@newrelic/browser-agent 1.321.0-rc.7 → 1.321.0-rc.9

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@newrelic/browser-agent",
-  "version": "1.321.0-rc.7",
+  "version": "1.321.0-rc.9",
   "private": false,
   "author": "New Relic Browser Agent Team <browser-agent@newrelic.com>",
   "description": "New Relic Browser Agent",

package/src/common/util/console.js

@@ -95,6 +95,7 @@ import { dispatchGlobalEvent } from '../dispatch/global-event'
  * | 77 | Agent rejected post message, could not validate origin. |
  * | 78 | RegisteredIframeEntity could not determine parent origin and will not register, to avoid trusting messages from any origin. |
  * | 79 | Unable to initialize Connector and/or Harvester. |
+ * | 80 | An invalid manifest option was provided to register() and will be ignored. |
  * | 81 | Entities were detected that share a name with different IDs - This can cause multiple entities to have the same name in New Relic. |
  * | 82 | Entities were detected that share an ID with different names - This can cause your entity's name to change unexpectedly. |
  *

package/src/common/v2/manifest.js

@@ -0,0 +1,126 @@
+/**
+ * Copyright 2020-2026 New Relic, Inc. All rights reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+import { cleanURL } from '../url/clean-url'
+import { warn } from '../util/console'
+import { single } from '../util/invoke'
+
+/**
+ * @typedef {Object} AssetFile
+ * @property {string|RegExp} matcher - the path/path-fragment string, or RegExp, used to match a resolved URL against this asset
+ * @property {'script'|'asset'} [type] - optional override for script-capability inference. When omitted, script-capability is inferred from a
+ * `.js` suffix on a string `matcher` (a RegExp `matcher` is never inferred as a script). Supply `type: 'script'` to explicitly flag an entry
+ * as a script regardless of its matcher shape/suffix (e.g. an extensionless URL, or a RegExp targeting a script path), or `type: 'asset'` to
+ * explicitly flag it as non-script. Any other value is invalid, logs a warning, and is ignored (falls back to inference).
+ */
+
+/** Warns at most once per page for any invalid manifest entry (bad `matcher` or bad `type`) -- mirrors the
+ * existing `invalidTimingMethod` single()-wrapped warning pattern in register.js. */
+const warnInvalidManifestEntry = single((secondary) => warn(80, secondary))
+
+/**
+ * @typedef {Object} ParsedManifestAsset
+ * @property {string|RegExp} pattern - the original matcher supplied by the customer
+ * @property {(url: string) => boolean} test - precompiled matcher against a resolved URL
+ * @property {boolean} isScript
+ */
+
+/**
+ * @typedef {Object} ParsedManifest
+ * @property {ParsedManifestAsset[]} assets - all supplied assets
+ * @property {ParsedManifestAsset[]} scripts - the subset of assets inferred/declared as scripts (`.js`)
+ */
+
+/**
+ * Parses a raw manifest supplied to `register()` into precompiled matcher closures. Parsing happens once, at
+ * registration time, so downstream event attribution (which runs on every ajax/error/log/websocket event) never has
+ * to re-derive matching logic from the raw customer input.
+ * @param {{assets?: Array<AssetFile>}} [rawManifest]
+ * @returns {ParsedManifest|undefined} undefined if no usable assets were supplied, so callers can cheaply skip all manifest logic
+ */
+export function parseManifest (rawManifest) {
+  if (!Array.isArray(rawManifest?.assets) || !rawManifest.assets.length) return undefined
+
+  const assets = rawManifest.assets.map(parseAsset).filter(Boolean)
+  if (!assets.length) return undefined
+
+  return { assets, scripts: assets.filter(asset => asset.isScript) }
+}
+
+/**
+ * @param {AssetFile} entry
+ * @returns {ParsedManifestAsset|undefined}
+ */
+function parseAsset (entry) {
+  if (!entry || typeof entry !== 'object') return undefined
+
+  const { matcher, type } = entry
+  const inferredIsScript = typeof matcher === 'string' && isScriptPath(matcher)
+
+  let isScript = inferredIsScript
+  if (type !== undefined) {
+    if (isValidType(type)) {
+      isScript = isScriptType(type)
+    } else {
+      // Invalid `type` never overrides -- fall back to inference-only behavior rather than forcing `isScript: false`,
+      // so a typo'd `type` can't silently break stack-trace attribution for an otherwise-valid `.js` matcher.
+      warnInvalidManifestEntry(type)
+    }
+  }
+
+  if (isRegExp(matcher)) {
+    // Reset lastIndex before every test -- a `g`/`y` flagged matcher otherwise carries state across calls
+    // (this closure is reused for every event), causing intermittent, input-order-dependent match failures.
+    return { pattern: matcher, test: (url) => { matcher.lastIndex = 0; return matcher.test(cleanURL(url)) }, isScript }
+  }
+
+  if (typeof matcher === 'string' && matcher.length > 0) {
+    return { pattern: matcher, test: (url) => cleanURL(url).includes(matcher), isScript }
+  }
+
+  // Every other matcher shape (missing, empty string, null, number, plain object, ...) is invalid -- notably an
+  // empty string must be rejected here rather than falling through to the string branch above, since
+  // ''.includes('') is always true and would otherwise silently match every URL.
+  warnInvalidManifestEntry(matcher)
+  return undefined
+}
+
+function isScriptPath (path) {
+  return path.endsWith('.js')
+}
+
+function isValidType (type) {
+  return type === 'script' || type === 'asset'
+}
+
+/**
+ * Cross-realm-safe check for whether a value is a RegExp. `instanceof RegExp` only returns true when the value's
+ * prototype chain links to THIS realm's `RegExp.prototype` -- a regex literal constructed in a different realm
+ * (an iframe, a Worker via structured clone, a WebDriver sandbox such as Firefox's geckodriver executeScript
+ * context) is still a genuine RegExp, just not an instance of this realm's constructor, and would otherwise be
+ * silently dropped by parseAsset below.
+ * @param {*} value
+ * @returns {boolean}
+ */
+function isRegExp (value) {
+  return Object.prototype.toString.call(value) === '[object RegExp]'
+}
+
+function isScriptType (type) {
+  return type === 'script'
+}
+
+/**
+ * Determines whether a resolved URL matches any asset in a parsed manifest.
+ * @param {ParsedManifest|undefined} parsed
+ * @param {string} url
+ * @param {{scriptsOnly?: boolean}} [options]
+ * @returns {boolean}
+ */
+export function matchManifestAsset (parsed, url, { scriptsOnly = false } = {}) {
+  if (!parsed || !url) return false
+  const candidates = scriptsOnly ? parsed.scripts : parsed.assets
+  return candidates.some(asset => asset.test(url))
+}

package/src/common/v2/script-tracker-types.js

@@ -0,0 +1,24 @@
+/**
+ * Copyright 2020-2026 New Relic, Inc. All rights reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+/**
+ * @typedef {(start: number, end: number) => void} RecordManifestScriptWindowFn - Widens the live scriptStart/
+ * scriptEnd window with one manifest script asset's DOM correlation timing. `start`/`end` are that asset's
+ * `correlation.script.start`/`.end`, or falsy if not yet resolved. See `findScriptTimings`, which registers the
+ * concrete implementation, for the exact widening semantics (never shrinks either bound).
+ */
+
+/**
+ * @typedef {Object} TimingsInternals
+ * @property {Set<string>} weighedAssetUrls - Always present (seeded by `getOrCreateInternals`, see
+ * `script-tracker.js`). Cleaned URLs already folded into `timings.totalWeight`/`timings.renderBlocking` by
+ * `applyResourceWeight`, so the same underlying resource (e.g. a manifest asset that's also the .register calling
+ * script itself) is never counted twice.
+ * @property {RecordManifestScriptWindowFn} recordManifestScriptWindow - Always present (seeded by
+ * `getOrCreateInternals`, see `script-tracker.js`). `findScriptTimings` overrides the seeded default with one that
+ * folds into the live `scriptStart`/`scriptEnd` getters instead.
+ */
+
+export default {}

package/src/common/v2/script-tracker.js

@@ -12,8 +12,10 @@ import { CORRELATION_STALE_THRESHOLD_MS } from './script-tracker-constants'
 import { timingFactory } from './timing-factory'
 
 /**
- * @typedef {import('./register-api-types').RegisterAPITimings} RegisterAPITimings
+ * @typedef {import('../../loaders/api/register-api-types').RegisterAPITimings} RegisterAPITimings
  * @typedef {import('../../loaders/api/register-api-types').RegisterAPITarget} RegisterAPITarget
+ * @typedef {import('./script-tracker-types').RecordManifestScriptWindowFn} RecordManifestScriptWindowFn
+ * @typedef {import('./script-tracker-types').TimingsInternals} TimingsInternals
  */
 
 /** export for testing purposes */
@@ -33,11 +35,43 @@ export const scriptCorrelations = new Map()
 let poSubscribers = []
 
 /**
- * Retrieves a script correlation by URL using exact matching
+ * Bookkeeping keyed by a `timings` object, kept off the object itself since it's exposed directly to customers via
+ * `register().metadata.timings`.
+ * @type {WeakMap<RegisterAPITimings, TimingsInternals>}
+ */
+const timingsInternals = new WeakMap()
+
+/**
+ * Gets (or lazily creates) the bookkeeping record for a `timings` object. A fresh record's `recordManifestScriptWindow`
+ * defaults to widening `timings.scriptStart`/`scriptEnd` directly -- correct for a plain `timings` object never
+ * produced by `findScriptTimings`. `findScriptTimings` overrides that default with one that folds into its live
+ * getters instead.
+ * @param {RegisterAPITimings} timings
+ * @returns {TimingsInternals}
+ */
+function getOrCreateInternals (timings) {
+  let internals = timingsInternals.get(timings)
+  if (!internals) {
+    internals = {
+      weighedAssetUrls: new Set(),
+      recordManifestScriptWindow: (start, end) => {
+        if (start) timings.scriptStart = timings.scriptStart > 0 ? Math.min(timings.scriptStart, start) : start
+        if (end) timings.scriptEnd = timings.scriptEnd > 0 ? Math.max(timings.scriptEnd, end) : end
+      }
+    }
+    timingsInternals.set(timings, internals)
+  }
+  return internals
+}
+
+/**
+ * Retrieves a script correlation by URL using exact matching. Exported so other features (e.g. generic_events'
+ * resource attribution) can key off the same DOM node/load-timing tracking this module already does for every
+ * `<script>` element, rather than setting up a second, redundant observer.
  * @param {string} targetUrl - The URL to find
  * @returns {ScriptCorrelation | undefined} - The correlation object if found
  */
-function findCorrelation (targetUrl) {
+export function findCorrelation (targetUrl) {
   return scriptCorrelations.get(targetUrl)
 }
 
@@ -88,20 +122,24 @@ if (globalScope.MutationObserver && globalScope.document) {
 }
 
 if (globalScope.PerformanceObserver?.supportedEntryTypes.includes('resource')) {
-  /** We must track the script assets this way, because the performance buffer can fill up and when it does that
-   * it stops accepting new entries (instead of dropping old entries), which means if the register API is called
-   * after the buffer fills up we won't be able to get the script timing information from the resource timing API
-  */
+  // Tracked via an observer (not a later buffer read) because the performance buffer stops accepting new entries
+  // once full, instead of dropping old ones -- a late register() call could otherwise miss timing entirely.
   const scriptObserver = new PerformanceObserver((list) => {
-    list.getEntries().filter(validEntryCriteria).forEach((entry) => {
-      // Update correlation with performance data (creates entry if needed)
-      const entryUrl = cleanURL(entry.name)
-      const correlation = getOrCreateCorrelation(entryUrl)
-      correlation.performance.start = Math.floor(entry.startTime)
-      correlation.performance.end = Math.floor(entry.responseEnd)
-      correlation.performance.value = entry
-
-      // Clear resolved or expired subscribers
+    list.getEntries().forEach((entry) => {
+      // Correlation bookkeeping only makes sense for script-like entries -- gated on validEntryCriteria so
+      // scriptCorrelations doesn't grow for every image/css/font load on the page.
+      if (validEntryCriteria(entry)) {
+        const entryUrl = cleanURL(entry.name)
+        const correlation = getOrCreateCorrelation(entryUrl)
+        correlation.performance.start = Math.floor(entry.startTime)
+        correlation.performance.end = Math.floor(entry.responseEnd)
+        correlation.performance.value = entry
+      }
+
+      // Late-resolution subscribers can be for any asset type (not just scripts), so every entry is checked here,
+      // unfiltered. Skipped when nothing is pending, the common case.
+      if (!poSubscribers.length) return
+
       const canClear = []
       poSubscribers.forEach(({ test, addedAt }, idx) => {
         if (test(entry) || now() - addedAt > 10000) canClear.push(idx)
@@ -197,6 +235,32 @@ function applyPerformanceEntry (timings, entry) {
   timings.fetchEnd = Math.floor(entry.responseEnd)
   timings.asset = entry.name
   timings.type = entry.initiatorType
+  applyResourceWeight(timings, entry)
+}
+
+/**
+ * Accumulates the byte weight and render-blocking status of a single detected asset (the entry script or a resolved
+ * manifest asset) into a timings object. Shared by both the entry-script path (`applyPerformanceEntry`) and the
+ * manifest path (`applyManifestEntry`) so `totalWeight`/`renderBlocking` reflect every asset actually detected,
+ * regardless of which path found it.
+ * @param {RegisterAPITimings} timings
+ * @param {PerformanceResourceTiming} entry
+ */
+function applyResourceWeight (timings, entry) {
+  // De-dupe by cleaned URL: a manifest can list the .register calling script itself as one of its own assets,
+  // which would otherwise weigh the same resource twice (once via findScriptTimings, once via applyManifestTimings).
+  const url = cleanURL(entry.name)
+  const { weighedAssetUrls } = getOrCreateInternals(timings)
+  if (weighedAssetUrls.has(url)) return
+  weighedAssetUrls.add(url)
+
+  // transferSize is 0 for cross-origin responses without Timing-Allow-Origin (a privacy restriction, not a
+  // zero-byte asset) -- adding 0 is correct either way.
+  timings.totalWeight = (timings.totalWeight || 0) + (entry.transferSize || 0)
+  // 'blocking' always wins and never gets downgraded; 'non-blocking' only applies if nothing already resolved
+  // true; no value at all (unsupported browser) leaves renderBlocking untouched (stays `undefined`).
+  if (entry.renderBlockingStatus === 'blocking') timings.renderBlocking = true
+  else if (entry.renderBlockingStatus === 'non-blocking' && timings.renderBlocking !== true) timings.renderBlocking = false
 }
 
 /**
@@ -220,13 +284,117 @@ function subscribeToLatePerformanceEntry (timings, mfeScriptUrl) {
 }
 
 /**
- * Uses the stack of the initiator function, returns script timing information if a script can be found with the resource timing API matching the URL found in the stack.
- * @param {RegisterAPITarget} [target] - The MFE target being registered. Its id is used to scope stale-correlation detection per-MFE rather than per-script-URL, so one script registering multiple distinct MFEs doesn't misclassify a later MFE's registration as a stale reuse of an earlier one's.
+ * Applies one manifest asset's performance entry to a timings object: weight/renderBlocking always accumulate;
+ * fetchStart/fetchEnd and scriptStart/scriptEnd widen (never shrink) only when `timingMethod` calls for it; asset/
+ * type get anchored to the first script asset seen to resolve.
+ * @param {RegisterAPITimings} timings
+ * @param {PerformanceResourceTiming} entry
+ * @param {import('./manifest').ParsedManifestAsset} asset - the manifest asset this entry resolved
+ * @param {{ resolved: boolean }} entryState - shared "first script asset wins" guard for a single `applyManifestTimings` call
+ * @param {'entry'|'scripts'|'all'} [timingMethod] - the registered MFE's timing method; `undefined`/'entry' means weight/render-blocking still accumulate, but no timing widening happens at all
+ */
+function applyManifestEntry (timings, entry, asset, entryState, timingMethod) {
+  // Weight isn't a timing concern, so it accumulates for every matched asset regardless of timingMethod.
+  applyResourceWeight(timings, entry)
+
+  if (timingMethod !== 'scripts' && timingMethod !== 'all') return // no timing-widening effect at the 'entry' default/unset
+
+  const widensAllAssets = timingMethod === 'all'
+  // Under 'scripts', only script assets widen the fetch window; under 'all', every matched asset does.
+  if (widensAllAssets || asset.isScript) {
+    const start = Math.floor(entry.startTime)
+    const end = Math.floor(entry.responseEnd)
+    // fetchStart/fetchEnd default to 0 ("not yet found") -- only fold into the min/max once they're positive,
+    // or 0 would permanently win Math.min.
+    timings.fetchStart = timings.fetchStart > 0 ? Math.min(timings.fetchStart, start) : start
+    timings.fetchEnd = timings.fetchEnd > 0 ? Math.max(timings.fetchEnd, end) : end
+  }
+
+  // Non-script assets never execute, so only script assets widen the execution window or anchor asset/type.
+  if (asset.isScript) {
+    const correlation = findCorrelation(cleanURL(entry.name))
+    if (correlation) {
+      // Widens the aggregate scriptStart/scriptEnd window with this asset's current correlation timing. Re-called
+      // as a 'load'/'error' listener below if its DOM completion hasn't fired yet, so a later, larger end still counts.
+      const widenScriptWindowForAsset = () => {
+        const { start: scriptStart, end: scriptEnd } = correlation.script
+        getOrCreateInternals(timings).recordManifestScriptWindow(scriptStart, scriptEnd)
+      }
+      widenScriptWindowForAsset()
+      if (!correlation.dom.end && correlation.dom.value) {
+        ;['load', 'error'].forEach(eventType => correlation.dom.value.addEventListener(eventType, widenScriptWindowForAsset, { once: true }))
+      }
+    }
+
+    if (!entryState.resolved) {
+      timings.asset = entry.name
+      timings.type = entry.initiatorType
+      entryState.resolved = true
+    }
+  }
+}
+
+/**
+ * Subscribes to late resource timing emissions for manifest assets not yet resolved against the buffered entries.
+ * Reuses the shared page-wide scriptObserver/poSubscribers mechanism (one PerformanceObserver for all MFEs, not
+ * one per MFE) and, unlike that observer's own correlation bookkeeping, checks every resource entry -- not just
+ * script-like ones -- so lazy-loaded images/fonts/stylesheets resolve too.
+ * @param {RegisterAPITimings} timings
+ * @param {Set<import('./manifest').ParsedManifestAsset>} pending - manifest assets still unresolved
+ * @param {{ resolved: boolean }} entryState - shared "first script asset wins" guard for a single `applyManifestTimings` call
+ * @param {'entry'|'scripts'|'all'} [timingMethod] - forwarded to `applyManifestEntry` for each late-resolving asset
+ */
+function subscribeToLateManifestEntries (timings, pending, entryState, timingMethod) {
+  if (!globalScope.PerformanceObserver?.supportedEntryTypes?.includes('resource')) return
+
+  poSubscribers.push({
+    addedAt: now(),
+    test: (entry) => {
+      const matched = [...pending].find(asset => asset.test(entry.name))
+      if (matched) {
+        applyManifestEntry(timings, entry, matched, entryState, timingMethod)
+        pending.delete(matched)
+      }
+      return pending.size === 0
+    }
+  })
+}
+
+/**
+ * Applies a registered MFE's manifest to a timings object (already populated by `findScriptTimings`). No-op if no
+ * manifest is present. Weight/renderBlocking always accumulate from every detected manifest asset; timing widening
+ * (fetchStart/fetchEnd/scriptStart/scriptEnd/asset anchor) is opt-in via `timingMethod` -- see `applyManifestEntry`.
+ * @param {RegisterAPITimings} timings - the timings object to widen in place
+ * @param {RegisterAPITarget} target - the registered MFE target, which may carry a parsed `manifest`
+ */
+export function applyManifestTimings (timings, target) {
+  const parsedManifest = target?.manifest
+  if (!parsedManifest || !parsedManifest.assets.length) return
+
+  const entryState = { resolved: false }
+  const pending = new Set(parsedManifest.assets)
+
+  const resourceEntries = globalScope.performance?.getEntriesByType('resource') || []
+  resourceEntries.forEach((entry) => {
+    const matched = [...pending].find(asset => asset.test(entry.name))
+    if (matched) {
+      applyManifestEntry(timings, entry, matched, entryState, target.timingMethod)
+      pending.delete(matched)
+    }
+  })
+
+  if (pending.size) subscribeToLateManifestEntries(timings, pending, entryState, target.timingMethod)
+}
+
+/**
+ * Uses the initiator function's stack to find script timing information via the resource timing API.
+ * @param {RegisterAPITarget} [target] - the MFE target being registered; its id scopes stale-correlation
+ * detection per-MFE rather than per-script-URL (see isCorrelationStale below)
  * @returns {RegisterAPITimings} Object containing script fetch start and end times, and the asset URL if found
  */
 export function findScriptTimings (target) {
   const mfeId = target?.id
-  const timings = { registeredAt: now(), reportedAt: undefined, fetchStart: 0, fetchEnd: 0, scriptStart: 0, scriptEnd: 0, asset: undefined, type: 'unknown' }
+  const timings = { registeredAt: now(), reportedAt: undefined, fetchStart: 0, fetchEnd: 0, scriptStart: 0, scriptEnd: 0, asset: undefined, type: 'unknown', totalWeight: 0, renderBlocking: undefined }
   const stack = getDeepStackTrace()
   if (!stack) return timings
 
@@ -266,9 +434,8 @@ export function findScriptTimings (target) {
     }
 
     // A correlation can be reused across multiple `register()` calls for the same script URL (e.g. an SPA
-    // remounting the same MFE without the script actually reloading). When that happens, its dom/performance
-    // timings still describe the *original* load, not this one. Detect that case so scriptStart/scriptEnd
-    // below can ignore the stale data instead of reporting it as if it were fresh.
+    // remounting the same MFE without the script reloading) -- its dom/performance timings would then describe
+    // the *original* load. Detect that so scriptStart/scriptEnd below can ignore the stale data.
     const correlation = timings.correlation
     const alreadyClaimedByThisMFE = !!mfeId && !!correlation?.claimedBy.has(mfeId)
     if (correlation && mfeId) correlation.claimedBy.add(mfeId)
@@ -279,17 +446,42 @@ export function findScriptTimings (target) {
       return staleness > CORRELATION_STALE_THRESHOLD_MS
     }
 
-    // Use getters here because the correlation data may arrive after this function returns the timing object, and we want to provide the most up-to-date timing information possible when the getters are accessed at harvest time.
-    // Non-stale: fall back to fetchEnd if correlation data isn't available yet (our best approximation for script execution start). Stale: fall back straight to registeredAt — fetchEnd would be derived from the same stale correlation, so it can't be trusted either.
+    // Only reached for a real (non-inline), stack-attributable script -- scriptStart/scriptEnd become live getters
+    // below, so manifest widening needs a hook that composes with them instead of overriding them (see
+    // recordManifestScriptWindow's doc comment). Every other path keeps getOrCreateInternals' plain-value-widening
+    // default, which is already correct there.
+    let manifestScriptStart = 0
+    let manifestScriptEnd = 0
+    /**
+     * Widens the running manifestScriptStart/manifestScriptEnd accumulators with one asset's correlation timing.
+     * Never shrinks either bound; a falsy (unresolved) start/end is ignored.
+     * @type {RecordManifestScriptWindowFn}
+     */
+    getOrCreateInternals(timings).recordManifestScriptWindow = (start, end) => {
+      if (start) manifestScriptStart = manifestScriptStart > 0 ? Math.min(manifestScriptStart, start) : start
+      if (end) manifestScriptEnd = manifestScriptEnd > 0 ? Math.max(manifestScriptEnd, end) : end
+    }
+
+    // Getters, since correlation data may still arrive after this function returns -- we want the freshest value
+    // at harvest time. Non-stale: fall back to fetchEnd (best approximation) if correlation isn't available yet.
+    // Stale: fall back to registeredAt, since fetchEnd would derive from the same stale correlation. Manifest
+    // widening is re-read on every access rather than baked in once, so it composes with a correlation that
+    // resolves later.
     Object.defineProperty(
       timings,
       'scriptStart',
-      timingFactory(() => isCorrelationStale() ? timings.registeredAt : (correlation?.script.start ?? timings.fetchEnd))
+      timingFactory(() => {
+        const ownStart = isCorrelationStale() ? timings.registeredAt : (correlation?.script.start ?? timings.fetchEnd)
+        return manifestScriptStart > 0 ? Math.min(ownStart, manifestScriptStart) : ownStart
+      })
     )
     Object.defineProperty(
       timings,
       'scriptEnd',
-      timingFactory(() => isCorrelationStale() ? timings.registeredAt : (correlation?.script.end ?? timings.registeredAt))
+      timingFactory(() => {
+        const ownEnd = isCorrelationStale() ? timings.registeredAt : (correlation?.script.end ?? timings.registeredAt)
+        return manifestScriptEnd > 0 ? Math.max(ownEnd, manifestScriptEnd) : ownEnd
+      })
     )
   } catch (error) {
     // Don't let stack parsing errors break anything

package/src/common/v2/utils.js

@@ -4,6 +4,8 @@
  */
 
 import { extractUrlsFromStack, getDeepStackTrace } from './script-tracker'
+import { matchManifestAsset } from './manifest'
+import { cleanURL } from '../url/clean-url'
 import { V2_TYPES } from './constants'
 
 /**
@@ -47,6 +49,36 @@ export function getRegisteredTargetsFromId (id, agentRef) {
   return registeredEntities?.filter(entity => String(entity.metadata.target.id) === String(id)).map(entity => entity.metadata.target) || []
 }
 
+/**
+ * Returns the registered target(s) whose resource matches a given resource URL -- used to attribute `BrowserPerformance`
+ * (PerformanceResourceTiming) events, which never have a JS call stack to walk (they're fired for declarative
+ * `<script src>`/`<link>`/`<img>` tags, not JS execution), so stack-trace attribution (see {@link findTargetsFromStackTrace})
+ * doesn't apply. Unlike {@link getRegisteredTargetsFromFilename}, this matches manifest assets of ANY type (scripts,
+ * images, fonts, css, etc.) -- non-script assets can't produce a JS stack frame to match against, but they can and do
+ * produce their own resource timing entries. Returns an empty array if no target is found.
+ * @param {string} url - the resource's URL, as reported by the Performance API
+ * @param {*} agentRef
+ * @returns {import("../../interfaces/registered-entity").RegisterAPIMetadataTarget[]}
+ */
+export function getRegisteredTargetsFromResourceUrl (url, agentRef) {
+  if (!isValid(url, agentRef)) return []
+  const registeredEntities = agentRef.runtime.registeredEntities
+  const cleanedUrl = cleanURL(url)
+  const matches = registeredEntities?.filter(entity => {
+    const manifest = entity.metadata.target?.manifest
+    if (manifest) {
+      // A manifest was supplied -- it is the sole source of truth for attribution. The caller-script fallback
+      // below never applies here, so e.g. a registrar script that calls register() on behalf of many MFEs (each
+      // with its own manifest naming only that MFE's own files) never has ITS OWN activity attributed just because
+      // it happened to be the one that called register().
+      return matchManifestAsset(manifest, url, { scriptsOnly: false })
+    }
+    // No manifest -- fall back to matching the resolved URL of whatever script called register().
+    return !!entity.metadata.timings?.asset && cleanURL(entity.metadata.timings.asset) === cleanedUrl
+  })
+  return dedupeRegisteredEntitiesByAsset(matches).map(entity => entity.metadata.target)
+}
+
 /**
  * Returns the registered target(s) associated with a given filename if found in the resource timing API during registration. Returns an empty array if no target is found.
  * Multiple registrations that resolve to the same underlying script asset AND represent the same logical MFE (i.e.
@@ -63,7 +95,16 @@ export function getRegisteredTargetsFromId (id, agentRef) {
 export function getRegisteredTargetsFromFilename (filename, agentRef) {
   if (!isValid(filename, agentRef)) return []
   const registeredEntities = agentRef.runtime.registeredEntities
-  const matches = registeredEntities?.filter(entity => entity.metadata.timings?.asset?.endsWith(filename))
+  const matches = registeredEntities?.filter(entity => {
+    const manifest = entity.metadata.target?.manifest
+    if (manifest) {
+      // See the identical case in getRegisteredTargetsFromResourceUrl above: once a manifest exists, it is the
+      // sole source of truth for attribution -- the caller-script fallback below never applies.
+      return matchManifestAsset(manifest, filename, { scriptsOnly: true })
+    }
+    // No manifest -- fall back to matching the resolved URL of whatever script called register().
+    return !!entity.metadata.timings?.asset?.endsWith(filename)
+  })
   return dedupeRegisteredEntitiesByAsset(matches).map(entity => entity.metadata.target)
 }
 

package/src/features/generic_events/aggregate/index.js

@@ -15,7 +15,8 @@ import { UserActionsAggregator } from './user-actions/user-actions-aggregator'
 import { isIFrameWindow } from '../../../common/dom/iframe'
 import { isPureObject } from '../../../common/util/type-check'
 import { EVENT_TYPES } from '../../../common/constants/events'
-import { getVersion2Attributes, getVersion2DuplicationAttributes, shouldDuplicate } from '../../../common/v2/utils'
+import { getVersion2Attributes, getVersion2DuplicationAttributes, shouldDuplicate, getRegisteredTargetsFromResourceUrl } from '../../../common/v2/utils'
+import { findCorrelation } from '../../../common/v2/script-tracker'
 
 export class Aggregate extends AggregateBase {
   static featureName = FEATURE_NAME
@@ -229,7 +230,26 @@ export class Aggregate extends AggregateBase {
               firstParty
             }
 
-            this.addEvent(event)
+            const targets = getRegisteredTargetsFromResourceUrl(name, this.agentRef)
+            if (targets.length) {
+              targets.forEach(target => this.addEvent({ ...event }, target))
+              return
+            }
+
+            this.addEvent({ ...event }, undefined)
+
+            // This resource entry can resolve before a self-registering script has actually executed and called
+            // register() on itself (responseEnd fires before script parse/execution). If this URL belongs to a
+            // <script> we're tracking that hasn't finished loading yet, retry resolution once it has -- reporting
+            // a second (deliberately duplicate) copy under the real target if one shows up by then. One-shot,
+            // self-cleans via `once: true`, so there's nothing to leak if the script never registers.
+            const correlation = findCorrelation(cleanURL(name))
+            if (correlation?.dom.value && !correlation.dom.end) {
+              const retryAttribution = () => {
+                getRegisteredTargetsFromResourceUrl(name, this.agentRef).forEach(target => this.addEvent({ ...event }, target))
+              }
+              ;['load', 'error'].forEach(evtType => correlation.dom.value.addEventListener(evtType, retryAttribution, { once: true }))
+            }
           } catch (err) {
             this.ee.emit('internal-error', [err, 'GenericEvents-Resource'])
           }

package/src/loaders/api/register-api-types.js

@@ -17,6 +17,10 @@
  * @property {RegisterAPIMetadata} metadata - The metadata object containing the custom attributes and target information for the registered entity.
  */
 
+/**
+ * @typedef {import('../../common/v2/manifest').AssetFile} AssetFile
+ */
+
 /**
  * @typedef {Object} RegisterAPIConstructor
  * @property {string} id - The unique id for the registered entity. This will be assigned to any synthesized entities.
@@ -24,6 +28,8 @@
  * @property {{[key: string]: any}} [tags] - The tags for the registered entity as key-value pairs. This will be assigned to any synthesized entities. Tags are converted to source.* attributes (e.g., {environment: 'production'} becomes source.environment: 'production').
  * @property {RegisterAPITarget} [parent] - The parent target for the registered entity. If none was supplied, it will assume the entity guid from the main agent.
  * @property {string} [parentId] - The parentId for the registered entity. If none was supplied, it will assume the entity guid from the main agent.
+ * @property {{assets?: Array<AssetFile>}} [manifest] - An optional manifest describing the MFE's known assets (scripts, stylesheets, images, fonts, etc.) as `AssetFile` entries, used to improve the accuracy of event attribution (errors, logs, ajax, websockets), attribute `BrowserPerformance` resource events (any asset type, not just scripts) and, depending on `timingMethod`, MicroFrontEndTiming values. Each `AssetFile`'s script-capability is inferred from a `.js` suffix on a string `matcher` (a RegExp `matcher` is never inferred as a script), unless overridden via `type: 'script'` or explicitly disabled via `type: 'asset'`. An `AssetFile` with an invalid `matcher` or an unrecognized `type` is discarded/ignored (with a console warning) rather than applied. If omitted, the agent falls back to its existing behavior of only evaluating the script that called `register()` (resource attribution still applies to that script).
+ * @property {'entry'|'scripts'|'all'} [timingMethod] - Controls which manifest assets are used to calculate MicroFrontEndTiming values: 'entry' (the default) leaves timing based entirely on the script that called `register()`, unaffected by the manifest; 'scripts' widens the timing window across all script assets; 'all' widens it across every asset.
  */
 
 /**
@@ -39,18 +45,22 @@
  * @property {string} name - The name returned for the registered entity.
  * @property {{[key: string]: any}} [tags] - The tags for the registered entity as key-value pairs.
  * @property {string} [parentId] - The parentId for the registered entity. If none was supplied, it will assume the entity guid from the main agent.
+ * @property {import('../../common/v2/manifest').ParsedManifest} [manifest] - The parsed manifest for the registered entity, if one was supplied.
+ * @property {'entry'|'scripts'|'all'} [timingMethod] - The timing method supplied for the registered entity, if any.
  */
 
 /**
  * @typedef {Object} RegisterAPITimings
  * @property {number} registeredAt - The timestamp when the registered entity was created.
  * @property {number} [reportedAt] - The timestamp when the registered entity was deregistered.
- * @property {number} fetchStart - The timestamp when the registered entity began fetching (performance.start).
- * @property {number} fetchEnd - The timestamp when the registered entity finished fetching (performance.end).
- * @property {number} scriptStart - The timestamp when script initialization began (max of dom.start or performance.end, or performance.end if no dom.start).
- * @property {number} scriptEnd - The timestamp when script loading completed (dom.end or registeredAt if no dom.end).
+ * @property {number} fetchStart - The timestamp when the registered entity began fetching (performance.start). When a manifest with timingMethod 'scripts'|'all' is supplied, this widens to the earliest fetchStart across all matched manifest assets.
+ * @property {number} fetchEnd - The timestamp when the registered entity finished fetching (performance.end). When a manifest with timingMethod 'scripts'|'all' is supplied, this widens to the latest fetchEnd across all matched manifest assets.
+ * @property {number} scriptStart - The timestamp when script initialization began (max of dom.start or performance.end, or performance.end if no dom.start). When a manifest with timingMethod 'scripts'|'all' is supplied, this widens to the earliest scriptStart across all matched manifest script assets (non-script assets are excluded).
+ * @property {number} scriptEnd - The timestamp when script loading completed (dom.end or registeredAt if no dom.end). When a manifest with timingMethod 'scripts'|'all' is supplied, this widens to the latest scriptEnd across all matched manifest script assets (non-script assets are excluded).
  * @property {Object} [asset] - The asset path (if found) for the registered entity.
  * @property {string} type - The type of timing associated with the registered entity, 'script' or 'link' if found with the performance resource API, 'fetch' for dynamic imports, 'inline' if found to be associated with the root document URL, or 'unknown' if no associated resource could be found.
+ * @property {number} totalWeight - The sum of `transferSize` (bytes) across every asset detected for the registered entity -- the entry script, plus, when a manifest is supplied, every matched manifest asset (script or non-script). Unlike fetchStart/fetchEnd/scriptStart/scriptEnd above, this is never gated behind `timingMethod` -- manifest assets contribute their bytes even at the 'entry' default/unset. Cross-origin assets without a Timing-Allow-Origin header report 0 bytes per the Resource Timing spec.
+ * @property {boolean} [renderBlocking] - True if any detected asset (entry script or matched manifest asset) has a `renderBlockingStatus` of 'blocking'; false if none were 'blocking' but at least one reported 'non-blocking'; left `undefined` if no detected asset reported the attribute at all (e.g. unsupported browser). A single 'blocking' asset always wins over any number of 'non-blocking' ones, regardless of resolution order.
  */
 
 /**