@newrelic/browser-agent 1.316.0 → 1.317.0-rc.1

package/src/common/harvest/send.js

@@ -0,0 +1,209 @@
+/**
+ * Copyright 2020-2026 New Relic, Inc. All rights reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { JSERRORS, RUM, EVENTS, FEATURE_NAMES, BLOBS, LOGS } from '../../loaders/features/features'
+import { VERSION } from '../constants/env'
+import { globalScope, isWorkerScope } from '../constants/runtime'
+import { handle } from '../event-emitter/handle'
+import { eventListenerOpts } from '../event-listener/event-listener-opts'
+import { now } from '../timing/now'
+import { cleanURL } from '../url/clean-url'
+import { obj, param } from '../url/encode'
+import { warn } from '../util/console'
+import { stringify } from '../util/stringify'
+import { xhr as xhrMethod, xhrFetch as fetchMethod } from '../util/submit-data'
+import { dispatchGlobalEvent } from '../dispatch/global-event'
+
+/**
+ * @typedef {import('./types.js').NetworkSendSpec} NetworkSendSpec
+ */
+
+const warnings = {}
+
+/**
+ * Initiate a harvest call.
+ * @param {object} agentRef The initialized agent reference
+ * @param {NetworkSendSpec} spec Specification for sending data
+ * @returns {boolean} True if a network call was made. Note that this does not mean or guarantee that it was successful.
+ */
+export function send (agentRef, { endpoint, payload, localOpts = {}, submitMethod, cbFinished, raw, featureName, endpointVersion = 1, harvesterObfuscator }) {
+  if (!agentRef.info.errorBeacon) return false
+
+  let { body, qs } = cleanPayload(payload)
+
+  if (Object.keys(body).length === 0 && !localOpts.sendEmptyBody) { // if there's no body to send, just run onfinish stuff and return
+    if (cbFinished) cbFinished({ sent: false })
+    return false
+  }
+
+  const protocol = agentRef.init.ssl === false ? 'http' : 'https'
+  const perceivedBeacon = agentRef.init.proxy.beacon || agentRef.info.errorBeacon
+  const url = raw
+    ? `${protocol}://${perceivedBeacon}/${endpoint}`
+    : `${protocol}://${perceivedBeacon}${endpoint !== RUM ? '/' + endpoint : ''}/${endpointVersion}/${agentRef.info.licenseKey}`
+  const baseParams = !raw ? baseQueryString(agentRef, qs, endpoint, harvesterObfuscator) : ''
+  let payloadParams = obj(qs, agentRef.runtime.maxBytes)
+  if (baseParams === '' && payloadParams.startsWith('&')) {
+    payloadParams = payloadParams.substring(1)
+  }
+
+  const fullUrl = `${url}?${baseParams}${payloadParams}`
+  const gzip = !!qs?.attributes?.includes('gzip')
+
+  // all gzipped data is already in the correct format and needs no transformation
+  // all features going to 'events' endpoint should already be serialized & stringified
+  let stringBody = gzip || endpoint === EVENTS ? body : stringify(body)
+
+  // If body is null, undefined, or an empty object or array after stringifying, send an empty string instead.
+  if (!stringBody || stringBody.length === 0 || stringBody === '{}' || stringBody === '[]') stringBody = ''
+
+  // Warn--once per endpoint--if the agent tries to send large payloads
+  if (endpoint !== BLOBS && stringBody.length > 750000 && (warnings[endpoint] = (warnings[endpoint] || 0) + 1) === 1) warn(28, endpoint)
+
+  const headers = [{ key: 'content-type', value: 'text/plain' }]
+
+  /* Since workers don't support sendBeacon right now, they can only use XHR method.
+      Because they still do permit synch XHR, the idea is that at final harvest time (worker is closing),
+      we just make a BLOCKING request--trivial impact--with the remaining data as a temp fill-in for sendBeacon.
+     Following the removal of img-element method. */
+  let result = submitMethod({ url: fullUrl, body: stringBody, sync: localOpts.isFinalHarvest && isWorkerScope, headers })
+
+  if (!localOpts.isFinalHarvest && cbFinished) { // final harvests don't hold onto buffer data (shouldRetryOnFail is false), so cleanup isn't needed
+    if (submitMethod === xhrMethod) {
+      result.addEventListener('loadend', function () {
+        // `this` here in block refers to the XHR object in this scope, do not change the anon function to an arrow function
+        // status 0 refers to a local error, such as CORS or network failure, or a blocked request by the browser (e.g. adblocker)
+        const cbResult = { sent: this.status !== 0, status: this.status, retry: shouldRetry(this.status), fullUrl, xhr: this, responseText: this.responseText }
+        cbFinished(cbResult)
+
+        /** temporary audit of consistency of harvest metadata flags */
+        if (!shouldRetry(this.status)) trackHarvestMetadata()
+      }, eventListenerOpts(false))
+    } else if (submitMethod === fetchMethod) {
+      result.then(async function (response) {
+        const status = response.status
+        const cbResult = { sent: true, status, retry: shouldRetry(status), fullUrl, fetchResponse: response, responseText: await response.text() }
+        cbFinished(cbResult)
+        /** temporary audit of consistency of harvest metadata flags */
+        if (!shouldRetry(status)) trackHarvestMetadata()
+      })
+    }
+
+    function trackHarvestMetadata () {
+      try {
+        if (featureName === FEATURE_NAMES.jserrors && !body?.err) return
+
+        const hasReplay = baseParams.includes('hr=1')
+        const hasTrace = baseParams.includes('ht=1')
+        const hasError = qs?.attributes?.includes('hasError=true')
+
+        handle('harvest-metadata', [{
+          [featureName]: {
+            ...(hasReplay && { hasReplay }),
+            ...(hasTrace && { hasTrace }),
+            ...(hasError && { hasError })
+          }
+        }], undefined, FEATURE_NAMES.metrics, agentRef.ee)
+      } catch (err) {
+        // do nothing
+      }
+    }
+  }
+
+  dispatchGlobalEvent({
+    drained: !!agentRef.runtime?.activatedFeatures,
+    type: 'data',
+    name: 'harvest',
+    feature: featureName,
+    data: {
+      endpoint,
+      headers,
+      payload,
+      submitMethod: getSubmitMethodName(),
+      raw,
+      synchronousXhr: !!(localOpts.isFinalHarvest && isWorkerScope)
+    }
+  })
+
+  return true
+
+  function shouldRetry (status) {
+    switch (status) {
+      case 408:
+      case 429:
+      case 500:
+        return true
+    }
+    return (status >= 502 && status <= 504) || (status >= 512 && status <= 530)
+  }
+
+  function getSubmitMethodName () {
+    if (submitMethod === xhrMethod) return 'xhr'
+    if (submitMethod === fetchMethod) return 'fetch'
+    return 'beacon'
+  }
+}
+
+/**
+ * Cleans and returns a payload object containing a body and qs
+ * object with key/value pairs. KV pairs where the value is null,
+ * undefined, or an empty string are removed to save on transmission
+ * size.
+ * @param {HarvestPayload} payload Payload to be sent to the endpoint.
+ * @returns {HarvestPayload} Cleaned payload payload to be sent to the endpoint.
+ */
+function cleanPayload (payload = {}) {
+  const clean = (input) => {
+    if ((typeof Uint8Array !== 'undefined' && input instanceof Uint8Array) || Array.isArray(input)) return input
+    if (typeof input === 'string') return input
+    return Object.entries(input || {}).reduce((accumulator, [key, value]) => {
+      if ((typeof value === 'number') ||
+        (typeof value === 'string' && value.length > 0) ||
+        (typeof value === 'object' && Object.keys(value || {}).length > 0)
+      ) {
+        accumulator[key] = value
+      }
+      return accumulator
+    }, {})
+  }
+
+  return {
+    body: clean(payload.body),
+    qs: clean(payload.qs)
+  }
+}
+
+// The stuff that gets sent every time.
+function baseQueryString (agentRef, qs, endpoint, harvesterObfuscator) {
+  const cleanedURL = cleanURL('' + globalScope.location)
+  const ref = harvesterObfuscator?.obfuscateString(cleanedURL) ?? cleanedURL
+  const session = agentRef.runtime.session
+  const hr = !!session?.state.sessionReplaySentFirstChunk && session?.state.sessionReplayMode === 1 && endpoint !== JSERRORS
+  const ht = !!session?.state.traceHarvestStarted && session?.state.sessionTraceMode === 1 && ![LOGS, BLOBS].includes(endpoint)
+
+  const qps = [
+    'a=' + agentRef.info.applicationID,
+    param('sa', (agentRef.info.sa ? '' + agentRef.info.sa : '')),
+    param('v', VERSION),
+    transactionNameParam(),
+    param('ct', agentRef.runtime.customTransaction),
+    '&rst=' + now(),
+    '&ck=0', // ck param DEPRECATED - still expected by backend
+    '&s=' + (session?.state.value || '0'), // the 0 id encaps all untrackable and default traffic
+    param('ref', ref),
+    param('ptid', (agentRef.runtime.ptid ? '' + agentRef.runtime.ptid : ''))
+  ]
+  if (hr) qps.push(param('hr', '1', qs))
+  if (ht) qps.push(param('ht', '1', qs))
+
+  return qps.join('')
+
+  // Constructs the transaction name param for the beacon URL.
+  // Prefers the obfuscated transaction name over the plain text.
+  // Falls back to making up a name.
+  function transactionNameParam () {
+    if (agentRef.info.transactionName) return param('to', agentRef.info.transactionName)
+    return param('t', agentRef.info.tNamePlain || 'Unnamed Transaction')
+  }
+}

package/src/common/harvest/types.js

@@ -1,5 +1,5 @@
 /**
- * Copyright 2020-2025 New Relic, Inc. All rights reserved.
+ * Copyright 2020-2026 New Relic, Inc. All rights reserved.
  * SPDX-License-Identifier: Apache-2.0
  */
 
@@ -23,11 +23,15 @@
  * @typedef {object} NetworkSendSpec
  * @property {HarvestEndpointIdentifier} endpoint The endpoint to use (jserrors, events, resources etc.)
  * @property {HarvestPayload} payload Object representing payload.
- * @property {object} localOpts Additional options for sending data
- * @property {boolean} localOpts.isFinalHarvest Specify whether the call is a final harvest during page unload.
- * @property {boolean} localOpts.sendEmptyBody Specify whether the call should be made even if the body is empty. Useful for rum calls.
- * @property {boolean} localOpts.forceNoRetry Don't save the buffered data in the case of a need to retry the transmission.
+ * @property {object} [localOpts] Additional options for sending data
+ * @property {boolean} [localOpts.isFinalHarvest] Specify whether the call is a final harvest during page unload.
+ * @property {boolean} [localOpts.sendEmptyBody] Specify whether the call should be made even if the body is empty. Useful for rum calls.
+ * @property {boolean} [localOpts.forceNoRetry] Don't save the buffered data in the case of a need to retry the transmission.
  * @property {import('../util/submit-data.js').NetworkMethods} submitMethod The network method to use {@link ../util/submit-data.js}
+ * @property {function(object): void} [cbFinished] Callback invoked with the result once the network request completes. Receives an object with sent, status, retry, fullUrl, responseText, and either xhr or fetchResponse.
+ * @property {boolean} [raw] If true, skips standard versioned URL path construction and uses a bare endpoint URL.
+ * @property {string} [featureName] The feature name associated with this harvest, used for metadata tracking and the global harvest event.
+ * @property {number} [endpointVersion] The endpoint version included in the URL path. Defaults to 1.
  */
 
 export const unused = {}

package/src/common/payloads/payloads.js

@@ -0,0 +1,135 @@
+/**
+ * Copyright 2020-2026 New Relic, Inc. All rights reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+import { stringify } from '../util/stringify'
+import { CAPTURE_PAYLOAD_SETTINGS } from '../../features/ajax/constants'
+
+/**
+ * Determines whether payload data should be captured based on the capture mode setting,
+ * HTTP status code, and GraphQL error status.
+ * @param {string} captureMode - The capture mode setting ('none', 'all', or 'failures')
+ * @param {number} statusCode - The HTTP status code
+ * @param {boolean} hasGQLErrors - Whether the response contains GraphQL errors
+ * @returns {boolean} True if payload should be captured
+ */
+export function canCapturePayload (captureMode, statusCode, hasGQLErrors) {
+  if (captureMode === CAPTURE_PAYLOAD_SETTINGS.ALL) return true
+  if (!captureMode || captureMode === CAPTURE_PAYLOAD_SETTINGS.NONE) return false
+
+  // Default "failures" mode
+  return statusCode === 0 || statusCode >= 400 || hasGQLErrors === true
+}
+
+/**
+ * Parses a query string into an object of key-value pairs.
+ * @param {string} search a query string starting with "?" or without (ex. new URL(...).search)
+ * @returns {Object|undefined} Parsed query parameters as key-value pairs. Returns undefined if no valid parameters are found.
+ */
+export function parseQueryString (search) {
+  if (!search || search.length === 0) return
+
+  const queryParams = {}
+  try {
+    const searchParams = new URLSearchParams(search)
+    searchParams.forEach(function (value, key) {
+      queryParams[key] = value
+    })
+  } catch (e) {
+    // Fallback for environments without URLSearchParams
+  }
+
+  return queryParams
+}
+
+/**
+ * Determines if the given content type is likely to be human-readable (text-based).
+ * @param {Object} headers - The headers object containing content-type
+ * @param {*} data - The data to check
+ * @returns {boolean} True if the content type is human-readable (text-based)
+ */
+export function isLikelyHumanReadable (headers, data) {
+  if (!headers) return typeof data === 'string'
+  var contentType = headers['content-type']
+  if (!contentType) return typeof data === 'string'
+  // Normalize to lowercase and extract the mime type (ignore charset, etc.)
+  var mimeType = contentType.toLowerCase().split(';')[0].trim()
+
+  // Check for text/* types
+  if (mimeType.indexOf('text/') === 0) return true
+
+  // Check for specific application/* types
+  var readableAppTypes = [
+    '/json',
+    '/xml',
+    '/xhtml+xml',
+    '/ld+json',
+    '/yaml',
+    '/x-www-form-urlencoded'
+  ]
+
+  for (var i = 0; i < readableAppTypes.length; i++) {
+    if (mimeType === 'application' + readableAppTypes[i]) return true
+  }
+
+  return false
+}
+
+/**
+ * Truncates a string to ensure its UTF-8 byte length does not exceed 4092 bytes.  If truncation is necessary,
+ * the string is cut off at a character boundary to avoid breaking multi-byte characters and " ..." is appended to indicate truncation.
+ * If not a string, it is first converted to a string using JSON.stringify.
+ * @param {*} data The data to truncate.
+ * @returns {string}
+ */
+export function truncateAsString (data) {
+  if (!data) return data
+  try {
+    if (typeof data !== 'string') data = stringify(data)
+    let bytes = 0
+    let i = 0
+    let needsEllipsis = false
+
+    while (i < data.length) {
+      const c = data.charCodeAt(i)
+      const charBytes = c < 0x80 ? 1 : c < 0x800 ? 2 : c < 0xD800 || c >= 0xE000 ? 3 : 4
+
+      if (bytes + charBytes > 4092) {
+        needsEllipsis = true
+        break
+      }
+
+      bytes += charBytes
+      i += charBytes === 4 ? 2 : 1
+    }
+
+    return data.slice(0, i) + (needsEllipsis ? ' ...' : '')
+  } catch (e) {
+    return data
+  }
+}
+
+/**
+ * Creates string adder functions for BEL serialization with obfuscation and optional truncation.
+ * This ensures a single string table is used while providing separate handling for regular vs payload attributes.
+ * @param {Function} getAddStringContext - Function that creates a new string table context
+ * @param {Object} obfuscator - Optional obfuscator instance for string obfuscation
+ * @returns {{addString: Function, addStringWithTruncation: Function}} Object containing both string adder functions
+ */
+export function createStringAdders (getAddStringContext, obfuscator) {
+  const addStringRaw = getAddStringContext()
+
+  const processString = (str, shouldTruncate) => {
+    if (typeof str === 'undefined' || str === '') return addStringRaw(str)
+    if (typeof str !== 'string') str = stringify(str)
+    const obfuscated = obfuscator?.obfuscateString(str) ?? str
+    const processed = shouldTruncate ? truncateAsString(obfuscated) : obfuscated
+    return addStringRaw(processed)
+  }
+
+  return {
+    addString: (str) => processString(str, false),
+    addStringWithTruncation: (str) => processString(str, true)
+  }
+}

package/src/common/serialize/bel-serializer.js

@@ -1,5 +1,5 @@
 /**
- * Copyright 2020-2025 New Relic, Inc. All rights reserved.
+ * Copyright 2020-2026 New Relic, Inc. All rights reserved.
  * SPDX-License-Identifier: Apache-2.0
  */
 
@@ -21,7 +21,7 @@ export function numeric (n, noDefault) {
   return (n === undefined || n === 0) ? '' : Math.floor(n).toString(36)
 }
 
-export function getAddStringContext (obfuscator) {
+export function getAddStringContext (obfuscator, truncator) {
   let stringTableIdx = 0
   const stringTable = Object.prototype.hasOwnProperty.call(Object, 'create') ? Object.create(null) : {}
 
@@ -29,7 +29,8 @@ export function getAddStringContext (obfuscator) {
 
   function addString (str) {
     if (typeof str === 'undefined' || str === '') return ''
-    str = obfuscator.obfuscateString(String(str))
+    str = obfuscator?.obfuscateString(String(str)) ?? String(str)
+    str = truncator?.(str) ?? str
     if (hasOwnProp.call(stringTable, str)) {
       return numeric(stringTable[str], true)
     } else {

package/src/common/session/session-entity.js

@@ -7,7 +7,7 @@ import { warn } from '../util/console'
 import { stringify } from '../util/stringify'
 import { Timer } from '../timer/timer'
 import { isBrowserScope } from '../constants/runtime'
-import { DEFAULT_EXPIRES_MS, DEFAULT_INACTIVE_MS, MODE, SESSION_EVENTS, SESSION_EVENT_TYPES, SESSION_STORAGE_KEY_PREFIX } from './constants'
+import { DEFAULT_EXPIRES_MS, DEFAULT_INACTIVE_MS, SESSION_EVENTS, SESSION_EVENT_TYPES, SESSION_STORAGE_KEY_PREFIX } from './constants'
 import { InteractionTimer } from '../timer/interaction-timer'
 import { wrapEvents } from '../wrap/wrap-events'
 import { getModeledObject } from '../config/configurable'
@@ -15,25 +15,25 @@ import { handle } from '../event-emitter/handle'
 import { SUPPORTABILITY_METRIC_CHANNEL } from '../../features/metrics/constants'
 import { FEATURE_NAMES } from '../../loaders/features/features'
 import { windowAddEventListener } from '../event-listener/event-listener-opts'
-import { LOGGING_MODE } from '../../features/logging/constants'
 
-// this is what can be stored in local storage (not enforced but probably should be)
+// this is what can be stored in local storage (enforced during reads)
 // these values should sync between local storage and the parent class props
 const model = {
   value: '',
   inactiveAt: 0,
   expiresAt: 0,
   updatedAt: Date.now(),
-  sessionReplayMode: MODE.OFF,
+  sessionReplayMode: null,
   sessionReplaySentFirstChunk: false,
-  sessionTraceMode: MODE.OFF,
+  sessionTraceMode: null,
   traceHarvestStarted: false,
-  loggingMode: LOGGING_MODE.OFF,
-  logApiMode: LOGGING_MODE.OFF,
+  loggingMode: null,
+  logApiMode: null,
   serverTimeDiff: null, // set by TimeKeeper; "undefined" value will not be stringified and stored but "null" will
   custom: {},
   numOfResets: 0,
-  consent: false // set by consent() API call
+  consent: false, // set by consent() API call
+  cachedRumResponse: null
 }
 
 export class SessionEntity {
@@ -242,7 +242,6 @@ export class SessionEntity {
       delete this.isNew
 
       this.setup({
-        agentRef: this.agentRef,
         key: this.key,
         storage: this.storage,
         expiresMs: this.expiresMs,

package/src/common/util/data-size.js

@@ -1,5 +1,5 @@
 /**
- * Copyright 2020-2025 New Relic, Inc. All rights reserved.
+ * Copyright 2020-2026 New Relic, Inc. All rights reserved.
  * SPDX-License-Identifier: Apache-2.0
  */
 
@@ -12,7 +12,7 @@ import { stringify } from './stringify'
  * @returns {(number|undefined)} - The size of the data or undefined if size cannot be determined.
  */
 export function dataSize (data) {
-  if (typeof data === 'string' && data.length) return data.length
+  if (typeof data === 'string') return data.length
   if (typeof data !== 'object') return undefined
   // eslint-disable-next-line
   if (typeof ArrayBuffer !== 'undefined' && data instanceof ArrayBuffer && data.byteLength) return data.byteLength

package/src/common/util/obfuscate.js

@@ -1,5 +1,5 @@
 /**
- * Copyright 2020-2025 New Relic, Inc. All rights reserved.
+ * Copyright 2020-2026 New Relic, Inc. All rights reserved.
  * SPDX-License-Identifier: Apache-2.0
  */
 import { isFileProtocol } from '../url/protocol'
@@ -10,6 +10,7 @@ import { warn } from './console'
  * @typedef {object} ObfuscationRule
  * @property {string|RegExp} regex The regular expression to match against in the payload
  * @property {string} [replacement] The string to replace the matched regex with
+ * @property {string[]} [eventFilter] An optional list of event types to which this rule should be applied. If not provided, or an empty array, the rule will be applied to all events.
  */
 
 /**
@@ -24,15 +25,34 @@ import { warn } from './console'
  */
 
 export class Obfuscator {
-  constructor (agentRef) {
+  /**
+   * @param {Object} agentRef - Reference to the agent instance
+   * @param {string} [eventType] - Optional event type this obfuscator instance handles.
+   *                               If provided, only rules matching this event type (or rules with no eventFilter) will be applied.
+   */
+  constructor (agentRef, eventType) {
     this.agentRef = agentRef
+    this.eventType = eventType
     this.warnedRegexMissing = false
     this.warnedInvalidRegex = false
     this.warnedInvalidReplacement = false
   }
 
   get obfuscateConfigRules () {
-    return this.agentRef.init.obfuscate || []
+    const allRules = this.agentRef.init.obfuscate || []
+
+    // If this instance has no specific event type, return all rules
+    if (!this.eventType) return allRules
+
+    // Filter rules to only those that apply to this instance's event type
+    return allRules.filter(rule => {
+      // If rule has no eventFilter, it applies to all events
+      if (!this.#hasValidEventFilter(rule)) {
+        return true
+      }
+      // Otherwise, check if this instance's event type matches the rule's filter
+      return rule.eventFilter.includes(this.eventType)
+    })
   }
 
   /**
@@ -60,6 +80,137 @@ export class Obfuscator {
       }, input)
   }
 
+  /**
+   * Traverses an object and obfuscates all string properties.
+   * This instance will only apply rules that match its configured event type (if any).
+   * For features with mixed event types in their payloads (like generic_events), this will
+   * traverse the object and check each object's eventType property against the rules.
+   * @param {Object|Array} obj - The object or array to traverse
+   * @returns {Object|Array} The modified object
+   */
+  traverseAndObfuscateEvents (obj) {
+    if (!obj || typeof obj !== 'object') return obj
+
+    // If this instance was configured with a specific event type, obfuscate everything
+    // (rules are already filtered in obfuscateConfigRules getter)
+    if (this.eventType) {
+      this.#applyFnToAllStrings(obj, this.obfuscateString.bind(this))
+      return obj
+    }
+
+    // For generic obfuscators (no specific event types), check individual eventType properties
+    // This path is for features like generic_events that handle multiple event types
+    const eventTypesToObfuscate = new Set()
+    const globalRules = []
+    const eventSpecificRules = []
+
+    this.obfuscateConfigRules.forEach(rule => {
+      if (this.#hasValidEventFilter(rule)) {
+        eventSpecificRules.push(rule)
+        rule.eventFilter.forEach(eventType => eventTypesToObfuscate.add(eventType))
+      } else {
+        globalRules.push(rule)
+      }
+    })
+
+    // Optimization: if ALL rules are global (no event-specific rules exist),
+    // we can just apply all rules to everything without checking eventType properties
+    if (eventSpecificRules.length === 0) {
+      this.#applyFnToAllStrings(obj, this.obfuscateString.bind(this))
+      return obj
+    }
+
+    // We have a mix of global and event-specific rules:
+    // - Apply event-specific rules only to matching eventTypes
+    // - Apply global rules to ALL event types
+    this.#applyFnWithEventTypeFilter(obj, this.obfuscateString.bind(this), Array.from(eventTypesToObfuscate), globalRules, null)
+    return obj
+  }
+
+  /**
+   * Recursively applies a function to all string properties in an object.
+   * @param {Object|Array} obj - The object or array to traverse
+   * @param {Function} fn - The function to apply to string properties
+   * @private
+   */
+  #applyFnToAllStrings (obj, fn) {
+    if (!obj || typeof obj !== 'object') return
+
+    Object.keys(obj).forEach(property => {
+      const value = obj[property]
+
+      if (typeof value === 'object' && value !== null) {
+        this.#applyFnToAllStrings(value, fn)
+      } else if (typeof value === 'string') {
+        obj[property] = fn(value)
+      }
+    })
+  }
+
+  /**
+   * Recursively applies a function to string properties based on eventType filtering.
+   * @param {Object|Array} obj - The object or array to traverse
+   * @param {Function} fn - The function to apply to string properties (applies all rules)
+   * @param {string[]} eventTypes - Array of event types to apply event-specific obfuscation
+   * @param {Array} globalRules - Rules without eventFilter that apply to all events
+   * @param {boolean|null} shouldObfuscate - Track obfuscation state: null = not determined yet, true = obfuscate with all rules, false = obfuscate with global rules only
+   * @private
+   */
+  #applyFnWithEventTypeFilter (obj, fn, eventTypes, globalRules, shouldObfuscate) {
+    if (!obj || typeof obj !== 'object') return
+
+    // Determine the obfuscation state for this object
+    let currentShouldObfuscate = shouldObfuscate
+
+    // Check if this object has an eventType property
+    if ('eventType' in obj && typeof obj.eventType === 'string') {
+      currentShouldObfuscate = eventTypes.includes(obj.eventType)
+    }
+
+    // Process all properties
+    Object.keys(obj).forEach(property => {
+      const value = obj[property]
+
+      if (typeof value === 'object' && value !== null) {
+        // Recursively traverse objects/arrays, passing the current obfuscation state
+        this.#applyFnWithEventTypeFilter(value, fn, eventTypes, globalRules, currentShouldObfuscate)
+      } else if (typeof value === 'string') {
+        if (currentShouldObfuscate === true) {
+          // Apply all rules (both global and event-specific)
+          obj[property] = fn(value)
+        } else if (currentShouldObfuscate === false && globalRules.length > 0) {
+          // Apply only global rules
+          obj[property] = this.#applyRulesToString(value, globalRules)
+        }
+        // If currentShouldObfuscate is null, we haven't found an eventType yet, so don't obfuscate
+      }
+    })
+  }
+
+  /**
+   * Applies specific obfuscation rules to a string.
+   * @param {string} input - The string to obfuscate
+   * @param {Array} rules - The rules to apply
+   * @returns {string} The obfuscated string
+   * @private
+   */
+  #applyRulesToString (input, rules) {
+    if (typeof input !== 'string' || input.trim().length === 0) return input
+
+    const validatedRules = rules.map(rule => this.validateObfuscationRule(rule))
+
+    return validatedRules
+      .filter(ruleValidation => ruleValidation.isValid)
+      .reduce((input, ruleValidation) => {
+        const { rule } = ruleValidation
+        return input.replace(rule.regex, rule.replacement || '*')
+      }, input)
+  }
+
+  #hasValidEventFilter (rule) {
+    return Array.isArray(rule?.eventFilter) && rule.eventFilter.length > 0
+  }
+
   /**
    * Validates an obfuscation rule and provides errors if any are found.
    * @param {ObfuscationRule} rule The rule to validate