@newrelic/browser-agent 1.316.0-rc.6 → 1.317.0

package/dist/esm/features/jserrors/aggregate/format-stack-trace.js

@@ -1,5 +1,5 @@
 /**
- * Copyright 2020-2025 New Relic, Inc. All rights reserved.
+ * Copyright 2020-2026 New Relic, Inc. All rights reserved.
  * SPDX-License-Identifier: Apache-2.0
  */
 
@@ -9,7 +9,7 @@ export function formatStackTrace(stackLines) {
   return truncateStackLines(stackLines).replace(stripNewlinesRegex, '');
 }
 
-// takes array of stack lines and returns string with top 50 and buttom 50 lines
+// takes array of stack lines and returns string with top 50 and bottom 50 lines
 function truncateStackLines(stackLines) {
   var stackString;
   if (stackLines.length > 100) {

package/dist/esm/features/jserrors/aggregate/index.js

@@ -262,7 +262,7 @@ export class Aggregate extends AggregateBase {
       params.stack_trace = truncateSize(stackInfo.stackString);
       this.observedAt[bucketHash] = Math.floor(this.agentRef.runtime.timeKeeper.correctRelativeTimestamp(time));
     } else {
-      params.browser_stack_hash = stringHashCode(stackInfo.stackString);
+      params.browser_stack_hash = stringHashCode(truncateSize(stackInfo.stackString));
     }
     params.releaseIds = stringify(this.agentRef.runtime.releaseIds);
 

package/dist/esm/features/soft_navigations/aggregate/ajax-node.js

@@ -3,6 +3,7 @@
  * SPDX-License-Identifier: Apache-2.0
  */
 import { addCustomAttributes, getAddStringContext, nullable, numeric } from '../../../common/serialize/bel-serializer';
+import { createStringAdders } from '../../../common/payloads/payloads';
 import { AJAX_ID } from '../../ajax/constants';
 import { NODE_TYPE } from '../constants';
 import { BelNode } from './bel-node';
@@ -24,6 +25,12 @@ export class AjaxNode extends BelNode {
     this.targetAttributes = ajaxEvent.targetAttributes;
     this[AJAX_ID] = ajaxEvent[AJAX_ID]; // all AjaxRequest events should have a unique identifier to allow for easier grouping and analysis in the UI
 
+    // optional payload metadata attributes
+    this.requestBody = ajaxEvent.requestBody;
+    this.requestHeaders = ajaxEvent.requestHeaders;
+    this.requestQuery = ajaxEvent.requestQuery;
+    this.responseBody = ajaxEvent.responseBody;
+    this.responseHeaders = ajaxEvent.responseHeaders;
     this.start = ajaxEvent.startTime;
     this.end = ajaxEvent.endTime;
     if (ajaxContext?.latestLongtaskEnd) {
@@ -32,7 +39,10 @@ export class AjaxNode extends BelNode {
     } else this.callbackEnd = this.end; // if no long task was observed, callbackEnd is the same as end
   }
   serialize(parentStartTimestamp, agentRef, ajaxObfuscator) {
-    const addString = getAddStringContext(ajaxObfuscator);
+    const {
+      addString,
+      addStringWithTruncation
+    } = createStringAdders(getAddStringContext, ajaxObfuscator);
     const nodeList = [];
 
     // IMPORTANT: The order in which addString is called matters and correlates to the order in which string shows up in the harvest payload. Do not re-order the following code.
@@ -47,11 +57,32 @@ export class AjaxNode extends BelNode {
     numeric(this.callbackDuration),
     // not relative
     addString(this.method), numeric(this.status), addString(this.domain), addString(this.path), numeric(this.txSize), numeric(this.rxSize), this.requestedWith, addString(this.nodeId), nullable(this.spanId, addString, true) + nullable(this.traceId, addString, true) + nullable(this.spanTimestamp, numeric)];
-    let allAttachedNodes = addCustomAttributes({
-      ...(this.gql || {}),
+    // Regular attributes: obfuscate only
+    const regularAttrs = addCustomAttributes({
+      [AJAX_ID]: this[AJAX_ID],
       ...(this.targetAttributes || {}),
-      [AJAX_ID]: this[AJAX_ID]
+      ...(this.gql || {})
     }, addString);
+
+    // Payload attributes: obfuscate then truncate
+    const payloadAttrs = addCustomAttributes({
+      ...(this.requestBody ? {
+        requestBody: this.requestBody
+      } : {}),
+      ...(this.requestHeaders ? {
+        requestHeaders: this.requestHeaders
+      } : {}),
+      ...(this.requestQuery ? {
+        requestQuery: this.requestQuery
+      } : {}),
+      ...(this.responseBody ? {
+        responseBody: this.responseBody
+      } : {}),
+      ...(this.responseHeaders ? {
+        responseHeaders: this.responseHeaders
+      } : {})
+    }, addStringWithTruncation);
+    let allAttachedNodes = [...regularAttrs, ...payloadAttrs];
     this.children.forEach(node => allAttachedNodes.push(node.serialize())); // no children is expected under ajax nodes at this time
 
     fields[1] = numeric(allAttachedNodes.length);

package/dist/esm/features/soft_navigations/aggregate/initial-page-load-interaction.js

@@ -1,5 +1,5 @@
 /**
- * Copyright 2020-2025 New Relic, Inc. All rights reserved.
+ * Copyright 2020-2026 New Relic, Inc. All rights reserved.
  * SPDX-License-Identifier: Apache-2.0
  */
 import { navTimingValues } from '../../../common/timing/nav-timing';

package/dist/tsconfig.tsbuildinfo

@@ -1 +1 @@
-{"root":["../src/index.js","../src/cdn/experimental.js","../src/cdn/lite.js","../src/cdn/pro.js","../src/cdn/spa.js","../src/common/aggregate/aggregator.js","../src/common/aggregate/event-aggregator.js","../src/common/config/configurable.js","../src/common/config/info.js","../src/common/config/init-types.js","../src/common/config/init.js","../src/common/config/loader-config.js","../src/common/config/runtime.js","../src/common/constants/agent-constants.js","../src/common/constants/env.cdn.js","../src/common/constants/env.js","../src/common/constants/env.npm.js","../src/common/constants/events.js","../src/common/constants/runtime.js","../src/common/constants/shared-channel.js","../src/common/deny-list/deny-list.js","../src/common/dispatch/global-event.js","../src/common/dom/iframe.js","../src/common/dom/query-selector.js","../src/common/dom/selector-path.js","../src/common/drain/drain.js","../src/common/event-emitter/contextual-ee.js","../src/common/event-emitter/event-context.js","../src/common/event-emitter/handle.js","../src/common/event-emitter/register-handler.js","../src/common/event-listener/event-listener-opts.js","../src/common/harvest/harvester.js","../src/common/harvest/types.js","../src/common/ids/bundle-id.js","../src/common/ids/id.js","../src/common/ids/unique-id.js","../src/common/serialize/bel-serializer.js","../src/common/session/constants.js","../src/common/session/session-entity.js","../src/common/session/session-key.js","../src/common/storage/local-storage.js","../src/common/timer/interaction-timer.js","../src/common/timer/timer.js","../src/common/timing/nav-timing.js","../src/common/timing/now.js","../src/common/timing/time-keeper.js","../src/common/unload/eol.js","../src/common/url/canonicalize-url.js","../src/common/url/clean-url.js","../src/common/url/encode.js","../src/common/url/extract-url.js","../src/common/url/location.js","../src/common/url/parse-url.js","../src/common/url/protocol.js","../src/common/util/attribute-size.js","../src/common/util/browser-stack-matchers.js","../src/common/util/console.js","../src/common/util/data-size.js","../src/common/util/event-origin.js","../src/common/util/feature-flags.js","../src/common/util/get-or-set.js","../src/common/util/invoke.js","../src/common/util/monkey-patched.js","../src/common/util/obfuscate.js","../src/common/util/short-circuit.js","../src/common/util/stringify.js","../src/common/util/submit-data.js","../src/common/util/text.js","../src/common/util/traverse.js","../src/common/util/type-check.js","../src/common/util/webdriver-detection.js","../src/common/v2/script-correlation.js","../src/common/v2/script-tracker.js","../src/common/v2/utils.js","../src/common/vitals/constants.js","../src/common/vitals/cumulative-layout-shift.js","../src/common/vitals/first-contentful-paint.js","../src/common/vitals/first-paint.js","../src/common/vitals/interaction-to-next-paint.js","../src/common/vitals/largest-contentful-paint.js","../src/common/vitals/load-time.js","../src/common/vitals/time-to-first-byte.js","../src/common/vitals/vital-metric.js","../src/common/window/load.js","../src/common/window/nreum.js","../src/common/window/page-visibility.js","../src/common/wrap/wrap-events.js","../src/common/wrap/wrap-fetch.js","../src/common/wrap/wrap-function.js","../src/common/wrap/wrap-history.js","../src/common/wrap/wrap-logger.js","../src/common/wrap/wrap-websocket.js","../src/common/wrap/wrap-xhr.js","../src/features/ajax/constants.js","../src/features/ajax/index.js","../src/features/ajax/aggregate/gql.js","../src/features/ajax/aggregate/index.js","../src/features/ajax/instrument/distributed-tracing.js","../src/features/ajax/instrument/index.js","../src/features/ajax/instrument/response-size.js","../src/features/generic_events/constants.js","../src/features/generic_events/index.js","../src/features/generic_events/aggregate/index.js","../src/features/generic_events/aggregate/user-actions/aggregated-user-action.js","../src/features/generic_events/aggregate/user-actions/user-actions-aggregator.js","../src/features/generic_events/instrument/index.js","../src/features/jserrors/constants.js","../src/features/jserrors/index.js","../src/features/jserrors/aggregate/canonical-function-name.js","../src/features/jserrors/aggregate/cause-string.js","../src/features/jserrors/aggregate/compute-stack-trace.js","../src/features/jserrors/aggregate/format-stack-trace.js","../src/features/jserrors/aggregate/index.js","../src/features/jserrors/aggregate/internal-errors.js","../src/features/jserrors/aggregate/string-hash-code.js","../src/features/jserrors/instrument/index.js","../src/features/jserrors/shared/cast-error.js","../src/features/jserrors/shared/uncaught-error.js","../src/features/logging/constants.js","../src/features/logging/index.js","../src/features/logging/aggregate/index.js","../src/features/logging/instrument/index.js","../src/features/logging/shared/log.js","../src/features/logging/shared/utils.js","../src/features/metrics/constants.js","../src/features/metrics/index.js","../src/features/metrics/aggregate/framework-detection.js","../src/features/metrics/aggregate/harvest-metadata.js","../src/features/metrics/aggregate/index.js","../src/features/metrics/instrument/index.js","../src/features/page_action/constants.js","../src/features/page_action/index.js","../src/features/page_action/instrument/index.js","../src/features/page_view_event/constants.js","../src/features/page_view_event/index.js","../src/features/page_view_event/aggregate/index.js","../src/features/page_view_event/aggregate/initialized-features.js","../src/features/page_view_event/instrument/index.js","../src/features/page_view_timing/constants.js","../src/features/page_view_timing/index.js","../src/features/page_view_timing/aggregate/index.js","../src/features/page_view_timing/instrument/index.js","../src/features/session_replay/constants.js","../src/features/session_replay/index.js","../src/features/session_replay/aggregate/index.js","../src/features/session_replay/instrument/index.js","../src/features/session_replay/shared/recorder-events.js","../src/features/session_replay/shared/recorder.js","../src/features/session_replay/shared/stylesheet-evaluator.js","../src/features/session_replay/shared/utils.js","../src/features/session_trace/constants.js","../src/features/session_trace/index.js","../src/features/session_trace/aggregate/index.js","../src/features/session_trace/aggregate/trace/node.js","../src/features/session_trace/aggregate/trace/storage.js","../src/features/session_trace/aggregate/trace/utils.js","../src/features/session_trace/instrument/index.js","../src/features/soft_navigations/constants.js","../src/features/soft_navigations/index.js","../src/features/soft_navigations/aggregate/ajax-node.js","../src/features/soft_navigations/aggregate/bel-node.js","../src/features/soft_navigations/aggregate/index.js","../src/features/soft_navigations/aggregate/initial-page-load-interaction.js","../src/features/soft_navigations/aggregate/interaction.js","../src/features/soft_navigations/instrument/index.js","../src/features/utils/agent-session.js","../src/features/utils/aggregate-base.js","../src/features/utils/event-buffer.js","../src/features/utils/feature-base.js","../src/features/utils/feature-gates.js","../src/features/utils/instrument-base.js","../src/interfaces/registered-entity.js","../src/loaders/agent-base.js","../src/loaders/agent.js","../src/loaders/api-base.js","../src/loaders/browser-agent.js","../src/loaders/micro-agent-base.js","../src/loaders/micro-agent.js","../src/loaders/api/addPageAction.js","../src/loaders/api/addRelease.js","../src/loaders/api/addToTrace.js","../src/loaders/api/consent.js","../src/loaders/api/constants.js","../src/loaders/api/finished.js","../src/loaders/api/interaction-types.js","../src/loaders/api/interaction.js","../src/loaders/api/log.js","../src/loaders/api/measure.js","../src/loaders/api/noticeError.js","../src/loaders/api/pauseReplay.js","../src/loaders/api/recordCustomEvent.js","../src/loaders/api/recordReplay.js","../src/loaders/api/register-api-types.js","../src/loaders/api/register.js","../src/loaders/api/setApplicationVersion.js","../src/loaders/api/setCustomAttribute.js","../src/loaders/api/setErrorHandler.js","../src/loaders/api/setPageViewName.js","../src/loaders/api/setUserId.js","../src/loaders/api/sharedHandlers.js","../src/loaders/api/start.js","../src/loaders/api/topLevelCallers.js","../src/loaders/api/wrapLogger.js","../src/loaders/configure/configure.js","../src/loaders/configure/nonce.js","../src/loaders/configure/public-path.js","../src/loaders/features/enabled-features.js","../src/loaders/features/featureDependencies.js","../src/loaders/features/features.js"],"version":"5.9.3"}
+{"root":["../src/index.js","../src/cdn/experimental.js","../src/cdn/lite.js","../src/cdn/pro.js","../src/cdn/spa.js","../src/common/aggregate/aggregator.js","../src/common/aggregate/event-aggregator.js","../src/common/config/configurable.js","../src/common/config/info.js","../src/common/config/init-types.js","../src/common/config/init.js","../src/common/config/loader-config.js","../src/common/config/runtime.js","../src/common/constants/agent-constants.js","../src/common/constants/env.cdn.js","../src/common/constants/env.js","../src/common/constants/env.npm.js","../src/common/constants/events.js","../src/common/constants/runtime.js","../src/common/constants/shared-channel.js","../src/common/deny-list/deny-list.js","../src/common/dispatch/global-event.js","../src/common/dom/iframe.js","../src/common/dom/query-selector.js","../src/common/dom/selector-path.js","../src/common/drain/drain.js","../src/common/event-emitter/contextual-ee.js","../src/common/event-emitter/event-context.js","../src/common/event-emitter/handle.js","../src/common/event-emitter/register-handler.js","../src/common/event-listener/event-listener-opts.js","../src/common/harvest/harvester.js","../src/common/harvest/types.js","../src/common/ids/bundle-id.js","../src/common/ids/id.js","../src/common/ids/unique-id.js","../src/common/payloads/payloads.js","../src/common/serialize/bel-serializer.js","../src/common/session/constants.js","../src/common/session/session-entity.js","../src/common/session/session-key.js","../src/common/storage/local-storage.js","../src/common/timer/interaction-timer.js","../src/common/timer/timer.js","../src/common/timing/nav-timing.js","../src/common/timing/now.js","../src/common/timing/time-keeper.js","../src/common/unload/eol.js","../src/common/url/canonicalize-url.js","../src/common/url/clean-url.js","../src/common/url/encode.js","../src/common/url/extract-url.js","../src/common/url/location.js","../src/common/url/parse-url.js","../src/common/url/protocol.js","../src/common/util/attribute-size.js","../src/common/util/browser-stack-matchers.js","../src/common/util/console.js","../src/common/util/data-size.js","../src/common/util/event-origin.js","../src/common/util/feature-flags.js","../src/common/util/get-or-set.js","../src/common/util/invoke.js","../src/common/util/monkey-patched.js","../src/common/util/obfuscate.js","../src/common/util/short-circuit.js","../src/common/util/stringify.js","../src/common/util/submit-data.js","../src/common/util/text.js","../src/common/util/traverse.js","../src/common/util/type-check.js","../src/common/util/webdriver-detection.js","../src/common/v2/script-correlation.js","../src/common/v2/script-tracker.js","../src/common/v2/utils.js","../src/common/vitals/constants.js","../src/common/vitals/cumulative-layout-shift.js","../src/common/vitals/first-contentful-paint.js","../src/common/vitals/first-paint.js","../src/common/vitals/interaction-to-next-paint.js","../src/common/vitals/largest-contentful-paint.js","../src/common/vitals/load-time.js","../src/common/vitals/time-to-first-byte.js","../src/common/vitals/vital-metric.js","../src/common/window/load.js","../src/common/window/nreum.js","../src/common/window/page-visibility.js","../src/common/wrap/wrap-events.js","../src/common/wrap/wrap-fetch.js","../src/common/wrap/wrap-function.js","../src/common/wrap/wrap-history.js","../src/common/wrap/wrap-logger.js","../src/common/wrap/wrap-websocket.js","../src/common/wrap/wrap-xhr.js","../src/features/ajax/constants.js","../src/features/ajax/index.js","../src/features/ajax/aggregate/gql.js","../src/features/ajax/aggregate/index.js","../src/features/ajax/instrument/distributed-tracing.js","../src/features/ajax/instrument/index.js","../src/features/ajax/instrument/response-size.js","../src/features/generic_events/constants.js","../src/features/generic_events/index.js","../src/features/generic_events/aggregate/index.js","../src/features/generic_events/aggregate/user-actions/aggregated-user-action.js","../src/features/generic_events/aggregate/user-actions/user-actions-aggregator.js","../src/features/generic_events/instrument/index.js","../src/features/jserrors/constants.js","../src/features/jserrors/index.js","../src/features/jserrors/aggregate/canonical-function-name.js","../src/features/jserrors/aggregate/cause-string.js","../src/features/jserrors/aggregate/compute-stack-trace.js","../src/features/jserrors/aggregate/format-stack-trace.js","../src/features/jserrors/aggregate/index.js","../src/features/jserrors/aggregate/internal-errors.js","../src/features/jserrors/aggregate/string-hash-code.js","../src/features/jserrors/instrument/index.js","../src/features/jserrors/shared/cast-error.js","../src/features/jserrors/shared/uncaught-error.js","../src/features/logging/constants.js","../src/features/logging/index.js","../src/features/logging/aggregate/index.js","../src/features/logging/instrument/index.js","../src/features/logging/shared/log.js","../src/features/logging/shared/utils.js","../src/features/metrics/constants.js","../src/features/metrics/index.js","../src/features/metrics/aggregate/framework-detection.js","../src/features/metrics/aggregate/harvest-metadata.js","../src/features/metrics/aggregate/index.js","../src/features/metrics/instrument/index.js","../src/features/page_action/constants.js","../src/features/page_action/index.js","../src/features/page_action/instrument/index.js","../src/features/page_view_event/constants.js","../src/features/page_view_event/index.js","../src/features/page_view_event/aggregate/index.js","../src/features/page_view_event/aggregate/initialized-features.js","../src/features/page_view_event/instrument/index.js","../src/features/page_view_timing/constants.js","../src/features/page_view_timing/index.js","../src/features/page_view_timing/aggregate/index.js","../src/features/page_view_timing/instrument/index.js","../src/features/session_replay/constants.js","../src/features/session_replay/index.js","../src/features/session_replay/aggregate/index.js","../src/features/session_replay/instrument/index.js","../src/features/session_replay/shared/recorder-events.js","../src/features/session_replay/shared/recorder.js","../src/features/session_replay/shared/stylesheet-evaluator.js","../src/features/session_replay/shared/utils.js","../src/features/session_trace/constants.js","../src/features/session_trace/index.js","../src/features/session_trace/aggregate/index.js","../src/features/session_trace/aggregate/trace/node.js","../src/features/session_trace/aggregate/trace/storage.js","../src/features/session_trace/aggregate/trace/utils.js","../src/features/session_trace/instrument/index.js","../src/features/soft_navigations/constants.js","../src/features/soft_navigations/index.js","../src/features/soft_navigations/aggregate/ajax-node.js","../src/features/soft_navigations/aggregate/bel-node.js","../src/features/soft_navigations/aggregate/index.js","../src/features/soft_navigations/aggregate/initial-page-load-interaction.js","../src/features/soft_navigations/aggregate/interaction.js","../src/features/soft_navigations/instrument/index.js","../src/features/utils/agent-session.js","../src/features/utils/aggregate-base.js","../src/features/utils/event-buffer.js","../src/features/utils/feature-base.js","../src/features/utils/feature-gates.js","../src/features/utils/instrument-base.js","../src/interfaces/registered-entity.js","../src/loaders/agent-base.js","../src/loaders/agent.js","../src/loaders/api-base.js","../src/loaders/browser-agent.js","../src/loaders/micro-agent-base.js","../src/loaders/micro-agent.js","../src/loaders/api/addPageAction.js","../src/loaders/api/addRelease.js","../src/loaders/api/addToTrace.js","../src/loaders/api/consent.js","../src/loaders/api/constants.js","../src/loaders/api/finished.js","../src/loaders/api/interaction-types.js","../src/loaders/api/interaction.js","../src/loaders/api/log.js","../src/loaders/api/measure.js","../src/loaders/api/noticeError.js","../src/loaders/api/pauseReplay.js","../src/loaders/api/recordCustomEvent.js","../src/loaders/api/recordReplay.js","../src/loaders/api/register-api-types.js","../src/loaders/api/register.js","../src/loaders/api/setApplicationVersion.js","../src/loaders/api/setCustomAttribute.js","../src/loaders/api/setErrorHandler.js","../src/loaders/api/setPageViewName.js","../src/loaders/api/setUserId.js","../src/loaders/api/sharedHandlers.js","../src/loaders/api/start.js","../src/loaders/api/topLevelCallers.js","../src/loaders/api/wrapLogger.js","../src/loaders/configure/configure.js","../src/loaders/configure/nonce.js","../src/loaders/configure/public-path.js","../src/loaders/features/enabled-features.js","../src/loaders/features/featureDependencies.js","../src/loaders/features/features.js"],"version":"5.9.3"}

package/dist/types/common/config/init-types.d.ts

@@ -18,6 +18,10 @@ export type Init = {
          * - If true, the agent will automatically start the ajax feature. Otherwise, it will be in a deferred state until the `start` API method is called.
          */
         autoStart?: boolean | undefined;
+        /**
+         * - Controls when AJAX request/response payloads are captured. 'none' = never capture, 'failures' = capture only on errors (4xx, 5xx, network errors, GraphQL errors), 'all' = always capture.
+         */
+        capture_payloads?: "none" | "failures" | "all" | undefined;
     } | undefined;
     api?: {
         register?: {

package/dist/types/common/config/init-types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"init-types.d.ts","sourceRoot":"","sources":["../../../../src/common/config/init-types.js"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;eAsCsB,MAAM,GAAG,MAAM;qBAAe,MAAM"}
+{"version":3,"file":"init-types.d.ts","sourceRoot":"","sources":["../../../../src/common/config/init-types.js"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;eAuCsB,MAAM,GAAG,MAAM;qBAAe,MAAM"}

package/dist/types/common/config/init.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"init.d.ts","sourceRoot":"","sources":["../../../../src/common/config/init.js"],"names":[],"mappings":"AA+IO,0CAEN;mBAtIY,OAAO,cAAc,EAAE,IAAI"}
+{"version":3,"file":"init.d.ts","sourceRoot":"","sources":["../../../../src/common/config/init.js"],"names":[],"mappings":"AAgJO,0CAEN;mBAtIY,OAAO,cAAc,EAAE,IAAI"}

package/dist/types/common/payloads/payloads.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Determines whether payload data should be captured based on the capture mode setting,
+ * HTTP status code, and GraphQL error status.
+ * @param {string} captureMode - The capture mode setting ('none', 'all', or 'failures')
+ * @param {number} statusCode - The HTTP status code
+ * @param {boolean} hasGQLErrors - Whether the response contains GraphQL errors
+ * @returns {boolean} True if payload should be captured
+ */
+export function canCapturePayload(captureMode: string, statusCode: number, hasGQLErrors: boolean): boolean;
+/**
+ * Parses a query string into an object of key-value pairs.
+ * @param {string} search a query string starting with "?" or without (ex. new URL(...).search)
+ * @returns {Object|undefined} Parsed query parameters as key-value pairs. Returns undefined if no valid parameters are found.
+ */
+export function parseQueryString(search: string): Object | undefined;
+/**
+ * Determines if the given content type is likely to be human-readable (text-based).
+ * @param {Object} headers - The headers object containing content-type
+ * @param {*} data - The data to check
+ * @returns {boolean} True if the content type is human-readable (text-based)
+ */
+export function isLikelyHumanReadable(headers: Object, data: any): boolean;
+/**
+ * Truncates a string to ensure its UTF-8 byte length does not exceed 4092 bytes.  If truncation is necessary,
+ * the string is cut off at a character boundary to avoid breaking multi-byte characters and " ..." is appended to indicate truncation.
+ * If not a string, it is first converted to a string using JSON.stringify.
+ * @param {*} data The data to truncate.
+ * @returns {string}
+ */
+export function truncateAsString(data: any): string;
+/**
+ * Creates string adder functions for BEL serialization with obfuscation and optional truncation.
+ * This ensures a single string table is used while providing separate handling for regular vs payload attributes.
+ * @param {Function} getAddStringContext - Function that creates a new string table context
+ * @param {Object} obfuscator - Optional obfuscator instance for string obfuscation
+ * @returns {{addString: Function, addStringWithTruncation: Function}} Object containing both string adder functions
+ */
+export function createStringAdders(getAddStringContext: Function, obfuscator: Object): {
+    addString: Function;
+    addStringWithTruncation: Function;
+};
+//# sourceMappingURL=payloads.d.ts.map

package/dist/types/common/payloads/payloads.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"payloads.d.ts","sourceRoot":"","sources":["../../../../src/common/payloads/payloads.js"],"names":[],"mappings":"AAQA;;;;;;;GAOG;AACH,+CALW,MAAM,cACN,MAAM,gBACN,OAAO,GACL,OAAO,CAQnB;AAED;;;;GAIG;AACH,yCAHW,MAAM,GACJ,MAAM,GAAC,SAAS,CAgB5B;AAED;;;;;GAKG;AACH,+CAJW,MAAM,QACN,GAAC,GACC,OAAO,CA2BnB;AAED;;;;;;GAMG;AACH,uCAHW,GAAC,GACC,MAAM,CA2BlB;AAED;;;;;;GAMG;AACH,8EAHW,MAAM,GACJ;IAAC,SAAS,WAAW;IAAC,uBAAuB,WAAU;CAAC,CAiBpE"}

package/dist/types/common/serialize/bel-serializer.d.ts

@@ -1,5 +1,5 @@
 export function nullable(val: any, fn: any, comma: any): string;
 export function numeric(n: any, noDefault: any): string;
-export function getAddStringContext(obfuscator: any): (str: any) => string;
+export function getAddStringContext(obfuscator: any, truncator: any): (str: any) => string;
 export function addCustomAttributes(attrs: any, addString: any): any[];
 //# sourceMappingURL=bel-serializer.d.ts.map

package/dist/types/common/serialize/bel-serializer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bel-serializer.d.ts","sourceRoot":"","sources":["../../../../src/common/serialize/bel-serializer.js"],"names":[],"mappings":"AAUA,gEAIC;AAED,wDAKC;AAED,2EAgBC;AAED,uEAwCC"}
+{"version":3,"file":"bel-serializer.d.ts","sourceRoot":"","sources":["../../../../src/common/serialize/bel-serializer.js"],"names":[],"mappings":"AAUA,gEAIC;AAED,wDAKC;AAED,2FAiBC;AAED,uEAwCC"}

package/dist/types/features/ajax/aggregate/gql.d.ts

@@ -12,6 +12,14 @@
  * @returns {GQLMetadata | undefined}
  */
 export function parseGQL({ body, query }?: object | string): GQLMetadata | undefined;
+/**
+ * Checks if a response body contains GraphQL errors according to the GraphQL spec.
+ * A valid GraphQL error response contains an "errors" array with at least one error object.
+ * Supports both single and batched GraphQL responses.
+ * @param {string|object|array} [responseBody] The response body to check
+ * @returns {boolean} True if the response contains GraphQL errors
+ */
+export function hasGQLErrors(responseBody?: string | object | array): boolean;
 export type GQLMetadata = {
     /**
      * Name of the operation

package/dist/types/features/ajax/aggregate/gql.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gql.d.ts","sourceRoot":"","sources":["../../../../../src/features/ajax/aggregate/gql.js"],"names":[],"mappings":"AAMA;;;;;GAKG;AAEH;;;;;;GAMG;AACH,2CAJW,MAAM,GAAC,MAAM,GAEX,WAAW,GAAG,SAAS,CAYnC;;;;;mBAtBa,MAAM;;;;mBACN,MAAM;;;;wBACN,MAAM"}
+{"version":3,"file":"gql.d.ts","sourceRoot":"","sources":["../../../../../src/features/ajax/aggregate/gql.js"],"names":[],"mappings":"AAMA;;;;;GAKG;AAEH;;;;;;GAMG;AACH,2CAJW,MAAM,GAAC,MAAM,GAEX,WAAW,GAAG,SAAS,CAYnC;AAkFD;;;;;;GAMG;AACH,4CAHW,MAAM,GAAC,MAAM,GAAC,KAAK,GACjB,OAAO,CAsBnB;;;;;mBAnIa,MAAM;;;;mBACN,MAAM;;;;wBACN,MAAM"}

package/dist/types/features/ajax/aggregate/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/features/ajax/aggregate/index.js"],"names":[],"mappings":"AAmBA;IACE,2BAAiC;IAEjC,2BA6BC;IAvBC,uBAA4D;IAyB9D,0GAwEC;IAED,+CAOC;IAED,iDAyDC;CACF;8BAxL6B,4BAA4B;2BAI/B,gCAAgC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/features/ajax/aggregate/index.js"],"names":[],"mappings":"AAoBA;IACE,2BAAiC;IAEjC,2BA6BC;IAvBC,uBAA4D;IAyB9D,0GAqFC;IAED,+CAOC;IAED,iDAoEC;CACF;8BAjN6B,4BAA4B;2BAK/B,gCAAgC"}

package/dist/types/features/ajax/constants.d.ts

@@ -1,3 +1,8 @@
 export const FEATURE_NAME: string;
+export namespace CAPTURE_PAYLOAD_SETTINGS {
+    let NONE: string;
+    let FAILURES: string;
+    let ALL: string;
+}
 export const AJAX_ID: "ajaxRequest.id";
 //# sourceMappingURL=constants.d.ts.map

package/dist/types/features/ajax/constants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../../src/features/ajax/constants.js"],"names":[],"mappings":"AAMA,kCAA8C;AAE9C,sBAAuB,gBAAgB,CAAA"}
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../../src/features/ajax/constants.js"],"names":[],"mappings":"AAMA,kCAA8C;;;;;;AAM9C,sBAAuB,gBAAgB,CAAA"}

package/dist/types/features/ajax/instrument/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/features/ajax/instrument/index.js"],"names":[],"mappings":"AA8BA;IACE,2BAAiC;IACjC,2BAkCC;IA/BC,OAA0B;IAE1B,8DAAkF;CA8BrF;AA6VD,qCAA8B;+BAjZC,6BAA6B;mBAFzC,uBAAuB"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/features/ajax/instrument/index.js"],"names":[],"mappings":"AA+BA;IACE,2BAAiC;IACjC,2BAiCC;IA9BC,OAA0B;IAE1B,8DAAkF;CA6BrF;AA6bD,qCAA8B;+BAjfC,6BAA6B;mBAFzC,uBAAuB"}

package/dist/types/features/soft_navigations/aggregate/ajax-node.d.ts

@@ -13,6 +13,11 @@ export class AjaxNode extends BelNode {
     spanTimestamp: any;
     gql: any;
     targetAttributes: any;
+    requestBody: any;
+    requestHeaders: any;
+    requestQuery: any;
+    responseBody: any;
+    responseHeaders: any;
     callbackEnd: any;
     serialize(parentStartTimestamp: any, agentRef: any, ajaxObfuscator: any): string;
     "ajaxRequest.id": any;

package/dist/types/features/soft_navigations/aggregate/ajax-node.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ajax-node.d.ts","sourceRoot":"","sources":["../../../../../src/features/soft_navigations/aggregate/ajax-node.js"],"names":[],"mappings":"AASA;IACE,8CAuBC;IArBC,gBAA6B;IAC7B,YAA8B;IAC9B,YAA8B;IAC9B,YAA8B;IAC9B,UAA0B;IAC1B,YAAmC;IACnC,YAAoC;IACpC,+BAAwD;IACxD,YAA8B;IAC9B,aAAgC;IAChC,mBAA4C;IAC5C,SAAwB;IACxB,sBAAkD;IAMhD,iBAAoE;IAKxE,iFAkCC;IA5CC,sBAAkC;CA6CrC;wBA/DuB,YAAY"}
+{"version":3,"file":"ajax-node.d.ts","sourceRoot":"","sources":["../../../../../src/features/soft_navigations/aggregate/ajax-node.js"],"names":[],"mappings":"AAUA;IACE,8CA8BC;IA5BC,gBAA6B;IAC7B,YAA8B;IAC9B,YAA8B;IAC9B,YAA8B;IAC9B,UAA0B;IAC1B,YAAmC;IACnC,YAAoC;IACpC,+BAAwD;IACxD,YAA8B;IAC9B,aAAgC;IAChC,mBAA4C;IAC5C,SAAwB;IACxB,sBAAkD;IAIlD,iBAAwC;IACxC,oBAA8C;IAC9C,kBAA0C;IAC1C,kBAA0C;IAC1C,qBAAgD;IAK9C,iBAAoE;IAKxE,iFA+CC;IAhEC,sBAAkC;CAiErC;wBAnFuB,YAAY"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@newrelic/browser-agent",
-  "version": "1.316.0-rc.6",
+  "version": "1.317.0",
   "private": false,
   "author": "New Relic Browser Agent Team <browser-agent@newrelic.com>",
   "description": "New Relic Browser Agent",
@@ -284,4 +284,4 @@
     "README.md",
     "CHANGELOG.md"
   ]
-}
+}

package/src/common/config/init-types.js

@@ -11,6 +11,7 @@
  * @property {boolean} [ajax.block_internal] - If true, agent requests going to harvest endpoint are treated as on deny list. In other words, agent will not self-report AJAX.
  * @property {boolean} [ajax.enabled] - Turn on/off the ajax feature (on by default).
  * @property {boolean} [ajax.autoStart] - If true, the agent will automatically start the ajax feature. Otherwise, it will be in a deferred state until the `start` API method is called.
+ * @property {('none'|'failures'|'all')} [ajax.capture_payloads] - Controls when AJAX request/response payloads are captured. 'none' = never capture, 'failures' = capture only on errors (4xx, 5xx, network errors, GraphQL errors), 'all' = always capture.
  * @property {Object} [api]
  * @property {Object} [api.register]
  * @property {boolean} [api.register.enabled] - If true, the agent will allow registered children to be sent to the server.

package/src/common/config/init.js

@@ -3,6 +3,7 @@
  * SPDX-License-Identifier: Apache-2.0
  */
 import { FEATURE_FLAGS } from '../../features/generic_events/constants'
+import { CAPTURE_PAYLOAD_SETTINGS } from '../../features/ajax/constants'
 import { isValidSelector } from '../dom/query-selector'
 import { DEFAULT_EXPIRES_MS, DEFAULT_INACTIVE_MS } from '../session/constants'
 import { warn } from '../util/console'
@@ -47,7 +48,7 @@ const InitModelFn = () => {
     }
   }
   return {
-    ajax: { deny_list: undefined, block_internal: true, enabled: true, autoStart: true },
+    ajax: { deny_list: undefined, block_internal: true, enabled: true, autoStart: true, capture_payloads: CAPTURE_PAYLOAD_SETTINGS.NONE },
     api: {
       register: {
         get enabled () { return hiddenState.feature_flags.includes(FEATURE_FLAGS.REGISTER) || hiddenState.experimental.register },

package/src/common/payloads/payloads.js

@@ -0,0 +1,135 @@
+/**
+ * Copyright 2020-2026 New Relic, Inc. All rights reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+import { stringify } from '../util/stringify'
+import { CAPTURE_PAYLOAD_SETTINGS } from '../../features/ajax/constants'
+
+/**
+ * Determines whether payload data should be captured based on the capture mode setting,
+ * HTTP status code, and GraphQL error status.
+ * @param {string} captureMode - The capture mode setting ('none', 'all', or 'failures')
+ * @param {number} statusCode - The HTTP status code
+ * @param {boolean} hasGQLErrors - Whether the response contains GraphQL errors
+ * @returns {boolean} True if payload should be captured
+ */
+export function canCapturePayload (captureMode, statusCode, hasGQLErrors) {
+  if (captureMode === CAPTURE_PAYLOAD_SETTINGS.ALL) return true
+  if (!captureMode || captureMode === CAPTURE_PAYLOAD_SETTINGS.NONE) return false
+
+  // Default "failures" mode
+  return statusCode === 0 || statusCode >= 400 || hasGQLErrors === true
+}
+
+/**
+ * Parses a query string into an object of key-value pairs.
+ * @param {string} search a query string starting with "?" or without (ex. new URL(...).search)
+ * @returns {Object|undefined} Parsed query parameters as key-value pairs. Returns undefined if no valid parameters are found.
+ */
+export function parseQueryString (search) {
+  if (!search || search.length === 0) return
+
+  const queryParams = {}
+  try {
+    const searchParams = new URLSearchParams(search)
+    searchParams.forEach(function (value, key) {
+      queryParams[key] = value
+    })
+  } catch (e) {
+    // Fallback for environments without URLSearchParams
+  }
+
+  return queryParams
+}
+
+/**
+ * Determines if the given content type is likely to be human-readable (text-based).
+ * @param {Object} headers - The headers object containing content-type
+ * @param {*} data - The data to check
+ * @returns {boolean} True if the content type is human-readable (text-based)
+ */
+export function isLikelyHumanReadable (headers, data) {
+  if (!headers) return typeof data === 'string'
+  var contentType = headers['content-type']
+  if (!contentType) return typeof data === 'string'
+  // Normalize to lowercase and extract the mime type (ignore charset, etc.)
+  var mimeType = contentType.toLowerCase().split(';')[0].trim()
+
+  // Check for text/* types
+  if (mimeType.indexOf('text/') === 0) return true
+
+  // Check for specific application/* types
+  var readableAppTypes = [
+    '/json',
+    '/xml',
+    '/xhtml+xml',
+    '/ld+json',
+    '/yaml',
+    '/x-www-form-urlencoded'
+  ]
+
+  for (var i = 0; i < readableAppTypes.length; i++) {
+    if (mimeType === 'application' + readableAppTypes[i]) return true
+  }
+
+  return false
+}
+
+/**
+ * Truncates a string to ensure its UTF-8 byte length does not exceed 4092 bytes.  If truncation is necessary,
+ * the string is cut off at a character boundary to avoid breaking multi-byte characters and " ..." is appended to indicate truncation.
+ * If not a string, it is first converted to a string using JSON.stringify.
+ * @param {*} data The data to truncate.
+ * @returns {string}
+ */
+export function truncateAsString (data) {
+  if (!data) return data
+  try {
+    if (typeof data !== 'string') data = stringify(data)
+    let bytes = 0
+    let i = 0
+    let needsEllipsis = false
+
+    while (i < data.length) {
+      const c = data.charCodeAt(i)
+      const charBytes = c < 0x80 ? 1 : c < 0x800 ? 2 : c < 0xD800 || c >= 0xE000 ? 3 : 4
+
+      if (bytes + charBytes > 4092) {
+        needsEllipsis = true
+        break
+      }
+
+      bytes += charBytes
+      i += charBytes === 4 ? 2 : 1
+    }
+
+    return data.slice(0, i) + (needsEllipsis ? ' ...' : '')
+  } catch (e) {
+    return data
+  }
+}
+
+/**
+ * Creates string adder functions for BEL serialization with obfuscation and optional truncation.
+ * This ensures a single string table is used while providing separate handling for regular vs payload attributes.
+ * @param {Function} getAddStringContext - Function that creates a new string table context
+ * @param {Object} obfuscator - Optional obfuscator instance for string obfuscation
+ * @returns {{addString: Function, addStringWithTruncation: Function}} Object containing both string adder functions
+ */
+export function createStringAdders (getAddStringContext, obfuscator) {
+  const addStringRaw = getAddStringContext()
+
+  const processString = (str, shouldTruncate) => {
+    if (typeof str === 'undefined' || str === '') return addStringRaw(str)
+    if (typeof str !== 'string') str = stringify(str)
+    const obfuscated = obfuscator?.obfuscateString(str) ?? str
+    const processed = shouldTruncate ? truncateAsString(obfuscated) : obfuscated
+    return addStringRaw(processed)
+  }
+
+  return {
+    addString: (str) => processString(str, false),
+    addStringWithTruncation: (str) => processString(str, true)
+  }
+}

package/src/common/serialize/bel-serializer.js

@@ -21,7 +21,7 @@ export function numeric (n, noDefault) {
   return (n === undefined || n === 0) ? '' : Math.floor(n).toString(36)
 }
 
-export function getAddStringContext (obfuscator) {
+export function getAddStringContext (obfuscator, truncator) {
   let stringTableIdx = 0
   const stringTable = Object.prototype.hasOwnProperty.call(Object, 'create') ? Object.create(null) : {}
 
@@ -30,6 +30,7 @@ export function getAddStringContext (obfuscator) {
   function addString (str) {
     if (typeof str === 'undefined' || str === '') return ''
     str = obfuscator?.obfuscateString(String(str)) ?? String(str)
+    str = truncator?.(str) ?? str
     if (hasOwnProp.call(stringTable, str)) {
       return numeric(stringTable[str], true)
     } else {

package/src/common/util/data-size.js

@@ -1,5 +1,5 @@
 /**
- * Copyright 2020-2025 New Relic, Inc. All rights reserved.
+ * Copyright 2020-2026 New Relic, Inc. All rights reserved.
  * SPDX-License-Identifier: Apache-2.0
  */
 
@@ -12,7 +12,7 @@ import { stringify } from './stringify'
  * @returns {(number|undefined)} - The size of the data or undefined if size cannot be determined.
  */
 export function dataSize (data) {
-  if (typeof data === 'string' && data.length) return data.length
+  if (typeof data === 'string') return data.length
   if (typeof data !== 'object') return undefined
   // eslint-disable-next-line
   if (typeof ArrayBuffer !== 'undefined' && data instanceof ArrayBuffer && data.byteLength) return data.byteLength

package/src/common/wrap/wrap-xhr.js

@@ -17,7 +17,7 @@ import { warn } from '../util/console'
 import { findTargetsFromStackTrace } from '../v2/utils'
 
 const wrapped = {}
-const XHR_PROPS = ['open', 'send'] // these are the specific funcs being wrapped on all XMLHttpRequests(.prototype)
+const XHR_PROPS = ['open', 'send', 'setRequestHeader'] // these are the specific funcs being wrapped on all XMLHttpRequests(.prototype)
 
 /**
  * Wraps the native XMLHttpRequest (XHR) object to emit custom events to its readystatechange event and an assortment

package/src/features/ajax/aggregate/gql.js

@@ -1,5 +1,5 @@
 /**
- * Copyright 2020-2025 New Relic, Inc. All rights reserved.
+ * Copyright 2020-2026 New Relic, Inc. All rights reserved.
  * SPDX-License-Identifier: Apache-2.0
  */
 import { isPureObject } from '../../../common/util/type-check'
@@ -97,3 +97,44 @@ function parseGQLQueryString (gqlQueryString) {
 function validateGQLObject (obj) {
   return !(typeof obj !== 'object' || !obj.query || typeof obj.query !== 'string')
 }
+
+/**
+ * Checks if a response object has valid GraphQL errors.
+ * @param {object} response - A single GraphQL response object
+ * @returns {boolean} True if the response has valid errors
+ */
+function hasValidGQLErrors (response) {
+  return Array.isArray(response?.errors) &&
+    response.errors.some(err =>
+      err && typeof err === 'object' && typeof err.message === 'string'
+    )
+}
+
+/**
+ * Checks if a response body contains GraphQL errors according to the GraphQL spec.
+ * A valid GraphQL error response contains an "errors" array with at least one error object.
+ * Supports both single and batched GraphQL responses.
+ * @param {string|object|array} [responseBody] The response body to check
+ * @returns {boolean} True if the response contains GraphQL errors
+ */
+export function hasGQLErrors (responseBody) {
+  if (!responseBody) return false
+  try {
+    let parsed = responseBody
+
+    // Parse string to object if needed
+    if (typeof responseBody === 'string') {
+      parsed = JSON.parse(responseBody)
+    }
+
+    // Handle batched GraphQL responses (array of response objects)
+    if (Array.isArray(parsed)) {
+      return parsed.some(hasValidGQLErrors)
+    }
+
+    // Handle single GraphQL response
+    return hasValidGQLErrors(parsed)
+  } catch (err) {
+    return false
+  }
+}