feat(scan): support data-options config on auto.global.js script tag

.changeset/auto-script-data-options.md

@@ -0,0 +1,5 @@
+---
+"react-scan": patch
+---
+
+Support configuring `auto.global.js` via a `data-options` JSON attribute on its script tag

docs/installation/cdn.md

@@ -8,6 +8,17 @@ You can choose one of the following URLs to initialize React Scan via CDN.
 <script src="https://cdn.jsdelivr.net/npm/react-scan/dist/auto.global.js"></script>
 ```
 
+### Options
+
+Pass [options](../../README.md#api-reference) as JSON in a `data-options` attribute:
+
+```html
+<script
+  src="https://cdn.jsdelivr.net/npm/react-scan/dist/auto.global.js"
+  data-options='{"showToolbar":false}'
+></script>
+```
+
 ## Available URLs
 
 ### JSDelivr

packages/scan/src/auto.ts

@@ -1,13 +1,39 @@
-import './polyfills';
+import "./polyfills";
 // Prioritize bippy side-effect
-import 'bippy';
+import "bippy";
 
-import { IS_CLIENT } from '~web/utils/constants';
-import { scan } from './index';
+import { IS_CLIENT } from "~web/utils/constants";
+import { type Options, scan } from "./index";
+
+// Read configuration from a `data-options='{"enabled":false}'` attribute on
+// the loading <script> tag. Must run synchronously at module top-level so
+// `document.currentScript` still points at our script tag. Field validation
+// is left to `scan()` -> `validateOptions`, which already warns on bad values.
+const readScriptOptions = (): Options => {
+  const script = document.currentScript;
+  const rawOptions = script instanceof HTMLScriptElement ? script.dataset.options : undefined;
+  if (!rawOptions) return {};
+
+  try {
+    const parsedOptions: unknown = JSON.parse(rawOptions);
+    if (
+      typeof parsedOptions === "object" &&
+      parsedOptions !== null &&
+      !Array.isArray(parsedOptions)
+    ) {
+      return parsedOptions as Options;
+    }
+  } catch {
+    // Fall through to the warning below
+  }
+  // oxlint-disable-next-line no-console
+  console.warn("[React Scan] data-options must be a JSON object");
+  return {};
+};
 
 if (IS_CLIENT) {
-  scan();
+  scan(readScriptOptions());
   window.reactScan = scan;
 }
 
-export * from './core';
+export * from "./core";