diff --git a/CHANGELOG-FRONTIER.md b/CHANGELOG-FRONTIER.md
index 4bea864366..143213a6f1 100644
--- a/CHANGELOG-FRONTIER.md
+++ b/CHANGELOG-FRONTIER.md
@@ -1,3 +1,17 @@
+## 8.17.0
+
+- Upgrade Dynatrace RUM agent to version 1.329+ and enable new RUM experience
+  - Added feature flag `frontier_snow_dynatraceNewRUM` to control RUM version selection (gradual rollout); the existing `frontier_snow_dynatraceRUM` flag still selects the loading mechanism
+  - New RUM is loaded exclusively via `<script>` tags (never inlined). This fixes a 500 error (`Could not find matching close tag for "<%"`) caused by EJS `include()` compiling the agent JS as a template — the new agent's minified code contains the `<%` sequence — and avoids re-shipping 300–460 KB on every page view
+  - Mapped each mechanism to a Dynatrace snippet format for the new RUM (treatment names kept for old-RUM compatibility):
+    - `asyncCS-script` → OneAgent JavaScript tag + SRI, loaded `async`
+    - `asyncCS-inline` → OneAgent JavaScript tag + SRI, loaded `sync` (closest analog to the old sync inline bootstrap; the new RUM has no small-bootstrap format, so this no longer inlines)
+    - `global-cdn` → JavaScript tag (`_complete.js`), loaded `async`
+  - SRI (Subresource Integrity) integrity hashes and `data-dtconfig` are emitted on the OneAgent tags; new RUM includes enhanced data collection (owasp=1, uxrgce=1)
+  - Snow can supply fresh values at runtime via `locals.dynatrace.*` (`cdnUrls`/`cdnIntegrity`/`cdnConfig`/`cdnCompleteUrls`), published to S3 as `dynatrace-rum-config.json`; publish-time fallbacks are baked into `dynatrace.ejs`
+  - `fetch-dynatrace-scripts.js` no longer fetches `/inlineCode` or writes `_inline_*_new.ejs`; old-RUM `_inline_*.ejs` bootstrap files are unchanged
+  - When the new flag is OFF: uses the existing RUM version and URLs (backward compatible)
+
 ## 8.16.1
 
 - Convert layout.ejs includes from the removed EJS preprocessor syntax (`<% include x %>`) to the function form (`<%- include('x') %>`) ahead of the company-wide EJS 3 upgrade
diff --git a/package-lock.json b/package-lock.json
index b65ca53060..091c8bbeb2 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -43779,7 +43779,7 @@
     },
     "packages/react-scripts": {
       "name": "@fs/react-scripts",
-      "version": "8.16.1",
+      "version": "8.17.0",
       "license": "MIT",
       "dependencies": {
         "@babel/core": "^7.16.0",
diff --git a/packages/react-scripts/layout/views/partials/dynatrace.ejs b/packages/react-scripts/layout/views/partials/dynatrace.ejs
index 6805ef274f..3366eba512 100644
--- a/packages/react-scripts/layout/views/partials/dynatrace.ejs
+++ b/packages/react-scripts/layout/views/partials/dynatrace.ejs
@@ -3,8 +3,11 @@
 
 if (typeof getFeatureFlag !== 'undefined') {
   const dynatraceFlag = getFeatureFlag('frontier_snow_dynatraceRUM', {appName: process.env.APP_NAME});
+  const dynatraceNewFlag = getFeatureFlag('frontier_snow_dynatraceNewRUM', {appName: process.env.APP_NAME});
   const env = envType();
+  const useNewRUM = dynatraceNewFlag.isOn;
 
+  // Old RUM version URLs
   const cdnUrls = {
     int: 'https://js-cdn.dynatrace.com/jstag/15c157a40ab/bf99293tkn/3faf90e849295814_complete.js',
     beta: 'https://js-cdn.dynatrace.com/jstag/15c157a40ab/bf99293tkn/c4242bb1eb216374_complete.js',
@@ -17,12 +20,91 @@ if (typeof getFeatureFlag !== 'undefined') {
     prod: 'https://edge.fscdn.org/assets/components/hf/assets/js/monitoring/dynatrace-20221104-prod.min-44bb9345beec8a984c2fca40385b4f41.js'
   }
 
+  // New RUM 1.329+ — Snow provides fresh values via locals.dynatrace (from CDN config file);
+  // fallback to values current at react-scripts publish time.
+  const cdnUrlsNew = (locals && locals.dynatrace && locals.dynatrace.cdnUrls) || {
+    int: 'https://js-cdn.dynatrace.com/jstag/15c157a40ab/sri/ruxitagent_ICA15789NPQRTUVXfghqrux_10341260622154106.js',
+    beta: 'https://js-cdn.dynatrace.com/jstag/15c157a40ab/sri/ruxitagent_ICA7NQVfghqrux_10341260622154106.js',
+    prod: 'https://js-cdn.dynatrace.com/jstag/15c157a40ab/sri/ruxitagent_ICA7NQVfghqrux_10341260622154106.js'
+  }
+
+  const cdnIntegrityNew = (locals && locals.dynatrace && locals.dynatrace.cdnIntegrity) || {
+    int: 'sha256-xCOvz0J22cpI/MIdcbEaVWANEPMHmZAKpeD8zTuMY/s=',
+    beta: 'sha256-eGB6PLc8ndZISmjwbbi4xZhE9nbarKf48bRKxVdha+8=',
+    prod: 'sha256-eGB6PLc8ndZISmjwbbi4xZhE9nbarKf48bRKxVdha+8='
+  }
+
+  const cdnConfigNew = (locals && locals.dynatrace && locals.dynatrace.cdnConfig) || {
+    int: 'app=3faf90e849295814|cors=1|owasp=1|featureHash=ICA15789NPQRTUVXfghqrux|msl=153600|srsr=10000|nsfnv=1|reportUrl=https://bf99293tkn.bf.dynatrace.com/bf|srvr=%5C%2Fidentity%5C%2Fsettings|rdnt=2|uxrgce=1|cuc=t0rtn87t|srms=2,1,0,0%2Ftextarea%2Cinput%2Cselect%2Coption;0%2Fdatalist;0%2Fform%20button;0%2F%5Bdata-dtrum-input%5D;0%2F.data-dtrum-input;1%2F%5Edata%28%28%5C-.%2B%24%29%7C%24%29|mel=100000|dpvc=1|md=mdcc1=cfs_anid,mdcc2=bFS.User.profile.cisId,mdcc3=bs.pageName,mdcc4=bFS.attrs.anonId,mdcc5=bFS.attrs.country,mdcc6=bFS.attrs.cisId|lastModification=1785320826721|mdp=mdcc4,mdcc5|tp=500,50,0|srbbv=2|agentUri=https://js-cdn.dynatrace.com/jstag/15c157a40ab/sri/ruxitagent_ICA15789NPQRTUVXfghqrux_10341260622154106.js',
+    beta: 'app=c4242bb1eb216374|cors=1|owasp=1|featureHash=ICA7NQVfghqrux|msl=153600|srsr=10000|nsfnv=1|reportUrl=https://bf99293tkn.bf.dynatrace.com/bf|srvr=%5C%2Fidentity%5C%2Fsettings|rdnt=2|uxrgce=1|cuc=t0rtn87t|srms=2,1,0,0%2Ftextarea%2Cinput%2Cselect%2Coption;0%2Fdatalist;0%2Fform%20button;0%2F%5Bdata-dtrum-input%5D;0%2F.data-dtrum-input;1%2F%5Edata%28%28%5C-.%2B%24%29%7C%24%29|mel=100000|dpvc=1|md=mdcc1=cfs_anid,mdcc2=bFS.attrs.cisId,mdcc3=bFS.User.profile.cisId,mdcc4=fx-ratelimit-remaining,mdcc5=bs.campaign,mdcc6=bs.channel,mdcc7=bs.pageName,mdcc8=bs.pageURL,mdcc9=bs.pageType,mdcc10=bs.visitorID|lastModification=1785320826721|tp=500,50,0|srbbv=2|agentUri=https://js-cdn.dynatrace.com/jstag/15c157a40ab/sri/ruxitagent_ICA7NQVfghqrux_10341260622154106.js',
+    prod: 'app=a8e5edd77f861ace|cors=1|owasp=1|featureHash=ICA7NQVfghqrux|msl=153600|srsr=10000|vcx=1500|nsfnv=1|reportUrl=https://bf99293tkn.bf.dynatrace.com/bf|srvr=%5C%2Fidentity%5C%2Fsettings|rdnt=2|uxrgce=1|vcit=8000|cuc=t0rtn87t|srms=2,2,1,|mdl=mdcc11=20|mel=100000|dpvc=1|md=mdcc1=cfs_anid,mdcc2=bFS.attrs.cisId,mdcc3=bFS.User.profile.cisId,mdcc4=bs.pageName,mdcc5=bs.pageType,mdcc6=bs.pageURL,mdcc7=bs.visitorID,mdcc8=bs.campaign,mdcc9=bs.channel,mdcc10=fx-ratelimit-remaining,mdcc11=bdocument.referrer,mdcc12=dutm_campaign,mdcc13=dutm_source,mdcc14=dutm_medium|lastModification=1785320826721|tp=500,50,0|srbbv=2|agentUri=https://js-cdn.dynatrace.com/jstag/15c157a40ab/sri/ruxitagent_ICA7NQVfghqrux_10341260622154106.js'
+  }
+
+  // New RUM JavaScript tag (combined code+config _complete.js) from the Dynatrace global CDN.
+  // Snow provides fresh values via locals.dynatrace.cdnCompleteUrls; fallback to publish-time values.
+  const cdnCompleteUrlsNew = (locals && locals.dynatrace && locals.dynatrace.cdnCompleteUrls) || {
+    int: 'https://js-cdn.dynatrace.com/jstag/15c157a40ab/bf99293tkn/3faf90e849295814_complete.js',
+    beta: 'https://js-cdn.dynatrace.com/jstag/15c157a40ab/bf99293tkn/c4242bb1eb216374_complete.js',
+    prod: 'https://js-cdn.dynatrace.com/jstag/15c157a40ab/bf99293tkn/a8e5edd77f861ace_complete.js'
+  }
+
+  // Old-RUM inline bootstrap include path: a small sync stub that begins capture, then async-loads
+  // the full library. The new RUM has no equivalent small-bootstrap format, so this include is used
+  // for old RUM only. (The agent JS must NOT be run through EJS include() — see below.)
+  const inlinePathOld = './partials/dynatrace/_inline_' + env;
+
+  // NOTE: the new RUM is loaded exclusively via script tags built from cdnUrlsNew / cdnConfigNew /
+  // cdnIntegrityNew / cdnCompleteUrlsNew. We deliberately do NOT include() the inline agent for the
+  // new RUM: EJS compiles included files as templates, and the new agent's minified JS contains the
+  // two-character EJS open-delimiter sequence (a less-than sign immediately followed by a percent
+  // sign) inside a character-class string, which EJS misreads as an unterminated scriptlet and
+  // fails with "Could not find matching close tag". Emitting a script tag sidesteps that entirely.
   if (dynatraceFlag.treatment === 'asyncCS-script') { %>
-    <script type="text/javascript" src="<%= edgeUrls[env] %>" crossorigin="anonymous"></script>
-    <% } else if (dynatraceFlag.treatment === 'asyncCS-inline') { %>
-    <%- include(`./partials/dynatrace/_inline_${env}`) %>
+    <% if (useNewRUM) { %>
+      <!-- New RUM: OneAgent JS tag + SRI, loaded async (non-blocking; blind window until the agent
+           downloads and executes — earliest user actions / XHRs may be missed) -->
+      <script type="text/javascript" src="<%= cdnUrlsNew[env] %>" data-dtconfig="<%= cdnConfigNew[env] %>" integrity="<%= cdnIntegrityNew[env] %>" crossorigin="anonymous" async></script>
+    <% } else { %>
+      <!-- Old RUM: load from Edge CDN asynchronously -->
+      <script type="text/javascript" src="<%= edgeUrls[env] %>" crossorigin="anonymous" async></script>
+    <% } %>
+  <% } else if (dynatraceFlag.treatment === 'asyncCS-inline') { %>
+    <% if (useNewRUM) { %>
+      <!-- New RUM: there is no small-bootstrap snippet format. The closest analog to the old sync
+           inline bootstrap is the OneAgent JS tag + SRI loaded SYNCHRONOUSLY: full early capture,
+           parse-blocks only on the first uncached load, then free on warm cache (the versioned URL is
+           cacheable up to one year). NOTE: this no longer inlines the agent — the treatment name is
+           retained for old-RUM compatibility; see DYNATRACE_RUM_UPDATE.md for the remap rationale. -->
+      <script type="text/javascript" src="<%= cdnUrlsNew[env] %>" data-dtconfig="<%= cdnConfigNew[env] %>" integrity="<%= cdnIntegrityNew[env] %>" crossorigin="anonymous"></script>
+    <% } else { %>
+      <!-- Old RUM: small inline bootstrap that begins capture then async-loads the full library -->
+      <%- include(inlinePathOld) %>
+    <% } %>
   <% } else if (dynatraceFlag.treatment === 'global-cdn') { %>
+    <% if (useNewRUM) { %>
+      <!-- New RUM: JavaScript tag (combined code+config _complete.js) from the Dynatrace global CDN,
+           loaded async (single request; the combined file is cached ~1 hour) -->
+      <script type="text/javascript" src="<%= cdnCompleteUrlsNew[env] %>" crossorigin="anonymous" async></script>
+    <% } else { %>
+      <!-- Old RUM: combined _complete.js from the Dynatrace global CDN (synchronous) -->
       <script type="text/javascript" src="<%= cdnUrls[env] %>" crossorigin="anonymous"></script>
+    <% } %>
   <% } %>
-
+  <script type="text/javascript">
+    // Report the RUM loading mechanism once the agent is available. For the async treatments
+    // window.dtrum isn't defined yet when this inline script runs, so poll briefly rather than
+    // firing once and silently dropping the signal (which lost it for asyncCS-script/global-cdn).
+    (function () {
+      if (typeof window === 'undefined') return;
+      var treatment = "<%= dynatraceFlag.treatment %>";
+      var attempts = 0;
+      (function report() {
+        if (window.dtrum && typeof window.dtrum.sendSessionProperties === 'function') {
+          window.dtrum.sendSessionProperties({rum_loading_mechanism: treatment});
+        } else if (++attempts <= 50) {
+          setTimeout(report, 200); // up to ~10s for the async agent to load
+        }
+      })();
+    })();
+  </script>
 <% } %>
diff --git a/packages/react-scripts/package.json b/packages/react-scripts/package.json
index 98f1328c8a..aaff449610 100644
--- a/packages/react-scripts/package.json
+++ b/packages/react-scripts/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@fs/react-scripts",
-  "version": "8.16.1",
+  "version": "8.17.0",
   "upstreamVersion": "5.0.1",
   "description": "Configuration and scripts for Create React App.",
   "repository": {
diff --git a/packages/react-scripts/scripts/DYNATRACE_RUM_UPDATE.md b/packages/react-scripts/scripts/DYNATRACE_RUM_UPDATE.md
new file mode 100644
index 0000000000..4885b1a3c3
--- /dev/null
+++ b/packages/react-scripts/scripts/DYNATRACE_RUM_UPDATE.md
@@ -0,0 +1,177 @@
+# Updating Dynatrace RUM Scripts
+
+This guide explains how to update the Dynatrace RUM agent to a new version using the automated fetch script.
+
+## Quick Start
+
+```bash
+export DYNATRACE_API_TOKEN="your-api-token"
+node packages/react-scripts/scripts/fetch-dynatrace-scripts.js
+```
+
+The script will fetch the latest RUM scripts and CDN URLs for all three environments (int, beta, prod).
+
+## Prerequisites
+
+### 1. Get a Dynatrace API Token
+
+1. Log into your Dynatrace environment: https://bjm35087.live.dynatrace.com
+2. Go to Account → Access Tokens
+3. Create a new API token with these scopes:
+   - **Read RUM manual insertion tags** (API v2) - for fetching scripts
+   - **Real user monitoring JavaScript tag management** (API v1) - optional, for additional RUM data
+
+### 2. Know Your Entity IDs
+
+The script uses these default entity IDs:
+- **Int**: `APPLICATION-3FAF90E849295814`
+- **Beta**: `APPLICATION-C4242BB1EB216374`
+- **Prod**: `APPLICATION-A8E5EDD77F861ACE`
+
+To find entity IDs yourself:
+1. Log into Dynatrace
+2. Go to Applications → select your app → Settings
+3. The entity ID is shown in the URL or settings page
+
+## How to Use
+
+### Step 1: Fetch the Latest Scripts
+
+```bash
+export DYNATRACE_API_TOKEN="your-token-here"
+node packages/react-scripts/scripts/fetch-dynatrace-scripts.js
+```
+
+The script will:
+1. ✅ **Update the new-RUM fallback values** in `dynatrace.ejs` (`cdnUrlsNew`, `cdnIntegrityNew`, `cdnConfigNew`, `cdnCompleteUrlsNew`)
+2. ✅ **Write & publish** `dynatrace-rum-config.json` to S3 so Snow can supply fresh values via `locals.dynatrace.*` without a react-scripts redeploy
+3. 🔒 **Capture the SRI integrity hashes** and `data-dtconfig` for each environment
+
+> **The new RUM agent is never inlined.** The script no longer fetches `/inlineCode` or writes `_inline_*_new.ejs` files. Reason: EJS `include()` compiles the included file as a template, and the new agent's minified JS contains the two-character EJS open-delimiter sequence (a `<` immediately followed by a `%`) inside a string, which EJS misreads as an unterminated scriptlet ("Could not find matching close tag"). It also re-ships 300–460 KB on every page view. The new RUM loads exclusively via `<script>` tags. The old-RUM `_inline_*.ejs` bootstrap files are unaffected.
+
+### Step 2: Verify the updated values in dynatrace.ejs
+
+The script updates `dynatrace.ejs` **automatically** (see Step 1) — there is nothing to copy by hand. It rewrites four per-environment fallback objects, and the values differ per environment: `int` uses a different feature hash than `beta`/`prod`, so its integrity hash and `data-dtconfig` differ too (there is **no** single integrity hash shared across environments).
+
+```javascript
+const cdnUrlsNew         = (locals && locals.dynatrace && locals.dynatrace.cdnUrls)         || { int: '…', beta: '…', prod: '…' }
+const cdnIntegrityNew    = (locals && locals.dynatrace && locals.dynatrace.cdnIntegrity)    || { int: 'sha256-…', beta: 'sha256-…', prod: 'sha256-…' }
+const cdnConfigNew       = (locals && locals.dynatrace && locals.dynatrace.cdnConfig)       || { int: '…', beta: '…', prod: '…' }
+const cdnCompleteUrlsNew = (locals && locals.dynatrace && locals.dynatrace.cdnCompleteUrls) || { int: '…', beta: '…', prod: '…' }
+```
+
+To confirm, run `git diff` on `dynatrace.ejs` and check that all three environments show the new agent version. The script also prints the downloaded agent version and each environment's CDN URL / integrity / config to stdout for reference.
+
+### Step 3: Test All Mechanisms
+
+Two flags drive the experiment (see [dynatrace.ejs](./partials/dynatrace.ejs)):
+
+- **`frontier_snow_dynatraceRUM`**: Selects the loading mechanism (`asyncCS-script`, `asyncCS-inline`, or `global-cdn`)
+- **`frontier_snow_dynatraceNewRUM`**: Selects the RUM version (old or new)
+
+#### Treatment → snippet-format mapping
+
+The three treatment names are **fixed** (apps still on old RUM depend on them), so for the new RUM we remap each treatment to a Dynatrace snippet format. This is intentional and documented here.
+
+| Treatment | Old RUM (unchanged) | New RUM | Why |
+|---|---|---|---|
+| `asyncCS-script` | Edge CDN `<script async>` | **OneAgent JS tag + SRI, `async`** | Non-blocking; 1-year cached, integrity-verified. Measures the early-capture "blind window." |
+| `asyncCS-inline` | small inline bootstrap (`_inline_*.ejs`) | **OneAgent JS tag + SRI, `sync`** | New RUM has **no small-bootstrap format**; the sync SRI tag is the closest analog (full early capture; parse-blocks only on first uncached load, free on warm cache). **No longer inlines.** |
+| `global-cdn` | `_complete.js` (sync) | **JavaScript tag (`_complete.js`), `async`** | Combined code+config, single request, ~1-hour cache. The caching-strategy comparison point. |
+
+`defer` is intentionally not tested: for a monitoring agent it strictly enlarges the un-instrumented early window for a negligible page-speed gain over `async`.
+
+What to verify per treatment (DevTools → Network / Elements):
+
+```text
+asyncCS-script (new) → <script src=".../sri/ruxitagent_…js" data-dtconfig integrity … async>
+asyncCS-inline (new) → same SRI tag but WITHOUT async (synchronous)
+global-cdn     (new) → <script src=".../{appId}_complete.js" async>   (no integrity/data-dtconfig; config is baked in)
+```
+
+To gauge data loss between sync/async, compare RUM aggregates across treatments (user actions per session, captured XHR/fetch actions, JS error capture rate, and CWV) — or run a synthetic page that fires an early click + XHR + error and confirm each is captured under sync vs async.
+
+### Step 4: Commit and Release
+
+```bash
+# Stage changes (dynatrace.ejs fallback values are auto-updated by the fetch script)
+git add packages/react-scripts/layout/views/partials/dynatrace.ejs
+
+# Commit with descriptive message
+git commit -m "Update Dynatrace RUM to latest version
+
+- Update new-RUM fallback values (cdnUrls/cdnIntegrity/cdnConfig/cdnCompleteUrls) via fetch-dynatrace-scripts.js
+- Republish dynatrace-rum-config.json to S3
+- New RUM version includes enhanced data collection (owasp=1, uxrgce=1)"
+
+# Bump version in package.json (usually minor bump)
+# Example: 8.16.0 → 8.17.0
+sed -i '' 's/"version": "8\.16\.0"/"version": "8.17.0"/' packages/react-scripts/package.json
+
+# Update CHANGELOG-FRONTIER.md
+# Add entry at the top with the new version and upgrade details
+
+# Commit version and changelog
+git add packages/react-scripts/package.json CHANGELOG-FRONTIER.md
+git commit -m "Bump react-scripts to 8.17.0 with Dynatrace RUM upgrade"
+
+# Push when ready
+git push origin dynatrace-rum-upgrade
+```
+
+## Understanding the Output
+
+The API returns complete script tags like:
+
+```html
+<script type="text/javascript" 
+  src="https://js-cdn.dynatrace.com/jstag/15c157a40ab/sri/ruxitagent_ICA7NQVfghqrux_10337260504112723.js" 
+  data-dtconfig="app=3faf90e849295814|..." 
+  integrity="sha256-6PrnNTp1/05LJTqnB9OOhKEVMId1XHk4Xa1x3cPF2Ec=" 
+  crossorigin="anonymous">
+</script>
+```
+
+Key parts:
+- **`src`**: The CDN URL for the external script
+- **`data-dtconfig`**: Configuration string (includes app ID, parameters, etc.)
+- **`integrity`**: SRI hash for script verification
+- **app ID**: The environment-specific application identifier (e.g., `app=3faf90e849295814`)
+
+## Files Modified During Update
+
+```
+packages/react-scripts/layout/views/partials/dynatrace.ejs   (fallback values auto-updated)
+packages/react-scripts/scripts/dynatrace-rum-config.json     (regenerated; also published to S3)
+packages/react-scripts/package.json (version bump)
+CHANGELOG-FRONTIER.md (add entry)
+```
+
+> Note: the new RUM does **not** generate `_inline_*_new.ejs` files (the agent is loaded via `<script>` tags, never inlined). The old-RUM `_inline_*.ejs` bootstrap files remain and are not touched by this script.
+
+## Troubleshooting
+
+**API returns 401 Unauthorized**
+- Check that `DYNATRACE_API_TOKEN` environment variable is set
+- Verify the token has the correct scopes (RUM manual insertion tags read)
+
+**API returns 400 Bad Request**
+- Ensure entity IDs include the `APPLICATION-` prefix
+- Entity IDs must be uppercase
+
+**API returns 404 Not Found**
+- Verify the API endpoint URL is correct: `/api/v2/rum/oneAgentJavaScriptTagWithSri/{entityId}`
+- Check that you're using the `.live.dynatrace.com` domain, not `.apps.dynatrace.com`
+
+## Related Documentation
+
+- [Dynatrace RUM API Documentation](https://docs.dynatrace.com/docs/dynatrace-api/environment-api/rum/rum-manual-insertion-tags)
+- [dynatrace.ejs](./partials/dynatrace.ejs) - Main RUM configuration file
+- [fetch-dynatrace-scripts.js](./fetch-dynatrace-scripts.js) - The fetch script itself
+
+## Version History
+
+- **8.17.0**: First release with dual-flag support (old vs new RUM version)
+  - Introduced `frontier_snow_dynatraceNewRUM` feature flag for gradual rollout
+  - Updated to RUM 1.329+ with enhanced data collection (owasp=1, uxrgce=1)
+  - Added SRI integrity hash support
diff --git a/packages/react-scripts/scripts/dynatrace-rum-config.json b/packages/react-scripts/scripts/dynatrace-rum-config.json
new file mode 100644
index 0000000000..0134131fd6
--- /dev/null
+++ b/packages/react-scripts/scripts/dynatrace-rum-config.json
@@ -0,0 +1,23 @@
+{
+  "generated": "2026-07-29T12:55:34.341Z",
+  "cdnUrls": {
+    "int": "https://js-cdn.dynatrace.com/jstag/15c157a40ab/sri/ruxitagent_ICA15789NPQRTUVXfghqrux_10341260622154106.js",
+    "beta": "https://js-cdn.dynatrace.com/jstag/15c157a40ab/sri/ruxitagent_ICA7NQVfghqrux_10341260622154106.js",
+    "prod": "https://js-cdn.dynatrace.com/jstag/15c157a40ab/sri/ruxitagent_ICA7NQVfghqrux_10341260622154106.js"
+  },
+  "cdnIntegrity": {
+    "int": "sha256-xCOvz0J22cpI/MIdcbEaVWANEPMHmZAKpeD8zTuMY/s=",
+    "beta": "sha256-eGB6PLc8ndZISmjwbbi4xZhE9nbarKf48bRKxVdha+8=",
+    "prod": "sha256-eGB6PLc8ndZISmjwbbi4xZhE9nbarKf48bRKxVdha+8="
+  },
+  "cdnConfig": {
+    "int": "app=3faf90e849295814|cors=1|owasp=1|featureHash=ICA15789NPQRTUVXfghqrux|msl=153600|srsr=10000|nsfnv=1|reportUrl=https://bf99293tkn.bf.dynatrace.com/bf|srvr=%5C%2Fidentity%5C%2Fsettings|rdnt=2|uxrgce=1|cuc=t0rtn87t|srms=2,1,0,0%2Ftextarea%2Cinput%2Cselect%2Coption;0%2Fdatalist;0%2Fform%20button;0%2F%5Bdata-dtrum-input%5D;0%2F.data-dtrum-input;1%2F%5Edata%28%28%5C-.%2B%24%29%7C%24%29|mel=100000|dpvc=1|md=mdcc1=cfs_anid,mdcc2=bFS.User.profile.cisId,mdcc3=bs.pageName,mdcc4=bFS.attrs.anonId,mdcc5=bFS.attrs.country,mdcc6=bFS.attrs.cisId|lastModification=1785320826721|mdp=mdcc4,mdcc5|tp=500,50,0|srbbv=2|agentUri=https://js-cdn.dynatrace.com/jstag/15c157a40ab/sri/ruxitagent_ICA15789NPQRTUVXfghqrux_10341260622154106.js",
+    "beta": "app=c4242bb1eb216374|cors=1|owasp=1|featureHash=ICA7NQVfghqrux|msl=153600|srsr=10000|nsfnv=1|reportUrl=https://bf99293tkn.bf.dynatrace.com/bf|srvr=%5C%2Fidentity%5C%2Fsettings|rdnt=2|uxrgce=1|cuc=t0rtn87t|srms=2,1,0,0%2Ftextarea%2Cinput%2Cselect%2Coption;0%2Fdatalist;0%2Fform%20button;0%2F%5Bdata-dtrum-input%5D;0%2F.data-dtrum-input;1%2F%5Edata%28%28%5C-.%2B%24%29%7C%24%29|mel=100000|dpvc=1|md=mdcc1=cfs_anid,mdcc2=bFS.attrs.cisId,mdcc3=bFS.User.profile.cisId,mdcc4=fx-ratelimit-remaining,mdcc5=bs.campaign,mdcc6=bs.channel,mdcc7=bs.pageName,mdcc8=bs.pageURL,mdcc9=bs.pageType,mdcc10=bs.visitorID|lastModification=1785320826721|tp=500,50,0|srbbv=2|agentUri=https://js-cdn.dynatrace.com/jstag/15c157a40ab/sri/ruxitagent_ICA7NQVfghqrux_10341260622154106.js",
+    "prod": "app=a8e5edd77f861ace|cors=1|owasp=1|featureHash=ICA7NQVfghqrux|msl=153600|srsr=10000|vcx=1500|nsfnv=1|reportUrl=https://bf99293tkn.bf.dynatrace.com/bf|srvr=%5C%2Fidentity%5C%2Fsettings|rdnt=2|uxrgce=1|vcit=8000|cuc=t0rtn87t|srms=2,2,1,|mdl=mdcc11=20|mel=100000|dpvc=1|md=mdcc1=cfs_anid,mdcc2=bFS.attrs.cisId,mdcc3=bFS.User.profile.cisId,mdcc4=bs.pageName,mdcc5=bs.pageType,mdcc6=bs.pageURL,mdcc7=bs.visitorID,mdcc8=bs.campaign,mdcc9=bs.channel,mdcc10=fx-ratelimit-remaining,mdcc11=bdocument.referrer,mdcc12=dutm_campaign,mdcc13=dutm_source,mdcc14=dutm_medium|lastModification=1785320826721|tp=500,50,0|srbbv=2|agentUri=https://js-cdn.dynatrace.com/jstag/15c157a40ab/sri/ruxitagent_ICA7NQVfghqrux_10341260622154106.js"
+  },
+  "cdnCompleteUrls": {
+    "int": "https://js-cdn.dynatrace.com/jstag/15c157a40ab/bf99293tkn/3faf90e849295814_complete.js",
+    "beta": "https://js-cdn.dynatrace.com/jstag/15c157a40ab/bf99293tkn/c4242bb1eb216374_complete.js",
+    "prod": "https://js-cdn.dynatrace.com/jstag/15c157a40ab/bf99293tkn/a8e5edd77f861ace_complete.js"
+  }
+}
\ No newline at end of file
diff --git a/packages/react-scripts/scripts/fetch-dynatrace-scripts.js b/packages/react-scripts/scripts/fetch-dynatrace-scripts.js
new file mode 100755
index 0000000000..3d26ffd705
--- /dev/null
+++ b/packages/react-scripts/scripts/fetch-dynatrace-scripts.js
@@ -0,0 +1,414 @@
+#!/usr/bin/env node
+/**
+ * Dynatrace RUM Script Fetcher
+ *
+ * Fetches the latest RUM inline scripts and tags from Dynatrace using the API.
+ * Automatically updates inline script files, dynatrace.ejs fallbacks, and publishes
+ * dynatrace-rum-config.json to S3 for Snow to consume.
+ *
+ * Requires:
+ *   - Dynatrace API token with "Read RUM manual insertion tags" scope
+ *   - AWS CLI configured with S3 write access to the CDN bucket
+ *
+ * IMPORTANT: Dynatrace API may not be available on all instances.
+ * If unavailable, fetch scripts manually from:
+ *   Dynatrace UI → Settings → Real User Monitoring → Managed JavaScript
+ *
+ * Usage:
+ *   node fetch-dynatrace-scripts.js                        # reads token from keychain
+ *   DYNATRACE_API_TOKEN="xxx" node fetch-dynatrace-scripts.js  # override for one run
+ *
+ * Setup (one-time):
+ *   1. Store Dynatrace API token in keychain:
+ *      security add-generic-password -a dynatrace-rum-fetch -s dynatrace-rum-fetch -w
+ *
+ *   2. Configure AWS CLI (uses standard AWS credential chain):
+ *      aws configure          # or set AWS_ACCESS_KEY_ID + AWS_SECRET_ACCESS_KEY env vars
+ *      aws s3 ls              # verify you have S3 access
+ *
+ * Configuration:
+ *   - Dynatrace token: auto-read from keychain; override with DYNATRACE_API_TOKEN
+ *   - AWS credentials: read via AWS CLI (no keychain needed; uses ~/.aws/credentials or env vars)
+ *   - S3 bucket/region: set via S3_PUBLISH_BUCKET and S3_PUBLISH_REGION env vars
+ *   - Dynatrace/Entity IDs: set via DYNATRACE_ENV_URL and *_ENTITY_ID env vars
+ *
+ * API Documentation:
+ *   https://docs.dynatrace.com/docs/dynatrace-api/environment-api/rum/rum-manual-insertion-tags
+ */
+
+const https = require('https');
+const fs = require('fs');
+const path = require('path');
+const { execSync } = require('child_process');
+
+const KEYCHAIN_ACCOUNT = 'dynatrace-rum-fetch';
+const KEYCHAIN_SERVICE_DYNATRACE = 'dynatrace-rum-fetch';
+const KEYCHAIN_SERVICE_S3 = 's3-publish-key';
+
+function getKeychainSecret(service) {
+  try {
+    const secret = execSync(
+      `security find-generic-password -a "${KEYCHAIN_ACCOUNT}" -s "${service}" -w`,
+      { stdio: ['pipe', 'pipe', 'pipe'] }
+    ).toString().trim();
+    return secret || null;
+  } catch (error) {
+    return null;
+  }
+}
+
+function printKeychainSetupInstructions() {
+  console.error(`
+ERROR: No Dynatrace API token found in keychain.
+
+To store your Dynatrace token (one-time setup):
+
+  security add-generic-password \\
+    -a "${KEYCHAIN_ACCOUNT}" \\
+    -s "${KEYCHAIN_SERVICE_DYNATRACE}" \\
+    -w
+
+You'll be prompted to enter the token (won't appear in shell history).
+
+To get a Dynatrace token:
+  1. Log into https://bjm35087.live.dynatrace.com
+  2. Go to Account → Access Tokens → Generate new token
+  3. Add scope: "Read RUM manual insertion tags"
+  4. Paste the token when prompted above
+
+To update an existing token:
+  security delete-generic-password -a "${KEYCHAIN_ACCOUNT}" -s "${KEYCHAIN_SERVICE_DYNATRACE}"
+  security add-generic-password -a "${KEYCHAIN_ACCOUNT}" -s "${KEYCHAIN_SERVICE_DYNATRACE}" -w
+
+For AWS S3 access (used for publishing config):
+  Ensure AWS CLI is configured with credentials:
+    aws configure
+  Or set environment variables:
+    export AWS_ACCESS_KEY_ID="your-key"
+    export AWS_SECRET_ACCESS_KEY="your-secret"
+
+Or override Dynatrace token for a single run:
+  DYNATRACE_API_TOKEN="dt0c01.xxx" node fetch-dynatrace-scripts.js
+`);
+}
+
+// Configuration
+const DYNATRACE_ENVIRONMENT_URL = process.env.DYNATRACE_ENV_URL || "https://bjm35087.live.dynatrace.com";
+const DYNATRACE_API_TOKEN = process.env.DYNATRACE_API_TOKEN || getKeychainSecret(KEYCHAIN_SERVICE_DYNATRACE);
+
+// S3 CDN configuration (for publishing dynatrace-rum-config.json via AWS CLI)
+const S3_PUBLISH_BUCKET = process.env.S3_PUBLISH_BUCKET || "fs-cdn2-origin/assets/dynatrace";
+const S3_PUBLISH_REGION = process.env.S3_PUBLISH_REGION || "us-east-1";
+// AWS auth uses the standard credential chain. The `aws` child processes below inherit this
+// process's env, so select a profile the normal AWS way — no script-specific env var needed:
+//   aws sso login --profile frontier-admin
+//   export AWS_PROFILE=frontier-admin     (or run inline: AWS_PROFILE=frontier-admin node ...)
+
+// Entity IDs for your RUM applications in each environment
+// Get from Dynatrace UI: Applications → select app → Settings → note the entity ID
+const ENTITY_IDS = {
+  int: process.env.INT_ENTITY_ID || "APPLICATION-3FAF90E849295814",
+  beta: process.env.BETA_ENTITY_ID || "APPLICATION-C4242BB1EB216374",
+  prod: process.env.PROD_ENTITY_ID || "APPLICATION-A8E5EDD77F861ACE",
+};
+
+function parseUrl(urlString) {
+  const url = new URL(urlString);
+  return {
+    hostname: url.hostname,
+    path: url.pathname.replace(/\/$/, ''),
+  };
+}
+
+async function makeRequest(hostname, path) {
+  return new Promise((resolve, reject) => {
+    const options = {
+      hostname,
+      path,
+      method: 'GET',
+      headers: {
+        'Authorization': `Api-Token ${DYNATRACE_API_TOKEN}`,
+        'Content-Type': 'application/json',
+      },
+    };
+
+    https.request(options, (res) => {
+      let data = '';
+      res.on('data', chunk => data += chunk);
+      res.on('end', () => {
+        if (res.statusCode >= 200 && res.statusCode < 300) {
+          resolve(data);
+        } else {
+          reject(`HTTP ${res.statusCode}: ${data}`);
+        }
+      });
+    }).on('error', reject).end();
+  });
+}
+
+function extractEnvValues(results) {
+  const envs = Object.keys(results);
+  return {
+    cdnUrls: Object.fromEntries(envs.map(env => [
+      env, results[env].completeTag.match(/src="([^"]+)"/)?.[1] || ''
+    ])),
+    cdnIntegrity: Object.fromEntries(envs.map(env => [
+      env, results[env].completeTag.match(/integrity="([^"]+)"/)?.[1] || ''
+    ])),
+    cdnConfig: Object.fromEntries(envs.map(env => [
+      env, results[env].completeTag.match(/data-dtconfig="([^"]+)"/)?.[1] || ''
+    ])),
+    // Combined code+config file (the "JavaScript tag" _complete.js) used by the global-cdn treatment.
+    cdnCompleteUrls: Object.fromEntries(envs.map(env => [
+      env, results[env].simpleTag.match(/src="([^"]+)"/)?.[1] || ''
+    ])),
+  };
+}
+
+// Parse the Dynatrace agent version — the trailing number in ruxitagent_<hash>_<version>.js —
+// from each environment's tag, e.g. ...ruxitagent_ICA7NQVfghqrux_10341260622154106.js → 10341260622154106.
+function extractAgentVersions(results) {
+  return Object.fromEntries(Object.keys(results).map(env => {
+    const src = results[env].completeTag.match(/src="([^"]+)"/)?.[1] || '';
+    const version = src.match(/ruxitagent_[A-Za-z0-9]+_(\d+)\.js/)?.[1] || 'unknown';
+    return [env, version];
+  }));
+}
+
+function updateDynatraceEjs(results) {
+  const ejsPath = path.join(__dirname, '../layout/views/partials/dynatrace.ejs');
+  let content = fs.readFileSync(ejsPath, 'utf8');
+  const values = extractEnvValues(results);
+
+  // Rewrite the hardcoded fallback object inside a
+  //   const <name> = (locals && locals.dynatrace && locals.dynatrace.<localsKey>) || { ... }
+  // block, preserving the locals-first progressive-enhancement guard.
+  const replaceFallback = (name, localsKey, map) => {
+    const lines = Object.entries(map).map(([env, v]) => `    ${env}: '${v}'`).join(',\n');
+    const re = new RegExp(
+      `const ${name} = \\(locals && locals\\.dynatrace && locals\\.dynatrace\\.${localsKey}\\) \\|\\| \\{[^}]+\\}`,
+      's'
+    );
+    if (!re.test(content)) {
+      console.warn(`   ⚠️  Could not find ${name} fallback block in dynatrace.ejs — skipped`);
+      return;
+    }
+    const replacement = `const ${name} = (locals && locals.dynatrace && locals.dynatrace.${localsKey}) || {\n${lines}\n  }`;
+    // Use a function replacement so '$' in values is not treated as a substitution token.
+    content = content.replace(re, () => replacement);
+  };
+
+  replaceFallback('cdnUrlsNew', 'cdnUrls', values.cdnUrls);
+  replaceFallback('cdnIntegrityNew', 'cdnIntegrity', values.cdnIntegrity);
+  replaceFallback('cdnConfigNew', 'cdnConfig', values.cdnConfig);
+  replaceFallback('cdnCompleteUrlsNew', 'cdnCompleteUrls', values.cdnCompleteUrls);
+
+  fs.writeFileSync(ejsPath, content, 'utf8');
+  console.log("   ✅ Updated dynatrace.ejs fallback values");
+}
+
+function writeCdnConfigJson(results) {
+  const values = extractEnvValues(results);
+  const config = {
+    generated: new Date().toISOString(),
+    ...values,
+  };
+  const configPath = path.join(__dirname, 'dynatrace-rum-config.json');
+  fs.writeFileSync(configPath, JSON.stringify(config, null, 2), 'utf8');
+  console.log("   ✅ Wrote dynatrace-rum-config.json");
+  return config;
+}
+
+function printAwsSetupInstructions() {
+  const active = process.env.AWS_PROFILE || "";
+  console.error(`
+AWS credentials are missing or expired${active ? ` for profile "${active}"` : " (no profile set — using the default credential chain)"}.
+
+This script publishes dynatrace-rum-config.json to s3://${S3_PUBLISH_BUCKET} and needs S3 write access.
+
+If your org uses AWS SSO (FamilySearch does), run:
+  export AWS_PROFILE=frontier-admin      # so this script's aws calls use that profile
+  aws sso login                          # refresh the SSO session (opens a browser)
+  # ...then re-run this script
+
+Or pin the profile for a single run without exporting it:
+  AWS_PROFILE=frontier-admin node packages/react-scripts/scripts/fetch-dynatrace-scripts.js
+
+Verify your identity any time:
+  aws sts get-caller-identity${active ? ` --profile ${active}` : " --profile frontier-admin"}
+
+(For static keys instead of SSO: run 'aws configure', or set AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY.)
+`);
+}
+
+// Preflight: confirm AWS credentials resolve before doing any Dynatrace work, so we fail
+// fast with actionable guidance instead of after fetching everything (publish is the last step).
+function checkAwsCredentials() {
+  if (!process.env.AWS_PROFILE) {
+    console.warn(
+      "   ⚠️  AWS_PROFILE is not set — falling back to the default credential chain.\n" +
+      "       In this setup the default profile has no credentials, so the S3 publish will\n" +
+      "       likely fail. Set it first:  export AWS_PROFILE=frontier-admin\n" +
+      "       (after: aws sso login --profile frontier-admin)"
+    );
+  }
+  try {
+    const out = execSync(`aws sts get-caller-identity --output json`, {
+      stdio: ['pipe', 'pipe', 'pipe'],
+    }).toString();
+    const id = JSON.parse(out);
+    const profileNote = process.env.AWS_PROFILE || "";
+    console.log(`   ✅ AWS credentials OK — account ${id.Account}${profileNote ? `, profile ${profileNote}` : ""}`);
+    return true;
+  } catch (error) {
+    printAwsSetupInstructions();
+    return false;
+  }
+}
+
+async function publishToS3(config) {
+  const tempFile = path.join(__dirname, '.dynatrace-rum-config-temp.json');
+  try {
+    fs.writeFileSync(tempFile, JSON.stringify(config), 'utf8');
+
+    // Use AWS CLI for S3 upload (inherits this process's env → honors AWS_PROFILE / default chain)
+    const awsCmd = `aws s3 cp "${tempFile}" s3://${S3_PUBLISH_BUCKET}/dynatrace-rum-config.json --region ${S3_PUBLISH_REGION} --metadata "generated=$(date +%s)" --cache-control "max-age=300" --acl public-read`;
+
+    execSync(awsCmd, { stdio: 'inherit' });
+
+    console.log(`   ✅ Published dynatrace-rum-config.json to S3 (s3://${S3_PUBLISH_BUCKET}/dynatrace-rum-config.json)`);
+  } catch (error) {
+    console.error(`   ❌ Failed to publish to S3: ${error.message}`);
+    printAwsSetupInstructions();
+    throw error;
+  } finally {
+    // Always remove the temp file, even if the upload failed.
+    try { fs.unlinkSync(tempFile); } catch (_) { /* already gone */ }
+  }
+}
+
+async function fetchScripts() {
+  if (!DYNATRACE_API_TOKEN) {
+    printKeychainSetupInstructions();
+    process.exit(1);
+  }
+
+  const missingIds = Object.entries(ENTITY_IDS)
+    .filter(([, id]) => !id)
+    .map(([env]) => env);
+
+  if (missingIds.length > 0) {
+    console.error(`ERROR: Missing entity IDs for: ${missingIds.join(", ")}`);
+    console.error("Set environment variables: INT_ENTITY_ID, BETA_ENTITY_ID, PROD_ENTITY_ID");
+    process.exit(1);
+  }
+
+  // Preflight AWS creds up front — publishing to S3 is the last step, and the Dynatrace
+  // fetch is wasted work if we can't publish. Fail fast with setup guidance instead.
+  console.log("Checking AWS credentials...");
+  if (!checkAwsCredentials()) {
+    process.exit(1);
+  }
+
+  try {
+    const { hostname, path: basePath } = parseUrl(DYNATRACE_ENVIRONMENT_URL);
+    console.log("Fetching Dynatrace RUM scripts...\n");
+
+    const results = {};
+
+    for (const [env, entityId] of Object.entries(ENTITY_IDS)) {
+      console.log(`📥 Fetching ${env.toUpperCase()} environment (entity: ${entityId})...`);
+
+      try {
+        // Fetch simple JavaScript tag (basic, no SRI)
+        const simplePath = `${basePath}/api/v2/rum/javaScriptTag/${entityId}`;
+        const simpleResponse = await makeRequest(hostname, simplePath);
+
+        // Fetch OneAgent JavaScript tag with SRI (for CDN URL, config, integrity hash)
+        const tagPath = `${basePath}/api/v2/rum/oneAgentJavaScriptTagWithSri/${entityId}`;
+        const tagResponse = await makeRequest(hostname, tagPath);
+
+        // NOTE: we intentionally no longer fetch /inlineCode. The new RUM agent is loaded via
+        // <script> tags (SRI tag or _complete.js), never inlined: EJS include() compiles the agent
+        // JS as a template and chokes on the literal "<%" inside it. See dynatrace.ejs.
+        results[env] = {
+          simpleTag: simpleResponse.trim(),
+          completeTag: tagResponse.trim(),
+        };
+
+        console.log(`   ✅ Simple tag fetched (${simpleResponse.length} chars)`);
+        console.log(`   ✅ Complete tag fetched (${tagResponse.length} chars)`);
+
+        // Extract CDN URL from both simple and complete tags
+        const simpleSrcMatch = simpleResponse.match(/src="([^"]+)"/);
+        if (simpleSrcMatch) {
+          console.log(`   📌 Simple CDN URL: ${simpleSrcMatch[1]}`);
+        }
+
+        const sriBenchMatch = tagResponse.match(/src="([^"]+)"/);
+        if (sriBenchMatch) {
+          console.log(`   📌 SRI CDN URL: ${sriBenchMatch[1]}`);
+        }
+
+        // Extract integrity hash if present
+        const integrityMatch = tagResponse.match(/integrity="([^"]+)"/);
+        if (integrityMatch) {
+          console.log(`   🔒 Integrity: ${integrityMatch[1]}`);
+        }
+
+        // Extract data-dtconfig if present
+        const configMatch = tagResponse.match(/data-dtconfig="([^"]+)"/);
+        if (configMatch) {
+          console.log(`   ⚙️  Config includes reportUrl for direct beacon delivery`);
+        }
+
+        console.log("");
+      } catch (error) {
+        console.error(`   ❌ Failed to fetch ${env}: ${error}\n`);
+        throw error;
+      }
+    }
+
+    // Update dynatrace.ejs fallback values and write CDN config JSON
+    console.log("\n📝 Updating files...\n");
+    updateDynatraceEjs(results);
+    const cdnConfig = writeCdnConfigJson(results);
+
+    // Publish to S3
+    console.log("\n📤 Publishing to S3...\n");
+    await publishToS3(cdnConfig);
+
+    // Report the agent version that was actually downloaded (from the tag URLs).
+    const agentVersions = extractAgentVersions(results);
+    const uniqueVersions = [...new Set(Object.values(agentVersions))];
+    console.log("\n📦 Downloaded Dynatrace RUM agent version:");
+    if (uniqueVersions.length === 1) {
+      console.log(`     ${uniqueVersions[0]}  (int, beta, prod)`);
+    } else {
+      for (const [env, v] of Object.entries(agentVersions)) {
+        console.log(`     ${env.padEnd(5)} ${v}`);
+      }
+    }
+
+    console.log("\n✨ Done!");
+    console.log("\nNext steps:");
+    console.log("1. ✅ dynatrace.ejs fallback values updated (cdnUrls/cdnIntegrity/cdnConfig/cdnCompleteUrls)");
+    console.log("2. ✅ dynatrace-rum-config.json published to S3");
+    console.log("3. Commit and deploy react-scripts to update the fallback values");
+    console.log("4. Test all three mechanisms for new RUM:");
+    console.log("     - asyncCS-script → OneAgent JS tag + SRI, async");
+    console.log("     - asyncCS-inline → OneAgent JS tag + SRI, sync (no longer inlines)");
+    console.log("     - global-cdn    → JavaScript tag (_complete.js), async");
+
+    return results;
+  } catch (error) {
+    console.error("Fatal error:", error);
+    process.exit(1);
+  }
+}
+
+if (require.main === module) {
+  fetchScripts();
+}
+
+module.exports = { fetchScripts };