness wait was aborted',
+    })
+
+    controller.abort()
+
+    await expect(promise).rejects.toMatchObject({
+      name: 'AbortError',
+      message: 'SDK readiness wait was aborted',
+    })
+    expect(cleanup).toHaveBeenCalledOnce()
+  })
+
+  it('does not run setup for an already-aborted signal', async () => {
+    const controller = new AbortController()
+    const setup = vi.fn()
+    controller.abort()
+
+    await expect(createAbortablePromise(setup, { signal: controller.signal })).rejects.toMatchObject({
+      name: 'AbortError',
+    })
+    expect(setup).not.toHaveBeenCalled()
+  })
+
+  it('routes synchronous setup failures to rejection', async () => {
+    const error = new Error('setup failed')
+
+    await expect(createAbortablePromise(() => {
+      throw error
+    })).rejects.toBe(error)
+  })
+})

From f39b7b4c74f428129b2a5409c52bceb141bf45a7 Mon Sep 17 00:00:00 2001
From: Harlan Wilton <harlan@harlanzw.com>
Date: Thu, 16 Jul 2026 11:49:38 +1000
Subject: [PATCH 5/6] fix: isolate readiness callback failures

---
 packages/script/src/runtime/registry/youtube-player.ts | 4 ++++
 test/unit/npm-script-stub-lifecycle.test.ts            | 6 +++++-
 2 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/packages/script/src/runtime/registry/youtube-player.ts b/packages/script/src/runtime/registry/youtube-player.ts
index b4013e2aa..167afe4b7 100644
--- a/packages/script/src/runtime/registry/youtube-player.ts
+++ b/packages/script/src/runtime/registry/youtube-player.ts
@@ -76,6 +76,10 @@ export function useScriptYouTubePlayer<T extends YouTubePlayerApi>(_options: You
               try {
                 previousReady?.()
               }
+              catch (error) {
+                if (import.meta.dev)
+                  console.error('[nuxt-scripts] Previous onYouTubeIframeAPIReady handler failed:', error)
+              }
               finally {
                 resolve()
               }
diff --git a/test/unit/npm-script-stub-lifecycle.test.ts b/test/unit/npm-script-stub-lifecycle.test.ts
index b0f473c32..1408a9a9e 100644
--- a/test/unit/npm-script-stub-lifecycle.test.ts
+++ b/test/unit/npm-script-stub-lifecycle.test.ts
@@ -1,4 +1,4 @@
-import { describe, expect, it, vi } from 'vitest'
+import { afterEach, describe, expect, it, vi } from 'vitest'
 import { createNpmScriptStub } from '../../packages/script/src/runtime/npm-script-stub'
 
 vi.mock('../../packages/script/src/runtime/logger', () => ({
@@ -6,6 +6,10 @@ vi.mock('../../packages/script/src/runtime/logger', () => ({
 }))
 
 describe('npm script stub lifecycle', () => {
+  afterEach(() => {
+    vi.restoreAllMocks()
+  })
+
   it('does not retain callbacks registered after initialization fails', async () => {
     vi.spyOn(console, 'log').mockImplementation(() => {})
     const beforeFailure = vi.fn()

From 9e3eca08a01650b2c873ed9a4e8992513afbf586 Mon Sep 17 00:00:00 2001
From: Harlan Wilton <harlan@harlanzw.com>
Date: Thu, 16 Jul 2026 12:10:47 +1000
Subject: [PATCH 6/6] fix: keep adopted readiness promises abortable

---
 .../GoogleMaps/ScriptGoogleMaps.vue           |  4 ++--
 .../src/runtime/utils/abortable-promise.ts    | 21 ++++++++++++++++++-
 test/unit/abortable-promise.test.ts           | 17 +++++++++++++++
 3 files changed, 39 insertions(+), 3 deletions(-)

diff --git a/packages/script/src/runtime/components/GoogleMaps/ScriptGoogleMaps.vue b/packages/script/src/runtime/components/GoogleMaps/ScriptGoogleMaps.vue
index 4bb54fd08..bd9d624e4 100644
--- a/packages/script/src/runtime/components/GoogleMaps/ScriptGoogleMaps.vue
+++ b/packages/script/src/runtime/components/GoogleMaps/ScriptGoogleMaps.vue
@@ -386,12 +386,12 @@ function importLibrary(key: string): Promise<any>
 function importLibrary<T>(key: string): Promise<T> {
   if (libraries.has(key))
     return libraries.get(key)
-  const p = mapsApi.value?.importLibrary(key) || createAbortablePromise((resolve, reject) => {
+  const p = createAbortablePromise<T>((resolve, reject) => {
     let stop = () => {}
     stop = watch(mapsApi, (api) => {
       if (api) {
         try {
-          resolve(api.importLibrary(key))
+          resolve(api.importLibrary(key) as Promise<T>)
         }
         catch (error) {
           reject(error)
diff --git a/packages/script/src/runtime/utils/abortable-promise.ts b/packages/script/src/runtime/utils/abortable-promise.ts
index 1f6d2f3f6..054e43197 100644
--- a/packages/script/src/runtime/utils/abortable-promise.ts
+++ b/packages/script/src/runtime/utils/abortable-promise.ts
@@ -40,8 +40,27 @@ export function createAbortablePromise<T>(
       }
       settle(value)
     }
-    const resolve = (value: T | PromiseLike<T>) => finish(outerResolve, value)
     const reject = (reason?: unknown) => finish(outerReject, reason)
+    const resolve = (value: T | PromiseLike<T>) => {
+      if ((typeof value === 'object' && value !== null) || typeof value === 'function') {
+        let then: unknown
+        try {
+          then = (value as PromiseLike<T>).then
+        }
+        catch (error) {
+          reject(error)
+          return
+        }
+        if (typeof then === 'function') {
+          Promise.resolve(value).then(
+            resolved => finish(outerResolve, resolved),
+            reject,
+          )
+          return
+        }
+      }
+      finish(outerResolve, value)
+    }
     onAbort = () => reject(createAbortError(abortMessage))
 
     if (signal?.aborted) {
diff --git a/test/unit/abortable-promise.test.ts b/test/unit/abortable-promise.test.ts
index 7dc1fc648..3f860c466 100644
--- a/test/unit/abortable-promise.test.ts
+++ b/test/unit/abortable-promise.test.ts
@@ -30,6 +30,23 @@ describe('createAbortablePromise', () => {
     expect(cleanup).toHaveBeenCalledOnce()
   })
 
+  it('keeps abort handling active while adopting a pending promise', async () => {
+    const controller = new AbortController()
+    const cleanup = vi.fn()
+    const inner = Promise.withResolvers<number>()
+    const promise = createAbortablePromise<number>((resolve) => {
+      resolve(inner.promise)
+      return cleanup
+    }, { signal: controller.signal })
+
+    controller.abort()
+
+    await expect(promise).rejects.toMatchObject({ name: 'AbortError' })
+    inner.resolve(42)
+    await inner.promise
+    expect(cleanup).toHaveBeenCalledOnce()
+  })
+
   it('does not run setup for an already-aborted signal', async () => {
     const controller = new AbortController()
     const setup = vi.fn()