@newrelic/browser-agent 1.321.0 → 1.322.0-rc.1

package/src/common/v2/utils.js

@@ -4,6 +4,8 @@
  */
 
 import { extractUrlsFromStack, getDeepStackTrace } from './script-tracker'
+import { matchManifestAsset } from './manifest'
+import { cleanURL } from '../url/clean-url'
 import { V2_TYPES } from './constants'
 
 /**
@@ -47,6 +49,36 @@ export function getRegisteredTargetsFromId (id, agentRef) {
   return registeredEntities?.filter(entity => String(entity.metadata.target.id) === String(id)).map(entity => entity.metadata.target) || []
 }
 
+/**
+ * Returns the registered target(s) whose resource matches a given resource URL -- used to attribute `BrowserPerformance`
+ * (PerformanceResourceTiming) events, which never have a JS call stack to walk (they're fired for declarative
+ * `<script src>`/`<link>`/`<img>` tags, not JS execution), so stack-trace attribution (see {@link findTargetsFromStackTrace})
+ * doesn't apply. Unlike {@link getRegisteredTargetsFromFilename}, this matches manifest assets of ANY type (scripts,
+ * images, fonts, css, etc.) -- non-script assets can't produce a JS stack frame to match against, but they can and do
+ * produce their own resource timing entries. Returns an empty array if no target is found.
+ * @param {string} url - the resource's URL, as reported by the Performance API
+ * @param {*} agentRef
+ * @returns {import("../../interfaces/registered-entity").RegisterAPIMetadataTarget[]}
+ */
+export function getRegisteredTargetsFromResourceUrl (url, agentRef) {
+  if (!isValid(url, agentRef)) return []
+  const registeredEntities = agentRef.runtime.registeredEntities
+  const cleanedUrl = cleanURL(url)
+  const matches = registeredEntities?.filter(entity => {
+    const manifest = entity.metadata.target?.manifest
+    if (manifest) {
+      // A manifest was supplied -- it is the sole source of truth for attribution. The caller-script fallback
+      // below never applies here, so e.g. a registrar script that calls register() on behalf of many MFEs (each
+      // with its own manifest naming only that MFE's own files) never has ITS OWN activity attributed just because
+      // it happened to be the one that called register().
+      return matchManifestAsset(manifest, url, { scriptsOnly: false })
+    }
+    // No manifest -- fall back to matching the resolved URL of whatever script called register().
+    return !!entity.metadata.timings?.asset && cleanURL(entity.metadata.timings.asset) === cleanedUrl
+  })
+  return dedupeRegisteredEntitiesByAsset(matches).map(entity => entity.metadata.target)
+}
+
 /**
  * Returns the registered target(s) associated with a given filename if found in the resource timing API during registration. Returns an empty array if no target is found.
  * Multiple registrations that resolve to the same underlying script asset AND represent the same logical MFE (i.e.
@@ -63,7 +95,16 @@ export function getRegisteredTargetsFromId (id, agentRef) {
 export function getRegisteredTargetsFromFilename (filename, agentRef) {
   if (!isValid(filename, agentRef)) return []
   const registeredEntities = agentRef.runtime.registeredEntities
-  const matches = registeredEntities?.filter(entity => entity.metadata.timings?.asset?.endsWith(filename))
+  const matches = registeredEntities?.filter(entity => {
+    const manifest = entity.metadata.target?.manifest
+    if (manifest) {
+      // See the identical case in getRegisteredTargetsFromResourceUrl above: once a manifest exists, it is the
+      // sole source of truth for attribution -- the caller-script fallback below never applies.
+      return matchManifestAsset(manifest, filename, { scriptsOnly: true })
+    }
+    // No manifest -- fall back to matching the resolved URL of whatever script called register().
+    return !!entity.metadata.timings?.asset?.endsWith(filename)
+  })
   return dedupeRegisteredEntitiesByAsset(matches).map(entity => entity.metadata.target)
 }
 

package/src/common/vitals/cumulative-layout-shift.js

@@ -1,16 +1,17 @@
 /**
- * Copyright 2020-2025 New Relic, Inc. All rights reserved.
+ * Copyright 2020-2026 New Relic, Inc. All rights reserved.
  * SPDX-License-Identifier: Apache-2.0
  */
 import { onCLS } from 'web-vitals/attribution'
 import { VITAL_NAMES } from './constants'
 import { VitalMetric } from './vital-metric'
+import { registerVital } from './register-vital'
 import { isBrowserScope } from '../constants/runtime'
 
 export const cumulativeLayoutShift = new VitalMetric(VITAL_NAMES.CUMULATIVE_LAYOUT_SHIFT, (x) => x)
 
 if (isBrowserScope) {
-  onCLS(({ value, attribution, id }) => {
+  const handleCLS = ({ value, attribution, id }) => {
     const attrs = {
       metricId: id,
       largestShiftTarget: attribution.largestShiftTarget,
@@ -19,5 +20,6 @@ if (isBrowserScope) {
       loadState: attribution.loadState
     }
     cumulativeLayoutShift.update({ value, attrs })
-  }, { reportAllChanges: true })
+  }
+  registerVital(() => onCLS(handleCLS, { reportAllChanges: true }))
 }

package/src/common/vitals/first-contentful-paint.js

@@ -1,5 +1,5 @@
 /**
- * Copyright 2020-2025 New Relic, Inc. All rights reserved.
+ * Copyright 2020-2026 New Relic, Inc. All rights reserved.
  * SPDX-License-Identifier: Apache-2.0
  */
 import { onFCP } from 'web-vitals/attribution'
@@ -7,6 +7,7 @@ import { onFCP } from 'web-vitals/attribution'
 import { iOSBelow16, initiallyHidden, isBrowserScope } from '../constants/runtime'
 import { VITAL_NAMES } from './constants'
 import { VitalMetric } from './vital-metric'
+import { registerVital } from './register-vital'
 
 export const firstContentfulPaint = new VitalMetric(VITAL_NAMES.FIRST_CONTENTFUL_PAINT)
 
@@ -27,7 +28,7 @@ if (isBrowserScope) {
     // ignore
     }
   } else {
-    onFCP(({ value, attribution }) => {
+    const handleFCP = ({ value, attribution }) => {
       if (initiallyHidden || firstContentfulPaint.isValid) return
       const attrs = {
         timeToFirstByte: attribution.timeToFirstByte,
@@ -35,6 +36,7 @@ if (isBrowserScope) {
         loadState: attribution.loadState
       }
       firstContentfulPaint.update({ value, attrs })
-    })
+    }
+    registerVital(() => onFCP(handleFCP))
   }
 }

package/src/common/vitals/interaction-to-next-paint.js

@@ -1,17 +1,21 @@
 /**
- * Copyright 2020-2025 New Relic, Inc. All rights reserved.
+ * Copyright 2020-2026 New Relic, Inc. All rights reserved.
  * SPDX-License-Identifier: Apache-2.0
  */
 import { onINP } from 'web-vitals/attribution'
 import { VitalMetric } from './vital-metric'
 import { VITAL_NAMES } from './constants'
+import { registerVital } from './register-vital'
 import { isBrowserScope } from '../constants/runtime'
 
 export const interactionToNextPaint = new VitalMetric(VITAL_NAMES.INTERACTION_TO_NEXT_PAINT)
 
 if (isBrowserScope) {
   /* Interaction-to-Next-Paint */
-  onINP(({ value, attribution, id }) => {
+  const handleINP = ({ value, attribution, id, entries }) => {
+    /* web-vitals v6 reports a synthetic INP (value 8, no entries, no interaction attribution) after bfcache restores when
+      every interaction stayed below the duration threshold; skip those so only measured interactions are reported, as in v4 */
+    if (!entries?.length) return
     const attrs = {
       metricId: id,
       eventTarget: attribution.interactionTarget, // event* attrs deprecated in v4, kept for NR backwards compatibility
@@ -26,5 +30,6 @@ if (isBrowserScope) {
       loadState: attribution.loadState
     }
     interactionToNextPaint.update({ value, attrs })
-  })
+  }
+  registerVital(() => onINP(handleINP))
 }

package/src/common/vitals/largest-contentful-paint.js

@@ -5,13 +5,14 @@
 import { onLCP } from 'web-vitals/attribution'
 import { VitalMetric } from './vital-metric'
 import { VITAL_NAMES } from './constants'
+import { registerVital } from './register-vital'
 import { initiallyHidden, isBrowserScope } from '../constants/runtime'
 import { cleanURL } from '../url/clean-url'
 
 export const largestContentfulPaint = new VitalMetric(VITAL_NAMES.LARGEST_CONTENTFUL_PAINT)
 
 if (isBrowserScope) {
-  onLCP(({ value, attribution }) => {
+  const handleLCP = ({ value, attribution }) => {
   /* Largest Contentful Paint - As of WV v3, it still imperfectly tries to detect document vis state asap and isn't supposed to report if page starts hidden. */
     if (initiallyHidden || largestContentfulPaint.isValid) return
 
@@ -28,9 +29,10 @@ if (isBrowserScope) {
       attrs.eid = lcpEntry.id
       if (lcpEntry.element?.tagName) attrs.elTag = lcpEntry.element.tagName
     }
-    if (attribution.element) attrs.element = attribution.element
+    if (attribution.target) attrs.element = attribution.target // renamed from `element` in web-vitals v4->v5; NR attr name kept for backwards compatibility
     if (attribution.url) attrs.elUrl = cleanURL(attribution.url)
 
     largestContentfulPaint.update({ value, attrs })
-  })
+  }
+  registerVital(() => onLCP(handleLCP))
 }

package/src/common/vitals/register-vital.js

@@ -0,0 +1,19 @@
+/**
+ * Copyright 2020-2026 New Relic, Inc. All rights reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+/**
+ * Invokes a web-vitals registration (e.g. `onLCP(callback)`), tolerating environments where the registration itself
+ * throws. web-vitals >= 5 reads Performance Timeline APIs such as `performance.getEntriesByType` unguarded when a
+ * metric is registered; where those are missing the metric is simply never reported, instead of the throw failing
+ * the feature that imported it.
+ * @param {() => void} register
+ */
+export function registerVital (register) {
+  try {
+    register()
+  } catch (e) {
+    // metric unavailable in this environment
+  }
+}

package/src/common/vitals/time-to-first-byte.js

@@ -5,6 +5,7 @@
 import { globalScope, isBrowserScope, isiOS, originTime, getNavigationEntry } from '../constants/runtime'
 import { VITAL_NAMES } from './constants'
 import { VitalMetric } from './vital-metric'
+import { registerVital } from './register-vital'
 import { onTTFB } from 'web-vitals/attribution'
 
 export const timeToFirstByte = new VitalMetric(VITAL_NAMES.TIME_TO_FIRST_BYTE)
@@ -18,10 +19,11 @@ export const timeToFirstByte = new VitalMetric(VITAL_NAMES.TIME_TO_FIRST_BYTE)
  * - onTTFB relies on a truthy `responseStart` value, should ensure that exists before relying on it (seen to be falsy in certain Electron.js cases for instance)
  */
 if (isBrowserScope && getNavigationEntry() && !isiOS && window === window.parent) {
-  onTTFB(({ value, attribution }) => {
+  const handleTTFB = ({ value, attribution }) => {
     if (timeToFirstByte.isValid) return
     timeToFirstByte.update({ value, attrs: { navigationEntry: attribution.navigationEntry } })
-  })
+  }
+  registerVital(() => onTTFB(handleTTFB))
 } else {
   if (!timeToFirstByte.isValid) {
     const entry = {}

package/src/common/vitals/vital-metric.js

@@ -1,5 +1,5 @@
 /**
- * Copyright 2020-2025 New Relic, Inc. All rights reserved.
+ * Copyright 2020-2026 New Relic, Inc. All rights reserved.
  * SPDX-License-Identifier: Apache-2.0
  */
 export class VitalMetric {
@@ -17,7 +17,8 @@ export class VitalMetric {
     const state = {
       value: this.roundingMethod(value),
       name: this.name,
-      attrs
+      // optional web-vitals attribution fields are omitted rather than being serialized as null attributes
+      attrs: Object.fromEntries(Object.entries(attrs).filter(([, attrValue]) => attrValue !== undefined))
     }
 
     this.history.push(state)

package/src/features/generic_events/aggregate/index.js

@@ -15,7 +15,8 @@ import { UserActionsAggregator } from './user-actions/user-actions-aggregator'
 import { isIFrameWindow } from '../../../common/dom/iframe'
 import { isPureObject } from '../../../common/util/type-check'
 import { EVENT_TYPES } from '../../../common/constants/events'
-import { getVersion2Attributes, getVersion2DuplicationAttributes, shouldDuplicate } from '../../../common/v2/utils'
+import { getVersion2Attributes, getVersion2DuplicationAttributes, shouldDuplicate, getRegisteredTargetsFromResourceUrl } from '../../../common/v2/utils'
+import { findCorrelation } from '../../../common/v2/script-tracker'
 
 export class Aggregate extends AggregateBase {
   static featureName = FEATURE_NAME
@@ -229,7 +230,26 @@ export class Aggregate extends AggregateBase {
               firstParty
             }
 
-            this.addEvent(event)
+            const targets = getRegisteredTargetsFromResourceUrl(name, this.agentRef)
+            if (targets.length) {
+              targets.forEach(target => this.addEvent({ ...event }, target))
+              return
+            }
+
+            this.addEvent({ ...event }, undefined)
+
+            // This resource entry can resolve before a self-registering script has actually executed and called
+            // register() on itself (responseEnd fires before script parse/execution). If this URL belongs to a
+            // <script> we're tracking that hasn't finished loading yet, retry resolution once it has -- reporting
+            // a second (deliberately duplicate) copy under the real target if one shows up by then. One-shot,
+            // self-cleans via `once: true`, so there's nothing to leak if the script never registers.
+            const correlation = findCorrelation(cleanURL(name))
+            if (correlation?.dom.value && !correlation.dom.end) {
+              const retryAttribution = () => {
+                getRegisteredTargetsFromResourceUrl(name, this.agentRef).forEach(target => this.addEvent({ ...event }, target))
+              }
+              ;['load', 'error'].forEach(evtType => correlation.dom.value.addEventListener(evtType, retryAttribution, { once: true }))
+            }
           } catch (err) {
             this.ee.emit('internal-error', [err, 'GenericEvents-Resource'])
           }
@@ -271,21 +291,11 @@ export class Aggregate extends AggregateBase {
         }, this.featureName, this.ee)
       }
       if (!agentRef.init.feature_flags.includes('no_spv')) {
-        registerHandler('spv', (evt) => {
+        registerHandler('spv', (violation, timestamp) => {
           this.addEvent({
             eventType: EVENT_TYPES.SPV,
-            timestamp: this.#toEpoch(evt.timeStamp),
-            blockedUri: evt.blockedURI,
-            documentUri: evt.documentURI,
-            effectiveDirective: evt.effectiveDirective,
-            originalPolicy: evt.originalPolicy,
-            sourceFile: evt.sourceFile,
-            statusCode: evt.statusCode,
-            lineNumber: evt.lineNumber,
-            columnNumber: evt.columnNumber,
-            disposition: evt.disposition,
-            sample: evt.sample,
-            referrer: evt.referrer
+            timestamp: this.#toEpoch(timestamp),
+            ...violation
           })
         }, this.featureName, this.ee)
       }

package/src/features/generic_events/instrument/index.js

@@ -6,6 +6,7 @@
 import { globalScope, isBrowserScope } from '../../../common/constants/runtime'
 import { handle } from '../../../common/event-emitter/handle'
 import { eventListenerOpts, windowAddEventListener } from '../../../common/event-listener/event-listener-opts'
+import { now } from '../../../common/timing/now'
 import { debounce } from '../../../common/util/invoke'
 import { setupAddPageActionAPI } from '../../../loaders/api/addPageAction'
 import { setupFinishedAPI } from '../../../loaders/api/finished'
@@ -61,8 +62,24 @@ export class Instrument extends InstrumentBase {
       })
     }
     if (securityPolicyViolationEnabled) {
+      /** ReportingObserver's `csp-violation` type isn't reliably enabled everywhere out of the box:
+       *  - Safari only delivers it when the page sets a report-to CSP directive -- https://bugs.webkit.org/show_bug.cgi?id=320750;
+       *  - Firefox ships it behind the `dom.reporting.enabled` pref, which defaults to false;
+       * So it's only used for violations that occur before the agent loaded, targeting Chromium browsers. `buffered: true` replays
+       * that backlog in the observer's first callback invocation, after which it's disconnected and all future violations are
+       * covered by securitypolicyviolation, which is reliable across all browsers. */
+      if (typeof globalScope.ReportingObserver === 'function') {
+        const cspObserver = new globalScope.ReportingObserver((reports) => {
+          reports.forEach(report => {
+            handle('spv', [normalizeCspViolation(report), now()], undefined, FEATURE_NAMES.genericEvents, this.ee)
+          })
+          cspObserver.disconnect()
+        }, { types: ['csp-violation'], buffered: true })
+        cspObserver.observe()
+      }
+
       globalScope.addEventListener('securitypolicyviolation', (evt) => {
-        handle('spv', [evt], undefined, FEATURE_NAMES.genericEvents, this.ee)
+        handle('spv', [normalizeCspViolation(evt), evt.timeStamp], undefined, FEATURE_NAMES.genericEvents, this.ee)
       }, eventListenerOpts(false, this.removeOnAbort.signal))
     }
     if (isBrowserScope) {
@@ -132,5 +149,26 @@ export class Instrument extends InstrumentBase {
     else this.deregisterDrain()
   }
 }
+/** `Report.body` (ReportingObserver) and `SecurityPolicyViolationEvent` (securitypolicyviolation) describe the same
+ * violation with differently-named/shaped fields -- collapse both into one shape so downstream code doesn't care
+ * which mechanism produced it. `source` is either of those: a Report (fields under `.body`, URLs as blockedURL/
+ * documentURL) or the event (fields at the top level, URLs as blockedURI/documentURI). Also normalizes disposition's
+ * "reporting" (Report body) to "report" (event) so the value is consistent regardless of source. */
+function normalizeCspViolation (source) {
+  const body = source.body ?? source
+  return {
+    blockedUrl: body.blockedURL ?? source.blockedURI,
+    documentUrl: body.documentURL ?? source.documentURI,
+    effectiveDirective: body.effectiveDirective,
+    originalPolicy: body.originalPolicy,
+    sourceFile: body.sourceFile,
+    statusCode: body.statusCode,
+    lineNumber: body.lineNumber,
+    columnNumber: body.columnNumber,
+    disposition: body.disposition === 'reporting' ? 'report' : body.disposition,
+    sample: body.sample,
+    referrer: body.referrer
+  }
+}
 
 export const GenericEvents = Instrument

package/src/interfaces/registered-iframe-entity.js

@@ -7,6 +7,7 @@
 import { onCLS, onFCP, onINP, onLCP } from 'web-vitals'
 // internal
 import { globalScope, isBrowserScope } from '../common/constants/runtime'
+import { registerVital } from '../common/vitals/register-vital'
 import { isIFrameWindow } from '../common/dom/iframe'
 import { now } from '../common/timing/now'
 import { warn } from '../common/util/console'
@@ -179,12 +180,16 @@ export class RegisteredIframeEntity {
    */
   #setupVitalsListeners () {
     VITALS.forEach(([vitalFn, property]) => {
-      vitalFn(({ value }) => {
+      registerVital(() => vitalFn(({ value, entries: vitalEntries }) => {
+        /* web-vitals v6 reports a synthetic INP (value 8, no entries) after bfcache restores when
+          every interaction stayed below the duration threshold; skip those so only measured
+          interactions are reported, matching the guard in src/common/vitals/interaction-to-next-paint.js */
+        if (property === 'inp' && !vitalEntries?.length) return
         this.metadata.vitals[property].value = value
         this.#postMessageToParent(IFRAME_VITALS_UPDATE, {
           entries: [{ property, value }]
         })
-      }, { reportAllChanges: property === 'cls' || property === 'inp' })
+      }, { reportAllChanges: property === 'cls' || property === 'inp' }))
     })
   }
 

package/src/loaders/api/register-api-types.js

@@ -17,6 +17,10 @@
  * @property {RegisterAPIMetadata} metadata - The metadata object containing the custom attributes and target information for the registered entity.
  */
 
+/**
+ * @typedef {import('../../common/v2/manifest').AssetFile} AssetFile
+ */
+
 /**
  * @typedef {Object} RegisterAPIConstructor
  * @property {string} id - The unique id for the registered entity. This will be assigned to any synthesized entities.
@@ -24,6 +28,8 @@
  * @property {{[key: string]: any}} [tags] - The tags for the registered entity as key-value pairs. This will be assigned to any synthesized entities. Tags are converted to source.* attributes (e.g., {environment: 'production'} becomes source.environment: 'production').
  * @property {RegisterAPITarget} [parent] - The parent target for the registered entity. If none was supplied, it will assume the entity guid from the main agent.
  * @property {string} [parentId] - The parentId for the registered entity. If none was supplied, it will assume the entity guid from the main agent.
+ * @property {{assets?: Array<AssetFile>}} [manifest] - An optional manifest describing the MFE's known assets (scripts, stylesheets, images, fonts, etc.) as `AssetFile` entries, used to improve the accuracy of event attribution (errors, logs, ajax, websockets), attribute `BrowserPerformance` resource events (any asset type, not just scripts) and, depending on `timingMethod`, MicroFrontEndTiming values. Each `AssetFile`'s script-capability is inferred from a `.js` suffix on a string `matcher` (a RegExp `matcher` is never inferred as a script), unless overridden via `type: 'script'` or explicitly disabled via `type: 'asset'`. An `AssetFile` with an invalid `matcher` or an unrecognized `type` is discarded/ignored (with a console warning) rather than applied. If omitted, the agent falls back to its existing behavior of only evaluating the script that called `register()` (resource attribution still applies to that script).
+ * @property {'entry'|'scripts'|'all'} [timingMethod] - Controls which manifest assets are used to calculate MicroFrontEndTiming values: 'entry' (the default) leaves timing based entirely on the script that called `register()`, unaffected by the manifest; 'scripts' widens the timing window across all script assets; 'all' widens it across every asset.
  */
 
 /**
@@ -39,18 +45,22 @@
  * @property {string} name - The name returned for the registered entity.
  * @property {{[key: string]: any}} [tags] - The tags for the registered entity as key-value pairs.
  * @property {string} [parentId] - The parentId for the registered entity. If none was supplied, it will assume the entity guid from the main agent.
+ * @property {import('../../common/v2/manifest').ParsedManifest} [manifest] - The parsed manifest for the registered entity, if one was supplied.
+ * @property {'entry'|'scripts'|'all'} [timingMethod] - The timing method supplied for the registered entity, if any.
  */
 
 /**
  * @typedef {Object} RegisterAPITimings
  * @property {number} registeredAt - The timestamp when the registered entity was created.
  * @property {number} [reportedAt] - The timestamp when the registered entity was deregistered.
- * @property {number} fetchStart - The timestamp when the registered entity began fetching (performance.start).
- * @property {number} fetchEnd - The timestamp when the registered entity finished fetching (performance.end).
- * @property {number} scriptStart - The timestamp when script initialization began (max of dom.start or performance.end, or performance.end if no dom.start).
- * @property {number} scriptEnd - The timestamp when script loading completed (dom.end or registeredAt if no dom.end).
+ * @property {number} fetchStart - The timestamp when the registered entity began fetching (performance.start). When a manifest with timingMethod 'scripts'|'all' is supplied, this widens to the earliest fetchStart across all matched manifest assets.
+ * @property {number} fetchEnd - The timestamp when the registered entity finished fetching (performance.end). When a manifest with timingMethod 'scripts'|'all' is supplied, this widens to the latest fetchEnd across all matched manifest assets.
+ * @property {number} scriptStart - The timestamp when script initialization began (max of dom.start or performance.end, or performance.end if no dom.start). When a manifest with timingMethod 'scripts'|'all' is supplied, this widens to the earliest scriptStart across all matched manifest script assets (non-script assets are excluded).
+ * @property {number} scriptEnd - The timestamp when script loading completed (dom.end or registeredAt if no dom.end). When a manifest with timingMethod 'scripts'|'all' is supplied, this widens to the latest scriptEnd across all matched manifest script assets (non-script assets are excluded).
  * @property {Object} [asset] - The asset path (if found) for the registered entity.
  * @property {string} type - The type of timing associated with the registered entity, 'script' or 'link' if found with the performance resource API, 'fetch' for dynamic imports, 'inline' if found to be associated with the root document URL, or 'unknown' if no associated resource could be found.
+ * @property {number} totalWeight - The sum of `transferSize` (bytes) across every asset detected for the registered entity -- the entry script, plus, when a manifest is supplied, every matched manifest asset (script or non-script). Unlike fetchStart/fetchEnd/scriptStart/scriptEnd above, this is never gated behind `timingMethod` -- manifest assets contribute their bytes even at the 'entry' default/unset. Cross-origin assets without a Timing-Allow-Origin header report 0 bytes per the Resource Timing spec.
+ * @property {boolean} [renderBlocking] - True if any detected asset (entry script or matched manifest asset) has a `renderBlockingStatus` of 'blocking'; false if none were 'blocking' but at least one reported 'non-blocking'; left `undefined` if no detected asset reported the attribute at all (e.g. unsupported browser). A single 'blocking' asset always wins over any number of 'non-blocking' ones, regardless of resolution order.
  */
 
 /**

package/src/loaders/api/register.js

@@ -17,11 +17,14 @@ import { single } from '../../common/util/invoke'
 import { measure } from './measure'
 import { recordCustomEvent } from './recordCustomEvent'
 import { subscribeToPageUnload } from '../../common/window/page-visibility'
-import { findScriptTimings } from '../../common/v2/script-tracker'
+import { findScriptTimings, applyManifestTimings } from '../../common/v2/script-tracker'
 import { trackMFEVitals } from '../../common/v2/mfe-vitals'
 import { generateRandomHexString } from '../../common/ids/unique-id'
+import { parseManifest } from '../../common/v2/manifest'
 import { cleanURL } from '../../common/url/clean-url'
 
+const TIMING_METHODS = ['entry', 'scripts', 'all']
+
 /**
  * @typedef {import('./register-api-types').RegisterAPI} RegisterAPI
  */
@@ -48,7 +51,10 @@ export const warnings = {
   experimental: single(() => warn(54, 'newrelic.register')),
   disabled: single(() => warn(55)),
   invalidTarget: single((target) => warn(48, target)),
-  deregistered: single(() => warn(68))
+  deregistered: single(() => warn(68)),
+  invalidTimingMethod: single((value) => warn(80, value)),
+  duplicateName: single((target) => warn(81, target)),
+  duplicateId: single((target) => warn(82, target))
 }
 
 /**
@@ -82,9 +88,17 @@ function register (agentRef, target) {
     get id () { return agentRef.runtime.appMetadata.agents?.[0].entityGuid }, // getter because this is asynchronously set
     type: V2_TYPES.BA
   }
+  target.manifest = parseManifest(target.manifest)
+  if (target.timingMethod !== undefined && !TIMING_METHODS.includes(target.timingMethod)) {
+    warnings.invalidTimingMethod(target.timingMethod)
+    target.timingMethod = undefined
+  }
 
   // The script timings for this entity, which will be used to populate part of the MicroFrontEndTiming custom event.
   const timings = findScriptTimings(target)
+  // Always applied when a manifest is present -- totalWeight/renderBlocking accumulate from manifest assets
+  // regardless of timingMethod; actual timing widening inside stays gated to 'scripts'/'all' (see applyManifestTimings).
+  if (target.manifest) applyManifestTimings(timings, target)
 
   // Track MFE vitals for this entity, which will be used to populate part of the MicroFrontEndTiming custom event.
   const vitals = trackMFEVitals(target, timings)
@@ -138,6 +152,16 @@ function register (agentRef, target) {
   /** primary cases that can block the register API from working at init time */
   if (!agentRef.init.api.register.enabled) block(warnings.disabled)
   if (!hasValidValue(target.id) || !hasValidValue(target.name)) block(() => warnings.invalidTarget(target))
+  /** warn if we see obviously unstable things with MFE targets */
+  registeredEntities.forEach((entity) => {
+    try {
+      const { name, id } = entity.metadata.target
+      if (name === target.name && id !== target.id) warnings.duplicateName(target)
+      if (id === target.id && name !== target.name) warnings.duplicateId(target)
+    } catch (e) {
+      // something unexpected went wrong...
+    }
+  })
 
   /** @type {RegisterAPI} */
   const api = {
@@ -215,6 +239,9 @@ function register (agentRef, target) {
       timeToFetch, // fetchStart to fetchEnd
       timeToLoad: timeToFetch + timeToExecute, // fetch time and script time together
       timeToRegister: timings.registeredAt, // timestamp when register() was called
+      totalWeight: timings.totalWeight, // sum of transferSize bytes across every detected asset (entry script + matched manifest assets)
+      // renderBlocking: true if any detected asset was 'blocking', false if only 'non-blocking' assets were seen, omitted entirely if no detected asset reported the attribute at all
+      ...(timings.renderBlocking !== undefined && { renderBlocking: timings.renderBlocking }),
       // leave room to extend these with more data keys as needed
       ...(vitals.fcp.value >= 0 && { 'vitals.fcp.value': vitals.fcp.value }), // FCP vital object with value and metadata
       ...(vitals.lcp.value >= 0 && { 'vitals.lcp.value': vitals.lcp.value }), // LCP vital object with value and metadata