@newrelic/browser-agent 1.316.0 → 1.317.0-rc.0

package/src/features/session_trace/aggregate/index.js

@@ -3,15 +3,16 @@
  * SPDX-License-Identifier: Apache-2.0
  */
 import { registerHandler } from '../../../common/event-emitter/register-handler'
-import { FEATURE_NAME } from '../constants'
+import { ABORT_REASONS, FEATURE_NAME } from '../constants'
 import { AggregateBase } from '../../utils/aggregate-base'
 import { TraceStorage } from './trace/storage'
 import { obj as encodeObj } from '../../../common/url/encode'
 import { globalScope } from '../../../common/constants/runtime'
 import { MODE, SESSION_EVENTS } from '../../../common/session/constants'
-import { applyFnToProps } from '../../../common/util/traverse'
+import { Obfuscator } from '../../../common/util/obfuscate'
 import { cleanURL } from '../../../common/url/clean-url'
 import { warn } from '../../../common/util/console'
+import { EVENT_TYPES } from '../../../common/constants/events'
 
 /** Reserved room for query param attrs */
 const QUERY_PARAM_PADDING = 5000
@@ -22,6 +23,9 @@ export class Aggregate extends AggregateBase {
     super(agentRef, FEATURE_NAME)
     this.harvestOpts.raw = true
 
+    // Create obfuscator for session trace nodes
+    this.obfuscator = new Obfuscator(agentRef, EVENT_TYPES.ST)
+
     /** Tied to the entitlement flag response from BCS.  Will short circuit operations of the agg if false  */
     this.entitled = undefined
     /** A flag used to decide if the 30 node threshold should be ignored on the first harvest to ensure sending on the first payload */
@@ -39,8 +43,10 @@ export class Aggregate extends AggregateBase {
   /** Sets up event listeners, and initializes this module to run in the correct "mode".  Can be triggered from a few places, but makes an effort to only set up listeners once */
   initialize (stMode, stEntitled, ignoreSession) {
     this.entitled ??= stEntitled
-    if (!this.entitled) this.blocked = true
-    if (this.blocked) return this.deregisterDrain()
+    if (!this.entitled) {
+      this.abort(ABORT_REASONS.ENTITLEMENTS)
+      return this.deregisterDrain()
+    }
     this.timeKeeper ??= this.agentRef.runtime.timeKeeper
 
     if (!this.initialized) {
@@ -51,7 +57,7 @@ export class Aggregate extends AggregateBase {
       // The SessionEntity class can emit a message indicating the session was cleared and reset (expiry, inactivity). This feature must abort and never resume if that occurs.
       this.ee.on(SESSION_EVENTS.RESET, () => {
         if (this.blocked) return
-        this.abort(1)
+        this.abort(ABORT_REASONS.RESET)
       })
       // The SessionEntity can have updates (locally or across tabs for SR mode changes), (across tabs for ST mode changes).
       // Those updates should be sync'd here to ensure this page also honors the mode after initialization
@@ -60,7 +66,7 @@ export class Aggregate extends AggregateBase {
         // this will only have an effect if ST is NOT already in full mode
         if (this.mode !== MODE.FULL && (sessionState.sessionReplayMode === MODE.FULL || sessionState.sessionTraceMode === MODE.FULL)) this.switchToFull()
         // if another page's session entity has expired, or another page has transitioned to off and this one hasn't... we can just abort straight away here
-        if (this.sessionId !== sessionState.value || (eventType === 'cross-tab' && sessionState.sessionTraceMode === MODE.OFF)) this.abort(2)
+        if (this.sessionId !== sessionState.value || (eventType === 'cross-tab' && sessionState.sessionTraceMode === MODE.OFF)) this.abort(ABORT_REASONS.CROSS_TAB)
       })
 
       if (typeof PerformanceNavigationTiming !== 'undefined' && globalScope.performance?.getEntriesByType('navigation')?.length > 0) {
@@ -72,30 +78,31 @@ export class Aggregate extends AggregateBase {
 
     /** ST/SR sampling flow in BCS - https://drive.google.com/file/d/19hwt2oft-8Hh4RrjpLqEXfpP_9wYBLcq/view?usp=sharing */
     /** ST will run in the mode provided by BCS if the session IS NEW.  If not... it will use the state of the session entity to determine what mode to run in */
-    if (!this.agentRef.runtime.session.isNew && !ignoreSession) this.mode = this.agentRef.runtime.session.state.sessionTraceMode
+    if (this.agentRef.runtime.session.state.sessionTraceMode !== null && !ignoreSession) this.mode = this.agentRef.runtime.session.state.sessionTraceMode
     else this.mode = stMode
 
-    /** If the mode is off, we do not want to hold up draining for other features, so we deregister the feature for now.
-     * If it drains later (due to a mode change), data and handlers will instantly drain instead of waiting for the registry. */
-    if (this.mode === MODE.OFF) return this.deregisterDrain()
-
-    /** The handlers set up by the Inst file */
-    registerHandler('bst', (...args) => this.traceStorage.storeEvent(...args), this.featureName, this.ee)
-    registerHandler('bstResource', (...args) => this.traceStorage.storeResources(...args), this.featureName, this.ee)
-    registerHandler('bstHist', (...args) => this.traceStorage.storeHist(...args), this.featureName, this.ee)
-    registerHandler('bstXhrAgg', (...args) => this.traceStorage.storeXhrAgg(...args), this.featureName, this.ee)
-    registerHandler('bstApi', (...args) => this.traceStorage.storeNode(...args), this.featureName, this.ee)
-    registerHandler('trace-jserror', (...args) => this.traceStorage.storeErrorAgg(...args), this.featureName, this.ee)
-    registerHandler('pvtAdded', (...args) => this.traceStorage.processPVT(...args), this.featureName, this.ee)
-
-    if (this.mode !== MODE.FULL) {
-      /** A separate handler for noticing errors, and switching to "full" mode if running in "error" mode */
-      registerHandler('trace-jserror', () => {
-        if (this.mode === MODE.ERROR) this.switchToFull()
-      }, this.featureName, this.ee)
+    if (this.mode !== MODE.OFF) {
+      /** The handlers set up by the Inst file */
+      registerHandler('bst', (...args) => this.traceStorage.storeEvent(...args), this.featureName, this.ee)
+      registerHandler('bstResource', (...args) => this.traceStorage.storeResources(...args), this.featureName, this.ee)
+      registerHandler('bstHist', (...args) => this.traceStorage.storeHist(...args), this.featureName, this.ee)
+      registerHandler('bstXhrAgg', (...args) => this.traceStorage.storeXhrAgg(...args), this.featureName, this.ee)
+      registerHandler('bstApi', (...args) => this.traceStorage.storeNode(...args), this.featureName, this.ee)
+      registerHandler('trace-jserror', (...args) => this.traceStorage.storeErrorAgg(...args), this.featureName, this.ee)
+      registerHandler('pvtAdded', (...args) => this.traceStorage.processPVT(...args), this.featureName, this.ee)
+
+      if (this.mode === MODE.ERROR) {
+        /** A separate handler for noticing errors, and switching to "full" mode if running in "error" mode */
+        registerHandler('trace-jserror', () => {
+          if (this.mode === MODE.ERROR) this.switchToFull()
+        }, this.featureName, this.ee)
+      }
     }
     this.agentRef.runtime.session.write({ sessionTraceMode: this.mode })
-    this.drain()
+
+    /** If the mode is off, we do not want to hold up draining for other features, so we deregister the feature for now.
+     * If it drains later (due to a mode change), data and handlers will instantly drain instead of waiting for the registry. */
+    this.mode === MODE.OFF ? this.deregisterDrain() : this.drain()
   }
 
   preHarvestChecks () {
@@ -104,7 +111,7 @@ export class Aggregate extends AggregateBase {
     if (!this.agentRef.runtime.session) return // session entity is required for trace to run and continue running
     if (this.sessionId !== this.agentRef.runtime.session.state.value || this.ptid !== this.agentRef.runtime.ptid) {
       // If something unexpected happened and we somehow still got to harvesting after a session identifier changed, we should force-exit instead of harvesting:
-      this.abort(3)
+      this.abort(ABORT_REASONS.SESSION_CHANGED)
       return
     }
 
@@ -114,7 +121,7 @@ export class Aggregate extends AggregateBase {
   serializer (stns) {
     if (!stns.length) return // there are no processed nodes
     this.everHarvested = true
-    return applyFnToProps(stns, this.obfuscator.obfuscateString.bind(this.obfuscator), 'string')
+    return this.obfuscator.traverseAndObfuscateEvents(stns)
   }
 
   queryStringsBuilder (stns) {
@@ -181,8 +188,8 @@ export class Aggregate extends AggregateBase {
   }
 
   /** Stop running for the remainder of the page lifecycle */
-  abort (code) {
-    warn(60, code)
+  abort (reason = {}) {
+    warn(60, reason.message)
     this.blocked = true
     this.mode = MODE.OFF
     this.agentRef.runtime.session.write({ sessionTraceMode: this.mode })

package/src/features/session_trace/constants.js

@@ -1,5 +1,5 @@
 /**
- * Copyright 2020-2025 New Relic, Inc. All rights reserved.
+ * Copyright 2020-2026 New Relic, Inc. All rights reserved.
  * SPDX-License-Identifier: Apache-2.0
  */
 import { FEATURE_NAMES } from '../../loaders/features/features'
@@ -14,3 +14,9 @@ export const FN_END = 'fn' + END
 export const PUSH_STATE = 'pushState'
 export const MAX_NODES_PER_HARVEST = 1000
 export const ERROR_MODE_SECONDS_WINDOW = 30 * 1000 // sliding window of nodes to track when simply monitoring (but not harvesting) in error mode
+export const ABORT_REASONS = {
+  CROSS_TAB: { message: 'Session Entity was set to OFF on another tab' },
+  ENTITLEMENTS: { message: 'Session Trace is not allowed and will not be started' },
+  RESET: { message: 'Session was reset' },
+  SESSION_CHANGED: { message: 'Session identifier changed unexpectedly' }
+}

package/src/features/soft_navigations/aggregate/ajax-node.js

@@ -3,6 +3,7 @@
  * SPDX-License-Identifier: Apache-2.0
  */
 import { addCustomAttributes, getAddStringContext, nullable, numeric } from '../../../common/serialize/bel-serializer'
+import { createStringAdders } from '../../../common/payloads/payloads'
 import { AJAX_ID } from '../../ajax/constants'
 import { NODE_TYPE } from '../constants'
 import { BelNode } from './bel-node'
@@ -25,6 +26,13 @@ export class AjaxNode extends BelNode {
     this.targetAttributes = ajaxEvent.targetAttributes
     this[AJAX_ID] = ajaxEvent[AJAX_ID] // all AjaxRequest events should have a unique identifier to allow for easier grouping and analysis in the UI
 
+    // optional payload metadata attributes
+    this.requestBody = ajaxEvent.requestBody
+    this.requestHeaders = ajaxEvent.requestHeaders
+    this.requestQuery = ajaxEvent.requestQuery
+    this.responseBody = ajaxEvent.responseBody
+    this.responseHeaders = ajaxEvent.responseHeaders
+
     this.start = ajaxEvent.startTime
     this.end = ajaxEvent.endTime
     if (ajaxContext?.latestLongtaskEnd) {
@@ -33,8 +41,9 @@ export class AjaxNode extends BelNode {
     } else this.callbackEnd = this.end // if no long task was observed, callbackEnd is the same as end
   }
 
-  serialize (parentStartTimestamp, agentRef) {
-    const addString = getAddStringContext(agentRef.runtime.obfuscator)
+  serialize (parentStartTimestamp, agentRef, ajaxObfuscator) {
+    const { addString, addStringWithTruncation } = createStringAdders(getAddStringContext, ajaxObfuscator)
+
     const nodeList = []
 
     // IMPORTANT: The order in which addString is called matters and correlates to the order in which string shows up in the harvest payload. Do not re-order the following code.
@@ -55,11 +64,23 @@ export class AjaxNode extends BelNode {
       addString(this.nodeId),
       nullable(this.spanId, addString, true) + nullable(this.traceId, addString, true) + nullable(this.spanTimestamp, numeric)
     ]
-    let allAttachedNodes = addCustomAttributes({
-      ...(this.gql || {}),
+    // Regular attributes: obfuscate only
+    const regularAttrs = addCustomAttributes({
+      [AJAX_ID]: this[AJAX_ID],
       ...(this.targetAttributes || {}),
-      [AJAX_ID]: this[AJAX_ID]
+      ...(this.gql || {})
     }, addString)
+
+    // Payload attributes: obfuscate then truncate
+    const payloadAttrs = addCustomAttributes({
+      ...(this.requestBody ? { requestBody: this.requestBody } : {}),
+      ...(this.requestHeaders ? { requestHeaders: this.requestHeaders } : {}),
+      ...(this.requestQuery ? { requestQuery: this.requestQuery } : {}),
+      ...(this.responseBody ? { responseBody: this.responseBody } : {}),
+      ...(this.responseHeaders ? { responseHeaders: this.responseHeaders } : {})
+    }, addStringWithTruncation)
+
+    let allAttachedNodes = [...regularAttrs, ...payloadAttrs]
     this.children.forEach(node => allAttachedNodes.push(node.serialize())) // no children is expected under ajax nodes at this time
 
     fields[1] = numeric(allAttachedNodes.length)

package/src/features/soft_navigations/aggregate/index.js

@@ -8,10 +8,12 @@ import { webdriverDetected } from '../../../common/util/webdriver-detection'
 import { loadTime } from '../../../common/vitals/load-time'
 import { FEATURE_NAMES } from '../../../loaders/features/features'
 import { AggregateBase } from '../../utils/aggregate-base'
+import { Obfuscator } from '../../../common/util/obfuscate'
 import { API_TRIGGER_NAME, FEATURE_NAME, INTERACTION_STATUS, INTERACTION_TRIGGERS, IPL_TRIGGER_NAME, NO_LONG_TASK_WINDOW, POPSTATE_MERGE_WINDOW, POPSTATE_TRIGGER } from '../constants'
 import { AjaxNode } from './ajax-node'
 import { InitialPageLoadInteraction } from './initial-page-load-interaction'
 import { Interaction } from './interaction'
+import { EVENT_TYPES } from '../../../common/constants/events'
 
 export class Aggregate extends AggregateBase {
   static featureName = FEATURE_NAME
@@ -20,6 +22,10 @@ export class Aggregate extends AggregateBase {
 
     super.customAttributesAreSeparate = true
 
+    // Create obfuscators for browser interactions and nested AJAX requests
+    this.interactionObfuscator = new Obfuscator(agentRef, EVENT_TYPES.BI)
+    this.ajaxObfuscator = new Obfuscator(agentRef, EVENT_TYPES.AJAX)
+
     this.interactionsToHarvest = this.events
     this.domObserver = domObserver
 
@@ -86,7 +92,7 @@ export class Aggregate extends AggregateBase {
     let firstIxnStartTime
     const serializedIxnList = []
     for (const interaction of eventBuffer) {
-      serializedIxnList.push(interaction.serialize(firstIxnStartTime, this.agentRef))
+      serializedIxnList.push(interaction.serialize(firstIxnStartTime, this.agentRef, this.interactionObfuscator, this.ajaxObfuscator))
       if (firstIxnStartTime === undefined) firstIxnStartTime = Math.floor(interaction.start) // careful not to match or overwrite on 0 value!
     }
     return `bel.7;${serializedIxnList.join(';')}`

package/src/features/soft_navigations/aggregate/initial-page-load-interaction.js

@@ -1,5 +1,5 @@
 /**
- * Copyright 2020-2025 New Relic, Inc. All rights reserved.
+ * Copyright 2020-2026 New Relic, Inc. All rights reserved.
  * SPDX-License-Identifier: Apache-2.0
  */
 import { navTimingValues } from '../../../common/timing/nav-timing'

package/src/features/soft_navigations/aggregate/interaction.js

@@ -1,5 +1,5 @@
 /**
- * Copyright 2020-2025 New Relic, Inc. All rights reserved.
+ * Copyright 2020-2026 New Relic, Inc. All rights reserved.
  * SPDX-License-Identifier: Apache-2.0
  */
 import { globalScope, initialLocation } from '../../../common/constants/runtime'
@@ -133,11 +133,13 @@ export class Interaction extends BelNode {
    * Serializes (BEL) the interaction data for transmission.
    * @param {Number} firstStartTimeOfPayload timestamp
    * @param {Agent} agentRef Pass in the agent reference directly so that the event itself doesnt need to store the pointers and ruin the evaluation of the event size by including unused object references.
+   * @param {Obfuscator} interactionObfuscator Obfuscator for BrowserInteraction event type
+   * @param {Obfuscator} ajaxObfuscator Obfuscator for AjaxRequest event type (passed to child AjaxNodes)
    * @returns {String} A string that is the serialized representation of this interaction.
    */
-  serialize (firstStartTimeOfPayload, agentRef) {
+  serialize (firstStartTimeOfPayload, agentRef, interactionObfuscator, ajaxObfuscator) {
     const isFirstIxnOfPayload = firstStartTimeOfPayload === undefined
-    const addString = getAddStringContext(agentRef.runtime.obfuscator)
+    const addString = getAddStringContext(interactionObfuscator)
     const nodeList = []
     let ixnType
     if (this.trigger === IPL_TRIGGER_NAME) ixnType = INTERACTION_TYPE.INITIAL_PAGE_LOAD
@@ -170,7 +172,7 @@ export class Interaction extends BelNode {
     /* Querypack encoder+decoder quirkiness:
        - If first ixn node of payload is being processed, its children's start time must be offset by this node's start. (firstStartTime should be undefined.)
        - Else for subsequent ixns in the same payload, we go back to using that first ixn node's start to offset their children's start. */
-    this.children.forEach(node => allAttachedNodes.push(node.serialize(isFirstIxnOfPayload ? this.start : firstStartTimeOfPayload, agentRef))) // recursively add the serialized string of every child of this (ixn) bel node
+    this.children.forEach(node => allAttachedNodes.push(node.serialize(isFirstIxnOfPayload ? this.start : firstStartTimeOfPayload, agentRef, ajaxObfuscator))) // recursively add the serialized string of every child of this (ixn) bel node
 
     fields[1] = numeric(allAttachedNodes.length)
     nodeList.push(fields)

package/src/features/utils/aggregate-base.js

@@ -4,7 +4,6 @@
  */
 import { FeatureBase } from './feature-base'
 import { drain } from '../../common/drain/drain'
-import { Obfuscator } from '../../common/util/obfuscate'
 import { FEATURE_NAMES } from '../../loaders/features/features'
 import { Harvester } from '../../common/harvest/harvester'
 import { EventBuffer } from './event-buffer'
@@ -12,6 +11,7 @@ import { handle } from '../../common/event-emitter/handle'
 import { SUPPORTABILITY_METRIC_CHANNEL } from '../metrics/constants'
 import { EventAggregator } from '../../common/aggregate/event-aggregator'
 import { MAX_PAYLOAD_SIZE, IDEAL_PAYLOAD_SIZE, SUPPORTS_REGISTERED_ENTITIES } from '../../common/constants/agent-constants'
+import { warn } from '../../common/util/console'
 
 export class AggregateBase extends FeatureBase {
   /**
@@ -115,6 +115,7 @@ export class AggregateBase extends FeatureBase {
       }
       function buildOutput (ref) {
         return flagNames.map(flag => {
+          if (ref[flag] === undefined || ref[flag] === null) warn(71, flag)
           if (!ref[flag]) return 0
           return ref[flag]
         })
@@ -182,8 +183,7 @@ export class AggregateBase extends FeatureBase {
    * This method should run after checkConfiguration, which may reset the agent's info/runtime object that is used here.
    */
   doOnceForAllAggregate (agentRef) {
-    if (!agentRef.runtime.obfuscator) agentRef.runtime.obfuscator = new Obfuscator(agentRef)
-    this.obfuscator = agentRef.runtime.obfuscator
+    // Note: obfuscator is now created per-feature for their specific event types
 
     if (!agentRef.runtime.harvester) agentRef.runtime.harvester = new Harvester(agentRef)
   }

package/src/loaders/api/register.js

@@ -18,6 +18,7 @@ import { measure } from './measure'
 import { recordCustomEvent } from './recordCustomEvent'
 import { subscribeToPageUnload } from '../../common/window/page-visibility'
 import { findScriptTimings } from '../../common/v2/script-tracker'
+import { trackMFEVitals } from '../../common/v2/mfe-vitals'
 import { generateRandomHexString } from '../../common/ids/unique-id'
 
 /**
@@ -83,6 +84,9 @@ function register (agentRef, target) {
 
   const timings = findScriptTimings()
 
+  // Track MFE vitals for this entity
+  const vitals = trackMFEVitals(target.id)
+
   const attrs = {}
 
   // Only define attributes getter if it doesn't already exist
@@ -149,7 +153,8 @@ function register (agentRef, target) {
     metadata: {
       get customAttributes () { return attrs },
       target,
-      timings
+      timings,
+      vitals
     }
   }
 
@@ -177,9 +182,18 @@ function register (agentRef, target) {
     // only ever report the timings the first time this is called
     if (timings.reportedAt) return
     timings.reportedAt = now()
+
+    // Disconnect observers and capture current values, store in timings obj for visibility
+    vitals.disconnect()
+    timings.fcp = vitals.fcp
+    timings.lcp = vitals.lcp
+    timings.cls = vitals.cls
+    timings.inp = vitals.inp
+
     const timeToFetch = timings.fetchEnd - timings.fetchStart // fetchStart to fetchEnd
     const timeToExecute = timings.scriptEnd - timings.scriptStart // scriptStart to scriptEnd
-    api.recordCustomEvent('MicroFrontEndTiming', {
+
+    const eventData = {
       assetUrl: timings.asset, // the url of the script that was registered, or undefined if it could not be determined (inline or no match)
       assetType: timings.type, // the type of asset that was associated with the timings, one of 'script', 'link' (if preloaded and found in the resource timing buffer), 'preload' (if preloaded but not found in the resource timing buffer), or "unknown" if it could not be determined
       timeAlive: timings.reportedAt - timings.registeredAt, // registeredAt to reportedAt
@@ -187,8 +201,14 @@ function register (agentRef, target) {
       timeToExecute, // scriptStart to scriptEnd
       timeToFetch, // fetchStart to fetchEnd
       timeToLoad: timeToFetch + timeToExecute, // fetch time and script time together
-      timeToRegister: timings.registeredAt // timestamp when register() was called
-    })
+      timeToRegister: timings.registeredAt, // timestamp when register() was called
+      'nr.vitals.fcp': vitals.fcp || null, // FCP vital object with value and metadata
+      'nr.vitals.lcp': vitals.lcp || null, // LCP vital object with value and metadata
+      'nr.vitals.cls': vitals.cls || null, // CLS vital object with value and metadata
+      'nr.vitals.inp': vitals.inp || null // INP vital object with value and metadata
+    }
+
+    api.recordCustomEvent('MicroFrontEndTiming', eventData)
   }
 
   /**