@newrelic/browser-agent 1.316.0-rc.6 → 1.317.0

package/CHANGELOG.md

@@ -3,6 +3,21 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [1.317.0](https://github.com/newrelic/newrelic-browser-agent/compare/v1.316.0...v1.317.0) (2026-06-18)
+
+
+### Features
+
+* Detect and report AJAX payloads ([#1651](https://github.com/newrelic/newrelic-browser-agent/issues/1651)) ([08394db](https://github.com/newrelic/newrelic-browser-agent/commit/08394db8a5a9f2b6fd627e9eee76022977cb433c))
+* Enhance obfuscation to support event filter ([#1782](https://github.com/newrelic/newrelic-browser-agent/issues/1782)) ([c97aaf9](https://github.com/newrelic/newrelic-browser-agent/commit/c97aaf9773cfb0b62a810eb07b37e6f5b96d5ab5))
+
+
+### Bug Fixes
+
+* Calculate browser_stack_hash from truncated stack trace ([#1789](https://github.com/newrelic/newrelic-browser-agent/issues/1789)) ([f7df627](https://github.com/newrelic/newrelic-browser-agent/commit/f7df627b14e3e5e8fa4a8d94433ea76e9a9902bb))
+* Get responseBodySize from body if content-length is missing ([#1793](https://github.com/newrelic/newrelic-browser-agent/issues/1793)) ([58663ec](https://github.com/newrelic/newrelic-browser-agent/commit/58663ec19dc99ec94e34c17a5dfaa20a07038dba))
+* Patch handling of inlining images for Session Replay ([#1765](https://github.com/newrelic/newrelic-browser-agent/issues/1765)) ([b330f8e](https://github.com/newrelic/newrelic-browser-agent/commit/b330f8e3e35f2fda076967092bcb70e792de6eeb))
+
 ## [1.316.0](https://github.com/newrelic/newrelic-browser-agent/compare/v1.315.0...v1.316.0) (2026-06-01)
 
 

package/dist/cjs/common/config/init-types.js

@@ -16,6 +16,7 @@ exports.default = void 0;
  * @property {boolean} [ajax.block_internal] - If true, agent requests going to harvest endpoint are treated as on deny list. In other words, agent will not self-report AJAX.
  * @property {boolean} [ajax.enabled] - Turn on/off the ajax feature (on by default).
  * @property {boolean} [ajax.autoStart] - If true, the agent will automatically start the ajax feature. Otherwise, it will be in a deferred state until the `start` API method is called.
+ * @property {('none'|'failures'|'all')} [ajax.capture_payloads] - Controls when AJAX request/response payloads are captured. 'none' = never capture, 'failures' = capture only on errors (4xx, 5xx, network errors, GraphQL errors), 'all' = always capture.
  * @property {Object} [api]
  * @property {Object} [api.register]
  * @property {boolean} [api.register.enabled] - If true, the agent will allow registered children to be sent to the server.

package/dist/cjs/common/config/init.js

@@ -5,8 +5,9 @@ Object.defineProperty(exports, "__esModule", {
 });
 exports.mergeInit = void 0;
 var _constants = require("../../features/generic_events/constants");
+var _constants2 = require("../../features/ajax/constants");
 var _querySelector = require("../dom/query-selector");
-var _constants2 = require("../session/constants");
+var _constants3 = require("../session/constants");
 var _console = require("../util/console");
 var _configurable = require("./configurable");
 /**
@@ -57,7 +58,8 @@ const InitModelFn = () => {
       deny_list: undefined,
       block_internal: true,
       enabled: true,
-      autoStart: true
+      autoStart: true,
+      capture_payloads: _constants2.CAPTURE_PAYLOAD_SETTINGS.NONE
     },
     api: {
       register: {
@@ -141,8 +143,8 @@ const InitModelFn = () => {
       beacon: undefined
     },
     session: {
-      expiresMs: _constants2.DEFAULT_EXPIRES_MS,
-      inactiveMs: _constants2.DEFAULT_INACTIVE_MS
+      expiresMs: _constants3.DEFAULT_EXPIRES_MS,
+      inactiveMs: _constants3.DEFAULT_INACTIVE_MS
     },
     session_replay: {
       autoStart: true,

package/dist/cjs/common/constants/env.cdn.js

@@ -17,7 +17,7 @@ exports.VERSION = exports.RRWEB_VERSION = exports.RRWEB_PACKAGE_NAME = exports.D
 /**
  * Exposes the version of the agent
  */
-const VERSION = exports.VERSION = "1.316.0-rc.6";
+const VERSION = exports.VERSION = "1.317.0";
 
 /**
  * Exposes the build type of the agent

package/dist/cjs/common/constants/env.npm.js

@@ -17,7 +17,7 @@ exports.VERSION = exports.RRWEB_VERSION = exports.RRWEB_PACKAGE_NAME = exports.D
 /**
  * Exposes the version of the agent
  */
-const VERSION = exports.VERSION = "1.316.0-rc.6";
+const VERSION = exports.VERSION = "1.317.0";
 
 /**
  * Exposes the build type of the agent

package/dist/cjs/common/payloads/payloads.js

@@ -0,0 +1,127 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.canCapturePayload = canCapturePayload;
+exports.createStringAdders = createStringAdders;
+exports.isLikelyHumanReadable = isLikelyHumanReadable;
+exports.parseQueryString = parseQueryString;
+exports.truncateAsString = truncateAsString;
+var _stringify = require("../util/stringify");
+var _constants = require("../../features/ajax/constants");
+/**
+ * Copyright 2020-2026 New Relic, Inc. All rights reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+/**
+ * Determines whether payload data should be captured based on the capture mode setting,
+ * HTTP status code, and GraphQL error status.
+ * @param {string} captureMode - The capture mode setting ('none', 'all', or 'failures')
+ * @param {number} statusCode - The HTTP status code
+ * @param {boolean} hasGQLErrors - Whether the response contains GraphQL errors
+ * @returns {boolean} True if payload should be captured
+ */
+function canCapturePayload(captureMode, statusCode, hasGQLErrors) {
+  if (captureMode === _constants.CAPTURE_PAYLOAD_SETTINGS.ALL) return true;
+  if (!captureMode || captureMode === _constants.CAPTURE_PAYLOAD_SETTINGS.NONE) return false;
+
+  // Default "failures" mode
+  return statusCode === 0 || statusCode >= 400 || hasGQLErrors === true;
+}
+
+/**
+ * Parses a query string into an object of key-value pairs.
+ * @param {string} search a query string starting with "?" or without (ex. new URL(...).search)
+ * @returns {Object|undefined} Parsed query parameters as key-value pairs. Returns undefined if no valid parameters are found.
+ */
+function parseQueryString(search) {
+  if (!search || search.length === 0) return;
+  const queryParams = {};
+  try {
+    const searchParams = new URLSearchParams(search);
+    searchParams.forEach(function (value, key) {
+      queryParams[key] = value;
+    });
+  } catch (e) {
+    // Fallback for environments without URLSearchParams
+  }
+  return queryParams;
+}
+
+/**
+ * Determines if the given content type is likely to be human-readable (text-based).
+ * @param {Object} headers - The headers object containing content-type
+ * @param {*} data - The data to check
+ * @returns {boolean} True if the content type is human-readable (text-based)
+ */
+function isLikelyHumanReadable(headers, data) {
+  if (!headers) return typeof data === 'string';
+  var contentType = headers['content-type'];
+  if (!contentType) return typeof data === 'string';
+  // Normalize to lowercase and extract the mime type (ignore charset, etc.)
+  var mimeType = contentType.toLowerCase().split(';')[0].trim();
+
+  // Check for text/* types
+  if (mimeType.indexOf('text/') === 0) return true;
+
+  // Check for specific application/* types
+  var readableAppTypes = ['/json', '/xml', '/xhtml+xml', '/ld+json', '/yaml', '/x-www-form-urlencoded'];
+  for (var i = 0; i < readableAppTypes.length; i++) {
+    if (mimeType === 'application' + readableAppTypes[i]) return true;
+  }
+  return false;
+}
+
+/**
+ * Truncates a string to ensure its UTF-8 byte length does not exceed 4092 bytes.  If truncation is necessary,
+ * the string is cut off at a character boundary to avoid breaking multi-byte characters and " ..." is appended to indicate truncation.
+ * If not a string, it is first converted to a string using JSON.stringify.
+ * @param {*} data The data to truncate.
+ * @returns {string}
+ */
+function truncateAsString(data) {
+  if (!data) return data;
+  try {
+    if (typeof data !== 'string') data = (0, _stringify.stringify)(data);
+    let bytes = 0;
+    let i = 0;
+    let needsEllipsis = false;
+    while (i < data.length) {
+      const c = data.charCodeAt(i);
+      const charBytes = c < 0x80 ? 1 : c < 0x800 ? 2 : c < 0xD800 || c >= 0xE000 ? 3 : 4;
+      if (bytes + charBytes > 4092) {
+        needsEllipsis = true;
+        break;
+      }
+      bytes += charBytes;
+      i += charBytes === 4 ? 2 : 1;
+    }
+    return data.slice(0, i) + (needsEllipsis ? ' ...' : '');
+  } catch (e) {
+    return data;
+  }
+}
+
+/**
+ * Creates string adder functions for BEL serialization with obfuscation and optional truncation.
+ * This ensures a single string table is used while providing separate handling for regular vs payload attributes.
+ * @param {Function} getAddStringContext - Function that creates a new string table context
+ * @param {Object} obfuscator - Optional obfuscator instance for string obfuscation
+ * @returns {{addString: Function, addStringWithTruncation: Function}} Object containing both string adder functions
+ */
+function createStringAdders(getAddStringContext, obfuscator) {
+  const addStringRaw = getAddStringContext();
+  const processString = (str, shouldTruncate) => {
+    if (typeof str === 'undefined' || str === '') return addStringRaw(str);
+    if (typeof str !== 'string') str = (0, _stringify.stringify)(str);
+    const obfuscated = obfuscator?.obfuscateString(str) ?? str;
+    const processed = shouldTruncate ? truncateAsString(obfuscated) : obfuscated;
+    return addStringRaw(processed);
+  };
+  return {
+    addString: str => processString(str, false),
+    addStringWithTruncation: str => processString(str, true)
+  };
+}

package/dist/cjs/common/serialize/bel-serializer.js

@@ -24,13 +24,14 @@ function numeric(n, noDefault) {
   }
   return n === undefined || n === 0 ? '' : Math.floor(n).toString(36);
 }
-function getAddStringContext(obfuscator) {
+function getAddStringContext(obfuscator, truncator) {
   let stringTableIdx = 0;
   const stringTable = Object.prototype.hasOwnProperty.call(Object, 'create') ? Object.create(null) : {};
   return addString;
   function addString(str) {
     if (typeof str === 'undefined' || str === '') return '';
     str = obfuscator?.obfuscateString(String(str)) ?? String(str);
+    str = truncator?.(str) ?? str;
     if (hasOwnProp.call(stringTable, str)) {
       return numeric(stringTable[str], true);
     } else {

package/dist/cjs/common/util/data-size.js

@@ -6,7 +6,7 @@ Object.defineProperty(exports, "__esModule", {
 exports.dataSize = dataSize;
 var _stringify = require("./stringify");
 /**
- * Copyright 2020-2025 New Relic, Inc. All rights reserved.
+ * Copyright 2020-2026 New Relic, Inc. All rights reserved.
  * SPDX-License-Identifier: Apache-2.0
  */
 
@@ -17,7 +17,7 @@ var _stringify = require("./stringify");
  * @returns {(number|undefined)} - The size of the data or undefined if size cannot be determined.
  */
 function dataSize(data) {
-  if (typeof data === 'string' && data.length) return data.length;
+  if (typeof data === 'string') return data.length;
   if (typeof data !== 'object') return undefined;
   // eslint-disable-next-line
   if (typeof ArrayBuffer !== 'undefined' && data instanceof ArrayBuffer && data.byteLength) return data.byteLength;

package/dist/cjs/common/wrap/wrap-xhr.js

@@ -23,7 +23,7 @@ var _utils = require("../v2/utils");
  */
 
 const wrapped = {};
-const XHR_PROPS = ['open', 'send']; // these are the specific funcs being wrapped on all XMLHttpRequests(.prototype)
+const XHR_PROPS = ['open', 'send', 'setRequestHeader']; // these are the specific funcs being wrapped on all XMLHttpRequests(.prototype)
 
 /**
  * Wraps the native XMLHttpRequest (XHR) object to emit custom events to its readystatechange event and an assortment

package/dist/cjs/features/ajax/aggregate/gql.js

@@ -3,10 +3,11 @@
 Object.defineProperty(exports, "__esModule", {
   value: true
 });
+exports.hasGQLErrors = hasGQLErrors;
 exports.parseGQL = parseGQL;
 var _typeCheck = require("../../../common/util/type-check");
 /**
- * Copyright 2020-2025 New Relic, Inc. All rights reserved.
+ * Copyright 2020-2026 New Relic, Inc. All rights reserved.
  * SPDX-License-Identifier: Apache-2.0
  */
 
@@ -95,4 +96,42 @@ function parseGQLQueryString(gqlQueryString) {
 }
 function validateGQLObject(obj) {
   return !(typeof obj !== 'object' || !obj.query || typeof obj.query !== 'string');
+}
+
+/**
+ * Checks if a response object has valid GraphQL errors.
+ * @param {object} response - A single GraphQL response object
+ * @returns {boolean} True if the response has valid errors
+ */
+function hasValidGQLErrors(response) {
+  return Array.isArray(response?.errors) && response.errors.some(err => err && typeof err === 'object' && typeof err.message === 'string');
+}
+
+/**
+ * Checks if a response body contains GraphQL errors according to the GraphQL spec.
+ * A valid GraphQL error response contains an "errors" array with at least one error object.
+ * Supports both single and batched GraphQL responses.
+ * @param {string|object|array} [responseBody] The response body to check
+ * @returns {boolean} True if the response contains GraphQL errors
+ */
+function hasGQLErrors(responseBody) {
+  if (!responseBody) return false;
+  try {
+    let parsed = responseBody;
+
+    // Parse string to object if needed
+    if (typeof responseBody === 'string') {
+      parsed = JSON.parse(responseBody);
+    }
+
+    // Handle batched GraphQL responses (array of response objects)
+    if (Array.isArray(parsed)) {
+      return parsed.some(hasValidGQLErrors);
+    }
+
+    // Handle single GraphQL response
+    return hasValidGQLErrors(parsed);
+  } catch (err) {
+    return false;
+  }
 }

package/dist/cjs/features/ajax/aggregate/index.js

@@ -11,9 +11,10 @@ var _denyList = require("../../../common/deny-list/deny-list");
 var _constants = require("../constants");
 var _features = require("../../../loaders/features/features");
 var _aggregateBase = require("../../utils/aggregate-base");
-var _gql = require("./gql");
 var _belSerializer = require("../../../common/serialize/bel-serializer");
 var _nreum = require("../../../common/window/nreum");
+var _gql = require("./gql");
+var _payloads = require("../../../common/payloads/payloads");
 var _obfuscate = require("../../../common/util/obfuscate");
 var _utils = require("../../../common/v2/utils");
 var _events = require("../../../common/constants/events");
@@ -96,17 +97,26 @@ class Aggregate extends _aggregateBase.AggregateBase {
       callbackDuration: metrics.cbTime,
       [_constants.AJAX_ID]: (0, _uniqueId.generateUuid)() // all AjaxRequest events should have a unique identifier to allow for easier grouping and analysis in the UI
     };
+    event.gql = params.gql = (0, _gql.parseGQL)({
+      body: ctx.requestBody,
+      query: ctx.parsedOrigin?.search
+    });
+    if (event.gql) event.gql.operationHasErrors = params.gql.operationHasErrors = (0, _gql.hasGQLErrors)(ctx.responseBody);
+    const capturePayloadSetting = this.agentRef.init.ajax.capture_payloads;
+    const shouldCapturePayload = (0, _payloads.canCapturePayload)(capturePayloadSetting, params.status, event.gql?.operationHasErrors);
+    if (shouldCapturePayload) {
+      // Store raw data; obfuscation and truncation will happen in the serializer
+      params.requestQuery = event.requestQuery = (0, _payloads.parseQueryString)(ctx.parsedOrigin?.search);
+      params.requestHeaders = event.requestHeaders = ctx.requestHeaders;
+      params.responseHeaders = event.responseHeaders = ctx.responseHeaders;
+      if ((0, _payloads.isLikelyHumanReadable)(ctx.requestHeaders, ctx.requestBody)) params.requestBody = event.requestBody = ctx.requestBody;
+      if ((0, _payloads.isLikelyHumanReadable)(ctx.responseHeaders, ctx.responseBody)) params.responseBody = event.responseBody = ctx.responseBody;
+    }
     if (ctx.dt) {
       event.spanId = ctx.dt.spanId;
       event.traceId = ctx.dt.traceId;
       event.spanTimestamp = Math.floor(this.agentRef.runtime.timeKeeper.correctAbsoluteTimestamp(ctx.dt.timestamp));
     }
-
-    // parsed from the AJAX body, looking for operationName param & parsing query for operationType
-    event.gql = params.gql = (0, _gql.parseGQL)({
-      body: ctx.body,
-      query: ctx.parsedOrigin?.search
-    });
     if (event.gql) this.reportSupportabilityMetric('Ajax/Events/GraphQL/Bytes-Added', (0, _stringify.stringify)(event.gql).length);
 
     /** make a copy of the event for the MFE target if it exists */
@@ -134,7 +144,10 @@ class Aggregate extends _aggregateBase.AggregateBase {
   }
   serializer(eventBuffer) {
     if (!eventBuffer.length) return;
-    const addString = (0, _belSerializer.getAddStringContext)(this.obfuscator);
+    const {
+      addString,
+      addStringWithTruncation
+    } = (0, _payloads.createStringAdders)(_belSerializer.getAddStringContext, this.obfuscator);
     let payload = 'bel.7;';
     let firstTimestamp = 0;
     for (let i = 0; i < eventBuffer.length; i++) {
@@ -159,15 +172,35 @@ class Aggregate extends _aggregateBase.AggregateBase {
       // Since configuration objects (like info) are created new each time they are set, we have to grab the current pointer to the attr object here.
       const jsAttributes = this.agentRef.info.jsAttributes;
 
-      // add custom attributes
-      // gql decorators are added as custom attributes to alleviate need for new BEL schema
-      const attrParts = (0, _belSerializer.addCustomAttributes)({
+      // Regular attributes: obfuscate only
+      const regularAttrs = (0, _belSerializer.addCustomAttributes)({
         ...(jsAttributes || {}),
-        ...(event.gql || {}),
+        [_constants.AJAX_ID]: event[_constants.AJAX_ID],
+        // all AjaxRequest events should have a unique identifier to allow for easier grouping and analysis in the UI
         ...(event.targetAttributes || {}),
         // used to supply the version 2 attributes, either MFE target or duplication attributes for the main agent app
-        [_constants.AJAX_ID]: event[_constants.AJAX_ID] // all AjaxRequest events should have a unique identifier to allow for easier grouping and analysis in the UI
+        ...(event.gql || {})
       }, addString);
+
+      // Payload attributes: obfuscate then truncate
+      const payloadAttrs = (0, _belSerializer.addCustomAttributes)({
+        ...(event.requestBody ? {
+          requestBody: event.requestBody
+        } : {}),
+        ...(event.requestHeaders ? {
+          requestHeaders: event.requestHeaders
+        } : {}),
+        ...(event.requestQuery ? {
+          requestQuery: event.requestQuery
+        } : {}),
+        ...(event.responseBody ? {
+          responseBody: event.responseBody
+        } : {}),
+        ...(event.responseHeaders ? {
+          responseHeaders: event.responseHeaders
+        } : {})
+      }, addStringWithTruncation);
+      const attrParts = [...regularAttrs, ...payloadAttrs];
       fields.unshift((0, _belSerializer.numeric)(attrParts.length));
       insert += fields.join(',');
       if (attrParts && attrParts.length > 0) {

package/dist/cjs/features/ajax/constants.js

@@ -3,7 +3,7 @@
 Object.defineProperty(exports, "__esModule", {
   value: true
 });
-exports.FEATURE_NAME = exports.AJAX_ID = void 0;
+exports.FEATURE_NAME = exports.CAPTURE_PAYLOAD_SETTINGS = exports.AJAX_ID = void 0;
 var _features = require("../../loaders/features/features");
 /**
  * Copyright 2020-2026 New Relic, Inc. All rights reserved.
@@ -11,4 +11,9 @@ var _features = require("../../loaders/features/features");
  */
 
 const FEATURE_NAME = exports.FEATURE_NAME = _features.FEATURE_NAMES.ajax;
+const CAPTURE_PAYLOAD_SETTINGS = exports.CAPTURE_PAYLOAD_SETTINGS = {
+  NONE: 'none',
+  FAILURES: 'failures',
+  ALL: 'all'
+};
 const AJAX_ID = exports.AJAX_ID = 'ajaxRequest.id';

package/dist/cjs/features/ajax/instrument/index.js

@@ -31,6 +31,7 @@ var handlersLen = handlers.length;
 var origRequest = (0, _nreum.gosNREUMOriginals)().o.REQ;
 var origXHR = (0, _nreum.gosNREUMOriginals)().o.XHR;
 const NR_CAT_HEADER = 'X-NewRelic-App-Data';
+const INTERNAL_ERROR = 'internal-error';
 class Instrument extends _instrumentBase.InstrumentBase {
   static featureName = _constants.FEATURE_NAME;
   constructor(agentRef) {
@@ -77,10 +78,12 @@ class Instrument extends _instrumentBase.InstrumentBase {
 }
 exports.Instrument = Instrument;
 function subscribeToEvents(agentRef, ee, handler, dt) {
+  const shouldInterceptPayloads = [_constants.CAPTURE_PAYLOAD_SETTINGS.ALL, _constants.CAPTURE_PAYLOAD_SETTINGS.FAILURES].includes(agentRef.init.ajax?.capture_payloads);
   ee.on('new-xhr', onNewXhr);
   ee.on('open-xhr-start', onOpenXhrStart);
   ee.on('open-xhr-end', onOpenXhrEnd);
   ee.on('send-xhr-start', onSendXhrStart);
+  ee.on('setRequestHeader-xhr-start', onSetRequestHeader);
   ee.on('xhr-cb-time', onXhrCbTime);
   ee.on('xhr-load-added', onXhrLoadAdded);
   ee.on('xhr-load-removed', onXhrLoadRemoved);
@@ -152,6 +155,13 @@ function subscribeToEvents(agentRef, ee, handler, dt) {
       }
     }
   }
+  function onSetRequestHeader(args, xhr) {
+    // args[0] = header name, args[1] = header value
+    if (shouldInterceptPayloads && args.length >= 2) {
+      this.requestHeaders ??= {};
+      this.requestHeaders[args[0].toLowerCase()] = args[1];
+    }
+  }
   function onSendXhrStart(args, xhr) {
     var metrics = this.metrics;
     var data = args[0];
@@ -161,7 +171,7 @@ function subscribeToEvents(agentRef, ee, handler, dt) {
       if (size) metrics.txSize = size;
     }
     this.startTime = (0, _now.now)();
-    this.body = data;
+    this.requestBody = data;
     this.listener = function (evt) {
       try {
         if (evt.type === 'abort' && !context.loadCaptureCalled) {
@@ -170,7 +180,7 @@ function subscribeToEvents(agentRef, ee, handler, dt) {
         if (evt.type !== 'load' || context.called === context.totalCbs && (context.onloadCalled || typeof xhr.onload !== 'function') && typeof context.end === 'function') context.end(xhr);
       } catch (e) {
         try {
-          ee.emit('internal-error', [e]);
+          ee.emit(INTERNAL_ERROR, [e]);
         } catch (err) {
           // do nothing
         }
@@ -298,8 +308,27 @@ function subscribeToEvents(agentRef, ee, handler, dt) {
     addUrl(this, (0, _extractUrl.extractUrl)(target));
     const method = ('' + (target && target instanceof origRequest && target.method || opts.method || 'GET')).toUpperCase();
     this.params.method = method;
-    this.body = opts.body;
-    this.txSize = (0, _dataSize.dataSize)(opts.body) || 0;
+    this.txSize = (0, _dataSize.dataSize)(opts.body || target?.body) || 0;
+
+    // Capture request headers
+    try {
+      var headers = opts.headers || target?.headers;
+      if (shouldInterceptPayloads && headers) {
+        this.requestHeaders ??= {};
+        if (headers instanceof Headers) {
+          headers.forEach(function (value, key) {
+            this.requestHeaders[key.toLowerCase()] = value;
+          }.bind(this));
+        } else if (typeof headers === 'object') {
+          for (var key in headers) {
+            this.requestHeaders[key.toLowerCase()] = headers[key];
+          }
+        }
+      }
+    } catch (e) {
+      // Silently fail if we can't access headers
+    }
+    this.requestBody = opts.body || target?.body;
   }
 
   // we capture failed call as status 0, the actual error is ignored
@@ -310,19 +339,45 @@ function subscribeToEvents(agentRef, ee, handler, dt) {
     if ((0, _denyList.hasUndefinedHostname)(this.params)) return; // don't bother with fetch to url with no hostname
 
     this.params.status = res ? res.status : 0;
+    const finishAndReport = () => {
+      // convert rxSize to a number - handle both string (from content-length header) and number (from fallback)
+      const num = +this.rxSize;
+      const responseSize = this.rxSize != null && !isNaN(num) ? num : undefined;
+      const metrics = {
+        txSize: this.txSize,
+        rxSize: responseSize,
+        duration: this.endTime - this.startTime
+      };
+      const payload = [this.params, metrics, this.startTime, this.endTime, 'fetch'];
+      this.targets.forEach(target => reportToAgg(payload, this, target));
+    };
 
-    // convert rxSize to a number
-    let responseSize;
-    if (typeof this.rxSize === 'string' && this.rxSize.length > 0) {
-      responseSize = +this.rxSize;
+    /** Since accessing fetch bodies is an async process, these are
+     * reasonable conditions to check to not do needless extra work */
+    if (!res || !shouldInterceptPayloads) {
+      finishAndReport();
+      return;
     }
-    const metrics = {
-      txSize: this.txSize,
-      rxSize: responseSize,
-      duration: (0, _now.now)() - this.startTime
-    };
-    const payload = [this.params, metrics, this.startTime, this.endTime, 'fetch'];
-    this.targets.forEach(target => reportToAgg(payload, this, target));
+
+    // Clone the response to read the body without consuming the original
+    res.clone().text().then(text => {
+      this.responseBody = text;
+      // Use captured payload size as fallback if content-length header was missing or is 0 with a body
+      // Only apply fallback for non-network-error responses (status !== 0)
+      if ((!this.rxSize || this.rxSize === '0' || this.rxSize === 0) && text !== undefined && this.params.status !== 0) {
+        this.rxSize = (0, _dataSize.dataSize)(text);
+      }
+      if (res?.headers) {
+        this.responseHeaders = {};
+        res.headers.forEach(function (value, key) {
+          this.responseHeaders[key.toLowerCase()] = value;
+        }.bind(this));
+      }
+    }).catch(err => {
+      ee.emit(INTERNAL_ERROR, [err]);
+    }).finally(() => {
+      finishAndReport();
+    });
   }
 
   // Create report for XHR request that has finished
@@ -337,7 +392,7 @@ function subscribeToEvents(agentRef, ee, handler, dt) {
     if (params.aborted) return;
     if ((0, _denyList.hasUndefinedHostname)(params)) return; // don't bother with XHR of url with no hostname
 
-    metrics.duration = (0, _now.now)() - this.startTime;
+    metrics.duration = this.endTime - this.startTime;
     if (!this.loadCaptureCalled && xhr.readyState === 4) {
       captureXhrData(this, xhr);
     } else if (params.status == null) {
@@ -346,6 +401,25 @@ function subscribeToEvents(agentRef, ee, handler, dt) {
 
     // Always send cbTime, even if no noticeable time was taken.
     metrics.cbTime = this.cbTime;
+    if (shouldInterceptPayloads) {
+      try {
+        this.responseBody = xhr.responseText;
+      } catch (e) {
+        this.responseBody = xhr.response;
+      }
+
+      // Use captured payload size as fallback if not already determined or is 0 with a body
+      // Only apply fallback for non-network-error responses (status !== 0)
+      if ((!metrics.rxSize || metrics.rxSize === 0) && this.responseBody !== undefined && params.status !== 0) {
+        const size = (0, _dataSize.dataSize)(this.responseBody);
+        if (size !== undefined) metrics.rxSize = size;
+      }
+      try {
+        this.responseHeaders = parseResponseHeaders(xhr.getAllResponseHeaders());
+      } catch (err) {
+        ee.emit(INTERNAL_ERROR, [err]);
+      }
+    }
     const payload = [params, metrics, this.startTime, this.endTime, 'xhr'];
     this.targets.forEach(target => reportToAgg(payload, this, target));
   }
@@ -355,7 +429,8 @@ function subscribeToEvents(agentRef, ee, handler, dt) {
   function captureXhrData(ctx, xhr) {
     ctx.params.status = xhr.status;
     var size = (0, _responseSize.responseSizeFromXhr)(xhr, ctx.lastSize);
-    if (size) ctx.metrics.rxSize = size;
+    // Don't set rxSize for network errors (status 0)
+    if (size !== undefined && xhr.status !== 0) ctx.metrics.rxSize = size;
     if (ctx.sameOrigin && xhr.getAllResponseHeaders().indexOf(NR_CAT_HEADER) >= 0) {
       var header = xhr.getResponseHeader(NR_CAT_HEADER);
       if (header) {
@@ -377,4 +452,17 @@ function addUrl(ctx, url) {
   ctx.parsedOrigin = parsed;
   ctx.sameOrigin = parsed.sameOrigin;
 }
+function parseResponseHeaders(headerStr) {
+  const headers = {};
+  if (!headerStr) return headers;
+  headerStr.split('\r\n').forEach(function (line) {
+    const separatorIndex = line.indexOf(': ');
+    if (separatorIndex > 0) {
+      const name = line.substring(0, separatorIndex);
+      const value = line.substring(separatorIndex + 2);
+      headers[name.toLowerCase()] = value;
+    }
+  });
+  return headers;
+}
 const Ajax = exports.Ajax = Instrument;

package/dist/cjs/features/jserrors/aggregate/format-stack-trace.js

@@ -6,7 +6,7 @@ Object.defineProperty(exports, "__esModule", {
 exports.formatStackTrace = formatStackTrace;
 exports.truncateSize = truncateSize;
 /**
- * Copyright 2020-2025 New Relic, Inc. All rights reserved.
+ * Copyright 2020-2026 New Relic, Inc. All rights reserved.
  * SPDX-License-Identifier: Apache-2.0
  */
 
@@ -16,7 +16,7 @@ function formatStackTrace(stackLines) {
   return truncateStackLines(stackLines).replace(stripNewlinesRegex, '');
 }
 
-// takes array of stack lines and returns string with top 50 and buttom 50 lines
+// takes array of stack lines and returns string with top 50 and bottom 50 lines
 function truncateStackLines(stackLines) {
   var stackString;
   if (stackLines.length > 100) {

package/dist/cjs/features/jserrors/aggregate/index.js

@@ -267,7 +267,7 @@ class Aggregate extends _aggregateBase.AggregateBase {
       params.stack_trace = (0, _formatStackTrace.truncateSize)(stackInfo.stackString);
       this.observedAt[bucketHash] = Math.floor(this.agentRef.runtime.timeKeeper.correctRelativeTimestamp(time));
     } else {
-      params.browser_stack_hash = (0, _stringHashCode.stringHashCode)(stackInfo.stackString);
+      params.browser_stack_hash = (0, _stringHashCode.stringHashCode)((0, _formatStackTrace.truncateSize)(stackInfo.stackString));
     }
     params.releaseIds = (0, _stringify.stringify)(this.agentRef.runtime.releaseIds);