@newrelic/browser-agent 1.320.0 → 1.320.1

package/CHANGELOG.md

@@ -3,6 +3,14 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [1.320.1](https://github.com/newrelic/newrelic-browser-agent/compare/v1.320.0...v1.320.1) (2026-08-12)
+
+
+### Bug Fixes
+
+* Apply hard cap to MFE FCP ([#1828](https://github.com/newrelic/newrelic-browser-agent/issues/1828)) ([095a1d6](https://github.com/newrelic/newrelic-browser-agent/commit/095a1d66a917b5044f64757f61ee57607b2879ae))
+* Avoid obfuscating keys and reserved system vals ([#1817](https://github.com/newrelic/newrelic-browser-agent/issues/1817)) ([1f19198](https://github.com/newrelic/newrelic-browser-agent/commit/1f1919809498e6aa8f1fc2ada0c00c3872cb30b8))
+
 ## [1.320.0](https://github.com/newrelic/newrelic-browser-agent/compare/v1.319.0...v1.320.0) (2026-08-07)
 
 

package/dist/cjs/common/constants/env.cdn.js

@@ -17,7 +17,7 @@ exports.VERSION = exports.RRWEB_VERSION = exports.RRWEB_PACKAGE_NAME = exports.D
 /**
  * Exposes the version of the agent
  */
-const VERSION = exports.VERSION = "1.320.0";
+const VERSION = exports.VERSION = "1.320.1";
 
 /**
  * Exposes the build type of the agent

package/dist/cjs/common/constants/env.npm.js

@@ -17,7 +17,7 @@ exports.VERSION = exports.RRWEB_VERSION = exports.RRWEB_PACKAGE_NAME = exports.D
 /**
  * Exposes the version of the agent
  */
-const VERSION = exports.VERSION = "1.320.0";
+const VERSION = exports.VERSION = "1.320.1";
 
 /**
  * Exposes the build type of the agent

package/dist/cjs/common/payloads/payloads.js

@@ -123,11 +123,11 @@ function truncateAsString(data) {
 }
 
 /**
- * Creates string adder functions for BEL serialization with obfuscation and optional truncation.
+ * Creates string adder functions for BEL serialization with obfuscation and optional truncation, as well as raw string.
  * This ensures a single string table is used while providing separate handling for regular vs payload attributes.
  * @param {Function} getAddStringContext - Function that creates a new string table context
  * @param {Object} obfuscator - Optional obfuscator instance for string obfuscation
- * @returns {{addString: Function, addStringWithTruncation: Function}} Object containing both string adder functions
+ * @returns {{addString: Function, addStringRaw: Function, addStringWithTruncation: Function}} Object containing various string adder functions
  */
 function createStringAdders(getAddStringContext, obfuscator) {
   const addStringRaw = getAddStringContext();
@@ -140,6 +140,7 @@ function createStringAdders(getAddStringContext, obfuscator) {
   };
   return {
     addString: str => processString(str, false),
+    addStringRaw: str => addStringRaw(str),
     addStringWithTruncation: str => processString(str, true)
   };
 }

package/dist/cjs/common/serialize/bel-serializer.js

@@ -40,19 +40,32 @@ function getAddStringContext(obfuscator, truncator) {
     }
   }
 }
-function addCustomAttributes(attrs, addString) {
+
+/**
+ * Attributes are serialized according to their types, using the provided serializers.  Only the first 64 attributes will be added to the payload.
+ * @param attrs
+ * @param serializers
+ * @param {function} serializers.addKey -function for serializing attribute keys
+ * @param {function} serializers.addVal - function for serializing attribute values
+ * @returns {*[]}
+ */
+function addCustomAttributes(attrs, serializers) {
+  const {
+    addKey,
+    addVal
+  } = serializers;
   var attrParts = [];
   Object.entries(attrs || {}).forEach(([key, val]) => {
     if (attrParts.length >= MAX_ATTRIBUTES) return;
     var type = 5;
     var serializedValue;
     // add key to string table first
-    key = addString(key, false);
+    key = addKey(key);
     switch (typeof val) {
       case 'object':
         if (val) {
           // serialize objects to strings
-          serializedValue = addString((0, _stringify.stringify)(val));
+          serializedValue = addVal((0, _stringify.stringify)(val));
         } else {
           // null attribute type
           type = 9;
@@ -71,7 +84,7 @@ function addCustomAttributes(attrs, addString) {
         type = 9;
         break;
       default:
-        serializedValue = addString(val);
+        serializedValue = addVal(val);
     }
     attrParts.push([type, key + (serializedValue ? ',' + serializedValue : '')]);
   });

package/dist/cjs/common/v2/mfe-vitals.js

@@ -132,25 +132,33 @@ const observePerformance = (observers, config, onEntry) => {
 function trackMFEVitals(target, timings) {
   let fcpObservedAt;
   let lcpObservedAt;
+  // Once disconnect() runs, no further vitals data should be written - even from an observer callback that was
+  // already in flight when disconnect() was called.
+  let disconnected = false;
   const getTimeRelativeToScriptStart = capturedAt => {
     if (capturedAt == null) return capturedAt;
     return capturedAt - (timings?.scriptStart || timings?.registeredAt || 0);
   };
   const vitals = {
     fcp: {
+      // A clock freeze/tab suspend between script registration and first paint can make this value huge once the
+      // tab resumes. Rather than report a multi-hour "FCP", drop it so bad data doesn't reach the backend.
       get value() {
-        return getTimeRelativeToScriptStart(fcpObservedAt);
+        const relative = getTimeRelativeToScriptStart(fcpObservedAt);
+        return relative > _scriptTrackerConstants.CORRELATION_STALE_THRESHOLD_MS ? undefined : relative;
       },
       set value(v) {
-        fcpObservedAt = v;
+        if (!disconnected) fcpObservedAt = v;
       }
     },
     lcp: {
+      // LCP can never occur before FCP, so if FCP was dropped as invalid, LCP is derived from the same untrustworthy clock and must be dropped too.
       get value() {
+        if (vitals.fcp.value === undefined) return undefined;
         return getTimeRelativeToScriptStart(lcpObservedAt);
       },
       set value(v) {
-        lcpObservedAt = v;
+        if (!disconnected) lcpObservedAt = v;
       }
     },
     cls: {
@@ -170,15 +178,22 @@ function trackMFEVitals(target, timings) {
     if (!fcpObservedAt) vitals.disconnect();
   }, _scriptTrackerConstants.CORRELATION_STALE_THRESHOLD_MS);
   const populateVitalMinimums = () => {
-    fcpObservedAt ??= (0, _now.now)();
+    if (disconnected) return;
+    if (fcpObservedAt == null) {
+      const capturedAt = (0, _now.now)();
+      // If the very first observed render already exceeds the window, the clock is untrustworthy for this
+      // MFE (e.g. tab was frozen/suspended between registration and paint) - shut everything down instead
+      // of seeding vitals with data derived from it.
+      if (getTimeRelativeToScriptStart(capturedAt) > _scriptTrackerConstants.CORRELATION_STALE_THRESHOLD_MS) {
+        vitals.disconnect();
+        return;
+      }
+      fcpObservedAt = capturedAt;
+    }
     lcpObservedAt ??= (0, _now.now)();
     vitals.cls.value ??= 0;
   };
 
-  // if the MFE has already rendered something on the page before we could set up listeners, just populate vital minimums immediately
-  const existingRoots = _runtime.globalScope.document?.querySelectorAll("[data-nr-mfe-id=\"".concat(escapeSelectorValue(target.id), "\"]"));
-  if (Array.from(existingRoots || []).some(x => isMatch(x.dataset, target))) populateVitalMinimums();
-
   // Track FCP - first contentful paint
   const fcpObs = observeMutations(target, (_, obs) => {
     // An observed "FCP" means _something_ rendered, so at minimum we can populate all the baseline values for the vitals
@@ -193,12 +208,13 @@ function trackMFEVitals(target, timings) {
   const observedElements = new Set();
   try {
     resizeObs = new _runtime.globalScope.ResizeObserver(entries => {
+      if (disconnected) return;
       entries.forEach(entry => {
         try {
           const size = entry.contentRect.width * entry.contentRect.height;
           if (size > largestSize) {
             largestSize = size;
-            lcpObservedAt = (0, _now.now)();
+            vitals.lcp.value = (0, _now.now)();
           }
           resizeObs.unobserve(entry.target);
         } catch (e) {
@@ -259,7 +275,7 @@ function trackMFEVitals(target, timings) {
     type: 'layout-shift',
     buffered: true
   }, entry => {
-    if (entry.hadRecentInput) return;
+    if (disconnected || entry.hadRecentInput) return;
     (entry.sources || []).some(source => {
       if (isInMFE(source.node, target)) {
         // an observed "CLS" means _something_ rendered for the MFE, so at minimum we can make sure all the baseline values are populated for the vitals
@@ -277,7 +293,7 @@ function trackMFEVitals(target, timings) {
     buffered: true,
     durationThreshold: 40
   }, entry => {
-    if (!entry.interactionId || !isInMFE(entry.target, target)) return;
+    if (disconnected || !entry.interactionId || !isInMFE(entry.target, target)) return;
     if (vitals.inp.value === undefined || entry.duration > vitals.inp.value) {
       // an observed "INP" means _something_ rendered for the MFE, so at minimum we can make sure all the baseline values are populated for the vitals
       populateVitalMinimums();
@@ -295,6 +311,7 @@ function trackMFEVitals(target, timings) {
 
   // Disconnect all observers
   vitals.disconnect = () => {
+    disconnected = true;
     // Disconnect all observers
     observers.forEach(obs => {
       try {
@@ -341,5 +358,11 @@ function trackMFEVitals(target, timings) {
       passive: true
     });
   });
+
+  // If the MFE has already rendered something on the page before we could set up listeners, just populate vital
+  // minimums immediately. Done last, once `observers` is fully populated and `vitals.disconnect` has its real
+  // implementation, so a stale-clock detection here can actually tear everything down instead of no-op'ing.
+  const existingRoots = _runtime.globalScope.document?.querySelectorAll("[data-nr-mfe-id=\"".concat(escapeSelectorValue(target.id), "\"]"));
+  if (Array.from(existingRoots || []).some(x => isMatch(x.dataset, target))) populateVitalMinimums();
   return vitals;
 }

package/dist/cjs/features/ajax/aggregate/index.js

@@ -152,6 +152,7 @@ class Aggregate extends _aggregateBase.AggregateBase {
     if (!eventBuffer.length) return;
     const {
       addString,
+      addStringRaw,
       addStringWithTruncation
     } = (0, _payloads.createStringAdders)(_belSerializer.getAddStringContext, this.obfuscator);
     let payload = 'bel.7;';
@@ -165,11 +166,11 @@ class Aggregate extends _aggregateBase.AggregateBase {
       // callbackEnd
       (0, _belSerializer.numeric)(0),
       // no callbackDuration for non-SPA events
-      addString(event.method), (0, _belSerializer.numeric)(event.status), addString(event.domain), addString(event.path), (0, _belSerializer.numeric)(event.requestSize), (0, _belSerializer.numeric)(event.responseSize), event.type === 'fetch' ? 1 : '', addString(0),
+      addStringRaw(event.method), (0, _belSerializer.numeric)(event.status), addString(event.domain), addString(event.path), (0, _belSerializer.numeric)(event.requestSize), (0, _belSerializer.numeric)(event.responseSize), event.type === 'fetch' ? 1 : '', addStringRaw(0),
       // nodeId
-      (0, _belSerializer.nullable)(event.spanId, addString, true) +
+      (0, _belSerializer.nullable)(event.spanId, addStringRaw, true) +
       // guid
-      (0, _belSerializer.nullable)(event.traceId, addString, true) +
+      (0, _belSerializer.nullable)(event.traceId, addStringRaw, true) +
       // traceId
       (0, _belSerializer.nullable)(event.spanTimestamp, _belSerializer.numeric, false) // timestamp
       ];
@@ -179,14 +180,21 @@ class Aggregate extends _aggregateBase.AggregateBase {
       const jsAttributes = this.agentRef.info.jsAttributes;
 
       // Regular attributes: obfuscate only
-      const regularAttrs = (0, _belSerializer.addCustomAttributes)({
+      let regularAttrs = (0, _belSerializer.addCustomAttributes)({
         ...(jsAttributes || {}),
-        [_constants.AJAX_ID]: event[_constants.AJAX_ID],
-        // all AjaxRequest events should have a unique identifier to allow for easier grouping and analysis in the UI
         ...(event.targetAttributes || {}),
         // used to supply the version 2 attributes, either MFE target or duplication attributes for the main agent app
         ...(event.gql || {})
-      }, addString);
+      }, {
+        addKey: addStringRaw,
+        addVal: addString
+      });
+      regularAttrs.push(...(0, _belSerializer.addCustomAttributes)({
+        [_constants.AJAX_ID]: event[_constants.AJAX_ID] // all AjaxRequest events should have a unique identifier to allow for easier grouping and analysis in the UI
+      }, {
+        addKey: addStringRaw,
+        addVal: addStringRaw
+      }));
 
       // Payload attributes: obfuscate then truncate
       const payloadAttrs = (0, _belSerializer.addCustomAttributes)({
@@ -205,7 +213,10 @@ class Aggregate extends _aggregateBase.AggregateBase {
         ...(event.responseHeaders ? {
           responseHeaders: event.responseHeaders
         } : {})
-      }, addStringWithTruncation);
+      }, {
+        addKey: addStringRaw,
+        addVal: addStringWithTruncation
+      });
       const attrParts = [...regularAttrs, ...payloadAttrs];
       fields.unshift((0, _belSerializer.numeric)(attrParts.length));
       insert += fields.join(',');

package/dist/cjs/features/page_view_timing/aggregate/index.js

@@ -24,6 +24,7 @@ var _loadTime = require("../../../common/vitals/load-time");
 var _webdriverDetection = require("../../../common/util/webdriver-detection");
 var _cleanUrl = require("../../../common/url/clean-url");
 var _events = require("../../../common/constants/events");
+var _payloads = require("../../../common/payloads/payloads");
 /**
  * Copyright 2020-2026 New Relic, Inc. All rights reserved.
  * SPDX-License-Identifier: Apache-2.0
@@ -104,6 +105,7 @@ class Aggregate extends _aggregateBase.AggregateBase {
     if (name !== _constants2.VITAL_NAMES.CUMULATIVE_LAYOUT_SHIFT && _cumulativeLayoutShift.cumulativeLayoutShift.current.value >= 0) {
       attrs.cls = _cumulativeLayoutShift.cumulativeLayoutShift.current.value;
     }
+    attrs.webdriverDetected = _webdriverDetection.webdriverDetected;
     const timing = {
       name,
       value,
@@ -133,15 +135,9 @@ class Aggregate extends _aggregateBase.AggregateBase {
       loadState: document.readyState
     });
   }
-  appendGlobalCustomAttributes(timing) {
-    var timingAttributes = timing.attrs || {};
-    var reservedAttributes = ['size', 'eid', 'cls', 'type', 'fid', 'elTag', 'elUrl', 'net-type', 'net-etype', 'net-rtt', 'net-dlink'];
-    Object.entries(this.agentRef.info.jsAttributes || {}).forEach(([key, val]) => {
-      if (reservedAttributes.indexOf(key) < 0) {
-        timingAttributes[key] = val;
-      }
-    });
-    timingAttributes.webdriverDetected = _webdriverDetection.webdriverDetected;
+  #getGlobalCustomAttributes() {
+    const reservedAttributes = ['size', 'eid', 'cls', 'type', 'fid', 'elTag', 'elUrl', 'net-type', 'net-etype', 'net-rtt', 'net-dlink', 'webdriverDetected'];
+    return Object.fromEntries(Object.entries(this.agentRef.info.jsAttributes || {}).filter(([key]) => !reservedAttributes.includes(key)));
   }
   preHarvestChecks() {
     this.checkForFirstInteraction();
@@ -151,15 +147,34 @@ class Aggregate extends _aggregateBase.AggregateBase {
   // serialize array of timing data
   serializer(eventBuffer) {
     if (!eventBuffer?.length) return '';
-    var addString = (0, _belSerializer.getAddStringContext)(this.obfuscator);
+    const {
+      addString,
+      addStringRaw
+    } = (0, _payloads.createStringAdders)(_belSerializer.getAddStringContext, this.obfuscator);
+    const keepOrigValue = {
+      addKey: addStringRaw,
+      addVal: addStringRaw
+    };
+    const obfuscateValue = {
+      addKey: addStringRaw,
+      addVal: addString
+    };
     var payload = 'bel.6;';
     for (var i = 0; i < eventBuffer.length; i++) {
       var timing = eventBuffer[i];
       payload += 'e,';
-      payload += addString(timing.name) + ',';
+      payload += addStringRaw(timing.name) + ',';
       payload += (0, _belSerializer.nullable)(timing.value, _belSerializer.numeric, false) + ',';
-      this.appendGlobalCustomAttributes(timing);
-      var attrParts = (0, _belSerializer.addCustomAttributes)(timing.attrs, addString);
+      const userAttrs = this.#getGlobalCustomAttributes();
+      const {
+        pageUrl,
+        ...systemReservedAttrs
+      } = timing.attrs || {};
+      var attrParts = (0, _belSerializer.addCustomAttributes)(systemReservedAttrs, keepOrigValue);
+      attrParts.push(...(0, _belSerializer.addCustomAttributes)(userAttrs, obfuscateValue));
+      if (pageUrl) attrParts.push(...(0, _belSerializer.addCustomAttributes)({
+        pageUrl
+      }, obfuscateValue));
       if (attrParts && attrParts.length > 0) {
         payload += (0, _belSerializer.numeric)(attrParts.length) + ';' + attrParts.join(';');
       }

package/dist/cjs/features/soft_navigations/aggregate/ajax-node.js

@@ -48,6 +48,7 @@ class AjaxNode extends _belNode.BelNode {
   serialize(parentStartTimestamp, agentRef, ajaxObfuscator) {
     const {
       addString,
+      addStringRaw,
       addStringWithTruncation
     } = (0, _payloads.createStringAdders)(_belSerializer.getAddStringContext, ajaxObfuscator);
     const nodeList = [];
@@ -63,13 +64,21 @@ class AjaxNode extends _belNode.BelNode {
     // callbackEnd is relative to end
     (0, _belSerializer.numeric)(this.callbackDuration),
     // not relative
-    addString(this.method), (0, _belSerializer.numeric)(this.status), addString(this.domain), addString(this.path), (0, _belSerializer.numeric)(this.txSize), (0, _belSerializer.numeric)(this.rxSize), this.requestedWith, addString(this.nodeId), (0, _belSerializer.nullable)(this.spanId, addString, true) + (0, _belSerializer.nullable)(this.traceId, addString, true) + (0, _belSerializer.nullable)(this.spanTimestamp, _belSerializer.numeric)];
+    addStringRaw(this.method), (0, _belSerializer.numeric)(this.status), addString(this.domain), addString(this.path), (0, _belSerializer.numeric)(this.txSize), (0, _belSerializer.numeric)(this.rxSize), this.requestedWith, addStringRaw(this.nodeId), (0, _belSerializer.nullable)(this.spanId, addStringRaw, true) + (0, _belSerializer.nullable)(this.traceId, addStringRaw, true) + (0, _belSerializer.nullable)(this.spanTimestamp, _belSerializer.numeric)];
     // Regular attributes: obfuscate only
     const regularAttrs = (0, _belSerializer.addCustomAttributes)({
-      [_constants.AJAX_ID]: this[_constants.AJAX_ID],
       ...(this.targetAttributes || {}),
       ...(this.gql || {})
-    }, addString);
+    }, {
+      addKey: addStringRaw,
+      addVal: addString
+    });
+    regularAttrs.push(...(0, _belSerializer.addCustomAttributes)({
+      [_constants.AJAX_ID]: this[_constants.AJAX_ID]
+    }, {
+      addKey: addStringRaw,
+      addVal: addStringRaw
+    }));
 
     // Payload attributes: obfuscate then truncate
     const payloadAttrs = (0, _belSerializer.addCustomAttributes)({
@@ -88,7 +97,10 @@ class AjaxNode extends _belNode.BelNode {
       ...(this.responseHeaders ? {
         responseHeaders: this.responseHeaders
       } : {})
-    }, addStringWithTruncation);
+    }, {
+      addKey: addStringRaw,
+      addVal: addStringWithTruncation
+    });
     let allAttachedNodes = [...regularAttrs, ...payloadAttrs];
     this.children.forEach(node => allAttachedNodes.push(node.serialize())); // no children is expected under ajax nodes at this time
 

package/dist/cjs/features/soft_navigations/aggregate/interaction.js

@@ -11,6 +11,7 @@ var _now = require("../../../common/timing/now");
 var _cleanUrl = require("../../../common/url/clean-url");
 var _constants = require("../constants");
 var _belNode = require("./bel-node");
+var _payloads = require("../../../common/payloads/payloads");
 /**
  * Copyright 2020-2026 New Relic, Inc. All rights reserved.
  * SPDX-License-Identifier: Apache-2.0
@@ -133,7 +134,10 @@ class Interaction extends _belNode.BelNode {
    */
   serialize(firstStartTimeOfPayload, agentRef, interactionObfuscator, ajaxObfuscator) {
     const isFirstIxnOfPayload = firstStartTimeOfPayload === undefined;
-    const addString = (0, _belSerializer.getAddStringContext)(interactionObfuscator);
+    const {
+      addString,
+      addStringRaw
+    } = (0, _payloads.createStringAdders)(_belSerializer.getAddStringContext, interactionObfuscator);
     const nodeList = [];
     let ixnType;
     if (this.trigger === _constants.IPL_TRIGGER_NAME) ixnType = _constants.INTERACTION_TYPE.INITIAL_PAGE_LOAD;else if (this.newURL !== this.oldURL) ixnType = _constants.INTERACTION_TYPE.ROUTE_CHANGE;else ixnType = _constants.INTERACTION_TYPE.UNSPECIFIED;
@@ -149,12 +153,15 @@ class Interaction extends _belNode.BelNode {
     // callbackEnd -- relative to start; not used by BrowserInteraction events so these are always 0
     (0, _belSerializer.numeric)(0),
     // not relative; always 0 for BrowserInteraction
-    addString(this.trigger), addString((0, _cleanUrl.cleanURL)(this.initialPageURL, true)), addString((0, _cleanUrl.cleanURL)(this.oldURL, true)), addString((0, _cleanUrl.cleanURL)(this.newURL, true)), addString(this.customName), ixnType, (0, _belSerializer.nullable)(this.queueTime, _belSerializer.numeric, true) + (0, _belSerializer.nullable)(this.appTime, _belSerializer.numeric, true) + (0, _belSerializer.nullable)(this.oldRoute, addString, true) + (0, _belSerializer.nullable)(this.newRoute, addString, true) + addString(this.id), addString(this.nodeId), (0, _belSerializer.nullable)(this.firstPaint, _belSerializer.numeric, true) + (0, _belSerializer.nullable)(this.firstContentfulPaint, _belSerializer.numeric)];
+    addStringRaw(this.trigger), addString((0, _cleanUrl.cleanURL)(this.initialPageURL, true)), addString((0, _cleanUrl.cleanURL)(this.oldURL, true)), addString((0, _cleanUrl.cleanURL)(this.newURL, true)), addString(this.customName), ixnType, (0, _belSerializer.nullable)(this.queueTime, _belSerializer.numeric, true) + (0, _belSerializer.nullable)(this.appTime, _belSerializer.numeric, true) + (0, _belSerializer.nullable)(this.oldRoute, addString, true) + (0, _belSerializer.nullable)(this.newRoute, addString, true) + addStringRaw(this.id), addStringRaw(this.nodeId), (0, _belSerializer.nullable)(this.firstPaint, _belSerializer.numeric, true) + (0, _belSerializer.nullable)(this.firstContentfulPaint, _belSerializer.numeric)];
     const customAttributes = {
       ...agentRef.info.jsAttributes,
       ...this.customAttributes
     }; // attrs specific to this interaction should have precedence over the general custom attrs
-    const allAttachedNodes = (0, _belSerializer.addCustomAttributes)(customAttributes || {}, addString); // start with all custom attributes
+    const allAttachedNodes = (0, _belSerializer.addCustomAttributes)(customAttributes || {}, {
+      addKey: addStringRaw,
+      addVal: addString
+    }); // start with all custom attributes
     if (agentRef.info.atts) allAttachedNodes.push('a,' + addString(agentRef.info.atts)); // add apm provided attributes
     /* Querypack encoder+decoder quirkiness:
        - If first ixn node of payload is being processed, its children's start time must be offset by this node's start. (firstStartTime should be undefined.)

package/dist/esm/common/constants/env.cdn.js

@@ -11,7 +11,7 @@
 /**
  * Exposes the version of the agent
  */
-export const VERSION = "1.320.0";
+export const VERSION = "1.320.1";
 
 /**
  * Exposes the build type of the agent

package/dist/esm/common/constants/env.npm.js

@@ -11,7 +11,7 @@
 /**
  * Exposes the version of the agent
  */
-export const VERSION = "1.320.0";
+export const VERSION = "1.320.1";
 
 /**
  * Exposes the build type of the agent

package/dist/esm/common/payloads/payloads.js

@@ -114,11 +114,11 @@ export function truncateAsString(data) {
 }
 
 /**
- * Creates string adder functions for BEL serialization with obfuscation and optional truncation.
+ * Creates string adder functions for BEL serialization with obfuscation and optional truncation, as well as raw string.
  * This ensures a single string table is used while providing separate handling for regular vs payload attributes.
  * @param {Function} getAddStringContext - Function that creates a new string table context
  * @param {Object} obfuscator - Optional obfuscator instance for string obfuscation
- * @returns {{addString: Function, addStringWithTruncation: Function}} Object containing both string adder functions
+ * @returns {{addString: Function, addStringRaw: Function, addStringWithTruncation: Function}} Object containing various string adder functions
  */
 export function createStringAdders(getAddStringContext, obfuscator) {
   const addStringRaw = getAddStringContext();
@@ -131,6 +131,7 @@ export function createStringAdders(getAddStringContext, obfuscator) {
   };
   return {
     addString: str => processString(str, false),
+    addStringRaw: str => addStringRaw(str),
     addStringWithTruncation: str => processString(str, true)
   };
 }

package/dist/esm/common/serialize/bel-serializer.js

@@ -31,19 +31,32 @@ export function getAddStringContext(obfuscator, truncator) {
     }
   }
 }
-export function addCustomAttributes(attrs, addString) {
+
+/**
+ * Attributes are serialized according to their types, using the provided serializers.  Only the first 64 attributes will be added to the payload.
+ * @param attrs
+ * @param serializers
+ * @param {function} serializers.addKey -function for serializing attribute keys
+ * @param {function} serializers.addVal - function for serializing attribute values
+ * @returns {*[]}
+ */
+export function addCustomAttributes(attrs, serializers) {
+  const {
+    addKey,
+    addVal
+  } = serializers;
   var attrParts = [];
   Object.entries(attrs || {}).forEach(([key, val]) => {
     if (attrParts.length >= MAX_ATTRIBUTES) return;
     var type = 5;
     var serializedValue;
     // add key to string table first
-    key = addString(key, false);
+    key = addKey(key);
     switch (typeof val) {
       case 'object':
         if (val) {
           // serialize objects to strings
-          serializedValue = addString(stringify(val));
+          serializedValue = addVal(stringify(val));
         } else {
           // null attribute type
           type = 9;
@@ -62,7 +75,7 @@ export function addCustomAttributes(attrs, addString) {
         type = 9;
         break;
       default:
-        serializedValue = addString(val);
+        serializedValue = addVal(val);
     }
     attrParts.push([type, key + (serializedValue ? ',' + serializedValue : '')]);
   });

package/dist/esm/common/v2/mfe-vitals.js

@@ -127,25 +127,33 @@ const observePerformance = (observers, config, onEntry) => {
 export function trackMFEVitals(target, timings) {
   let fcpObservedAt;
   let lcpObservedAt;
+  // Once disconnect() runs, no further vitals data should be written - even from an observer callback that was
+  // already in flight when disconnect() was called.
+  let disconnected = false;
   const getTimeRelativeToScriptStart = capturedAt => {
     if (capturedAt == null) return capturedAt;
     return capturedAt - (timings?.scriptStart || timings?.registeredAt || 0);
   };
   const vitals = {
     fcp: {
+      // A clock freeze/tab suspend between script registration and first paint can make this value huge once the
+      // tab resumes. Rather than report a multi-hour "FCP", drop it so bad data doesn't reach the backend.
       get value() {
-        return getTimeRelativeToScriptStart(fcpObservedAt);
+        const relative = getTimeRelativeToScriptStart(fcpObservedAt);
+        return relative > CORRELATION_STALE_THRESHOLD_MS ? undefined : relative;
       },
       set value(v) {
-        fcpObservedAt = v;
+        if (!disconnected) fcpObservedAt = v;
       }
     },
     lcp: {
+      // LCP can never occur before FCP, so if FCP was dropped as invalid, LCP is derived from the same untrustworthy clock and must be dropped too.
       get value() {
+        if (vitals.fcp.value === undefined) return undefined;
         return getTimeRelativeToScriptStart(lcpObservedAt);
       },
       set value(v) {
-        lcpObservedAt = v;
+        if (!disconnected) lcpObservedAt = v;
       }
     },
     cls: {
@@ -165,15 +173,22 @@ export function trackMFEVitals(target, timings) {
     if (!fcpObservedAt) vitals.disconnect();
   }, CORRELATION_STALE_THRESHOLD_MS);
   const populateVitalMinimums = () => {
-    fcpObservedAt ??= now();
+    if (disconnected) return;
+    if (fcpObservedAt == null) {
+      const capturedAt = now();
+      // If the very first observed render already exceeds the window, the clock is untrustworthy for this
+      // MFE (e.g. tab was frozen/suspended between registration and paint) - shut everything down instead
+      // of seeding vitals with data derived from it.
+      if (getTimeRelativeToScriptStart(capturedAt) > CORRELATION_STALE_THRESHOLD_MS) {
+        vitals.disconnect();
+        return;
+      }
+      fcpObservedAt = capturedAt;
+    }
     lcpObservedAt ??= now();
     vitals.cls.value ??= 0;
   };
 
-  // if the MFE has already rendered something on the page before we could set up listeners, just populate vital minimums immediately
-  const existingRoots = globalScope.document?.querySelectorAll("[data-nr-mfe-id=\"".concat(escapeSelectorValue(target.id), "\"]"));
-  if (Array.from(existingRoots || []).some(x => isMatch(x.dataset, target))) populateVitalMinimums();
-
   // Track FCP - first contentful paint
   const fcpObs = observeMutations(target, (_, obs) => {
     // An observed "FCP" means _something_ rendered, so at minimum we can populate all the baseline values for the vitals
@@ -188,12 +203,13 @@ export function trackMFEVitals(target, timings) {
   const observedElements = new Set();
   try {
     resizeObs = new globalScope.ResizeObserver(entries => {
+      if (disconnected) return;
       entries.forEach(entry => {
         try {
           const size = entry.contentRect.width * entry.contentRect.height;
           if (size > largestSize) {
             largestSize = size;
-            lcpObservedAt = now();
+            vitals.lcp.value = now();
           }
           resizeObs.unobserve(entry.target);
         } catch (e) {
@@ -254,7 +270,7 @@ export function trackMFEVitals(target, timings) {
     type: 'layout-shift',
     buffered: true
   }, entry => {
-    if (entry.hadRecentInput) return;
+    if (disconnected || entry.hadRecentInput) return;
     (entry.sources || []).some(source => {
       if (isInMFE(source.node, target)) {
         // an observed "CLS" means _something_ rendered for the MFE, so at minimum we can make sure all the baseline values are populated for the vitals
@@ -272,7 +288,7 @@ export function trackMFEVitals(target, timings) {
     buffered: true,
     durationThreshold: 40
   }, entry => {
-    if (!entry.interactionId || !isInMFE(entry.target, target)) return;
+    if (disconnected || !entry.interactionId || !isInMFE(entry.target, target)) return;
     if (vitals.inp.value === undefined || entry.duration > vitals.inp.value) {
       // an observed "INP" means _something_ rendered for the MFE, so at minimum we can make sure all the baseline values are populated for the vitals
       populateVitalMinimums();
@@ -290,6 +306,7 @@ export function trackMFEVitals(target, timings) {
 
   // Disconnect all observers
   vitals.disconnect = () => {
+    disconnected = true;
     // Disconnect all observers
     observers.forEach(obs => {
       try {
@@ -336,5 +353,11 @@ export function trackMFEVitals(target, timings) {
       passive: true
     });
   });
+
+  // If the MFE has already rendered something on the page before we could set up listeners, just populate vital
+  // minimums immediately. Done last, once `observers` is fully populated and `vitals.disconnect` has its real
+  // implementation, so a stale-clock detection here can actually tear everything down instead of no-op'ing.
+  const existingRoots = globalScope.document?.querySelectorAll("[data-nr-mfe-id=\"".concat(escapeSelectorValue(target.id), "\"]"));
+  if (Array.from(existingRoots || []).some(x => isMatch(x.dataset, target))) populateVitalMinimums();
   return vitals;
 }