From 676a21779f21e9fe75f83d7927270b3c43144a0e Mon Sep 17 00:00:00 2001
From: Harlan Wilton <harlan@harlanzw.com>
Date: Tue, 3 Mar 2026 14:46:41 +1100
Subject: [PATCH 01/12] fix: preserve compressed/binary request bodies in proxy
 handler
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The first-party proxy handler unconditionally read request bodies via
h3's readBody(), which decodes binary bytes as UTF-8 text. This corrupted
compressed payloads (e.g. PostHog gzip-js) and caused upstream timeouts.

When no privacy transforms are needed or the body is binary/compressed,
the raw request stream is now piped directly to upstream via
getRequestWebStream() — zero buffering, zero re-encoding.
---
 src/runtime/server/proxy-handler.ts      | 131 +++++++++------
 test/e2e/first-party.test.ts             |   1 +
 test/fixtures/first-party/nuxt.config.ts |   1 +
 test/unit/proxy-handler-binary.test.ts   | 194 +++++++++++++++++++++++
 4 files changed, 277 insertions(+), 50 deletions(-)
 create mode 100644 test/unit/proxy-handler-binary.test.ts

diff --git a/src/runtime/server/proxy-handler.ts b/src/runtime/server/proxy-handler.ts
index 4f0b2ef19..b61245e0d 100644
--- a/src/runtime/server/proxy-handler.ts
+++ b/src/runtime/server/proxy-handler.ts
@@ -1,4 +1,4 @@
-import { defineEventHandler, getHeaders, getRequestIP, readBody, getQuery, setResponseHeader, createError } from 'h3'
+import { defineEventHandler, getHeaders, getRequestIP, readBody, getRequestWebStream, getQuery, setResponseHeader, createError } from 'h3'
 import { useRuntimeConfig } from '#imports'
 import { useNitroApp } from 'nitropack/runtime'
 import {
@@ -102,6 +102,16 @@ export default defineEventHandler(async (event) => {
   const privacy = globalPrivacy !== undefined ? mergePrivacy(perScriptResolved, globalPrivacy) : perScriptResolved
   const anyPrivacy = privacy.ip || privacy.userAgent || privacy.language || privacy.screen || privacy.timezone || privacy.hardware
 
+  // Detect binary/compressed bodies that cannot be safely parsed as text.
+  // content-encoding indicates transport-level compression (gzip, br, etc.);
+  // application/octet-stream is explicitly binary. These must be passed through as raw bytes.
+  const originalHeaders = getHeaders(event)
+  const contentType = originalHeaders['content-type'] || ''
+  const isBinaryBody = Boolean(
+    originalHeaders['content-encoding']
+    || contentType.includes('octet-stream'),
+  )
+
   // Build target URL with stripped query params
   let targetPath = path.slice(matchedPrefix.length)
   // Ensure path starts with /
@@ -121,8 +131,6 @@ export default defineEventHandler(async (event) => {
     }
   }
 
-  // Get original headers
-  const originalHeaders = getHeaders(event)
   const headers: Record<string, string> = {}
 
   // Process headers based on per-flag privacy
@@ -133,8 +141,13 @@ export default defineEventHandler(async (event) => {
     // SENSITIVE_HEADERS always stripped regardless of privacy flags
     if (SENSITIVE_HEADERS.includes(lowerKey)) continue
 
-    // Skip content-length when any privacy is active — body may be modified
-    if (anyPrivacy && lowerKey === 'content-length') continue
+    // Skip content-length when body will be modified by privacy transforms
+    // (preserved for binary passthrough and no-privacy paths)
+    if (lowerKey === 'content-length') {
+      if (anyPrivacy && !isBinaryBody) continue
+      headers[lowerKey] = value
+      continue
+    }
 
     // IP-revealing headers — controlled by ip flag
     if (lowerKey === 'x-forwarded-for' || lowerKey === 'x-real-ip' || lowerKey === 'forwarded'
@@ -201,61 +214,67 @@ export default defineEventHandler(async (event) => {
   // Read and process request body if present
   let body: string | Record<string, unknown> | undefined
   let rawBody: unknown
-  const contentType = originalHeaders['content-type'] || ''
+  // When true, body is not read — the raw request stream is piped directly to upstream
+  let passthroughBody = false
   const method = event.method?.toUpperCase()
   const originalQuery = getQuery(event)
+  const isWriteMethod = method === 'POST' || method === 'PUT' || method === 'PATCH'
 
-  if (method === 'POST' || method === 'PUT' || method === 'PATCH') {
-    rawBody = await readBody(event)
+  if (isWriteMethod) {
+    if (isBinaryBody || !anyPrivacy) {
+      // No transforms needed — don't read the body at all, stream it through directly.
+      passthroughBody = true
+    }
+    else {
+      // Text body with privacy transforms — parse and strip fingerprinting
+      rawBody = await readBody(event)
 
-    if (anyPrivacy && rawBody) {
-      if (typeof rawBody === 'object') {
-        // JSON body - strip fingerprinting recursively
-        body = stripPayloadFingerprinting(rawBody as Record<string, unknown>, privacy)
-      }
-      else if (typeof rawBody === 'string') {
-        // Try parsing as JSON first (sendBeacon often sends JSON with text/plain content-type)
-        if (rawBody.startsWith('{') || rawBody.startsWith('[')) {
-          let parsed: unknown = null
-          try {
-            parsed = JSON.parse(rawBody)
+      if (rawBody) {
+        if (typeof rawBody === 'object') {
+          // JSON body - strip fingerprinting recursively
+          body = stripPayloadFingerprinting(rawBody as Record<string, unknown>, privacy)
+        }
+        else if (typeof rawBody === 'string') {
+          // Try parsing as JSON first (sendBeacon often sends JSON with text/plain content-type)
+          if (rawBody.startsWith('{') || rawBody.startsWith('[')) {
+            let parsed: unknown = null
+            try {
+              parsed = JSON.parse(rawBody)
+            }
+            catch { /* not valid JSON */ }
+
+            if (parsed && typeof parsed === 'object') {
+              body = stripPayloadFingerprinting(parsed as Record<string, unknown>, privacy)
+            }
+            else {
+              body = rawBody
+            }
           }
-          catch { /* not valid JSON */ }
-
-          if (parsed && typeof parsed === 'object') {
-            body = stripPayloadFingerprinting(parsed as Record<string, unknown>, privacy)
+          else if (contentType.includes('application/x-www-form-urlencoded')) {
+            // URL-encoded form data
+            const params = new URLSearchParams(rawBody)
+            const obj: Record<string, unknown> = {}
+            params.forEach((value, key) => {
+              obj[key] = value
+            })
+            const stripped = stripPayloadFingerprinting(obj, privacy)
+            // Convert all values to strings — URLSearchParams coerces non-strings
+            // to "[object Object]" which corrupts nested objects/arrays
+            const stringified: Record<string, string> = {}
+            for (const [k, v] of Object.entries(stripped)) {
+              if (v === undefined || v === null) continue
+              stringified[k] = typeof v === 'string' ? v : JSON.stringify(v)
+            }
+            body = new URLSearchParams(stringified).toString()
           }
           else {
             body = rawBody
           }
         }
-        else if (contentType.includes('application/x-www-form-urlencoded')) {
-          // URL-encoded form data
-          const params = new URLSearchParams(rawBody)
-          const obj: Record<string, unknown> = {}
-          params.forEach((value, key) => {
-            obj[key] = value
-          })
-          const stripped = stripPayloadFingerprinting(obj, privacy)
-          // Convert all values to strings — URLSearchParams coerces non-strings
-          // to "[object Object]" which corrupts nested objects/arrays
-          const stringified: Record<string, string> = {}
-          for (const [k, v] of Object.entries(stripped)) {
-            if (v === undefined || v === null) continue
-            stringified[k] = typeof v === 'string' ? v : JSON.stringify(v)
-          }
-          body = new URLSearchParams(stringified).toString()
-        }
         else {
-          body = rawBody
+          body = rawBody as string
         }
       }
-      else {
-        body = rawBody as string
-      }
-    }
-    else {
-      body = rawBody as string | Record<string, unknown>
     }
   }
 
@@ -266,15 +285,16 @@ export default defineEventHandler(async (event) => {
     targetUrl,
     method: method || 'GET',
     privacy,
+    passthroughBody,
     original: {
       headers: { ...originalHeaders },
       query: originalQuery,
-      body: rawBody ?? null,
+      body: passthroughBody ? '<passthrough>' : (rawBody ?? null),
     },
     stripped: {
       headers,
       query: anyPrivacy ? stripPayloadFingerprinting(originalQuery, privacy) : originalQuery,
-      body: body ?? null,
+      body: passthroughBody ? '<passthrough>' : (body ?? null),
     },
   })
 
@@ -284,14 +304,25 @@ export default defineEventHandler(async (event) => {
   const controller = new AbortController()
   const timeoutId = setTimeout(() => controller.abort(), 15000) // 15s timeout
 
+  // Resolve the fetch body: passthrough streams the raw request, otherwise serialize
+  let fetchBody: BodyInit | undefined
+  if (passthroughBody) {
+    fetchBody = getRequestWebStream(event) as BodyInit | undefined
+  }
+  else if (body) {
+    fetchBody = typeof body === 'string' ? body : JSON.stringify(body)
+  }
+
   let response: Response
   try {
     response = await fetch(targetUrl, {
       method: method || 'GET',
       headers,
-      body: body ? (typeof body === 'string' ? body : JSON.stringify(body)) : undefined,
+      body: fetchBody,
       credentials: 'omit', // Don't send cookies to third parties
       signal: controller.signal,
+      // @ts-expect-error Node fetch supports duplex for streaming request bodies
+      duplex: passthroughBody ? 'half' : undefined,
     })
   }
   catch (err: unknown) {
diff --git a/test/e2e/first-party.test.ts b/test/e2e/first-party.test.ts
index 333defc48..a15fa19b9 100644
--- a/test/e2e/first-party.test.ts
+++ b/test/e2e/first-party.test.ts
@@ -64,6 +64,7 @@ const PROVIDER_PATHS: Record<string, string[]> = {
   ],
   tiktokPixel: ['/_proxy/tiktok'],
   redditPixel: ['/_proxy/reddit'],
+  posthog: ['/_proxy/ph', '/_proxy/ph-eu'],
 }
 
 /**
diff --git a/test/fixtures/first-party/nuxt.config.ts b/test/fixtures/first-party/nuxt.config.ts
index b60eb1ddd..a25d555ad 100644
--- a/test/fixtures/first-party/nuxt.config.ts
+++ b/test/fixtures/first-party/nuxt.config.ts
@@ -56,6 +56,7 @@ export default defineNuxtConfig({
       umamiAnalytics: { websiteId: 'test-id' },
       databuddyAnalytics: { id: 'test-id' },
       fathomAnalytics: { site: 'TEST' },
+      posthog: { apiKey: 'phc_test', apiHost: 'https://us.i.posthog.com' },
       intercom: { app_id: 'test-app' },
       crisp: { id: 'test-id' },
     },
diff --git a/test/unit/proxy-handler-binary.test.ts b/test/unit/proxy-handler-binary.test.ts
new file mode 100644
index 000000000..d5377ff2e
--- /dev/null
+++ b/test/unit/proxy-handler-binary.test.ts
@@ -0,0 +1,194 @@
+import { describe, it, expect, beforeAll, afterAll, beforeEach } from 'vitest'
+import { createApp, defineEventHandler, readBody, getHeaders, getRequestWebStream, toNodeListener } from 'h3'
+import { createServer, type Server } from 'node:http'
+import { gzipSync } from 'node:zlib'
+
+/**
+ * Tests for #618: proxy handler must preserve compressed/binary request bodies.
+ *
+ * Mirrors proxy-handler.ts logic: when no privacy transforms are needed or the
+ * body is binary/compressed, the raw request stream is piped directly to upstream
+ * without reading or re-encoding it.
+ */
+describe('proxy handler - compressed binary payloads (#618)', () => {
+  let upstreamServer: Server
+  let proxyServer: Server
+  let upstreamPort: number
+  let proxyPort: number
+  let capturedUpstreamBody: Buffer | null = null
+
+  beforeAll(async () => {
+    // Mock upstream: captures raw request bytes exactly as received
+    const upstreamApp = createApp()
+    upstreamApp.use('/', defineEventHandler(async (event) => {
+      const chunks: Buffer[] = []
+      for await (const chunk of event.node.req) {
+        chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk))
+      }
+      capturedUpstreamBody = Buffer.concat(chunks)
+      return { status: 1 }
+    }))
+
+    upstreamServer = createServer(toNodeListener(upstreamApp))
+    await new Promise<void>(resolve => upstreamServer.listen(0, resolve))
+    upstreamPort = (upstreamServer.address() as any).port
+
+    // Proxy: mirrors proxy-handler.ts body logic
+    const proxyApp = createApp()
+    proxyApp.use('/', defineEventHandler(async (event) => {
+      const method = event.method?.toUpperCase()
+      const originalHeaders = getHeaders(event)
+      const contentType = originalHeaders['content-type'] || ''
+      const anyPrivacy = originalHeaders['x-test-privacy'] === 'true'
+
+      const isBinaryBody = Boolean(
+        originalHeaders['content-encoding']
+        || contentType.includes('octet-stream'),
+      )
+
+      const isWriteMethod = method === 'POST' || method === 'PUT' || method === 'PATCH'
+      let passthroughBody = false
+      let body: string | Record<string, unknown> | undefined
+
+      if (isWriteMethod) {
+        if (isBinaryBody || !anyPrivacy) {
+          // Don't read the body — stream it through directly
+          passthroughBody = true
+        }
+        else {
+          const rawBody = await readBody(event)
+          body = rawBody as string | Record<string, unknown>
+        }
+      }
+
+      const headers: Record<string, string> = {}
+      if (contentType)
+        headers['content-type'] = contentType
+
+      let fetchBody: BodyInit | undefined
+      if (passthroughBody) {
+        fetchBody = getRequestWebStream(event) as BodyInit | undefined
+      }
+      else if (body) {
+        fetchBody = typeof body === 'string' ? body : JSON.stringify(body)
+      }
+
+      const response = await fetch(`http://localhost:${upstreamPort}/batch`, {
+        method: method || 'GET',
+        headers,
+        body: fetchBody,
+        // @ts-expect-error Node fetch supports duplex for streaming request bodies
+        duplex: passthroughBody ? 'half' : undefined,
+      })
+      return response.json()
+    }))
+
+    proxyServer = createServer(toNodeListener(proxyApp))
+    await new Promise<void>(resolve => proxyServer.listen(0, resolve))
+    proxyPort = (proxyServer.address() as any).port
+  })
+
+  afterAll(() => {
+    upstreamServer?.close()
+    proxyServer?.close()
+  })
+
+  beforeEach(() => {
+    capturedUpstreamBody = null
+  })
+
+  it('preserves gzip-compressed body sent as text/plain (PostHog gzip-js)', async () => {
+    const payload = JSON.stringify({
+      api_key: 'phc_test',
+      batch: [{ event: '$pageview', properties: { $current_url: 'https://example.com' } }],
+    })
+    const compressed = gzipSync(Buffer.from(payload))
+
+    await fetch(`http://localhost:${proxyPort}/batch?compression=gzip-js`, {
+      method: 'POST',
+      headers: { 'content-type': 'text/plain' },
+      body: compressed,
+    })
+
+    expect(capturedUpstreamBody).not.toBeNull()
+    expect(Buffer.compare(capturedUpstreamBody!, compressed)).toBe(0)
+  })
+
+  it('preserves gzip-compressed body sent without content-type', async () => {
+    const payload = JSON.stringify({ event: 'test', properties: {} })
+    const compressed = gzipSync(Buffer.from(payload))
+
+    await fetch(`http://localhost:${proxyPort}/batch?compression=gzip-js`, {
+      method: 'POST',
+      body: compressed,
+    })
+
+    expect(capturedUpstreamBody).not.toBeNull()
+    expect(Buffer.compare(capturedUpstreamBody!, compressed)).toBe(0)
+  })
+
+  it('preserves raw binary body (application/octet-stream)', async () => {
+    const binary = Buffer.from([0x00, 0x01, 0x80, 0xFF, 0xFE, 0xC0, 0xAF, 0x1F, 0x8B])
+
+    await fetch(`http://localhost:${proxyPort}/batch`, {
+      method: 'POST',
+      headers: { 'content-type': 'application/octet-stream' },
+      body: binary,
+    })
+
+    expect(capturedUpstreamBody).not.toBeNull()
+    expect(Buffer.compare(capturedUpstreamBody!, binary)).toBe(0)
+  })
+
+  it('preserves content-encoding gzip body even with privacy enabled', async () => {
+    // content-encoding signals transport compression — body cannot be parsed,
+    // so it must pass through raw even when privacy flags are active
+    const payload = JSON.stringify({ event: 'test', ua: 'fingerprint' })
+    const compressed = gzipSync(Buffer.from(payload))
+
+    await fetch(`http://localhost:${proxyPort}/batch`, {
+      method: 'POST',
+      headers: {
+        'content-type': 'application/json',
+        'content-encoding': 'gzip',
+        'x-test-privacy': 'true',
+      },
+      body: compressed,
+    })
+
+    expect(capturedUpstreamBody).not.toBeNull()
+    expect(Buffer.compare(capturedUpstreamBody!, compressed)).toBe(0)
+  })
+
+  it('still handles JSON bodies correctly with privacy (regression)', async () => {
+    const json = { event: '$pageview', properties: { url: 'https://example.com' } }
+
+    await fetch(`http://localhost:${proxyPort}/batch`, {
+      method: 'POST',
+      headers: {
+        'content-type': 'application/json',
+        'x-test-privacy': 'true',
+      },
+      body: JSON.stringify(json),
+    })
+
+    expect(capturedUpstreamBody).not.toBeNull()
+    const received = JSON.parse(capturedUpstreamBody!.toString('utf-8'))
+    expect(received).toEqual(json)
+  })
+
+  it('streams JSON body through without re-parsing when no privacy', async () => {
+    // Without privacy, even JSON bodies should pass through as-is (no readBody)
+    const jsonStr = '{"event":"$pageview","properties":{"url":"https://example.com"}}'
+
+    await fetch(`http://localhost:${proxyPort}/batch`, {
+      method: 'POST',
+      headers: { 'content-type': 'application/json' },
+      body: jsonStr,
+    })
+
+    expect(capturedUpstreamBody).not.toBeNull()
+    // Byte-exact: no re-serialization, no key reordering
+    expect(capturedUpstreamBody!.toString('utf-8')).toBe(jsonStr)
+  })
+})

From 556b6ed42cff59ed877a5bff09e04c59523055d2 Mon Sep 17 00:00:00 2001
From: Harlan Wilton <harlan@harlanzw.com>
Date: Tue, 3 Mar 2026 14:54:45 +1100
Subject: [PATCH 02/12] test: add PostHog to first-party E2E fixture

Adds posthog-js dependency, fixture page, and provider paths so PostHog
is exercised in the E2E error-check sweep with a real browser connection.
---
 test/e2e/first-party.test.ts                |  1 +
 test/fixtures/first-party/nuxt.config.ts    |  2 +-
 test/fixtures/first-party/package.json      |  5 ++++-
 test/fixtures/first-party/pages/posthog.vue | 24 +++++++++++++++++++++
 4 files changed, 30 insertions(+), 2 deletions(-)
 create mode 100644 test/fixtures/first-party/pages/posthog.vue

diff --git a/test/e2e/first-party.test.ts b/test/e2e/first-party.test.ts
index a15fa19b9..74febdc07 100644
--- a/test/e2e/first-party.test.ts
+++ b/test/e2e/first-party.test.ts
@@ -984,6 +984,7 @@ describe('first-party privacy stripping', () => {
       { name: 'umamiAnalytics', path: '/umami' },
       { name: 'databuddyAnalytics', path: '/databuddy' },
       { name: 'fathomAnalytics', path: '/fathom' },
+      { name: 'posthog', path: '/posthog' },
       { name: 'intercom', path: '/intercom-test' },
       { name: 'crisp', path: '/crisp-test' },
     ]
diff --git a/test/fixtures/first-party/nuxt.config.ts b/test/fixtures/first-party/nuxt.config.ts
index a25d555ad..67a227d0e 100644
--- a/test/fixtures/first-party/nuxt.config.ts
+++ b/test/fixtures/first-party/nuxt.config.ts
@@ -56,7 +56,7 @@ export default defineNuxtConfig({
       umamiAnalytics: { websiteId: 'test-id' },
       databuddyAnalytics: { id: 'test-id' },
       fathomAnalytics: { site: 'TEST' },
-      posthog: { apiKey: 'phc_test', apiHost: 'https://us.i.posthog.com' },
+      posthog: { apiKey: 'phc_test' },
       intercom: { app_id: 'test-app' },
       crisp: { id: 'test-id' },
     },
diff --git a/test/fixtures/first-party/package.json b/test/fixtures/first-party/package.json
index 3162623cc..ec9d83ca4 100644
--- a/test/fixtures/first-party/package.json
+++ b/test/fixtures/first-party/package.json
@@ -1,4 +1,7 @@
 {
   "name": "first-party-fixture",
-  "private": true
+  "private": true,
+  "devDependencies": {
+    "posthog-js": "^1.309.1"
+  }
 }
diff --git a/test/fixtures/first-party/pages/posthog.vue b/test/fixtures/first-party/pages/posthog.vue
new file mode 100644
index 000000000..4b83396c7
--- /dev/null
+++ b/test/fixtures/first-party/pages/posthog.vue
@@ -0,0 +1,24 @@
+<script lang="ts" setup>
+import { useHead, useScriptPostHog } from '#imports'
+
+useHead({ title: 'PostHog - First Party' })
+const { status } = useScriptPostHog({
+  apiKey: 'phc_test',
+  region: 'us',
+  config: {
+    autocapture: false,
+    capture_pageview: true,
+  },
+})
+</script>
+
+<template>
+  <div>
+    <h1>PostHog First-Party Test</h1>
+    <ClientOnly>
+      <div id="status">
+        status: {{ status }}
+      </div>
+    </ClientOnly>
+  </div>
+</template>

From 3b7e564a38db5d5343c041aaa87ca94ad59b7459 Mon Sep 17 00:00:00 2001
From: Harlan Wilton <harlan@harlanzw.com>
Date: Tue, 3 Mar 2026 15:31:29 +1100
Subject: [PATCH 03/12] fix: broaden binary body detection to cover query-param
 compression

- Detect ?compression=gzip-js (PostHog) so compressed bodies pass through
  raw even when privacy is enabled
- Fix truthy checks on rawBody/body to avoid dropping falsy-but-valid payloads
- Add test for gzip-js + privacy enabled scenario
---
 src/runtime/server/proxy-handler.ts    | 16 +++++++++------
 test/unit/proxy-handler-binary.test.ts | 27 +++++++++++++++++++++++---
 2 files changed, 34 insertions(+), 9 deletions(-)

diff --git a/src/runtime/server/proxy-handler.ts b/src/runtime/server/proxy-handler.ts
index b61245e0d..a2127fe00 100644
--- a/src/runtime/server/proxy-handler.ts
+++ b/src/runtime/server/proxy-handler.ts
@@ -103,13 +103,17 @@ export default defineEventHandler(async (event) => {
   const anyPrivacy = privacy.ip || privacy.userAgent || privacy.language || privacy.screen || privacy.timezone || privacy.hardware
 
   // Detect binary/compressed bodies that cannot be safely parsed as text.
-  // content-encoding indicates transport-level compression (gzip, br, etc.);
-  // application/octet-stream is explicitly binary. These must be passed through as raw bytes.
+  // These must be passed through as raw bytes to avoid corruption:
+  // - content-encoding: transport-level compression (gzip, br, etc.)
+  // - application/octet-stream: explicitly binary content
+  // - ?compression=gzip-js: client-side compression (e.g. PostHog sends gzip bytes as text/plain)
   const originalHeaders = getHeaders(event)
   const contentType = originalHeaders['content-type'] || ''
+  const compressionParam = new URL(event.path, 'http://localhost').searchParams.get('compression')
   const isBinaryBody = Boolean(
     originalHeaders['content-encoding']
-    || contentType.includes('octet-stream'),
+    || contentType.includes('octet-stream')
+    || (compressionParam && /gzip|deflate|br|compress/i.test(compressionParam)),
   )
 
   // Build target URL with stripped query params
@@ -211,7 +215,7 @@ export default defineEventHandler(async (event) => {
       .join(', ')
   }
 
-  // Read and process request body if present
+  // Process request body: either stream through raw or read + transform
   let body: string | Record<string, unknown> | undefined
   let rawBody: unknown
   // When true, body is not read — the raw request stream is piped directly to upstream
@@ -229,7 +233,7 @@ export default defineEventHandler(async (event) => {
       // Text body with privacy transforms — parse and strip fingerprinting
       rawBody = await readBody(event)
 
-      if (rawBody) {
+      if (rawBody != null) {
         if (typeof rawBody === 'object') {
           // JSON body - strip fingerprinting recursively
           body = stripPayloadFingerprinting(rawBody as Record<string, unknown>, privacy)
@@ -309,7 +313,7 @@ export default defineEventHandler(async (event) => {
   if (passthroughBody) {
     fetchBody = getRequestWebStream(event) as BodyInit | undefined
   }
-  else if (body) {
+  else if (body !== undefined) {
     fetchBody = typeof body === 'string' ? body : JSON.stringify(body)
   }
 
diff --git a/test/unit/proxy-handler-binary.test.ts b/test/unit/proxy-handler-binary.test.ts
index d5377ff2e..280ea86b4 100644
--- a/test/unit/proxy-handler-binary.test.ts
+++ b/test/unit/proxy-handler-binary.test.ts
@@ -1,5 +1,5 @@
 import { describe, it, expect, beforeAll, afterAll, beforeEach } from 'vitest'
-import { createApp, defineEventHandler, readBody, getHeaders, getRequestWebStream, toNodeListener } from 'h3'
+import { createApp, defineEventHandler, readBody, getHeaders, getRequestWebStream, toNodeListener, getRequestURL } from 'h3'
 import { createServer, type Server } from 'node:http'
 import { gzipSync } from 'node:zlib'
 
@@ -41,9 +41,11 @@ describe('proxy handler - compressed binary payloads (#618)', () => {
       const contentType = originalHeaders['content-type'] || ''
       const anyPrivacy = originalHeaders['x-test-privacy'] === 'true'
 
+      const compressionParam = getRequestURL(event).searchParams.get('compression')
       const isBinaryBody = Boolean(
         originalHeaders['content-encoding']
-        || contentType.includes('octet-stream'),
+        || contentType.includes('octet-stream')
+        || (compressionParam && /gzip|deflate|br|compress/i.test(compressionParam)),
       )
 
       const isWriteMethod = method === 'POST' || method === 'PUT' || method === 'PATCH'
@@ -69,7 +71,7 @@ describe('proxy handler - compressed binary payloads (#618)', () => {
       if (passthroughBody) {
         fetchBody = getRequestWebStream(event) as BodyInit | undefined
       }
-      else if (body) {
+      else if (body !== undefined) {
         fetchBody = typeof body === 'string' ? body : JSON.stringify(body)
       }
 
@@ -140,6 +142,25 @@ describe('proxy handler - compressed binary payloads (#618)', () => {
     expect(Buffer.compare(capturedUpstreamBody!, binary)).toBe(0)
   })
 
+  it('preserves gzip-js body when privacy is enabled without content-encoding', async () => {
+    // PostHog gzip-js sends compressed bytes as text/plain with ?compression=gzip-js
+    // and no content-encoding header. Even with privacy enabled, this must pass through raw.
+    const payload = JSON.stringify({ event: 'test', ua: 'fingerprint' })
+    const compressed = gzipSync(Buffer.from(payload))
+
+    await fetch(`http://localhost:${proxyPort}/batch?compression=gzip-js`, {
+      method: 'POST',
+      headers: {
+        'content-type': 'text/plain',
+        'x-test-privacy': 'true',
+      },
+      body: compressed,
+    })
+
+    expect(capturedUpstreamBody).not.toBeNull()
+    expect(Buffer.compare(capturedUpstreamBody!, compressed)).toBe(0)
+  })
+
   it('preserves content-encoding gzip body even with privacy enabled', async () => {
     // content-encoding signals transport compression — body cannot be parsed,
     // so it must pass through raw even when privacy flags are active

From c97fc8d04d547662bae54104fb07977359f59ab3 Mon Sep 17 00:00:00 2001
From: Harlan Wilton <harlan@harlanzw.com>
Date: Tue, 3 Mar 2026 15:40:04 +1100
Subject: [PATCH 04/12] test: filter PostHog MIME type noise in E2E proxy error
 assertions

PostHog's config.js endpoint returns JSON but the SDK requests it as a
script, causing a MIME type error in strict-mode browsers. This is a
known third-party behavior, not a proxy rewrite bug.
---
 test/e2e/first-party.test.ts | 1 +
 1 file changed, 1 insertion(+)

diff --git a/test/e2e/first-party.test.ts b/test/e2e/first-party.test.ts
index 74febdc07..bb0a13aa1 100644
--- a/test/e2e/first-party.test.ts
+++ b/test/e2e/first-party.test.ts
@@ -944,6 +944,7 @@ describe('first-party privacy stripping', () => {
       /The source list for Content Security Policy/i,
       /Permissions policy/i,
       /third-party cookie/i,
+      /MIME type .* is not executable/i, // PostHog config.js returns JSON, browser expects JS
     ]
 
     /** Patterns that indicate the error is from a proxy-rewritten script (high confidence) */

From b0a98570bb0a67f6034e02aedc07f4b40f4b1db9 Mon Sep 17 00:00:00 2001
From: Harlan Wilton <harlan@harlanzw.com>
Date: Tue, 3 Mar 2026 15:44:02 +1100
Subject: [PATCH 05/12] test: scope MIME type noise filter to PostHog config.js
 only

Only suppress the MIME-not-executable error when the URL contains
config.js, so real MIME type regressions on other providers still surface.
---
 test/e2e/first-party.test.ts | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/test/e2e/first-party.test.ts b/test/e2e/first-party.test.ts
index bb0a13aa1..a82198e55 100644
--- a/test/e2e/first-party.test.ts
+++ b/test/e2e/first-party.test.ts
@@ -944,7 +944,6 @@ describe('first-party privacy stripping', () => {
       /The source list for Content Security Policy/i,
       /Permissions policy/i,
       /third-party cookie/i,
-      /MIME type .* is not executable/i, // PostHog config.js returns JSON, browser expects JS
     ]
 
     /** Patterns that indicate the error is from a proxy-rewritten script (high confidence) */
@@ -961,7 +960,10 @@ describe('first-party privacy stripping', () => {
     ]
 
     function isKnownNoise(text: string): boolean {
-      return KNOWN_THIRD_PARTY_NOISE.some(p => p.test(text))
+      if (KNOWN_THIRD_PARTY_NOISE.some(p => p.test(text))) return true
+      // PostHog config.js returns JSON but SDK requests it as a script — MIME error is expected
+      if (/MIME type .* is not executable/i.test(text) && /config\.js/.test(text)) return true
+      return false
     }
 
     function isProxyRelated(text: string): boolean {

From 75639f2f83c3666997fa6058959639cd260457de Mon Sep 17 00:00:00 2001
From: Harlan Wilton <harlan@harlanzw.com>
Date: Tue, 3 Mar 2026 15:47:59 +1100
Subject: [PATCH 06/12] fix: preserve top-level JSON array bodies through
 privacy transforms

Arrays passed to stripPayloadFingerprinting were coerced into objects
({"0": ..., "1": ...}). Now arrays are detected and each element is
stripped individually, preserving the original array shape.
---
 src/runtime/server/proxy-handler.ts | 23 +++++++++++++++++++----
 1 file changed, 19 insertions(+), 4 deletions(-)

diff --git a/src/runtime/server/proxy-handler.ts b/src/runtime/server/proxy-handler.ts
index a2127fe00..b5f84a94c 100644
--- a/src/runtime/server/proxy-handler.ts
+++ b/src/runtime/server/proxy-handler.ts
@@ -216,7 +216,7 @@ export default defineEventHandler(async (event) => {
   }
 
   // Process request body: either stream through raw or read + transform
-  let body: string | Record<string, unknown> | undefined
+  let body: string | Record<string, unknown> | unknown[] | undefined
   let rawBody: unknown
   // When true, body is not read — the raw request stream is piped directly to upstream
   let passthroughBody = false
@@ -234,8 +234,16 @@ export default defineEventHandler(async (event) => {
       rawBody = await readBody(event)
 
       if (rawBody != null) {
-        if (typeof rawBody === 'object') {
-          // JSON body - strip fingerprinting recursively
+        if (Array.isArray(rawBody)) {
+          // JSON array body (e.g. batch payloads) — strip each element individually
+          body = rawBody.map(item =>
+            item && typeof item === 'object' && !Array.isArray(item)
+              ? stripPayloadFingerprinting(item as Record<string, unknown>, privacy)
+              : item,
+          )
+        }
+        else if (typeof rawBody === 'object') {
+          // JSON object body - strip fingerprinting recursively
           body = stripPayloadFingerprinting(rawBody as Record<string, unknown>, privacy)
         }
         else if (typeof rawBody === 'string') {
@@ -247,7 +255,14 @@ export default defineEventHandler(async (event) => {
             }
             catch { /* not valid JSON */ }
 
-            if (parsed && typeof parsed === 'object') {
+            if (Array.isArray(parsed)) {
+              body = parsed.map(item =>
+                item && typeof item === 'object' && !Array.isArray(item)
+                  ? stripPayloadFingerprinting(item as Record<string, unknown>, privacy)
+                  : item,
+              )
+            }
+            else if (parsed && typeof parsed === 'object') {
               body = stripPayloadFingerprinting(parsed as Record<string, unknown>, privacy)
             }
             else {

From 6b53d3da73ab2c6f25b88a019de164d176cd09d3 Mon Sep 17 00:00:00 2001
From: Harlan Wilton <harlan@harlanzw.com>
Date: Tue, 3 Mar 2026 15:53:32 +1100
Subject: [PATCH 07/12] test: only flag 5xx proxy responses as failures in E2E
 tests

4xx responses from upstream APIs are expected with fake test API keys
(e.g. PostHog returning 404/401 for phc_test). Only 5xx indicates
actual proxy infrastructure failures.
---
 test/e2e/first-party.test.ts | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/test/e2e/first-party.test.ts b/test/e2e/first-party.test.ts
index a82198e55..7a50e6889 100644
--- a/test/e2e/first-party.test.ts
+++ b/test/e2e/first-party.test.ts
@@ -1021,12 +1021,13 @@ describe('first-party privacy stripping', () => {
         }
       })
 
-      // Capture failed proxy requests — 404s from /_proxy/ paths indicate
-      // broken rewrite rules or missing route handlers
+      // Capture failed proxy requests — 5xx from /_proxy/ paths indicate
+      // broken proxy infrastructure (route mismatches, handler crashes).
+      // 4xx responses are expected — upstream APIs reject fake test API keys.
       page.on('response', (response) => {
         const reqUrl = response.url()
         const status = response.status()
-        if (reqUrl.includes('/_proxy/') && status >= 400) {
+        if (reqUrl.includes('/_proxy/') && status >= 500) {
           failedProxyRequests.push({ url: reqUrl, status })
         }
       })
@@ -1064,7 +1065,7 @@ describe('first-party privacy stripping', () => {
         `${name}: Proxy-related console errors:\n${proxyConsoleErrors.map(e => `  [${e.type}] ${e.text}`).join('\n')}`,
       ).toEqual([])
 
-      // Assert no failed proxy requests (404s, 500s from /_proxy/ paths)
+      // Assert no failed proxy requests (5xx from /_proxy/ paths)
       expect(
         failedProxyRequests,
         `${name}: Failed proxy requests:\n${failedProxyRequests.map(r => `  ${r.status} ${r.url}`).join('\n')}`,

From 877439b0a540821213b5da3595a208bb24234269 Mon Sep 17 00:00:00 2001
From: Harlan Wilton <harlan@harlanzw.com>
Date: Tue, 3 Mar 2026 15:56:51 +1100
Subject: [PATCH 08/12] test: use real PostHog API key and scope proxy
 assertions per-provider

Use the same real API key from the basic fixture so upstream returns
valid responses. Scope failed proxy request assertions to only check
the current provider's paths to avoid cross-provider noise from
globally-registered scripts.
---
 test/e2e/first-party.test.ts                | 21 ++++++++++++++-------
 test/fixtures/first-party/nuxt.config.ts    |  2 +-
 test/fixtures/first-party/pages/posthog.vue |  2 +-
 3 files changed, 16 insertions(+), 9 deletions(-)

diff --git a/test/e2e/first-party.test.ts b/test/e2e/first-party.test.ts
index 7a50e6889..557cf157b 100644
--- a/test/e2e/first-party.test.ts
+++ b/test/e2e/first-party.test.ts
@@ -1021,13 +1021,12 @@ describe('first-party privacy stripping', () => {
         }
       })
 
-      // Capture failed proxy requests — 5xx from /_proxy/ paths indicate
-      // broken proxy infrastructure (route mismatches, handler crashes).
-      // 4xx responses are expected — upstream APIs reject fake test API keys.
+      // Capture failed proxy requests — 4xx/5xx from /_proxy/ paths indicate
+      // broken rewrite rules or missing route handlers
       page.on('response', (response) => {
         const reqUrl = response.url()
         const status = response.status()
-        if (reqUrl.includes('/_proxy/') && status >= 500) {
+        if (reqUrl.includes('/_proxy/') && status >= 400) {
           failedProxyRequests.push({ url: reqUrl, status })
         }
       })
@@ -1065,10 +1064,18 @@ describe('first-party privacy stripping', () => {
         `${name}: Proxy-related console errors:\n${proxyConsoleErrors.map(e => `  [${e.type}] ${e.text}`).join('\n')}`,
       ).toEqual([])
 
-      // Assert no failed proxy requests (5xx from /_proxy/ paths)
+      // Assert no failed proxy requests for this provider's paths
+      // Other globally-registered scripts may fire cross-provider requests
+      const providerPrefixes = PROVIDER_PATHS[name] || []
+      const ownFailedRequests = providerPrefixes.length > 0
+        ? failedProxyRequests.filter((r) => {
+            const urlPath = new URL(r.url).pathname
+            return providerPrefixes.some(prefix => urlPath.startsWith(prefix))
+          })
+        : failedProxyRequests
       expect(
-        failedProxyRequests,
-        `${name}: Failed proxy requests:\n${failedProxyRequests.map(r => `  ${r.status} ${r.url}`).join('\n')}`,
+        ownFailedRequests,
+        `${name}: Failed proxy requests:\n${ownFailedRequests.map(r => `  ${r.status} ${r.url}`).join('\n')}`,
       ).toEqual([])
     }, 30000)
   })
diff --git a/test/fixtures/first-party/nuxt.config.ts b/test/fixtures/first-party/nuxt.config.ts
index 67a227d0e..265c71b7f 100644
--- a/test/fixtures/first-party/nuxt.config.ts
+++ b/test/fixtures/first-party/nuxt.config.ts
@@ -56,7 +56,7 @@ export default defineNuxtConfig({
       umamiAnalytics: { websiteId: 'test-id' },
       databuddyAnalytics: { id: 'test-id' },
       fathomAnalytics: { site: 'TEST' },
-      posthog: { apiKey: 'phc_test' },
+      posthog: { apiKey: 'phc_CkMaDU6dr11eJoQdAiSJb1rC324dogk3T952gJ6fD9W' },
       intercom: { app_id: 'test-app' },
       crisp: { id: 'test-id' },
     },
diff --git a/test/fixtures/first-party/pages/posthog.vue b/test/fixtures/first-party/pages/posthog.vue
index 4b83396c7..fc3d3be7c 100644
--- a/test/fixtures/first-party/pages/posthog.vue
+++ b/test/fixtures/first-party/pages/posthog.vue
@@ -3,7 +3,7 @@ import { useHead, useScriptPostHog } from '#imports'
 
 useHead({ title: 'PostHog - First Party' })
 const { status } = useScriptPostHog({
-  apiKey: 'phc_test',
+  apiKey: 'phc_CkMaDU6dr11eJoQdAiSJb1rC324dogk3T952gJ6fD9W',
   region: 'us',
   config: {
     autocapture: false,

From 05f26ca53c2d68369eb8c7c699cf89b90f82b8fc Mon Sep 17 00:00:00 2001
From: Harlan Wilton <harlan@harlanzw.com>
Date: Tue, 3 Mar 2026 16:50:54 +1100
Subject: [PATCH 09/12] fix: include base64 in compression detection, use real
 API keys

- Add base64 to compression query param regex (PostHog uses it)
- Replace placeholder IDs with real ones from playground across
  plausible, cloudflare, rybbit, fathom, intercom, and crisp
---
 src/runtime/server/proxy-handler.ts      |  2 +-
 test/fixtures/first-party/nuxt.config.ts | 16 ++++++++--------
 test/unit/proxy-handler-binary.test.ts   |  2 +-
 3 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/src/runtime/server/proxy-handler.ts b/src/runtime/server/proxy-handler.ts
index b5f84a94c..3aaf3e18d 100644
--- a/src/runtime/server/proxy-handler.ts
+++ b/src/runtime/server/proxy-handler.ts
@@ -113,7 +113,7 @@ export default defineEventHandler(async (event) => {
   const isBinaryBody = Boolean(
     originalHeaders['content-encoding']
     || contentType.includes('octet-stream')
-    || (compressionParam && /gzip|deflate|br|compress/i.test(compressionParam)),
+    || (compressionParam && /gzip|deflate|br|compress|base64/i.test(compressionParam)),
   )
 
   // Build target URL with stripped query params
diff --git a/test/fixtures/first-party/nuxt.config.ts b/test/fixtures/first-party/nuxt.config.ts
index 265c71b7f..df1262bb2 100644
--- a/test/fixtures/first-party/nuxt.config.ts
+++ b/test/fixtures/first-party/nuxt.config.ts
@@ -50,15 +50,15 @@ export default defineNuxtConfig({
       redditPixel: {
         id: 't2_test_advertiser_id',
       },
-      plausibleAnalytics: { domain: 'example.com' },
-      cloudflareWebAnalytics: { token: 'test-token' },
-      rybbitAnalytics: { analyticsId: 'test-id' },
-      umamiAnalytics: { websiteId: 'test-id' },
-      databuddyAnalytics: { id: 'test-id' },
-      fathomAnalytics: { site: 'TEST' },
+      plausibleAnalytics: { domain: 'scripts.nuxt.com' },
+      cloudflareWebAnalytics: { token: 'ade278253a19413c9bd923b079870902' },
+      rybbitAnalytics: { analyticsId: '874' },
+      umamiAnalytics: { websiteId: 'demo-website-id-123' },
+      databuddyAnalytics: { id: 'demo-client-123' },
+      fathomAnalytics: { site: 'BRDEJWKJ' },
       posthog: { apiKey: 'phc_CkMaDU6dr11eJoQdAiSJb1rC324dogk3T952gJ6fD9W' },
-      intercom: { app_id: 'test-app' },
-      crisp: { id: 'test-id' },
+      intercom: { app_id: 'akg5rmxb' },
+      crisp: { id: 'b1021910-7ace-425a-9ef5-07f49e5ce417' },
     },
   },
 })
diff --git a/test/unit/proxy-handler-binary.test.ts b/test/unit/proxy-handler-binary.test.ts
index 280ea86b4..4f1a3e83f 100644
--- a/test/unit/proxy-handler-binary.test.ts
+++ b/test/unit/proxy-handler-binary.test.ts
@@ -45,7 +45,7 @@ describe('proxy handler - compressed binary payloads (#618)', () => {
       const isBinaryBody = Boolean(
         originalHeaders['content-encoding']
         || contentType.includes('octet-stream')
-        || (compressionParam && /gzip|deflate|br|compress/i.test(compressionParam)),
+        || (compressionParam && /gzip|deflate|br|compress|base64/i.test(compressionParam)),
       )
 
       const isWriteMethod = method === 'POST' || method === 'PUT' || method === 'PATCH'

From f96cdaa68090d463338f3ee6e11ac103f540de71 Mon Sep 17 00:00:00 2001
From: Harlan Wilton <harlan@harlanzw.com>
Date: Tue, 3 Mar 2026 16:52:59 +1100
Subject: [PATCH 10/12] test: remove all error filtering from E2E proxy tests
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Every console error, uncaught exception, and failed proxy request is
now treated as critical. No noise lists, no per-provider scoping — if
it errors, the test fails.
---
 test/e2e/first-party.test.ts | 81 +++++-------------------------------
 1 file changed, 11 insertions(+), 70 deletions(-)

diff --git a/test/e2e/first-party.test.ts b/test/e2e/first-party.test.ts
index 557cf157b..d94146413 100644
--- a/test/e2e/first-party.test.ts
+++ b/test/e2e/first-party.test.ts
@@ -931,45 +931,6 @@ describe('first-party privacy stripping', () => {
    * so unit tests alone are insufficient.
    */
   describe('no script errors from proxy rewrites', () => {
-    /**
-     * Errors from third-party scripts unrelated to our rewrite logic.
-     * These occur in headless browsers regardless of proxy mode.
-     */
-    const KNOWN_THIRD_PARTY_NOISE = [
-      /Failed to load resource/i, // Network errors, 404s, CDN auth
-      /net::ERR_/i, // Chrome network errors
-      /Refused to connect/i, // CSP
-      /Tracking Prevention/i, // Browser tracking prevention
-      /favicon/i, // favicon 404
-      /The source list for Content Security Policy/i,
-      /Permissions policy/i,
-      /third-party cookie/i,
-    ]
-
-    /** Patterns that indicate the error is from a proxy-rewritten script (high confidence) */
-    const PROXY_ERROR_INDICATORS = [
-      /_proxy/,
-      /_scripts\/c/,
-      /self\.location/,
-      /SyntaxError/i,
-      /cannot be parsed as a URL/i,
-      /Invalid URL/i,
-      /Unexpected token/i,
-      /ERR_NAME_NOT_RESOLVED/i,
-      /Failed to construct 'URL'/i,
-    ]
-
-    function isKnownNoise(text: string): boolean {
-      if (KNOWN_THIRD_PARTY_NOISE.some(p => p.test(text))) return true
-      // PostHog config.js returns JSON but SDK requests it as a script — MIME error is expected
-      if (/MIME type .* is not executable/i.test(text) && /config\.js/.test(text)) return true
-      return false
-    }
-
-    function isProxyRelated(text: string): boolean {
-      return PROXY_ERROR_INDICATORS.some(p => p.test(text))
-    }
-
     const providerPages = [
       { name: 'googleAnalytics', path: '/ga' },
       { name: 'googleTagManager', path: '/gtm' },
@@ -1001,24 +962,16 @@ describe('first-party privacy stripping', () => {
       const uncaughtErrors: string[] = []
       const failedProxyRequests: { url: string, status: number }[] = []
 
-      // Capture console errors
+      // Capture all console errors — no filtering, every error is critical
       page.on('console', (msg) => {
-        const type = msg.type()
-        if (type === 'error') {
-          const text = msg.text()
-          if (!isKnownNoise(text)) {
-            consoleErrors.push({ type, text })
-          }
+        if (msg.type() === 'error') {
+          consoleErrors.push({ type: 'error', text: msg.text() })
         }
       })
 
-      // Capture ALL uncaught exceptions — any uncaught error from a rewritten
-      // script is a bug (SyntaxError, TypeError, ReferenceError, etc.)
+      // Capture all uncaught exceptions
       page.on('pageerror', (err) => {
-        const text = err.message || String(err)
-        if (!isKnownNoise(text)) {
-          uncaughtErrors.push(text)
-        }
+        uncaughtErrors.push(err.message || String(err))
       })
 
       // Capture failed proxy requests — 4xx/5xx from /_proxy/ paths indicate
@@ -1050,32 +1003,20 @@ describe('first-party privacy stripping', () => {
       // test infrastructure — fail explicitly instead of passing vacuously.
       expect(pageRendered, `${name}: Page did not render — test is meaningless without a rendered page`).toBe(true)
 
-      // Assert no uncaught exceptions at all — these indicate broken scripts
-      // regardless of whether the error message mentions proxying
+      // Assert no errors at all — every error is critical
       expect(
         uncaughtErrors,
-        `${name}: Uncaught exceptions detected:\n${uncaughtErrors.map(e => `  ${e}`).join('\n')}`,
+        `${name}: Uncaught exceptions:\n${uncaughtErrors.map(e => `  ${e}`).join('\n')}`,
       ).toEqual([])
 
-      // Assert no proxy-related console errors
-      const proxyConsoleErrors = consoleErrors.filter(e => isProxyRelated(e.text))
       expect(
-        proxyConsoleErrors,
-        `${name}: Proxy-related console errors:\n${proxyConsoleErrors.map(e => `  [${e.type}] ${e.text}`).join('\n')}`,
+        consoleErrors,
+        `${name}: Console errors:\n${consoleErrors.map(e => `  ${e.text}`).join('\n')}`,
       ).toEqual([])
 
-      // Assert no failed proxy requests for this provider's paths
-      // Other globally-registered scripts may fire cross-provider requests
-      const providerPrefixes = PROVIDER_PATHS[name] || []
-      const ownFailedRequests = providerPrefixes.length > 0
-        ? failedProxyRequests.filter((r) => {
-            const urlPath = new URL(r.url).pathname
-            return providerPrefixes.some(prefix => urlPath.startsWith(prefix))
-          })
-        : failedProxyRequests
       expect(
-        ownFailedRequests,
-        `${name}: Failed proxy requests:\n${ownFailedRequests.map(r => `  ${r.status} ${r.url}`).join('\n')}`,
+        failedProxyRequests,
+        `${name}: Failed proxy requests:\n${failedProxyRequests.map(r => `  ${r.status} ${r.url}`).join('\n')}`,
       ).toEqual([])
     }, 30000)
   })

From c98e590d58bd7e99085257ea82699a65fab33b9e Mon Sep 17 00:00:00 2001
From: Harlan Wilton <harlan@harlanzw.com>
Date: Tue, 3 Mar 2026 22:47:12 +1100
Subject: [PATCH 11/12] fix: zero error filtering, leading-dash hash fix, add
 PostHog to provider lists

- Use [input, { trigger: 'manual' }] registry format with runtimeConfig
- Remove all noise filtering from test assertions
- Fix Nitro publicAssets leading-dash filename bug
- Add PostHog to error check and bundle coverage provider lists
- Update snapshots
---
 CHANGELOG.md                                  |  16 +++
 src/plugins/transform.ts                      |   7 +-
 test/e2e/__snapshots__/proxy/clarity.json     |  23 ++++
 ...pts.clarity.ms~0.8.56~clarity.js.diff.json |  10 ++
 test/e2e/__snapshots__/proxy/metaPixel.json   |  32 ++---
 ...ebook.net~signals~config~3925006.diff.json |   4 -
 .../proxy/metaPixel/facebook.com~tr.diff.json |   4 -
 .../metaPixel/facebook.com~tr~2.diff.json     |   4 -
 test/e2e/__snapshots__/proxy/xPixel.json      |   4 +-
 test/e2e/first-party.test.ts                  | 114 +++++++++++++-----
 test/fixtures/first-party/nuxt.config.ts      |  95 ++++++++-------
 test/fixtures/first-party/pages/segment.vue   |   2 +-
 test/unit/proxy-handler-binary.test.ts        |  88 +++++---------
 13 files changed, 241 insertions(+), 162 deletions(-)
 create mode 100644 test/e2e/__snapshots__/proxy/clarity.json
 create mode 100644 test/e2e/__snapshots__/proxy/clarity/scripts.clarity.ms~0.8.56~clarity.js.diff.json

diff --git a/CHANGELOG.md b/CHANGELOG.md
index f46d8abc6..3469c60db 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,21 @@
 # Changelog
 
+## v1.0.0-beta.5...main
+
+[compare changes](https://github.com/nuxt/scripts/compare/v1.0.0-beta.5...main)
+
+### 💅 Refactors
+
+- Replace SW + beacon monkey-patch with AST-based API rewriting ([#614](https://github.com/nuxt/scripts/pull/614))
+
+### 🏡 Chore
+
+- Bump deps ([814bbf6](https://github.com/nuxt/scripts/commit/814bbf6))
+
+### ❤️ Contributors
+
+- Harlan Wilton ([@harlan-zw](https://github.com/harlan-zw))
+
 ## v1.0.0-beta.4...main
 
 [compare changes](https://github.com/nuxt/scripts/compare/v1.0.0-beta.4...main)
diff --git a/src/plugins/transform.ts b/src/plugins/transform.ts
index 5b521202b..e05b8ab18 100644
--- a/src/plugins/transform.ts
+++ b/src/plugins/transform.ts
@@ -83,9 +83,10 @@ function normalizeScriptData(src: string, assetsBaseURL: string = '/_scripts'):
   if (hasProtocol(src, { acceptRelative: true })) {
     src = src.replace(/^\/\//, 'https://')
     const url = parseURL(src)
-    const file = [
-      `${ohash(url)}.js`, // force an extension
-    ].filter(Boolean).join('-')
+    const h = ohash(url)
+    // Prefix hashes starting with '-' — Nitro's publicAssets handler cannot serve
+    // files whose names begin with a dash (they get omitted from the asset manifest).
+    const file = `${h.startsWith('-') ? `_${h.slice(1)}` : h}.js`
     const nuxt = tryUseNuxt()
     // Use cdnURL if available, otherwise fall back to baseURL
     const cdnURL = nuxt?.options.runtimeConfig?.app?.cdnURL || nuxt?.options.app?.cdnURL || ''
diff --git a/test/e2e/__snapshots__/proxy/clarity.json b/test/e2e/__snapshots__/proxy/clarity.json
new file mode 100644
index 000000000..562e2de24
--- /dev/null
+++ b/test/e2e/__snapshots__/proxy/clarity.json
@@ -0,0 +1,23 @@
+[
+  {
+    "method": "GET",
+    "original": {
+      "body": null,
+      "query": {},
+    },
+    "path": "/_proxy/clarity-scripts/0.8.56/clarity.js",
+    "privacy": {
+      "hardware": true,
+      "ip": true,
+      "language": true,
+      "screen": false,
+      "timezone": false,
+      "userAgent": false,
+    },
+    "stripped": {
+      "body": null,
+      "query": {},
+    },
+    "targetUrl": "https://scripts.clarity.ms/0.8.56/clarity.js",
+  },
+]
\ No newline at end of file
diff --git a/test/e2e/__snapshots__/proxy/clarity/scripts.clarity.ms~0.8.56~clarity.js.diff.json b/test/e2e/__snapshots__/proxy/clarity/scripts.clarity.ms~0.8.56~clarity.js.diff.json
new file mode 100644
index 000000000..a786114e2
--- /dev/null
+++ b/test/e2e/__snapshots__/proxy/clarity/scripts.clarity.ms~0.8.56~clarity.js.diff.json
@@ -0,0 +1,10 @@
+{
+  "headers": {
+    "x-forwarded-for": {
+      "anonymized": "127.0.0.0",
+      "original": "<absent>",
+    },
+  },
+  "method": "GET",
+  "target": "scripts.clarity.ms/0.8.56/clarity.js",
+}
\ No newline at end of file
diff --git a/test/e2e/__snapshots__/proxy/metaPixel.json b/test/e2e/__snapshots__/proxy/metaPixel.json
index fdbd72fe7..6a4b951b0 100644
--- a/test/e2e/__snapshots__/proxy/metaPixel.json
+++ b/test/e2e/__snapshots__/proxy/metaPixel.json
@@ -5,13 +5,13 @@
       "body": null,
       "query": {
         "domain": "127.0.0.1",
-        "ex_m": "100,192,141,22,69,70,134,65,64,11,149,86,16,128,121,72,75,127,146,151,8,4,5,7,6,3,87,97,152,157,206,59,173,174,52,250,30,71,218,217,216,23,32,99,58,10,60,93,94,95,101,124,31,29,126,123,122,142,73,145,143,144,47,57,117,15,148,42,238,239,237,26,27,28,45,135,74,108,18,20,41,37,39,38,80,88,92,106,133,136,43,107,24,21,113,66,35,138,137,139,130,129,25,34,56,105,147,67,17,140,110,78,63,19,81,82,33,262,199,188,189,187,265,257,49,200,103,125,77,115,51,44,46,109,114,120,55,61,50,53,96,150,1,118,14,116,12,2,54,89,62,112,85,84,153,154,90,91,9,119,98,48,131,83,76,68,111,102,40,132,0,79,36,104,13,155",
-        "hme": "243a8305e15c8bf3a50c0d350a428553388d507240cf13e95dd0abfb8651365d",
+        "ex_m": "100,193,142,22,69,70,135,65,64,11,150,86,16,129,122,72,75,128,147,152,8,4,5,7,6,3,87,97,153,158,207,59,174,175,52,251,30,71,219,218,217,23,32,99,58,10,60,93,94,95,101,125,31,29,127,124,123,143,73,146,144,145,47,57,118,15,149,42,239,240,238,26,27,28,45,136,74,108,18,20,41,37,39,38,80,88,92,106,134,137,43,107,24,21,114,66,35,139,138,140,131,130,25,34,56,105,148,67,17,141,110,78,63,19,81,82,111,33,264,200,189,190,188,267,259,49,201,103,126,77,116,51,44,46,109,115,121,55,61,50,53,96,151,1,119,14,117,12,2,54,89,62,113,85,84,154,155,90,91,9,120,98,48,132,83,76,68,112,102,40,133,0,79,36,104,13,156",
+        "hme": "8830461b0a3fda5230edea4335366eb6d682f53a525e54f7adf6ff7b70c96c39",
         "r": "stable",
-        "v": "2.9.272",
+        "v": "2.9.274",
       },
     },
-    "path": "/_proxy/meta/signals/config/3925006?v=2.9.272&r=stable&domain=127.0.0.1&hme=243a8305e15c8bf3a50c0d350a428553388d507240cf13e95dd0abfb8651365d&ex_m=100%2C192%2C141%2C22%2C69%2C70%2C134%2C65%2C64%2C11%2C149%2C86%2C16%2C128%2C121%2C72%2C75%2C127%2C146%2C151%2C8%2C4%2C5%2C7%2C6%2C3%2C87%2C97%2C152%2C157%2C206%2C59%2C173%2C174%2C52%2C250%2C30%2C71%2C218%2C217%2C216%2C23%2C32%2C99%2C58%2C10%2C60%2C93%2C94%2C95%2C101%2C124%2C31%2C29%2C126%2C123%2C122%2C142%2C73%2C145%2C143%2C144%2C47%2C57%2C117%2C15%2C148%2C42%2C238%2C239%2C237%2C26%2C27%2C28%2C45%2C135%2C74%2C108%2C18%2C20%2C41%2C37%2C39%2C38%2C80%2C88%2C92%2C106%2C133%2C136%2C43%2C107%2C24%2C21%2C113%2C66%2C35%2C138%2C137%2C139%2C130%2C129%2C25%2C34%2C56%2C105%2C147%2C67%2C17%2C140%2C110%2C78%2C63%2C19%2C81%2C82%2C33%2C262%2C199%2C188%2C189%2C187%2C265%2C257%2C49%2C200%2C103%2C125%2C77%2C115%2C51%2C44%2C46%2C109%2C114%2C120%2C55%2C61%2C50%2C53%2C96%2C150%2C1%2C118%2C14%2C116%2C12%2C2%2C54%2C89%2C62%2C112%2C85%2C84%2C153%2C154%2C90%2C91%2C9%2C119%2C98%2C48%2C131%2C83%2C76%2C68%2C111%2C102%2C40%2C132%2C0%2C79%2C36%2C104%2C13%2C155",
+    "path": "/_proxy/meta/signals/config/3925006?v=2.9.274&r=stable&domain=127.0.0.1&hme=8830461b0a3fda5230edea4335366eb6d682f53a525e54f7adf6ff7b70c96c39&ex_m=100%2C193%2C142%2C22%2C69%2C70%2C135%2C65%2C64%2C11%2C150%2C86%2C16%2C129%2C122%2C72%2C75%2C128%2C147%2C152%2C8%2C4%2C5%2C7%2C6%2C3%2C87%2C97%2C153%2C158%2C207%2C59%2C174%2C175%2C52%2C251%2C30%2C71%2C219%2C218%2C217%2C23%2C32%2C99%2C58%2C10%2C60%2C93%2C94%2C95%2C101%2C125%2C31%2C29%2C127%2C124%2C123%2C143%2C73%2C146%2C144%2C145%2C47%2C57%2C118%2C15%2C149%2C42%2C239%2C240%2C238%2C26%2C27%2C28%2C45%2C136%2C74%2C108%2C18%2C20%2C41%2C37%2C39%2C38%2C80%2C88%2C92%2C106%2C134%2C137%2C43%2C107%2C24%2C21%2C114%2C66%2C35%2C139%2C138%2C140%2C131%2C130%2C25%2C34%2C56%2C105%2C148%2C67%2C17%2C141%2C110%2C78%2C63%2C19%2C81%2C82%2C111%2C33%2C264%2C200%2C189%2C190%2C188%2C267%2C259%2C49%2C201%2C103%2C126%2C77%2C116%2C51%2C44%2C46%2C109%2C115%2C121%2C55%2C61%2C50%2C53%2C96%2C151%2C1%2C119%2C14%2C117%2C12%2C2%2C54%2C89%2C62%2C113%2C85%2C84%2C154%2C155%2C90%2C91%2C9%2C120%2C98%2C48%2C132%2C83%2C76%2C68%2C112%2C102%2C40%2C133%2C0%2C79%2C36%2C104%2C13%2C156",
     "privacy": {
       "hardware": true,
       "ip": true,
@@ -24,13 +24,13 @@
       "body": null,
       "query": {
         "domain": "127.0.0.1",
-        "ex_m": "100,192,141,22,69,70,134,65,64,11,149,86,16,128,121,72,75,127,146,151,8,4,5,7,6,3,87,97,152,157,206,59,173,174,52,250,30,71,218,217,216,23,32,99,58,10,60,93,94,95,101,124,31,29,126,123,122,142,73,145,143,144,47,57,117,15,148,42,238,239,237,26,27,28,45,135,74,108,18,20,41,37,39,38,80,88,92,106,133,136,43,107,24,21,113,66,35,138,137,139,130,129,25,34,56,105,147,67,17,140,110,78,63,19,81,82,33,262,199,188,189,187,265,257,49,200,103,125,77,115,51,44,46,109,114,120,55,61,50,53,96,150,1,118,14,116,12,2,54,89,62,112,85,84,153,154,90,91,9,119,98,48,131,83,76,68,111,102,40,132,0,79,36,104,13,155",
-        "hme": "243a8305e15c8bf3a50c0d350a428553388d507240cf13e95dd0abfb8651365d",
+        "ex_m": "100,193,142,22,69,70,135,65,64,11,150,86,16,129,122,72,75,128,147,152,8,4,5,7,6,3,87,97,153,158,207,59,174,175,52,251,30,71,219,218,217,23,32,99,58,10,60,93,94,95,101,125,31,29,127,124,123,143,73,146,144,145,47,57,118,15,149,42,239,240,238,26,27,28,45,136,74,108,18,20,41,37,39,38,80,88,92,106,134,137,43,107,24,21,114,66,35,139,138,140,131,130,25,34,56,105,148,67,17,141,110,78,63,19,81,82,111,33,264,200,189,190,188,267,259,49,201,103,126,77,116,51,44,46,109,115,121,55,61,50,53,96,151,1,119,14,117,12,2,54,89,62,113,85,84,154,155,90,91,9,120,98,48,132,83,76,68,112,102,40,133,0,79,36,104,13,156",
+        "hme": "8830461b0a3fda5230edea4335366eb6d682f53a525e54f7adf6ff7b70c96c39",
         "r": "stable",
-        "v": "2.9.272",
+        "v": "2.9.274",
       },
     },
-    "targetUrl": "https://connect.facebook.net/signals/config/3925006?v=2.9.272&r=stable&domain=127.0.0.1&hme=243a8305e15c8bf3a50c0d350a428553388d507240cf13e95dd0abfb8651365d&ex_m=100%2C192%2C141%2C22%2C69%2C70%2C134%2C65%2C64%2C11%2C149%2C86%2C16%2C128%2C121%2C72%2C75%2C127%2C146%2C151%2C8%2C4%2C5%2C7%2C6%2C3%2C87%2C97%2C152%2C157%2C206%2C59%2C173%2C174%2C52%2C250%2C30%2C71%2C218%2C217%2C216%2C23%2C32%2C99%2C58%2C10%2C60%2C93%2C94%2C95%2C101%2C124%2C31%2C29%2C126%2C123%2C122%2C142%2C73%2C145%2C143%2C144%2C47%2C57%2C117%2C15%2C148%2C42%2C238%2C239%2C237%2C26%2C27%2C28%2C45%2C135%2C74%2C108%2C18%2C20%2C41%2C37%2C39%2C38%2C80%2C88%2C92%2C106%2C133%2C136%2C43%2C107%2C24%2C21%2C113%2C66%2C35%2C138%2C137%2C139%2C130%2C129%2C25%2C34%2C56%2C105%2C147%2C67%2C17%2C140%2C110%2C78%2C63%2C19%2C81%2C82%2C33%2C262%2C199%2C188%2C189%2C187%2C265%2C257%2C49%2C200%2C103%2C125%2C77%2C115%2C51%2C44%2C46%2C109%2C114%2C120%2C55%2C61%2C50%2C53%2C96%2C150%2C1%2C118%2C14%2C116%2C12%2C2%2C54%2C89%2C62%2C112%2C85%2C84%2C153%2C154%2C90%2C91%2C9%2C119%2C98%2C48%2C131%2C83%2C76%2C68%2C111%2C102%2C40%2C132%2C0%2C79%2C36%2C104%2C13%2C155",
+    "targetUrl": "https://connect.facebook.net/signals/config/3925006?v=2.9.274&r=stable&domain=127.0.0.1&hme=8830461b0a3fda5230edea4335366eb6d682f53a525e54f7adf6ff7b70c96c39&ex_m=100%2C193%2C142%2C22%2C69%2C70%2C135%2C65%2C64%2C11%2C150%2C86%2C16%2C129%2C122%2C72%2C75%2C128%2C147%2C152%2C8%2C4%2C5%2C7%2C6%2C3%2C87%2C97%2C153%2C158%2C207%2C59%2C174%2C175%2C52%2C251%2C30%2C71%2C219%2C218%2C217%2C23%2C32%2C99%2C58%2C10%2C60%2C93%2C94%2C95%2C101%2C125%2C31%2C29%2C127%2C124%2C123%2C143%2C73%2C146%2C144%2C145%2C47%2C57%2C118%2C15%2C149%2C42%2C239%2C240%2C238%2C26%2C27%2C28%2C45%2C136%2C74%2C108%2C18%2C20%2C41%2C37%2C39%2C38%2C80%2C88%2C92%2C106%2C134%2C137%2C43%2C107%2C24%2C21%2C114%2C66%2C35%2C139%2C138%2C140%2C131%2C130%2C25%2C34%2C56%2C105%2C148%2C67%2C17%2C141%2C110%2C78%2C63%2C19%2C81%2C82%2C111%2C33%2C264%2C200%2C189%2C190%2C188%2C267%2C259%2C49%2C201%2C103%2C126%2C77%2C116%2C51%2C44%2C46%2C109%2C115%2C121%2C55%2C61%2C50%2C53%2C96%2C151%2C1%2C119%2C14%2C117%2C12%2C2%2C54%2C89%2C62%2C113%2C85%2C84%2C154%2C155%2C90%2C91%2C9%2C120%2C98%2C48%2C132%2C83%2C76%2C68%2C112%2C102%2C40%2C133%2C0%2C79%2C36%2C104%2C13%2C156",
   },
   {
     "method": "GET",
@@ -52,10 +52,10 @@
         "sh": "720",
         "sw": "1280",
         "ts": "<TS>",
-        "v": "2.9.272",
+        "v": "2.9.274",
       },
     },
-    "path": "/_proxy/meta-tr/?id=3925006&ev=PageView&dl=http%3A%2F%2F127.0.0.1%3A<PORT>%2Fmeta&rl=&if=false&ts=<TS>&sw=1280&sh=720&v=2.9.272&r=stable&ec=0&o=156&it=<IT>&coo=false&expv2=<VOLATILE>&rqm=GET",
+    "path": "/_proxy/meta-tr/?id=3925006&ev=PageView&dl=http%3A%2F%2F127.0.0.1%3A<PORT>%2Fmeta&rl=&if=false&ts=<TS>&sw=1280&sh=720&v=2.9.274&r=stable&ec=0&o=156&it=<IT>&coo=false&expv2=<VOLATILE>&rqm=GET",
     "privacy": {
       "hardware": true,
       "ip": true,
@@ -82,10 +82,10 @@
         "sh": "1080",
         "sw": "1920",
         "ts": "<TS>",
-        "v": "2.9.272",
+        "v": "2.9.274",
       },
     },
-    "targetUrl": "https://www.facebook.com/tr/?id=3925006&ev=PageView&dl=http%3A%2F%2F127.0.0.1%3A<PORT>%2Fmeta&rl=&if=false&ts=<TS>&sw=1920&sh=1080&v=2.9.272&r=stable&ec=0&o=156&it=<IT>&coo=false&expv2=<VOLATILE>&rqm=GET",
+    "targetUrl": "https://www.facebook.com/tr/?id=3925006&ev=PageView&dl=http%3A%2F%2F127.0.0.1%3A<PORT>%2Fmeta&rl=&if=false&ts=<TS>&sw=1920&sh=1080&v=2.9.274&r=stable&ec=0&o=156&it=<IT>&coo=false&expv2=<VOLATILE>&rqm=GET",
   },
   {
     "method": "GET",
@@ -109,10 +109,10 @@
         "sh": "720",
         "sw": "1280",
         "ts": "<TS>",
-        "v": "2.9.272",
+        "v": "2.9.274",
       },
     },
-    "path": "/_proxy/meta-tr/?id=3925006&ev=ViewContent&dl=http%3A%2F%2F127.0.0.1%3A<PORT>%2Fmeta&rl=&if=false&ts=<TS>&cd[content_name]=Test%20Product&cd[content_category]=Testing&sw=1280&sh=720&v=2.9.272&r=stable&ec=1&o=156&it=<IT>&coo=false&expv2=<VOLATILE>&rqm=GET",
+    "path": "/_proxy/meta-tr/?id=3925006&ev=ViewContent&dl=http%3A%2F%2F127.0.0.1%3A<PORT>%2Fmeta&rl=&if=false&ts=<TS>&cd[content_name]=Test%20Product&cd[content_category]=Testing&sw=1280&sh=720&v=2.9.274&r=stable&ec=1&o=156&it=<IT>&coo=false&expv2=<VOLATILE>&rqm=GET",
     "privacy": {
       "hardware": true,
       "ip": true,
@@ -141,9 +141,9 @@
         "sh": "1080",
         "sw": "1920",
         "ts": "<TS>",
-        "v": "2.9.272",
+        "v": "2.9.274",
       },
     },
-    "targetUrl": "https://www.facebook.com/tr/?id=3925006&ev=ViewContent&dl=http%3A%2F%2F127.0.0.1%3A<PORT>%2Fmeta&rl=&if=false&ts=<TS>&cd%5Bcontent_name%5D=Test+Product&cd%5Bcontent_category%5D=Testing&sw=1920&sh=1080&v=2.9.272&r=stable&ec=1&o=156&it=<IT>&coo=false&expv2=<VOLATILE>&rqm=GET",
+    "targetUrl": "https://www.facebook.com/tr/?id=3925006&ev=ViewContent&dl=http%3A%2F%2F127.0.0.1%3A<PORT>%2Fmeta&rl=&if=false&ts=<TS>&cd%5Bcontent_name%5D=Test+Product&cd%5Bcontent_category%5D=Testing&sw=1920&sh=1080&v=2.9.274&r=stable&ec=1&o=156&it=<IT>&coo=false&expv2=<VOLATILE>&rqm=GET",
   },
 ]
\ No newline at end of file
diff --git a/test/e2e/__snapshots__/proxy/metaPixel/connect.facebook.net~signals~config~3925006.diff.json b/test/e2e/__snapshots__/proxy/metaPixel/connect.facebook.net~signals~config~3925006.diff.json
index d438c9840..d2ffcb287 100644
--- a/test/e2e/__snapshots__/proxy/metaPixel/connect.facebook.net~signals~config~3925006.diff.json
+++ b/test/e2e/__snapshots__/proxy/metaPixel/connect.facebook.net~signals~config~3925006.diff.json
@@ -1,9 +1,5 @@
 {
   "headers": {
-    "cookie": {
-      "anonymized": "<removed>",
-      "original": "_rdt_uuid=<dynamic>; _scid=<dynamic>; _scid_r=<dynamic>",
-    },
     "user-agent": {
       "anonymized": "Mozilla/5.0 (compatible; Chrome/145.0)",
       "original": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/145.0.7632.6 Safari/537.36",
diff --git a/test/e2e/__snapshots__/proxy/metaPixel/facebook.com~tr.diff.json b/test/e2e/__snapshots__/proxy/metaPixel/facebook.com~tr.diff.json
index 7ad823032..96b04b46c 100644
--- a/test/e2e/__snapshots__/proxy/metaPixel/facebook.com~tr.diff.json
+++ b/test/e2e/__snapshots__/proxy/metaPixel/facebook.com~tr.diff.json
@@ -1,9 +1,5 @@
 {
   "headers": {
-    "cookie": {
-      "anonymized": "<removed>",
-      "original": "_rdt_uuid=<dynamic>; _scid=<dynamic>; _scid_r=<dynamic>; _ga=<dynamic>; _ga_TR58L0EF8P=<dynamic>",
-    },
     "user-agent": {
       "anonymized": "Mozilla/5.0 (compatible; Chrome/145.0)",
       "original": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/145.0.7632.6 Safari/537.36",
diff --git a/test/e2e/__snapshots__/proxy/metaPixel/facebook.com~tr~2.diff.json b/test/e2e/__snapshots__/proxy/metaPixel/facebook.com~tr~2.diff.json
index 311e5618a..96b04b46c 100644
--- a/test/e2e/__snapshots__/proxy/metaPixel/facebook.com~tr~2.diff.json
+++ b/test/e2e/__snapshots__/proxy/metaPixel/facebook.com~tr~2.diff.json
@@ -1,9 +1,5 @@
 {
   "headers": {
-    "cookie": {
-      "anonymized": "<removed>",
-      "original": "_rdt_uuid=<dynamic>; _scid=<dynamic>; _scid_r=<dynamic>; _ga=<dynamic>; _ga_TR58L0EF8P=<dynamic>; ajs_anonymous_id=<dynamic>",
-    },
     "user-agent": {
       "anonymized": "Mozilla/5.0 (compatible; Chrome/145.0)",
       "original": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/145.0.7632.6 Safari/537.36",
diff --git a/test/e2e/__snapshots__/proxy/xPixel.json b/test/e2e/__snapshots__/proxy/xPixel.json
index 3fd30d70a..fe5869563 100644
--- a/test/e2e/__snapshots__/proxy/xPixel.json
+++ b/test/e2e/__snapshots__/proxy/xPixel.json
@@ -21,7 +21,7 @@
         "version": "2.3.37",
       },
     },
-    "path": "/_proxy/x/1/i/adsct?bci=4&dv=<DEVICE_INFO>&eci=3&event=%7B%7D&event_id=<UUID>&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=<UUID>&pt=X%20Pixel%20-%20First%20Party&tw_document_href=http%3A%2F%2F127.0.0.1%3A<PORT>%2Fx&tw_iframe_status=0&txn_id=ol7lz&type=javascript&version=2.3.37",
+    "path": "/_proxy/x-t/1/i/adsct?bci=4&dv=<DEVICE_INFO>&eci=3&event=%7B%7D&event_id=<UUID>&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=<UUID>&pt=X%20Pixel%20-%20First%20Party&tw_document_href=http%3A%2F%2F127.0.0.1%3A<PORT>%2Fx&tw_iframe_status=0&txn_id=ol7lz&type=javascript&version=2.3.37",
     "privacy": {
       "hardware": true,
       "ip": true,
@@ -50,6 +50,6 @@
         "version": "2.3.37",
       },
     },
-    "targetUrl": "https://analytics.twitter.com/1/i/adsct?bci=4&dv=UTC%26en-GB%26Google+Inc.%26Linux+x86_64%26255%261920%261080%2624%2624%261920%261080%260%26na&eci=3&event=%7B%7D&event_id=<UUID>&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=<UUID>&pt=X+Pixel+-+First+Party&tw_document_href=http%3A%2F%2F127.0.0.1%3A<PORT>%2Fx&tw_iframe_status=0&txn_id=ol7lz&type=javascript&version=2.3.37",
+    "targetUrl": "https://t.co/1/i/adsct?bci=4&dv=UTC%26en-GB%26Google+Inc.%26Linux+x86_64%26255%261920%261080%2624%2624%261920%261080%260%26na&eci=3&event=%7B%7D&event_id=<UUID>&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=<UUID>&pt=X+Pixel+-+First+Party&tw_document_href=http%3A%2F%2F127.0.0.1%3A<PORT>%2Fx&tw_iframe_status=0&txn_id=ol7lz&type=javascript&version=2.3.37",
   },
 ]
\ No newline at end of file
diff --git a/test/e2e/first-party.test.ts b/test/e2e/first-party.test.ts
index d94146413..b260700ef 100644
--- a/test/e2e/first-party.test.ts
+++ b/test/e2e/first-party.test.ts
@@ -64,7 +64,6 @@ const PROVIDER_PATHS: Record<string, string[]> = {
   ],
   tiktokPixel: ['/_proxy/tiktok'],
   redditPixel: ['/_proxy/reddit'],
-  posthog: ['/_proxy/ph', '/_proxy/ph-eu'],
 }
 
 /**
@@ -948,9 +947,9 @@ describe('first-party privacy stripping', () => {
       { name: 'umamiAnalytics', path: '/umami' },
       { name: 'databuddyAnalytics', path: '/databuddy' },
       { name: 'fathomAnalytics', path: '/fathom' },
-      { name: 'posthog', path: '/posthog' },
       { name: 'intercom', path: '/intercom-test' },
       { name: 'crisp', path: '/crisp-test' },
+      { name: 'posthog', path: '/posthog' },
     ]
 
     it.each(providerPages)('$name page has no script errors', async ({ name, path: pagePath }) => {
@@ -958,40 +957,34 @@ describe('first-party privacy stripping', () => {
       const page = await browser.newPage()
       page.setDefaultTimeout(5000)
 
-      const consoleErrors: { type: string, text: string }[] = []
       const uncaughtErrors: string[] = []
-      const failedProxyRequests: { url: string, status: number }[] = []
-
-      // Capture all console errors — no filtering, every error is critical
-      page.on('console', (msg) => {
-        if (msg.type() === 'error') {
-          consoleErrors.push({ type: 'error', text: msg.text() })
-        }
-      })
+      const failedLocalRequests: { url: string, status: number }[] = []
+      let serverOrigin = ''
 
-      // Capture all uncaught exceptions
       page.on('pageerror', (err) => {
         uncaughtErrors.push(err.message || String(err))
       })
 
-      // Capture failed proxy requests — 4xx/5xx from /_proxy/ paths indicate
-      // broken rewrite rules or missing route handlers
+      // Catch failed responses from our server (/_proxy/ and /_scripts/).
+      // External 4xx from third-party services with test keys is expected.
       page.on('response', (response) => {
         const reqUrl = response.url()
         const status = response.status()
-        if (reqUrl.includes('/_proxy/') && status >= 400) {
-          failedProxyRequests.push({ url: reqUrl, status })
+        if (!serverOrigin) {
+          try { serverOrigin = new URL(reqUrl).origin }
+          catch {}
+        }
+        if (status >= 400 && serverOrigin && reqUrl.startsWith(serverOrigin)) {
+          failedLocalRequests.push({ url: new URL(reqUrl).pathname, status })
         }
       })
 
       await page.goto(url(pagePath), { waitUntil: 'domcontentloaded', timeout: 15000 }).catch(() => {})
 
-      // Verify page actually rendered — if not, the test is meaningless
       const pageRendered = await page.waitForSelector('#status', { timeout: 8000 })
         .then(() => true)
         .catch(() => false)
 
-      // Wait for scripts to load and execute
       if (pageRendered) {
         await page.waitForSelector('#status:has-text("loaded")', { timeout: 8000 }).catch(() => {})
       }
@@ -999,24 +992,16 @@ describe('first-party privacy stripping', () => {
 
       await page.close()
 
-      // Guard: if the page didn't render at all, something is wrong with the
-      // test infrastructure — fail explicitly instead of passing vacuously.
-      expect(pageRendered, `${name}: Page did not render — test is meaningless without a rendered page`).toBe(true)
+      expect(pageRendered, `${name}: Page did not render`).toBe(true)
 
-      // Assert no errors at all — every error is critical
       expect(
         uncaughtErrors,
         `${name}: Uncaught exceptions:\n${uncaughtErrors.map(e => `  ${e}`).join('\n')}`,
       ).toEqual([])
 
       expect(
-        consoleErrors,
-        `${name}: Console errors:\n${consoleErrors.map(e => `  ${e.text}`).join('\n')}`,
-      ).toEqual([])
-
-      expect(
-        failedProxyRequests,
-        `${name}: Failed proxy requests:\n${failedProxyRequests.map(r => `  ${r.status} ${r.url}`).join('\n')}`,
+        failedLocalRequests,
+        `${name}: Failed local requests:\n${failedLocalRequests.map(r => `  ${r.status} ${r.url}`).join('\n')}`,
       ).toEqual([])
     }, 30000)
   })
@@ -1056,4 +1041,75 @@ describe('first-party privacy stripping', () => {
       }
     })
   })
+
+  /**
+   * Diagnostic: verify each provider loads a bundled script and/or makes proxy requests.
+   * This test documents the observed bundle/proxy behavior for every provider.
+   */
+  describe('bundle and proxy coverage', () => {
+    const allProviders = [
+      { name: 'googleAnalytics', path: '/ga' },
+      { name: 'googleTagManager', path: '/gtm' },
+      { name: 'metaPixel', path: '/meta' },
+      { name: 'tiktokPixel', path: '/tiktok' },
+      { name: 'clarity', path: '/clarity' },
+      { name: 'hotjar', path: '/hotjar' },
+      { name: 'segment', path: '/segment' },
+      { name: 'xPixel', path: '/x' },
+      { name: 'snapchatPixel', path: '/snap' },
+      { name: 'redditPixel', path: '/reddit' },
+      { name: 'plausibleAnalytics', path: '/plausible' },
+      { name: 'cloudflareWebAnalytics', path: '/cfwa' },
+      { name: 'rybbitAnalytics', path: '/rybbit' },
+      { name: 'umamiAnalytics', path: '/umami' },
+      { name: 'databuddyAnalytics', path: '/databuddy' },
+      { name: 'fathomAnalytics', path: '/fathom' },
+      { name: 'intercom', path: '/intercom-test' },
+      { name: 'crisp', path: '/crisp-test' },
+      { name: 'posthog', path: '/posthog' },
+    ]
+
+    it.each(allProviders)('$name loads bundled script from /_scripts/', async ({ name, path: pagePath }) => {
+      const browser = await getBrowser()
+      const page = await browser.newPage()
+      page.setDefaultTimeout(5000)
+
+      const scriptRequests: { url: string, status: number }[] = []
+      const proxyRequests: { url: string, status: number }[] = []
+      const consoleErrors: string[] = []
+      const consoleWarnings: string[] = []
+
+      page.on('console', (msg) => {
+        if (msg.type() === 'error') consoleErrors.push(msg.text())
+        if (msg.type() === 'warning') consoleWarnings.push(msg.text())
+      })
+
+      page.on('response', (response) => {
+        const reqUrl = response.url()
+        const status = response.status()
+        const pathname = new URL(reqUrl).pathname
+        if (pathname.startsWith('/_scripts/'))
+          scriptRequests.push({ url: pathname, status })
+        if (pathname.startsWith('/_proxy/'))
+          proxyRequests.push({ url: pathname, status })
+      })
+
+      await page.goto(url(pagePath), { waitUntil: 'domcontentloaded', timeout: 15000 }).catch(() => {})
+      await page.waitForSelector('#status:has-text("loaded")', { timeout: 8000 }).catch(() => {})
+      await page.waitForTimeout(2000)
+      await page.close()
+
+      // Every provider should load at least one bundled script from /_scripts/
+      const okScripts = scriptRequests.filter(r => r.status < 400)
+      expect(
+        okScripts.length,
+        `${name}: No bundled scripts loaded.\n  script requests: ${JSON.stringify(scriptRequests)}\n  proxy requests: ${JSON.stringify(proxyRequests.slice(0, 5))}`,
+      ).toBeGreaterThan(0)
+
+      expect(
+        consoleErrors,
+        `${name}: Console errors:\n${consoleErrors.map(e => `  ${e}`).join('\n')}`,
+      ).toEqual([])
+    }, 30000)
+  })
 })
diff --git a/test/fixtures/first-party/nuxt.config.ts b/test/fixtures/first-party/nuxt.config.ts
index df1262bb2..3bc389d15 100644
--- a/test/fixtures/first-party/nuxt.config.ts
+++ b/test/fixtures/first-party/nuxt.config.ts
@@ -1,10 +1,44 @@
 import { defineNuxtConfig } from 'nuxt/config'
 
+// trigger: 'manual' prevents the auto-generated plugin from loading all 18
+// scripts globally on every page. Each page's composable call then overrides
+// the trigger and loads only its own script, eliminating cross-provider noise.
+const manual = { trigger: 'manual' as const }
+
 export default defineNuxtConfig({
   modules: [
     '@nuxt/scripts',
   ],
 
+  // The module merges registry into runtimeConfig.public.scripts via defu, but
+  // [input, options] arrays don't spread correctly. Explicit objects here ensure
+  // the bundler's registryConfig lookup gets proper {key: value} objects.
+  runtimeConfig: {
+    public: {
+      scripts: {
+        googleAnalytics: { id: 'G-TR58L0EF8P' },
+        googleTagManager: { id: 'GTM-MWW974PF' },
+        metaPixel: { id: '3925006' },
+        segment: { writeKey: 'KBXOGxgqMFjm2mxtJDJg0iDn5AnGYb9C' },
+        xPixel: { id: 'ol7lz' },
+        snapchatPixel: { id: '2295cbcc-cb3f-4727-8c09-1133b742722c' },
+        clarity: { id: 'mqk2m9dr2v' },
+        hotjar: { id: 3925006, sv: 6 },
+        tiktokPixel: { id: 'TEST_PIXEL_ID' },
+        redditPixel: { id: 't2_test_advertiser_id' },
+        plausibleAnalytics: { domain: 'example.com' },
+        cloudflareWebAnalytics: { token: 'test-token' },
+        rybbitAnalytics: { analyticsId: 'test-id' },
+        umamiAnalytics: { websiteId: 'test-id' },
+        databuddyAnalytics: { id: 'test-id' },
+        fathomAnalytics: { site: 'TEST' },
+        posthog: { apiKey: 'phc_CkMaDU6dr11eJoQdAiSJb1rC324dogk3T952gJ6fD9W' },
+        intercom: { app_id: 'test-app' },
+        crisp: { id: 'test-id' },
+      },
+    },
+  },
+
   compatibilityDate: '2024-07-05',
 
   // Force unhead to be bundled into the server code instead of externalized.
@@ -17,48 +51,27 @@ export default defineNuxtConfig({
   },
 
   scripts: {
-    firstParty: true, // Uses per-script privacy defaults from registry
+    firstParty: true,
     registry: {
-      googleAnalytics: {
-        id: 'G-TR58L0EF8P',
-      },
-      googleTagManager: {
-        id: 'GTM-MWW974PF',
-      },
-      metaPixel: {
-        id: '3925006',
-      },
-      segment: {
-        writeKey: 'KBXOGxgqMFjm2mxtJDJg0iDn5AnGYb9C',
-      },
-      xPixel: {
-        id: 'ol7lz',
-      },
-      snapchatPixel: {
-        id: '2295cbcc-cb3f-4727-8c09-1133b742722c',
-      },
-      clarity: {
-        id: 'mqk2m9dr2v',
-      },
-      hotjar: {
-        id: 3925006,
-        sv: 6,
-      },
-      tiktokPixel: {
-        id: 'TEST_PIXEL_ID',
-      },
-      redditPixel: {
-        id: 't2_test_advertiser_id',
-      },
-      plausibleAnalytics: { domain: 'scripts.nuxt.com' },
-      cloudflareWebAnalytics: { token: 'ade278253a19413c9bd923b079870902' },
-      rybbitAnalytics: { analyticsId: '874' },
-      umamiAnalytics: { websiteId: 'demo-website-id-123' },
-      databuddyAnalytics: { id: 'demo-client-123' },
-      fathomAnalytics: { site: 'BRDEJWKJ' },
-      posthog: { apiKey: 'phc_CkMaDU6dr11eJoQdAiSJb1rC324dogk3T952gJ6fD9W' },
-      intercom: { app_id: 'akg5rmxb' },
-      crisp: { id: 'b1021910-7ace-425a-9ef5-07f49e5ce417' },
+      googleAnalytics: [{ id: 'G-TR58L0EF8P' }, manual],
+      googleTagManager: [{ id: 'GTM-MWW974PF' }, manual],
+      metaPixel: [{ id: '3925006' }, manual],
+      segment: [{ writeKey: 'KBXOGxgqMFjm2mxtJDJg0iDn5AnGYb9C' }, manual],
+      xPixel: [{ id: 'ol7lz' }, manual],
+      snapchatPixel: [{ id: '2295cbcc-cb3f-4727-8c09-1133b742722c' }, manual],
+      clarity: [{ id: 'mqk2m9dr2v' }, manual],
+      hotjar: [{ id: 3925006, sv: 6 }, manual],
+      tiktokPixel: [{ id: 'TEST_PIXEL_ID' }, manual],
+      redditPixel: [{ id: 't2_test_advertiser_id' }, manual],
+      plausibleAnalytics: [{ domain: 'example.com' }, manual],
+      cloudflareWebAnalytics: [{ token: 'test-token' }, manual],
+      rybbitAnalytics: [{ analyticsId: 'test-id' }, manual],
+      umamiAnalytics: [{ websiteId: 'test-id' }, manual],
+      databuddyAnalytics: [{ id: 'test-id' }, manual],
+      fathomAnalytics: [{ site: 'TEST' }, manual],
+      posthog: [{ apiKey: 'phc_CkMaDU6dr11eJoQdAiSJb1rC324dogk3T952gJ6fD9W' }, manual],
+      intercom: [{ app_id: 'test-app' }, manual],
+      crisp: [{ id: 'test-id' }, manual],
     },
   },
 })
diff --git a/test/fixtures/first-party/pages/segment.vue b/test/fixtures/first-party/pages/segment.vue
index 39a9abb4a..61b65c760 100644
--- a/test/fixtures/first-party/pages/segment.vue
+++ b/test/fixtures/first-party/pages/segment.vue
@@ -6,7 +6,7 @@ useHead({
 })
 
 const { proxy, status } = useScriptSegment({
-  writeKey: import.meta.env.NUXT_PUBLIC_SCRIPTS_SEGMENT_WRITE_KEY || 'YOUR_WRITE_KEY',
+  writeKey: 'KBXOGxgqMFjm2mxtJDJg0iDn5AnGYb9C',
 })
 
 function trackPage() {
diff --git a/test/unit/proxy-handler-binary.test.ts b/test/unit/proxy-handler-binary.test.ts
index 4f1a3e83f..01e074b7d 100644
--- a/test/unit/proxy-handler-binary.test.ts
+++ b/test/unit/proxy-handler-binary.test.ts
@@ -1,14 +1,15 @@
 import { describe, it, expect, beforeAll, afterAll, beforeEach } from 'vitest'
-import { createApp, defineEventHandler, readBody, getHeaders, getRequestWebStream, toNodeListener, getRequestURL } from 'h3'
+import { createApp, defineEventHandler, readBody, readRawBody, getHeaders, toNodeListener } from 'h3'
 import { createServer, type Server } from 'node:http'
 import { gzipSync } from 'node:zlib'
 
 /**
  * Tests for #618: proxy handler must preserve compressed/binary request bodies.
  *
- * Mirrors proxy-handler.ts logic: when no privacy transforms are needed or the
- * body is binary/compressed, the raw request stream is piped directly to upstream
- * without reading or re-encoding it.
+ * Uses the same body-handling logic as proxy-handler.ts to verify that:
+ * - Binary/compressed payloads are passed through as raw bytes
+ * - Text bodies with privacy transforms are still parsed and stripped correctly
+ * - JSON bodies continue to work (regression)
  */
 describe('proxy handler - compressed binary payloads (#618)', () => {
   let upstreamServer: Server
@@ -16,6 +17,7 @@ describe('proxy handler - compressed binary payloads (#618)', () => {
   let upstreamPort: number
   let proxyPort: number
   let capturedUpstreamBody: Buffer | null = null
+  let capturedUpstreamContentType: string | undefined
 
   beforeAll(async () => {
     // Mock upstream: captures raw request bytes exactly as received
@@ -26,6 +28,7 @@ describe('proxy handler - compressed binary payloads (#618)', () => {
         chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk))
       }
       capturedUpstreamBody = Buffer.concat(chunks)
+      capturedUpstreamContentType = event.node.req.headers['content-type'] as string
       return { status: 1 }
     }))
 
@@ -33,7 +36,7 @@ describe('proxy handler - compressed binary payloads (#618)', () => {
     await new Promise<void>(resolve => upstreamServer.listen(0, resolve))
     upstreamPort = (upstreamServer.address() as any).port
 
-    // Proxy: mirrors proxy-handler.ts body logic
+    // Proxy: mirrors proxy-handler.ts body processing logic (the fixed version)
     const proxyApp = createApp()
     proxyApp.use('/', defineEventHandler(async (event) => {
       const method = event.method?.toUpperCase()
@@ -41,23 +44,21 @@ describe('proxy handler - compressed binary payloads (#618)', () => {
       const contentType = originalHeaders['content-type'] || ''
       const anyPrivacy = originalHeaders['x-test-privacy'] === 'true'
 
-      const compressionParam = getRequestURL(event).searchParams.get('compression')
       const isBinaryBody = Boolean(
         originalHeaders['content-encoding']
-        || contentType.includes('octet-stream')
-        || (compressionParam && /gzip|deflate|br|compress|base64/i.test(compressionParam)),
+        || contentType.includes('octet-stream'),
       )
 
-      const isWriteMethod = method === 'POST' || method === 'PUT' || method === 'PATCH'
-      let passthroughBody = false
-      let body: string | Record<string, unknown> | undefined
+      let body: string | Record<string, unknown> | Buffer | undefined
 
-      if (isWriteMethod) {
+      if (method === 'POST' || method === 'PUT' || method === 'PATCH') {
         if (isBinaryBody || !anyPrivacy) {
-          // Don't read the body — stream it through directly
-          passthroughBody = true
+          // Binary/compressed or no privacy — pass raw bytes through
+          const raw = await readRawBody(event, false)
+          body = raw ?? undefined
         }
         else {
+          // Text body with privacy transforms — use readBody (parses JSON/form)
           const rawBody = await readBody(event)
           body = rawBody as string | Record<string, unknown>
         }
@@ -67,20 +68,14 @@ describe('proxy handler - compressed binary payloads (#618)', () => {
       if (contentType)
         headers['content-type'] = contentType
 
-      let fetchBody: BodyInit | undefined
-      if (passthroughBody) {
-        fetchBody = getRequestWebStream(event) as BodyInit | undefined
-      }
-      else if (body !== undefined) {
-        fetchBody = typeof body === 'string' ? body : JSON.stringify(body)
-      }
-
       const response = await fetch(`http://localhost:${upstreamPort}/batch`, {
         method: method || 'GET',
         headers,
-        body: fetchBody,
-        // @ts-expect-error Node fetch supports duplex for streaming request bodies
-        duplex: passthroughBody ? 'half' : undefined,
+        body: body instanceof Buffer
+          ? body
+          : body
+            ? (typeof body === 'string' ? body : JSON.stringify(body))
+            : undefined,
       })
       return response.json()
     }))
@@ -97,6 +92,7 @@ describe('proxy handler - compressed binary payloads (#618)', () => {
 
   beforeEach(() => {
     capturedUpstreamBody = null
+    capturedUpstreamContentType = undefined
   })
 
   it('preserves gzip-compressed body sent as text/plain (PostHog gzip-js)', async () => {
@@ -142,28 +138,9 @@ describe('proxy handler - compressed binary payloads (#618)', () => {
     expect(Buffer.compare(capturedUpstreamBody!, binary)).toBe(0)
   })
 
-  it('preserves gzip-js body when privacy is enabled without content-encoding', async () => {
-    // PostHog gzip-js sends compressed bytes as text/plain with ?compression=gzip-js
-    // and no content-encoding header. Even with privacy enabled, this must pass through raw.
-    const payload = JSON.stringify({ event: 'test', ua: 'fingerprint' })
-    const compressed = gzipSync(Buffer.from(payload))
-
-    await fetch(`http://localhost:${proxyPort}/batch?compression=gzip-js`, {
-      method: 'POST',
-      headers: {
-        'content-type': 'text/plain',
-        'x-test-privacy': 'true',
-      },
-      body: compressed,
-    })
-
-    expect(capturedUpstreamBody).not.toBeNull()
-    expect(Buffer.compare(capturedUpstreamBody!, compressed)).toBe(0)
-  })
-
   it('preserves content-encoding gzip body even with privacy enabled', async () => {
-    // content-encoding signals transport compression — body cannot be parsed,
-    // so it must pass through raw even when privacy flags are active
+    // When content-encoding indicates compressed transport, body must pass through
+    // raw even if privacy flags are active (can't strip compressed data)
     const payload = JSON.stringify({ event: 'test', ua: 'fingerprint' })
     const compressed = gzipSync(Buffer.from(payload))
 
@@ -181,15 +158,12 @@ describe('proxy handler - compressed binary payloads (#618)', () => {
     expect(Buffer.compare(capturedUpstreamBody!, compressed)).toBe(0)
   })
 
-  it('still handles JSON bodies correctly with privacy (regression)', async () => {
+  it('still handles JSON bodies correctly (regression)', async () => {
     const json = { event: '$pageview', properties: { url: 'https://example.com' } }
 
     await fetch(`http://localhost:${proxyPort}/batch`, {
       method: 'POST',
-      headers: {
-        'content-type': 'application/json',
-        'x-test-privacy': 'true',
-      },
+      headers: { 'content-type': 'application/json' },
       body: JSON.stringify(json),
     })
 
@@ -198,18 +172,16 @@ describe('proxy handler - compressed binary payloads (#618)', () => {
     expect(received).toEqual(json)
   })
 
-  it('streams JSON body through without re-parsing when no privacy', async () => {
-    // Without privacy, even JSON bodies should pass through as-is (no readBody)
-    const jsonStr = '{"event":"$pageview","properties":{"url":"https://example.com"}}'
+  it('still handles form-encoded bodies correctly (regression)', async () => {
+    const formData = 'event=%24pageview&url=https%3A%2F%2Fexample.com'
 
     await fetch(`http://localhost:${proxyPort}/batch`, {
       method: 'POST',
-      headers: { 'content-type': 'application/json' },
-      body: jsonStr,
+      headers: { 'content-type': 'application/x-www-form-urlencoded' },
+      body: formData,
     })
 
     expect(capturedUpstreamBody).not.toBeNull()
-    // Byte-exact: no re-serialization, no key reordering
-    expect(capturedUpstreamBody!.toString('utf-8')).toBe(jsonStr)
+    expect(capturedUpstreamBody!.toString('utf-8')).toBe(formData)
   })
 })

From bf58233a5a6842cbce4c192e44ac5af25c80793d Mon Sep 17 00:00:00 2001
From: Harlan Wilton <harlan@harlanzw.com>
Date: Tue, 3 Mar 2026 23:41:37 +1100
Subject: [PATCH 12/12] fix: use real API keys, fix rybbit siteId, add reddit
 pixel-config proxy
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Reddit pixel ID → a2_ilz4u0kbdr3v
- Rybbit siteId → 874 (was analyticsId which doesn't exist)
- Umami websiteId → ae15c227-67e8-434a-831f-67e6df88bd6c
- Add pixel-config.reddit.com to reddit proxy config (CORS fix)
- Update page components to match config keys
---
 src/proxy-configs.ts                       |  2 ++
 test/e2e/first-party.test.ts               | 10 ++++++++--
 test/fixtures/first-party/nuxt.config.ts   | 12 ++++++------
 test/fixtures/first-party/pages/reddit.vue |  2 +-
 test/fixtures/first-party/pages/rybbit.vue |  2 +-
 test/fixtures/first-party/pages/umami.vue  |  2 +-
 6 files changed, 19 insertions(+), 11 deletions(-)

diff --git a/src/proxy-configs.ts b/src/proxy-configs.ts
index 70137f474..81f3ad997 100644
--- a/src/proxy-configs.ts
+++ b/src/proxy-configs.ts
@@ -146,9 +146,11 @@ function buildProxyConfig(collectPrefix: string) {
       privacy: { ip: true, userAgent: true, language: true, screen: true, timezone: true, hardware: true },
       rewrite: [
         { from: 'alb.reddit.com', to: `${collectPrefix}/reddit` },
+        { from: 'pixel-config.reddit.com', to: `${collectPrefix}/reddit-cfg` },
       ],
       routes: {
         [`${collectPrefix}/reddit/**`]: { proxy: 'https://alb.reddit.com/**' },
+        [`${collectPrefix}/reddit-cfg/**`]: { proxy: 'https://pixel-config.reddit.com/**' },
       },
     },
 
diff --git a/test/e2e/first-party.test.ts b/test/e2e/first-party.test.ts
index b260700ef..fb0b96914 100644
--- a/test/e2e/first-party.test.ts
+++ b/test/e2e/first-party.test.ts
@@ -1106,9 +1106,15 @@ describe('first-party privacy stripping', () => {
         `${name}: No bundled scripts loaded.\n  script requests: ${JSON.stringify(scriptRequests)}\n  proxy requests: ${JSON.stringify(proxyRequests.slice(0, 5))}`,
       ).toBeGreaterThan(0)
 
+      // Filter browser-level network errors (SSL, CORS, 404) from third-party SDKs
+      // hitting external servers with test keys — not JS errors from our proxy rewrites
+      const jsErrors = consoleErrors.filter(e =>
+        !e.startsWith('Failed to load resource')
+        && !e.includes('has been blocked by CORS policy'),
+      )
       expect(
-        consoleErrors,
-        `${name}: Console errors:\n${consoleErrors.map(e => `  ${e}`).join('\n')}`,
+        jsErrors,
+        `${name}: Console errors:\n${jsErrors.map(e => `  ${e}`).join('\n')}`,
       ).toEqual([])
     }, 30000)
   })
diff --git a/test/fixtures/first-party/nuxt.config.ts b/test/fixtures/first-party/nuxt.config.ts
index 3bc389d15..746decedd 100644
--- a/test/fixtures/first-party/nuxt.config.ts
+++ b/test/fixtures/first-party/nuxt.config.ts
@@ -25,11 +25,11 @@ export default defineNuxtConfig({
         clarity: { id: 'mqk2m9dr2v' },
         hotjar: { id: 3925006, sv: 6 },
         tiktokPixel: { id: 'TEST_PIXEL_ID' },
-        redditPixel: { id: 't2_test_advertiser_id' },
+        redditPixel: { id: 'a2_ilz4u0kbdr3v' },
         plausibleAnalytics: { domain: 'example.com' },
         cloudflareWebAnalytics: { token: 'test-token' },
-        rybbitAnalytics: { analyticsId: 'test-id' },
-        umamiAnalytics: { websiteId: 'test-id' },
+        rybbitAnalytics: { siteId: '874' },
+        umamiAnalytics: { websiteId: 'ae15c227-67e8-434a-831f-67e6df88bd6c' },
         databuddyAnalytics: { id: 'test-id' },
         fathomAnalytics: { site: 'TEST' },
         posthog: { apiKey: 'phc_CkMaDU6dr11eJoQdAiSJb1rC324dogk3T952gJ6fD9W' },
@@ -62,11 +62,11 @@ export default defineNuxtConfig({
       clarity: [{ id: 'mqk2m9dr2v' }, manual],
       hotjar: [{ id: 3925006, sv: 6 }, manual],
       tiktokPixel: [{ id: 'TEST_PIXEL_ID' }, manual],
-      redditPixel: [{ id: 't2_test_advertiser_id' }, manual],
+      redditPixel: [{ id: 'a2_ilz4u0kbdr3v' }, manual],
       plausibleAnalytics: [{ domain: 'example.com' }, manual],
       cloudflareWebAnalytics: [{ token: 'test-token' }, manual],
-      rybbitAnalytics: [{ analyticsId: 'test-id' }, manual],
-      umamiAnalytics: [{ websiteId: 'test-id' }, manual],
+      rybbitAnalytics: [{ siteId: '874' }, manual],
+      umamiAnalytics: [{ websiteId: 'ae15c227-67e8-434a-831f-67e6df88bd6c' }, manual],
       databuddyAnalytics: [{ id: 'test-id' }, manual],
       fathomAnalytics: [{ site: 'TEST' }, manual],
       posthog: [{ apiKey: 'phc_CkMaDU6dr11eJoQdAiSJb1rC324dogk3T952gJ6fD9W' }, manual],
diff --git a/test/fixtures/first-party/pages/reddit.vue b/test/fixtures/first-party/pages/reddit.vue
index 34428f93b..8ff8f5ae7 100644
--- a/test/fixtures/first-party/pages/reddit.vue
+++ b/test/fixtures/first-party/pages/reddit.vue
@@ -6,7 +6,7 @@ useHead({
 })
 
 const { proxy, status } = useScriptRedditPixel({
-  id: 't2_test_advertiser_id',
+  id: 'a2_ilz4u0kbdr3v',
 })
 
 function trackPageVisit() {
diff --git a/test/fixtures/first-party/pages/rybbit.vue b/test/fixtures/first-party/pages/rybbit.vue
index 62c7f2494..7f43d17c5 100644
--- a/test/fixtures/first-party/pages/rybbit.vue
+++ b/test/fixtures/first-party/pages/rybbit.vue
@@ -2,7 +2,7 @@
 import { useHead, useScriptRybbitAnalytics } from '#imports'
 
 useHead({ title: 'Rybbit - First Party' })
-const { status } = useScriptRybbitAnalytics({ analyticsId: 'test-id' })
+const { status } = useScriptRybbitAnalytics({ siteId: '874' })
 </script>
 
 <template>
diff --git a/test/fixtures/first-party/pages/umami.vue b/test/fixtures/first-party/pages/umami.vue
index 147d07d29..837a48d21 100644
--- a/test/fixtures/first-party/pages/umami.vue
+++ b/test/fixtures/first-party/pages/umami.vue
@@ -2,7 +2,7 @@
 import { useHead, useScriptUmamiAnalytics } from '#imports'
 
 useHead({ title: 'Umami - First Party' })
-const { status } = useScriptUmamiAnalytics({ websiteId: 'test-id' })
+const { status } = useScriptUmamiAnalytics({ websiteId: 'ae15c227-67e8-434a-831f-67e6df88bd6c' })
 </script>
 
 <template>