@newrelic/browser-agent 1.321.0-rc.8 → 1.321.0-rc.9

package/dist/cjs/common/constants/env.cdn.js

@@ -17,7 +17,7 @@ exports.VERSION = exports.RRWEB_VERSION = exports.RRWEB_PACKAGE_NAME = exports.D
 /**
  * Exposes the version of the agent
  */
-const VERSION = exports.VERSION = "1.321.0-rc.8";
+const VERSION = exports.VERSION = "1.321.0-rc.9";
 
 /**
  * Exposes the build type of the agent

package/dist/cjs/common/constants/env.npm.js

@@ -17,7 +17,7 @@ exports.VERSION = exports.RRWEB_VERSION = exports.RRWEB_PACKAGE_NAME = exports.D
 /**
  * Exposes the version of the agent
  */
-const VERSION = exports.VERSION = "1.321.0-rc.8";
+const VERSION = exports.VERSION = "1.321.0-rc.9";
 
 /**
  * Exposes the build type of the agent

package/dist/cjs/common/util/console.js

@@ -100,6 +100,7 @@ var _globalEvent = require("../dispatch/global-event");
  * | 77 | Agent rejected post message, could not validate origin. |
  * | 78 | RegisteredIframeEntity could not determine parent origin and will not register, to avoid trusting messages from any origin. |
  * | 79 | Unable to initialize Connector and/or Harvester. |
+ * | 80 | An invalid manifest option was provided to register() and will be ignored. |
  * | 81 | Entities were detected that share a name with different IDs - This can cause multiple entities to have the same name in New Relic. |
  * | 82 | Entities were detected that share an ID with different names - This can cause your entity's name to change unexpectedly. |
  *

package/dist/cjs/common/v2/manifest.js

@@ -0,0 +1,142 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.matchManifestAsset = matchManifestAsset;
+exports.parseManifest = parseManifest;
+var _cleanUrl = require("../url/clean-url");
+var _console = require("../util/console");
+var _invoke = require("../util/invoke");
+/**
+ * Copyright 2020-2026 New Relic, Inc. All rights reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+/**
+ * @typedef {Object} AssetFile
+ * @property {string|RegExp} matcher - the path/path-fragment string, or RegExp, used to match a resolved URL against this asset
+ * @property {'script'|'asset'} [type] - optional override for script-capability inference. When omitted, script-capability is inferred from a
+ * `.js` suffix on a string `matcher` (a RegExp `matcher` is never inferred as a script). Supply `type: 'script'` to explicitly flag an entry
+ * as a script regardless of its matcher shape/suffix (e.g. an extensionless URL, or a RegExp targeting a script path), or `type: 'asset'` to
+ * explicitly flag it as non-script. Any other value is invalid, logs a warning, and is ignored (falls back to inference).
+ */
+
+/** Warns at most once per page for any invalid manifest entry (bad `matcher` or bad `type`) -- mirrors the
+ * existing `invalidTimingMethod` single()-wrapped warning pattern in register.js. */
+const warnInvalidManifestEntry = (0, _invoke.single)(secondary => (0, _console.warn)(80, secondary));
+
+/**
+ * @typedef {Object} ParsedManifestAsset
+ * @property {string|RegExp} pattern - the original matcher supplied by the customer
+ * @property {(url: string) => boolean} test - precompiled matcher against a resolved URL
+ * @property {boolean} isScript
+ */
+
+/**
+ * @typedef {Object} ParsedManifest
+ * @property {ParsedManifestAsset[]} assets - all supplied assets
+ * @property {ParsedManifestAsset[]} scripts - the subset of assets inferred/declared as scripts (`.js`)
+ */
+
+/**
+ * Parses a raw manifest supplied to `register()` into precompiled matcher closures. Parsing happens once, at
+ * registration time, so downstream event attribution (which runs on every ajax/error/log/websocket event) never has
+ * to re-derive matching logic from the raw customer input.
+ * @param {{assets?: Array<AssetFile>}} [rawManifest]
+ * @returns {ParsedManifest|undefined} undefined if no usable assets were supplied, so callers can cheaply skip all manifest logic
+ */
+function parseManifest(rawManifest) {
+  if (!Array.isArray(rawManifest?.assets) || !rawManifest.assets.length) return undefined;
+  const assets = rawManifest.assets.map(parseAsset).filter(Boolean);
+  if (!assets.length) return undefined;
+  return {
+    assets,
+    scripts: assets.filter(asset => asset.isScript)
+  };
+}
+
+/**
+ * @param {AssetFile} entry
+ * @returns {ParsedManifestAsset|undefined}
+ */
+function parseAsset(entry) {
+  if (!entry || typeof entry !== 'object') return undefined;
+  const {
+    matcher,
+    type
+  } = entry;
+  const inferredIsScript = typeof matcher === 'string' && isScriptPath(matcher);
+  let isScript = inferredIsScript;
+  if (type !== undefined) {
+    if (isValidType(type)) {
+      isScript = isScriptType(type);
+    } else {
+      // Invalid `type` never overrides -- fall back to inference-only behavior rather than forcing `isScript: false`,
+      // so a typo'd `type` can't silently break stack-trace attribution for an otherwise-valid `.js` matcher.
+      warnInvalidManifestEntry(type);
+    }
+  }
+  if (isRegExp(matcher)) {
+    // Reset lastIndex before every test -- a `g`/`y` flagged matcher otherwise carries state across calls
+    // (this closure is reused for every event), causing intermittent, input-order-dependent match failures.
+    return {
+      pattern: matcher,
+      test: url => {
+        matcher.lastIndex = 0;
+        return matcher.test((0, _cleanUrl.cleanURL)(url));
+      },
+      isScript
+    };
+  }
+  if (typeof matcher === 'string' && matcher.length > 0) {
+    return {
+      pattern: matcher,
+      test: url => (0, _cleanUrl.cleanURL)(url).includes(matcher),
+      isScript
+    };
+  }
+
+  // Every other matcher shape (missing, empty string, null, number, plain object, ...) is invalid -- notably an
+  // empty string must be rejected here rather than falling through to the string branch above, since
+  // ''.includes('') is always true and would otherwise silently match every URL.
+  warnInvalidManifestEntry(matcher);
+  return undefined;
+}
+function isScriptPath(path) {
+  return path.endsWith('.js');
+}
+function isValidType(type) {
+  return type === 'script' || type === 'asset';
+}
+
+/**
+ * Cross-realm-safe check for whether a value is a RegExp. `instanceof RegExp` only returns true when the value's
+ * prototype chain links to THIS realm's `RegExp.prototype` -- a regex literal constructed in a different realm
+ * (an iframe, a Worker via structured clone, a WebDriver sandbox such as Firefox's geckodriver executeScript
+ * context) is still a genuine RegExp, just not an instance of this realm's constructor, and would otherwise be
+ * silently dropped by parseAsset below.
+ * @param {*} value
+ * @returns {boolean}
+ */
+function isRegExp(value) {
+  return Object.prototype.toString.call(value) === '[object RegExp]';
+}
+function isScriptType(type) {
+  return type === 'script';
+}
+
+/**
+ * Determines whether a resolved URL matches any asset in a parsed manifest.
+ * @param {ParsedManifest|undefined} parsed
+ * @param {string} url
+ * @param {{scriptsOnly?: boolean}} [options]
+ * @returns {boolean}
+ */
+function matchManifestAsset(parsed, url, {
+  scriptsOnly = false
+} = {}) {
+  if (!parsed || !url) return false;
+  const candidates = scriptsOnly ? parsed.scripts : parsed.assets;
+  return candidates.some(asset => asset.test(url));
+}

package/dist/cjs/common/v2/script-tracker-types.js

@@ -0,0 +1,27 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.default = void 0;
+/**
+ * Copyright 2020-2026 New Relic, Inc. All rights reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+/**
+ * @typedef {(start: number, end: number) => void} RecordManifestScriptWindowFn - Widens the live scriptStart/
+ * scriptEnd window with one manifest script asset's DOM correlation timing. `start`/`end` are that asset's
+ * `correlation.script.start`/`.end`, or falsy if not yet resolved. See `findScriptTimings`, which registers the
+ * concrete implementation, for the exact widening semantics (never shrinks either bound).
+ */
+/**
+ * @typedef {Object} TimingsInternals
+ * @property {Set<string>} weighedAssetUrls - Always present (seeded by `getOrCreateInternals`, see
+ * `script-tracker.js`). Cleaned URLs already folded into `timings.totalWeight`/`timings.renderBlocking` by
+ * `applyResourceWeight`, so the same underlying resource (e.g. a manifest asset that's also the .register calling
+ * script itself) is never counted twice.
+ * @property {RecordManifestScriptWindowFn} recordManifestScriptWindow - Always present (seeded by
+ * `getOrCreateInternals`, see `script-tracker.js`). `findScriptTimings` overrides the seeded default with one that
+ * folds into the live `scriptStart`/`scriptEnd` getters instead.
+ */
+var _default = exports.default = {};

package/dist/cjs/common/v2/script-tracker.js

@@ -3,7 +3,9 @@
 Object.defineProperty(exports, "__esModule", {
   value: true
 });
+exports.applyManifestTimings = applyManifestTimings;
 exports.extractUrlsFromStack = extractUrlsFromStack;
+exports.findCorrelation = findCorrelation;
 exports.findScriptTimings = findScriptTimings;
 exports.getDeepStackTrace = getDeepStackTrace;
 exports.thisFile = exports.scriptCorrelations = void 0;
@@ -20,8 +22,10 @@ var _timingFactory = require("./timing-factory");
  */
 
 /**
- * @typedef {import('./register-api-types').RegisterAPITimings} RegisterAPITimings
+ * @typedef {import('../../loaders/api/register-api-types').RegisterAPITimings} RegisterAPITimings
  * @typedef {import('../../loaders/api/register-api-types').RegisterAPITarget} RegisterAPITarget
+ * @typedef {import('./script-tracker-types').RecordManifestScriptWindowFn} RecordManifestScriptWindowFn
+ * @typedef {import('./script-tracker-types').TimingsInternals} TimingsInternals
  */
 
 /** export for testing purposes */
@@ -41,7 +45,39 @@ const scriptCorrelations = exports.scriptCorrelations = new Map();
 let poSubscribers = [];
 
 /**
- * Retrieves a script correlation by URL using exact matching
+ * Bookkeeping keyed by a `timings` object, kept off the object itself since it's exposed directly to customers via
+ * `register().metadata.timings`.
+ * @type {WeakMap<RegisterAPITimings, TimingsInternals>}
+ */
+const timingsInternals = new WeakMap();
+
+/**
+ * Gets (or lazily creates) the bookkeeping record for a `timings` object. A fresh record's `recordManifestScriptWindow`
+ * defaults to widening `timings.scriptStart`/`scriptEnd` directly -- correct for a plain `timings` object never
+ * produced by `findScriptTimings`. `findScriptTimings` overrides that default with one that folds into its live
+ * getters instead.
+ * @param {RegisterAPITimings} timings
+ * @returns {TimingsInternals}
+ */
+function getOrCreateInternals(timings) {
+  let internals = timingsInternals.get(timings);
+  if (!internals) {
+    internals = {
+      weighedAssetUrls: new Set(),
+      recordManifestScriptWindow: (start, end) => {
+        if (start) timings.scriptStart = timings.scriptStart > 0 ? Math.min(timings.scriptStart, start) : start;
+        if (end) timings.scriptEnd = timings.scriptEnd > 0 ? Math.max(timings.scriptEnd, end) : end;
+      }
+    };
+    timingsInternals.set(timings, internals);
+  }
+  return internals;
+}
+
+/**
+ * Retrieves a script correlation by URL using exact matching. Exported so other features (e.g. generic_events'
+ * resource attribution) can key off the same DOM node/load-timing tracking this module already does for every
+ * `<script>` element, rather than setting up a second, redundant observer.
  * @param {string} targetUrl - The URL to find
  * @returns {ScriptCorrelation | undefined} - The correlation object if found
  */
@@ -94,20 +130,23 @@ if (_runtime.globalScope.MutationObserver && _runtime.globalScope.document) {
   });
 }
 if (_runtime.globalScope.PerformanceObserver?.supportedEntryTypes.includes('resource')) {
-  /** We must track the script assets this way, because the performance buffer can fill up and when it does that
-   * it stops accepting new entries (instead of dropping old entries), which means if the register API is called
-   * after the buffer fills up we won't be able to get the script timing information from the resource timing API
-  */
+  // Tracked via an observer (not a later buffer read) because the performance buffer stops accepting new entries
+  // once full, instead of dropping old ones -- a late register() call could otherwise miss timing entirely.
   const scriptObserver = new PerformanceObserver(list => {
-    list.getEntries().filter(validEntryCriteria).forEach(entry => {
-      // Update correlation with performance data (creates entry if needed)
-      const entryUrl = (0, _cleanUrl.cleanURL)(entry.name);
-      const correlation = getOrCreateCorrelation(entryUrl);
-      correlation.performance.start = Math.floor(entry.startTime);
-      correlation.performance.end = Math.floor(entry.responseEnd);
-      correlation.performance.value = entry;
-
-      // Clear resolved or expired subscribers
+    list.getEntries().forEach(entry => {
+      // Correlation bookkeeping only makes sense for script-like entries -- gated on validEntryCriteria so
+      // scriptCorrelations doesn't grow for every image/css/font load on the page.
+      if (validEntryCriteria(entry)) {
+        const entryUrl = (0, _cleanUrl.cleanURL)(entry.name);
+        const correlation = getOrCreateCorrelation(entryUrl);
+        correlation.performance.start = Math.floor(entry.startTime);
+        correlation.performance.end = Math.floor(entry.responseEnd);
+        correlation.performance.value = entry;
+      }
+
+      // Late-resolution subscribers can be for any asset type (not just scripts), so every entry is checked here,
+      // unfiltered. Skipped when nothing is pending, the common case.
+      if (!poSubscribers.length) return;
       const canClear = [];
       poSubscribers.forEach(({
         test,
@@ -206,6 +245,33 @@ function applyPerformanceEntry(timings, entry) {
   timings.fetchEnd = Math.floor(entry.responseEnd);
   timings.asset = entry.name;
   timings.type = entry.initiatorType;
+  applyResourceWeight(timings, entry);
+}
+
+/**
+ * Accumulates the byte weight and render-blocking status of a single detected asset (the entry script or a resolved
+ * manifest asset) into a timings object. Shared by both the entry-script path (`applyPerformanceEntry`) and the
+ * manifest path (`applyManifestEntry`) so `totalWeight`/`renderBlocking` reflect every asset actually detected,
+ * regardless of which path found it.
+ * @param {RegisterAPITimings} timings
+ * @param {PerformanceResourceTiming} entry
+ */
+function applyResourceWeight(timings, entry) {
+  // De-dupe by cleaned URL: a manifest can list the .register calling script itself as one of its own assets,
+  // which would otherwise weigh the same resource twice (once via findScriptTimings, once via applyManifestTimings).
+  const url = (0, _cleanUrl.cleanURL)(entry.name);
+  const {
+    weighedAssetUrls
+  } = getOrCreateInternals(timings);
+  if (weighedAssetUrls.has(url)) return;
+  weighedAssetUrls.add(url);
+
+  // transferSize is 0 for cross-origin responses without Timing-Allow-Origin (a privacy restriction, not a
+  // zero-byte asset) -- adding 0 is correct either way.
+  timings.totalWeight = (timings.totalWeight || 0) + (entry.transferSize || 0);
+  // 'blocking' always wins and never gets downgraded; 'non-blocking' only applies if nothing already resolved
+  // true; no value at all (unsupported browser) leaves renderBlocking untouched (stays `undefined`).
+  if (entry.renderBlockingStatus === 'blocking') timings.renderBlocking = true;else if (entry.renderBlockingStatus === 'non-blocking' && timings.renderBlocking !== true) timings.renderBlocking = false;
 }
 
 /**
@@ -228,8 +294,114 @@ function subscribeToLatePerformanceEntry(timings, mfeScriptUrl) {
 }
 
 /**
- * Uses the stack of the initiator function, returns script timing information if a script can be found with the resource timing API matching the URL found in the stack.
- * @param {RegisterAPITarget} [target] - The MFE target being registered. Its id is used to scope stale-correlation detection per-MFE rather than per-script-URL, so one script registering multiple distinct MFEs doesn't misclassify a later MFE's registration as a stale reuse of an earlier one's.
+ * Applies one manifest asset's performance entry to a timings object: weight/renderBlocking always accumulate;
+ * fetchStart/fetchEnd and scriptStart/scriptEnd widen (never shrink) only when `timingMethod` calls for it; asset/
+ * type get anchored to the first script asset seen to resolve.
+ * @param {RegisterAPITimings} timings
+ * @param {PerformanceResourceTiming} entry
+ * @param {import('./manifest').ParsedManifestAsset} asset - the manifest asset this entry resolved
+ * @param {{ resolved: boolean }} entryState - shared "first script asset wins" guard for a single `applyManifestTimings` call
+ * @param {'entry'|'scripts'|'all'} [timingMethod] - the registered MFE's timing method; `undefined`/'entry' means weight/render-blocking still accumulate, but no timing widening happens at all
+ */
+function applyManifestEntry(timings, entry, asset, entryState, timingMethod) {
+  // Weight isn't a timing concern, so it accumulates for every matched asset regardless of timingMethod.
+  applyResourceWeight(timings, entry);
+  if (timingMethod !== 'scripts' && timingMethod !== 'all') return; // no timing-widening effect at the 'entry' default/unset
+
+  const widensAllAssets = timingMethod === 'all';
+  // Under 'scripts', only script assets widen the fetch window; under 'all', every matched asset does.
+  if (widensAllAssets || asset.isScript) {
+    const start = Math.floor(entry.startTime);
+    const end = Math.floor(entry.responseEnd);
+    // fetchStart/fetchEnd default to 0 ("not yet found") -- only fold into the min/max once they're positive,
+    // or 0 would permanently win Math.min.
+    timings.fetchStart = timings.fetchStart > 0 ? Math.min(timings.fetchStart, start) : start;
+    timings.fetchEnd = timings.fetchEnd > 0 ? Math.max(timings.fetchEnd, end) : end;
+  }
+
+  // Non-script assets never execute, so only script assets widen the execution window or anchor asset/type.
+  if (asset.isScript) {
+    const correlation = findCorrelation((0, _cleanUrl.cleanURL)(entry.name));
+    if (correlation) {
+      // Widens the aggregate scriptStart/scriptEnd window with this asset's current correlation timing. Re-called
+      // as a 'load'/'error' listener below if its DOM completion hasn't fired yet, so a later, larger end still counts.
+      const widenScriptWindowForAsset = () => {
+        const {
+          start: scriptStart,
+          end: scriptEnd
+        } = correlation.script;
+        getOrCreateInternals(timings).recordManifestScriptWindow(scriptStart, scriptEnd);
+      };
+      widenScriptWindowForAsset();
+      if (!correlation.dom.end && correlation.dom.value) {
+        ;
+        ['load', 'error'].forEach(eventType => correlation.dom.value.addEventListener(eventType, widenScriptWindowForAsset, {
+          once: true
+        }));
+      }
+    }
+    if (!entryState.resolved) {
+      timings.asset = entry.name;
+      timings.type = entry.initiatorType;
+      entryState.resolved = true;
+    }
+  }
+}
+
+/**
+ * Subscribes to late resource timing emissions for manifest assets not yet resolved against the buffered entries.
+ * Reuses the shared page-wide scriptObserver/poSubscribers mechanism (one PerformanceObserver for all MFEs, not
+ * one per MFE) and, unlike that observer's own correlation bookkeeping, checks every resource entry -- not just
+ * script-like ones -- so lazy-loaded images/fonts/stylesheets resolve too.
+ * @param {RegisterAPITimings} timings
+ * @param {Set<import('./manifest').ParsedManifestAsset>} pending - manifest assets still unresolved
+ * @param {{ resolved: boolean }} entryState - shared "first script asset wins" guard for a single `applyManifestTimings` call
+ * @param {'entry'|'scripts'|'all'} [timingMethod] - forwarded to `applyManifestEntry` for each late-resolving asset
+ */
+function subscribeToLateManifestEntries(timings, pending, entryState, timingMethod) {
+  if (!_runtime.globalScope.PerformanceObserver?.supportedEntryTypes?.includes('resource')) return;
+  poSubscribers.push({
+    addedAt: (0, _now.now)(),
+    test: entry => {
+      const matched = [...pending].find(asset => asset.test(entry.name));
+      if (matched) {
+        applyManifestEntry(timings, entry, matched, entryState, timingMethod);
+        pending.delete(matched);
+      }
+      return pending.size === 0;
+    }
+  });
+}
+
+/**
+ * Applies a registered MFE's manifest to a timings object (already populated by `findScriptTimings`). No-op if no
+ * manifest is present. Weight/renderBlocking always accumulate from every detected manifest asset; timing widening
+ * (fetchStart/fetchEnd/scriptStart/scriptEnd/asset anchor) is opt-in via `timingMethod` -- see `applyManifestEntry`.
+ * @param {RegisterAPITimings} timings - the timings object to widen in place
+ * @param {RegisterAPITarget} target - the registered MFE target, which may carry a parsed `manifest`
+ */
+function applyManifestTimings(timings, target) {
+  const parsedManifest = target?.manifest;
+  if (!parsedManifest || !parsedManifest.assets.length) return;
+  const entryState = {
+    resolved: false
+  };
+  const pending = new Set(parsedManifest.assets);
+  const resourceEntries = _runtime.globalScope.performance?.getEntriesByType('resource') || [];
+  resourceEntries.forEach(entry => {
+    const matched = [...pending].find(asset => asset.test(entry.name));
+    if (matched) {
+      applyManifestEntry(timings, entry, matched, entryState, target.timingMethod);
+      pending.delete(matched);
+    }
+  });
+  if (pending.size) subscribeToLateManifestEntries(timings, pending, entryState, target.timingMethod);
+}
+
+/**
+ * Uses the initiator function's stack to find script timing information via the resource timing API.
+ * @param {RegisterAPITarget} [target] - the MFE target being registered; its id scopes stale-correlation
+ * detection per-MFE rather than per-script-URL (see isCorrelationStale below)
  * @returns {RegisterAPITimings} Object containing script fetch start and end times, and the asset URL if found
  */
 function findScriptTimings(target) {
@@ -242,7 +414,9 @@ function findScriptTimings(target) {
     scriptStart: 0,
     scriptEnd: 0,
     asset: undefined,
-    type: 'unknown'
+    type: 'unknown',
+    totalWeight: 0,
+    renderBlocking: undefined
   };
   const stack = getDeepStackTrace();
   if (!stack) return timings;
@@ -279,9 +453,8 @@ function findScriptTimings(target) {
     }
 
     // A correlation can be reused across multiple `register()` calls for the same script URL (e.g. an SPA
-    // remounting the same MFE without the script actually reloading). When that happens, its dom/performance
-    // timings still describe the *original* load, not this one. Detect that case so scriptStart/scriptEnd
-    // below can ignore the stale data instead of reporting it as if it were fresh.
+    // remounting the same MFE without the script reloading) -- its dom/performance timings would then describe
+    // the *original* load. Detect that so scriptStart/scriptEnd below can ignore the stale data.
     const correlation = timings.correlation;
     const alreadyClaimedByThisMFE = !!mfeId && !!correlation?.claimedBy.has(mfeId);
     if (correlation && mfeId) correlation.claimedBy.add(mfeId);
@@ -292,10 +465,35 @@ function findScriptTimings(target) {
       return staleness > _scriptTrackerConstants.CORRELATION_STALE_THRESHOLD_MS;
     };
 
-    // Use getters here because the correlation data may arrive after this function returns the timing object, and we want to provide the most up-to-date timing information possible when the getters are accessed at harvest time.
-    // Non-stale: fall back to fetchEnd if correlation data isn't available yet (our best approximation for script execution start). Stale: fall back straight to registeredAt — fetchEnd would be derived from the same stale correlation, so it can't be trusted either.
-    Object.defineProperty(timings, 'scriptStart', (0, _timingFactory.timingFactory)(() => isCorrelationStale() ? timings.registeredAt : correlation?.script.start ?? timings.fetchEnd));
-    Object.defineProperty(timings, 'scriptEnd', (0, _timingFactory.timingFactory)(() => isCorrelationStale() ? timings.registeredAt : correlation?.script.end ?? timings.registeredAt));
+    // Only reached for a real (non-inline), stack-attributable script -- scriptStart/scriptEnd become live getters
+    // below, so manifest widening needs a hook that composes with them instead of overriding them (see
+    // recordManifestScriptWindow's doc comment). Every other path keeps getOrCreateInternals' plain-value-widening
+    // default, which is already correct there.
+    let manifestScriptStart = 0;
+    let manifestScriptEnd = 0;
+    /**
+     * Widens the running manifestScriptStart/manifestScriptEnd accumulators with one asset's correlation timing.
+     * Never shrinks either bound; a falsy (unresolved) start/end is ignored.
+     * @type {RecordManifestScriptWindowFn}
+     */
+    getOrCreateInternals(timings).recordManifestScriptWindow = (start, end) => {
+      if (start) manifestScriptStart = manifestScriptStart > 0 ? Math.min(manifestScriptStart, start) : start;
+      if (end) manifestScriptEnd = manifestScriptEnd > 0 ? Math.max(manifestScriptEnd, end) : end;
+    };
+
+    // Getters, since correlation data may still arrive after this function returns -- we want the freshest value
+    // at harvest time. Non-stale: fall back to fetchEnd (best approximation) if correlation isn't available yet.
+    // Stale: fall back to registeredAt, since fetchEnd would derive from the same stale correlation. Manifest
+    // widening is re-read on every access rather than baked in once, so it composes with a correlation that
+    // resolves later.
+    Object.defineProperty(timings, 'scriptStart', (0, _timingFactory.timingFactory)(() => {
+      const ownStart = isCorrelationStale() ? timings.registeredAt : correlation?.script.start ?? timings.fetchEnd;
+      return manifestScriptStart > 0 ? Math.min(ownStart, manifestScriptStart) : ownStart;
+    }));
+    Object.defineProperty(timings, 'scriptEnd', (0, _timingFactory.timingFactory)(() => {
+      const ownEnd = isCorrelationStale() ? timings.registeredAt : correlation?.script.end ?? timings.registeredAt;
+      return manifestScriptEnd > 0 ? Math.max(ownEnd, manifestScriptEnd) : ownEnd;
+    }));
   } catch (error) {
     // Don't let stack parsing errors break anything
   }

package/dist/cjs/common/v2/utils.js

@@ -9,11 +9,14 @@ exports.findTargetsFromStackTrace = findTargetsFromStackTrace;
 exports.getRegisteredEntityByIframeInterfaceId = getRegisteredEntityByIframeInterfaceId;
 exports.getRegisteredTargetsFromFilename = getRegisteredTargetsFromFilename;
 exports.getRegisteredTargetsFromId = getRegisteredTargetsFromId;
+exports.getRegisteredTargetsFromResourceUrl = getRegisteredTargetsFromResourceUrl;
 exports.getVersion2Attributes = getVersion2Attributes;
 exports.getVersion2DuplicationAttributes = getVersion2DuplicationAttributes;
 exports.isMfeTarget = isMfeTarget;
 exports.shouldDuplicate = shouldDuplicate;
 var _scriptTracker = require("./script-tracker");
+var _manifest = require("./manifest");
+var _cleanUrl = require("../url/clean-url");
 var _constants = require("./constants");
 /**
  * Copyright 2020-2026 New Relic, Inc. All rights reserved.
@@ -61,6 +64,38 @@ function getRegisteredTargetsFromId(id, agentRef) {
   return registeredEntities?.filter(entity => String(entity.metadata.target.id) === String(id)).map(entity => entity.metadata.target) || [];
 }
 
+/**
+ * Returns the registered target(s) whose resource matches a given resource URL -- used to attribute `BrowserPerformance`
+ * (PerformanceResourceTiming) events, which never have a JS call stack to walk (they're fired for declarative
+ * `<script src>`/`<link>`/`<img>` tags, not JS execution), so stack-trace attribution (see {@link findTargetsFromStackTrace})
+ * doesn't apply. Unlike {@link getRegisteredTargetsFromFilename}, this matches manifest assets of ANY type (scripts,
+ * images, fonts, css, etc.) -- non-script assets can't produce a JS stack frame to match against, but they can and do
+ * produce their own resource timing entries. Returns an empty array if no target is found.
+ * @param {string} url - the resource's URL, as reported by the Performance API
+ * @param {*} agentRef
+ * @returns {import("../../interfaces/registered-entity").RegisterAPIMetadataTarget[]}
+ */
+function getRegisteredTargetsFromResourceUrl(url, agentRef) {
+  if (!isValid(url, agentRef)) return [];
+  const registeredEntities = agentRef.runtime.registeredEntities;
+  const cleanedUrl = (0, _cleanUrl.cleanURL)(url);
+  const matches = registeredEntities?.filter(entity => {
+    const manifest = entity.metadata.target?.manifest;
+    if (manifest) {
+      // A manifest was supplied -- it is the sole source of truth for attribution. The caller-script fallback
+      // below never applies here, so e.g. a registrar script that calls register() on behalf of many MFEs (each
+      // with its own manifest naming only that MFE's own files) never has ITS OWN activity attributed just because
+      // it happened to be the one that called register().
+      return (0, _manifest.matchManifestAsset)(manifest, url, {
+        scriptsOnly: false
+      });
+    }
+    // No manifest -- fall back to matching the resolved URL of whatever script called register().
+    return !!entity.metadata.timings?.asset && (0, _cleanUrl.cleanURL)(entity.metadata.timings.asset) === cleanedUrl;
+  });
+  return dedupeRegisteredEntitiesByAsset(matches).map(entity => entity.metadata.target);
+}
+
 /**
  * Returns the registered target(s) associated with a given filename if found in the resource timing API during registration. Returns an empty array if no target is found.
  * Multiple registrations that resolve to the same underlying script asset AND represent the same logical MFE (i.e.
@@ -77,7 +112,18 @@ function getRegisteredTargetsFromId(id, agentRef) {
 function getRegisteredTargetsFromFilename(filename, agentRef) {
   if (!isValid(filename, agentRef)) return [];
   const registeredEntities = agentRef.runtime.registeredEntities;
-  const matches = registeredEntities?.filter(entity => entity.metadata.timings?.asset?.endsWith(filename));
+  const matches = registeredEntities?.filter(entity => {
+    const manifest = entity.metadata.target?.manifest;
+    if (manifest) {
+      // See the identical case in getRegisteredTargetsFromResourceUrl above: once a manifest exists, it is the
+      // sole source of truth for attribution -- the caller-script fallback below never applies.
+      return (0, _manifest.matchManifestAsset)(manifest, filename, {
+        scriptsOnly: true
+      });
+    }
+    // No manifest -- fall back to matching the resolved URL of whatever script called register().
+    return !!entity.metadata.timings?.asset?.endsWith(filename);
+  });
   return dedupeRegisteredEntitiesByAsset(matches).map(entity => entity.metadata.target);
 }
 

package/dist/cjs/features/generic_events/aggregate/index.js

@@ -18,6 +18,7 @@ var _iframe = require("../../../common/dom/iframe");
 var _typeCheck = require("../../../common/util/type-check");
 var _events = require("../../../common/constants/events");
 var _utils = require("../../../common/v2/utils");
+var _scriptTracker = require("../../../common/v2/script-tracker");
 /**
  * Copyright 2020-2026 New Relic, Inc. All rights reserved.
  * SPDX-License-Identifier: Apache-2.0
@@ -239,7 +240,33 @@ class Aggregate extends _aggregateBase.AggregateBase {
               entryDuration: duration,
               firstParty
             };
-            this.addEvent(event);
+            const targets = (0, _utils.getRegisteredTargetsFromResourceUrl)(name, this.agentRef);
+            if (targets.length) {
+              targets.forEach(target => this.addEvent({
+                ...event
+              }, target));
+              return;
+            }
+            this.addEvent({
+              ...event
+            }, undefined);
+
+            // This resource entry can resolve before a self-registering script has actually executed and called
+            // register() on itself (responseEnd fires before script parse/execution). If this URL belongs to a
+            // <script> we're tracking that hasn't finished loading yet, retry resolution once it has -- reporting
+            // a second (deliberately duplicate) copy under the real target if one shows up by then. One-shot,
+            // self-cleans via `once: true`, so there's nothing to leak if the script never registers.
+            const correlation = (0, _scriptTracker.findCorrelation)((0, _cleanUrl.cleanURL)(name));
+            if (correlation?.dom.value && !correlation.dom.end) {
+              const retryAttribution = () => {
+                (0, _utils.getRegisteredTargetsFromResourceUrl)(name, this.agentRef).forEach(target => this.addEvent({
+                  ...event
+                }, target));
+              };
+              ['load', 'error'].forEach(evtType => correlation.dom.value.addEventListener(evtType, retryAttribution, {
+                once: true
+              }));
+            }
           } catch (err) {
             this.ee.emit('internal-error', [err, 'GenericEvents-Resource']);
           }