@newrelic/browser-agent 1.316.0-rc.6 → 1.317.0

package/dist/cjs/features/soft_navigations/aggregate/ajax-node.js

@@ -5,6 +5,7 @@ Object.defineProperty(exports, "__esModule", {
 });
 exports.AjaxNode = void 0;
 var _belSerializer = require("../../../common/serialize/bel-serializer");
+var _payloads = require("../../../common/payloads/payloads");
 var _constants = require("../../ajax/constants");
 var _constants2 = require("../constants");
 var _belNode = require("./bel-node");
@@ -31,6 +32,12 @@ class AjaxNode extends _belNode.BelNode {
     this.targetAttributes = ajaxEvent.targetAttributes;
     this[_constants.AJAX_ID] = ajaxEvent[_constants.AJAX_ID]; // all AjaxRequest events should have a unique identifier to allow for easier grouping and analysis in the UI
 
+    // optional payload metadata attributes
+    this.requestBody = ajaxEvent.requestBody;
+    this.requestHeaders = ajaxEvent.requestHeaders;
+    this.requestQuery = ajaxEvent.requestQuery;
+    this.responseBody = ajaxEvent.responseBody;
+    this.responseHeaders = ajaxEvent.responseHeaders;
     this.start = ajaxEvent.startTime;
     this.end = ajaxEvent.endTime;
     if (ajaxContext?.latestLongtaskEnd) {
@@ -39,7 +46,10 @@ class AjaxNode extends _belNode.BelNode {
     } else this.callbackEnd = this.end; // if no long task was observed, callbackEnd is the same as end
   }
   serialize(parentStartTimestamp, agentRef, ajaxObfuscator) {
-    const addString = (0, _belSerializer.getAddStringContext)(ajaxObfuscator);
+    const {
+      addString,
+      addStringWithTruncation
+    } = (0, _payloads.createStringAdders)(_belSerializer.getAddStringContext, ajaxObfuscator);
     const nodeList = [];
 
     // IMPORTANT: The order in which addString is called matters and correlates to the order in which string shows up in the harvest payload. Do not re-order the following code.
@@ -54,11 +64,32 @@ class AjaxNode extends _belNode.BelNode {
     (0, _belSerializer.numeric)(this.callbackDuration),
     // not relative
     addString(this.method), (0, _belSerializer.numeric)(this.status), addString(this.domain), addString(this.path), (0, _belSerializer.numeric)(this.txSize), (0, _belSerializer.numeric)(this.rxSize), this.requestedWith, addString(this.nodeId), (0, _belSerializer.nullable)(this.spanId, addString, true) + (0, _belSerializer.nullable)(this.traceId, addString, true) + (0, _belSerializer.nullable)(this.spanTimestamp, _belSerializer.numeric)];
-    let allAttachedNodes = (0, _belSerializer.addCustomAttributes)({
-      ...(this.gql || {}),
+    // Regular attributes: obfuscate only
+    const regularAttrs = (0, _belSerializer.addCustomAttributes)({
+      [_constants.AJAX_ID]: this[_constants.AJAX_ID],
       ...(this.targetAttributes || {}),
-      [_constants.AJAX_ID]: this[_constants.AJAX_ID]
+      ...(this.gql || {})
     }, addString);
+
+    // Payload attributes: obfuscate then truncate
+    const payloadAttrs = (0, _belSerializer.addCustomAttributes)({
+      ...(this.requestBody ? {
+        requestBody: this.requestBody
+      } : {}),
+      ...(this.requestHeaders ? {
+        requestHeaders: this.requestHeaders
+      } : {}),
+      ...(this.requestQuery ? {
+        requestQuery: this.requestQuery
+      } : {}),
+      ...(this.responseBody ? {
+        responseBody: this.responseBody
+      } : {}),
+      ...(this.responseHeaders ? {
+        responseHeaders: this.responseHeaders
+      } : {})
+    }, addStringWithTruncation);
+    let allAttachedNodes = [...regularAttrs, ...payloadAttrs];
     this.children.forEach(node => allAttachedNodes.push(node.serialize())); // no children is expected under ajax nodes at this time
 
     fields[1] = (0, _belSerializer.numeric)(allAttachedNodes.length);

package/dist/cjs/features/soft_navigations/aggregate/initial-page-load-interaction.js

@@ -11,7 +11,7 @@ var _firstPaint = require("../../../common/vitals/first-paint");
 var _firstContentfulPaint = require("../../../common/vitals/first-contentful-paint");
 var _constants = require("../constants");
 /**
- * Copyright 2020-2025 New Relic, Inc. All rights reserved.
+ * Copyright 2020-2026 New Relic, Inc. All rights reserved.
  * SPDX-License-Identifier: Apache-2.0
  */
 

package/dist/esm/common/config/init-types.js

@@ -11,6 +11,7 @@
  * @property {boolean} [ajax.block_internal] - If true, agent requests going to harvest endpoint are treated as on deny list. In other words, agent will not self-report AJAX.
  * @property {boolean} [ajax.enabled] - Turn on/off the ajax feature (on by default).
  * @property {boolean} [ajax.autoStart] - If true, the agent will automatically start the ajax feature. Otherwise, it will be in a deferred state until the `start` API method is called.
+ * @property {('none'|'failures'|'all')} [ajax.capture_payloads] - Controls when AJAX request/response payloads are captured. 'none' = never capture, 'failures' = capture only on errors (4xx, 5xx, network errors, GraphQL errors), 'all' = always capture.
  * @property {Object} [api]
  * @property {Object} [api.register]
  * @property {boolean} [api.register.enabled] - If true, the agent will allow registered children to be sent to the server.

package/dist/esm/common/config/init.js

@@ -3,6 +3,7 @@
  * SPDX-License-Identifier: Apache-2.0
  */
 import { FEATURE_FLAGS } from '../../features/generic_events/constants';
+import { CAPTURE_PAYLOAD_SETTINGS } from '../../features/ajax/constants';
 import { isValidSelector } from '../dom/query-selector';
 import { DEFAULT_EXPIRES_MS, DEFAULT_INACTIVE_MS } from '../session/constants';
 import { warn } from '../util/console';
@@ -51,7 +52,8 @@ const InitModelFn = () => {
       deny_list: undefined,
       block_internal: true,
       enabled: true,
-      autoStart: true
+      autoStart: true,
+      capture_payloads: CAPTURE_PAYLOAD_SETTINGS.NONE
     },
     api: {
       register: {

package/dist/esm/common/constants/env.cdn.js

@@ -11,7 +11,7 @@
 /**
  * Exposes the version of the agent
  */
-export const VERSION = "1.316.0-rc.6";
+export const VERSION = "1.317.0";
 
 /**
  * Exposes the build type of the agent

package/dist/esm/common/constants/env.npm.js

@@ -11,7 +11,7 @@
 /**
  * Exposes the version of the agent
  */
-export const VERSION = "1.316.0-rc.6";
+export const VERSION = "1.317.0";
 
 /**
  * Exposes the build type of the agent

package/dist/esm/common/payloads/payloads.js

@@ -0,0 +1,118 @@
+/**
+ * Copyright 2020-2026 New Relic, Inc. All rights reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+import { stringify } from '../util/stringify';
+import { CAPTURE_PAYLOAD_SETTINGS } from '../../features/ajax/constants';
+
+/**
+ * Determines whether payload data should be captured based on the capture mode setting,
+ * HTTP status code, and GraphQL error status.
+ * @param {string} captureMode - The capture mode setting ('none', 'all', or 'failures')
+ * @param {number} statusCode - The HTTP status code
+ * @param {boolean} hasGQLErrors - Whether the response contains GraphQL errors
+ * @returns {boolean} True if payload should be captured
+ */
+export function canCapturePayload(captureMode, statusCode, hasGQLErrors) {
+  if (captureMode === CAPTURE_PAYLOAD_SETTINGS.ALL) return true;
+  if (!captureMode || captureMode === CAPTURE_PAYLOAD_SETTINGS.NONE) return false;
+
+  // Default "failures" mode
+  return statusCode === 0 || statusCode >= 400 || hasGQLErrors === true;
+}
+
+/**
+ * Parses a query string into an object of key-value pairs.
+ * @param {string} search a query string starting with "?" or without (ex. new URL(...).search)
+ * @returns {Object|undefined} Parsed query parameters as key-value pairs. Returns undefined if no valid parameters are found.
+ */
+export function parseQueryString(search) {
+  if (!search || search.length === 0) return;
+  const queryParams = {};
+  try {
+    const searchParams = new URLSearchParams(search);
+    searchParams.forEach(function (value, key) {
+      queryParams[key] = value;
+    });
+  } catch (e) {
+    // Fallback for environments without URLSearchParams
+  }
+  return queryParams;
+}
+
+/**
+ * Determines if the given content type is likely to be human-readable (text-based).
+ * @param {Object} headers - The headers object containing content-type
+ * @param {*} data - The data to check
+ * @returns {boolean} True if the content type is human-readable (text-based)
+ */
+export function isLikelyHumanReadable(headers, data) {
+  if (!headers) return typeof data === 'string';
+  var contentType = headers['content-type'];
+  if (!contentType) return typeof data === 'string';
+  // Normalize to lowercase and extract the mime type (ignore charset, etc.)
+  var mimeType = contentType.toLowerCase().split(';')[0].trim();
+
+  // Check for text/* types
+  if (mimeType.indexOf('text/') === 0) return true;
+
+  // Check for specific application/* types
+  var readableAppTypes = ['/json', '/xml', '/xhtml+xml', '/ld+json', '/yaml', '/x-www-form-urlencoded'];
+  for (var i = 0; i < readableAppTypes.length; i++) {
+    if (mimeType === 'application' + readableAppTypes[i]) return true;
+  }
+  return false;
+}
+
+/**
+ * Truncates a string to ensure its UTF-8 byte length does not exceed 4092 bytes.  If truncation is necessary,
+ * the string is cut off at a character boundary to avoid breaking multi-byte characters and " ..." is appended to indicate truncation.
+ * If not a string, it is first converted to a string using JSON.stringify.
+ * @param {*} data The data to truncate.
+ * @returns {string}
+ */
+export function truncateAsString(data) {
+  if (!data) return data;
+  try {
+    if (typeof data !== 'string') data = stringify(data);
+    let bytes = 0;
+    let i = 0;
+    let needsEllipsis = false;
+    while (i < data.length) {
+      const c = data.charCodeAt(i);
+      const charBytes = c < 0x80 ? 1 : c < 0x800 ? 2 : c < 0xD800 || c >= 0xE000 ? 3 : 4;
+      if (bytes + charBytes > 4092) {
+        needsEllipsis = true;
+        break;
+      }
+      bytes += charBytes;
+      i += charBytes === 4 ? 2 : 1;
+    }
+    return data.slice(0, i) + (needsEllipsis ? ' ...' : '');
+  } catch (e) {
+    return data;
+  }
+}
+
+/**
+ * Creates string adder functions for BEL serialization with obfuscation and optional truncation.
+ * This ensures a single string table is used while providing separate handling for regular vs payload attributes.
+ * @param {Function} getAddStringContext - Function that creates a new string table context
+ * @param {Object} obfuscator - Optional obfuscator instance for string obfuscation
+ * @returns {{addString: Function, addStringWithTruncation: Function}} Object containing both string adder functions
+ */
+export function createStringAdders(getAddStringContext, obfuscator) {
+  const addStringRaw = getAddStringContext();
+  const processString = (str, shouldTruncate) => {
+    if (typeof str === 'undefined' || str === '') return addStringRaw(str);
+    if (typeof str !== 'string') str = stringify(str);
+    const obfuscated = obfuscator?.obfuscateString(str) ?? str;
+    const processed = shouldTruncate ? truncateAsString(obfuscated) : obfuscated;
+    return addStringRaw(processed);
+  };
+  return {
+    addString: str => processString(str, false),
+    addStringWithTruncation: str => processString(str, true)
+  };
+}

package/dist/esm/common/serialize/bel-serializer.js

@@ -15,13 +15,14 @@ export function numeric(n, noDefault) {
   }
   return n === undefined || n === 0 ? '' : Math.floor(n).toString(36);
 }
-export function getAddStringContext(obfuscator) {
+export function getAddStringContext(obfuscator, truncator) {
   let stringTableIdx = 0;
   const stringTable = Object.prototype.hasOwnProperty.call(Object, 'create') ? Object.create(null) : {};
   return addString;
   function addString(str) {
     if (typeof str === 'undefined' || str === '') return '';
     str = obfuscator?.obfuscateString(String(str)) ?? String(str);
+    str = truncator?.(str) ?? str;
     if (hasOwnProp.call(stringTable, str)) {
       return numeric(stringTable[str], true);
     } else {

package/dist/esm/common/util/data-size.js

@@ -1,5 +1,5 @@
 /**
- * Copyright 2020-2025 New Relic, Inc. All rights reserved.
+ * Copyright 2020-2026 New Relic, Inc. All rights reserved.
  * SPDX-License-Identifier: Apache-2.0
  */
 
@@ -12,7 +12,7 @@ import { stringify } from './stringify';
  * @returns {(number|undefined)} - The size of the data or undefined if size cannot be determined.
  */
 export function dataSize(data) {
-  if (typeof data === 'string' && data.length) return data.length;
+  if (typeof data === 'string') return data.length;
   if (typeof data !== 'object') return undefined;
   // eslint-disable-next-line
   if (typeof ArrayBuffer !== 'undefined' && data instanceof ArrayBuffer && data.byteLength) return data.byteLength;

package/dist/esm/common/wrap/wrap-xhr.js

@@ -16,7 +16,7 @@ import { globalScope } from '../constants/runtime';
 import { warn } from '../util/console';
 import { findTargetsFromStackTrace } from '../v2/utils';
 const wrapped = {};
-const XHR_PROPS = ['open', 'send']; // these are the specific funcs being wrapped on all XMLHttpRequests(.prototype)
+const XHR_PROPS = ['open', 'send', 'setRequestHeader']; // these are the specific funcs being wrapped on all XMLHttpRequests(.prototype)
 
 /**
  * Wraps the native XMLHttpRequest (XHR) object to emit custom events to its readystatechange event and an assortment

package/dist/esm/features/ajax/aggregate/gql.js

@@ -1,5 +1,5 @@
 /**
- * Copyright 2020-2025 New Relic, Inc. All rights reserved.
+ * Copyright 2020-2026 New Relic, Inc. All rights reserved.
  * SPDX-License-Identifier: Apache-2.0
  */
 import { isPureObject } from '../../../common/util/type-check';
@@ -89,4 +89,42 @@ function parseGQLQueryString(gqlQueryString) {
 }
 function validateGQLObject(obj) {
   return !(typeof obj !== 'object' || !obj.query || typeof obj.query !== 'string');
+}
+
+/**
+ * Checks if a response object has valid GraphQL errors.
+ * @param {object} response - A single GraphQL response object
+ * @returns {boolean} True if the response has valid errors
+ */
+function hasValidGQLErrors(response) {
+  return Array.isArray(response?.errors) && response.errors.some(err => err && typeof err === 'object' && typeof err.message === 'string');
+}
+
+/**
+ * Checks if a response body contains GraphQL errors according to the GraphQL spec.
+ * A valid GraphQL error response contains an "errors" array with at least one error object.
+ * Supports both single and batched GraphQL responses.
+ * @param {string|object|array} [responseBody] The response body to check
+ * @returns {boolean} True if the response contains GraphQL errors
+ */
+export function hasGQLErrors(responseBody) {
+  if (!responseBody) return false;
+  try {
+    let parsed = responseBody;
+
+    // Parse string to object if needed
+    if (typeof responseBody === 'string') {
+      parsed = JSON.parse(responseBody);
+    }
+
+    // Handle batched GraphQL responses (array of response objects)
+    if (Array.isArray(parsed)) {
+      return parsed.some(hasValidGQLErrors);
+    }
+
+    // Handle single GraphQL response
+    return hasValidGQLErrors(parsed);
+  } catch (err) {
+    return false;
+  }
 }

package/dist/esm/features/ajax/aggregate/index.js

@@ -6,12 +6,13 @@ import { registerHandler } from '../../../common/event-emitter/register-handler'
 import { stringify } from '../../../common/util/stringify';
 import { handle } from '../../../common/event-emitter/handle';
 import { setDenyList, shouldCollectEvent } from '../../../common/deny-list/deny-list';
-import { AJAX_ID, FEATURE_NAME } from '../constants';
+import { FEATURE_NAME, AJAX_ID } from '../constants';
 import { FEATURE_NAMES } from '../../../loaders/features/features';
 import { AggregateBase } from '../../utils/aggregate-base';
-import { parseGQL } from './gql';
 import { nullable, numeric, getAddStringContext, addCustomAttributes } from '../../../common/serialize/bel-serializer';
 import { gosNREUMOriginals } from '../../../common/window/nreum';
+import { hasGQLErrors, parseGQL } from './gql';
+import { canCapturePayload, isLikelyHumanReadable, parseQueryString, createStringAdders } from '../../../common/payloads/payloads';
 import { Obfuscator } from '../../../common/util/obfuscate';
 import { getVersion2Attributes, getVersion2DuplicationAttributes, shouldDuplicate } from '../../../common/v2/utils';
 import { EVENT_TYPES } from '../../../common/constants/events';
@@ -89,17 +90,26 @@ export class Aggregate extends AggregateBase {
       callbackDuration: metrics.cbTime,
       [AJAX_ID]: generateUuid() // all AjaxRequest events should have a unique identifier to allow for easier grouping and analysis in the UI
     };
+    event.gql = params.gql = parseGQL({
+      body: ctx.requestBody,
+      query: ctx.parsedOrigin?.search
+    });
+    if (event.gql) event.gql.operationHasErrors = params.gql.operationHasErrors = hasGQLErrors(ctx.responseBody);
+    const capturePayloadSetting = this.agentRef.init.ajax.capture_payloads;
+    const shouldCapturePayload = canCapturePayload(capturePayloadSetting, params.status, event.gql?.operationHasErrors);
+    if (shouldCapturePayload) {
+      // Store raw data; obfuscation and truncation will happen in the serializer
+      params.requestQuery = event.requestQuery = parseQueryString(ctx.parsedOrigin?.search);
+      params.requestHeaders = event.requestHeaders = ctx.requestHeaders;
+      params.responseHeaders = event.responseHeaders = ctx.responseHeaders;
+      if (isLikelyHumanReadable(ctx.requestHeaders, ctx.requestBody)) params.requestBody = event.requestBody = ctx.requestBody;
+      if (isLikelyHumanReadable(ctx.responseHeaders, ctx.responseBody)) params.responseBody = event.responseBody = ctx.responseBody;
+    }
     if (ctx.dt) {
       event.spanId = ctx.dt.spanId;
       event.traceId = ctx.dt.traceId;
       event.spanTimestamp = Math.floor(this.agentRef.runtime.timeKeeper.correctAbsoluteTimestamp(ctx.dt.timestamp));
     }
-
-    // parsed from the AJAX body, looking for operationName param & parsing query for operationType
-    event.gql = params.gql = parseGQL({
-      body: ctx.body,
-      query: ctx.parsedOrigin?.search
-    });
     if (event.gql) this.reportSupportabilityMetric('Ajax/Events/GraphQL/Bytes-Added', stringify(event.gql).length);
 
     /** make a copy of the event for the MFE target if it exists */
@@ -127,7 +137,10 @@ export class Aggregate extends AggregateBase {
   }
   serializer(eventBuffer) {
     if (!eventBuffer.length) return;
-    const addString = getAddStringContext(this.obfuscator);
+    const {
+      addString,
+      addStringWithTruncation
+    } = createStringAdders(getAddStringContext, this.obfuscator);
     let payload = 'bel.7;';
     let firstTimestamp = 0;
     for (let i = 0; i < eventBuffer.length; i++) {
@@ -152,15 +165,35 @@ export class Aggregate extends AggregateBase {
       // Since configuration objects (like info) are created new each time they are set, we have to grab the current pointer to the attr object here.
       const jsAttributes = this.agentRef.info.jsAttributes;
 
-      // add custom attributes
-      // gql decorators are added as custom attributes to alleviate need for new BEL schema
-      const attrParts = addCustomAttributes({
+      // Regular attributes: obfuscate only
+      const regularAttrs = addCustomAttributes({
         ...(jsAttributes || {}),
-        ...(event.gql || {}),
+        [AJAX_ID]: event[AJAX_ID],
+        // all AjaxRequest events should have a unique identifier to allow for easier grouping and analysis in the UI
         ...(event.targetAttributes || {}),
         // used to supply the version 2 attributes, either MFE target or duplication attributes for the main agent app
-        [AJAX_ID]: event[AJAX_ID] // all AjaxRequest events should have a unique identifier to allow for easier grouping and analysis in the UI
+        ...(event.gql || {})
       }, addString);
+
+      // Payload attributes: obfuscate then truncate
+      const payloadAttrs = addCustomAttributes({
+        ...(event.requestBody ? {
+          requestBody: event.requestBody
+        } : {}),
+        ...(event.requestHeaders ? {
+          requestHeaders: event.requestHeaders
+        } : {}),
+        ...(event.requestQuery ? {
+          requestQuery: event.requestQuery
+        } : {}),
+        ...(event.responseBody ? {
+          responseBody: event.responseBody
+        } : {}),
+        ...(event.responseHeaders ? {
+          responseHeaders: event.responseHeaders
+        } : {})
+      }, addStringWithTruncation);
+      const attrParts = [...regularAttrs, ...payloadAttrs];
       fields.unshift(numeric(attrParts.length));
       insert += fields.join(',');
       if (attrParts && attrParts.length > 0) {

package/dist/esm/features/ajax/constants.js

@@ -4,4 +4,9 @@
  */
 import { FEATURE_NAMES } from '../../loaders/features/features';
 export const FEATURE_NAME = FEATURE_NAMES.ajax;
+export const CAPTURE_PAYLOAD_SETTINGS = {
+  NONE: 'none',
+  FAILURES: 'failures',
+  ALL: 'all'
+};
 export const AJAX_ID = 'ajaxRequest.id';

package/dist/esm/features/ajax/instrument/index.js

@@ -14,7 +14,7 @@ import { parseUrl } from '../../../common/url/parse-url';
 import { DT } from './distributed-tracing';
 import { responseSizeFromXhr } from './response-size';
 import { InstrumentBase } from '../../utils/instrument-base';
-import { FEATURE_NAME } from '../constants';
+import { CAPTURE_PAYLOAD_SETTINGS, FEATURE_NAME } from '../constants';
 import { FEATURE_NAMES } from '../../../loaders/features/features';
 import { SUPPORTABILITY_METRIC } from '../../metrics/constants';
 import { now } from '../../../common/timing/now';
@@ -25,6 +25,7 @@ var handlersLen = handlers.length;
 var origRequest = gosNREUMOriginals().o.REQ;
 var origXHR = gosNREUMOriginals().o.XHR;
 const NR_CAT_HEADER = 'X-NewRelic-App-Data';
+const INTERNAL_ERROR = 'internal-error';
 export class Instrument extends InstrumentBase {
   static featureName = FEATURE_NAME;
   constructor(agentRef) {
@@ -70,10 +71,12 @@ export class Instrument extends InstrumentBase {
   }
 }
 function subscribeToEvents(agentRef, ee, handler, dt) {
+  const shouldInterceptPayloads = [CAPTURE_PAYLOAD_SETTINGS.ALL, CAPTURE_PAYLOAD_SETTINGS.FAILURES].includes(agentRef.init.ajax?.capture_payloads);
   ee.on('new-xhr', onNewXhr);
   ee.on('open-xhr-start', onOpenXhrStart);
   ee.on('open-xhr-end', onOpenXhrEnd);
   ee.on('send-xhr-start', onSendXhrStart);
+  ee.on('setRequestHeader-xhr-start', onSetRequestHeader);
   ee.on('xhr-cb-time', onXhrCbTime);
   ee.on('xhr-load-added', onXhrLoadAdded);
   ee.on('xhr-load-removed', onXhrLoadRemoved);
@@ -145,6 +148,13 @@ function subscribeToEvents(agentRef, ee, handler, dt) {
       }
     }
   }
+  function onSetRequestHeader(args, xhr) {
+    // args[0] = header name, args[1] = header value
+    if (shouldInterceptPayloads && args.length >= 2) {
+      this.requestHeaders ??= {};
+      this.requestHeaders[args[0].toLowerCase()] = args[1];
+    }
+  }
   function onSendXhrStart(args, xhr) {
     var metrics = this.metrics;
     var data = args[0];
@@ -154,7 +164,7 @@ function subscribeToEvents(agentRef, ee, handler, dt) {
       if (size) metrics.txSize = size;
     }
     this.startTime = now();
-    this.body = data;
+    this.requestBody = data;
     this.listener = function (evt) {
       try {
         if (evt.type === 'abort' && !context.loadCaptureCalled) {
@@ -163,7 +173,7 @@ function subscribeToEvents(agentRef, ee, handler, dt) {
         if (evt.type !== 'load' || context.called === context.totalCbs && (context.onloadCalled || typeof xhr.onload !== 'function') && typeof context.end === 'function') context.end(xhr);
       } catch (e) {
         try {
-          ee.emit('internal-error', [e]);
+          ee.emit(INTERNAL_ERROR, [e]);
         } catch (err) {
           // do nothing
         }
@@ -291,8 +301,27 @@ function subscribeToEvents(agentRef, ee, handler, dt) {
     addUrl(this, extractUrl(target));
     const method = ('' + (target && target instanceof origRequest && target.method || opts.method || 'GET')).toUpperCase();
     this.params.method = method;
-    this.body = opts.body;
-    this.txSize = dataSize(opts.body) || 0;
+    this.txSize = dataSize(opts.body || target?.body) || 0;
+
+    // Capture request headers
+    try {
+      var headers = opts.headers || target?.headers;
+      if (shouldInterceptPayloads && headers) {
+        this.requestHeaders ??= {};
+        if (headers instanceof Headers) {
+          headers.forEach(function (value, key) {
+            this.requestHeaders[key.toLowerCase()] = value;
+          }.bind(this));
+        } else if (typeof headers === 'object') {
+          for (var key in headers) {
+            this.requestHeaders[key.toLowerCase()] = headers[key];
+          }
+        }
+      }
+    } catch (e) {
+      // Silently fail if we can't access headers
+    }
+    this.requestBody = opts.body || target?.body;
   }
 
   // we capture failed call as status 0, the actual error is ignored
@@ -303,19 +332,45 @@ function subscribeToEvents(agentRef, ee, handler, dt) {
     if (hasUndefinedHostname(this.params)) return; // don't bother with fetch to url with no hostname
 
     this.params.status = res ? res.status : 0;
+    const finishAndReport = () => {
+      // convert rxSize to a number - handle both string (from content-length header) and number (from fallback)
+      const num = +this.rxSize;
+      const responseSize = this.rxSize != null && !isNaN(num) ? num : undefined;
+      const metrics = {
+        txSize: this.txSize,
+        rxSize: responseSize,
+        duration: this.endTime - this.startTime
+      };
+      const payload = [this.params, metrics, this.startTime, this.endTime, 'fetch'];
+      this.targets.forEach(target => reportToAgg(payload, this, target));
+    };
 
-    // convert rxSize to a number
-    let responseSize;
-    if (typeof this.rxSize === 'string' && this.rxSize.length > 0) {
-      responseSize = +this.rxSize;
+    /** Since accessing fetch bodies is an async process, these are
+     * reasonable conditions to check to not do needless extra work */
+    if (!res || !shouldInterceptPayloads) {
+      finishAndReport();
+      return;
     }
-    const metrics = {
-      txSize: this.txSize,
-      rxSize: responseSize,
-      duration: now() - this.startTime
-    };
-    const payload = [this.params, metrics, this.startTime, this.endTime, 'fetch'];
-    this.targets.forEach(target => reportToAgg(payload, this, target));
+
+    // Clone the response to read the body without consuming the original
+    res.clone().text().then(text => {
+      this.responseBody = text;
+      // Use captured payload size as fallback if content-length header was missing or is 0 with a body
+      // Only apply fallback for non-network-error responses (status !== 0)
+      if ((!this.rxSize || this.rxSize === '0' || this.rxSize === 0) && text !== undefined && this.params.status !== 0) {
+        this.rxSize = dataSize(text);
+      }
+      if (res?.headers) {
+        this.responseHeaders = {};
+        res.headers.forEach(function (value, key) {
+          this.responseHeaders[key.toLowerCase()] = value;
+        }.bind(this));
+      }
+    }).catch(err => {
+      ee.emit(INTERNAL_ERROR, [err]);
+    }).finally(() => {
+      finishAndReport();
+    });
   }
 
   // Create report for XHR request that has finished
@@ -330,7 +385,7 @@ function subscribeToEvents(agentRef, ee, handler, dt) {
     if (params.aborted) return;
     if (hasUndefinedHostname(params)) return; // don't bother with XHR of url with no hostname
 
-    metrics.duration = now() - this.startTime;
+    metrics.duration = this.endTime - this.startTime;
     if (!this.loadCaptureCalled && xhr.readyState === 4) {
       captureXhrData(this, xhr);
     } else if (params.status == null) {
@@ -339,6 +394,25 @@ function subscribeToEvents(agentRef, ee, handler, dt) {
 
     // Always send cbTime, even if no noticeable time was taken.
     metrics.cbTime = this.cbTime;
+    if (shouldInterceptPayloads) {
+      try {
+        this.responseBody = xhr.responseText;
+      } catch (e) {
+        this.responseBody = xhr.response;
+      }
+
+      // Use captured payload size as fallback if not already determined or is 0 with a body
+      // Only apply fallback for non-network-error responses (status !== 0)
+      if ((!metrics.rxSize || metrics.rxSize === 0) && this.responseBody !== undefined && params.status !== 0) {
+        const size = dataSize(this.responseBody);
+        if (size !== undefined) metrics.rxSize = size;
+      }
+      try {
+        this.responseHeaders = parseResponseHeaders(xhr.getAllResponseHeaders());
+      } catch (err) {
+        ee.emit(INTERNAL_ERROR, [err]);
+      }
+    }
     const payload = [params, metrics, this.startTime, this.endTime, 'xhr'];
     this.targets.forEach(target => reportToAgg(payload, this, target));
   }
@@ -348,7 +422,8 @@ function subscribeToEvents(agentRef, ee, handler, dt) {
   function captureXhrData(ctx, xhr) {
     ctx.params.status = xhr.status;
     var size = responseSizeFromXhr(xhr, ctx.lastSize);
-    if (size) ctx.metrics.rxSize = size;
+    // Don't set rxSize for network errors (status 0)
+    if (size !== undefined && xhr.status !== 0) ctx.metrics.rxSize = size;
     if (ctx.sameOrigin && xhr.getAllResponseHeaders().indexOf(NR_CAT_HEADER) >= 0) {
       var header = xhr.getResponseHeader(NR_CAT_HEADER);
       if (header) {
@@ -370,4 +445,17 @@ function addUrl(ctx, url) {
   ctx.parsedOrigin = parsed;
   ctx.sameOrigin = parsed.sameOrigin;
 }
+function parseResponseHeaders(headerStr) {
+  const headers = {};
+  if (!headerStr) return headers;
+  headerStr.split('\r\n').forEach(function (line) {
+    const separatorIndex = line.indexOf(': ');
+    if (separatorIndex > 0) {
+      const name = line.substring(0, separatorIndex);
+      const value = line.substring(separatorIndex + 2);
+      headers[name.toLowerCase()] = value;
+    }
+  });
+  return headers;
+}
 export const Ajax = Instrument;