@newrelic/browser-agent 1.315.0 → 1.316.0

package/CHANGELOG.md

@@ -3,6 +3,13 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [1.316.0](https://github.com/newrelic/newrelic-browser-agent/compare/v1.315.0...v1.316.0) (2026-06-01)
+
+
+### Features
+
+* Use app-namespaced keys for session ([#1776](https://github.com/newrelic/newrelic-browser-agent/issues/1776)) ([60ec5bf](https://github.com/newrelic/newrelic-browser-agent/commit/60ec5bf566d27d68e59c827f08dcd8dd73d8cd2c))
+
 ## [1.315.0](https://github.com/newrelic/newrelic-browser-agent/compare/v1.314.0...v1.315.0) (2026-05-26)
 
 

package/dist/cjs/common/constants/env.cdn.js

@@ -17,7 +17,7 @@ exports.VERSION = exports.RRWEB_VERSION = exports.RRWEB_PACKAGE_NAME = exports.D
 /**
  * Exposes the version of the agent
  */
-const VERSION = exports.VERSION = "1.315.0";
+const VERSION = exports.VERSION = "1.316.0";
 
 /**
  * Exposes the build type of the agent

package/dist/cjs/common/constants/env.npm.js

@@ -17,7 +17,7 @@ exports.VERSION = exports.RRWEB_VERSION = exports.RRWEB_PACKAGE_NAME = exports.D
 /**
  * Exposes the version of the agent
  */
-const VERSION = exports.VERSION = "1.315.0";
+const VERSION = exports.VERSION = "1.316.0";
 
 /**
  * Exposes the build type of the agent

package/dist/cjs/common/session/constants.js

@@ -3,13 +3,12 @@
 Object.defineProperty(exports, "__esModule", {
   value: true
 });
-exports.SESSION_EVENT_TYPES = exports.SESSION_EVENTS = exports.PREFIX = exports.MODE = exports.DEFAULT_KEY = exports.DEFAULT_INACTIVE_MS = exports.DEFAULT_EXPIRES_MS = void 0;
+exports.SESSION_STORAGE_KEY_PREFIX = exports.SESSION_EVENT_TYPES = exports.SESSION_EVENTS = exports.MODE = exports.DEFAULT_INACTIVE_MS = exports.DEFAULT_EXPIRES_MS = void 0;
 /**
- * Copyright 2020-2025 New Relic, Inc. All rights reserved.
+ * Copyright 2020-2026 New Relic, Inc. All rights reserved.
  * SPDX-License-Identifier: Apache-2.0
  */
-const PREFIX = exports.PREFIX = 'NRBA';
-const DEFAULT_KEY = exports.DEFAULT_KEY = 'SESSION';
+const SESSION_STORAGE_KEY_PREFIX = exports.SESSION_STORAGE_KEY_PREFIX = 'NRBA_SESSION::';
 const DEFAULT_EXPIRES_MS = exports.DEFAULT_EXPIRES_MS = 14400000;
 const DEFAULT_INACTIVE_MS = exports.DEFAULT_INACTIVE_MS = 1800000;
 const SESSION_EVENTS = exports.SESSION_EVENTS = {

package/dist/cjs/common/session/session-entity.js

@@ -45,7 +45,7 @@ const model = {
 class SessionEntity {
   /**
    * Create a self-managing Session Entity. This entity is scoped to the agent which triggered it, allowing for multiple simultaneous session objects to exist.
-   * There is one "namespace" an agent can store data in LS -- NRBA_{key}. If there are two agents on one page, and they both use the same key, they could overwrite each other since they would both use the same namespace in LS by default.
+  * Session data is stored at NRBA_SESSION::{key}, where key can be app-scoped by the caller to avoid collisions across multiple agents on the same origin.
    * The value can be overridden in the constructor, but will default to a unique 16 character hex string
    * expiresMs and inactiveMs are used to "expire" the session, but can be overridden in the constructor. Pass 0 to disable expiration timers.
    */
@@ -174,7 +174,7 @@ class SessionEntity {
 
   // This is the actual key appended to the storage API
   get lookupKey() {
-    return "".concat(_constants.PREFIX, "_").concat(this.key);
+    return "".concat(_constants.SESSION_STORAGE_KEY_PREFIX).concat(this.key);
   }
   sync(data) {
     Object.assign(this.state, data);

package/dist/cjs/common/session/session-key.js

@@ -0,0 +1,22 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.getAppSessionHash = getAppSessionHash;
+/**
+ * Copyright 2020-2026 New Relic, Inc. All rights reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+// Deterministic 32-bit FNV-1a hash, rendered as a fixed 8-char hex string.
+function hashTo8Hex(value) {
+  let hash = 0x811c9dc5;
+  for (let i = 0; i < value.length; i++) {
+    hash ^= value.charCodeAt(i);
+    hash = Math.imul(hash, 0x01000193);
+  }
+  return (hash >>> 0).toString(16).padStart(8, '0');
+}
+function getAppSessionHash(licenseKey, applicationID) {
+  return hashTo8Hex("".concat(String(licenseKey), ":").concat(String(applicationID)));
+}

package/dist/cjs/features/page_view_event/aggregate/index.js

@@ -7,7 +7,6 @@ exports.Aggregate = void 0;
 var _runtime = require("../../../common/constants/runtime");
 var _navTiming = require("../../../common/timing/nav-timing");
 var _stringify = require("../../../common/util/stringify");
-var _info = require("../../../common/config/info");
 var CONSTANTS = _interopRequireWildcard(require("../constants"));
 var _initializedFeatures = require("./initialized-features");
 var _featureFlags = require("../../../common/util/feature-flags");
@@ -39,10 +38,6 @@ class Aggregate extends _aggregateBase.AggregateBase {
     this.firstByteToWindowLoad = 0; // our "frontend" duration
     this.firstByteToDomContent = 0; // our "dom processing" duration
     this.retries = 0;
-    if (!(0, _info.isValid)(agentRef.info)) {
-      this.ee.abort();
-      return (0, _console.warn)(43);
-    }
     agentRef.runtime.timeKeeper = new _timeKeeper.TimeKeeper(agentRef.runtime.session);
     if (_runtime.isBrowserScope) {
       _timeToFirstByte.timeToFirstByte.subscribe(({

package/dist/cjs/features/session_replay/instrument/index.js

@@ -6,6 +6,7 @@ Object.defineProperty(exports, "__esModule", {
 exports.SessionReplay = exports.Instrument = void 0;
 var _handle = require("../../../common/event-emitter/handle");
 var _constants = require("../../../common/session/constants");
+var _sessionKey = require("../../../common/session/session-key");
 var _instrumentBase = require("../../utils/instrument-base");
 var _utils = require("../shared/utils");
 var _constants2 = require("../constants");
@@ -13,7 +14,7 @@ var _recordReplay = require("../../../loaders/api/recordReplay");
 var _pauseReplay = require("../../../loaders/api/pauseReplay");
 var _constants3 = require("../../../loaders/api/constants");
 function _interopRequireWildcard(e, t) { if ("function" == typeof WeakMap) var r = new WeakMap(), n = new WeakMap(); return (_interopRequireWildcard = function (e, t) { if (!t && e && e.__esModule) return e; var o, i, f = { __proto__: null, default: e }; if (null === e || "object" != typeof e && "function" != typeof e) return f; if (o = t ? n : r) { if (o.has(e)) return o.get(e); o.set(e, f); } for (const t in e) "default" !== t && {}.hasOwnProperty.call(e, t) && ((i = (o = Object.defineProperty) && Object.getOwnPropertyDescriptor(e, t)) && (i.get || i.set) ? o(f, t, i) : f[t] = e[t]); return f; })(e, t); } /**
- * Copyright 2020-2025 New Relic, Inc. All rights reserved.
+ * Copyright 2020-2026 New Relic, Inc. All rights reserved.
  * SPDX-License-Identifier: Apache-2.0
  */ /**
  * @file Primes the Session Replay feature for lazy loading.
@@ -31,8 +32,9 @@ class Instrument extends _instrumentBase.InstrumentBase {
     (0, _recordReplay.setupRecordReplayAPI)(agentRef);
     (0, _pauseReplay.setupPauseReplayAPI)(agentRef);
     let session;
+    const fullNamespacedKey = "".concat(_constants.SESSION_STORAGE_KEY_PREFIX).concat((0, _sessionKey.getAppSessionHash)(agentRef.info.licenseKey, agentRef.info.applicationID));
     try {
-      session = JSON.parse(localStorage.getItem("".concat(_constants.PREFIX, "_").concat(_constants.DEFAULT_KEY)));
+      session = JSON.parse(localStorage.getItem(fullNamespacedKey));
     } catch (err) {}
     if ((0, _utils.hasReplayPrerequisite)(agentRef.init)) {
       this.ee.on(_constants3.RECORD_REPLAY, () => this.#apiStartOrRestartReplay());

package/dist/cjs/features/utils/agent-session.js

@@ -8,12 +8,12 @@ var _drain = require("../../common/drain/drain");
 var _registerHandler = require("../../common/event-emitter/register-handler");
 var _sessionEntity = require("../../common/session/session-entity");
 var _localStorage = require("../../common/storage/local-storage.js");
-var _constants = require("../../common/session/constants");
+var _sessionKey = require("../../common/session/session-key");
 var _info = require("../../common/config/info");
 var _attributeSize = require("../../common/util/attribute-size");
 var _handle = require("../../common/event-emitter/handle");
-var _constants2 = require("../../loaders/api/constants");
-var _constants3 = require("../metrics/constants");
+var _constants = require("../../loaders/api/constants");
+var _constants2 = require("../metrics/constants");
 var _features = require("../../loaders/features/features");
 var _sharedHandlers = require("../../loaders/api/sharedHandlers");
 /**
@@ -25,9 +25,10 @@ function setupAgentSession(agentRef) {
   if (agentRef.runtime.session) return agentRef.runtime.session; // already setup
 
   const sessionInit = agentRef.init.session;
+  const namespacedKey = (0, _sessionKey.getAppSessionHash)(agentRef.info.licenseKey, agentRef.info.applicationID);
   agentRef.runtime.session = new _sessionEntity.SessionEntity({
     agentRef,
-    key: _constants.DEFAULT_KEY,
+    key: namespacedKey,
     storage: new _localStorage.LocalStorage(),
     expiresMs: sessionInit?.expiresMs,
     inactiveMs: sessionInit?.inactiveMs
@@ -65,8 +66,8 @@ function setupAgentSession(agentRef) {
   }, 'session', sharedEE);
   (0, _registerHandler.registerHandler)('api-setUserIdAndResetSession', value => {
     agentRef.runtime.session.reset();
-    (0, _handle.handle)(_constants3.SUPPORTABILITY_METRIC_CHANNEL, ['API/' + _constants2.SET_USER_ID + '/resetSession/called'], undefined, _features.FEATURE_NAMES.metrics, sharedEE);
-    (0, _sharedHandlers.appendJsAttribute)(agentRef, 'enduser.id', value, _constants2.SET_USER_ID, true);
+    (0, _handle.handle)(_constants2.SUPPORTABILITY_METRIC_CHANNEL, ['API/' + _constants.SET_USER_ID + '/resetSession/called'], undefined, _features.FEATURE_NAMES.metrics, sharedEE);
+    (0, _sharedHandlers.appendJsAttribute)(agentRef, 'enduser.id', value, _constants.SET_USER_ID, true);
   }, 'session', sharedEE);
   (0, _registerHandler.registerHandler)('api-consent', accept => {
     agentRef.runtime.session.write({

package/dist/cjs/features/utils/aggregate-base.js

@@ -5,9 +5,6 @@ Object.defineProperty(exports, "__esModule", {
 });
 exports.AggregateBase = void 0;
 var _featureBase = require("./feature-base");
-var _info = require("../../common/config/info");
-var _configure = require("../../loaders/configure/configure");
-var _nreum = require("../../common/window/nreum");
 var _drain = require("../../common/drain/drain");
 var _obfuscate = require("../../common/util/obfuscate");
 var _features = require("../../loaders/features/features");
@@ -30,7 +27,6 @@ class AggregateBase extends _featureBase.FeatureBase {
    */
   constructor(agentRef, featureName) {
     super(agentRef, featureName);
-    this.checkConfiguration(agentRef);
     this.doOnceForAllAggregate(agentRef);
 
     /** @type {Boolean} indicates if custom attributes are combined in each event payload for size estimation purposes. this is set to true in derived classes that need to evaluate custom attributes separately from the event payload */
@@ -182,36 +178,6 @@ class AggregateBase extends _featureBase.FeatureBase {
     this.events.clearSave(this.harvestOpts);
   }
 
-  /**
-   * Checks for additional `jsAttributes` items to support backward compatibility with implementations of the agent where
-   * loader configurations may appear after the loader code is executed.
-   */
-  checkConfiguration(existingAgent) {
-    // NOTE: This check has to happen at aggregator load time
-    if (!(0, _info.isValid)(existingAgent.info)) {
-      const cdn = (0, _nreum.gosCDN)();
-      let jsAttributes = {
-        ...cdn.info?.jsAttributes
-      };
-      try {
-        jsAttributes = {
-          ...jsAttributes,
-          ...existingAgent.info?.jsAttributes
-        };
-      } catch (err) {
-        // do nothing
-      }
-      (0, _configure.configure)(existingAgent, {
-        ...cdn,
-        info: {
-          ...cdn.info,
-          jsAttributes
-        },
-        runtime: existingAgent.runtime
-      }, existingAgent.runtime.loaderType);
-    }
-  }
-
   /**
    * These are actions related to shared resources that should be initialized once by whichever feature Aggregate subclass loads first.
    * This method should run after checkConfiguration, which may reset the agent's info/runtime object that is used here.

package/dist/cjs/features/utils/instrument-base.js

@@ -9,6 +9,9 @@ var _featureBase = require("./feature-base");
 var _load = require("../../common/window/load");
 var _runtime = require("../../common/constants/runtime");
 var _console = require("../../common/util/console");
+var _info = require("../../common/config/info");
+var _configure = require("../../loaders/configure/configure");
+var _nreum = require("../../common/window/nreum");
 var _features = require("../../loaders/features/features");
 var _utils = require("../session_replay/shared/utils");
 var _featureGates = require("./feature-gates");
@@ -20,9 +23,11 @@ function _interopRequireWildcard(e, t) { if ("function" == typeof WeakMap) var r
  * SPDX-License-Identifier: Apache-2.0
  */ /**
  * @file Defines `InstrumentBase` to be used as the super of the Instrument classes implemented by each feature.
- * Inherits and executes the `checkConfiguration` method from [FeatureBase]{@link ./feature-base}, which also
- * exposes the `blocked` property.
+ * Validates and loads feature aggregates, including a one-time late configuration check before import.
+ * Inherits `blocked` behavior from [FeatureBase]{@link ./feature-base}.
  */
+const checkedAgents = new WeakSet();
+
 /**
  * Base class for instrumenting a feature.
  * @extends FeatureBase
@@ -89,6 +94,14 @@ class InstrumentBase extends _featureBase.FeatureBase {
       // this will resolve immediately if the feature is auto-started,
       // or otherwise when the manual-start-all event is emitted by the start API
       await this.deferred;
+      this.#checkConfiguration(agentRef); // check for late-appearing 'info' config on the page
+      if (!(0, _info.isValid)(agentRef.info)) {
+        // if there still isn't valid info, then we can't proceed with session setup or importing the aggregates
+        (0, _console.warn)(43);
+        agentRef.ee.abort();
+        this.loadedSuccessfully(false);
+        return;
+      }
       let session;
       try {
         if ((0, _featureGates.canEnableSessionTracking)(agentRef.init)) {
@@ -153,5 +166,37 @@ class InstrumentBase extends _featureBase.FeatureBase {
         return true;
     }
   }
+
+  /**
+   * Checks for additional `jsAttributes` items to support backward compatibility with implementations of the agent where
+   * loader configurations may appear after the loader code is executed.
+   */
+  #checkConfiguration(existingAgent) {
+    if (checkedAgents.has(existingAgent)) return;
+    checkedAgents.add(existingAgent);
+    // NOTE: This check has to happen at load time
+    if (!(0, _info.isValid)(existingAgent.info)) {
+      const cdn = (0, _nreum.gosCDN)();
+      let jsAttributes = {
+        ...cdn.info?.jsAttributes
+      };
+      try {
+        jsAttributes = {
+          ...jsAttributes,
+          ...existingAgent.info?.jsAttributes
+        };
+      } catch (err) {
+        // do nothing
+      }
+      (0, _configure.configure)(existingAgent, {
+        ...cdn,
+        info: {
+          ...cdn.info,
+          jsAttributes
+        },
+        runtime: existingAgent.runtime
+      }, existingAgent.runtime.loaderType);
+    }
+  }
 }
 exports.InstrumentBase = InstrumentBase;

package/dist/cjs/loaders/api-base.js

@@ -235,7 +235,7 @@ class ApiBase {
 
   /**
    * Accepts or rejects consent when the agent is configured to require consent before harvesting.
-   * The consent state is stored in session storage inside the NRBA_SESSION object.
+    * The consent state is stored in the agent session object in browser storage.
    * {@link https://docs.newrelic.com/docs/browser/new-relic-browser/browser-apis/consent/}
    * @param {boolean?} accept Whether to accept or reject consent. Defaults to true (accept) if left undefined.
    */

package/dist/esm/common/constants/env.cdn.js

@@ -11,7 +11,7 @@
 /**
  * Exposes the version of the agent
  */
-export const VERSION = "1.315.0";
+export const VERSION = "1.316.0";
 
 /**
  * Exposes the build type of the agent

package/dist/esm/common/constants/env.npm.js

@@ -11,7 +11,7 @@
 /**
  * Exposes the version of the agent
  */
-export const VERSION = "1.315.0";
+export const VERSION = "1.316.0";
 
 /**
  * Exposes the build type of the agent

package/dist/esm/common/session/constants.js

@@ -1,9 +1,8 @@
 /**
- * Copyright 2020-2025 New Relic, Inc. All rights reserved.
+ * Copyright 2020-2026 New Relic, Inc. All rights reserved.
  * SPDX-License-Identifier: Apache-2.0
  */
-export const PREFIX = 'NRBA';
-export const DEFAULT_KEY = 'SESSION';
+export const SESSION_STORAGE_KEY_PREFIX = 'NRBA_SESSION::';
 export const DEFAULT_EXPIRES_MS = 14400000;
 export const DEFAULT_INACTIVE_MS = 1800000;
 export const SESSION_EVENTS = {

package/dist/esm/common/session/session-entity.js

@@ -7,7 +7,7 @@ import { warn } from '../util/console';
 import { stringify } from '../util/stringify';
 import { Timer } from '../timer/timer';
 import { isBrowserScope } from '../constants/runtime';
-import { DEFAULT_EXPIRES_MS, DEFAULT_INACTIVE_MS, MODE, PREFIX, SESSION_EVENTS, SESSION_EVENT_TYPES } from './constants';
+import { DEFAULT_EXPIRES_MS, DEFAULT_INACTIVE_MS, MODE, SESSION_EVENTS, SESSION_EVENT_TYPES, SESSION_STORAGE_KEY_PREFIX } from './constants';
 import { InteractionTimer } from '../timer/interaction-timer';
 import { wrapEvents } from '../wrap/wrap-events';
 import { getModeledObject } from '../config/configurable';
@@ -39,7 +39,7 @@ const model = {
 export class SessionEntity {
   /**
    * Create a self-managing Session Entity. This entity is scoped to the agent which triggered it, allowing for multiple simultaneous session objects to exist.
-   * There is one "namespace" an agent can store data in LS -- NRBA_{key}. If there are two agents on one page, and they both use the same key, they could overwrite each other since they would both use the same namespace in LS by default.
+  * Session data is stored at NRBA_SESSION::{key}, where key can be app-scoped by the caller to avoid collisions across multiple agents on the same origin.
    * The value can be overridden in the constructor, but will default to a unique 16 character hex string
    * expiresMs and inactiveMs are used to "expire" the session, but can be overridden in the constructor. Pass 0 to disable expiration timers.
    */
@@ -168,7 +168,7 @@ export class SessionEntity {
 
   // This is the actual key appended to the storage API
   get lookupKey() {
-    return "".concat(PREFIX, "_").concat(this.key);
+    return "".concat(SESSION_STORAGE_KEY_PREFIX).concat(this.key);
   }
   sync(data) {
     Object.assign(this.state, data);

package/dist/esm/common/session/session-key.js

@@ -0,0 +1,16 @@
+/**
+ * Copyright 2020-2026 New Relic, Inc. All rights reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+// Deterministic 32-bit FNV-1a hash, rendered as a fixed 8-char hex string.
+function hashTo8Hex(value) {
+  let hash = 0x811c9dc5;
+  for (let i = 0; i < value.length; i++) {
+    hash ^= value.charCodeAt(i);
+    hash = Math.imul(hash, 0x01000193);
+  }
+  return (hash >>> 0).toString(16).padStart(8, '0');
+}
+export function getAppSessionHash(licenseKey, applicationID) {
+  return hashTo8Hex("".concat(String(licenseKey), ":").concat(String(applicationID)));
+}

package/dist/esm/features/page_view_event/aggregate/index.js

@@ -5,7 +5,6 @@
 import { globalScope, isBrowserScope, originTime, getNavigationEntry } from '../../../common/constants/runtime';
 import { addPT, addPN } from '../../../common/timing/nav-timing';
 import { stringify } from '../../../common/util/stringify';
-import { isValid } from '../../../common/config/info';
 import * as CONSTANTS from '../constants';
 import { getActivatedFeaturesFlags } from './initialized-features';
 import { activateFeatures } from '../../../common/util/feature-flags';
@@ -31,10 +30,6 @@ export class Aggregate extends AggregateBase {
     this.firstByteToWindowLoad = 0; // our "frontend" duration
     this.firstByteToDomContent = 0; // our "dom processing" duration
     this.retries = 0;
-    if (!isValid(agentRef.info)) {
-      this.ee.abort();
-      return warn(43);
-    }
     agentRef.runtime.timeKeeper = new TimeKeeper(agentRef.runtime.session);
     if (isBrowserScope) {
       timeToFirstByte.subscribe(({

package/dist/esm/features/session_replay/instrument/index.js

@@ -1,5 +1,5 @@
 /**
- * Copyright 2020-2025 New Relic, Inc. All rights reserved.
+ * Copyright 2020-2026 New Relic, Inc. All rights reserved.
  * SPDX-License-Identifier: Apache-2.0
  */
 /**
@@ -7,7 +7,8 @@
  */
 
 import { handle } from '../../../common/event-emitter/handle';
-import { DEFAULT_KEY, MODE, PREFIX } from '../../../common/session/constants';
+import { MODE, SESSION_STORAGE_KEY_PREFIX } from '../../../common/session/constants';
+import { getAppSessionHash } from '../../../common/session/session-key';
 import { InstrumentBase } from '../../utils/instrument-base';
 import { hasReplayPrerequisite, isPreloadAllowed } from '../shared/utils';
 import { ERROR_DURING_REPLAY, FEATURE_NAME, TRIGGERS } from '../constants';
@@ -27,8 +28,9 @@ export class Instrument extends InstrumentBase {
     setupRecordReplayAPI(agentRef);
     setupPauseReplayAPI(agentRef);
     let session;
+    const fullNamespacedKey = "".concat(SESSION_STORAGE_KEY_PREFIX).concat(getAppSessionHash(agentRef.info.licenseKey, agentRef.info.applicationID));
     try {
-      session = JSON.parse(localStorage.getItem("".concat(PREFIX, "_").concat(DEFAULT_KEY)));
+      session = JSON.parse(localStorage.getItem(fullNamespacedKey));
     } catch (err) {}
     if (hasReplayPrerequisite(agentRef.init)) {
       this.ee.on(RECORD_REPLAY, () => this.#apiStartOrRestartReplay());

package/dist/esm/features/utils/agent-session.js

@@ -6,7 +6,7 @@ import { drain } from '../../common/drain/drain';
 import { registerHandler } from '../../common/event-emitter/register-handler';
 import { SessionEntity } from '../../common/session/session-entity';
 import { LocalStorage } from '../../common/storage/local-storage.js';
-import { DEFAULT_KEY } from '../../common/session/constants';
+import { getAppSessionHash } from '../../common/session/session-key';
 import { mergeInfo } from '../../common/config/info';
 import { trackObjectAttributeSize } from '../../common/util/attribute-size';
 import { handle } from '../../common/event-emitter/handle';
@@ -18,9 +18,10 @@ export function setupAgentSession(agentRef) {
   if (agentRef.runtime.session) return agentRef.runtime.session; // already setup
 
   const sessionInit = agentRef.init.session;
+  const namespacedKey = getAppSessionHash(agentRef.info.licenseKey, agentRef.info.applicationID);
   agentRef.runtime.session = new SessionEntity({
     agentRef,
-    key: DEFAULT_KEY,
+    key: namespacedKey,
     storage: new LocalStorage(),
     expiresMs: sessionInit?.expiresMs,
     inactiveMs: sessionInit?.inactiveMs

package/dist/esm/features/utils/aggregate-base.js

@@ -3,9 +3,6 @@
  * SPDX-License-Identifier: Apache-2.0
  */
 import { FeatureBase } from './feature-base';
-import { isValid } from '../../common/config/info';
-import { configure } from '../../loaders/configure/configure';
-import { gosCDN } from '../../common/window/nreum';
 import { drain } from '../../common/drain/drain';
 import { Obfuscator } from '../../common/util/obfuscate';
 import { FEATURE_NAMES } from '../../loaders/features/features';
@@ -23,7 +20,6 @@ export class AggregateBase extends FeatureBase {
    */
   constructor(agentRef, featureName) {
     super(agentRef, featureName);
-    this.checkConfiguration(agentRef);
     this.doOnceForAllAggregate(agentRef);
 
     /** @type {Boolean} indicates if custom attributes are combined in each event payload for size estimation purposes. this is set to true in derived classes that need to evaluate custom attributes separately from the event payload */
@@ -175,36 +171,6 @@ export class AggregateBase extends FeatureBase {
     this.events.clearSave(this.harvestOpts);
   }
 
-  /**
-   * Checks for additional `jsAttributes` items to support backward compatibility with implementations of the agent where
-   * loader configurations may appear after the loader code is executed.
-   */
-  checkConfiguration(existingAgent) {
-    // NOTE: This check has to happen at aggregator load time
-    if (!isValid(existingAgent.info)) {
-      const cdn = gosCDN();
-      let jsAttributes = {
-        ...cdn.info?.jsAttributes
-      };
-      try {
-        jsAttributes = {
-          ...jsAttributes,
-          ...existingAgent.info?.jsAttributes
-        };
-      } catch (err) {
-        // do nothing
-      }
-      configure(existingAgent, {
-        ...cdn,
-        info: {
-          ...cdn.info,
-          jsAttributes
-        },
-        runtime: existingAgent.runtime
-      }, existingAgent.runtime.loaderType);
-    }
-  }
-
   /**
    * These are actions related to shared resources that should be initialized once by whichever feature Aggregate subclass loads first.
    * This method should run after checkConfiguration, which may reset the agent's info/runtime object that is used here.

package/dist/esm/features/utils/instrument-base.js

@@ -5,8 +5,8 @@
 
 /**
  * @file Defines `InstrumentBase` to be used as the super of the Instrument classes implemented by each feature.
- * Inherits and executes the `checkConfiguration` method from [FeatureBase]{@link ./feature-base}, which also
- * exposes the `blocked` property.
+ * Validates and loads feature aggregates, including a one-time late configuration check before import.
+ * Inherits `blocked` behavior from [FeatureBase]{@link ./feature-base}.
  */
 
 import { drain, registerDrain } from '../../common/drain/drain';
@@ -14,12 +14,16 @@ import { FeatureBase } from './feature-base';
 import { onWindowLoad } from '../../common/window/load';
 import { isBrowserScope } from '../../common/constants/runtime';
 import { warn } from '../../common/util/console';
+import { isValid } from '../../common/config/info';
+import { configure } from '../../loaders/configure/configure';
+import { gosCDN } from '../../common/window/nreum';
 import { FEATURE_NAMES } from '../../loaders/features/features';
 import { hasReplayPrerequisite } from '../session_replay/shared/utils';
 import { canEnableSessionTracking } from './feature-gates';
 import { single } from '../../common/util/invoke';
 import { SESSION_ERROR } from '../../common/constants/agent-constants';
 import { handle } from '../../common/event-emitter/handle';
+const checkedAgents = new WeakSet();
 
 /**
  * Base class for instrumenting a feature.
@@ -87,6 +91,14 @@ export class InstrumentBase extends FeatureBase {
       // this will resolve immediately if the feature is auto-started,
       // or otherwise when the manual-start-all event is emitted by the start API
       await this.deferred;
+      this.#checkConfiguration(agentRef); // check for late-appearing 'info' config on the page
+      if (!isValid(agentRef.info)) {
+        // if there still isn't valid info, then we can't proceed with session setup or importing the aggregates
+        warn(43);
+        agentRef.ee.abort();
+        this.loadedSuccessfully(false);
+        return;
+      }
       let session;
       try {
         if (canEnableSessionTracking(agentRef.init)) {
@@ -151,4 +163,36 @@ export class InstrumentBase extends FeatureBase {
         return true;
     }
   }
+
+  /**
+   * Checks for additional `jsAttributes` items to support backward compatibility with implementations of the agent where
+   * loader configurations may appear after the loader code is executed.
+   */
+  #checkConfiguration(existingAgent) {
+    if (checkedAgents.has(existingAgent)) return;
+    checkedAgents.add(existingAgent);
+    // NOTE: This check has to happen at load time
+    if (!isValid(existingAgent.info)) {
+      const cdn = gosCDN();
+      let jsAttributes = {
+        ...cdn.info?.jsAttributes
+      };
+      try {
+        jsAttributes = {
+          ...jsAttributes,
+          ...existingAgent.info?.jsAttributes
+        };
+      } catch (err) {
+        // do nothing
+      }
+      configure(existingAgent, {
+        ...cdn,
+        info: {
+          ...cdn.info,
+          jsAttributes
+        },
+        runtime: existingAgent.runtime
+      }, existingAgent.runtime.loaderType);
+    }
+  }
 }

package/dist/esm/loaders/api-base.js

@@ -229,7 +229,7 @@ export class ApiBase {
 
   /**
    * Accepts or rejects consent when the agent is configured to require consent before harvesting.
-   * The consent state is stored in session storage inside the NRBA_SESSION object.
+    * The consent state is stored in the agent session object in browser storage.
    * {@link https://docs.newrelic.com/docs/browser/new-relic-browser/browser-apis/consent/}
    * @param {boolean?} accept Whether to accept or reject consent. Defaults to true (accept) if left undefined.
    */

package/dist/tsconfig.tsbuildinfo

@@ -1 +1 @@
-{"root":["../src/index.js","../src/cdn/experimental.js","../src/cdn/lite.js","../src/cdn/pro.js","../src/cdn/spa.js","../src/common/aggregate/aggregator.js","../src/common/aggregate/event-aggregator.js","../src/common/config/configurable.js","../src/common/config/info.js","../src/common/config/init-types.js","../src/common/config/init.js","../src/common/config/loader-config.js","../src/common/config/runtime.js","../src/common/constants/agent-constants.js","../src/common/constants/env.cdn.js","../src/common/constants/env.js","../src/common/constants/env.npm.js","../src/common/constants/runtime.js","../src/common/constants/shared-channel.js","../src/common/deny-list/deny-list.js","../src/common/dispatch/global-event.js","../src/common/dom/iframe.js","../src/common/dom/query-selector.js","../src/common/dom/selector-path.js","../src/common/drain/drain.js","../src/common/event-emitter/contextual-ee.js","../src/common/event-emitter/event-context.js","../src/common/event-emitter/handle.js","../src/common/event-emitter/register-handler.js","../src/common/event-listener/event-listener-opts.js","../src/common/harvest/harvester.js","../src/common/harvest/types.js","../src/common/ids/bundle-id.js","../src/common/ids/id.js","../src/common/ids/unique-id.js","../src/common/serialize/bel-serializer.js","../src/common/session/constants.js","../src/common/session/session-entity.js","../src/common/storage/local-storage.js","../src/common/timer/interaction-timer.js","../src/common/timer/timer.js","../src/common/timing/nav-timing.js","../src/common/timing/now.js","../src/common/timing/time-keeper.js","../src/common/unload/eol.js","../src/common/url/canonicalize-url.js","../src/common/url/clean-url.js","../src/common/url/encode.js","../src/common/url/extract-url.js","../src/common/url/location.js","../src/common/url/parse-url.js","../src/common/url/protocol.js","../src/common/util/attribute-size.js","../src/common/util/browser-stack-matchers.js","../src/common/util/console.js","../src/common/util/data-size.js","../src/common/util/event-origin.js","../src/common/util/feature-flags.js","../src/common/util/get-or-set.js","../src/common/util/invoke.js","../src/common/util/monkey-patched.js","../src/common/util/obfuscate.js","../src/common/util/short-circuit.js","../src/common/util/stringify.js","../src/common/util/submit-data.js","../src/common/util/text.js","../src/common/util/traverse.js","../src/common/util/type-check.js","../src/common/util/webdriver-detection.js","../src/common/v2/script-correlation.js","../src/common/v2/script-tracker.js","../src/common/v2/utils.js","../src/common/vitals/constants.js","../src/common/vitals/cumulative-layout-shift.js","../src/common/vitals/first-contentful-paint.js","../src/common/vitals/first-paint.js","../src/common/vitals/interaction-to-next-paint.js","../src/common/vitals/largest-contentful-paint.js","../src/common/vitals/load-time.js","../src/common/vitals/time-to-first-byte.js","../src/common/vitals/vital-metric.js","../src/common/window/load.js","../src/common/window/nreum.js","../src/common/window/page-visibility.js","../src/common/wrap/wrap-events.js","../src/common/wrap/wrap-fetch.js","../src/common/wrap/wrap-function.js","../src/common/wrap/wrap-history.js","../src/common/wrap/wrap-logger.js","../src/common/wrap/wrap-websocket.js","../src/common/wrap/wrap-xhr.js","../src/features/ajax/constants.js","../src/features/ajax/index.js","../src/features/ajax/aggregate/gql.js","../src/features/ajax/aggregate/index.js","../src/features/ajax/instrument/distributed-tracing.js","../src/features/ajax/instrument/index.js","../src/features/ajax/instrument/response-size.js","../src/features/generic_events/constants.js","../src/features/generic_events/index.js","../src/features/generic_events/aggregate/index.js","../src/features/generic_events/aggregate/user-actions/aggregated-user-action.js","../src/features/generic_events/aggregate/user-actions/user-actions-aggregator.js","../src/features/generic_events/instrument/index.js","../src/features/jserrors/constants.js","../src/features/jserrors/index.js","../src/features/jserrors/aggregate/canonical-function-name.js","../src/features/jserrors/aggregate/cause-string.js","../src/features/jserrors/aggregate/compute-stack-trace.js","../src/features/jserrors/aggregate/format-stack-trace.js","../src/features/jserrors/aggregate/index.js","../src/features/jserrors/aggregate/internal-errors.js","../src/features/jserrors/aggregate/string-hash-code.js","../src/features/jserrors/instrument/index.js","../src/features/jserrors/shared/cast-error.js","../src/features/jserrors/shared/uncaught-error.js","../src/features/logging/constants.js","../src/features/logging/index.js","../src/features/logging/aggregate/index.js","../src/features/logging/instrument/index.js","../src/features/logging/shared/log.js","../src/features/logging/shared/utils.js","../src/features/metrics/constants.js","../src/features/metrics/index.js","../src/features/metrics/aggregate/framework-detection.js","../src/features/metrics/aggregate/harvest-metadata.js","../src/features/metrics/aggregate/index.js","../src/features/metrics/instrument/index.js","../src/features/page_action/constants.js","../src/features/page_action/index.js","../src/features/page_action/instrument/index.js","../src/features/page_view_event/constants.js","../src/features/page_view_event/index.js","../src/features/page_view_event/aggregate/index.js","../src/features/page_view_event/aggregate/initialized-features.js","../src/features/page_view_event/instrument/index.js","../src/features/page_view_timing/constants.js","../src/features/page_view_timing/index.js","../src/features/page_view_timing/aggregate/index.js","../src/features/page_view_timing/instrument/index.js","../src/features/session_replay/constants.js","../src/features/session_replay/index.js","../src/features/session_replay/aggregate/index.js","../src/features/session_replay/instrument/index.js","../src/features/session_replay/shared/recorder-events.js","../src/features/session_replay/shared/recorder.js","../src/features/session_replay/shared/stylesheet-evaluator.js","../src/features/session_replay/shared/utils.js","../src/features/session_trace/constants.js","../src/features/session_trace/index.js","../src/features/session_trace/aggregate/index.js","../src/features/session_trace/aggregate/trace/node.js","../src/features/session_trace/aggregate/trace/storage.js","../src/features/session_trace/aggregate/trace/utils.js","../src/features/session_trace/instrument/index.js","../src/features/soft_navigations/constants.js","../src/features/soft_navigations/index.js","../src/features/soft_navigations/aggregate/ajax-node.js","../src/features/soft_navigations/aggregate/bel-node.js","../src/features/soft_navigations/aggregate/index.js","../src/features/soft_navigations/aggregate/initial-page-load-interaction.js","../src/features/soft_navigations/aggregate/interaction.js","../src/features/soft_navigations/instrument/index.js","../src/features/utils/agent-session.js","../src/features/utils/aggregate-base.js","../src/features/utils/event-buffer.js","../src/features/utils/feature-base.js","../src/features/utils/feature-gates.js","../src/features/utils/instrument-base.js","../src/interfaces/registered-entity.js","../src/loaders/agent-base.js","../src/loaders/agent.js","../src/loaders/api-base.js","../src/loaders/browser-agent.js","../src/loaders/micro-agent-base.js","../src/loaders/micro-agent.js","../src/loaders/api/addPageAction.js","../src/loaders/api/addRelease.js","../src/loaders/api/addToTrace.js","../src/loaders/api/consent.js","../src/loaders/api/constants.js","../src/loaders/api/finished.js","../src/loaders/api/interaction-types.js","../src/loaders/api/interaction.js","../src/loaders/api/log.js","../src/loaders/api/measure.js","../src/loaders/api/noticeError.js","../src/loaders/api/pauseReplay.js","../src/loaders/api/recordCustomEvent.js","../src/loaders/api/recordReplay.js","../src/loaders/api/register-api-types.js","../src/loaders/api/register.js","../src/loaders/api/setApplicationVersion.js","../src/loaders/api/setCustomAttribute.js","../src/loaders/api/setErrorHandler.js","../src/loaders/api/setPageViewName.js","../src/loaders/api/setUserId.js","../src/loaders/api/sharedHandlers.js","../src/loaders/api/start.js","../src/loaders/api/topLevelCallers.js","../src/loaders/api/wrapLogger.js","../src/loaders/configure/configure.js","../src/loaders/configure/nonce.js","../src/loaders/configure/public-path.js","../src/loaders/features/enabled-features.js","../src/loaders/features/featureDependencies.js","../src/loaders/features/features.js"],"version":"5.9.3"}
+{"root":["../src/index.js","../src/cdn/experimental.js","../src/cdn/lite.js","../src/cdn/pro.js","../src/cdn/spa.js","../src/common/aggregate/aggregator.js","../src/common/aggregate/event-aggregator.js","../src/common/config/configurable.js","../src/common/config/info.js","../src/common/config/init-types.js","../src/common/config/init.js","../src/common/config/loader-config.js","../src/common/config/runtime.js","../src/common/constants/agent-constants.js","../src/common/constants/env.cdn.js","../src/common/constants/env.js","../src/common/constants/env.npm.js","../src/common/constants/runtime.js","../src/common/constants/shared-channel.js","../src/common/deny-list/deny-list.js","../src/common/dispatch/global-event.js","../src/common/dom/iframe.js","../src/common/dom/query-selector.js","../src/common/dom/selector-path.js","../src/common/drain/drain.js","../src/common/event-emitter/contextual-ee.js","../src/common/event-emitter/event-context.js","../src/common/event-emitter/handle.js","../src/common/event-emitter/register-handler.js","../src/common/event-listener/event-listener-opts.js","../src/common/harvest/harvester.js","../src/common/harvest/types.js","../src/common/ids/bundle-id.js","../src/common/ids/id.js","../src/common/ids/unique-id.js","../src/common/serialize/bel-serializer.js","../src/common/session/constants.js","../src/common/session/session-entity.js","../src/common/session/session-key.js","../src/common/storage/local-storage.js","../src/common/timer/interaction-timer.js","../src/common/timer/timer.js","../src/common/timing/nav-timing.js","../src/common/timing/now.js","../src/common/timing/time-keeper.js","../src/common/unload/eol.js","../src/common/url/canonicalize-url.js","../src/common/url/clean-url.js","../src/common/url/encode.js","../src/common/url/extract-url.js","../src/common/url/location.js","../src/common/url/parse-url.js","../src/common/url/protocol.js","../src/common/util/attribute-size.js","../src/common/util/browser-stack-matchers.js","../src/common/util/console.js","../src/common/util/data-size.js","../src/common/util/event-origin.js","../src/common/util/feature-flags.js","../src/common/util/get-or-set.js","../src/common/util/invoke.js","../src/common/util/monkey-patched.js","../src/common/util/obfuscate.js","../src/common/util/short-circuit.js","../src/common/util/stringify.js","../src/common/util/submit-data.js","../src/common/util/text.js","../src/common/util/traverse.js","../src/common/util/type-check.js","../src/common/util/webdriver-detection.js","../src/common/v2/script-correlation.js","../src/common/v2/script-tracker.js","../src/common/v2/utils.js","../src/common/vitals/constants.js","../src/common/vitals/cumulative-layout-shift.js","../src/common/vitals/first-contentful-paint.js","../src/common/vitals/first-paint.js","../src/common/vitals/interaction-to-next-paint.js","../src/common/vitals/largest-contentful-paint.js","../src/common/vitals/load-time.js","../src/common/vitals/time-to-first-byte.js","../src/common/vitals/vital-metric.js","../src/common/window/load.js","../src/common/window/nreum.js","../src/common/window/page-visibility.js","../src/common/wrap/wrap-events.js","../src/common/wrap/wrap-fetch.js","../src/common/wrap/wrap-function.js","../src/common/wrap/wrap-history.js","../src/common/wrap/wrap-logger.js","../src/common/wrap/wrap-websocket.js","../src/common/wrap/wrap-xhr.js","../src/features/ajax/constants.js","../src/features/ajax/index.js","../src/features/ajax/aggregate/gql.js","../src/features/ajax/aggregate/index.js","../src/features/ajax/instrument/distributed-tracing.js","../src/features/ajax/instrument/index.js","../src/features/ajax/instrument/response-size.js","../src/features/generic_events/constants.js","../src/features/generic_events/index.js","../src/features/generic_events/aggregate/index.js","../src/features/generic_events/aggregate/user-actions/aggregated-user-action.js","../src/features/generic_events/aggregate/user-actions/user-actions-aggregator.js","../src/features/generic_events/instrument/index.js","../src/features/jserrors/constants.js","../src/features/jserrors/index.js","../src/features/jserrors/aggregate/canonical-function-name.js","../src/features/jserrors/aggregate/cause-string.js","../src/features/jserrors/aggregate/compute-stack-trace.js","../src/features/jserrors/aggregate/format-stack-trace.js","../src/features/jserrors/aggregate/index.js","../src/features/jserrors/aggregate/internal-errors.js","../src/features/jserrors/aggregate/string-hash-code.js","../src/features/jserrors/instrument/index.js","../src/features/jserrors/shared/cast-error.js","../src/features/jserrors/shared/uncaught-error.js","../src/features/logging/constants.js","../src/features/logging/index.js","../src/features/logging/aggregate/index.js","../src/features/logging/instrument/index.js","../src/features/logging/shared/log.js","../src/features/logging/shared/utils.js","../src/features/metrics/constants.js","../src/features/metrics/index.js","../src/features/metrics/aggregate/framework-detection.js","../src/features/metrics/aggregate/harvest-metadata.js","../src/features/metrics/aggregate/index.js","../src/features/metrics/instrument/index.js","../src/features/page_action/constants.js","../src/features/page_action/index.js","../src/features/page_action/instrument/index.js","../src/features/page_view_event/constants.js","../src/features/page_view_event/index.js","../src/features/page_view_event/aggregate/index.js","../src/features/page_view_event/aggregate/initialized-features.js","../src/features/page_view_event/instrument/index.js","../src/features/page_view_timing/constants.js","../src/features/page_view_timing/index.js","../src/features/page_view_timing/aggregate/index.js","../src/features/page_view_timing/instrument/index.js","../src/features/session_replay/constants.js","../src/features/session_replay/index.js","../src/features/session_replay/aggregate/index.js","../src/features/session_replay/instrument/index.js","../src/features/session_replay/shared/recorder-events.js","../src/features/session_replay/shared/recorder.js","../src/features/session_replay/shared/stylesheet-evaluator.js","../src/features/session_replay/shared/utils.js","../src/features/session_trace/constants.js","../src/features/session_trace/index.js","../src/features/session_trace/aggregate/index.js","../src/features/session_trace/aggregate/trace/node.js","../src/features/session_trace/aggregate/trace/storage.js","../src/features/session_trace/aggregate/trace/utils.js","../src/features/session_trace/instrument/index.js","../src/features/soft_navigations/constants.js","../src/features/soft_navigations/index.js","../src/features/soft_navigations/aggregate/ajax-node.js","../src/features/soft_navigations/aggregate/bel-node.js","../src/features/soft_navigations/aggregate/index.js","../src/features/soft_navigations/aggregate/initial-page-load-interaction.js","../src/features/soft_navigations/aggregate/interaction.js","../src/features/soft_navigations/instrument/index.js","../src/features/utils/agent-session.js","../src/features/utils/aggregate-base.js","../src/features/utils/event-buffer.js","../src/features/utils/feature-base.js","../src/features/utils/feature-gates.js","../src/features/utils/instrument-base.js","../src/interfaces/registered-entity.js","../src/loaders/agent-base.js","../src/loaders/agent.js","../src/loaders/api-base.js","../src/loaders/browser-agent.js","../src/loaders/micro-agent-base.js","../src/loaders/micro-agent.js","../src/loaders/api/addPageAction.js","../src/loaders/api/addRelease.js","../src/loaders/api/addToTrace.js","../src/loaders/api/consent.js","../src/loaders/api/constants.js","../src/loaders/api/finished.js","../src/loaders/api/interaction-types.js","../src/loaders/api/interaction.js","../src/loaders/api/log.js","../src/loaders/api/measure.js","../src/loaders/api/noticeError.js","../src/loaders/api/pauseReplay.js","../src/loaders/api/recordCustomEvent.js","../src/loaders/api/recordReplay.js","../src/loaders/api/register-api-types.js","../src/loaders/api/register.js","../src/loaders/api/setApplicationVersion.js","../src/loaders/api/setCustomAttribute.js","../src/loaders/api/setErrorHandler.js","../src/loaders/api/setPageViewName.js","../src/loaders/api/setUserId.js","../src/loaders/api/sharedHandlers.js","../src/loaders/api/start.js","../src/loaders/api/topLevelCallers.js","../src/loaders/api/wrapLogger.js","../src/loaders/configure/configure.js","../src/loaders/configure/nonce.js","../src/loaders/configure/public-path.js","../src/loaders/features/enabled-features.js","../src/loaders/features/featureDependencies.js","../src/loaders/features/features.js"],"version":"5.9.3"}

package/dist/types/common/session/constants.d.ts

@@ -1,9 +1,8 @@
 /**
- * Copyright 2020-2025 New Relic, Inc. All rights reserved.
+ * Copyright 2020-2026 New Relic, Inc. All rights reserved.
  * SPDX-License-Identifier: Apache-2.0
  */
-export const PREFIX: "NRBA";
-export const DEFAULT_KEY: "SESSION";
+export const SESSION_STORAGE_KEY_PREFIX: "NRBA_SESSION::";
 export const DEFAULT_EXPIRES_MS: 14400000;
 export const DEFAULT_INACTIVE_MS: 1800000;
 export namespace SESSION_EVENTS {

package/dist/types/common/session/constants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../../src/common/session/constants.js"],"names":[],"mappings":"AAAA;;;GAGG;AACH,qBAAsB,MAAM,CAAA;AAC5B,0BAA2B,SAAS,CAAA;AACpC,iCAAkC,QAAQ,CAAA;AAC1C,kCAAmC,OAAO,CAAA"}
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../../src/common/session/constants.js"],"names":[],"mappings":"AAAA;;;GAGG;AACH,yCAA0C,gBAAgB,CAAA;AAC1D,iCAAkC,QAAQ,CAAA;AAC1C,kCAAmC,OAAO,CAAA"}

package/dist/types/common/session/session-entity.d.ts

@@ -1,7 +1,7 @@
 export class SessionEntity {
     /**
      * Create a self-managing Session Entity. This entity is scoped to the agent which triggered it, allowing for multiple simultaneous session objects to exist.
-     * There is one "namespace" an agent can store data in LS -- NRBA_{key}. If there are two agents on one page, and they both use the same key, they could overwrite each other since they would both use the same namespace in LS by default.
+    * Session data is stored at NRBA_SESSION::{key}, where key can be app-scoped by the caller to avoid collisions across multiple agents on the same origin.
      * The value can be overridden in the constructor, but will default to a unique 16 character hex string
      * expiresMs and inactiveMs are used to "expire" the session, but can be overridden in the constructor. Pass 0 to disable expiration timers.
      */

package/dist/types/common/session/session-key.d.ts

@@ -0,0 +1,2 @@
+export function getAppSessionHash(licenseKey: any, applicationID: any): string;
+//# sourceMappingURL=session-key.d.ts.map

package/dist/types/common/session/session-key.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-key.d.ts","sourceRoot":"","sources":["../../../../src/common/session/session-key.js"],"names":[],"mappings":"AAcA,+EAEC"}

package/dist/types/features/page_view_event/aggregate/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/features/page_view_event/aggregate/index.js"],"names":[],"mappings":"AAwBA;IACE,2BAA2C;IAE3C,2BA4BC;IAzBC,iBAAoB;IAEpB,wBAAwB;IACxB,8BAA8B;IAC9B,8BAA8B;IAC9B,gBAAgB;IAsBlB;;;;OAIG;IACH,2BAFW,GAAC,QAiEX;IAbC;;;;;;;;;;;;;;mBAOC;IANC,iCAAyB;IAc7B,kCAEC;IAED;;;;;;aAiGC;CACF;8BAzN6B,4BAA4B"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/features/page_view_event/aggregate/index.js"],"names":[],"mappings":"AAuBA;IACE,2BAA2C;IAE3C,2BAwBC;IArBC,iBAAoB;IAEpB,wBAAwB;IACxB,8BAA8B;IAC9B,8BAA8B;IAC9B,gBAAgB;IAkBlB;;;;OAIG;IACH,2BAFW,GAAC,QAiEX;IAbC;;;;;;;;;;;;;;mBAOC;IANC,iCAAyB;IAc7B,kCAEC;IAED;;;;;;aAiGC;CACF;8BArN6B,4BAA4B"}

package/dist/types/features/session_replay/instrument/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/features/session_replay/instrument/index.js"],"names":[],"mappings":"AAiBA;IACE,2BAAiC;IAMjC,2BAgCC;IAnCD,+CAA+C;IAC/C,cAAQ;IA8BF,sBAAwB;IAmB9B;;;OAGG;IACH,+BAkBC;;CAgBF;AAED,8CAAuC;+BArGR,6BAA6B"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/features/session_replay/instrument/index.js"],"names":[],"mappings":"AAkBA;IACE,2BAAiC;IAMjC,2BAiCC;IApCD,+CAA+C;IAC/C,cAAQ;IA+BF,sBAAwB;IAmB9B;;;OAGG;IACH,+BAkBC;;CAgBF;AAED,8CAAuC;+BAtGR,6BAA6B"}

package/dist/types/features/utils/agent-session.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"agent-session.d.ts","sourceRoot":"","sources":["../../../../src/features/utils/agent-session.js"],"names":[],"mappings":"AAiBA,sDA0DC"}
+{"version":3,"file":"agent-session.d.ts","sourceRoot":"","sources":["../../../../src/features/utils/agent-session.js"],"names":[],"mappings":"AAiBA,sDA2DC"}

package/dist/types/features/utils/aggregate-base.d.ts

@@ -58,11 +58,6 @@ export class AggregateBase extends FeatureBase {
         sent?: boolean | undefined;
         retry?: boolean | undefined;
     }): void;
-    /**
-     * Checks for additional `jsAttributes` items to support backward compatibility with implementations of the agent where
-     * loader configurations may appear after the loader code is executed.
-     */
-    checkConfiguration(existingAgent: any): void;
     /**
      * These are actions related to shared resources that should be initialized once by whichever feature Aggregate subclass loads first.
      * This method should run after checkConfiguration, which may reset the agent's info/runtime object that is used here.

package/dist/types/features/utils/aggregate-base.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"aggregate-base.d.ts","sourceRoot":"","sources":["../../../../src/features/utils/aggregate-base.js"],"names":[],"mappings":"AAkBA;IACE;;;;OAIG;IACH,sBAHW,MAAM,eACN,MAAM,EAmBhB;IAZC,uOAAuO;IACvO,qCAAwC;IACxC,gLAAgL;IAChL,yBAA2B;IAC3B,sFAAsF;IACtF,oBAAuB;IAEvB,gBAAqB;IAqBjB,YAAsE;IAW5E,iNAAiN;IACjN,0CAEC;IAED;;;;OAIG;IACH,8BAHU,MAAM,CAKf;IAED,qBAOC;IAFG,6BAAmB;IAIvB;;;;OAIG;IACH,2BAOC;IAED;;;;OAIG;IACH,yBAHW,MAAM,EAAE,gBAwBlB;IAED;;OAEG;IACH,cAEC;IAED,qCAEC;IAED;;;;;;OAMG;IACH,uDAJW,MAAM,GAAC,SAAS,SAsB1B;IAED;;;;;OAKG;IACH,4BAHG;QAAyB,IAAI,GAArB,OAAO,YAAC;QACS,KAAK,GAAtB,OAAO,YAAC;KAClB,QAKA;IAED;;;OAGG;IACH,6CAsBC;IAED;;;OAGG;IACH,2CAKC;IAHC,gBAA6C;IAK/C;;;;OAIG;IACH,uCAHW,GAAC,UACD,GAAC,QAIX;;CACF;4BAlO2B,gBAAgB"}
+{"version":3,"file":"aggregate-base.d.ts","sourceRoot":"","sources":["../../../../src/features/utils/aggregate-base.js"],"names":[],"mappings":"AAeA;IACE;;;;OAIG;IACH,sBAHW,MAAM,eACN,MAAM,EAkBhB;IAZC,uOAAuO;IACvO,qCAAwC;IACxC,gLAAgL;IAChL,yBAA2B;IAC3B,sFAAsF;IACtF,oBAAuB;IAEvB,gBAAqB;IAqBjB,YAAsE;IAW5E,iNAAiN;IACjN,0CAEC;IAED;;;;OAIG;IACH,8BAHU,MAAM,CAKf;IAED,qBAOC;IAFG,6BAAmB;IAIvB;;;;OAIG;IACH,2BAOC;IAED;;;;OAIG;IACH,yBAHW,MAAM,EAAE,gBAwBlB;IAED;;OAEG;IACH,cAEC;IAED,qCAEC;IAED;;;;;;OAMG;IACH,uDAJW,MAAM,GAAC,SAAS,SAsB1B;IAED;;;;;OAKG;IACH,4BAHG;QAAyB,IAAI,GAArB,OAAO,YAAC;QACS,KAAK,GAAtB,OAAO,YAAC;KAClB,QAKA;IAED;;;OAGG;IACH,2CAKC;IAHC,gBAA6C;IAK/C;;;;OAIG;IACH,uCAHW,GAAC,UACD,GAAC,QAIX;;CACF;4BAlM2B,gBAAgB"}

package/dist/types/features/utils/instrument-base.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"instrument-base.d.ts","sourceRoot":"","sources":["../../../../src/features/utils/instrument-base.js"],"names":[],"mappings":"AAuBA;;;GAGG;AACH;IACE;;;;OAIG;IACH,sBAHW,MAAM,eACN,MAAM,EA0ChB;IArCC,8IAA8I;IAC9I,cADW,WAAW,SAAS,CACF;IAE7B;;;MAGE;IACF,eAHU,OAAO,kBAAkB,EAAE,aAAa,CAGpB;IAE9B;;;MAGE;IACF,iCAAmC;IACnC,kCAEE;IAEF;;;MAGE;IACF,uBAAiC;IAiBnC;;;;;;;OAOG;IACH,2BALW,MAAM,qDAEN,MAAM,QAqDhB;;CAmBF;4BA5I2B,gBAAgB"}
+{"version":3,"file":"instrument-base.d.ts","sourceRoot":"","sources":["../../../../src/features/utils/instrument-base.js"],"names":[],"mappings":"AA4BA;;;GAGG;AACH;IACE;;;;OAIG;IACH,sBAHW,MAAM,eACN,MAAM,EA0ChB;IArCC,8IAA8I;IAC9I,cADW,WAAW,SAAS,CACF;IAE7B;;;MAGE;IACF,eAHU,OAAO,kBAAkB,EAAE,aAAa,CAGpB;IAE9B;;;MAGE;IACF,iCAAmC;IACnC,kCAEE;IAEF;;;MAGE;IACF,uBAAiC;IAiBnC;;;;;;;OAOG;IACH,2BALW,MAAM,qDAEN,MAAM,QA6DhB;;CAiDF;4BAvL2B,gBAAgB"}

package/dist/types/loaders/api-base.d.ts

@@ -182,7 +182,7 @@ export class ApiBase {
     };
     /**
      * Accepts or rejects consent when the agent is configured to require consent before harvesting.
-     * The consent state is stored in session storage inside the NRBA_SESSION object.
+      * The consent state is stored in the agent session object in browser storage.
      * {@link https://docs.newrelic.com/docs/browser/new-relic-browser/browser-apis/consent/}
      * @param {boolean?} accept Whether to accept or reject consent. Defaults to true (accept) if left undefined.
      */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@newrelic/browser-agent",
-  "version": "1.315.0",
+  "version": "1.316.0",
   "private": false,
   "author": "New Relic Browser Agent Team <browser-agent@newrelic.com>",
   "description": "New Relic Browser Agent",

package/src/common/session/constants.js

@@ -1,9 +1,8 @@
 /**
- * Copyright 2020-2025 New Relic, Inc. All rights reserved.
+ * Copyright 2020-2026 New Relic, Inc. All rights reserved.
  * SPDX-License-Identifier: Apache-2.0
  */
-export const PREFIX = 'NRBA'
-export const DEFAULT_KEY = 'SESSION'
+export const SESSION_STORAGE_KEY_PREFIX = 'NRBA_SESSION::'
 export const DEFAULT_EXPIRES_MS = 14400000
 export const DEFAULT_INACTIVE_MS = 1800000
 

package/src/common/session/session-entity.js

@@ -7,7 +7,7 @@ import { warn } from '../util/console'
 import { stringify } from '../util/stringify'
 import { Timer } from '../timer/timer'
 import { isBrowserScope } from '../constants/runtime'
-import { DEFAULT_EXPIRES_MS, DEFAULT_INACTIVE_MS, MODE, PREFIX, SESSION_EVENTS, SESSION_EVENT_TYPES } from './constants'
+import { DEFAULT_EXPIRES_MS, DEFAULT_INACTIVE_MS, MODE, SESSION_EVENTS, SESSION_EVENT_TYPES, SESSION_STORAGE_KEY_PREFIX } from './constants'
 import { InteractionTimer } from '../timer/interaction-timer'
 import { wrapEvents } from '../wrap/wrap-events'
 import { getModeledObject } from '../config/configurable'
@@ -39,7 +39,7 @@ const model = {
 export class SessionEntity {
   /**
    * Create a self-managing Session Entity. This entity is scoped to the agent which triggered it, allowing for multiple simultaneous session objects to exist.
-   * There is one "namespace" an agent can store data in LS -- NRBA_{key}. If there are two agents on one page, and they both use the same key, they could overwrite each other since they would both use the same namespace in LS by default.
+  * Session data is stored at NRBA_SESSION::{key}, where key can be app-scoped by the caller to avoid collisions across multiple agents on the same origin.
    * The value can be overridden in the constructor, but will default to a unique 16 character hex string
    * expiresMs and inactiveMs are used to "expire" the session, but can be overridden in the constructor. Pass 0 to disable expiration timers.
    */
@@ -160,7 +160,7 @@ export class SessionEntity {
 
   // This is the actual key appended to the storage API
   get lookupKey () {
-    return `${PREFIX}_${this.key}`
+    return `${SESSION_STORAGE_KEY_PREFIX}${this.key}`
   }
 
   sync (data) {

package/src/common/session/session-key.js

@@ -0,0 +1,17 @@
+/**
+ * Copyright 2020-2026 New Relic, Inc. All rights reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+// Deterministic 32-bit FNV-1a hash, rendered as a fixed 8-char hex string.
+function hashTo8Hex (value) {
+  let hash = 0x811c9dc5
+  for (let i = 0; i < value.length; i++) {
+    hash ^= value.charCodeAt(i)
+    hash = Math.imul(hash, 0x01000193)
+  }
+  return (hash >>> 0).toString(16).padStart(8, '0')
+}
+
+export function getAppSessionHash (licenseKey, applicationID) {
+  return hashTo8Hex(`${String(licenseKey)}:${String(applicationID)}`)
+}

package/src/features/page_view_event/aggregate/index.js

@@ -5,7 +5,6 @@
 import { globalScope, isBrowserScope, originTime, getNavigationEntry } from '../../../common/constants/runtime'
 import { addPT, addPN } from '../../../common/timing/nav-timing'
 import { stringify } from '../../../common/util/stringify'
-import { isValid } from '../../../common/config/info'
 import * as CONSTANTS from '../constants'
 import { getActivatedFeaturesFlags } from './initialized-features'
 import { activateFeatures } from '../../../common/util/feature-flags'
@@ -35,10 +34,6 @@ export class Aggregate extends AggregateBase {
     this.firstByteToDomContent = 0 // our "dom processing" duration
     this.retries = 0
 
-    if (!isValid(agentRef.info)) {
-      this.ee.abort()
-      return warn(43)
-    }
     agentRef.runtime.timeKeeper = new TimeKeeper(agentRef.runtime.session)
 
     if (isBrowserScope) {

package/src/features/session_replay/instrument/index.js

@@ -1,5 +1,5 @@
 /**
- * Copyright 2020-2025 New Relic, Inc. All rights reserved.
+ * Copyright 2020-2026 New Relic, Inc. All rights reserved.
  * SPDX-License-Identifier: Apache-2.0
  */
 /**
@@ -7,7 +7,8 @@
  */
 
 import { handle } from '../../../common/event-emitter/handle'
-import { DEFAULT_KEY, MODE, PREFIX } from '../../../common/session/constants'
+import { MODE, SESSION_STORAGE_KEY_PREFIX } from '../../../common/session/constants'
+import { getAppSessionHash } from '../../../common/session/session-key'
 import { InstrumentBase } from '../../utils/instrument-base'
 import { hasReplayPrerequisite, isPreloadAllowed } from '../shared/utils'
 import { ERROR_DURING_REPLAY, FEATURE_NAME, TRIGGERS } from '../constants'
@@ -30,8 +31,9 @@ export class Instrument extends InstrumentBase {
     setupPauseReplayAPI(agentRef)
 
     let session
+    const fullNamespacedKey = `${SESSION_STORAGE_KEY_PREFIX}${getAppSessionHash(agentRef.info.licenseKey, agentRef.info.applicationID)}`
     try {
-      session = JSON.parse(localStorage.getItem(`${PREFIX}_${DEFAULT_KEY}`))
+      session = JSON.parse(localStorage.getItem(fullNamespacedKey))
     } catch (err) { }
 
     if (hasReplayPrerequisite(agentRef.init)) {

package/src/features/utils/agent-session.js

@@ -6,7 +6,7 @@ import { drain } from '../../common/drain/drain'
 import { registerHandler } from '../../common/event-emitter/register-handler'
 import { SessionEntity } from '../../common/session/session-entity'
 import { LocalStorage } from '../../common/storage/local-storage.js'
-import { DEFAULT_KEY } from '../../common/session/constants'
+import { getAppSessionHash } from '../../common/session/session-key'
 import { mergeInfo } from '../../common/config/info'
 import { trackObjectAttributeSize } from '../../common/util/attribute-size'
 import { handle } from '../../common/event-emitter/handle'
@@ -19,10 +19,11 @@ export function setupAgentSession (agentRef) {
   if (agentRef.runtime.session) return agentRef.runtime.session // already setup
 
   const sessionInit = agentRef.init.session
+  const namespacedKey = getAppSessionHash(agentRef.info.licenseKey, agentRef.info.applicationID)
 
   agentRef.runtime.session = new SessionEntity({
     agentRef,
-    key: DEFAULT_KEY,
+    key: namespacedKey,
     storage: new LocalStorage(),
     expiresMs: sessionInit?.expiresMs,
     inactiveMs: sessionInit?.inactiveMs

package/src/features/utils/aggregate-base.js

@@ -3,9 +3,6 @@
  * SPDX-License-Identifier: Apache-2.0
  */
 import { FeatureBase } from './feature-base'
-import { isValid } from '../../common/config/info'
-import { configure } from '../../loaders/configure/configure'
-import { gosCDN } from '../../common/window/nreum'
 import { drain } from '../../common/drain/drain'
 import { Obfuscator } from '../../common/util/obfuscate'
 import { FEATURE_NAMES } from '../../loaders/features/features'
@@ -24,7 +21,6 @@ export class AggregateBase extends FeatureBase {
    */
   constructor (agentRef, featureName) {
     super(agentRef, featureName)
-    this.checkConfiguration(agentRef)
     this.doOnceForAllAggregate(agentRef)
 
     /** @type {Boolean} indicates if custom attributes are combined in each event payload for size estimation purposes. this is set to true in derived classes that need to evaluate custom attributes separately from the event payload */
@@ -181,34 +177,6 @@ export class AggregateBase extends FeatureBase {
     this.events.clearSave(this.harvestOpts)
   }
 
-  /**
-   * Checks for additional `jsAttributes` items to support backward compatibility with implementations of the agent where
-   * loader configurations may appear after the loader code is executed.
-   */
-  checkConfiguration (existingAgent) {
-    // NOTE: This check has to happen at aggregator load time
-    if (!isValid(existingAgent.info)) {
-      const cdn = gosCDN()
-      let jsAttributes = { ...cdn.info?.jsAttributes }
-      try {
-        jsAttributes = {
-          ...jsAttributes,
-          ...existingAgent.info?.jsAttributes
-        }
-      } catch (err) {
-        // do nothing
-      }
-      configure(existingAgent, {
-        ...cdn,
-        info: {
-          ...cdn.info,
-          jsAttributes
-        },
-        runtime: existingAgent.runtime
-      }, existingAgent.runtime.loaderType)
-    }
-  }
-
   /**
    * These are actions related to shared resources that should be initialized once by whichever feature Aggregate subclass loads first.
    * This method should run after checkConfiguration, which may reset the agent's info/runtime object that is used here.

package/src/features/utils/instrument-base.js

@@ -5,8 +5,8 @@
 
 /**
  * @file Defines `InstrumentBase` to be used as the super of the Instrument classes implemented by each feature.
- * Inherits and executes the `checkConfiguration` method from [FeatureBase]{@link ./feature-base}, which also
- * exposes the `blocked` property.
+ * Validates and loads feature aggregates, including a one-time late configuration check before import.
+ * Inherits `blocked` behavior from [FeatureBase]{@link ./feature-base}.
  */
 
 import { drain, registerDrain } from '../../common/drain/drain'
@@ -14,6 +14,9 @@ import { FeatureBase } from './feature-base'
 import { onWindowLoad } from '../../common/window/load'
 import { isBrowserScope } from '../../common/constants/runtime'
 import { warn } from '../../common/util/console'
+import { isValid } from '../../common/config/info'
+import { configure } from '../../loaders/configure/configure'
+import { gosCDN } from '../../common/window/nreum'
 import { FEATURE_NAMES } from '../../loaders/features/features'
 import { hasReplayPrerequisite } from '../session_replay/shared/utils'
 import { canEnableSessionTracking } from './feature-gates'
@@ -21,6 +24,8 @@ import { single } from '../../common/util/invoke'
 import { SESSION_ERROR } from '../../common/constants/agent-constants'
 import { handle } from '../../common/event-emitter/handle'
 
+const checkedAgents = new WeakSet()
+
 /**
  * Base class for instrumenting a feature.
  * @extends FeatureBase
@@ -90,6 +95,14 @@ export class InstrumentBase extends FeatureBase {
       // or otherwise when the manual-start-all event is emitted by the start API
       await this.deferred
 
+      this.#checkConfiguration(agentRef) // check for late-appearing 'info' config on the page
+      if (!isValid(agentRef.info)) { // if there still isn't valid info, then we can't proceed with session setup or importing the aggregates
+        warn(43)
+        agentRef.ee.abort()
+        this.loadedSuccessfully(false)
+        return
+      }
+
       let session
       try {
         if (canEnableSessionTracking(agentRef.init)) { // would require some setup before certain features start
@@ -150,4 +163,34 @@ export class InstrumentBase extends FeatureBase {
         return true
     }
   }
+
+  /**
+   * Checks for additional `jsAttributes` items to support backward compatibility with implementations of the agent where
+   * loader configurations may appear after the loader code is executed.
+   */
+  #checkConfiguration (existingAgent) {
+    if (checkedAgents.has(existingAgent)) return
+    checkedAgents.add(existingAgent)
+    // NOTE: This check has to happen at load time
+    if (!isValid(existingAgent.info)) {
+      const cdn = gosCDN()
+      let jsAttributes = { ...cdn.info?.jsAttributes }
+      try {
+        jsAttributes = {
+          ...jsAttributes,
+          ...existingAgent.info?.jsAttributes
+        }
+      } catch (err) {
+        // do nothing
+      }
+      configure(existingAgent, {
+        ...cdn,
+        info: {
+          ...cdn.info,
+          jsAttributes
+        },
+        runtime: existingAgent.runtime
+      }, existingAgent.runtime.loaderType)
+    }
+  }
 }

package/src/loaders/api-base.js

@@ -230,7 +230,7 @@ export class ApiBase {
 
   /**
    * Accepts or rejects consent when the agent is configured to require consent before harvesting.
-   * The consent state is stored in session storage inside the NRBA_SESSION object.
+    * The consent state is stored in the agent session object in browser storage.
    * {@link https://docs.newrelic.com/docs/browser/new-relic-browser/browser-apis/consent/}
    * @param {boolean?} accept Whether to accept or reject consent. Defaults to true (accept) if left undefined.
    */