@newrelic/browser-agent 1.323.0 → 1.324.0-rc.1

package/CHANGELOG.md

@@ -3,6 +3,21 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [1.324.0](https://github.com/newrelic/newrelic-browser-agent/compare/v1.323.0...v1.324.0) (2026-10-12)
+
+
+### Features
+
+* Enable distributed tracing for registered Micro Frontends ([#1871](https://github.com/newrelic/newrelic-browser-agent/issues/1871)) ([b4b2e96](https://github.com/newrelic/newrelic-browser-agent/commit/b4b2e9686fc454642454e1cf5804507f1449d495))
+* Improve script matching in manifest ([#1879](https://github.com/newrelic/newrelic-browser-agent/issues/1879)) ([5b7d6fa](https://github.com/newrelic/newrelic-browser-agent/commit/5b7d6fa2435967156cb520a0b73ac1934638da74))
+
+
+### Bug Fixes
+
+* find iframe entity script timings at registration ([#1891](https://github.com/newrelic/newrelic-browser-agent/issues/1891)) ([13f9fbe](https://github.com/newrelic/newrelic-browser-agent/commit/13f9fbe877ef1471200bb1460c1cb0158c302ad7))
+* **jserrors:** reset stack hash memory on session reset ([#1878](https://github.com/newrelic/newrelic-browser-agent/issues/1878)) ([b0d01bf](https://github.com/newrelic/newrelic-browser-agent/commit/b0d01bf582782d2176d1715aaab290019106eef3))
+* prevent runaway log harvests from inflated attribute size ([#1897](https://github.com/newrelic/newrelic-browser-agent/issues/1897)) ([1803e4c](https://github.com/newrelic/newrelic-browser-agent/commit/1803e4c1800e12c0486625e26b39e2a00146ab64))
+
 ## [1.323.0](https://github.com/newrelic/newrelic-browser-agent/compare/v1.322.0...v1.323.0) (2026-09-30)
 
 

package/dist/cjs/common/constants/agent-constants.js

@@ -3,7 +3,7 @@
 Object.defineProperty(exports, "__esModule", {
   value: true
 });
-exports.SUPPORTS_REGISTERED_ENTITIES = exports.SESSION_ERROR = exports.MAX_PAYLOAD_SIZE = exports.IDEAL_PAYLOAD_SIZE = exports.DEFAULT_KEY = void 0;
+exports.SUPPORTS_REGISTERED_ENTITIES = exports.SESSION_ERROR = exports.MIN_EARLY_HARVEST_INTERVAL = exports.MAX_PAYLOAD_SIZE = exports.IDEAL_PAYLOAD_SIZE = exports.EARLY_HARVEST_BYPASS_SIZE = exports.DEFAULT_KEY = void 0;
 var _features = require("../../loaders/features/features");
 /**
  * Copyright 2020-2026 New Relic, Inc. All rights reserved.
@@ -12,6 +12,10 @@ var _features = require("../../loaders/features/features");
 
 const IDEAL_PAYLOAD_SIZE = exports.IDEAL_PAYLOAD_SIZE = 16000;
 const MAX_PAYLOAD_SIZE = exports.MAX_PAYLOAD_SIZE = 1000000;
+/** The minimum time (ms) between early harvests of a single feature. Data that arrives inside this window stays buffered for the next harvest. */
+const MIN_EARLY_HARVEST_INTERVAL = exports.MIN_EARLY_HARVEST_INTERVAL = 500;
+/** The estimated payload size at which a feature may harvest early even inside the minimum interval, so that a flood of data cannot fill the buffer to MAX_PAYLOAD_SIZE (and start dropping events) while waiting. */
+const EARLY_HARVEST_BYPASS_SIZE = exports.EARLY_HARVEST_BYPASS_SIZE = MAX_PAYLOAD_SIZE / 2;
 const DEFAULT_KEY = exports.DEFAULT_KEY = 'NR_CONTAINER_AGENT';
 const SESSION_ERROR = exports.SESSION_ERROR = 'SESSION_ERROR';
 const SUPPORTS_REGISTERED_ENTITIES = exports.SUPPORTS_REGISTERED_ENTITIES = {

package/dist/cjs/common/constants/env.cdn.js

@@ -17,7 +17,7 @@ exports.VERSION = exports.RRWEB_VERSION = exports.RRWEB_PACKAGE_NAME = exports.D
 /**
  * Exposes the version of the agent
  */
-const VERSION = exports.VERSION = "1.323.0";
+const VERSION = exports.VERSION = "1.324.0-rc.1";
 
 /**
  * Exposes the build type of the agent

package/dist/cjs/common/constants/env.npm.js

@@ -17,7 +17,7 @@ exports.VERSION = exports.RRWEB_VERSION = exports.RRWEB_PACKAGE_NAME = exports.D
 /**
  * Exposes the version of the agent
  */
-const VERSION = exports.VERSION = "1.323.0";
+const VERSION = exports.VERSION = "1.324.0-rc.1";
 
 /**
  * Exposes the build type of the agent

package/dist/cjs/common/util/attribute-size.js

@@ -6,7 +6,7 @@ Object.defineProperty(exports, "__esModule", {
 exports.trackObjectAttributeSize = trackObjectAttributeSize;
 var _stringify = require("./stringify");
 /**
- * Copyright 2020-2025 New Relic, Inc. All rights reserved.
+ * Copyright 2020-2026 New Relic, Inc. All rights reserved.
  * SPDX-License-Identifier: Apache-2.0
  */
 
@@ -18,12 +18,15 @@ function trackObjectAttributeSize(parent, object) {
   // proxy attribute to calculate its size when changed
   parent[object] = new Proxy(originalAttribute, {
     set(target, prop, value) {
+      /* An overwrite replaces the existing entry, so its previous size must be removed first. Otherwise repeated sets of the same key inflate the count far beyond the real size. */
+      if (Object.prototype.hasOwnProperty.call(target, prop)) output.bytes -= prop.length + (0, _stringify.stringify)(target[prop]).length;
       output.bytes += prop.length + (0, _stringify.stringify)(value).length;
       target[prop] = value;
       return true;
     },
     deleteProperty(target, prop) {
-      output.bytes -= prop.length + (0, _stringify.stringify)(target[prop]).length;
+      /* Deleting a key that was never set removes nothing, so the count must not change. */
+      if (Object.prototype.hasOwnProperty.call(target, prop)) output.bytes -= prop.length + (0, _stringify.stringify)(target[prop]).length;
       return delete target[prop];
     }
   });

package/dist/cjs/common/v2/manifest.js

@@ -15,7 +15,7 @@ var _invoke = require("../util/invoke");
 
 /**
  * @typedef {Object} AssetFile
- * @property {string|RegExp} matcher - the path/path-fragment string, or RegExp, used to match a resolved URL against this asset
+ * @property {string|RegExp} matcher - the path/path-fragment string, or RegExp, used to match a resolved URL against this asset. A matcher may match many resources (e.g. a RegExp for hashed chunks); every matching resource contributes to the MFE's `totalWeight`/`renderBlocking` and, per `timingMethod`, its timing window
  * @property {'script'|'asset'} [type] - optional override for script-capability inference. When omitted, script-capability is inferred from a
  * `.js` suffix on a string `matcher` (a RegExp `matcher` is never inferred as a script). Supply `type: 'script'` to explicitly flag an entry
  * as a script regardless of its matcher shape/suffix (e.g. an extensionless URL, or a RegExp targeting a script path), or `type: 'asset'` to

package/dist/cjs/common/v2/script-tracker-types.js

@@ -20,6 +20,9 @@ exports.default = void 0;
  * `script-tracker.js`). Cleaned URLs already folded into `timings.totalWeight`/`timings.renderBlocking` by
  * `applyResourceWeight`, so the same underlying resource (e.g. a manifest asset that's also the .register calling
  * script itself) is never counted twice.
+ * @property {Set<string>} widenedAssetUrls - Always present. Cleaned URLs of manifest assets whose entry has already
+ * widened `fetchStart`/`fetchEnd`/the script window, so a duplicate load of the same URL (typically cache-served,
+ * with a later `responseEnd`) can't stretch the window a second time.
  * @property {RecordManifestScriptWindowFn} recordManifestScriptWindow - Always present (seeded by
  * `getOrCreateInternals`, see `script-tracker.js`). `findScriptTimings` overrides the seeded default with one that
  * folds into the live `scriptStart`/`scriptEnd` getters instead.

package/dist/cjs/common/v2/script-tracker.js

@@ -64,6 +64,7 @@ function getOrCreateInternals(timings) {
   if (!internals) {
     internals = {
       weighedAssetUrls: new Set(),
+      widenedAssetUrls: new Set(),
       recordManifestScriptWindow: (start, end) => {
         if (start) timings.scriptStart = timings.scriptStart > 0 ? Math.min(timings.scriptStart, start) : start;
         if (end) timings.scriptEnd = timings.scriptEnd > 0 ? Math.max(timings.scriptEnd, end) : end;
@@ -112,6 +113,9 @@ if (_runtime.globalScope.MutationObserver && _runtime.globalScope.document) {
         if (node.nodeName === 'SCRIPT' && node.src) {
           const cleanedSrc = (0, _cleanUrl.cleanURL)(node.src);
           const correlation = getOrCreateCorrelation(cleanedSrc);
+          /* The first node wins, same as the performance entry below. Skipping here also means no load/error listeners
+             are attached for duplicate references. */
+          if (correlation.dom.value) return;
           correlation.dom.start = (0, _now.now)();
           correlation.dom.value = node;
           const setEnd = () => {
@@ -139,9 +143,13 @@ if (_runtime.globalScope.PerformanceObserver?.supportedEntryTypes.includes('reso
       if (validEntryCriteria(entry)) {
         const entryUrl = (0, _cleanUrl.cleanURL)(entry.name);
         const correlation = getOrCreateCorrelation(entryUrl);
-        correlation.performance.start = Math.floor(entry.startTime);
-        correlation.performance.end = Math.floor(entry.responseEnd);
-        correlation.performance.value = entry;
+        /* The first entry wins. A script referenced more than once is typically re-served from the browser cache, so a
+           later entry for the same URL would overwrite the real network timing with a near-instant one. */
+        if (!correlation.performance.value) {
+          correlation.performance.start = Math.floor(entry.startTime);
+          correlation.performance.end = Math.floor(entry.responseEnd);
+          correlation.performance.value = entry;
+        }
       }
 
       // Late-resolution subscribers can be for any asset type (not just scripts), so every entry is checked here,
@@ -295,7 +303,8 @@ function subscribeToLatePerformanceEntry(timings, mfeScriptUrl) {
 
 /**
  * Applies one manifest asset's performance entry to a timings object: weight/renderBlocking always accumulate;
- * fetchStart/fetchEnd and scriptStart/scriptEnd widen (never shrink) only when `timingMethod` calls for it; asset/
+ * fetchStart/fetchEnd and scriptStart/scriptEnd widen (never shrink) only when `timingMethod` calls for it, and only for
+ * the first entry seen per URL; asset/
  * type get anchored to the first script asset seen to resolve.
  * @param {RegisterAPITimings} timings
  * @param {PerformanceResourceTiming} entry
@@ -308,6 +317,14 @@ function applyManifestEntry(timings, entry, asset, entryState, timingMethod) {
   applyResourceWeight(timings, entry);
   if (timingMethod !== 'scripts' && timingMethod !== 'all') return; // no timing-widening effect at the 'entry' default/unset
 
+  /* Only the first entry per URL widens timing. A resource referenced more than once is typically re-served from the
+     browser cache with a later responseEnd, which would otherwise stretch fetchEnd out to the duplicate's load. */
+  const {
+    widenedAssetUrls
+  } = getOrCreateInternals(timings);
+  const url = (0, _cleanUrl.cleanURL)(entry.name);
+  if (widenedAssetUrls.has(url)) return;
+  widenedAssetUrls.add(url);
   const widensAllAssets = timingMethod === 'all';
   // Under 'scripts', only script assets widen the fetch window; under 'all', every matched asset does.
   if (widensAllAssets || asset.isScript) {
@@ -349,33 +366,45 @@ function applyManifestEntry(timings, entry, asset, entryState, timingMethod) {
 }
 
 /**
- * Subscribes to late resource timing emissions for manifest assets not yet resolved against the buffered entries.
- * Reuses the shared page-wide scriptObserver/poSubscribers mechanism (one PerformanceObserver for all MFEs, not
- * one per MFE) and, unlike that observer's own correlation bookkeeping, checks every resource entry -- not just
- * script-like ones -- so lazy-loaded images/fonts/stylesheets resolve too.
+ * Finds the manifest asset a resource entry should be credited to. An entry matching several assets is applied once;
+ * a script asset is preferred so an overlapping non-script matcher can't cause 'scripts' mode to skip a script entry.
+ * @param {import('./manifest').ParsedManifestAsset[]} assets
+ * @param {PerformanceResourceTiming} entry
+ * @returns {import('./manifest').ParsedManifestAsset|undefined}
+ */
+function findMatchingManifestAsset(assets, entry) {
+  const matches = assets.filter(asset => asset.test(entry.name));
+  return matches.find(asset => asset.isScript) || matches[0];
+}
+
+/**
+ * Subscribes to late resource timing emissions for manifest assets. Reuses the shared page-wide
+ * scriptObserver/poSubscribers mechanism (one PerformanceObserver for all MFEs, not one per MFE) and, unlike that
+ * observer's own correlation bookkeeping, checks every resource entry -- not just script-like ones -- so lazy-loaded
+ * images/fonts/stylesheets resolve too. A matcher can legitimately match many resources (e.g. a hashed-chunk RegExp),
+ * so this subscriber never reports itself as finished; it is cleared by the shared observer's expiry instead.
  * @param {RegisterAPITimings} timings
- * @param {Set<import('./manifest').ParsedManifestAsset>} pending - manifest assets still unresolved
+ * @param {import('./manifest').ParsedManifestAsset[]} assets - every manifest asset to match late entries against
  * @param {{ resolved: boolean }} entryState - shared "first script asset wins" guard for a single `applyManifestTimings` call
  * @param {'entry'|'scripts'|'all'} [timingMethod] - forwarded to `applyManifestEntry` for each late-resolving asset
  */
-function subscribeToLateManifestEntries(timings, pending, entryState, timingMethod) {
+function subscribeToLateManifestEntries(timings, assets, entryState, timingMethod) {
   if (!_runtime.globalScope.PerformanceObserver?.supportedEntryTypes?.includes('resource')) return;
   poSubscribers.push({
     addedAt: (0, _now.now)(),
     test: entry => {
-      const matched = [...pending].find(asset => asset.test(entry.name));
-      if (matched) {
-        applyManifestEntry(timings, entry, matched, entryState, timingMethod);
-        pending.delete(matched);
-      }
-      return pending.size === 0;
+      const matched = findMatchingManifestAsset(assets, entry);
+      if (matched) applyManifestEntry(timings, entry, matched, entryState, timingMethod);
+      return false;
     }
   });
 }
 
 /**
  * Applies a registered MFE's manifest to a timings object (already populated by `findScriptTimings`). No-op if no
- * manifest is present. Weight/renderBlocking always accumulate from every detected manifest asset; timing widening
+ * manifest is present. Every resource entry matching any manifest asset contributes -- an asset is not consumed by its
+ * first match, so a broad matcher (e.g. a RegExp for hashed chunks) credits all of the chunks it matches.
+ * Weight/renderBlocking always accumulate from every detected manifest asset; timing widening
  * (fetchStart/fetchEnd/scriptStart/scriptEnd/asset anchor) is opt-in via `timingMethod` -- see `applyManifestEntry`.
  * @param {RegisterAPITimings} timings - the timings object to widen in place
  * @param {RegisterAPITarget} target - the registered MFE target, which may carry a parsed `manifest`
@@ -386,16 +415,18 @@ function applyManifestTimings(timings, target) {
   const entryState = {
     resolved: false
   };
-  const pending = new Set(parsedManifest.assets);
+  const {
+    assets
+  } = parsedManifest;
   const resourceEntries = _runtime.globalScope.performance?.getEntriesByType('resource') || [];
   resourceEntries.forEach(entry => {
-    const matched = [...pending].find(asset => asset.test(entry.name));
-    if (matched) {
-      applyManifestEntry(timings, entry, matched, entryState, target.timingMethod);
-      pending.delete(matched);
-    }
+    const matched = findMatchingManifestAsset(assets, entry);
+    if (matched) applyManifestEntry(timings, entry, matched, entryState, target.timingMethod);
   });
-  if (pending.size) subscribeToLateManifestEntries(timings, pending, entryState, target.timingMethod);
+
+  // Always subscribe: assets may still match resources that load after this point, and (unlike an exact matcher) a
+  // wildcard can't know its last match has been seen.
+  subscribeToLateManifestEntries(timings, assets, entryState, target.timingMethod);
 }
 
 /**

package/dist/cjs/features/ajax/aggregate/index.js

@@ -133,10 +133,23 @@ class Aggregate extends _aggregateBase.AggregateBase {
         ...event,
         targetAttributes: (0, _utils.getVersion2Attributes)(target, this)
       });
-      if ((0, _utils.shouldDuplicate)(target, this)) this.reportContainerEvent({
-        ...event,
-        targetAttributes: (0, _utils.getVersion2DuplicationAttributes)(target, this)
-      }, ctx);
+      if ((0, _utils.shouldDuplicate)(target, this)) {
+        const duplicateEvent = {
+          ...event,
+          targetAttributes: (0, _utils.getVersion2DuplicationAttributes)(target, this)
+        };
+        /** the container-duplicate copy represents the same single real HTTP call as the MFE event above, so it
+         * needs its own independent trace/span identity -- otherwise the two would collide on the same
+         * spanId/traceId, and BELC could not create two separate Spans/Traces from them. Only the id namespace is
+         * independent; spanTimestamp is intentionally left as-is (event.spanTimestamp), since it still reflects the
+         * real call's actual timing. When `event.spanId` was never set (e.g. distributed tracing is disabled), there
+         * is no span identity to duplicate either -- both copies correctly end up with no spanId/traceId. */
+        if (event.spanId) {
+          duplicateEvent.spanId = (0, _uniqueId.generateSpanId)();
+          duplicateEvent.traceId = (0, _uniqueId.generateTraceId)();
+        }
+        this.reportContainerEvent(duplicateEvent, ctx);
+      }
     } else {
       this.reportContainerEvent(event, ctx);
     }

package/dist/cjs/features/jserrors/aggregate/index.js

@@ -22,6 +22,7 @@ var _utils = require("../../../common/v2/utils");
 var _causeString = require("./cause-string");
 var _shortCircuit = require("../../../common/util/short-circuit");
 var _events = require("../../../common/constants/events");
+var _constants2 = require("../../../common/session/constants");
 /**
  * Copyright 2020-2026 New Relic, Inc. All rights reserved.
  * SPDX-License-Identifier: Apache-2.0
@@ -50,6 +51,27 @@ class Aggregate extends _aggregateBase.AggregateBase {
     (0, _registerHandler.registerHandler)('ierr', this.processError.bind(this), this.featureName, this.ee);
     (0, _registerHandler.registerHandler)('returnJserror', (jsErrorEvent, softNavAttrs) => this.#storeJserrorForHarvest(jsErrorEvent, softNavAttrs), this.featureName, this.ee);
 
+    /*
+     * The backend only remembers a stack trace for as long as the session that first reported it.
+     * The SessionEntity emits SESSION_EVENTS.RESET whenever the session expires (max duration or
+     * inactivity) or is otherwise reset, which is the same boundary the backend uses to forget
+     * previously-seen stack hashes. Forget them here too, so the next occurrence of an
+     * already-seen error resends its full stack_trace once, instead of a browser_stack_hash the
+     * backend can no longer resolve.
+     */
+    const forgetReportedStacks = () => {
+      this.stackReported = {};
+      this.observedAt = {};
+    };
+    let currentSessionId = this.agentRef.runtime.session?.state?.value;
+    this.ee.on(_constants2.SESSION_EVENTS.RESET, forgetReportedStacks);
+    this.ee.on(_constants2.SESSION_EVENTS.UPDATE, (type, data) => {
+      if (!data?.value) return;
+      /* A reset in another tab arrived as a cross-tab update carrying a new session id. */
+      if (type === _constants2.SESSION_EVENT_TYPES.CROSS_TAB && currentSessionId && data.value !== currentSessionId) forgetReportedStacks();
+      currentSessionId = data.value; // also tracks same-tab writes, so a local reset's new id is picked up
+    });
+
     // 0 == off, 1 == on
     this.waitForFlags(['err']).then(([errFlag]) => {
       if (errFlag) {

package/dist/cjs/features/utils/aggregate-base.js

@@ -13,6 +13,7 @@ var _constants = require("../metrics/constants");
 var _eventAggregator = require("../../common/aggregate/event-aggregator");
 var _agentConstants = require("../../common/constants/agent-constants");
 var _console = require("../../common/util/console");
+var _now = require("../../common/timing/now");
 /**
  * Copyright 2020-2026 New Relic, Inc. All rights reserved.
  * SPDX-License-Identifier: Apache-2.0
@@ -33,6 +34,8 @@ class AggregateBase extends _featureBase.FeatureBase {
     this.canHarvestEarly = true;
     /** @type {Boolean} indicates if the feature is actively in a retry deferral period */
     this.isRetrying = false;
+    /** @type {number|undefined} the timestamp (ms, relative to page start) of the last early harvest triggered by this feature, if any */
+    this.lastEarlyHarvestAt = undefined;
     this.harvestOpts = {}; // features aggregate classes can define custom opts for when their harvest is called
 
     this.#setupEventStore();
@@ -88,13 +91,19 @@ class AggregateBase extends _featureBase.FeatureBase {
 
   /**
    * Evaluates whether a harvest should be made early by estimating the size of the current payload.  Currently, this only happens if the event storage is EventBuffer, since that triggers this method directly.
-   * If conditions are met, a new harvest will be triggered immediately.
+   * If conditions are met, a new harvest will be triggered immediately, unless this feature already harvested early within the last `MIN_EARLY_HARVEST_INTERVAL` ms.
+   * Data held back by that limit stays buffered until the next early, interval, or final harvest. Once the estimated payload reaches `EARLY_HARVEST_BYPASS_SIZE`
+   * the limit no longer applies, so a flood of data cannot fill the buffer to its maximum size, where new events would be dropped, while waiting.
    * @returns void
    */
   decideEarlyHarvest() {
     if (!this.canHarvestEarly || this.blocked || this.isRetrying) return;
     const estimatedSize = this.events.byteSize() + (this.customAttributesAreSeparate ? this.agentRef.runtime.jsAttributesMetadata.bytes : 0);
     if (estimatedSize > _agentConstants.IDEAL_PAYLOAD_SIZE) {
+      const currentTime = (0, _now.now)();
+      /* Bounds the request rate when a page produces data in a flood, regardless of how fast or whether requests complete. Large payloads skip the limit to avoid dropping data. */
+      if (estimatedSize < _agentConstants.EARLY_HARVEST_BYPASS_SIZE && this.lastEarlyHarvestAt !== undefined && currentTime - this.lastEarlyHarvestAt < _agentConstants.MIN_EARLY_HARVEST_INTERVAL) return;
+      this.lastEarlyHarvestAt = currentTime;
       this.agentRef.runtime.harvester.triggerHarvestFor(this);
       this.reportSupportabilityMetric("".concat(this.featureName, "/Harvest/Early/Seen"), estimatedSize);
     }

package/dist/cjs/interfaces/registered-iframe-entity.js

@@ -123,10 +123,13 @@ class RegisteredIframeEntity {
       return;
     }
 
+    /* Script timings are found by parsing the call stack for the script that called register(), so this has to run
+       synchronously here. By the time the registration promise resolves, that caller is no longer on the stack. */
+    const timings = (0, _scriptTracker.findScriptTimings)(opts);
+
     // Store the registration promise so other methods can wait for it
     this.#registrationPromise = this.#register(opts);
     this.#registrationPromise.then(() => {
-      const timings = (0, _scriptTracker.findScriptTimings)();
       // Send initial timing values, skipping ones still at their "not yet known" default
       // (e.g. reportedAt: undefined, fetchStart: 0) to avoid pointless postMessage calls
       for (const [key, value] of Object.entries(timings)) {

package/dist/esm/common/constants/agent-constants.js

@@ -5,6 +5,10 @@
 import { FEATURE_NAMES } from '../../loaders/features/features';
 export const IDEAL_PAYLOAD_SIZE = 16000;
 export const MAX_PAYLOAD_SIZE = 1000000;
+/** The minimum time (ms) between early harvests of a single feature. Data that arrives inside this window stays buffered for the next harvest. */
+export const MIN_EARLY_HARVEST_INTERVAL = 500;
+/** The estimated payload size at which a feature may harvest early even inside the minimum interval, so that a flood of data cannot fill the buffer to MAX_PAYLOAD_SIZE (and start dropping events) while waiting. */
+export const EARLY_HARVEST_BYPASS_SIZE = MAX_PAYLOAD_SIZE / 2;
 export const DEFAULT_KEY = 'NR_CONTAINER_AGENT';
 export const SESSION_ERROR = 'SESSION_ERROR';
 export const SUPPORTS_REGISTERED_ENTITIES = {

package/dist/esm/common/constants/env.cdn.js

@@ -11,7 +11,7 @@
 /**
  * Exposes the version of the agent
  */
-export const VERSION = "1.323.0";
+export const VERSION = "1.324.0-rc.1";
 
 /**
  * Exposes the build type of the agent

package/dist/esm/common/constants/env.npm.js

@@ -11,7 +11,7 @@
 /**
  * Exposes the version of the agent
  */
-export const VERSION = "1.323.0";
+export const VERSION = "1.324.0-rc.1";
 
 /**
  * Exposes the build type of the agent

package/dist/esm/common/util/attribute-size.js

@@ -1,5 +1,5 @@
 /**
- * Copyright 2020-2025 New Relic, Inc. All rights reserved.
+ * Copyright 2020-2026 New Relic, Inc. All rights reserved.
  * SPDX-License-Identifier: Apache-2.0
  */
 import { stringify } from './stringify';
@@ -11,12 +11,15 @@ export function trackObjectAttributeSize(parent, object) {
   // proxy attribute to calculate its size when changed
   parent[object] = new Proxy(originalAttribute, {
     set(target, prop, value) {
+      /* An overwrite replaces the existing entry, so its previous size must be removed first. Otherwise repeated sets of the same key inflate the count far beyond the real size. */
+      if (Object.prototype.hasOwnProperty.call(target, prop)) output.bytes -= prop.length + stringify(target[prop]).length;
       output.bytes += prop.length + stringify(value).length;
       target[prop] = value;
       return true;
     },
     deleteProperty(target, prop) {
-      output.bytes -= prop.length + stringify(target[prop]).length;
+      /* Deleting a key that was never set removes nothing, so the count must not change. */
+      if (Object.prototype.hasOwnProperty.call(target, prop)) output.bytes -= prop.length + stringify(target[prop]).length;
       return delete target[prop];
     }
   });

package/dist/esm/common/v2/manifest.js

@@ -9,7 +9,7 @@ import { single } from '../util/invoke';
 
 /**
  * @typedef {Object} AssetFile
- * @property {string|RegExp} matcher - the path/path-fragment string, or RegExp, used to match a resolved URL against this asset
+ * @property {string|RegExp} matcher - the path/path-fragment string, or RegExp, used to match a resolved URL against this asset. A matcher may match many resources (e.g. a RegExp for hashed chunks); every matching resource contributes to the MFE's `totalWeight`/`renderBlocking` and, per `timingMethod`, its timing window
  * @property {'script'|'asset'} [type] - optional override for script-capability inference. When omitted, script-capability is inferred from a
  * `.js` suffix on a string `matcher` (a RegExp `matcher` is never inferred as a script). Supply `type: 'script'` to explicitly flag an entry
  * as a script regardless of its matcher shape/suffix (e.g. an extensionless URL, or a RegExp targeting a script path), or `type: 'asset'` to

package/dist/esm/common/v2/script-tracker-types.js

@@ -16,6 +16,9 @@
  * `script-tracker.js`). Cleaned URLs already folded into `timings.totalWeight`/`timings.renderBlocking` by
  * `applyResourceWeight`, so the same underlying resource (e.g. a manifest asset that's also the .register calling
  * script itself) is never counted twice.
+ * @property {Set<string>} widenedAssetUrls - Always present. Cleaned URLs of manifest assets whose entry has already
+ * widened `fetchStart`/`fetchEnd`/the script window, so a duplicate load of the same URL (typically cache-served,
+ * with a later `responseEnd`) can't stretch the window a second time.
  * @property {RecordManifestScriptWindowFn} recordManifestScriptWindow - Always present (seeded by
  * `getOrCreateInternals`, see `script-tracker.js`). `findScriptTimings` overrides the seeded default with one that
  * folds into the live `scriptStart`/`scriptEnd` getters instead.

package/dist/esm/common/v2/script-tracker.js

@@ -54,6 +54,7 @@ function getOrCreateInternals(timings) {
   if (!internals) {
     internals = {
       weighedAssetUrls: new Set(),
+      widenedAssetUrls: new Set(),
       recordManifestScriptWindow: (start, end) => {
         if (start) timings.scriptStart = timings.scriptStart > 0 ? Math.min(timings.scriptStart, start) : start;
         if (end) timings.scriptEnd = timings.scriptEnd > 0 ? Math.max(timings.scriptEnd, end) : end;
@@ -102,6 +103,9 @@ if (globalScope.MutationObserver && globalScope.document) {
         if (node.nodeName === 'SCRIPT' && node.src) {
           const cleanedSrc = cleanURL(node.src);
           const correlation = getOrCreateCorrelation(cleanedSrc);
+          /* The first node wins, same as the performance entry below. Skipping here also means no load/error listeners
+             are attached for duplicate references. */
+          if (correlation.dom.value) return;
           correlation.dom.start = now();
           correlation.dom.value = node;
           const setEnd = () => {
@@ -129,9 +133,13 @@ if (globalScope.PerformanceObserver?.supportedEntryTypes.includes('resource')) {
       if (validEntryCriteria(entry)) {
         const entryUrl = cleanURL(entry.name);
         const correlation = getOrCreateCorrelation(entryUrl);
-        correlation.performance.start = Math.floor(entry.startTime);
-        correlation.performance.end = Math.floor(entry.responseEnd);
-        correlation.performance.value = entry;
+        /* The first entry wins. A script referenced more than once is typically re-served from the browser cache, so a
+           later entry for the same URL would overwrite the real network timing with a near-instant one. */
+        if (!correlation.performance.value) {
+          correlation.performance.start = Math.floor(entry.startTime);
+          correlation.performance.end = Math.floor(entry.responseEnd);
+          correlation.performance.value = entry;
+        }
       }
 
       // Late-resolution subscribers can be for any asset type (not just scripts), so every entry is checked here,
@@ -285,7 +293,8 @@ function subscribeToLatePerformanceEntry(timings, mfeScriptUrl) {
 
 /**
  * Applies one manifest asset's performance entry to a timings object: weight/renderBlocking always accumulate;
- * fetchStart/fetchEnd and scriptStart/scriptEnd widen (never shrink) only when `timingMethod` calls for it; asset/
+ * fetchStart/fetchEnd and scriptStart/scriptEnd widen (never shrink) only when `timingMethod` calls for it, and only for
+ * the first entry seen per URL; asset/
  * type get anchored to the first script asset seen to resolve.
  * @param {RegisterAPITimings} timings
  * @param {PerformanceResourceTiming} entry
@@ -298,6 +307,14 @@ function applyManifestEntry(timings, entry, asset, entryState, timingMethod) {
   applyResourceWeight(timings, entry);
   if (timingMethod !== 'scripts' && timingMethod !== 'all') return; // no timing-widening effect at the 'entry' default/unset
 
+  /* Only the first entry per URL widens timing. A resource referenced more than once is typically re-served from the
+     browser cache with a later responseEnd, which would otherwise stretch fetchEnd out to the duplicate's load. */
+  const {
+    widenedAssetUrls
+  } = getOrCreateInternals(timings);
+  const url = cleanURL(entry.name);
+  if (widenedAssetUrls.has(url)) return;
+  widenedAssetUrls.add(url);
   const widensAllAssets = timingMethod === 'all';
   // Under 'scripts', only script assets widen the fetch window; under 'all', every matched asset does.
   if (widensAllAssets || asset.isScript) {
@@ -339,33 +356,45 @@ function applyManifestEntry(timings, entry, asset, entryState, timingMethod) {
 }
 
 /**
- * Subscribes to late resource timing emissions for manifest assets not yet resolved against the buffered entries.
- * Reuses the shared page-wide scriptObserver/poSubscribers mechanism (one PerformanceObserver for all MFEs, not
- * one per MFE) and, unlike that observer's own correlation bookkeeping, checks every resource entry -- not just
- * script-like ones -- so lazy-loaded images/fonts/stylesheets resolve too.
+ * Finds the manifest asset a resource entry should be credited to. An entry matching several assets is applied once;
+ * a script asset is preferred so an overlapping non-script matcher can't cause 'scripts' mode to skip a script entry.
+ * @param {import('./manifest').ParsedManifestAsset[]} assets
+ * @param {PerformanceResourceTiming} entry
+ * @returns {import('./manifest').ParsedManifestAsset|undefined}
+ */
+function findMatchingManifestAsset(assets, entry) {
+  const matches = assets.filter(asset => asset.test(entry.name));
+  return matches.find(asset => asset.isScript) || matches[0];
+}
+
+/**
+ * Subscribes to late resource timing emissions for manifest assets. Reuses the shared page-wide
+ * scriptObserver/poSubscribers mechanism (one PerformanceObserver for all MFEs, not one per MFE) and, unlike that
+ * observer's own correlation bookkeeping, checks every resource entry -- not just script-like ones -- so lazy-loaded
+ * images/fonts/stylesheets resolve too. A matcher can legitimately match many resources (e.g. a hashed-chunk RegExp),
+ * so this subscriber never reports itself as finished; it is cleared by the shared observer's expiry instead.
  * @param {RegisterAPITimings} timings
- * @param {Set<import('./manifest').ParsedManifestAsset>} pending - manifest assets still unresolved
+ * @param {import('./manifest').ParsedManifestAsset[]} assets - every manifest asset to match late entries against
  * @param {{ resolved: boolean }} entryState - shared "first script asset wins" guard for a single `applyManifestTimings` call
  * @param {'entry'|'scripts'|'all'} [timingMethod] - forwarded to `applyManifestEntry` for each late-resolving asset
  */
-function subscribeToLateManifestEntries(timings, pending, entryState, timingMethod) {
+function subscribeToLateManifestEntries(timings, assets, entryState, timingMethod) {
   if (!globalScope.PerformanceObserver?.supportedEntryTypes?.includes('resource')) return;
   poSubscribers.push({
     addedAt: now(),
     test: entry => {
-      const matched = [...pending].find(asset => asset.test(entry.name));
-      if (matched) {
-        applyManifestEntry(timings, entry, matched, entryState, timingMethod);
-        pending.delete(matched);
-      }
-      return pending.size === 0;
+      const matched = findMatchingManifestAsset(assets, entry);
+      if (matched) applyManifestEntry(timings, entry, matched, entryState, timingMethod);
+      return false;
     }
   });
 }
 
 /**
  * Applies a registered MFE's manifest to a timings object (already populated by `findScriptTimings`). No-op if no
- * manifest is present. Weight/renderBlocking always accumulate from every detected manifest asset; timing widening
+ * manifest is present. Every resource entry matching any manifest asset contributes -- an asset is not consumed by its
+ * first match, so a broad matcher (e.g. a RegExp for hashed chunks) credits all of the chunks it matches.
+ * Weight/renderBlocking always accumulate from every detected manifest asset; timing widening
  * (fetchStart/fetchEnd/scriptStart/scriptEnd/asset anchor) is opt-in via `timingMethod` -- see `applyManifestEntry`.
  * @param {RegisterAPITimings} timings - the timings object to widen in place
  * @param {RegisterAPITarget} target - the registered MFE target, which may carry a parsed `manifest`
@@ -376,16 +405,18 @@ export function applyManifestTimings(timings, target) {
   const entryState = {
     resolved: false
   };
-  const pending = new Set(parsedManifest.assets);
+  const {
+    assets
+  } = parsedManifest;
   const resourceEntries = globalScope.performance?.getEntriesByType('resource') || [];
   resourceEntries.forEach(entry => {
-    const matched = [...pending].find(asset => asset.test(entry.name));
-    if (matched) {
-      applyManifestEntry(timings, entry, matched, entryState, target.timingMethod);
-      pending.delete(matched);
-    }
+    const matched = findMatchingManifestAsset(assets, entry);
+    if (matched) applyManifestEntry(timings, entry, matched, entryState, target.timingMethod);
   });
-  if (pending.size) subscribeToLateManifestEntries(timings, pending, entryState, target.timingMethod);
+
+  // Always subscribe: assets may still match resources that load after this point, and (unlike an exact matcher) a
+  // wildcard can't know its last match has been seen.
+  subscribeToLateManifestEntries(timings, assets, entryState, target.timingMethod);
 }
 
 /**