@newrelic/browser-agent 1.316.0 → 1.317.0

package/dist/cjs/features/session_replay/aggregate/index.js

@@ -17,9 +17,11 @@ var _stringify = require("../../../common/util/stringify");
 var _stylesheetEvaluator = require("../shared/stylesheet-evaluator");
 var _now = require("../../../common/timing/now");
 var _agentConstants = require("../../../common/constants/agent-constants");
+var _events = require("../../../common/constants/events");
 var _cleanUrl = require("../../../common/url/clean-url");
 var _featureGates = require("../../utils/feature-gates");
 var _constants3 = require("../../../loaders/api/constants");
+var _obfuscate = require("../../../common/util/obfuscate");
 function _interopRequireWildcard(e, t) { if ("function" == typeof WeakMap) var r = new WeakMap(), n = new WeakMap(); return (_interopRequireWildcard = function (e, t) { if (!t && e && e.__esModule) return e; var o, i, f = { __proto__: null, default: e }; if (null === e || "object" != typeof e && "function" != typeof e) return f; if (o = t ? n : r) { if (o.has(e)) return o.get(e); o.set(e, f); } for (const t in e) "default" !== t && {}.hasOwnProperty.call(e, t) && ((i = (o = Object.defineProperty) && Object.getOwnPropertyDescriptor(e, t)) && (i.get || i.set) ? o(f, t, i) : f[t] = e[t]); return f; })(e, t); } /**
  * Copyright 2020-2026 New Relic, Inc. All rights reserved.
  * SPDX-License-Identifier: Apache-2.0
@@ -33,6 +35,10 @@ class Aggregate extends _aggregateBase.AggregateBase {
   // pass the recorder into the aggregator
   constructor(agentRef, args) {
     super(agentRef, _constants.FEATURE_NAME);
+
+    // Create obfuscator for session replay query params
+    this.obfuscator = new _obfuscate.Obfuscator(agentRef, _events.EVENT_TYPES.SR);
+
     /** Set once the recorder has fully initialized after flag checks and sampling */
     this.initialized = false;
     /** Set once the feature has been "aborted" to prevent other side-effects from continuing */
@@ -310,7 +316,7 @@ class Aggregate extends _aggregateBase.AggregateBase {
     return {
       qs: {
         browser_monitoring_key: this.agentRef.info.licenseKey,
-        type: 'SessionReplay',
+        type: _events.EVENT_TYPES.SR,
         app_id: this.agentRef.info.applicationID,
         protocol_version: '0',
         timestamp: firstTimestamp,

package/dist/cjs/features/session_trace/aggregate/index.js

@@ -11,9 +11,10 @@ var _storage = require("./trace/storage");
 var _encode = require("../../../common/url/encode");
 var _runtime = require("../../../common/constants/runtime");
 var _constants2 = require("../../../common/session/constants");
-var _traverse = require("../../../common/util/traverse");
+var _obfuscate = require("../../../common/util/obfuscate");
 var _cleanUrl = require("../../../common/url/clean-url");
 var _console = require("../../../common/util/console");
+var _events = require("../../../common/constants/events");
 /**
  * Copyright 2020-2026 New Relic, Inc. All rights reserved.
  * SPDX-License-Identifier: Apache-2.0
@@ -27,6 +28,9 @@ class Aggregate extends _aggregateBase.AggregateBase {
     super(agentRef, _constants.FEATURE_NAME);
     this.harvestOpts.raw = true;
 
+    // Create obfuscator for session trace nodes
+    this.obfuscator = new _obfuscate.Obfuscator(agentRef, _events.EVENT_TYPES.ST);
+
     /** Tied to the entitlement flag response from BCS.  Will short circuit operations of the agg if false  */
     this.entitled = undefined;
     /** A flag used to decide if the 30 node threshold should be ignored on the first harvest to ensure sending on the first payload */
@@ -113,7 +117,7 @@ class Aggregate extends _aggregateBase.AggregateBase {
   serializer(stns) {
     if (!stns.length) return; // there are no processed nodes
     this.everHarvested = true;
-    return (0, _traverse.applyFnToProps)(stns, this.obfuscator.obfuscateString.bind(this.obfuscator), 'string');
+    return this.obfuscator.traverseAndObfuscateEvents(stns);
   }
   queryStringsBuilder(stns) {
     const firstSessionHarvest = !this.agentRef.runtime.session.state.traceHarvestStarted;

package/dist/cjs/features/soft_navigations/aggregate/ajax-node.js

@@ -5,6 +5,7 @@ Object.defineProperty(exports, "__esModule", {
 });
 exports.AjaxNode = void 0;
 var _belSerializer = require("../../../common/serialize/bel-serializer");
+var _payloads = require("../../../common/payloads/payloads");
 var _constants = require("../../ajax/constants");
 var _constants2 = require("../constants");
 var _belNode = require("./bel-node");
@@ -31,6 +32,12 @@ class AjaxNode extends _belNode.BelNode {
     this.targetAttributes = ajaxEvent.targetAttributes;
     this[_constants.AJAX_ID] = ajaxEvent[_constants.AJAX_ID]; // all AjaxRequest events should have a unique identifier to allow for easier grouping and analysis in the UI
 
+    // optional payload metadata attributes
+    this.requestBody = ajaxEvent.requestBody;
+    this.requestHeaders = ajaxEvent.requestHeaders;
+    this.requestQuery = ajaxEvent.requestQuery;
+    this.responseBody = ajaxEvent.responseBody;
+    this.responseHeaders = ajaxEvent.responseHeaders;
     this.start = ajaxEvent.startTime;
     this.end = ajaxEvent.endTime;
     if (ajaxContext?.latestLongtaskEnd) {
@@ -38,8 +45,11 @@ class AjaxNode extends _belNode.BelNode {
       this.callbackDuration = this.callbackEnd - this.end; // callbackDuration is the time from ajax loaded to last long task observed from it
     } else this.callbackEnd = this.end; // if no long task was observed, callbackEnd is the same as end
   }
-  serialize(parentStartTimestamp, agentRef) {
-    const addString = (0, _belSerializer.getAddStringContext)(agentRef.runtime.obfuscator);
+  serialize(parentStartTimestamp, agentRef, ajaxObfuscator) {
+    const {
+      addString,
+      addStringWithTruncation
+    } = (0, _payloads.createStringAdders)(_belSerializer.getAddStringContext, ajaxObfuscator);
     const nodeList = [];
 
     // IMPORTANT: The order in which addString is called matters and correlates to the order in which string shows up in the harvest payload. Do not re-order the following code.
@@ -54,11 +64,32 @@ class AjaxNode extends _belNode.BelNode {
     (0, _belSerializer.numeric)(this.callbackDuration),
     // not relative
     addString(this.method), (0, _belSerializer.numeric)(this.status), addString(this.domain), addString(this.path), (0, _belSerializer.numeric)(this.txSize), (0, _belSerializer.numeric)(this.rxSize), this.requestedWith, addString(this.nodeId), (0, _belSerializer.nullable)(this.spanId, addString, true) + (0, _belSerializer.nullable)(this.traceId, addString, true) + (0, _belSerializer.nullable)(this.spanTimestamp, _belSerializer.numeric)];
-    let allAttachedNodes = (0, _belSerializer.addCustomAttributes)({
-      ...(this.gql || {}),
+    // Regular attributes: obfuscate only
+    const regularAttrs = (0, _belSerializer.addCustomAttributes)({
+      [_constants.AJAX_ID]: this[_constants.AJAX_ID],
       ...(this.targetAttributes || {}),
-      [_constants.AJAX_ID]: this[_constants.AJAX_ID]
+      ...(this.gql || {})
     }, addString);
+
+    // Payload attributes: obfuscate then truncate
+    const payloadAttrs = (0, _belSerializer.addCustomAttributes)({
+      ...(this.requestBody ? {
+        requestBody: this.requestBody
+      } : {}),
+      ...(this.requestHeaders ? {
+        requestHeaders: this.requestHeaders
+      } : {}),
+      ...(this.requestQuery ? {
+        requestQuery: this.requestQuery
+      } : {}),
+      ...(this.responseBody ? {
+        responseBody: this.responseBody
+      } : {}),
+      ...(this.responseHeaders ? {
+        responseHeaders: this.responseHeaders
+      } : {})
+    }, addStringWithTruncation);
+    let allAttachedNodes = [...regularAttrs, ...payloadAttrs];
     this.children.forEach(node => allAttachedNodes.push(node.serialize())); // no children is expected under ajax nodes at this time
 
     fields[1] = (0, _belSerializer.numeric)(allAttachedNodes.length);

package/dist/cjs/features/soft_navigations/aggregate/index.js

@@ -10,10 +10,12 @@ var _webdriverDetection = require("../../../common/util/webdriver-detection");
 var _loadTime = require("../../../common/vitals/load-time");
 var _features = require("../../../loaders/features/features");
 var _aggregateBase = require("../../utils/aggregate-base");
+var _obfuscate = require("../../../common/util/obfuscate");
 var _constants = require("../constants");
 var _ajaxNode = require("./ajax-node");
 var _initialPageLoadInteraction = require("./initial-page-load-interaction");
 var _interaction = require("./interaction");
+var _events = require("../../../common/constants/events");
 /**
  * Copyright 2020-2026 New Relic, Inc. All rights reserved.
  * SPDX-License-Identifier: Apache-2.0
@@ -26,6 +28,10 @@ class Aggregate extends _aggregateBase.AggregateBase {
   }) {
     super(agentRef, _constants.FEATURE_NAME);
     super.customAttributesAreSeparate = true;
+
+    // Create obfuscators for browser interactions and nested AJAX requests
+    this.interactionObfuscator = new _obfuscate.Obfuscator(agentRef, _events.EVENT_TYPES.BI);
+    this.ajaxObfuscator = new _obfuscate.Obfuscator(agentRef, _events.EVENT_TYPES.AJAX);
     this.interactionsToHarvest = this.events;
     this.domObserver = domObserver;
     this.initialPageLoadInteraction = new _initialPageLoadInteraction.InitialPageLoadInteraction(agentRef);
@@ -89,7 +95,7 @@ class Aggregate extends _aggregateBase.AggregateBase {
     let firstIxnStartTime;
     const serializedIxnList = [];
     for (const interaction of eventBuffer) {
-      serializedIxnList.push(interaction.serialize(firstIxnStartTime, this.agentRef));
+      serializedIxnList.push(interaction.serialize(firstIxnStartTime, this.agentRef, this.interactionObfuscator, this.ajaxObfuscator));
       if (firstIxnStartTime === undefined) firstIxnStartTime = Math.floor(interaction.start); // careful not to match or overwrite on 0 value!
     }
     return "bel.7;".concat(serializedIxnList.join(';'));

package/dist/cjs/features/soft_navigations/aggregate/initial-page-load-interaction.js

@@ -11,7 +11,7 @@ var _firstPaint = require("../../../common/vitals/first-paint");
 var _firstContentfulPaint = require("../../../common/vitals/first-contentful-paint");
 var _constants = require("../constants");
 /**
- * Copyright 2020-2025 New Relic, Inc. All rights reserved.
+ * Copyright 2020-2026 New Relic, Inc. All rights reserved.
  * SPDX-License-Identifier: Apache-2.0
  */
 

package/dist/cjs/features/soft_navigations/aggregate/interaction.js

@@ -12,7 +12,7 @@ var _cleanUrl = require("../../../common/url/clean-url");
 var _constants = require("../constants");
 var _belNode = require("./bel-node");
 /**
- * Copyright 2020-2025 New Relic, Inc. All rights reserved.
+ * Copyright 2020-2026 New Relic, Inc. All rights reserved.
  * SPDX-License-Identifier: Apache-2.0
  */
 
@@ -127,11 +127,13 @@ class Interaction extends _belNode.BelNode {
    * Serializes (BEL) the interaction data for transmission.
    * @param {Number} firstStartTimeOfPayload timestamp
    * @param {Agent} agentRef Pass in the agent reference directly so that the event itself doesnt need to store the pointers and ruin the evaluation of the event size by including unused object references.
+   * @param {Obfuscator} interactionObfuscator Obfuscator for BrowserInteraction event type
+   * @param {Obfuscator} ajaxObfuscator Obfuscator for AjaxRequest event type (passed to child AjaxNodes)
    * @returns {String} A string that is the serialized representation of this interaction.
    */
-  serialize(firstStartTimeOfPayload, agentRef) {
+  serialize(firstStartTimeOfPayload, agentRef, interactionObfuscator, ajaxObfuscator) {
     const isFirstIxnOfPayload = firstStartTimeOfPayload === undefined;
-    const addString = (0, _belSerializer.getAddStringContext)(agentRef.runtime.obfuscator);
+    const addString = (0, _belSerializer.getAddStringContext)(interactionObfuscator);
     const nodeList = [];
     let ixnType;
     if (this.trigger === _constants.IPL_TRIGGER_NAME) ixnType = _constants.INTERACTION_TYPE.INITIAL_PAGE_LOAD;else if (this.newURL !== this.oldURL) ixnType = _constants.INTERACTION_TYPE.ROUTE_CHANGE;else ixnType = _constants.INTERACTION_TYPE.UNSPECIFIED;
@@ -157,7 +159,7 @@ class Interaction extends _belNode.BelNode {
     /* Querypack encoder+decoder quirkiness:
        - If first ixn node of payload is being processed, its children's start time must be offset by this node's start. (firstStartTime should be undefined.)
        - Else for subsequent ixns in the same payload, we go back to using that first ixn node's start to offset their children's start. */
-    this.children.forEach(node => allAttachedNodes.push(node.serialize(isFirstIxnOfPayload ? this.start : firstStartTimeOfPayload, agentRef))); // recursively add the serialized string of every child of this (ixn) bel node
+    this.children.forEach(node => allAttachedNodes.push(node.serialize(isFirstIxnOfPayload ? this.start : firstStartTimeOfPayload, agentRef, ajaxObfuscator))); // recursively add the serialized string of every child of this (ixn) bel node
 
     fields[1] = (0, _belSerializer.numeric)(allAttachedNodes.length);
     nodeList.push(fields);

package/dist/cjs/features/utils/aggregate-base.js

@@ -6,7 +6,6 @@ Object.defineProperty(exports, "__esModule", {
 exports.AggregateBase = void 0;
 var _featureBase = require("./feature-base");
 var _drain = require("../../common/drain/drain");
-var _obfuscate = require("../../common/util/obfuscate");
 var _features = require("../../loaders/features/features");
 var _harvester = require("../../common/harvest/harvester");
 var _eventBuffer = require("./event-buffer");
@@ -183,8 +182,8 @@ class AggregateBase extends _featureBase.FeatureBase {
    * This method should run after checkConfiguration, which may reset the agent's info/runtime object that is used here.
    */
   doOnceForAllAggregate(agentRef) {
-    if (!agentRef.runtime.obfuscator) agentRef.runtime.obfuscator = new _obfuscate.Obfuscator(agentRef);
-    this.obfuscator = agentRef.runtime.obfuscator;
+    // Note: obfuscator is now created per-feature for their specific event types
+
     if (!agentRef.runtime.harvester) agentRef.runtime.harvester = new _harvester.Harvester(agentRef);
   }
 

package/dist/esm/common/config/init-types.js

@@ -11,6 +11,7 @@
  * @property {boolean} [ajax.block_internal] - If true, agent requests going to harvest endpoint are treated as on deny list. In other words, agent will not self-report AJAX.
  * @property {boolean} [ajax.enabled] - Turn on/off the ajax feature (on by default).
  * @property {boolean} [ajax.autoStart] - If true, the agent will automatically start the ajax feature. Otherwise, it will be in a deferred state until the `start` API method is called.
+ * @property {('none'|'failures'|'all')} [ajax.capture_payloads] - Controls when AJAX request/response payloads are captured. 'none' = never capture, 'failures' = capture only on errors (4xx, 5xx, network errors, GraphQL errors), 'all' = always capture.
  * @property {Object} [api]
  * @property {Object} [api.register]
  * @property {boolean} [api.register.enabled] - If true, the agent will allow registered children to be sent to the server.

package/dist/esm/common/config/init.js

@@ -3,6 +3,7 @@
  * SPDX-License-Identifier: Apache-2.0
  */
 import { FEATURE_FLAGS } from '../../features/generic_events/constants';
+import { CAPTURE_PAYLOAD_SETTINGS } from '../../features/ajax/constants';
 import { isValidSelector } from '../dom/query-selector';
 import { DEFAULT_EXPIRES_MS, DEFAULT_INACTIVE_MS } from '../session/constants';
 import { warn } from '../util/console';
@@ -51,7 +52,8 @@ const InitModelFn = () => {
       deny_list: undefined,
       block_internal: true,
       enabled: true,
-      autoStart: true
+      autoStart: true,
+      capture_payloads: CAPTURE_PAYLOAD_SETTINGS.NONE
     },
     api: {
       register: {

package/dist/esm/common/constants/env.cdn.js

@@ -11,7 +11,7 @@
 /**
  * Exposes the version of the agent
  */
-export const VERSION = "1.316.0";
+export const VERSION = "1.317.0";
 
 /**
  * Exposes the build type of the agent
@@ -25,4 +25,4 @@ export const BUILD_ENV = "CDN";
 export const DIST_METHOD = 'CDN';
 export const RRWEB_PACKAGE_NAME = '@newrelic/rrweb';
 // Babel will inline this with the rrweb (fork) version on CDN builds.
-export const RRWEB_VERSION = "1.1.0";
+export const RRWEB_VERSION = "^1.1.2";

package/dist/esm/common/constants/env.npm.js

@@ -11,7 +11,7 @@
 /**
  * Exposes the version of the agent
  */
-export const VERSION = "1.316.0";
+export const VERSION = "1.317.0";
 
 /**
  * Exposes the build type of the agent
@@ -26,4 +26,4 @@ export const BUILD_ENV = 'NPM';
 export const DIST_METHOD = 'NPM';
 export const RRWEB_PACKAGE_NAME = '@newrelic/rrweb';
 // Babel will inline this with the rrweb (fork) version on NPM dist esm/cjs builds.
-export const RRWEB_VERSION = "1.1.0";
+export const RRWEB_VERSION = "^1.1.2";

package/dist/esm/common/constants/events.js

@@ -0,0 +1,20 @@
+/**
+ * Copyright 2020-2026 New Relic, Inc. All rights reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+export const EVENT_TYPES = {
+  AJAX: 'AjaxRequest',
+  PA: 'PageAction',
+  UA: 'UserAction',
+  BP: 'BrowserPerformance',
+  WS: 'WebSocket',
+  SPV: 'SecurityPolicyViolation',
+  JSE: 'JavaScriptError',
+  LOG: 'Log',
+  PVE: 'PageView',
+  PVT: 'PageViewTiming',
+  SR: 'SessionReplay',
+  ST: 'SessionTrace',
+  BI: 'BrowserInteraction'
+};

package/dist/esm/common/harvest/harvester.js

@@ -16,6 +16,7 @@ import { warn } from '../util/console';
 import { stringify } from '../util/stringify';
 import { getSubmitMethod, xhr as xhrMethod, xhrFetch as fetchMethod } from '../util/submit-data';
 import { dispatchGlobalEvent } from '../dispatch/global-event';
+import { Obfuscator } from '../util/obfuscate';
 const RETRY = 'Harvester/Retry/';
 const RETRY_ATTEMPTED = RETRY + 'Attempted/';
 const RETRY_FAILED = RETRY + 'Failed/';
@@ -25,6 +26,10 @@ export class Harvester {
   initializedAggregates = [];
   constructor(agentRef) {
     this.agentRef = agentRef;
+
+    // Create obfuscator for harvest metadata (referrer URL, etc.)
+    // No event type specified - applies to all harvests regardless of feature
+    this.obfuscator = new Obfuscator(agentRef);
     subscribeToEOL(() => {
       // do one last harvest round or check
       this.initializedAggregates.forEach(aggregateInst => {
@@ -71,6 +76,7 @@ export class Harvester {
       payload: output.payload,
       localOpts,
       submitMethod,
+      harvesterObfuscator: this.obfuscator,
       cbFinished,
       raw: aggregateInst.harvestOpts.raw,
       featureName: aggregateInst.featureName,
@@ -119,7 +125,8 @@ export function send(agentRef, {
   cbFinished,
   raw,
   featureName,
-  endpointVersion = 1
+  endpointVersion = 1,
+  harvesterObfuscator
 }) {
   if (!agentRef.info.errorBeacon) return false;
   let {
@@ -136,7 +143,7 @@ export function send(agentRef, {
   const protocol = agentRef.init.ssl === false ? 'http' : 'https';
   const perceivedBeacon = agentRef.init.proxy.beacon || agentRef.info.errorBeacon;
   const url = raw ? "".concat(protocol, "://").concat(perceivedBeacon, "/").concat(endpoint) : "".concat(protocol, "://").concat(perceivedBeacon).concat(endpoint !== RUM ? '/' + endpoint : '', "/").concat(endpointVersion, "/").concat(agentRef.info.licenseKey);
-  const baseParams = !raw ? baseQueryString(agentRef, qs, endpoint) : '';
+  const baseParams = !raw ? baseQueryString(agentRef, qs, endpoint, harvesterObfuscator) : '';
   let payloadParams = obj(qs, agentRef.runtime.maxBytes);
   if (baseParams === '' && payloadParams.startsWith('&')) {
     payloadParams = payloadParams.substring(1);
@@ -284,8 +291,9 @@ function cleanPayload(payload = {}) {
 }
 
 // The stuff that gets sent every time.
-function baseQueryString(agentRef, qs, endpoint) {
-  const ref = agentRef.runtime.obfuscator.obfuscateString(cleanURL('' + globalScope.location));
+function baseQueryString(agentRef, qs, endpoint, harvesterObfuscator) {
+  const cleanedURL = cleanURL('' + globalScope.location);
+  const ref = harvesterObfuscator?.obfuscateString(cleanedURL) ?? cleanedURL;
   const session = agentRef.runtime.session;
   const hr = !!session?.state.sessionReplaySentFirstChunk && session?.state.sessionReplayMode === 1 && endpoint !== JSERRORS;
   const ht = !!session?.state.traceHarvestStarted && session?.state.sessionTraceMode === 1 && ![LOGS, BLOBS].includes(endpoint);

package/dist/esm/common/payloads/payloads.js

@@ -0,0 +1,118 @@
+/**
+ * Copyright 2020-2026 New Relic, Inc. All rights reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+import { stringify } from '../util/stringify';
+import { CAPTURE_PAYLOAD_SETTINGS } from '../../features/ajax/constants';
+
+/**
+ * Determines whether payload data should be captured based on the capture mode setting,
+ * HTTP status code, and GraphQL error status.
+ * @param {string} captureMode - The capture mode setting ('none', 'all', or 'failures')
+ * @param {number} statusCode - The HTTP status code
+ * @param {boolean} hasGQLErrors - Whether the response contains GraphQL errors
+ * @returns {boolean} True if payload should be captured
+ */
+export function canCapturePayload(captureMode, statusCode, hasGQLErrors) {
+  if (captureMode === CAPTURE_PAYLOAD_SETTINGS.ALL) return true;
+  if (!captureMode || captureMode === CAPTURE_PAYLOAD_SETTINGS.NONE) return false;
+
+  // Default "failures" mode
+  return statusCode === 0 || statusCode >= 400 || hasGQLErrors === true;
+}
+
+/**
+ * Parses a query string into an object of key-value pairs.
+ * @param {string} search a query string starting with "?" or without (ex. new URL(...).search)
+ * @returns {Object|undefined} Parsed query parameters as key-value pairs. Returns undefined if no valid parameters are found.
+ */
+export function parseQueryString(search) {
+  if (!search || search.length === 0) return;
+  const queryParams = {};
+  try {
+    const searchParams = new URLSearchParams(search);
+    searchParams.forEach(function (value, key) {
+      queryParams[key] = value;
+    });
+  } catch (e) {
+    // Fallback for environments without URLSearchParams
+  }
+  return queryParams;
+}
+
+/**
+ * Determines if the given content type is likely to be human-readable (text-based).
+ * @param {Object} headers - The headers object containing content-type
+ * @param {*} data - The data to check
+ * @returns {boolean} True if the content type is human-readable (text-based)
+ */
+export function isLikelyHumanReadable(headers, data) {
+  if (!headers) return typeof data === 'string';
+  var contentType = headers['content-type'];
+  if (!contentType) return typeof data === 'string';
+  // Normalize to lowercase and extract the mime type (ignore charset, etc.)
+  var mimeType = contentType.toLowerCase().split(';')[0].trim();
+
+  // Check for text/* types
+  if (mimeType.indexOf('text/') === 0) return true;
+
+  // Check for specific application/* types
+  var readableAppTypes = ['/json', '/xml', '/xhtml+xml', '/ld+json', '/yaml', '/x-www-form-urlencoded'];
+  for (var i = 0; i < readableAppTypes.length; i++) {
+    if (mimeType === 'application' + readableAppTypes[i]) return true;
+  }
+  return false;
+}
+
+/**
+ * Truncates a string to ensure its UTF-8 byte length does not exceed 4092 bytes.  If truncation is necessary,
+ * the string is cut off at a character boundary to avoid breaking multi-byte characters and " ..." is appended to indicate truncation.
+ * If not a string, it is first converted to a string using JSON.stringify.
+ * @param {*} data The data to truncate.
+ * @returns {string}
+ */
+export function truncateAsString(data) {
+  if (!data) return data;
+  try {
+    if (typeof data !== 'string') data = stringify(data);
+    let bytes = 0;
+    let i = 0;
+    let needsEllipsis = false;
+    while (i < data.length) {
+      const c = data.charCodeAt(i);
+      const charBytes = c < 0x80 ? 1 : c < 0x800 ? 2 : c < 0xD800 || c >= 0xE000 ? 3 : 4;
+      if (bytes + charBytes > 4092) {
+        needsEllipsis = true;
+        break;
+      }
+      bytes += charBytes;
+      i += charBytes === 4 ? 2 : 1;
+    }
+    return data.slice(0, i) + (needsEllipsis ? ' ...' : '');
+  } catch (e) {
+    return data;
+  }
+}
+
+/**
+ * Creates string adder functions for BEL serialization with obfuscation and optional truncation.
+ * This ensures a single string table is used while providing separate handling for regular vs payload attributes.
+ * @param {Function} getAddStringContext - Function that creates a new string table context
+ * @param {Object} obfuscator - Optional obfuscator instance for string obfuscation
+ * @returns {{addString: Function, addStringWithTruncation: Function}} Object containing both string adder functions
+ */
+export function createStringAdders(getAddStringContext, obfuscator) {
+  const addStringRaw = getAddStringContext();
+  const processString = (str, shouldTruncate) => {
+    if (typeof str === 'undefined' || str === '') return addStringRaw(str);
+    if (typeof str !== 'string') str = stringify(str);
+    const obfuscated = obfuscator?.obfuscateString(str) ?? str;
+    const processed = shouldTruncate ? truncateAsString(obfuscated) : obfuscated;
+    return addStringRaw(processed);
+  };
+  return {
+    addString: str => processString(str, false),
+    addStringWithTruncation: str => processString(str, true)
+  };
+}

package/dist/esm/common/serialize/bel-serializer.js

@@ -1,5 +1,5 @@
 /**
- * Copyright 2020-2025 New Relic, Inc. All rights reserved.
+ * Copyright 2020-2026 New Relic, Inc. All rights reserved.
  * SPDX-License-Identifier: Apache-2.0
  */
 
@@ -15,13 +15,14 @@ export function numeric(n, noDefault) {
   }
   return n === undefined || n === 0 ? '' : Math.floor(n).toString(36);
 }
-export function getAddStringContext(obfuscator) {
+export function getAddStringContext(obfuscator, truncator) {
   let stringTableIdx = 0;
   const stringTable = Object.prototype.hasOwnProperty.call(Object, 'create') ? Object.create(null) : {};
   return addString;
   function addString(str) {
     if (typeof str === 'undefined' || str === '') return '';
-    str = obfuscator.obfuscateString(String(str));
+    str = obfuscator?.obfuscateString(String(str)) ?? String(str);
+    str = truncator?.(str) ?? str;
     if (hasOwnProp.call(stringTable, str)) {
       return numeric(stringTable[str], true);
     } else {

package/dist/esm/common/util/data-size.js

@@ -1,5 +1,5 @@
 /**
- * Copyright 2020-2025 New Relic, Inc. All rights reserved.
+ * Copyright 2020-2026 New Relic, Inc. All rights reserved.
  * SPDX-License-Identifier: Apache-2.0
  */
 
@@ -12,7 +12,7 @@ import { stringify } from './stringify';
  * @returns {(number|undefined)} - The size of the data or undefined if size cannot be determined.
  */
 export function dataSize(data) {
-  if (typeof data === 'string' && data.length) return data.length;
+  if (typeof data === 'string') return data.length;
   if (typeof data !== 'object') return undefined;
   // eslint-disable-next-line
   if (typeof ArrayBuffer !== 'undefined' && data instanceof ArrayBuffer && data.byteLength) return data.byteLength;