@newrelic/browser-agent 1.316.0 → 1.317.0

package/CHANGELOG.md

@@ -3,6 +3,21 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [1.317.0](https://github.com/newrelic/newrelic-browser-agent/compare/v1.316.0...v1.317.0) (2026-06-18)
+
+
+### Features
+
+* Detect and report AJAX payloads ([#1651](https://github.com/newrelic/newrelic-browser-agent/issues/1651)) ([08394db](https://github.com/newrelic/newrelic-browser-agent/commit/08394db8a5a9f2b6fd627e9eee76022977cb433c))
+* Enhance obfuscation to support event filter ([#1782](https://github.com/newrelic/newrelic-browser-agent/issues/1782)) ([c97aaf9](https://github.com/newrelic/newrelic-browser-agent/commit/c97aaf9773cfb0b62a810eb07b37e6f5b96d5ab5))
+
+
+### Bug Fixes
+
+* Calculate browser_stack_hash from truncated stack trace ([#1789](https://github.com/newrelic/newrelic-browser-agent/issues/1789)) ([f7df627](https://github.com/newrelic/newrelic-browser-agent/commit/f7df627b14e3e5e8fa4a8d94433ea76e9a9902bb))
+* Get responseBodySize from body if content-length is missing ([#1793](https://github.com/newrelic/newrelic-browser-agent/issues/1793)) ([58663ec](https://github.com/newrelic/newrelic-browser-agent/commit/58663ec19dc99ec94e34c17a5dfaa20a07038dba))
+* Patch handling of inlining images for Session Replay ([#1765](https://github.com/newrelic/newrelic-browser-agent/issues/1765)) ([b330f8e](https://github.com/newrelic/newrelic-browser-agent/commit/b330f8e3e35f2fda076967092bcb70e792de6eeb))
+
 ## [1.316.0](https://github.com/newrelic/newrelic-browser-agent/compare/v1.315.0...v1.316.0) (2026-06-01)
 
 

package/dist/cjs/common/config/init-types.js

@@ -16,6 +16,7 @@ exports.default = void 0;
  * @property {boolean} [ajax.block_internal] - If true, agent requests going to harvest endpoint are treated as on deny list. In other words, agent will not self-report AJAX.
  * @property {boolean} [ajax.enabled] - Turn on/off the ajax feature (on by default).
  * @property {boolean} [ajax.autoStart] - If true, the agent will automatically start the ajax feature. Otherwise, it will be in a deferred state until the `start` API method is called.
+ * @property {('none'|'failures'|'all')} [ajax.capture_payloads] - Controls when AJAX request/response payloads are captured. 'none' = never capture, 'failures' = capture only on errors (4xx, 5xx, network errors, GraphQL errors), 'all' = always capture.
  * @property {Object} [api]
  * @property {Object} [api.register]
  * @property {boolean} [api.register.enabled] - If true, the agent will allow registered children to be sent to the server.

package/dist/cjs/common/config/init.js

@@ -5,8 +5,9 @@ Object.defineProperty(exports, "__esModule", {
 });
 exports.mergeInit = void 0;
 var _constants = require("../../features/generic_events/constants");
+var _constants2 = require("../../features/ajax/constants");
 var _querySelector = require("../dom/query-selector");
-var _constants2 = require("../session/constants");
+var _constants3 = require("../session/constants");
 var _console = require("../util/console");
 var _configurable = require("./configurable");
 /**
@@ -57,7 +58,8 @@ const InitModelFn = () => {
       deny_list: undefined,
       block_internal: true,
       enabled: true,
-      autoStart: true
+      autoStart: true,
+      capture_payloads: _constants2.CAPTURE_PAYLOAD_SETTINGS.NONE
     },
     api: {
       register: {
@@ -141,8 +143,8 @@ const InitModelFn = () => {
       beacon: undefined
     },
     session: {
-      expiresMs: _constants2.DEFAULT_EXPIRES_MS,
-      inactiveMs: _constants2.DEFAULT_INACTIVE_MS
+      expiresMs: _constants3.DEFAULT_EXPIRES_MS,
+      inactiveMs: _constants3.DEFAULT_INACTIVE_MS
     },
     session_replay: {
       autoStart: true,

package/dist/cjs/common/constants/env.cdn.js

@@ -17,7 +17,7 @@ exports.VERSION = exports.RRWEB_VERSION = exports.RRWEB_PACKAGE_NAME = exports.D
 /**
  * Exposes the version of the agent
  */
-const VERSION = exports.VERSION = "1.316.0";
+const VERSION = exports.VERSION = "1.317.0";
 
 /**
  * Exposes the build type of the agent
@@ -31,4 +31,4 @@ const BUILD_ENV = exports.BUILD_ENV = "CDN";
 const DIST_METHOD = exports.DIST_METHOD = 'CDN';
 const RRWEB_PACKAGE_NAME = exports.RRWEB_PACKAGE_NAME = '@newrelic/rrweb';
 // Babel will inline this with the rrweb (fork) version on CDN builds.
-const RRWEB_VERSION = exports.RRWEB_VERSION = "1.1.0";
+const RRWEB_VERSION = exports.RRWEB_VERSION = "^1.1.2";

package/dist/cjs/common/constants/env.npm.js

@@ -17,7 +17,7 @@ exports.VERSION = exports.RRWEB_VERSION = exports.RRWEB_PACKAGE_NAME = exports.D
 /**
  * Exposes the version of the agent
  */
-const VERSION = exports.VERSION = "1.316.0";
+const VERSION = exports.VERSION = "1.317.0";
 
 /**
  * Exposes the build type of the agent
@@ -32,4 +32,4 @@ const BUILD_ENV = exports.BUILD_ENV = 'NPM';
 const DIST_METHOD = exports.DIST_METHOD = 'NPM';
 const RRWEB_PACKAGE_NAME = exports.RRWEB_PACKAGE_NAME = '@newrelic/rrweb';
 // Babel will inline this with the rrweb (fork) version on NPM dist esm/cjs builds.
-const RRWEB_VERSION = exports.RRWEB_VERSION = "1.1.0";
+const RRWEB_VERSION = exports.RRWEB_VERSION = "^1.1.2";

package/dist/cjs/common/constants/events.js

@@ -0,0 +1,26 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.EVENT_TYPES = void 0;
+/**
+ * Copyright 2020-2026 New Relic, Inc. All rights reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+const EVENT_TYPES = exports.EVENT_TYPES = {
+  AJAX: 'AjaxRequest',
+  PA: 'PageAction',
+  UA: 'UserAction',
+  BP: 'BrowserPerformance',
+  WS: 'WebSocket',
+  SPV: 'SecurityPolicyViolation',
+  JSE: 'JavaScriptError',
+  LOG: 'Log',
+  PVE: 'PageView',
+  PVT: 'PageViewTiming',
+  SR: 'SessionReplay',
+  ST: 'SessionTrace',
+  BI: 'BrowserInteraction'
+};

package/dist/cjs/common/harvest/harvester.js

@@ -19,6 +19,7 @@ var _console = require("../util/console");
 var _stringify = require("../util/stringify");
 var _submitData = require("../util/submit-data");
 var _globalEvent = require("../dispatch/global-event");
+var _obfuscate = require("../util/obfuscate");
 /**
  * Copyright 2020-2026 New Relic, Inc. All rights reserved.
  * SPDX-License-Identifier: Apache-2.0
@@ -33,6 +34,10 @@ class Harvester {
   initializedAggregates = [];
   constructor(agentRef) {
     this.agentRef = agentRef;
+
+    // Create obfuscator for harvest metadata (referrer URL, etc.)
+    // No event type specified - applies to all harvests regardless of feature
+    this.obfuscator = new _obfuscate.Obfuscator(agentRef);
     (0, _eol.subscribeToEOL)(() => {
       // do one last harvest round or check
       this.initializedAggregates.forEach(aggregateInst => {
@@ -79,6 +84,7 @@ class Harvester {
       payload: output.payload,
       localOpts,
       submitMethod,
+      harvesterObfuscator: this.obfuscator,
       cbFinished,
       raw: aggregateInst.harvestOpts.raw,
       featureName: aggregateInst.featureName,
@@ -127,7 +133,8 @@ function send(agentRef, {
   cbFinished,
   raw,
   featureName,
-  endpointVersion = 1
+  endpointVersion = 1,
+  harvesterObfuscator
 }) {
   if (!agentRef.info.errorBeacon) return false;
   let {
@@ -144,7 +151,7 @@ function send(agentRef, {
   const protocol = agentRef.init.ssl === false ? 'http' : 'https';
   const perceivedBeacon = agentRef.init.proxy.beacon || agentRef.info.errorBeacon;
   const url = raw ? "".concat(protocol, "://").concat(perceivedBeacon, "/").concat(endpoint) : "".concat(protocol, "://").concat(perceivedBeacon).concat(endpoint !== _features.RUM ? '/' + endpoint : '', "/").concat(endpointVersion, "/").concat(agentRef.info.licenseKey);
-  const baseParams = !raw ? baseQueryString(agentRef, qs, endpoint) : '';
+  const baseParams = !raw ? baseQueryString(agentRef, qs, endpoint, harvesterObfuscator) : '';
   let payloadParams = (0, _encode.obj)(qs, agentRef.runtime.maxBytes);
   if (baseParams === '' && payloadParams.startsWith('&')) {
     payloadParams = payloadParams.substring(1);
@@ -292,8 +299,9 @@ function cleanPayload(payload = {}) {
 }
 
 // The stuff that gets sent every time.
-function baseQueryString(agentRef, qs, endpoint) {
-  const ref = agentRef.runtime.obfuscator.obfuscateString((0, _cleanUrl.cleanURL)('' + _runtime.globalScope.location));
+function baseQueryString(agentRef, qs, endpoint, harvesterObfuscator) {
+  const cleanedURL = (0, _cleanUrl.cleanURL)('' + _runtime.globalScope.location);
+  const ref = harvesterObfuscator?.obfuscateString(cleanedURL) ?? cleanedURL;
   const session = agentRef.runtime.session;
   const hr = !!session?.state.sessionReplaySentFirstChunk && session?.state.sessionReplayMode === 1 && endpoint !== _features.JSERRORS;
   const ht = !!session?.state.traceHarvestStarted && session?.state.sessionTraceMode === 1 && ![_features.LOGS, _features.BLOBS].includes(endpoint);

package/dist/cjs/common/payloads/payloads.js

@@ -0,0 +1,127 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.canCapturePayload = canCapturePayload;
+exports.createStringAdders = createStringAdders;
+exports.isLikelyHumanReadable = isLikelyHumanReadable;
+exports.parseQueryString = parseQueryString;
+exports.truncateAsString = truncateAsString;
+var _stringify = require("../util/stringify");
+var _constants = require("../../features/ajax/constants");
+/**
+ * Copyright 2020-2026 New Relic, Inc. All rights reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+/**
+ * Determines whether payload data should be captured based on the capture mode setting,
+ * HTTP status code, and GraphQL error status.
+ * @param {string} captureMode - The capture mode setting ('none', 'all', or 'failures')
+ * @param {number} statusCode - The HTTP status code
+ * @param {boolean} hasGQLErrors - Whether the response contains GraphQL errors
+ * @returns {boolean} True if payload should be captured
+ */
+function canCapturePayload(captureMode, statusCode, hasGQLErrors) {
+  if (captureMode === _constants.CAPTURE_PAYLOAD_SETTINGS.ALL) return true;
+  if (!captureMode || captureMode === _constants.CAPTURE_PAYLOAD_SETTINGS.NONE) return false;
+
+  // Default "failures" mode
+  return statusCode === 0 || statusCode >= 400 || hasGQLErrors === true;
+}
+
+/**
+ * Parses a query string into an object of key-value pairs.
+ * @param {string} search a query string starting with "?" or without (ex. new URL(...).search)
+ * @returns {Object|undefined} Parsed query parameters as key-value pairs. Returns undefined if no valid parameters are found.
+ */
+function parseQueryString(search) {
+  if (!search || search.length === 0) return;
+  const queryParams = {};
+  try {
+    const searchParams = new URLSearchParams(search);
+    searchParams.forEach(function (value, key) {
+      queryParams[key] = value;
+    });
+  } catch (e) {
+    // Fallback for environments without URLSearchParams
+  }
+  return queryParams;
+}
+
+/**
+ * Determines if the given content type is likely to be human-readable (text-based).
+ * @param {Object} headers - The headers object containing content-type
+ * @param {*} data - The data to check
+ * @returns {boolean} True if the content type is human-readable (text-based)
+ */
+function isLikelyHumanReadable(headers, data) {
+  if (!headers) return typeof data === 'string';
+  var contentType = headers['content-type'];
+  if (!contentType) return typeof data === 'string';
+  // Normalize to lowercase and extract the mime type (ignore charset, etc.)
+  var mimeType = contentType.toLowerCase().split(';')[0].trim();
+
+  // Check for text/* types
+  if (mimeType.indexOf('text/') === 0) return true;
+
+  // Check for specific application/* types
+  var readableAppTypes = ['/json', '/xml', '/xhtml+xml', '/ld+json', '/yaml', '/x-www-form-urlencoded'];
+  for (var i = 0; i < readableAppTypes.length; i++) {
+    if (mimeType === 'application' + readableAppTypes[i]) return true;
+  }
+  return false;
+}
+
+/**
+ * Truncates a string to ensure its UTF-8 byte length does not exceed 4092 bytes.  If truncation is necessary,
+ * the string is cut off at a character boundary to avoid breaking multi-byte characters and " ..." is appended to indicate truncation.
+ * If not a string, it is first converted to a string using JSON.stringify.
+ * @param {*} data The data to truncate.
+ * @returns {string}
+ */
+function truncateAsString(data) {
+  if (!data) return data;
+  try {
+    if (typeof data !== 'string') data = (0, _stringify.stringify)(data);
+    let bytes = 0;
+    let i = 0;
+    let needsEllipsis = false;
+    while (i < data.length) {
+      const c = data.charCodeAt(i);
+      const charBytes = c < 0x80 ? 1 : c < 0x800 ? 2 : c < 0xD800 || c >= 0xE000 ? 3 : 4;
+      if (bytes + charBytes > 4092) {
+        needsEllipsis = true;
+        break;
+      }
+      bytes += charBytes;
+      i += charBytes === 4 ? 2 : 1;
+    }
+    return data.slice(0, i) + (needsEllipsis ? ' ...' : '');
+  } catch (e) {
+    return data;
+  }
+}
+
+/**
+ * Creates string adder functions for BEL serialization with obfuscation and optional truncation.
+ * This ensures a single string table is used while providing separate handling for regular vs payload attributes.
+ * @param {Function} getAddStringContext - Function that creates a new string table context
+ * @param {Object} obfuscator - Optional obfuscator instance for string obfuscation
+ * @returns {{addString: Function, addStringWithTruncation: Function}} Object containing both string adder functions
+ */
+function createStringAdders(getAddStringContext, obfuscator) {
+  const addStringRaw = getAddStringContext();
+  const processString = (str, shouldTruncate) => {
+    if (typeof str === 'undefined' || str === '') return addStringRaw(str);
+    if (typeof str !== 'string') str = (0, _stringify.stringify)(str);
+    const obfuscated = obfuscator?.obfuscateString(str) ?? str;
+    const processed = shouldTruncate ? truncateAsString(obfuscated) : obfuscated;
+    return addStringRaw(processed);
+  };
+  return {
+    addString: str => processString(str, false),
+    addStringWithTruncation: str => processString(str, true)
+  };
+}

package/dist/cjs/common/serialize/bel-serializer.js

@@ -9,7 +9,7 @@ exports.nullable = nullable;
 exports.numeric = numeric;
 var _stringify = require("../util/stringify");
 /**
- * Copyright 2020-2025 New Relic, Inc. All rights reserved.
+ * Copyright 2020-2026 New Relic, Inc. All rights reserved.
  * SPDX-License-Identifier: Apache-2.0
  */
 
@@ -24,13 +24,14 @@ function numeric(n, noDefault) {
   }
   return n === undefined || n === 0 ? '' : Math.floor(n).toString(36);
 }
-function getAddStringContext(obfuscator) {
+function getAddStringContext(obfuscator, truncator) {
   let stringTableIdx = 0;
   const stringTable = Object.prototype.hasOwnProperty.call(Object, 'create') ? Object.create(null) : {};
   return addString;
   function addString(str) {
     if (typeof str === 'undefined' || str === '') return '';
-    str = obfuscator.obfuscateString(String(str));
+    str = obfuscator?.obfuscateString(String(str)) ?? String(str);
+    str = truncator?.(str) ?? str;
     if (hasOwnProp.call(stringTable, str)) {
       return numeric(stringTable[str], true);
     } else {

package/dist/cjs/common/util/data-size.js

@@ -6,7 +6,7 @@ Object.defineProperty(exports, "__esModule", {
 exports.dataSize = dataSize;
 var _stringify = require("./stringify");
 /**
- * Copyright 2020-2025 New Relic, Inc. All rights reserved.
+ * Copyright 2020-2026 New Relic, Inc. All rights reserved.
  * SPDX-License-Identifier: Apache-2.0
  */
 
@@ -17,7 +17,7 @@ var _stringify = require("./stringify");
  * @returns {(number|undefined)} - The size of the data or undefined if size cannot be determined.
  */
 function dataSize(data) {
-  if (typeof data === 'string' && data.length) return data.length;
+  if (typeof data === 'string') return data.length;
   if (typeof data !== 'object') return undefined;
   // eslint-disable-next-line
   if (typeof ArrayBuffer !== 'undefined' && data instanceof ArrayBuffer && data.byteLength) return data.byteLength;

package/dist/cjs/common/util/obfuscate.js

@@ -7,7 +7,7 @@ exports.Obfuscator = void 0;
 var _protocol = require("../url/protocol");
 var _console = require("./console");
 /**
- * Copyright 2020-2025 New Relic, Inc. All rights reserved.
+ * Copyright 2020-2026 New Relic, Inc. All rights reserved.
  * SPDX-License-Identifier: Apache-2.0
  */
 
@@ -16,6 +16,7 @@ var _console = require("./console");
  * @typedef {object} ObfuscationRule
  * @property {string|RegExp} regex The regular expression to match against in the payload
  * @property {string} [replacement] The string to replace the matched regex with
+ * @property {string[]} [eventFilter] An optional list of event types to which this rule should be applied. If not provided, or an empty array, the rule will be applied to all events.
  */
 
 /**
@@ -30,14 +31,33 @@ var _console = require("./console");
  */
 
 class Obfuscator {
-  constructor(agentRef) {
+  /**
+   * @param {Object} agentRef - Reference to the agent instance
+   * @param {string} [eventType] - Optional event type this obfuscator instance handles.
+   *                               If provided, only rules matching this event type (or rules with no eventFilter) will be applied.
+   */
+  constructor(agentRef, eventType) {
     this.agentRef = agentRef;
+    this.eventType = eventType;
     this.warnedRegexMissing = false;
     this.warnedInvalidRegex = false;
     this.warnedInvalidReplacement = false;
   }
   get obfuscateConfigRules() {
-    return this.agentRef.init.obfuscate || [];
+    const allRules = this.agentRef.init.obfuscate || [];
+
+    // If this instance has no specific event type, return all rules
+    if (!this.eventType) return allRules;
+
+    // Filter rules to only those that apply to this instance's event type
+    return allRules.filter(rule => {
+      // If rule has no eventFilter, it applies to all events
+      if (!this.#hasValidEventFilter(rule)) {
+        return true;
+      }
+      // Otherwise, check if this instance's event type matches the rule's filter
+      return rule.eventFilter.includes(this.eventType);
+    });
   }
 
   /**
@@ -63,6 +83,130 @@ class Obfuscator {
     }, input);
   }
 
+  /**
+   * Traverses an object and obfuscates all string properties.
+   * This instance will only apply rules that match its configured event type (if any).
+   * For features with mixed event types in their payloads (like generic_events), this will
+   * traverse the object and check each object's eventType property against the rules.
+   * @param {Object|Array} obj - The object or array to traverse
+   * @returns {Object|Array} The modified object
+   */
+  traverseAndObfuscateEvents(obj) {
+    if (!obj || typeof obj !== 'object') return obj;
+
+    // If this instance was configured with a specific event type, obfuscate everything
+    // (rules are already filtered in obfuscateConfigRules getter)
+    if (this.eventType) {
+      this.#applyFnToAllStrings(obj, this.obfuscateString.bind(this));
+      return obj;
+    }
+
+    // For generic obfuscators (no specific event types), check individual eventType properties
+    // This path is for features like generic_events that handle multiple event types
+    const eventTypesToObfuscate = new Set();
+    const globalRules = [];
+    const eventSpecificRules = [];
+    this.obfuscateConfigRules.forEach(rule => {
+      if (this.#hasValidEventFilter(rule)) {
+        eventSpecificRules.push(rule);
+        rule.eventFilter.forEach(eventType => eventTypesToObfuscate.add(eventType));
+      } else {
+        globalRules.push(rule);
+      }
+    });
+
+    // Optimization: if ALL rules are global (no event-specific rules exist),
+    // we can just apply all rules to everything without checking eventType properties
+    if (eventSpecificRules.length === 0) {
+      this.#applyFnToAllStrings(obj, this.obfuscateString.bind(this));
+      return obj;
+    }
+
+    // We have a mix of global and event-specific rules:
+    // - Apply event-specific rules only to matching eventTypes
+    // - Apply global rules to ALL event types
+    this.#applyFnWithEventTypeFilter(obj, this.obfuscateString.bind(this), Array.from(eventTypesToObfuscate), globalRules, null);
+    return obj;
+  }
+
+  /**
+   * Recursively applies a function to all string properties in an object.
+   * @param {Object|Array} obj - The object or array to traverse
+   * @param {Function} fn - The function to apply to string properties
+   * @private
+   */
+  #applyFnToAllStrings(obj, fn) {
+    if (!obj || typeof obj !== 'object') return;
+    Object.keys(obj).forEach(property => {
+      const value = obj[property];
+      if (typeof value === 'object' && value !== null) {
+        this.#applyFnToAllStrings(value, fn);
+      } else if (typeof value === 'string') {
+        obj[property] = fn(value);
+      }
+    });
+  }
+
+  /**
+   * Recursively applies a function to string properties based on eventType filtering.
+   * @param {Object|Array} obj - The object or array to traverse
+   * @param {Function} fn - The function to apply to string properties (applies all rules)
+   * @param {string[]} eventTypes - Array of event types to apply event-specific obfuscation
+   * @param {Array} globalRules - Rules without eventFilter that apply to all events
+   * @param {boolean|null} shouldObfuscate - Track obfuscation state: null = not determined yet, true = obfuscate with all rules, false = obfuscate with global rules only
+   * @private
+   */
+  #applyFnWithEventTypeFilter(obj, fn, eventTypes, globalRules, shouldObfuscate) {
+    if (!obj || typeof obj !== 'object') return;
+
+    // Determine the obfuscation state for this object
+    let currentShouldObfuscate = shouldObfuscate;
+
+    // Check if this object has an eventType property
+    if ('eventType' in obj && typeof obj.eventType === 'string') {
+      currentShouldObfuscate = eventTypes.includes(obj.eventType);
+    }
+
+    // Process all properties
+    Object.keys(obj).forEach(property => {
+      const value = obj[property];
+      if (typeof value === 'object' && value !== null) {
+        // Recursively traverse objects/arrays, passing the current obfuscation state
+        this.#applyFnWithEventTypeFilter(value, fn, eventTypes, globalRules, currentShouldObfuscate);
+      } else if (typeof value === 'string') {
+        if (currentShouldObfuscate === true) {
+          // Apply all rules (both global and event-specific)
+          obj[property] = fn(value);
+        } else if (currentShouldObfuscate === false && globalRules.length > 0) {
+          // Apply only global rules
+          obj[property] = this.#applyRulesToString(value, globalRules);
+        }
+        // If currentShouldObfuscate is null, we haven't found an eventType yet, so don't obfuscate
+      }
+    });
+  }
+
+  /**
+   * Applies specific obfuscation rules to a string.
+   * @param {string} input - The string to obfuscate
+   * @param {Array} rules - The rules to apply
+   * @returns {string} The obfuscated string
+   * @private
+   */
+  #applyRulesToString(input, rules) {
+    if (typeof input !== 'string' || input.trim().length === 0) return input;
+    const validatedRules = rules.map(rule => this.validateObfuscationRule(rule));
+    return validatedRules.filter(ruleValidation => ruleValidation.isValid).reduce((input, ruleValidation) => {
+      const {
+        rule
+      } = ruleValidation;
+      return input.replace(rule.regex, rule.replacement || '*');
+    }, input);
+  }
+  #hasValidEventFilter(rule) {
+    return Array.isArray(rule?.eventFilter) && rule.eventFilter.length > 0;
+  }
+
   /**
    * Validates an obfuscation rule and provides errors if any are found.
    * @param {ObfuscationRule} rule The rule to validate

package/dist/cjs/common/wrap/wrap-websocket.js

@@ -10,6 +10,7 @@ var _now = require("../timing/now");
 var _cleanUrl = require("../url/clean-url");
 var _nreum = require("../window/nreum");
 var _pageVisibility = require("../window/page-visibility");
+var _events = require("../constants/events");
 /**
  * Copyright 2020-2026 New Relic, Inc. All rights reserved.
  * SPDX-License-Identifier: Apache-2.0
@@ -40,7 +41,7 @@ function wrapWebSocket(sharedEE) {
     });
   });
   class WrappedWebSocket extends WebSocket {
-    static name = 'WebSocket';
+    static name = _events.EVENT_TYPES.WS;
     static toString() {
       // fake native WebSocket when static class is stringified
       return 'function WebSocket() { [native code] }';

package/dist/cjs/common/wrap/wrap-xhr.js

@@ -23,7 +23,7 @@ var _utils = require("../v2/utils");
  */
 
 const wrapped = {};
-const XHR_PROPS = ['open', 'send']; // these are the specific funcs being wrapped on all XMLHttpRequests(.prototype)
+const XHR_PROPS = ['open', 'send', 'setRequestHeader']; // these are the specific funcs being wrapped on all XMLHttpRequests(.prototype)
 
 /**
  * Wraps the native XMLHttpRequest (XHR) object to emit custom events to its readystatechange event and an assortment

package/dist/cjs/features/ajax/aggregate/gql.js

@@ -3,10 +3,11 @@
 Object.defineProperty(exports, "__esModule", {
   value: true
 });
+exports.hasGQLErrors = hasGQLErrors;
 exports.parseGQL = parseGQL;
 var _typeCheck = require("../../../common/util/type-check");
 /**
- * Copyright 2020-2025 New Relic, Inc. All rights reserved.
+ * Copyright 2020-2026 New Relic, Inc. All rights reserved.
  * SPDX-License-Identifier: Apache-2.0
  */
 
@@ -95,4 +96,42 @@ function parseGQLQueryString(gqlQueryString) {
 }
 function validateGQLObject(obj) {
   return !(typeof obj !== 'object' || !obj.query || typeof obj.query !== 'string');
+}
+
+/**
+ * Checks if a response object has valid GraphQL errors.
+ * @param {object} response - A single GraphQL response object
+ * @returns {boolean} True if the response has valid errors
+ */
+function hasValidGQLErrors(response) {
+  return Array.isArray(response?.errors) && response.errors.some(err => err && typeof err === 'object' && typeof err.message === 'string');
+}
+
+/**
+ * Checks if a response body contains GraphQL errors according to the GraphQL spec.
+ * A valid GraphQL error response contains an "errors" array with at least one error object.
+ * Supports both single and batched GraphQL responses.
+ * @param {string|object|array} [responseBody] The response body to check
+ * @returns {boolean} True if the response contains GraphQL errors
+ */
+function hasGQLErrors(responseBody) {
+  if (!responseBody) return false;
+  try {
+    let parsed = responseBody;
+
+    // Parse string to object if needed
+    if (typeof responseBody === 'string') {
+      parsed = JSON.parse(responseBody);
+    }
+
+    // Handle batched GraphQL responses (array of response objects)
+    if (Array.isArray(parsed)) {
+      return parsed.some(hasValidGQLErrors);
+    }
+
+    // Handle single GraphQL response
+    return hasValidGQLErrors(parsed);
+  } catch (err) {
+    return false;
+  }
 }