@newrelic/browser-agent 1.321.0-rc.7 → 1.321.0-rc.9

package/dist/cjs/loaders/api/register-api-types.js

@@ -21,6 +21,9 @@ exports.default = void 0;
  * @property {(value: string | null, resetSession?: boolean) => void} setUserId - Add an enduser.id attribute to all outgoing API data for the registered entity.  Note: a registered entity will not be able to initiate a session reset.  It must be done from the main agent.
  * @property {RegisterAPIMetadata} metadata - The metadata object containing the custom attributes and target information for the registered entity.
  */
+/**
+ * @typedef {import('../../common/v2/manifest').AssetFile} AssetFile
+ */
 /**
  * @typedef {Object} RegisterAPIConstructor
  * @property {string} id - The unique id for the registered entity. This will be assigned to any synthesized entities.
@@ -28,6 +31,8 @@ exports.default = void 0;
  * @property {{[key: string]: any}} [tags] - The tags for the registered entity as key-value pairs. This will be assigned to any synthesized entities. Tags are converted to source.* attributes (e.g., {environment: 'production'} becomes source.environment: 'production').
  * @property {RegisterAPITarget} [parent] - The parent target for the registered entity. If none was supplied, it will assume the entity guid from the main agent.
  * @property {string} [parentId] - The parentId for the registered entity. If none was supplied, it will assume the entity guid from the main agent.
+ * @property {{assets?: Array<AssetFile>}} [manifest] - An optional manifest describing the MFE's known assets (scripts, stylesheets, images, fonts, etc.) as `AssetFile` entries, used to improve the accuracy of event attribution (errors, logs, ajax, websockets), attribute `BrowserPerformance` resource events (any asset type, not just scripts) and, depending on `timingMethod`, MicroFrontEndTiming values. Each `AssetFile`'s script-capability is inferred from a `.js` suffix on a string `matcher` (a RegExp `matcher` is never inferred as a script), unless overridden via `type: 'script'` or explicitly disabled via `type: 'asset'`. An `AssetFile` with an invalid `matcher` or an unrecognized `type` is discarded/ignored (with a console warning) rather than applied. If omitted, the agent falls back to its existing behavior of only evaluating the script that called `register()` (resource attribution still applies to that script).
+ * @property {'entry'|'scripts'|'all'} [timingMethod] - Controls which manifest assets are used to calculate MicroFrontEndTiming values: 'entry' (the default) leaves timing based entirely on the script that called `register()`, unaffected by the manifest; 'scripts' widens the timing window across all script assets; 'all' widens it across every asset.
  */
 /**
  * @typedef {Object} RegisterAPIMetadata
@@ -41,17 +46,21 @@ exports.default = void 0;
  * @property {string} name - The name returned for the registered entity.
  * @property {{[key: string]: any}} [tags] - The tags for the registered entity as key-value pairs.
  * @property {string} [parentId] - The parentId for the registered entity. If none was supplied, it will assume the entity guid from the main agent.
+ * @property {import('../../common/v2/manifest').ParsedManifest} [manifest] - The parsed manifest for the registered entity, if one was supplied.
+ * @property {'entry'|'scripts'|'all'} [timingMethod] - The timing method supplied for the registered entity, if any.
  */
 /**
  * @typedef {Object} RegisterAPITimings
  * @property {number} registeredAt - The timestamp when the registered entity was created.
  * @property {number} [reportedAt] - The timestamp when the registered entity was deregistered.
- * @property {number} fetchStart - The timestamp when the registered entity began fetching (performance.start).
- * @property {number} fetchEnd - The timestamp when the registered entity finished fetching (performance.end).
- * @property {number} scriptStart - The timestamp when script initialization began (max of dom.start or performance.end, or performance.end if no dom.start).
- * @property {number} scriptEnd - The timestamp when script loading completed (dom.end or registeredAt if no dom.end).
+ * @property {number} fetchStart - The timestamp when the registered entity began fetching (performance.start). When a manifest with timingMethod 'scripts'|'all' is supplied, this widens to the earliest fetchStart across all matched manifest assets.
+ * @property {number} fetchEnd - The timestamp when the registered entity finished fetching (performance.end). When a manifest with timingMethod 'scripts'|'all' is supplied, this widens to the latest fetchEnd across all matched manifest assets.
+ * @property {number} scriptStart - The timestamp when script initialization began (max of dom.start or performance.end, or performance.end if no dom.start). When a manifest with timingMethod 'scripts'|'all' is supplied, this widens to the earliest scriptStart across all matched manifest script assets (non-script assets are excluded).
+ * @property {number} scriptEnd - The timestamp when script loading completed (dom.end or registeredAt if no dom.end). When a manifest with timingMethod 'scripts'|'all' is supplied, this widens to the latest scriptEnd across all matched manifest script assets (non-script assets are excluded).
  * @property {Object} [asset] - The asset path (if found) for the registered entity.
  * @property {string} type - The type of timing associated with the registered entity, 'script' or 'link' if found with the performance resource API, 'fetch' for dynamic imports, 'inline' if found to be associated with the root document URL, or 'unknown' if no associated resource could be found.
+ * @property {number} totalWeight - The sum of `transferSize` (bytes) across every asset detected for the registered entity -- the entry script, plus, when a manifest is supplied, every matched manifest asset (script or non-script). Unlike fetchStart/fetchEnd/scriptStart/scriptEnd above, this is never gated behind `timingMethod` -- manifest assets contribute their bytes even at the 'entry' default/unset. Cross-origin assets without a Timing-Allow-Origin header report 0 bytes per the Resource Timing spec.
+ * @property {boolean} [renderBlocking] - True if any detected asset (entry script or matched manifest asset) has a `renderBlockingStatus` of 'blocking'; false if none were 'blocking' but at least one reported 'non-blocking'; left `undefined` if no detected asset reported the attribute at all (e.g. unsupported browser). A single 'blocking' asset always wins over any number of 'non-blocking' ones, regardless of resolution order.
  */
 /**
  * @typedef {Object} RegisterAPIVitals

package/dist/cjs/loaders/api/register.js

@@ -23,12 +23,15 @@ var _pageVisibility = require("../../common/window/page-visibility");
 var _scriptTracker = require("../../common/v2/script-tracker");
 var _mfeVitals = require("../../common/v2/mfe-vitals");
 var _uniqueId = require("../../common/ids/unique-id");
+var _manifest = require("../../common/v2/manifest");
 var _cleanUrl = require("../../common/url/clean-url");
 /**
  * Copyright 2020-2026 New Relic, Inc. All rights reserved.
  * SPDX-License-Identifier: Apache-2.0
  */
 
+const TIMING_METHODS = ['entry', 'scripts', 'all'];
+
 /**
  * @typedef {import('./register-api-types').RegisterAPI} RegisterAPI
  */
@@ -50,6 +53,7 @@ const warnings = exports.warnings = {
   disabled: (0, _invoke.single)(() => (0, _console.warn)(55)),
   invalidTarget: (0, _invoke.single)(target => (0, _console.warn)(48, target)),
   deregistered: (0, _invoke.single)(() => (0, _console.warn)(68)),
+  invalidTimingMethod: (0, _invoke.single)(value => (0, _console.warn)(80, value)),
   duplicateName: (0, _invoke.single)(target => (0, _console.warn)(81, target)),
   duplicateId: (0, _invoke.single)(target => (0, _console.warn)(82, target))
 };
@@ -87,9 +91,17 @@ function register(agentRef, target) {
     // getter because this is asynchronously set
     type: _constants.V2_TYPES.BA
   };
+  target.manifest = (0, _manifest.parseManifest)(target.manifest);
+  if (target.timingMethod !== undefined && !TIMING_METHODS.includes(target.timingMethod)) {
+    warnings.invalidTimingMethod(target.timingMethod);
+    target.timingMethod = undefined;
+  }
 
   // The script timings for this entity, which will be used to populate part of the MicroFrontEndTiming custom event.
   const timings = (0, _scriptTracker.findScriptTimings)(target);
+  // Always applied when a manifest is present -- totalWeight/renderBlocking accumulate from manifest assets
+  // regardless of timingMethod; actual timing widening inside stays gated to 'scripts'/'all' (see applyManifestTimings).
+  if (target.manifest) (0, _scriptTracker.applyManifestTimings)(timings, target);
 
   // Track MFE vitals for this entity, which will be used to populate part of the MicroFrontEndTiming custom event.
   const vitals = (0, _mfeVitals.trackMFEVitals)(target, timings);
@@ -263,6 +275,12 @@ function register(agentRef, target) {
       // fetch time and script time together
       timeToRegister: timings.registeredAt,
       // timestamp when register() was called
+      totalWeight: timings.totalWeight,
+      // sum of transferSize bytes across every detected asset (entry script + matched manifest assets)
+      // renderBlocking: true if any detected asset was 'blocking', false if only 'non-blocking' assets were seen, omitted entirely if no detected asset reported the attribute at all
+      ...(timings.renderBlocking !== undefined && {
+        renderBlocking: timings.renderBlocking
+      }),
       // leave room to extend these with more data keys as needed
       ...(vitals.fcp.value >= 0 && {
         'vitals.fcp.value': vitals.fcp.value

package/dist/esm/common/constants/env.cdn.js

@@ -11,7 +11,7 @@
 /**
  * Exposes the version of the agent
  */
-export const VERSION = "1.321.0-rc.7";
+export const VERSION = "1.321.0-rc.9";
 
 /**
  * Exposes the build type of the agent

package/dist/esm/common/constants/env.npm.js

@@ -11,7 +11,7 @@
 /**
  * Exposes the version of the agent
  */
-export const VERSION = "1.321.0-rc.7";
+export const VERSION = "1.321.0-rc.9";
 
 /**
  * Exposes the build type of the agent

package/dist/esm/common/util/console.js

@@ -95,6 +95,7 @@ import { dispatchGlobalEvent } from '../dispatch/global-event';
  * | 77 | Agent rejected post message, could not validate origin. |
  * | 78 | RegisteredIframeEntity could not determine parent origin and will not register, to avoid trusting messages from any origin. |
  * | 79 | Unable to initialize Connector and/or Harvester. |
+ * | 80 | An invalid manifest option was provided to register() and will be ignored. |
  * | 81 | Entities were detected that share a name with different IDs - This can cause multiple entities to have the same name in New Relic. |
  * | 82 | Entities were detected that share an ID with different names - This can cause your entity's name to change unexpectedly. |
  *

package/dist/esm/common/v2/manifest.js

@@ -0,0 +1,136 @@
+/**
+ * Copyright 2020-2026 New Relic, Inc. All rights reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+import { cleanURL } from '../url/clean-url';
+import { warn } from '../util/console';
+import { single } from '../util/invoke';
+
+/**
+ * @typedef {Object} AssetFile
+ * @property {string|RegExp} matcher - the path/path-fragment string, or RegExp, used to match a resolved URL against this asset
+ * @property {'script'|'asset'} [type] - optional override for script-capability inference. When omitted, script-capability is inferred from a
+ * `.js` suffix on a string `matcher` (a RegExp `matcher` is never inferred as a script). Supply `type: 'script'` to explicitly flag an entry
+ * as a script regardless of its matcher shape/suffix (e.g. an extensionless URL, or a RegExp targeting a script path), or `type: 'asset'` to
+ * explicitly flag it as non-script. Any other value is invalid, logs a warning, and is ignored (falls back to inference).
+ */
+
+/** Warns at most once per page for any invalid manifest entry (bad `matcher` or bad `type`) -- mirrors the
+ * existing `invalidTimingMethod` single()-wrapped warning pattern in register.js. */
+const warnInvalidManifestEntry = single(secondary => warn(80, secondary));
+
+/**
+ * @typedef {Object} ParsedManifestAsset
+ * @property {string|RegExp} pattern - the original matcher supplied by the customer
+ * @property {(url: string) => boolean} test - precompiled matcher against a resolved URL
+ * @property {boolean} isScript
+ */
+
+/**
+ * @typedef {Object} ParsedManifest
+ * @property {ParsedManifestAsset[]} assets - all supplied assets
+ * @property {ParsedManifestAsset[]} scripts - the subset of assets inferred/declared as scripts (`.js`)
+ */
+
+/**
+ * Parses a raw manifest supplied to `register()` into precompiled matcher closures. Parsing happens once, at
+ * registration time, so downstream event attribution (which runs on every ajax/error/log/websocket event) never has
+ * to re-derive matching logic from the raw customer input.
+ * @param {{assets?: Array<AssetFile>}} [rawManifest]
+ * @returns {ParsedManifest|undefined} undefined if no usable assets were supplied, so callers can cheaply skip all manifest logic
+ */
+export function parseManifest(rawManifest) {
+  if (!Array.isArray(rawManifest?.assets) || !rawManifest.assets.length) return undefined;
+  const assets = rawManifest.assets.map(parseAsset).filter(Boolean);
+  if (!assets.length) return undefined;
+  return {
+    assets,
+    scripts: assets.filter(asset => asset.isScript)
+  };
+}
+
+/**
+ * @param {AssetFile} entry
+ * @returns {ParsedManifestAsset|undefined}
+ */
+function parseAsset(entry) {
+  if (!entry || typeof entry !== 'object') return undefined;
+  const {
+    matcher,
+    type
+  } = entry;
+  const inferredIsScript = typeof matcher === 'string' && isScriptPath(matcher);
+  let isScript = inferredIsScript;
+  if (type !== undefined) {
+    if (isValidType(type)) {
+      isScript = isScriptType(type);
+    } else {
+      // Invalid `type` never overrides -- fall back to inference-only behavior rather than forcing `isScript: false`,
+      // so a typo'd `type` can't silently break stack-trace attribution for an otherwise-valid `.js` matcher.
+      warnInvalidManifestEntry(type);
+    }
+  }
+  if (isRegExp(matcher)) {
+    // Reset lastIndex before every test -- a `g`/`y` flagged matcher otherwise carries state across calls
+    // (this closure is reused for every event), causing intermittent, input-order-dependent match failures.
+    return {
+      pattern: matcher,
+      test: url => {
+        matcher.lastIndex = 0;
+        return matcher.test(cleanURL(url));
+      },
+      isScript
+    };
+  }
+  if (typeof matcher === 'string' && matcher.length > 0) {
+    return {
+      pattern: matcher,
+      test: url => cleanURL(url).includes(matcher),
+      isScript
+    };
+  }
+
+  // Every other matcher shape (missing, empty string, null, number, plain object, ...) is invalid -- notably an
+  // empty string must be rejected here rather than falling through to the string branch above, since
+  // ''.includes('') is always true and would otherwise silently match every URL.
+  warnInvalidManifestEntry(matcher);
+  return undefined;
+}
+function isScriptPath(path) {
+  return path.endsWith('.js');
+}
+function isValidType(type) {
+  return type === 'script' || type === 'asset';
+}
+
+/**
+ * Cross-realm-safe check for whether a value is a RegExp. `instanceof RegExp` only returns true when the value's
+ * prototype chain links to THIS realm's `RegExp.prototype` -- a regex literal constructed in a different realm
+ * (an iframe, a Worker via structured clone, a WebDriver sandbox such as Firefox's geckodriver executeScript
+ * context) is still a genuine RegExp, just not an instance of this realm's constructor, and would otherwise be
+ * silently dropped by parseAsset below.
+ * @param {*} value
+ * @returns {boolean}
+ */
+function isRegExp(value) {
+  return Object.prototype.toString.call(value) === '[object RegExp]';
+}
+function isScriptType(type) {
+  return type === 'script';
+}
+
+/**
+ * Determines whether a resolved URL matches any asset in a parsed manifest.
+ * @param {ParsedManifest|undefined} parsed
+ * @param {string} url
+ * @param {{scriptsOnly?: boolean}} [options]
+ * @returns {boolean}
+ */
+export function matchManifestAsset(parsed, url, {
+  scriptsOnly = false
+} = {}) {
+  if (!parsed || !url) return false;
+  const candidates = scriptsOnly ? parsed.scripts : parsed.assets;
+  return candidates.some(asset => asset.test(url));
+}

package/dist/esm/common/v2/script-tracker-types.js

@@ -0,0 +1,24 @@
+/**
+ * Copyright 2020-2026 New Relic, Inc. All rights reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+/**
+ * @typedef {(start: number, end: number) => void} RecordManifestScriptWindowFn - Widens the live scriptStart/
+ * scriptEnd window with one manifest script asset's DOM correlation timing. `start`/`end` are that asset's
+ * `correlation.script.start`/`.end`, or falsy if not yet resolved. See `findScriptTimings`, which registers the
+ * concrete implementation, for the exact widening semantics (never shrinks either bound).
+ */
+
+/**
+ * @typedef {Object} TimingsInternals
+ * @property {Set<string>} weighedAssetUrls - Always present (seeded by `getOrCreateInternals`, see
+ * `script-tracker.js`). Cleaned URLs already folded into `timings.totalWeight`/`timings.renderBlocking` by
+ * `applyResourceWeight`, so the same underlying resource (e.g. a manifest asset that's also the .register calling
+ * script itself) is never counted twice.
+ * @property {RecordManifestScriptWindowFn} recordManifestScriptWindow - Always present (seeded by
+ * `getOrCreateInternals`, see `script-tracker.js`). `findScriptTimings` overrides the seeded default with one that
+ * folds into the live `scriptStart`/`scriptEnd` getters instead.
+ */
+
+export default {};

package/dist/esm/common/v2/script-tracker.js

@@ -12,8 +12,10 @@ import { CORRELATION_STALE_THRESHOLD_MS } from './script-tracker-constants';
 import { timingFactory } from './timing-factory';
 
 /**
- * @typedef {import('./register-api-types').RegisterAPITimings} RegisterAPITimings
+ * @typedef {import('../../loaders/api/register-api-types').RegisterAPITimings} RegisterAPITimings
  * @typedef {import('../../loaders/api/register-api-types').RegisterAPITarget} RegisterAPITarget
+ * @typedef {import('./script-tracker-types').RecordManifestScriptWindowFn} RecordManifestScriptWindowFn
+ * @typedef {import('./script-tracker-types').TimingsInternals} TimingsInternals
  */
 
 /** export for testing purposes */
@@ -33,11 +35,43 @@ export const scriptCorrelations = new Map();
 let poSubscribers = [];
 
 /**
- * Retrieves a script correlation by URL using exact matching
+ * Bookkeeping keyed by a `timings` object, kept off the object itself since it's exposed directly to customers via
+ * `register().metadata.timings`.
+ * @type {WeakMap<RegisterAPITimings, TimingsInternals>}
+ */
+const timingsInternals = new WeakMap();
+
+/**
+ * Gets (or lazily creates) the bookkeeping record for a `timings` object. A fresh record's `recordManifestScriptWindow`
+ * defaults to widening `timings.scriptStart`/`scriptEnd` directly -- correct for a plain `timings` object never
+ * produced by `findScriptTimings`. `findScriptTimings` overrides that default with one that folds into its live
+ * getters instead.
+ * @param {RegisterAPITimings} timings
+ * @returns {TimingsInternals}
+ */
+function getOrCreateInternals(timings) {
+  let internals = timingsInternals.get(timings);
+  if (!internals) {
+    internals = {
+      weighedAssetUrls: new Set(),
+      recordManifestScriptWindow: (start, end) => {
+        if (start) timings.scriptStart = timings.scriptStart > 0 ? Math.min(timings.scriptStart, start) : start;
+        if (end) timings.scriptEnd = timings.scriptEnd > 0 ? Math.max(timings.scriptEnd, end) : end;
+      }
+    };
+    timingsInternals.set(timings, internals);
+  }
+  return internals;
+}
+
+/**
+ * Retrieves a script correlation by URL using exact matching. Exported so other features (e.g. generic_events'
+ * resource attribution) can key off the same DOM node/load-timing tracking this module already does for every
+ * `<script>` element, rather than setting up a second, redundant observer.
  * @param {string} targetUrl - The URL to find
  * @returns {ScriptCorrelation | undefined} - The correlation object if found
  */
-function findCorrelation(targetUrl) {
+export function findCorrelation(targetUrl) {
   return scriptCorrelations.get(targetUrl);
 }
 
@@ -86,20 +120,23 @@ if (globalScope.MutationObserver && globalScope.document) {
   });
 }
 if (globalScope.PerformanceObserver?.supportedEntryTypes.includes('resource')) {
-  /** We must track the script assets this way, because the performance buffer can fill up and when it does that
-   * it stops accepting new entries (instead of dropping old entries), which means if the register API is called
-   * after the buffer fills up we won't be able to get the script timing information from the resource timing API
-  */
+  // Tracked via an observer (not a later buffer read) because the performance buffer stops accepting new entries
+  // once full, instead of dropping old ones -- a late register() call could otherwise miss timing entirely.
   const scriptObserver = new PerformanceObserver(list => {
-    list.getEntries().filter(validEntryCriteria).forEach(entry => {
-      // Update correlation with performance data (creates entry if needed)
-      const entryUrl = cleanURL(entry.name);
-      const correlation = getOrCreateCorrelation(entryUrl);
-      correlation.performance.start = Math.floor(entry.startTime);
-      correlation.performance.end = Math.floor(entry.responseEnd);
-      correlation.performance.value = entry;
-
-      // Clear resolved or expired subscribers
+    list.getEntries().forEach(entry => {
+      // Correlation bookkeeping only makes sense for script-like entries -- gated on validEntryCriteria so
+      // scriptCorrelations doesn't grow for every image/css/font load on the page.
+      if (validEntryCriteria(entry)) {
+        const entryUrl = cleanURL(entry.name);
+        const correlation = getOrCreateCorrelation(entryUrl);
+        correlation.performance.start = Math.floor(entry.startTime);
+        correlation.performance.end = Math.floor(entry.responseEnd);
+        correlation.performance.value = entry;
+      }
+
+      // Late-resolution subscribers can be for any asset type (not just scripts), so every entry is checked here,
+      // unfiltered. Skipped when nothing is pending, the common case.
+      if (!poSubscribers.length) return;
       const canClear = [];
       poSubscribers.forEach(({
         test,
@@ -198,6 +235,33 @@ function applyPerformanceEntry(timings, entry) {
   timings.fetchEnd = Math.floor(entry.responseEnd);
   timings.asset = entry.name;
   timings.type = entry.initiatorType;
+  applyResourceWeight(timings, entry);
+}
+
+/**
+ * Accumulates the byte weight and render-blocking status of a single detected asset (the entry script or a resolved
+ * manifest asset) into a timings object. Shared by both the entry-script path (`applyPerformanceEntry`) and the
+ * manifest path (`applyManifestEntry`) so `totalWeight`/`renderBlocking` reflect every asset actually detected,
+ * regardless of which path found it.
+ * @param {RegisterAPITimings} timings
+ * @param {PerformanceResourceTiming} entry
+ */
+function applyResourceWeight(timings, entry) {
+  // De-dupe by cleaned URL: a manifest can list the .register calling script itself as one of its own assets,
+  // which would otherwise weigh the same resource twice (once via findScriptTimings, once via applyManifestTimings).
+  const url = cleanURL(entry.name);
+  const {
+    weighedAssetUrls
+  } = getOrCreateInternals(timings);
+  if (weighedAssetUrls.has(url)) return;
+  weighedAssetUrls.add(url);
+
+  // transferSize is 0 for cross-origin responses without Timing-Allow-Origin (a privacy restriction, not a
+  // zero-byte asset) -- adding 0 is correct either way.
+  timings.totalWeight = (timings.totalWeight || 0) + (entry.transferSize || 0);
+  // 'blocking' always wins and never gets downgraded; 'non-blocking' only applies if nothing already resolved
+  // true; no value at all (unsupported browser) leaves renderBlocking untouched (stays `undefined`).
+  if (entry.renderBlockingStatus === 'blocking') timings.renderBlocking = true;else if (entry.renderBlockingStatus === 'non-blocking' && timings.renderBlocking !== true) timings.renderBlocking = false;
 }
 
 /**
@@ -220,8 +284,114 @@ function subscribeToLatePerformanceEntry(timings, mfeScriptUrl) {
 }
 
 /**
- * Uses the stack of the initiator function, returns script timing information if a script can be found with the resource timing API matching the URL found in the stack.
- * @param {RegisterAPITarget} [target] - The MFE target being registered. Its id is used to scope stale-correlation detection per-MFE rather than per-script-URL, so one script registering multiple distinct MFEs doesn't misclassify a later MFE's registration as a stale reuse of an earlier one's.
+ * Applies one manifest asset's performance entry to a timings object: weight/renderBlocking always accumulate;
+ * fetchStart/fetchEnd and scriptStart/scriptEnd widen (never shrink) only when `timingMethod` calls for it; asset/
+ * type get anchored to the first script asset seen to resolve.
+ * @param {RegisterAPITimings} timings
+ * @param {PerformanceResourceTiming} entry
+ * @param {import('./manifest').ParsedManifestAsset} asset - the manifest asset this entry resolved
+ * @param {{ resolved: boolean }} entryState - shared "first script asset wins" guard for a single `applyManifestTimings` call
+ * @param {'entry'|'scripts'|'all'} [timingMethod] - the registered MFE's timing method; `undefined`/'entry' means weight/render-blocking still accumulate, but no timing widening happens at all
+ */
+function applyManifestEntry(timings, entry, asset, entryState, timingMethod) {
+  // Weight isn't a timing concern, so it accumulates for every matched asset regardless of timingMethod.
+  applyResourceWeight(timings, entry);
+  if (timingMethod !== 'scripts' && timingMethod !== 'all') return; // no timing-widening effect at the 'entry' default/unset
+
+  const widensAllAssets = timingMethod === 'all';
+  // Under 'scripts', only script assets widen the fetch window; under 'all', every matched asset does.
+  if (widensAllAssets || asset.isScript) {
+    const start = Math.floor(entry.startTime);
+    const end = Math.floor(entry.responseEnd);
+    // fetchStart/fetchEnd default to 0 ("not yet found") -- only fold into the min/max once they're positive,
+    // or 0 would permanently win Math.min.
+    timings.fetchStart = timings.fetchStart > 0 ? Math.min(timings.fetchStart, start) : start;
+    timings.fetchEnd = timings.fetchEnd > 0 ? Math.max(timings.fetchEnd, end) : end;
+  }
+
+  // Non-script assets never execute, so only script assets widen the execution window or anchor asset/type.
+  if (asset.isScript) {
+    const correlation = findCorrelation(cleanURL(entry.name));
+    if (correlation) {
+      // Widens the aggregate scriptStart/scriptEnd window with this asset's current correlation timing. Re-called
+      // as a 'load'/'error' listener below if its DOM completion hasn't fired yet, so a later, larger end still counts.
+      const widenScriptWindowForAsset = () => {
+        const {
+          start: scriptStart,
+          end: scriptEnd
+        } = correlation.script;
+        getOrCreateInternals(timings).recordManifestScriptWindow(scriptStart, scriptEnd);
+      };
+      widenScriptWindowForAsset();
+      if (!correlation.dom.end && correlation.dom.value) {
+        ;
+        ['load', 'error'].forEach(eventType => correlation.dom.value.addEventListener(eventType, widenScriptWindowForAsset, {
+          once: true
+        }));
+      }
+    }
+    if (!entryState.resolved) {
+      timings.asset = entry.name;
+      timings.type = entry.initiatorType;
+      entryState.resolved = true;
+    }
+  }
+}
+
+/**
+ * Subscribes to late resource timing emissions for manifest assets not yet resolved against the buffered entries.
+ * Reuses the shared page-wide scriptObserver/poSubscribers mechanism (one PerformanceObserver for all MFEs, not
+ * one per MFE) and, unlike that observer's own correlation bookkeeping, checks every resource entry -- not just
+ * script-like ones -- so lazy-loaded images/fonts/stylesheets resolve too.
+ * @param {RegisterAPITimings} timings
+ * @param {Set<import('./manifest').ParsedManifestAsset>} pending - manifest assets still unresolved
+ * @param {{ resolved: boolean }} entryState - shared "first script asset wins" guard for a single `applyManifestTimings` call
+ * @param {'entry'|'scripts'|'all'} [timingMethod] - forwarded to `applyManifestEntry` for each late-resolving asset
+ */
+function subscribeToLateManifestEntries(timings, pending, entryState, timingMethod) {
+  if (!globalScope.PerformanceObserver?.supportedEntryTypes?.includes('resource')) return;
+  poSubscribers.push({
+    addedAt: now(),
+    test: entry => {
+      const matched = [...pending].find(asset => asset.test(entry.name));
+      if (matched) {
+        applyManifestEntry(timings, entry, matched, entryState, timingMethod);
+        pending.delete(matched);
+      }
+      return pending.size === 0;
+    }
+  });
+}
+
+/**
+ * Applies a registered MFE's manifest to a timings object (already populated by `findScriptTimings`). No-op if no
+ * manifest is present. Weight/renderBlocking always accumulate from every detected manifest asset; timing widening
+ * (fetchStart/fetchEnd/scriptStart/scriptEnd/asset anchor) is opt-in via `timingMethod` -- see `applyManifestEntry`.
+ * @param {RegisterAPITimings} timings - the timings object to widen in place
+ * @param {RegisterAPITarget} target - the registered MFE target, which may carry a parsed `manifest`
+ */
+export function applyManifestTimings(timings, target) {
+  const parsedManifest = target?.manifest;
+  if (!parsedManifest || !parsedManifest.assets.length) return;
+  const entryState = {
+    resolved: false
+  };
+  const pending = new Set(parsedManifest.assets);
+  const resourceEntries = globalScope.performance?.getEntriesByType('resource') || [];
+  resourceEntries.forEach(entry => {
+    const matched = [...pending].find(asset => asset.test(entry.name));
+    if (matched) {
+      applyManifestEntry(timings, entry, matched, entryState, target.timingMethod);
+      pending.delete(matched);
+    }
+  });
+  if (pending.size) subscribeToLateManifestEntries(timings, pending, entryState, target.timingMethod);
+}
+
+/**
+ * Uses the initiator function's stack to find script timing information via the resource timing API.
+ * @param {RegisterAPITarget} [target] - the MFE target being registered; its id scopes stale-correlation
+ * detection per-MFE rather than per-script-URL (see isCorrelationStale below)
  * @returns {RegisterAPITimings} Object containing script fetch start and end times, and the asset URL if found
  */
 export function findScriptTimings(target) {
@@ -234,7 +404,9 @@ export function findScriptTimings(target) {
     scriptStart: 0,
     scriptEnd: 0,
     asset: undefined,
-    type: 'unknown'
+    type: 'unknown',
+    totalWeight: 0,
+    renderBlocking: undefined
   };
   const stack = getDeepStackTrace();
   if (!stack) return timings;
@@ -271,9 +443,8 @@ export function findScriptTimings(target) {
     }
 
     // A correlation can be reused across multiple `register()` calls for the same script URL (e.g. an SPA
-    // remounting the same MFE without the script actually reloading). When that happens, its dom/performance
-    // timings still describe the *original* load, not this one. Detect that case so scriptStart/scriptEnd
-    // below can ignore the stale data instead of reporting it as if it were fresh.
+    // remounting the same MFE without the script reloading) -- its dom/performance timings would then describe
+    // the *original* load. Detect that so scriptStart/scriptEnd below can ignore the stale data.
     const correlation = timings.correlation;
     const alreadyClaimedByThisMFE = !!mfeId && !!correlation?.claimedBy.has(mfeId);
     if (correlation && mfeId) correlation.claimedBy.add(mfeId);
@@ -284,10 +455,35 @@ export function findScriptTimings(target) {
       return staleness > CORRELATION_STALE_THRESHOLD_MS;
     };
 
-    // Use getters here because the correlation data may arrive after this function returns the timing object, and we want to provide the most up-to-date timing information possible when the getters are accessed at harvest time.
-    // Non-stale: fall back to fetchEnd if correlation data isn't available yet (our best approximation for script execution start). Stale: fall back straight to registeredAt — fetchEnd would be derived from the same stale correlation, so it can't be trusted either.
-    Object.defineProperty(timings, 'scriptStart', timingFactory(() => isCorrelationStale() ? timings.registeredAt : correlation?.script.start ?? timings.fetchEnd));
-    Object.defineProperty(timings, 'scriptEnd', timingFactory(() => isCorrelationStale() ? timings.registeredAt : correlation?.script.end ?? timings.registeredAt));
+    // Only reached for a real (non-inline), stack-attributable script -- scriptStart/scriptEnd become live getters
+    // below, so manifest widening needs a hook that composes with them instead of overriding them (see
+    // recordManifestScriptWindow's doc comment). Every other path keeps getOrCreateInternals' plain-value-widening
+    // default, which is already correct there.
+    let manifestScriptStart = 0;
+    let manifestScriptEnd = 0;
+    /**
+     * Widens the running manifestScriptStart/manifestScriptEnd accumulators with one asset's correlation timing.
+     * Never shrinks either bound; a falsy (unresolved) start/end is ignored.
+     * @type {RecordManifestScriptWindowFn}
+     */
+    getOrCreateInternals(timings).recordManifestScriptWindow = (start, end) => {
+      if (start) manifestScriptStart = manifestScriptStart > 0 ? Math.min(manifestScriptStart, start) : start;
+      if (end) manifestScriptEnd = manifestScriptEnd > 0 ? Math.max(manifestScriptEnd, end) : end;
+    };
+
+    // Getters, since correlation data may still arrive after this function returns -- we want the freshest value
+    // at harvest time. Non-stale: fall back to fetchEnd (best approximation) if correlation isn't available yet.
+    // Stale: fall back to registeredAt, since fetchEnd would derive from the same stale correlation. Manifest
+    // widening is re-read on every access rather than baked in once, so it composes with a correlation that
+    // resolves later.
+    Object.defineProperty(timings, 'scriptStart', timingFactory(() => {
+      const ownStart = isCorrelationStale() ? timings.registeredAt : correlation?.script.start ?? timings.fetchEnd;
+      return manifestScriptStart > 0 ? Math.min(ownStart, manifestScriptStart) : ownStart;
+    }));
+    Object.defineProperty(timings, 'scriptEnd', timingFactory(() => {
+      const ownEnd = isCorrelationStale() ? timings.registeredAt : correlation?.script.end ?? timings.registeredAt;
+      return manifestScriptEnd > 0 ? Math.max(ownEnd, manifestScriptEnd) : ownEnd;
+    }));
   } catch (error) {
     // Don't let stack parsing errors break anything
   }