@newrelic/browser-agent 1.321.0 → 1.322.0-rc.0

package/dist/esm/common/v2/script-tracker.js

@@ -12,8 +12,10 @@ import { CORRELATION_STALE_THRESHOLD_MS } from './script-tracker-constants';
 import { timingFactory } from './timing-factory';
 
 /**
- * @typedef {import('./register-api-types').RegisterAPITimings} RegisterAPITimings
+ * @typedef {import('../../loaders/api/register-api-types').RegisterAPITimings} RegisterAPITimings
  * @typedef {import('../../loaders/api/register-api-types').RegisterAPITarget} RegisterAPITarget
+ * @typedef {import('./script-tracker-types').RecordManifestScriptWindowFn} RecordManifestScriptWindowFn
+ * @typedef {import('./script-tracker-types').TimingsInternals} TimingsInternals
  */
 
 /** export for testing purposes */
@@ -33,11 +35,43 @@ export const scriptCorrelations = new Map();
 let poSubscribers = [];
 
 /**
- * Retrieves a script correlation by URL using exact matching
+ * Bookkeeping keyed by a `timings` object, kept off the object itself since it's exposed directly to customers via
+ * `register().metadata.timings`.
+ * @type {WeakMap<RegisterAPITimings, TimingsInternals>}
+ */
+const timingsInternals = new WeakMap();
+
+/**
+ * Gets (or lazily creates) the bookkeeping record for a `timings` object. A fresh record's `recordManifestScriptWindow`
+ * defaults to widening `timings.scriptStart`/`scriptEnd` directly -- correct for a plain `timings` object never
+ * produced by `findScriptTimings`. `findScriptTimings` overrides that default with one that folds into its live
+ * getters instead.
+ * @param {RegisterAPITimings} timings
+ * @returns {TimingsInternals}
+ */
+function getOrCreateInternals(timings) {
+  let internals = timingsInternals.get(timings);
+  if (!internals) {
+    internals = {
+      weighedAssetUrls: new Set(),
+      recordManifestScriptWindow: (start, end) => {
+        if (start) timings.scriptStart = timings.scriptStart > 0 ? Math.min(timings.scriptStart, start) : start;
+        if (end) timings.scriptEnd = timings.scriptEnd > 0 ? Math.max(timings.scriptEnd, end) : end;
+      }
+    };
+    timingsInternals.set(timings, internals);
+  }
+  return internals;
+}
+
+/**
+ * Retrieves a script correlation by URL using exact matching. Exported so other features (e.g. generic_events'
+ * resource attribution) can key off the same DOM node/load-timing tracking this module already does for every
+ * `<script>` element, rather than setting up a second, redundant observer.
  * @param {string} targetUrl - The URL to find
  * @returns {ScriptCorrelation | undefined} - The correlation object if found
  */
-function findCorrelation(targetUrl) {
+export function findCorrelation(targetUrl) {
   return scriptCorrelations.get(targetUrl);
 }
 
@@ -86,20 +120,23 @@ if (globalScope.MutationObserver && globalScope.document) {
   });
 }
 if (globalScope.PerformanceObserver?.supportedEntryTypes.includes('resource')) {
-  /** We must track the script assets this way, because the performance buffer can fill up and when it does that
-   * it stops accepting new entries (instead of dropping old entries), which means if the register API is called
-   * after the buffer fills up we won't be able to get the script timing information from the resource timing API
-  */
+  // Tracked via an observer (not a later buffer read) because the performance buffer stops accepting new entries
+  // once full, instead of dropping old ones -- a late register() call could otherwise miss timing entirely.
   const scriptObserver = new PerformanceObserver(list => {
-    list.getEntries().filter(validEntryCriteria).forEach(entry => {
-      // Update correlation with performance data (creates entry if needed)
-      const entryUrl = cleanURL(entry.name);
-      const correlation = getOrCreateCorrelation(entryUrl);
-      correlation.performance.start = Math.floor(entry.startTime);
-      correlation.performance.end = Math.floor(entry.responseEnd);
-      correlation.performance.value = entry;
-
-      // Clear resolved or expired subscribers
+    list.getEntries().forEach(entry => {
+      // Correlation bookkeeping only makes sense for script-like entries -- gated on validEntryCriteria so
+      // scriptCorrelations doesn't grow for every image/css/font load on the page.
+      if (validEntryCriteria(entry)) {
+        const entryUrl = cleanURL(entry.name);
+        const correlation = getOrCreateCorrelation(entryUrl);
+        correlation.performance.start = Math.floor(entry.startTime);
+        correlation.performance.end = Math.floor(entry.responseEnd);
+        correlation.performance.value = entry;
+      }
+
+      // Late-resolution subscribers can be for any asset type (not just scripts), so every entry is checked here,
+      // unfiltered. Skipped when nothing is pending, the common case.
+      if (!poSubscribers.length) return;
       const canClear = [];
       poSubscribers.forEach(({
         test,
@@ -198,6 +235,33 @@ function applyPerformanceEntry(timings, entry) {
   timings.fetchEnd = Math.floor(entry.responseEnd);
   timings.asset = entry.name;
   timings.type = entry.initiatorType;
+  applyResourceWeight(timings, entry);
+}
+
+/**
+ * Accumulates the byte weight and render-blocking status of a single detected asset (the entry script or a resolved
+ * manifest asset) into a timings object. Shared by both the entry-script path (`applyPerformanceEntry`) and the
+ * manifest path (`applyManifestEntry`) so `totalWeight`/`renderBlocking` reflect every asset actually detected,
+ * regardless of which path found it.
+ * @param {RegisterAPITimings} timings
+ * @param {PerformanceResourceTiming} entry
+ */
+function applyResourceWeight(timings, entry) {
+  // De-dupe by cleaned URL: a manifest can list the .register calling script itself as one of its own assets,
+  // which would otherwise weigh the same resource twice (once via findScriptTimings, once via applyManifestTimings).
+  const url = cleanURL(entry.name);
+  const {
+    weighedAssetUrls
+  } = getOrCreateInternals(timings);
+  if (weighedAssetUrls.has(url)) return;
+  weighedAssetUrls.add(url);
+
+  // transferSize is 0 for cross-origin responses without Timing-Allow-Origin (a privacy restriction, not a
+  // zero-byte asset) -- adding 0 is correct either way.
+  timings.totalWeight = (timings.totalWeight || 0) + (entry.transferSize || 0);
+  // 'blocking' always wins and never gets downgraded; 'non-blocking' only applies if nothing already resolved
+  // true; no value at all (unsupported browser) leaves renderBlocking untouched (stays `undefined`).
+  if (entry.renderBlockingStatus === 'blocking') timings.renderBlocking = true;else if (entry.renderBlockingStatus === 'non-blocking' && timings.renderBlocking !== true) timings.renderBlocking = false;
 }
 
 /**
@@ -220,8 +284,114 @@ function subscribeToLatePerformanceEntry(timings, mfeScriptUrl) {
 }
 
 /**
- * Uses the stack of the initiator function, returns script timing information if a script can be found with the resource timing API matching the URL found in the stack.
- * @param {RegisterAPITarget} [target] - The MFE target being registered. Its id is used to scope stale-correlation detection per-MFE rather than per-script-URL, so one script registering multiple distinct MFEs doesn't misclassify a later MFE's registration as a stale reuse of an earlier one's.
+ * Applies one manifest asset's performance entry to a timings object: weight/renderBlocking always accumulate;
+ * fetchStart/fetchEnd and scriptStart/scriptEnd widen (never shrink) only when `timingMethod` calls for it; asset/
+ * type get anchored to the first script asset seen to resolve.
+ * @param {RegisterAPITimings} timings
+ * @param {PerformanceResourceTiming} entry
+ * @param {import('./manifest').ParsedManifestAsset} asset - the manifest asset this entry resolved
+ * @param {{ resolved: boolean }} entryState - shared "first script asset wins" guard for a single `applyManifestTimings` call
+ * @param {'entry'|'scripts'|'all'} [timingMethod] - the registered MFE's timing method; `undefined`/'entry' means weight/render-blocking still accumulate, but no timing widening happens at all
+ */
+function applyManifestEntry(timings, entry, asset, entryState, timingMethod) {
+  // Weight isn't a timing concern, so it accumulates for every matched asset regardless of timingMethod.
+  applyResourceWeight(timings, entry);
+  if (timingMethod !== 'scripts' && timingMethod !== 'all') return; // no timing-widening effect at the 'entry' default/unset
+
+  const widensAllAssets = timingMethod === 'all';
+  // Under 'scripts', only script assets widen the fetch window; under 'all', every matched asset does.
+  if (widensAllAssets || asset.isScript) {
+    const start = Math.floor(entry.startTime);
+    const end = Math.floor(entry.responseEnd);
+    // fetchStart/fetchEnd default to 0 ("not yet found") -- only fold into the min/max once they're positive,
+    // or 0 would permanently win Math.min.
+    timings.fetchStart = timings.fetchStart > 0 ? Math.min(timings.fetchStart, start) : start;
+    timings.fetchEnd = timings.fetchEnd > 0 ? Math.max(timings.fetchEnd, end) : end;
+  }
+
+  // Non-script assets never execute, so only script assets widen the execution window or anchor asset/type.
+  if (asset.isScript) {
+    const correlation = findCorrelation(cleanURL(entry.name));
+    if (correlation) {
+      // Widens the aggregate scriptStart/scriptEnd window with this asset's current correlation timing. Re-called
+      // as a 'load'/'error' listener below if its DOM completion hasn't fired yet, so a later, larger end still counts.
+      const widenScriptWindowForAsset = () => {
+        const {
+          start: scriptStart,
+          end: scriptEnd
+        } = correlation.script;
+        getOrCreateInternals(timings).recordManifestScriptWindow(scriptStart, scriptEnd);
+      };
+      widenScriptWindowForAsset();
+      if (!correlation.dom.end && correlation.dom.value) {
+        ;
+        ['load', 'error'].forEach(eventType => correlation.dom.value.addEventListener(eventType, widenScriptWindowForAsset, {
+          once: true
+        }));
+      }
+    }
+    if (!entryState.resolved) {
+      timings.asset = entry.name;
+      timings.type = entry.initiatorType;
+      entryState.resolved = true;
+    }
+  }
+}
+
+/**
+ * Subscribes to late resource timing emissions for manifest assets not yet resolved against the buffered entries.
+ * Reuses the shared page-wide scriptObserver/poSubscribers mechanism (one PerformanceObserver for all MFEs, not
+ * one per MFE) and, unlike that observer's own correlation bookkeeping, checks every resource entry -- not just
+ * script-like ones -- so lazy-loaded images/fonts/stylesheets resolve too.
+ * @param {RegisterAPITimings} timings
+ * @param {Set<import('./manifest').ParsedManifestAsset>} pending - manifest assets still unresolved
+ * @param {{ resolved: boolean }} entryState - shared "first script asset wins" guard for a single `applyManifestTimings` call
+ * @param {'entry'|'scripts'|'all'} [timingMethod] - forwarded to `applyManifestEntry` for each late-resolving asset
+ */
+function subscribeToLateManifestEntries(timings, pending, entryState, timingMethod) {
+  if (!globalScope.PerformanceObserver?.supportedEntryTypes?.includes('resource')) return;
+  poSubscribers.push({
+    addedAt: now(),
+    test: entry => {
+      const matched = [...pending].find(asset => asset.test(entry.name));
+      if (matched) {
+        applyManifestEntry(timings, entry, matched, entryState, timingMethod);
+        pending.delete(matched);
+      }
+      return pending.size === 0;
+    }
+  });
+}
+
+/**
+ * Applies a registered MFE's manifest to a timings object (already populated by `findScriptTimings`). No-op if no
+ * manifest is present. Weight/renderBlocking always accumulate from every detected manifest asset; timing widening
+ * (fetchStart/fetchEnd/scriptStart/scriptEnd/asset anchor) is opt-in via `timingMethod` -- see `applyManifestEntry`.
+ * @param {RegisterAPITimings} timings - the timings object to widen in place
+ * @param {RegisterAPITarget} target - the registered MFE target, which may carry a parsed `manifest`
+ */
+export function applyManifestTimings(timings, target) {
+  const parsedManifest = target?.manifest;
+  if (!parsedManifest || !parsedManifest.assets.length) return;
+  const entryState = {
+    resolved: false
+  };
+  const pending = new Set(parsedManifest.assets);
+  const resourceEntries = globalScope.performance?.getEntriesByType('resource') || [];
+  resourceEntries.forEach(entry => {
+    const matched = [...pending].find(asset => asset.test(entry.name));
+    if (matched) {
+      applyManifestEntry(timings, entry, matched, entryState, target.timingMethod);
+      pending.delete(matched);
+    }
+  });
+  if (pending.size) subscribeToLateManifestEntries(timings, pending, entryState, target.timingMethod);
+}
+
+/**
+ * Uses the initiator function's stack to find script timing information via the resource timing API.
+ * @param {RegisterAPITarget} [target] - the MFE target being registered; its id scopes stale-correlation
+ * detection per-MFE rather than per-script-URL (see isCorrelationStale below)
  * @returns {RegisterAPITimings} Object containing script fetch start and end times, and the asset URL if found
  */
 export function findScriptTimings(target) {
@@ -234,7 +404,9 @@ export function findScriptTimings(target) {
     scriptStart: 0,
     scriptEnd: 0,
     asset: undefined,
-    type: 'unknown'
+    type: 'unknown',
+    totalWeight: 0,
+    renderBlocking: undefined
   };
   const stack = getDeepStackTrace();
   if (!stack) return timings;
@@ -271,9 +443,8 @@ export function findScriptTimings(target) {
     }
 
     // A correlation can be reused across multiple `register()` calls for the same script URL (e.g. an SPA
-    // remounting the same MFE without the script actually reloading). When that happens, its dom/performance
-    // timings still describe the *original* load, not this one. Detect that case so scriptStart/scriptEnd
-    // below can ignore the stale data instead of reporting it as if it were fresh.
+    // remounting the same MFE without the script reloading) -- its dom/performance timings would then describe
+    // the *original* load. Detect that so scriptStart/scriptEnd below can ignore the stale data.
     const correlation = timings.correlation;
     const alreadyClaimedByThisMFE = !!mfeId && !!correlation?.claimedBy.has(mfeId);
     if (correlation && mfeId) correlation.claimedBy.add(mfeId);
@@ -284,10 +455,35 @@ export function findScriptTimings(target) {
       return staleness > CORRELATION_STALE_THRESHOLD_MS;
     };
 
-    // Use getters here because the correlation data may arrive after this function returns the timing object, and we want to provide the most up-to-date timing information possible when the getters are accessed at harvest time.
-    // Non-stale: fall back to fetchEnd if correlation data isn't available yet (our best approximation for script execution start). Stale: fall back straight to registeredAt — fetchEnd would be derived from the same stale correlation, so it can't be trusted either.
-    Object.defineProperty(timings, 'scriptStart', timingFactory(() => isCorrelationStale() ? timings.registeredAt : correlation?.script.start ?? timings.fetchEnd));
-    Object.defineProperty(timings, 'scriptEnd', timingFactory(() => isCorrelationStale() ? timings.registeredAt : correlation?.script.end ?? timings.registeredAt));
+    // Only reached for a real (non-inline), stack-attributable script -- scriptStart/scriptEnd become live getters
+    // below, so manifest widening needs a hook that composes with them instead of overriding them (see
+    // recordManifestScriptWindow's doc comment). Every other path keeps getOrCreateInternals' plain-value-widening
+    // default, which is already correct there.
+    let manifestScriptStart = 0;
+    let manifestScriptEnd = 0;
+    /**
+     * Widens the running manifestScriptStart/manifestScriptEnd accumulators with one asset's correlation timing.
+     * Never shrinks either bound; a falsy (unresolved) start/end is ignored.
+     * @type {RecordManifestScriptWindowFn}
+     */
+    getOrCreateInternals(timings).recordManifestScriptWindow = (start, end) => {
+      if (start) manifestScriptStart = manifestScriptStart > 0 ? Math.min(manifestScriptStart, start) : start;
+      if (end) manifestScriptEnd = manifestScriptEnd > 0 ? Math.max(manifestScriptEnd, end) : end;
+    };
+
+    // Getters, since correlation data may still arrive after this function returns -- we want the freshest value
+    // at harvest time. Non-stale: fall back to fetchEnd (best approximation) if correlation isn't available yet.
+    // Stale: fall back to registeredAt, since fetchEnd would derive from the same stale correlation. Manifest
+    // widening is re-read on every access rather than baked in once, so it composes with a correlation that
+    // resolves later.
+    Object.defineProperty(timings, 'scriptStart', timingFactory(() => {
+      const ownStart = isCorrelationStale() ? timings.registeredAt : correlation?.script.start ?? timings.fetchEnd;
+      return manifestScriptStart > 0 ? Math.min(ownStart, manifestScriptStart) : ownStart;
+    }));
+    Object.defineProperty(timings, 'scriptEnd', timingFactory(() => {
+      const ownEnd = isCorrelationStale() ? timings.registeredAt : correlation?.script.end ?? timings.registeredAt;
+      return manifestScriptEnd > 0 ? Math.max(ownEnd, manifestScriptEnd) : ownEnd;
+    }));
   } catch (error) {
     // Don't let stack parsing errors break anything
   }

package/dist/esm/common/v2/utils.js

@@ -4,6 +4,8 @@
  */
 
 import { extractUrlsFromStack, getDeepStackTrace } from './script-tracker';
+import { matchManifestAsset } from './manifest';
+import { cleanURL } from '../url/clean-url';
 import { V2_TYPES } from './constants';
 
 /**
@@ -47,6 +49,38 @@ export function getRegisteredTargetsFromId(id, agentRef) {
   return registeredEntities?.filter(entity => String(entity.metadata.target.id) === String(id)).map(entity => entity.metadata.target) || [];
 }
 
+/**
+ * Returns the registered target(s) whose resource matches a given resource URL -- used to attribute `BrowserPerformance`
+ * (PerformanceResourceTiming) events, which never have a JS call stack to walk (they're fired for declarative
+ * `<script src>`/`<link>`/`<img>` tags, not JS execution), so stack-trace attribution (see {@link findTargetsFromStackTrace})
+ * doesn't apply. Unlike {@link getRegisteredTargetsFromFilename}, this matches manifest assets of ANY type (scripts,
+ * images, fonts, css, etc.) -- non-script assets can't produce a JS stack frame to match against, but they can and do
+ * produce their own resource timing entries. Returns an empty array if no target is found.
+ * @param {string} url - the resource's URL, as reported by the Performance API
+ * @param {*} agentRef
+ * @returns {import("../../interfaces/registered-entity").RegisterAPIMetadataTarget[]}
+ */
+export function getRegisteredTargetsFromResourceUrl(url, agentRef) {
+  if (!isValid(url, agentRef)) return [];
+  const registeredEntities = agentRef.runtime.registeredEntities;
+  const cleanedUrl = cleanURL(url);
+  const matches = registeredEntities?.filter(entity => {
+    const manifest = entity.metadata.target?.manifest;
+    if (manifest) {
+      // A manifest was supplied -- it is the sole source of truth for attribution. The caller-script fallback
+      // below never applies here, so e.g. a registrar script that calls register() on behalf of many MFEs (each
+      // with its own manifest naming only that MFE's own files) never has ITS OWN activity attributed just because
+      // it happened to be the one that called register().
+      return matchManifestAsset(manifest, url, {
+        scriptsOnly: false
+      });
+    }
+    // No manifest -- fall back to matching the resolved URL of whatever script called register().
+    return !!entity.metadata.timings?.asset && cleanURL(entity.metadata.timings.asset) === cleanedUrl;
+  });
+  return dedupeRegisteredEntitiesByAsset(matches).map(entity => entity.metadata.target);
+}
+
 /**
  * Returns the registered target(s) associated with a given filename if found in the resource timing API during registration. Returns an empty array if no target is found.
  * Multiple registrations that resolve to the same underlying script asset AND represent the same logical MFE (i.e.
@@ -63,7 +97,18 @@ export function getRegisteredTargetsFromId(id, agentRef) {
 export function getRegisteredTargetsFromFilename(filename, agentRef) {
   if (!isValid(filename, agentRef)) return [];
   const registeredEntities = agentRef.runtime.registeredEntities;
-  const matches = registeredEntities?.filter(entity => entity.metadata.timings?.asset?.endsWith(filename));
+  const matches = registeredEntities?.filter(entity => {
+    const manifest = entity.metadata.target?.manifest;
+    if (manifest) {
+      // See the identical case in getRegisteredTargetsFromResourceUrl above: once a manifest exists, it is the
+      // sole source of truth for attribution -- the caller-script fallback below never applies.
+      return matchManifestAsset(manifest, filename, {
+        scriptsOnly: true
+      });
+    }
+    // No manifest -- fall back to matching the resolved URL of whatever script called register().
+    return !!entity.metadata.timings?.asset?.endsWith(filename);
+  });
   return dedupeRegisteredEntitiesByAsset(matches).map(entity => entity.metadata.target);
 }
 

package/dist/esm/common/vitals/cumulative-layout-shift.js

@@ -1,14 +1,15 @@
 /**
- * Copyright 2020-2025 New Relic, Inc. All rights reserved.
+ * Copyright 2020-2026 New Relic, Inc. All rights reserved.
  * SPDX-License-Identifier: Apache-2.0
  */
 import { onCLS } from 'web-vitals/attribution';
 import { VITAL_NAMES } from './constants';
 import { VitalMetric } from './vital-metric';
+import { registerVital } from './register-vital';
 import { isBrowserScope } from '../constants/runtime';
 export const cumulativeLayoutShift = new VitalMetric(VITAL_NAMES.CUMULATIVE_LAYOUT_SHIFT, x => x);
 if (isBrowserScope) {
-  onCLS(({
+  const handleCLS = ({
     value,
     attribution,
     id
@@ -24,7 +25,8 @@ if (isBrowserScope) {
       value,
       attrs
     });
-  }, {
+  };
+  registerVital(() => onCLS(handleCLS, {
     reportAllChanges: true
-  });
+  }));
 }

package/dist/esm/common/vitals/first-contentful-paint.js

@@ -1,5 +1,5 @@
 /**
- * Copyright 2020-2025 New Relic, Inc. All rights reserved.
+ * Copyright 2020-2026 New Relic, Inc. All rights reserved.
  * SPDX-License-Identifier: Apache-2.0
  */
 import { onFCP } from 'web-vitals/attribution';
@@ -7,6 +7,7 @@ import { onFCP } from 'web-vitals/attribution';
 import { iOSBelow16, initiallyHidden, isBrowserScope } from '../constants/runtime';
 import { VITAL_NAMES } from './constants';
 import { VitalMetric } from './vital-metric';
+import { registerVital } from './register-vital';
 export const firstContentfulPaint = new VitalMetric(VITAL_NAMES.FIRST_CONTENTFUL_PAINT);
 
 /* First Contentful Paint - As of WV v3, it still imperfectly tries to detect document vis state asap and isn't supposed to report if page starts hidden. */
@@ -29,7 +30,7 @@ if (isBrowserScope) {
       // ignore
     }
   } else {
-    onFCP(({
+    const handleFCP = ({
       value,
       attribution
     }) => {
@@ -43,6 +44,7 @@ if (isBrowserScope) {
         value,
         attrs
       });
-    });
+    };
+    registerVital(() => onFCP(handleFCP));
   }
 }

package/dist/esm/common/vitals/interaction-to-next-paint.js

@@ -1,19 +1,24 @@
 /**
- * Copyright 2020-2025 New Relic, Inc. All rights reserved.
+ * Copyright 2020-2026 New Relic, Inc. All rights reserved.
  * SPDX-License-Identifier: Apache-2.0
  */
 import { onINP } from 'web-vitals/attribution';
 import { VitalMetric } from './vital-metric';
 import { VITAL_NAMES } from './constants';
+import { registerVital } from './register-vital';
 import { isBrowserScope } from '../constants/runtime';
 export const interactionToNextPaint = new VitalMetric(VITAL_NAMES.INTERACTION_TO_NEXT_PAINT);
 if (isBrowserScope) {
   /* Interaction-to-Next-Paint */
-  onINP(({
+  const handleINP = ({
     value,
     attribution,
-    id
+    id,
+    entries
   }) => {
+    /* web-vitals v6 reports a synthetic INP (value 8, no entries, no interaction attribution) after bfcache restores when
+      every interaction stayed below the duration threshold; skip those so only measured interactions are reported, as in v4 */
+    if (!entries?.length) return;
     const attrs = {
       metricId: id,
       eventTarget: attribution.interactionTarget,
@@ -33,5 +38,6 @@ if (isBrowserScope) {
       value,
       attrs
     });
-  });
+  };
+  registerVital(() => onINP(handleINP));
 }

package/dist/esm/common/vitals/largest-contentful-paint.js

@@ -5,11 +5,12 @@
 import { onLCP } from 'web-vitals/attribution';
 import { VitalMetric } from './vital-metric';
 import { VITAL_NAMES } from './constants';
+import { registerVital } from './register-vital';
 import { initiallyHidden, isBrowserScope } from '../constants/runtime';
 import { cleanURL } from '../url/clean-url';
 export const largestContentfulPaint = new VitalMetric(VITAL_NAMES.LARGEST_CONTENTFUL_PAINT);
 if (isBrowserScope) {
-  onLCP(({
+  const handleLCP = ({
     value,
     attribution
   }) => {
@@ -29,11 +30,12 @@ if (isBrowserScope) {
       attrs.eid = lcpEntry.id;
       if (lcpEntry.element?.tagName) attrs.elTag = lcpEntry.element.tagName;
     }
-    if (attribution.element) attrs.element = attribution.element;
+    if (attribution.target) attrs.element = attribution.target; // renamed from `element` in web-vitals v4->v5; NR attr name kept for backwards compatibility
     if (attribution.url) attrs.elUrl = cleanURL(attribution.url);
     largestContentfulPaint.update({
       value,
       attrs
     });
-  });
+  };
+  registerVital(() => onLCP(handleLCP));
 }

package/dist/esm/common/vitals/register-vital.js

@@ -0,0 +1,19 @@
+/**
+ * Copyright 2020-2026 New Relic, Inc. All rights reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+/**
+ * Invokes a web-vitals registration (e.g. `onLCP(callback)`), tolerating environments where the registration itself
+ * throws. web-vitals >= 5 reads Performance Timeline APIs such as `performance.getEntriesByType` unguarded when a
+ * metric is registered; where those are missing the metric is simply never reported, instead of the throw failing
+ * the feature that imported it.
+ * @param {() => void} register
+ */
+export function registerVital(register) {
+  try {
+    register();
+  } catch (e) {
+    // metric unavailable in this environment
+  }
+}

package/dist/esm/common/vitals/time-to-first-byte.js

@@ -5,6 +5,7 @@
 import { globalScope, isBrowserScope, isiOS, originTime, getNavigationEntry } from '../constants/runtime';
 import { VITAL_NAMES } from './constants';
 import { VitalMetric } from './vital-metric';
+import { registerVital } from './register-vital';
 import { onTTFB } from 'web-vitals/attribution';
 export const timeToFirstByte = new VitalMetric(VITAL_NAMES.TIME_TO_FIRST_BYTE);
 
@@ -17,7 +18,7 @@ export const timeToFirstByte = new VitalMetric(VITAL_NAMES.TIME_TO_FIRST_BYTE);
  * - onTTFB relies on a truthy `responseStart` value, should ensure that exists before relying on it (seen to be falsy in certain Electron.js cases for instance)
  */
 if (isBrowserScope && getNavigationEntry() && !isiOS && window === window.parent) {
-  onTTFB(({
+  const handleTTFB = ({
     value,
     attribution
   }) => {
@@ -28,7 +29,8 @@ if (isBrowserScope && getNavigationEntry() && !isiOS && window === window.parent
         navigationEntry: attribution.navigationEntry
       }
     });
-  });
+  };
+  registerVital(() => onTTFB(handleTTFB));
 } else {
   if (!timeToFirstByte.isValid) {
     const entry = {};

package/dist/esm/common/vitals/vital-metric.js

@@ -1,5 +1,5 @@
 /**
- * Copyright 2020-2025 New Relic, Inc. All rights reserved.
+ * Copyright 2020-2026 New Relic, Inc. All rights reserved.
  * SPDX-License-Identifier: Apache-2.0
  */
 export class VitalMetric {
@@ -18,7 +18,8 @@ export class VitalMetric {
     const state = {
       value: this.roundingMethod(value),
       name: this.name,
-      attrs
+      // optional web-vitals attribution fields are omitted rather than being serialized as null attributes
+      attrs: Object.fromEntries(Object.entries(attrs).filter(([, attrValue]) => attrValue !== undefined))
     };
     this.history.push(state);
     this.#subscribers.forEach(cb => {

package/dist/esm/features/generic_events/aggregate/index.js

@@ -15,7 +15,8 @@ import { UserActionsAggregator } from './user-actions/user-actions-aggregator';
 import { isIFrameWindow } from '../../../common/dom/iframe';
 import { isPureObject } from '../../../common/util/type-check';
 import { EVENT_TYPES } from '../../../common/constants/events';
-import { getVersion2Attributes, getVersion2DuplicationAttributes, shouldDuplicate } from '../../../common/v2/utils';
+import { getVersion2Attributes, getVersion2DuplicationAttributes, shouldDuplicate, getRegisteredTargetsFromResourceUrl } from '../../../common/v2/utils';
+import { findCorrelation } from '../../../common/v2/script-tracker';
 export class Aggregate extends AggregateBase {
   static featureName = FEATURE_NAME;
   #userActionAggregator;
@@ -232,7 +233,33 @@ export class Aggregate extends AggregateBase {
               entryDuration: duration,
               firstParty
             };
-            this.addEvent(event);
+            const targets = getRegisteredTargetsFromResourceUrl(name, this.agentRef);
+            if (targets.length) {
+              targets.forEach(target => this.addEvent({
+                ...event
+              }, target));
+              return;
+            }
+            this.addEvent({
+              ...event
+            }, undefined);
+
+            // This resource entry can resolve before a self-registering script has actually executed and called
+            // register() on itself (responseEnd fires before script parse/execution). If this URL belongs to a
+            // <script> we're tracking that hasn't finished loading yet, retry resolution once it has -- reporting
+            // a second (deliberately duplicate) copy under the real target if one shows up by then. One-shot,
+            // self-cleans via `once: true`, so there's nothing to leak if the script never registers.
+            const correlation = findCorrelation(cleanURL(name));
+            if (correlation?.dom.value && !correlation.dom.end) {
+              const retryAttribution = () => {
+                getRegisteredTargetsFromResourceUrl(name, this.agentRef).forEach(target => this.addEvent({
+                  ...event
+                }, target));
+              };
+              ['load', 'error'].forEach(evtType => correlation.dom.value.addEventListener(evtType, retryAttribution, {
+                once: true
+              }));
+            }
           } catch (err) {
             this.ee.emit('internal-error', [err, 'GenericEvents-Resource']);
           }
@@ -273,21 +300,11 @@ export class Aggregate extends AggregateBase {
         }, this.featureName, this.ee);
       }
       if (!agentRef.init.feature_flags.includes('no_spv')) {
-        registerHandler('spv', evt => {
+        registerHandler('spv', (violation, timestamp) => {
           this.addEvent({
             eventType: EVENT_TYPES.SPV,
-            timestamp: this.#toEpoch(evt.timeStamp),
-            blockedUri: evt.blockedURI,
-            documentUri: evt.documentURI,
-            effectiveDirective: evt.effectiveDirective,
-            originalPolicy: evt.originalPolicy,
-            sourceFile: evt.sourceFile,
-            statusCode: evt.statusCode,
-            lineNumber: evt.lineNumber,
-            columnNumber: evt.columnNumber,
-            disposition: evt.disposition,
-            sample: evt.sample,
-            referrer: evt.referrer
+            timestamp: this.#toEpoch(timestamp),
+            ...violation
           });
         }, this.featureName, this.ee);
       }