@newrelic/browser-agent 1.316.0 → 1.317.0-rc.1

package/dist/esm/common/harvest/send.js

@@ -0,0 +1,226 @@
+/**
+ * Copyright 2020-2026 New Relic, Inc. All rights reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+import { JSERRORS, RUM, EVENTS, FEATURE_NAMES, BLOBS, LOGS } from '../../loaders/features/features';
+import { VERSION } from "../constants/env.npm";
+import { globalScope, isWorkerScope } from '../constants/runtime';
+import { handle } from '../event-emitter/handle';
+import { eventListenerOpts } from '../event-listener/event-listener-opts';
+import { now } from '../timing/now';
+import { cleanURL } from '../url/clean-url';
+import { obj, param } from '../url/encode';
+import { warn } from '../util/console';
+import { stringify } from '../util/stringify';
+import { xhr as xhrMethod, xhrFetch as fetchMethod } from '../util/submit-data';
+import { dispatchGlobalEvent } from '../dispatch/global-event';
+
+/**
+ * @typedef {import('./types.js').NetworkSendSpec} NetworkSendSpec
+ */
+
+const warnings = {};
+
+/**
+ * Initiate a harvest call.
+ * @param {object} agentRef The initialized agent reference
+ * @param {NetworkSendSpec} spec Specification for sending data
+ * @returns {boolean} True if a network call was made. Note that this does not mean or guarantee that it was successful.
+ */
+export function send(agentRef, {
+  endpoint,
+  payload,
+  localOpts = {},
+  submitMethod,
+  cbFinished,
+  raw,
+  featureName,
+  endpointVersion = 1,
+  harvesterObfuscator
+}) {
+  if (!agentRef.info.errorBeacon) return false;
+  let {
+    body,
+    qs
+  } = cleanPayload(payload);
+  if (Object.keys(body).length === 0 && !localOpts.sendEmptyBody) {
+    // if there's no body to send, just run onfinish stuff and return
+    if (cbFinished) cbFinished({
+      sent: false
+    });
+    return false;
+  }
+  const protocol = agentRef.init.ssl === false ? 'http' : 'https';
+  const perceivedBeacon = agentRef.init.proxy.beacon || agentRef.info.errorBeacon;
+  const url = raw ? "".concat(protocol, "://").concat(perceivedBeacon, "/").concat(endpoint) : "".concat(protocol, "://").concat(perceivedBeacon).concat(endpoint !== RUM ? '/' + endpoint : '', "/").concat(endpointVersion, "/").concat(agentRef.info.licenseKey);
+  const baseParams = !raw ? baseQueryString(agentRef, qs, endpoint, harvesterObfuscator) : '';
+  let payloadParams = obj(qs, agentRef.runtime.maxBytes);
+  if (baseParams === '' && payloadParams.startsWith('&')) {
+    payloadParams = payloadParams.substring(1);
+  }
+  const fullUrl = "".concat(url, "?").concat(baseParams).concat(payloadParams);
+  const gzip = !!qs?.attributes?.includes('gzip');
+
+  // all gzipped data is already in the correct format and needs no transformation
+  // all features going to 'events' endpoint should already be serialized & stringified
+  let stringBody = gzip || endpoint === EVENTS ? body : stringify(body);
+
+  // If body is null, undefined, or an empty object or array after stringifying, send an empty string instead.
+  if (!stringBody || stringBody.length === 0 || stringBody === '{}' || stringBody === '[]') stringBody = '';
+
+  // Warn--once per endpoint--if the agent tries to send large payloads
+  if (endpoint !== BLOBS && stringBody.length > 750000 && (warnings[endpoint] = (warnings[endpoint] || 0) + 1) === 1) warn(28, endpoint);
+  const headers = [{
+    key: 'content-type',
+    value: 'text/plain'
+  }];
+
+  /* Since workers don't support sendBeacon right now, they can only use XHR method.
+      Because they still do permit synch XHR, the idea is that at final harvest time (worker is closing),
+      we just make a BLOCKING request--trivial impact--with the remaining data as a temp fill-in for sendBeacon.
+     Following the removal of img-element method. */
+  let result = submitMethod({
+    url: fullUrl,
+    body: stringBody,
+    sync: localOpts.isFinalHarvest && isWorkerScope,
+    headers
+  });
+  if (!localOpts.isFinalHarvest && cbFinished) {
+    // final harvests don't hold onto buffer data (shouldRetryOnFail is false), so cleanup isn't needed
+    if (submitMethod === xhrMethod) {
+      result.addEventListener('loadend', function () {
+        // `this` here in block refers to the XHR object in this scope, do not change the anon function to an arrow function
+        // status 0 refers to a local error, such as CORS or network failure, or a blocked request by the browser (e.g. adblocker)
+        const cbResult = {
+          sent: this.status !== 0,
+          status: this.status,
+          retry: shouldRetry(this.status),
+          fullUrl,
+          xhr: this,
+          responseText: this.responseText
+        };
+        cbFinished(cbResult);
+
+        /** temporary audit of consistency of harvest metadata flags */
+        if (!shouldRetry(this.status)) trackHarvestMetadata();
+      }, eventListenerOpts(false));
+    } else if (submitMethod === fetchMethod) {
+      result.then(async function (response) {
+        const status = response.status;
+        const cbResult = {
+          sent: true,
+          status,
+          retry: shouldRetry(status),
+          fullUrl,
+          fetchResponse: response,
+          responseText: await response.text()
+        };
+        cbFinished(cbResult);
+        /** temporary audit of consistency of harvest metadata flags */
+        if (!shouldRetry(status)) trackHarvestMetadata();
+      });
+    }
+    function trackHarvestMetadata() {
+      try {
+        if (featureName === FEATURE_NAMES.jserrors && !body?.err) return;
+        const hasReplay = baseParams.includes('hr=1');
+        const hasTrace = baseParams.includes('ht=1');
+        const hasError = qs?.attributes?.includes('hasError=true');
+        handle('harvest-metadata', [{
+          [featureName]: {
+            ...(hasReplay && {
+              hasReplay
+            }),
+            ...(hasTrace && {
+              hasTrace
+            }),
+            ...(hasError && {
+              hasError
+            })
+          }
+        }], undefined, FEATURE_NAMES.metrics, agentRef.ee);
+      } catch (err) {
+        // do nothing
+      }
+    }
+  }
+  dispatchGlobalEvent({
+    drained: !!agentRef.runtime?.activatedFeatures,
+    type: 'data',
+    name: 'harvest',
+    feature: featureName,
+    data: {
+      endpoint,
+      headers,
+      payload,
+      submitMethod: getSubmitMethodName(),
+      raw,
+      synchronousXhr: !!(localOpts.isFinalHarvest && isWorkerScope)
+    }
+  });
+  return true;
+  function shouldRetry(status) {
+    switch (status) {
+      case 408:
+      case 429:
+      case 500:
+        return true;
+    }
+    return status >= 502 && status <= 504 || status >= 512 && status <= 530;
+  }
+  function getSubmitMethodName() {
+    if (submitMethod === xhrMethod) return 'xhr';
+    if (submitMethod === fetchMethod) return 'fetch';
+    return 'beacon';
+  }
+}
+
+/**
+ * Cleans and returns a payload object containing a body and qs
+ * object with key/value pairs. KV pairs where the value is null,
+ * undefined, or an empty string are removed to save on transmission
+ * size.
+ * @param {HarvestPayload} payload Payload to be sent to the endpoint.
+ * @returns {HarvestPayload} Cleaned payload payload to be sent to the endpoint.
+ */
+function cleanPayload(payload = {}) {
+  const clean = input => {
+    if (typeof Uint8Array !== 'undefined' && input instanceof Uint8Array || Array.isArray(input)) return input;
+    if (typeof input === 'string') return input;
+    return Object.entries(input || {}).reduce((accumulator, [key, value]) => {
+      if (typeof value === 'number' || typeof value === 'string' && value.length > 0 || typeof value === 'object' && Object.keys(value || {}).length > 0) {
+        accumulator[key] = value;
+      }
+      return accumulator;
+    }, {});
+  };
+  return {
+    body: clean(payload.body),
+    qs: clean(payload.qs)
+  };
+}
+
+// The stuff that gets sent every time.
+function baseQueryString(agentRef, qs, endpoint, harvesterObfuscator) {
+  const cleanedURL = cleanURL('' + globalScope.location);
+  const ref = harvesterObfuscator?.obfuscateString(cleanedURL) ?? cleanedURL;
+  const session = agentRef.runtime.session;
+  const hr = !!session?.state.sessionReplaySentFirstChunk && session?.state.sessionReplayMode === 1 && endpoint !== JSERRORS;
+  const ht = !!session?.state.traceHarvestStarted && session?.state.sessionTraceMode === 1 && ![LOGS, BLOBS].includes(endpoint);
+  const qps = ['a=' + agentRef.info.applicationID, param('sa', agentRef.info.sa ? '' + agentRef.info.sa : ''), param('v', VERSION), transactionNameParam(), param('ct', agentRef.runtime.customTransaction), '&rst=' + now(), '&ck=0',
+  // ck param DEPRECATED - still expected by backend
+  '&s=' + (session?.state.value || '0'),
+  // the 0 id encaps all untrackable and default traffic
+  param('ref', ref), param('ptid', agentRef.runtime.ptid ? '' + agentRef.runtime.ptid : '')];
+  if (hr) qps.push(param('hr', '1', qs));
+  if (ht) qps.push(param('ht', '1', qs));
+  return qps.join('');
+
+  // Constructs the transaction name param for the beacon URL.
+  // Prefers the obfuscated transaction name over the plain text.
+  // Falls back to making up a name.
+  function transactionNameParam() {
+    if (agentRef.info.transactionName) return param('to', agentRef.info.transactionName);
+    return param('t', agentRef.info.tNamePlain || 'Unnamed Transaction');
+  }
+}

package/dist/esm/common/harvest/types.js

@@ -1,5 +1,5 @@
 /**
- * Copyright 2020-2025 New Relic, Inc. All rights reserved.
+ * Copyright 2020-2026 New Relic, Inc. All rights reserved.
  * SPDX-License-Identifier: Apache-2.0
  */
 
@@ -23,11 +23,15 @@
  * @typedef {object} NetworkSendSpec
  * @property {HarvestEndpointIdentifier} endpoint The endpoint to use (jserrors, events, resources etc.)
  * @property {HarvestPayload} payload Object representing payload.
- * @property {object} localOpts Additional options for sending data
- * @property {boolean} localOpts.isFinalHarvest Specify whether the call is a final harvest during page unload.
- * @property {boolean} localOpts.sendEmptyBody Specify whether the call should be made even if the body is empty. Useful for rum calls.
- * @property {boolean} localOpts.forceNoRetry Don't save the buffered data in the case of a need to retry the transmission.
+ * @property {object} [localOpts] Additional options for sending data
+ * @property {boolean} [localOpts.isFinalHarvest] Specify whether the call is a final harvest during page unload.
+ * @property {boolean} [localOpts.sendEmptyBody] Specify whether the call should be made even if the body is empty. Useful for rum calls.
+ * @property {boolean} [localOpts.forceNoRetry] Don't save the buffered data in the case of a need to retry the transmission.
  * @property {import('../util/submit-data.js').NetworkMethods} submitMethod The network method to use {@link ../util/submit-data.js}
+ * @property {function(object): void} [cbFinished] Callback invoked with the result once the network request completes. Receives an object with sent, status, retry, fullUrl, responseText, and either xhr or fetchResponse.
+ * @property {boolean} [raw] If true, skips standard versioned URL path construction and uses a bare endpoint URL.
+ * @property {string} [featureName] The feature name associated with this harvest, used for metadata tracking and the global harvest event.
+ * @property {number} [endpointVersion] The endpoint version included in the URL path. Defaults to 1.
  */
 
 export const unused = {};

package/dist/esm/common/payloads/payloads.js

@@ -0,0 +1,118 @@
+/**
+ * Copyright 2020-2026 New Relic, Inc. All rights reserved.
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+import { stringify } from '../util/stringify';
+import { CAPTURE_PAYLOAD_SETTINGS } from '../../features/ajax/constants';
+
+/**
+ * Determines whether payload data should be captured based on the capture mode setting,
+ * HTTP status code, and GraphQL error status.
+ * @param {string} captureMode - The capture mode setting ('none', 'all', or 'failures')
+ * @param {number} statusCode - The HTTP status code
+ * @param {boolean} hasGQLErrors - Whether the response contains GraphQL errors
+ * @returns {boolean} True if payload should be captured
+ */
+export function canCapturePayload(captureMode, statusCode, hasGQLErrors) {
+  if (captureMode === CAPTURE_PAYLOAD_SETTINGS.ALL) return true;
+  if (!captureMode || captureMode === CAPTURE_PAYLOAD_SETTINGS.NONE) return false;
+
+  // Default "failures" mode
+  return statusCode === 0 || statusCode >= 400 || hasGQLErrors === true;
+}
+
+/**
+ * Parses a query string into an object of key-value pairs.
+ * @param {string} search a query string starting with "?" or without (ex. new URL(...).search)
+ * @returns {Object|undefined} Parsed query parameters as key-value pairs. Returns undefined if no valid parameters are found.
+ */
+export function parseQueryString(search) {
+  if (!search || search.length === 0) return;
+  const queryParams = {};
+  try {
+    const searchParams = new URLSearchParams(search);
+    searchParams.forEach(function (value, key) {
+      queryParams[key] = value;
+    });
+  } catch (e) {
+    // Fallback for environments without URLSearchParams
+  }
+  return queryParams;
+}
+
+/**
+ * Determines if the given content type is likely to be human-readable (text-based).
+ * @param {Object} headers - The headers object containing content-type
+ * @param {*} data - The data to check
+ * @returns {boolean} True if the content type is human-readable (text-based)
+ */
+export function isLikelyHumanReadable(headers, data) {
+  if (!headers) return typeof data === 'string';
+  var contentType = headers['content-type'];
+  if (!contentType) return typeof data === 'string';
+  // Normalize to lowercase and extract the mime type (ignore charset, etc.)
+  var mimeType = contentType.toLowerCase().split(';')[0].trim();
+
+  // Check for text/* types
+  if (mimeType.indexOf('text/') === 0) return true;
+
+  // Check for specific application/* types
+  var readableAppTypes = ['/json', '/xml', '/xhtml+xml', '/ld+json', '/yaml', '/x-www-form-urlencoded'];
+  for (var i = 0; i < readableAppTypes.length; i++) {
+    if (mimeType === 'application' + readableAppTypes[i]) return true;
+  }
+  return false;
+}
+
+/**
+ * Truncates a string to ensure its UTF-8 byte length does not exceed 4092 bytes.  If truncation is necessary,
+ * the string is cut off at a character boundary to avoid breaking multi-byte characters and " ..." is appended to indicate truncation.
+ * If not a string, it is first converted to a string using JSON.stringify.
+ * @param {*} data The data to truncate.
+ * @returns {string}
+ */
+export function truncateAsString(data) {
+  if (!data) return data;
+  try {
+    if (typeof data !== 'string') data = stringify(data);
+    let bytes = 0;
+    let i = 0;
+    let needsEllipsis = false;
+    while (i < data.length) {
+      const c = data.charCodeAt(i);
+      const charBytes = c < 0x80 ? 1 : c < 0x800 ? 2 : c < 0xD800 || c >= 0xE000 ? 3 : 4;
+      if (bytes + charBytes > 4092) {
+        needsEllipsis = true;
+        break;
+      }
+      bytes += charBytes;
+      i += charBytes === 4 ? 2 : 1;
+    }
+    return data.slice(0, i) + (needsEllipsis ? ' ...' : '');
+  } catch (e) {
+    return data;
+  }
+}
+
+/**
+ * Creates string adder functions for BEL serialization with obfuscation and optional truncation.
+ * This ensures a single string table is used while providing separate handling for regular vs payload attributes.
+ * @param {Function} getAddStringContext - Function that creates a new string table context
+ * @param {Object} obfuscator - Optional obfuscator instance for string obfuscation
+ * @returns {{addString: Function, addStringWithTruncation: Function}} Object containing both string adder functions
+ */
+export function createStringAdders(getAddStringContext, obfuscator) {
+  const addStringRaw = getAddStringContext();
+  const processString = (str, shouldTruncate) => {
+    if (typeof str === 'undefined' || str === '') return addStringRaw(str);
+    if (typeof str !== 'string') str = stringify(str);
+    const obfuscated = obfuscator?.obfuscateString(str) ?? str;
+    const processed = shouldTruncate ? truncateAsString(obfuscated) : obfuscated;
+    return addStringRaw(processed);
+  };
+  return {
+    addString: str => processString(str, false),
+    addStringWithTruncation: str => processString(str, true)
+  };
+}

package/dist/esm/common/serialize/bel-serializer.js

@@ -1,5 +1,5 @@
 /**
- * Copyright 2020-2025 New Relic, Inc. All rights reserved.
+ * Copyright 2020-2026 New Relic, Inc. All rights reserved.
  * SPDX-License-Identifier: Apache-2.0
  */
 
@@ -15,13 +15,14 @@ export function numeric(n, noDefault) {
   }
   return n === undefined || n === 0 ? '' : Math.floor(n).toString(36);
 }
-export function getAddStringContext(obfuscator) {
+export function getAddStringContext(obfuscator, truncator) {
   let stringTableIdx = 0;
   const stringTable = Object.prototype.hasOwnProperty.call(Object, 'create') ? Object.create(null) : {};
   return addString;
   function addString(str) {
     if (typeof str === 'undefined' || str === '') return '';
-    str = obfuscator.obfuscateString(String(str));
+    str = obfuscator?.obfuscateString(String(str)) ?? String(str);
+    str = truncator?.(str) ?? str;
     if (hasOwnProp.call(stringTable, str)) {
       return numeric(stringTable[str], true);
     } else {

package/dist/esm/common/session/session-entity.js

@@ -7,7 +7,7 @@ import { warn } from '../util/console';
 import { stringify } from '../util/stringify';
 import { Timer } from '../timer/timer';
 import { isBrowserScope } from '../constants/runtime';
-import { DEFAULT_EXPIRES_MS, DEFAULT_INACTIVE_MS, MODE, SESSION_EVENTS, SESSION_EVENT_TYPES, SESSION_STORAGE_KEY_PREFIX } from './constants';
+import { DEFAULT_EXPIRES_MS, DEFAULT_INACTIVE_MS, SESSION_EVENTS, SESSION_EVENT_TYPES, SESSION_STORAGE_KEY_PREFIX } from './constants';
 import { InteractionTimer } from '../timer/interaction-timer';
 import { wrapEvents } from '../wrap/wrap-events';
 import { getModeledObject } from '../config/configurable';
@@ -15,26 +15,27 @@ import { handle } from '../event-emitter/handle';
 import { SUPPORTABILITY_METRIC_CHANNEL } from '../../features/metrics/constants';
 import { FEATURE_NAMES } from '../../loaders/features/features';
 import { windowAddEventListener } from '../event-listener/event-listener-opts';
-import { LOGGING_MODE } from '../../features/logging/constants';
 
-// this is what can be stored in local storage (not enforced but probably should be)
+// this is what can be stored in local storage (enforced during reads)
 // these values should sync between local storage and the parent class props
 const model = {
   value: '',
   inactiveAt: 0,
   expiresAt: 0,
   updatedAt: Date.now(),
-  sessionReplayMode: MODE.OFF,
+  sessionReplayMode: null,
   sessionReplaySentFirstChunk: false,
-  sessionTraceMode: MODE.OFF,
+  sessionTraceMode: null,
   traceHarvestStarted: false,
-  loggingMode: LOGGING_MODE.OFF,
-  logApiMode: LOGGING_MODE.OFF,
+  loggingMode: null,
+  logApiMode: null,
   serverTimeDiff: null,
   // set by TimeKeeper; "undefined" value will not be stringified and stored but "null" will
   custom: {},
   numOfResets: 0,
-  consent: false // set by consent() API call
+  consent: false,
+  // set by consent() API call
+  cachedRumResponse: null
 };
 export class SessionEntity {
   /**
@@ -246,7 +247,6 @@ export class SessionEntity {
       this.expiresTimer?.clear?.();
       delete this.isNew;
       this.setup({
-        agentRef: this.agentRef,
         key: this.key,
         storage: this.storage,
         expiresMs: this.expiresMs,

package/dist/esm/common/util/data-size.js

@@ -1,5 +1,5 @@
 /**
- * Copyright 2020-2025 New Relic, Inc. All rights reserved.
+ * Copyright 2020-2026 New Relic, Inc. All rights reserved.
  * SPDX-License-Identifier: Apache-2.0
  */
 
@@ -12,7 +12,7 @@ import { stringify } from './stringify';
  * @returns {(number|undefined)} - The size of the data or undefined if size cannot be determined.
  */
 export function dataSize(data) {
-  if (typeof data === 'string' && data.length) return data.length;
+  if (typeof data === 'string') return data.length;
   if (typeof data !== 'object') return undefined;
   // eslint-disable-next-line
   if (typeof ArrayBuffer !== 'undefined' && data instanceof ArrayBuffer && data.byteLength) return data.byteLength;

package/dist/esm/common/util/obfuscate.js

@@ -1,5 +1,5 @@
 /**
- * Copyright 2020-2025 New Relic, Inc. All rights reserved.
+ * Copyright 2020-2026 New Relic, Inc. All rights reserved.
  * SPDX-License-Identifier: Apache-2.0
  */
 import { isFileProtocol } from '../url/protocol';
@@ -10,6 +10,7 @@ import { warn } from './console';
  * @typedef {object} ObfuscationRule
  * @property {string|RegExp} regex The regular expression to match against in the payload
  * @property {string} [replacement] The string to replace the matched regex with
+ * @property {string[]} [eventFilter] An optional list of event types to which this rule should be applied. If not provided, or an empty array, the rule will be applied to all events.
  */
 
 /**
@@ -24,14 +25,33 @@ import { warn } from './console';
  */
 
 export class Obfuscator {
-  constructor(agentRef) {
+  /**
+   * @param {Object} agentRef - Reference to the agent instance
+   * @param {string} [eventType] - Optional event type this obfuscator instance handles.
+   *                               If provided, only rules matching this event type (or rules with no eventFilter) will be applied.
+   */
+  constructor(agentRef, eventType) {
     this.agentRef = agentRef;
+    this.eventType = eventType;
     this.warnedRegexMissing = false;
     this.warnedInvalidRegex = false;
     this.warnedInvalidReplacement = false;
   }
   get obfuscateConfigRules() {
-    return this.agentRef.init.obfuscate || [];
+    const allRules = this.agentRef.init.obfuscate || [];
+
+    // If this instance has no specific event type, return all rules
+    if (!this.eventType) return allRules;
+
+    // Filter rules to only those that apply to this instance's event type
+    return allRules.filter(rule => {
+      // If rule has no eventFilter, it applies to all events
+      if (!this.#hasValidEventFilter(rule)) {
+        return true;
+      }
+      // Otherwise, check if this instance's event type matches the rule's filter
+      return rule.eventFilter.includes(this.eventType);
+    });
   }
 
   /**
@@ -57,6 +77,130 @@ export class Obfuscator {
     }, input);
   }
 
+  /**
+   * Traverses an object and obfuscates all string properties.
+   * This instance will only apply rules that match its configured event type (if any).
+   * For features with mixed event types in their payloads (like generic_events), this will
+   * traverse the object and check each object's eventType property against the rules.
+   * @param {Object|Array} obj - The object or array to traverse
+   * @returns {Object|Array} The modified object
+   */
+  traverseAndObfuscateEvents(obj) {
+    if (!obj || typeof obj !== 'object') return obj;
+
+    // If this instance was configured with a specific event type, obfuscate everything
+    // (rules are already filtered in obfuscateConfigRules getter)
+    if (this.eventType) {
+      this.#applyFnToAllStrings(obj, this.obfuscateString.bind(this));
+      return obj;
+    }
+
+    // For generic obfuscators (no specific event types), check individual eventType properties
+    // This path is for features like generic_events that handle multiple event types
+    const eventTypesToObfuscate = new Set();
+    const globalRules = [];
+    const eventSpecificRules = [];
+    this.obfuscateConfigRules.forEach(rule => {
+      if (this.#hasValidEventFilter(rule)) {
+        eventSpecificRules.push(rule);
+        rule.eventFilter.forEach(eventType => eventTypesToObfuscate.add(eventType));
+      } else {
+        globalRules.push(rule);
+      }
+    });
+
+    // Optimization: if ALL rules are global (no event-specific rules exist),
+    // we can just apply all rules to everything without checking eventType properties
+    if (eventSpecificRules.length === 0) {
+      this.#applyFnToAllStrings(obj, this.obfuscateString.bind(this));
+      return obj;
+    }
+
+    // We have a mix of global and event-specific rules:
+    // - Apply event-specific rules only to matching eventTypes
+    // - Apply global rules to ALL event types
+    this.#applyFnWithEventTypeFilter(obj, this.obfuscateString.bind(this), Array.from(eventTypesToObfuscate), globalRules, null);
+    return obj;
+  }
+
+  /**
+   * Recursively applies a function to all string properties in an object.
+   * @param {Object|Array} obj - The object or array to traverse
+   * @param {Function} fn - The function to apply to string properties
+   * @private
+   */
+  #applyFnToAllStrings(obj, fn) {
+    if (!obj || typeof obj !== 'object') return;
+    Object.keys(obj).forEach(property => {
+      const value = obj[property];
+      if (typeof value === 'object' && value !== null) {
+        this.#applyFnToAllStrings(value, fn);
+      } else if (typeof value === 'string') {
+        obj[property] = fn(value);
+      }
+    });
+  }
+
+  /**
+   * Recursively applies a function to string properties based on eventType filtering.
+   * @param {Object|Array} obj - The object or array to traverse
+   * @param {Function} fn - The function to apply to string properties (applies all rules)
+   * @param {string[]} eventTypes - Array of event types to apply event-specific obfuscation
+   * @param {Array} globalRules - Rules without eventFilter that apply to all events
+   * @param {boolean|null} shouldObfuscate - Track obfuscation state: null = not determined yet, true = obfuscate with all rules, false = obfuscate with global rules only
+   * @private
+   */
+  #applyFnWithEventTypeFilter(obj, fn, eventTypes, globalRules, shouldObfuscate) {
+    if (!obj || typeof obj !== 'object') return;
+
+    // Determine the obfuscation state for this object
+    let currentShouldObfuscate = shouldObfuscate;
+
+    // Check if this object has an eventType property
+    if ('eventType' in obj && typeof obj.eventType === 'string') {
+      currentShouldObfuscate = eventTypes.includes(obj.eventType);
+    }
+
+    // Process all properties
+    Object.keys(obj).forEach(property => {
+      const value = obj[property];
+      if (typeof value === 'object' && value !== null) {
+        // Recursively traverse objects/arrays, passing the current obfuscation state
+        this.#applyFnWithEventTypeFilter(value, fn, eventTypes, globalRules, currentShouldObfuscate);
+      } else if (typeof value === 'string') {
+        if (currentShouldObfuscate === true) {
+          // Apply all rules (both global and event-specific)
+          obj[property] = fn(value);
+        } else if (currentShouldObfuscate === false && globalRules.length > 0) {
+          // Apply only global rules
+          obj[property] = this.#applyRulesToString(value, globalRules);
+        }
+        // If currentShouldObfuscate is null, we haven't found an eventType yet, so don't obfuscate
+      }
+    });
+  }
+
+  /**
+   * Applies specific obfuscation rules to a string.
+   * @param {string} input - The string to obfuscate
+   * @param {Array} rules - The rules to apply
+   * @returns {string} The obfuscated string
+   * @private
+   */
+  #applyRulesToString(input, rules) {
+    if (typeof input !== 'string' || input.trim().length === 0) return input;
+    const validatedRules = rules.map(rule => this.validateObfuscationRule(rule));
+    return validatedRules.filter(ruleValidation => ruleValidation.isValid).reduce((input, ruleValidation) => {
+      const {
+        rule
+      } = ruleValidation;
+      return input.replace(rule.regex, rule.replacement || '*');
+    }, input);
+  }
+  #hasValidEventFilter(rule) {
+    return Array.isArray(rule?.eventFilter) && rule.eventFilter.length > 0;
+  }
+
   /**
    * Validates an obfuscation rule and provides errors if any are found.
    * @param {ObfuscationRule} rule The rule to validate