@newrelic/browser-agent 1.319.0 → 1.320.0

package/dist/cjs/loaders/configure/iframe-message-handler.js

@@ -0,0 +1,270 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.handleMethodCall = handleMethodCall;
+exports.setupIframeMFEMessageListener = setupIframeMFEMessageListener;
+var _console = require("../../common/util/console");
+var _utils = require("../../common/v2/utils");
+var _iframeConstants = require("../../common/constants/iframe-constants");
+var _constants = require("../api/constants");
+var _handle = require("../../common/event-emitter/handle");
+var _features = require("../features/features");
+var _stringify = require("../../common/util/stringify");
+var _registerHandler = require("../../common/event-emitter/register-handler");
+var _drain = require("../../common/drain/drain");
+var _runtime = require("../../common/constants/runtime");
+/**
+ * Copyright 2020-2026 New Relic, Inc. All rights reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+/**
+ * Retrieves the registered entity associated with the iframeInterfaceId from the event data, and validates that the origin of the message event matches the expected origin for that entity.
+ * @param {MessageEvent} event - The message event containing the method call or registration request
+ * @param {Object} agent - The browser agent instance
+ * @returns {Object|undefined} - The registered entity if it exists and the origin is valid, otherwise undefined
+ */
+function getValidEntity(event, agent) {
+  try {
+    const {
+      iframeInterfaceId
+    } = event.data;
+    if (!iframeInterfaceId) return;
+    const entity = (0, _utils.getRegisteredEntityByIframeInterfaceId)(iframeInterfaceId, agent);
+    if (!isValidOrigin(event, entity)) return;
+    return entity;
+  } catch (e) {
+    // couldnt get entity or validate origin, just let the method return undefined
+  }
+}
+function isSafeProperty(obj, property) {
+  return property in obj && typeof property === 'string' && !['__proto__', 'constructor', 'prototype'].includes(property);
+}
+
+/**
+ * Handles timing property updates from iframes. Mutates the timings object on the entity's metadata with the new value for the specified property.
+ * @param {MessageEvent} event - The message event containing the timing update
+ * @param {Object} agent - The browser agent instance
+ * @returns
+ */
+function handleTimingUpdate(event, agent) {
+  const entity = getValidEntity(event, agent);
+  if (!entity) return;
+  if (!entity.metadata.timings) return;
+  event.data.entries?.forEach(({
+    property,
+    value
+  }) => {
+    if (isSafeProperty(entity.metadata.timings, property)) {
+      entity.metadata.timings[property] = value;
+    }
+  });
+}
+
+/**
+ * Handles vitals property updates from iframes. Mutates the vitals object on the entity's metadata with the new value for the specified property.
+ * @param {MessageEvent} event - The message event containing the vitals update
+ * @param {Object} agent - The browser agent instance
+ * @returns
+ */
+function handleVitalsUpdate(event, agent) {
+  const entity = getValidEntity(event, agent);
+  if (!entity) return;
+  if (!entity.metadata?.vitals) return;
+  event.data.entries?.forEach(({
+    property,
+    value
+  }) => {
+    if (isSafeProperty(entity.metadata.vitals, property) && (!!Number(value) || value === 0)) {
+      entity.metadata.vitals[property].value = value;
+    }
+  });
+}
+
+/**
+ * Handles ajax events from iframes and forwards them to the agent's event emitter
+ * @param {MessageEvent} event  - The message event containing the method call or registration request
+ * @param {Object} agent - The browser agent instance
+ * @returns
+ */
+function handleAjax(event, agent) {
+  const entity = getValidEntity(event, agent);
+  if (!entity) return;
+  const {
+    entries
+  } = event.data;
+  entries?.forEach(({
+    params,
+    metrics,
+    start,
+    end,
+    initiatorType
+  }) => {
+    (0, _handle.handle)('xhr', [params, metrics, start, end, initiatorType, entity.metadata.target], undefined, _features.FEATURE_NAMES.ajax, agent.ee);
+  });
+}
+
+/**
+ * Validates that the origin of the message event matches the expected origin for the registered entity
+ * @param {MessageEvent} event - The message event containing the method call or registration request
+ * @param {Object} entity - The registered entity associated with the iframeInterfaceId from the event data
+ * @returns {boolean}
+ */
+function isValidOrigin(event, entity) {
+  if (!entity) return false;
+  try {
+    // "null" is the literal serialization the spec uses for every opaque origin (sandboxed iframes
+    // without allow-same-origin, data:/javascript: URLs, etc.) -- it does not uniquely identify a
+    // single origin, so treating two "null" origins as a match would let an unrelated opaque-origin
+    // frame impersonate the one that actually registered.
+    if (event.origin === 'null' || entity.metadata.target.iframeOrigin === 'null') return false;
+    return event.origin === entity.metadata.target.iframeOrigin;
+  } catch (e) {
+    (0, _console.warn)(77, e);
+    return false;
+  }
+}
+
+/**
+ * Handles both entity registration and method calls on existing entities
+ * @async
+ * @param {MessageEvent} event - The message event containing the method call or registration request
+ * @param {Object} agent - The browser agent instance
+ * @returns {Promise<{entity: Object|null, result: any}>}
+ */
+async function handleMethodCall(event, agent) {
+  const {
+    target,
+    iframeInterfaceId,
+    timestamp
+  } = event.data;
+  // Method calls are always sent one-at-a-time (each has its own postMessage response), so only
+  // the first entry is ever populated -- but the payload shape stays consistent with every other
+  // iframe message type (timing/vitals/ajax), which all wrap their data in an `entries` array.
+  const [{
+    method,
+    args
+  } = {}] = event.data.entries || [];
+  const output = {
+    entity: null,
+    result: null
+  };
+  // Registration of a new entity needs to be handled differently than method calls on existing entities
+  if (method === _constants.REGISTER) {
+    // "null" is the opaque-origin serialization (sandboxed iframes, data:/javascript: URLs) -- it
+    // doesn't identify a single origin, so an entity registered from one can never be safely
+    // distinguished from another later on (see isValidOrigin). Reject up front rather than
+    // registering an entity that would silently fail every subsequent call.
+    if (event.origin === 'null') {
+      (0, _console.warn)(74, event.origin);
+      return output;
+    }
+    const iframeDomains = agent.init.api.register.iframe_domains;
+    if (iframeDomains.length && !iframeDomains.includes(event.origin)) {
+      (0, _console.warn)(74, event.origin);
+      return output;
+    }
+    const targetData = args?.[0] || target || {};
+    if (!agent[_constants.REGISTER]) {
+      (0, _console.warn)(35, _constants.REGISTER);
+      return output;
+    }
+    const freshTarget = {
+      id: targetData.id,
+      name: targetData.name,
+      type: targetData.type,
+      version: targetData.version,
+      tags: targetData.tags
+    };
+    output.entity = agent[_constants.REGISTER](freshTarget);
+    output.entity.metadata.target.iframeInterfaceId = iframeInterfaceId;
+    output.entity.metadata.target.iframeOrigin = event.origin;
+    return output;
+  }
+  const entity = (0, _utils.getRegisteredEntityByIframeInterfaceId)(iframeInterfaceId, agent);
+  if (!isValidOrigin(event, entity)) {
+    (0, _console.warn)(76);
+    return output;
+  }
+  output.entity = entity;
+  const methodFn = entity[method];
+  if (!isSafeProperty(entity, method) || typeof methodFn !== 'function') {
+    (0, _console.warn)(35, method);
+    return output;
+  }
+
+  // Supply the timestamp captured inside the iframe at call time (from event.data.timestamp)
+  entity.metadata.events.latestTimestamp = timestamp;
+  output.result = await methodFn.apply(entity, args || []);
+  return output;
+}
+
+/**
+ * Serializes entity metadata for postMessage response.
+ * Strips out any non-serializable properties and returns a plain object.
+ * postMessage cant handle complex objects that cause DataCloneErrors to throw like functions, circular references, etc.
+ * @param {Object} entity - The registered entity whose metadata is to be serialized.  Uses a pattern of stringify and parse to remove any non-serializable properties from the metadata object.
+ * @returns {Object} - The serialized metadata object
+*/
+function serializeMetadata(entity) {
+  const meta = entity.metadata;
+  return JSON.parse((0, _stringify.stringify)(meta));
+}
+
+/**
+ * Sends a postMessage response to the iframe
+ * @param {MessageEvent} event - The message event containing the method call or registration request
+ * @param {Object} payload - The response payload to send back to the iframe
+ */
+function sendResponse(event, payload) {
+  event.source.postMessage({
+    type: _iframeConstants.IFRAME_API_RESPONSE,
+    messageId: event.data.messageId,
+    iframeInterfaceId: event.data.iframeInterfaceId,
+    ...payload
+  }, event.origin);
+}
+
+/**
+ * Sets up a postMessage listener to handle API calls and timing updates from iframes
+ * @param {Object} agent The agent instance
+ */
+function setupIframeMFEMessageListener(agent) {
+  if (!_runtime.isBrowserScope || !window.addEventListener || agent.runtime.listeningForIframeMessages) return;
+  (0, _registerHandler.registerHandler)('iframe-message', async event => {
+    if (!event.data) return;
+    switch (event.data.type) {
+      case _iframeConstants.IFRAME_TIMING_UPDATE:
+        handleTimingUpdate(event, agent);
+        return;
+      case _iframeConstants.IFRAME_VITALS_UPDATE:
+        handleVitalsUpdate(event, agent);
+        return;
+      case _iframeConstants.IFRAME_AJAX:
+        handleAjax(event, agent);
+        return;
+      case _iframeConstants.IFRAME_API:
+        try {
+          if (!event.source || !event.data.messageId || !event.data.entries?.[0]?.method) return;
+          const {
+            entity,
+            result
+          } = await handleMethodCall(event, agent);
+          const metadata = entity ? serializeMetadata(entity) : undefined;
+          sendResponse(event, {
+            result,
+            metadata
+          });
+        } catch (error) {
+          const errorMessage = error?.message || String(error);
+          sendResponse(event, {
+            error: errorMessage
+          });
+        }
+    }
+  }, 'IFRAME', agent.ee);
+  (0, _drain.drain)(agent, 'IFRAME', true); // drain any buffered iframe messages that were received before the listener was set up
+  agent.runtime.listeningForIframeMessages = true;
+}

package/dist/esm/common/config/init.js

@@ -23,7 +23,9 @@ const InitModelFn = () => {
     feature_flags: [],
     experimental: {
       register: false,
-      resources: false
+      resources: false,
+      iframe_bridge: false,
+      iframe_domains: []
     },
     mask_selector: '*',
     block_selector: '[data-nr-block]',
@@ -63,7 +65,20 @@ const InitModelFn = () => {
         set enabled(val) {
           hiddenState.experimental.register = val;
         },
-        duplicate_data_to_container: false
+        duplicate_data_to_container: false,
+        // experimental iframe bridge feature
+        get allow_iframe_bridge() {
+          return hiddenState.feature_flags.includes(FEATURE_FLAGS.IFRAME_BRIDGE) || hiddenState.experimental.iframe_bridge;
+        },
+        set allow_iframe_bridge(val) {
+          hiddenState.experimental.iframe_bridge = val;
+        },
+        get iframe_domains() {
+          return hiddenState.experimental.iframe_domains;
+        },
+        set iframe_domains(val) {
+          if (Array.isArray(val)) hiddenState.experimental.iframe_domains = val;else warn(1, val);
+        }
       }
     },
     browser_consent_mode: {

package/dist/esm/common/config/runtime.js

@@ -57,7 +57,8 @@ const RuntimeModel = {
   },
   get harvestCount() {
     return ++_harvestCount;
-  }
+  },
+  listeningForIframeMessages: false
 };
 export const mergeRuntime = runtime => {
   const modeledObject = getModeledObject(runtime, RuntimeModel);

package/dist/esm/common/constants/env.cdn.js

@@ -11,7 +11,7 @@
 /**
  * Exposes the version of the agent
  */
-export const VERSION = "1.319.0";
+export const VERSION = "1.320.0";
 
 /**
  * Exposes the build type of the agent

package/dist/esm/common/constants/env.npm.js

@@ -11,7 +11,7 @@
 /**
  * Exposes the version of the agent
  */
-export const VERSION = "1.319.0";
+export const VERSION = "1.320.0";
 
 /**
  * Exposes the build type of the agent

package/dist/esm/common/constants/iframe-constants.js

@@ -0,0 +1,10 @@
+/**
+ * Copyright 2020-2026 New Relic, Inc. All rights reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+export const prefix = 'newrelic-iframe-';
+export const IFRAME_TIMING_UPDATE = prefix + 'timing-update';
+export const IFRAME_API = prefix + 'api';
+export const IFRAME_API_RESPONSE = prefix + 'api-response';
+export const IFRAME_VITALS_UPDATE = prefix + 'vitals-update';
+export const IFRAME_AJAX = prefix + 'ajax';

package/dist/esm/common/url/add-url.js

@@ -0,0 +1,16 @@
+/**
+ * Copyright 2020-2026 New Relic, Inc. All rights reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { parseUrl } from './parse-url.js';
+export function addUrl(ctx, url) {
+  var parsed = parseUrl(url);
+  var params = ctx.params || ctx;
+  params.hostname = parsed.hostname;
+  params.port = parsed.port;
+  params.protocol = parsed.protocol;
+  params.host = parsed.hostname + ':' + parsed.port;
+  params.pathname = parsed.pathname;
+  ctx.parsedOrigin = parsed;
+  ctx.sameOrigin = parsed.sameOrigin;
+}

package/dist/esm/common/util/console.js

@@ -16,39 +16,39 @@ import { dispatchGlobalEvent } from '../dispatch/global-event';
  *
  * | Code | Message |
  * |------|---------|
- * | 1 | An error occurred while setting a property of a Configurable |
- * | 2 | An error occurred while setting a Configurable |
- * | 3 | Setting a Configurable requires an object as input |
- * | 4 | Setting a Configurable requires a model to set its initial properties |
+ * | 1 | An error occurred while setting a property of a Configurable. |
+ * | 2 | An error occurred while setting a Configurable. |
+ * | 3 | Setting a Configurable requires an object as input. |
+ * | 4 | Setting a Configurable requires a model to set its initial properties. |
  * | 5 | An invalid session_replay.mask_selector was provided. \* will be used. |
- * | 6 | An invalid session_replay.block_selector was provided and will not be used |
- * | 7 | An invalid session_replay.mask_input_option was provided and will not be used |
- * | 8 | Shared context requires an object as input |
- * | 9 | An error occurred while setting SharedContext |
- * | 10 | Failed to read from storage API |
- * | 11 | Failed to write to the storage API |
+ * | 6 | An invalid session_replay.block_selector was provided and will not be used. |
+ * | 7 | An invalid session_replay.mask_input_option was provided and will not be used. |
+ * | 8 | Shared context requires an object as input. |
+ * | 9 | An error occurred while setting SharedContext. |
+ * | 10 | Failed to read from storage API. |
+ * | 11 | Failed to write to the storage API. |
  * | 12 | An obfuscation replacement rule was detected missing a "regex" value. |
- * | 13 | An obfuscation replacement rule contains a "regex" value with an invalid type (must be a string or RegExp) |
- * | 14 | An obfuscation replacement rule contains a "replacement" value with an invalid type (must be a string) |
- * | 15 | An error occurred while intercepting XHR |
- * | 16 | Could not cast log message to string |
+ * | 13 | An obfuscation replacement rule contains a "regex" value with an invalid type (must be a string or RegExp). |
+ * | 14 | An obfuscation replacement rule contains a "replacement" value with an invalid type (must be a string). |
+ * | 15 | An error occurred while intercepting XHR. |
+ * | 16 | Could not cast log message to string. |
  * | 17 | Could not calculate New Relic server time. Agent shutting down. |
  * | 18 | RUM call failed. Agent shutting down. |
  * | 19 | SPA scheduler is not initialized. Saved interaction is not sent! |
  * | 20 | A problem occurred when starting up session manager. This page will not start or extend any session. |
  * | 21 | Failed to initialize the agent. Could not determine the runtime environment. |
  * | 22 | Failed to initialize all enabled instrument classes (agent aborted) - |
- * | 23 | An unexpected issue occurred |
+ * | 23 | An unexpected issue occurred. |
  * | 24 | Something prevented the agent from instrumenting. |
  * | 25 | Something prevented the agent from being downloaded. |
  * | 26 | Failed to initialize instrument classes. |
  * | 27 | Downloading runtime APIs failed... |
  * | 28 | The Browser Agent is attempting to send a very large payload. This is usually tied to large amounts of custom attributes. Please check your configurations. |
- * | 29 | Failed to wrap logger: invalid argument(s) |
- * | 30 | Invalid log level |
- * | 31 | Ignored log: Log is larger than maximum payload size |
- * | 32 | Ignored log: Invalid message |
- * | 33 | Session Replay Aborted |
+ * | 29 | Failed to wrap logger: invalid argument(s). |
+ * | 30 | Invalid log level. |
+ * | 31 | Ignored log: Log is larger than maximum payload size. |
+ * | 32 | Ignored log: Invalid message. |
+ * | 33 | Session Replay Aborted. |
  * | 34 | Downloading and initializing a feature failed... |
  * | 35 | Call to agent api failed. The API is not currently initialized. |
  * | 36 | A feature is enabled but one or more dependent features have not been initialized. This may cause unintended consequences or missing data... |
@@ -57,7 +57,7 @@ import { dispatchGlobalEvent } from '../dispatch/global-event';
  * | 39 | Failed to execute setCustomAttribute. Name must be a string type. |
  * | 40 | Failed to execute setCustomAttribute. Non-null value must be a string, number or boolean type. |
  * | 41 | Failed to execute setUserId. Non-null value must be a string type. |
- * | 42 | Failed to execute setApplicationVersion. Expected <String \| null> |
+ * | 42 | Failed to execute setApplicationVersion. Expected <String \| null>. |
  * | 43 | Agent not configured properly. |
  * | 44 | Invalid object passed to generic event aggregate. Missing "eventType". |
  * | 45 | An internal agent process failed to execute. |
@@ -66,27 +66,34 @@ import { dispatchGlobalEvent } from '../dispatch/global-event';
  * | 48 | Supplied an invalid API target. Must be an <Object> that contains valid (string) id and name properties. |
  * | 49 | Supplied API target is missing an entityGuid. Some APIs may not behave correctly without a valid entityGuid (ex. logs). |
  * | 50 | Failed to connect. Cannot allow registered API. |
- * | 51 | Container agent is not available to register with. Can not connect |
+ * | 51 | Container agent is not available to register with. Can not connect. |
  * | 52 | Unexpected problem encountered. There should be at least one app for harvest! |
- * | 53 | Did not receive a valid entityGuid from connection response |
- * | 54 | An experimental feature is being used. Support can not be offered for issues |
- * | 55 | Register API has been disabled on the container agent |
- * | 56 | Could not find a matching entity to store data |
+ * | 53 | Did not receive a valid entityGuid from connection response. |
+ * | 54 | An experimental feature is being used. Support can not be offered for issues. |
+ * | 55 | Register API has been disabled on the container agent. |
+ * | 56 | Could not find a matching entity to store data. |
  * | 57 | Failed to execute measure. Arguments must have valid types. |
  * | 58 | Failed to execute measure. Resulting duration must be non-negative. |
- * | 59 | Session replay harvested before a session trace payload could be sent. This could be problematic for replays that rely on a trace |
- * | 60 | Session trace aborted |
+ * | 59 | Session replay harvested before a session trace payload could be sent. This could be problematic for replays that rely on a trace. |
+ * | 60 | Session trace aborted. |
  * | 61 | Timestamps must be non-negative and end time cannot be before start time. |
- * | 62 | Timestamp must be a unix timestamp greater than the page origin time |
- * | 63 | A single event was larger than the maximum allowed payload size |
+ * | 62 | Timestamp must be a unix timestamp greater than the page origin time. |
+ * | 63 | A single event was larger than the maximum allowed payload size. |
  * | 64 | Required globals have been mutated before being accessed by the browser agent. This can cause issues and should be avoided. |
- * | 65 | Consent API argument must be boolean or undefined |
- * | 66 | A new agent session has started |
+ * | 65 | Consent API argument must be boolean or undefined. |
+ * | 66 | A new agent session has started. |
  * | 67 | The "spa" feature has been deprecated and disabled. Please use/import "soft_navigations" instead for tracking of BrowserInteraction data. |
  * | 68 | API has been deregistered and can no longer be used. Call "register" API again with credentials to start over. |
- * | 69 | More than one Browser agent is running on the page |
+ * | 69 | More than one Browser agent is running on the page. |
  * | 70 | A session replay payload failed to send and is being retried. Recording is paused during the retry period, and will resume when a successful harvest is made. Some replay activity may be missed during retry phases. |
  * | 71 | An invalid feature mode was detected and set to "off". |
+ * | 72 | RegisteredIframeEntity failed to transmit API data from an iframe to window context. |
+ * | 73 | RegisteredIframeEntity failed to register with window context. |
+ * | 74 | RegisteredIframeEntity rejected message from unauthorized origin. |
+ * | 75 | RegisteredIframeEntity rejected message with mismatched iframeInterfaceId. |
+ * | 76 | Agent rejected post message, could not match with existing entity. |
+ * | 77 | Agent rejected post message, could not validate origin. |
+ * | 78 | RegisteredIframeEntity could not determine parent origin and will not register, to avoid trusting messages from any origin. |
  *
  * @param {number} code The warning code to emit, which will be used to link to the warning code documentation
  * @param {*} [secondary] Secondary data to include, usually an extra message, error or object

package/dist/esm/common/v2/mfe-vitals.js

@@ -5,6 +5,7 @@
 
 import { globalScope, isBrowserScope } from '../constants/runtime';
 import { now } from '../timing/now';
+import { CORRELATION_STALE_THRESHOLD_MS } from './script-tracker-constants';
 
 /**
  * @typedef {import('../../loaders/api/register-api-types').RegisterAPITimings} RegisterAPITimings
@@ -134,11 +135,17 @@ export function trackMFEVitals(target, timings) {
     fcp: {
       get value() {
         return getTimeRelativeToScriptStart(fcpObservedAt);
+      },
+      set value(v) {
+        fcpObservedAt = v;
       }
     },
     lcp: {
       get value() {
         return getTimeRelativeToScriptStart(lcpObservedAt);
+      },
+      set value(v) {
+        lcpObservedAt = v;
       }
     },
     cls: {
@@ -152,11 +159,11 @@ export function trackMFEVitals(target, timings) {
   if (!target || !isBrowserScope || !globalScope.MutationObserver || !globalScope.PerformanceObserver) return vitals;
   const observers = [];
 
-  // If FCP hasn't been observed within 10 seconds, give up and shut down all observers.
+  // If FCP hasn't been observed within this window, give up and shut down all observers.
   // Once FCP is observed, the other vitals are left to record until their natural lifespan ends.
   setTimeout(() => {
     if (!fcpObservedAt) vitals.disconnect();
-  }, 10000);
+  }, CORRELATION_STALE_THRESHOLD_MS);
   const populateVitalMinimums = () => {
     fcpObservedAt ??= now();
     lcpObservedAt ??= now();

package/dist/esm/common/v2/script-correlation.js

@@ -18,6 +18,8 @@ export class ScriptCorrelation {
   constructor(url) {
     /** @type {string} The cleaned URL of the script */
     this.url = url;
+    /** @type {Set<string>} MFE target ids that have already claimed this correlation via a completed `findScriptTimings()` call. Keyed per target rather than a single flag so one script that registers multiple distinct MFEs (each with its own id) doesn't have the second MFE's registration mistaken for a stale reuse of the first's. */
+    this.claimedBy = new Set();
   }
 
   /**

package/dist/esm/common/v2/script-tracker-constants.js

@@ -0,0 +1,7 @@
+/**
+ * Copyright 2020-2026 New Relic, Inc. All rights reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+/** @type {number} - Correlations are keyed only by script URL and never cleared per-registration, so a script registered more than once in a session (SPA remount, shared bundle, etc.) can reuse a correlation from a much earlier load. If the correlation's recorded start predates `registeredAt` by more than this, treat it as stale and fall back to `registeredAt`. */
+export const CORRELATION_STALE_THRESHOLD_MS = 10000;

package/dist/esm/common/v2/script-tracker.js

@@ -8,9 +8,12 @@ import { now } from '../timing/now';
 import { cleanURL } from '../url/clean-url';
 import { chrome, chromeEval, gecko } from '../util/browser-stack-matchers';
 import { ScriptCorrelation } from './script-correlation';
+import { CORRELATION_STALE_THRESHOLD_MS } from './script-tracker-constants';
+import { timingFactory } from './timing-factory';
 
 /**
  * @typedef {import('./register-api-types').RegisterAPITimings} RegisterAPITimings
+ * @typedef {import('../../loaders/api/register-api-types').RegisterAPITarget} RegisterAPITarget
  */
 
 /** export for testing purposes */
@@ -22,7 +25,7 @@ try {
 }
 
 /** @type {(entry: PerformanceEntry) => boolean} - A shared function to determine if a performance entry is a valid script or link resource for evaluation */
-const validEntryCriteria = entry => entry.initiatorType === 'script' || ['link', 'fetch'].includes(entry.initiatorType) && entry.name.endsWith('.js');
+const validEntryCriteria = entry => entry.initiatorType === 'script' || ['link', 'fetch'].includes(entry.initiatorType) && cleanURL(entry.name).endsWith('.js');
 
 /** @type {Map<string, ScriptCorrelation>} - Central registry for script correlations containing both DOM and Performance data */
 export const scriptCorrelations = new Map();
@@ -197,11 +200,32 @@ function applyPerformanceEntry(timings, entry) {
   timings.type = entry.initiatorType;
 }
 
+/**
+ * Subscribes to late resource timing emissions for a script URL.
+ * @param {RegisterAPITimings} timings - The timings object to update
+ * @param {string} mfeScriptUrl - The script URL to match
+ */
+function subscribeToLatePerformanceEntry(timings, mfeScriptUrl) {
+  if (!globalScope.PerformanceObserver?.supportedEntryTypes?.includes('resource')) return;
+  poSubscribers.push({
+    addedAt: now(),
+    test: entry => {
+      if (entryMatchesUrl(entry, mfeScriptUrl)) {
+        applyPerformanceEntry(timings, entry);
+        return true;
+      }
+      return false;
+    }
+  });
+}
+
 /**
  * Uses the stack of the initiator function, returns script timing information if a script can be found with the resource timing API matching the URL found in the stack.
+ * @param {RegisterAPITarget} [target] - The MFE target being registered. Its id is used to scope stale-correlation detection per-MFE rather than per-script-URL, so one script registering multiple distinct MFEs doesn't misclassify a later MFE's registration as a stale reuse of an earlier one's.
  * @returns {RegisterAPITimings} Object containing script fetch start and end times, and the asset URL if found
  */
-export function findScriptTimings() {
+export function findScriptTimings(target) {
+  const mfeId = target?.id;
   const timings = {
     registeredAt: now(),
     reportedAt: undefined,
@@ -231,38 +255,39 @@ export function findScriptTimings() {
     // Get correlation data
     timings.correlation = findCorrelation(mfeScriptUrl);
 
-    // Use correlation's performance entry if available, otherwise check live performance API
-    const performanceEntry = timings.correlation?.performance.value || performance.getEntriesByType('resource').find(e => entryMatchesUrl(e, mfeScriptUrl));
+    // Use correlation's performance entry if available, otherwise check the live performance API before falling back to the buffered observer.
+    const performanceEntry = timings.correlation?.performance.value || globalScope.performance?.getEntriesByType('resource')?.find(e => entryMatchesUrl(e, mfeScriptUrl));
     if (performanceEntry) {
       applyPerformanceEntry(timings, performanceEntry);
-    } else if (wasPreloaded(mfeScriptUrl)) {
-      // Handle preloaded scripts that may report late
-      timings.asset = mfeScriptUrl;
-      timings.type = 'preload';
+    } else {
+      const isPreloaded = wasPreloaded(mfeScriptUrl);
 
-      // Subscribe to late performance observer callbacks
-      poSubscribers.push({
-        addedAt: now(),
-        test: entry => {
-          if (entryMatchesUrl(entry, mfeScriptUrl)) {
-            applyPerformanceEntry(timings, entry);
-            return true;
-          }
-          return false;
-        }
-      });
+      // Handle preloaded scripts and any late resource emissions through the shared buffered observer.
+      if (isPreloaded) {
+        timings.asset = mfeScriptUrl;
+        timings.type = 'preload';
+      }
+      subscribeToLatePerformanceEntry(timings, mfeScriptUrl);
     }
 
-    /*
-     * Use getters here because the correlation data may arrive after this function returns the timing object, and we want to provide the most up-to-date timing information possible when the getters are accessed at harvest time.
-     * The getters will fall back to fetchEnd if correlation data isn't available yet, which is our best approximation for script execution start when actual script timings can not be determined.
-    */
-    Object.defineProperty(timings, 'scriptStart', {
-      get: () => timings.correlation?.script.start || timings.fetchEnd
-    });
-    Object.defineProperty(timings, 'scriptEnd', {
-      get: () => timings.correlation?.script.end || timings.registeredAt
-    });
+    // A correlation can be reused across multiple `register()` calls for the same script URL (e.g. an SPA
+    // remounting the same MFE without the script actually reloading). When that happens, its dom/performance
+    // timings still describe the *original* load, not this one. Detect that case so scriptStart/scriptEnd
+    // below can ignore the stale data instead of reporting it as if it were fresh.
+    const correlation = timings.correlation;
+    const alreadyClaimedByThisMFE = !!mfeId && !!correlation?.claimedBy.has(mfeId);
+    if (correlation && mfeId) correlation.claimedBy.add(mfeId);
+    const isCorrelationStale = () => {
+      const correlationStart = correlation?.script.start;
+      if (!alreadyClaimedByThisMFE || !correlationStart) return false;
+      const staleness = timings.registeredAt - correlationStart;
+      return staleness > CORRELATION_STALE_THRESHOLD_MS;
+    };
+
+    // Use getters here because the correlation data may arrive after this function returns the timing object, and we want to provide the most up-to-date timing information possible when the getters are accessed at harvest time.
+    // Non-stale: fall back to fetchEnd if correlation data isn't available yet (our best approximation for script execution start). Stale: fall back straight to registeredAt — fetchEnd would be derived from the same stale correlation, so it can't be trusted either.
+    Object.defineProperty(timings, 'scriptStart', timingFactory(() => isCorrelationStale() ? timings.registeredAt : correlation?.script.start ?? timings.fetchEnd));
+    Object.defineProperty(timings, 'scriptEnd', timingFactory(() => isCorrelationStale() ? timings.registeredAt : correlation?.script.end ?? timings.registeredAt));
   } catch (error) {
     // Don't let stack parsing errors break anything
   }