n8n-nodes-redactor 4.0.0 → 4.2.0

package/dist/nodes/Redactor/engine.js

@@ -33,12 +33,14 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.collectTokenLike = collectTokenLike;
 exports.redactValue = redactValue;
 exports.restoreValue = restoreValue;
 exports.enhanceWithPresidio = enhanceWithPresidio;
 exports.buildReport = buildReport;
 const crypto = __importStar(require("crypto"));
 const patterns_1 = require("./patterns");
+const regexSafety_1 = require("./regexSafety");
 const context_1 = require("./context");
 const names_1 = require("./names");
 const pseudonymize_1 = require("./pseudonymize");
@@ -95,55 +97,79 @@ function maskValue(value, label) {
 function hashValue(value) {
     return crypto.createHash('sha256').update(value).digest('hex').slice(0, 12);
 }
-function applyRedaction(match, pattern, mode, vault, sessionId, dedup) {
-    switch (mode) {
-        case 'token': {
-            if (dedup) {
-                const existing = vault.findByOriginal(sessionId, match);
-                if (existing)
-                    return existing.token;
-            }
-            const session = vault.getSession(sessionId);
-            const index = session ? Object.keys(session.entries).length : 0;
-            const token = generateToken(pattern.label, index);
-            vault.addEntry(sessionId, {
-                token,
-                original: match,
-                patternLabel: pattern.label,
-                category: ('category' in pattern ? pattern.category : 'identity'),
-                createdAt: new Date().toISOString(),
-            });
-            return token;
-        }
-        case 'mask':
-            return maskValue(match, pattern.label);
-        case 'hash':
-            return `[${pattern.label}:${hashValue(match)}]`;
-        case 'redact':
-            return `[REDACTED]`;
-        case 'blackout':
-            return '\u2588'.repeat(match.length);
-        case 'remove':
-            return '';
-        case 'pseudonymize': {
-            if (dedup) {
-                const existing = vault.findByOriginal(sessionId, match);
-                if (existing)
-                    return existing.token;
-            }
-            const pseudonym = (0, pseudonymize_1.generatePseudonym)(sessionId, match, pattern.label);
-            vault.addEntry(sessionId, {
-                token: pseudonym,
-                original: match,
-                patternLabel: pattern.label,
-                category: ('category' in pattern ? pattern.category : 'identity'),
-                createdAt: new Date().toISOString(),
-            });
-            return pseudonym;
+function storeReversible(match, pattern, vault, sessionId, dedup, makeToken) {
+    if (dedup) {
+        const existing = vault.findByOriginal(sessionId, match);
+        if (existing && !existing.numeric)
+            return existing.token;
+    }
+    const token = makeToken();
+    vault.addEntry(sessionId, {
+        token,
+        original: match,
+        patternLabel: pattern.label,
+        category: ('category' in pattern ? pattern.category : 'identity'),
+        createdAt: new Date().toISOString(),
+    });
+    return token;
+}
+const IRREVERSIBLE = {
+    mask: (match, label) => maskValue(match, label),
+    hash: (match, label) => `[${label}:${hashValue(match)}]`,
+    redact: () => '[REDACTED]',
+    blackout: (match) => '\u2588'.repeat(match.length),
+    remove: () => '',
+};
+function applyRedaction(match, pattern, mode, vault, sessionId, dedup, reserved) {
+    if (mode === 'token') {
+        return storeReversible(match, pattern, vault, sessionId, dedup, () => freshToken(pattern.label, vault, sessionId, reserved));
+    }
+    if (mode === 'pseudonymize') {
+        return storeReversible(match, pattern, vault, sessionId, dedup, () => uniquePseudonym(vault, sessionId, match, pattern.label));
+    }
+    const irreversible = IRREVERSIBLE[mode];
+    return irreversible ? irreversible(match, pattern.label) : match;
+}
+function freshToken(label, vault, sessionId, reserved) {
+    var _a, _b;
+    const entries = (_b = (_a = vault.getSession(sessionId)) === null || _a === void 0 ? void 0 : _a.entries) !== null && _b !== void 0 ? _b : {};
+    let index = Object.keys(entries).length;
+    let token = generateToken(label, index);
+    while (entries[token] || (reserved === null || reserved === void 0 ? void 0 : reserved.has(token)))
+        token = generateToken(label, ++index);
+    return token;
+}
+const TOKEN_LIKE_RE = /\[[A-Z][A-Z0-9_]*_\d+\]/g;
+function collectTokenLike(value, into = new Set()) {
+    const scan = (text) => {
+        for (const m of text.matchAll(TOKEN_LIKE_RE))
+            into.add(m[0]);
+    };
+    if (typeof value === 'string')
+        scan(value);
+    else if (Array.isArray(value))
+        value.forEach((v) => collectTokenLike(v, into));
+    else if (value !== null && typeof value === 'object') {
+        for (const [k, v] of Object.entries(value)) {
+            scan(k);
+            collectTokenLike(v, into);
         }
-        default:
-            return match;
     }
+    return into;
+}
+function uniquePseudonym(vault, sessionId, original, label) {
+    var _a, _b;
+    const entries = (_b = (_a = vault.getSession(sessionId)) === null || _a === void 0 ? void 0 : _a.entries) !== null && _b !== void 0 ? _b : {};
+    for (let attempt = 0; attempt < 32; attempt++) {
+        const seed = attempt === 0 ? original : `${original}\u0000${attempt}`;
+        const candidate = (0, pseudonymize_1.generatePseudonym)(sessionId, seed, label);
+        const taken = entries[candidate];
+        if (candidate === original)
+            continue;
+        if (!taken || taken.original === original)
+            return candidate;
+    }
+    return generateToken(label, Object.keys(entries).length);
 }
 function shouldProcessField(fieldPath, fieldMode, fieldRules) {
     if (fieldMode === 'all')
@@ -169,17 +195,7 @@ function fieldPathMatches(actual, pattern) {
     }
 }
 function isSafeRegex(regexStr) {
-    if (/(\+|\*|\?|\{[^}]+\})\s*(\+|\*|\?|\{)/.test(regexStr))
-        return false;
-    if (regexStr.length > 500)
-        return false;
-    try {
-        new RegExp(regexStr);
-        return true;
-    }
-    catch {
-        return false;
-    }
+    return (0, regexSafety_1.checkRegex)(regexStr) === null;
 }
 const SEMANTIC_FIELD_MAP = [
     {
@@ -386,279 +402,342 @@ function getSemanticLabel(fieldKey, siblingKeys) {
     }
     return null;
 }
-function redactValue(value, ctx, vault, sessionId, hits, itemIndex, currentPath = '', siblingKeys) {
-    var _a, _b;
+function redactSemantic(raw, ctx, vault, sessionId, hits, itemIndex, path, display, siblingKeys) {
+    var _a;
+    const semantic = getSemanticLabel(path, siblingKeys);
+    if (!semantic || !semantic.label || raw.trim().length === 0)
+        return null;
+    if (isAllowListed(raw, ctx.allowList))
+        return null;
+    const semConf = semantic.label === 'IDENTIFIER' ? context_1.AMBIGUOUS_FIELD_CONFIDENCE : context_1.SEMANTIC_CONFIDENCE;
+    if (semConf < ((_a = ctx.confidenceThreshold) !== null && _a !== void 0 ? _a : 0))
+        return null;
+    const replacement = applyRedaction(raw, { label: semantic.label, category: semantic.category }, ctx.mode, vault, sessionId, ctx.dedup, ctx.reservedTokens);
+    hits.push({
+        token: replacement, original: '***',
+        patternName: `semantic_${semantic.label}`,
+        patternLabel: semantic.label,
+        category: semantic.category,
+        field: display, itemIndex,
+        confidence: semConf,
+    });
+    return replacement;
+}
+function redactNumber(value, ctx, vault, sessionId, hits, itemIndex, path, display, siblingKeys) {
+    var _a;
+    const text = String(value);
+    const numCtx = { ...ctx, dedup: false };
+    let out = null;
+    if (!ctx.skipSemantic)
+        out = redactSemantic(text, numCtx, vault, sessionId, hits, itemIndex, path, display, siblingKeys);
+    if (out === null && ctx.scanNumbers)
+        out = redactText(text, numCtx, vault, sessionId, hits, itemIndex, display);
+    if (out === null || out === text)
+        return value;
+    const entry = (_a = vault.getSession(sessionId)) === null || _a === void 0 ? void 0 : _a.entries[out];
+    if (entry && entry.original === text)
+        entry.numeric = true;
+    return out;
+}
+function redactKey(key, taken, sourceKeys, ctx, vault, sessionId, itemIndex, keyHits) {
+    var _a;
+    const out = redactText(key, ctx, vault, sessionId, keyHits, itemIndex, '');
+    if (out === key)
+        return key;
+    const clashes = (k) => k === '' || k in taken || sourceKeys.has(k);
+    if (!clashes(out))
+        return out;
+    if (ctx.mode === 'token' || ctx.mode === 'pseudonymize') {
+        const token = freshToken('KEY', vault, sessionId, new Set([...((_a = ctx.reservedTokens) !== null && _a !== void 0 ? _a : []), ...sourceKeys, ...Object.keys(taken)]));
+        vault.addEntry(sessionId, { token, original: key, patternLabel: 'KEY', category: 'other', createdAt: new Date().toISOString() });
+        return token;
+    }
+    let suffixed = out;
+    for (let n = 1; clashes(suffixed); n++)
+        suffixed = `${out}_${n}`;
+    return suffixed;
+}
+function redactObject(value, ctx, vault, sessionId, hits, itemIndex, path, display) {
+    var _a;
+    const entries = Object.entries(value);
+    const siblingKeys = entries.map(([k]) => k);
+    const sourceKeys = new Set(siblingKeys);
+    const origins = new Map();
+    const obj = {};
+    for (const [k, v] of entries) {
+        const fieldPath = path ? `${path}.${k}` : k;
+        const keyHits = [];
+        const outKey = shouldProcessField(fieldPath, ctx.fieldMode, ctx.fieldRules)
+            ? redactKey(k, obj, sourceKeys, ctx, vault, sessionId, itemIndex, keyHits)
+            : k;
+        origins.set(outKey, k);
+        const childDisplay = display ? `${display}.${outKey}` : outKey;
+        for (const h of keyHits)
+            hits.push({ ...h, field: childDisplay });
+        obj[outKey] = redactValue(v, ctx, vault, sessionId, hits, itemIndex, fieldPath, siblingKeys, childDisplay);
+    }
+    (_a = ctx.keyOrigins) === null || _a === void 0 ? void 0 : _a.set(obj, origins);
+    return obj;
+}
+function redactValue(value, ctx, vault, sessionId, hits, itemIndex, currentPath = '', siblingKeys, displayPath = currentPath) {
+    const processed = shouldProcessField(currentPath, ctx.fieldMode, ctx.fieldRules);
     if (typeof value === 'string') {
-        if (!shouldProcessField(currentPath, ctx.fieldMode, ctx.fieldRules)) {
+        if (!processed)
             return value;
-        }
         if (!ctx.skipSemantic) {
-            const semantic = getSemanticLabel(currentPath, siblingKeys);
-            if (semantic && semantic.label && value.trim().length > 0) {
-                if (isAllowListed(value, ctx.allowList)) {
-                }
-                else {
-                    const semConf = semantic.label === 'IDENTIFIER' ? context_1.AMBIGUOUS_FIELD_CONFIDENCE : context_1.SEMANTIC_CONFIDENCE;
-                    if (semConf >= ((_a = ctx.confidenceThreshold) !== null && _a !== void 0 ? _a : 0)) {
-                        const replacement = applyRedaction(value, { label: semantic.label, category: semantic.category }, ctx.mode, vault, sessionId, ctx.dedup);
-                        hits.push({
-                            token: replacement, original: '***',
-                            patternName: `semantic_${semantic.label}`,
-                            patternLabel: semantic.label,
-                            category: semantic.category,
-                            field: currentPath, itemIndex,
-                            confidence: semConf,
-                        });
-                        return replacement;
-                    }
-                }
-            }
+            const semantic = redactSemantic(value, ctx, vault, sessionId, hits, itemIndex, currentPath, displayPath, siblingKeys);
+            if (semantic !== null)
+                return semantic;
         }
-        return redactText(value, ctx, vault, sessionId, hits, itemIndex, currentPath);
+        return redactText(value, ctx, vault, sessionId, hits, itemIndex, displayPath);
     }
-    if (typeof value === 'number' && !ctx.skipSemantic) {
-        if (!shouldProcessField(currentPath, ctx.fieldMode, ctx.fieldRules)) {
+    if (typeof value === 'number') {
+        if (!processed)
             return value;
-        }
-        const semantic = getSemanticLabel(currentPath, siblingKeys);
-        if (semantic && semantic.label) {
-            const semConf = semantic.label === 'IDENTIFIER' ? context_1.AMBIGUOUS_FIELD_CONFIDENCE : context_1.SEMANTIC_CONFIDENCE;
-            if (semConf >= ((_b = ctx.confidenceThreshold) !== null && _b !== void 0 ? _b : 0)) {
-                const strValue = String(value);
-                const replacement = applyRedaction(strValue, { label: semantic.label, category: semantic.category }, ctx.mode, vault, sessionId, ctx.dedup);
-                hits.push({
-                    token: replacement, original: '***',
-                    patternName: `semantic_${semantic.label}`,
-                    patternLabel: semantic.label,
-                    category: semantic.category,
-                    field: currentPath, itemIndex,
-                    confidence: semConf,
-                });
-                return replacement;
-            }
-        }
+        return redactNumber(value, ctx, vault, sessionId, hits, itemIndex, currentPath, displayPath, siblingKeys);
     }
     if (Array.isArray(value)) {
-        return value.map((v, i) => redactValue(v, ctx, vault, sessionId, hits, itemIndex, `${currentPath}[${i}]`));
+        return value.map((v, i) => redactValue(v, ctx, vault, sessionId, hits, itemIndex, `${currentPath}[${i}]`, undefined, `${displayPath}[${i}]`));
     }
     if (value !== null && typeof value === 'object') {
-        const entries = Object.entries(value);
-        const siblingKeys = entries.map(([k]) => k);
-        const obj = {};
-        for (const [k, v] of entries) {
-            const fieldPath = currentPath ? `${currentPath}.${k}` : k;
-            obj[k] = redactValue(v, ctx, vault, sessionId, hits, itemIndex, fieldPath, siblingKeys);
-        }
-        return obj;
+        return redactObject(value, ctx, vault, sessionId, hits, itemIndex, currentPath, displayPath);
     }
     return value;
 }
-function redactText(text, ctx, vault, sessionId, hits, itemIndex, fieldPath) {
+const escapeRe = (text) => text.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+function segments(text, produced) {
     var _a;
-    let result = text;
-    const threshold = (_a = ctx.confidenceThreshold) !== null && _a !== void 0 ? _a : 0;
-    if (ctx.denyList && ctx.denyList.length > 0) {
-        for (const entry of ctx.denyList) {
-            try {
-                let re;
-                switch (entry.type) {
-                    case 'regex':
-                        if (!isSafeRegex(entry.value))
-                            continue;
-                        re = new RegExp(entry.value, 'gi');
-                        break;
-                    case 'contains':
-                        re = new RegExp(entry.value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&'), 'gi');
-                        break;
-                    default:
-                        re = new RegExp(entry.value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&'), 'gi');
-                }
-                result = result.replace(re, (match) => {
-                    if (TOKEN_RE.test(match))
-                        return match;
-                    const replacement = applyRedaction(match, { label: 'DENY_LIST', category: 'other' }, ctx.mode, vault, sessionId, ctx.dedup);
-                    hits.push({
-                        token: replacement, original: '***',
-                        patternName: 'denyList', patternLabel: 'DENY_LIST',
-                        category: 'other', field: fieldPath, itemIndex,
-                        confidence: context_1.DENY_LIST_CONFIDENCE,
-                    });
-                    return replacement;
-                });
-            }
-            catch { }
-        }
-    }
-    const enabled = (0, patterns_1.getPatternsByNames)(ctx.enabledPatterns);
-    const activePatterns = [...enabled.filter((p) => p.validate), ...enabled.filter((p) => !p.validate)];
-    for (const pattern of activePatterns) {
-        const re = new RegExp(pattern.regex.source, pattern.regex.flags);
-        result = result.replace(re, (match, ...args) => {
-            if (TOKEN_RE.test(match) || (match.startsWith('[') && match.endsWith(']')))
-                return match;
-            const validatorPassed = pattern.validate ? pattern.validate(match) : true;
-            if (pattern.validate && !validatorPassed)
-                return match;
-            if (isAllowListed(match, ctx.allowList))
-                return match;
-            const matchOffset = typeof args[args.length - 2] === 'number' ? args[args.length - 2] : 0;
-            const confidence = (0, context_1.calculateConfidence)(pattern.name, !!pattern.validate, validatorPassed, text, matchOffset, matchOffset + match.length);
-            if (confidence < threshold)
-                return match;
-            const replacement = applyRedaction(match, pattern, ctx.mode, vault, sessionId, ctx.dedup);
-            hits.push({
-                token: replacement, original: '***',
-                patternName: pattern.name, patternLabel: pattern.label,
-                category: pattern.category, field: fieldPath, itemIndex,
-                confidence,
-            });
-            return replacement;
-        });
+    if (produced.size === 0)
+        return [{ text, locked: false }];
+    const guard = new RegExp([...produced].sort((a, b) => b.length - a.length).map(escapeRe).join('|'), 'g');
+    const out = [];
+    let last = 0;
+    for (const m of text.matchAll(guard)) {
+        const at = (_a = m.index) !== null && _a !== void 0 ? _a : 0;
+        if (at > last)
+            out.push({ text: text.slice(last, at), locked: false });
+        out.push({ text: m[0], locked: true });
+        last = at + m[0].length;
     }
-    if (!ctx.skipSemantic) {
-        const nameMatches = (0, names_1.detectNamesInText)(result);
-        for (const nm of nameMatches) {
-            if (nm.name.includes('[') && nm.name.includes(']'))
-                continue;
-            if (isAllowListed(nm.name, ctx.allowList))
-                continue;
-            let nameConfidence = 0.65;
-            if ((0, context_1.hasContextWords)(text, nm.start, nm.end, names_1.NAME_CONTEXT_WORDS)) {
-                nameConfidence = 0.80;
-            }
-            if (nameConfidence < threshold)
+    if (last < text.length)
+        out.push({ text: text.slice(last), locked: false });
+    return out;
+}
+function replaceOutside(text, produced, re, fn) {
+    return segments(text, produced)
+        .map((seg) => (seg.locked ? seg.text : seg.text.replace(new RegExp(re.source, re.flags), fn)))
+        .join('');
+}
+function occursOutside(text, produced, needle) {
+    return segments(text, produced).some((seg) => !seg.locked && seg.text.includes(needle));
+}
+function redactMatch(pass, match, pattern, detail) {
+    const { ctx, vault, sessionId } = pass;
+    const replacement = applyRedaction(match, pattern, ctx.mode, vault, sessionId, ctx.dedup, ctx.reservedTokens);
+    pass.hits.push({ token: replacement, original: '***', field: pass.fieldPath, itemIndex: pass.itemIndex, ...detail });
+    if (replacement)
+        pass.produced.add(replacement);
+    return replacement;
+}
+function denyListRegex(entry) {
+    if (entry.type === 'regex')
+        return isSafeRegex(entry.value) ? new RegExp(entry.value, 'gi') : null;
+    return new RegExp(escapeRe(entry.value), 'gi');
+}
+function denyListStage(pass) {
+    var _a;
+    for (const entry of (_a = pass.ctx.denyList) !== null && _a !== void 0 ? _a : []) {
+        try {
+            const re = denyListRegex(entry);
+            if (!re)
                 continue;
-            const replacement = applyRedaction(nm.name, { label: 'PERSON_NAME', category: 'identity' }, ctx.mode, vault, sessionId, ctx.dedup);
-            result = result.split(nm.name).join(replacement);
-            hits.push({
-                token: replacement, original: '***',
-                patternName: 'personNameDict', patternLabel: 'PERSON_NAME',
-                category: 'identity', field: fieldPath, itemIndex,
-                confidence: nameConfidence,
-            });
+            pass.result = replaceOutside(pass.result, pass.produced, re, (match) => TOKEN_RE.test(match)
+                ? match
+                : redactMatch(pass, match, { label: 'DENY_LIST', category: 'other' }, {
+                    patternName: 'denyList', patternLabel: 'DENY_LIST', category: 'other', confidence: context_1.DENY_LIST_CONFIDENCE,
+                }));
         }
+        catch { }
     }
-    for (const cp of ctx.customPatterns) {
-        if (!cp.label || !cp.regex)
+}
+function builtInMatch(pass, pattern, match, args) {
+    if (TOKEN_RE.test(match) || (match.startsWith('[') && match.endsWith(']')))
+        return match;
+    const validatorPassed = pattern.validate ? pattern.validate(match) : true;
+    if (!validatorPassed || isAllowListed(match, pass.ctx.allowList))
+        return match;
+    const offsetArg = args[args.length - 2];
+    const offset = typeof offsetArg === 'number' ? offsetArg : 0;
+    const confidence = (0, context_1.calculateConfidence)(pattern.name, !!pattern.validate, validatorPassed, pass.source, offset, offset + match.length);
+    if (confidence < pass.threshold)
+        return match;
+    return redactMatch(pass, match, pattern, {
+        patternName: pattern.name, patternLabel: pattern.label, category: pattern.category, confidence,
+    });
+}
+function builtInStage(pass) {
+    const enabled = (0, patterns_1.getPatternsByNames)(pass.ctx.enabledPatterns);
+    for (const pattern of [...enabled.filter((p) => p.validate), ...enabled.filter((p) => !p.validate)]) {
+        const re = new RegExp(pattern.regex.source, pattern.regex.flags);
+        pass.result = replaceOutside(pass.result, pass.produced, re, (match, ...args) => builtInMatch(pass, pattern, match, args));
+    }
+}
+function nameStage(pass) {
+    if (pass.ctx.skipSemantic)
+        return;
+    for (const nm of (0, names_1.detectNamesInText)(pass.result)) {
+        if ((nm.name.includes('[') && nm.name.includes(']')) || isAllowListed(nm.name, pass.ctx.allowList))
+            continue;
+        const confidence = (0, context_1.hasContextWords)(pass.source, nm.start, nm.end, names_1.NAME_CONTEXT_WORDS) ? 0.8 : 0.65;
+        if (confidence < pass.threshold || !occursOutside(pass.result, pass.produced, nm.name))
             continue;
-        if (!isSafeRegex(cp.regex))
+        const before = new Set(pass.produced);
+        const replacement = redactMatch(pass, nm.name, { label: 'PERSON_NAME', category: 'identity' }, {
+            patternName: 'personNameDict', patternLabel: 'PERSON_NAME', category: 'identity', confidence,
+        });
+        pass.result = replaceOutside(pass.result, before, new RegExp(escapeRe(nm.name), 'g'), () => replacement);
+    }
+}
+function customStage(pass) {
+    if (context_1.CUSTOM_PATTERN_CONFIDENCE < pass.threshold)
+        return;
+    for (const cp of pass.ctx.customPatterns) {
+        if (!cp.label || !cp.regex || !isSafeRegex(cp.regex))
             continue;
+        const pattern = { label: cp.label.toUpperCase(), category: cp.category || 'identity' };
         try {
-            const re = new RegExp(cp.regex, 'g');
-            result = result.replace(re, (match) => {
-                if (TOKEN_RE.test(match))
-                    return match;
-                if (isAllowListed(match, ctx.allowList))
-                    return match;
-                if (context_1.CUSTOM_PATTERN_CONFIDENCE < threshold)
-                    return match;
-                const pseudoPattern = {
-                    label: cp.label.toUpperCase(),
-                    category: cp.category || 'identity',
-                };
-                const replacement = applyRedaction(match, pseudoPattern, ctx.mode, vault, sessionId, ctx.dedup);
-                hits.push({
-                    token: replacement, original: '***',
-                    patternName: `custom_${cp.label}`, patternLabel: pseudoPattern.label,
-                    category: pseudoPattern.category, field: fieldPath, itemIndex,
+            pass.result = replaceOutside(pass.result, pass.produced, new RegExp(cp.regex, 'g'), (match) => TOKEN_RE.test(match) || isAllowListed(match, pass.ctx.allowList)
+                ? match
+                : redactMatch(pass, match, pattern, {
+                    patternName: `custom_${cp.label}`, patternLabel: pattern.label, category: pattern.category,
                     confidence: context_1.CUSTOM_PATTERN_CONFIDENCE,
-                });
-                return replacement;
-            });
+                }));
         }
-        catch {
+        catch { }
+    }
+}
+function redactText(text, ctx, vault, sessionId, hits, itemIndex, fieldPath) {
+    var _a;
+    const pass = {
+        source: text, result: text, produced: new Set(), threshold: (_a = ctx.confidenceThreshold) !== null && _a !== void 0 ? _a : 0,
+        ctx, vault, sessionId, hits, itemIndex, fieldPath,
+    };
+    denyListStage(pass);
+    builtInStage(pass);
+    nameStage(pass);
+    customStage(pass);
+    return pass.result;
+}
+function makeRestorer(entries) {
+    const tokens = Object.keys(entries).filter((t) => t.length > 0).sort((a, b) => b.length - a.length);
+    if (tokens.length === 0)
+        return (text) => text;
+    const re = new RegExp(tokens.map((t) => t.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')).join('|'), 'g');
+    return (text) => text.replace(re, (token) => entries[token].original);
+}
+function restoreWith(value, restore, entries) {
+    if (typeof value === 'string') {
+        const exact = entries[value];
+        if ((exact === null || exact === void 0 ? void 0 : exact.numeric) && Number.isFinite(Number(exact.original)))
+            return Number(exact.original);
+        return restore(value);
+    }
+    if (Array.isArray(value))
+        return value.map((v) => restoreWith(v, restore, entries));
+    if (value !== null && typeof value === 'object') {
+        const obj = {};
+        for (const [k, v] of Object.entries(value)) {
+            obj[restore(k)] = restoreWith(v, restore, entries);
         }
+        return obj;
     }
-    return result;
+    return value;
 }
 function restoreValue(value, vault, sessionId) {
     const session = vault.getSession(sessionId);
     if (!session)
         return value;
+    return restoreWith(value, makeRestorer(session.entries), session.entries);
+}
+function toUtf16Spans(text, entities) {
+    const offsets = [0];
+    for (const ch of text)
+        offsets.push(offsets[offsets.length - 1] + ch.length);
+    return entities
+        .filter((e) => Number.isInteger(e.start) && Number.isInteger(e.end) && e.start >= 0 && e.end > e.start && e.end < offsets.length)
+        .map((e) => ({ start: offsets[e.start], end: offsets[e.end], score: e.score, entityType: e.entity_type }));
+}
+function resolveOverlaps(spans) {
+    const ranked = [...spans].sort((a, b) => b.score - a.score || (b.end - b.start) - (a.end - a.start) || a.start - b.start);
+    const kept = [];
+    for (const span of ranked) {
+        if (!kept.some((k) => span.start < k.end && k.start < span.end))
+            kept.push(span);
+    }
+    return kept.sort((a, b) => b.start - a.start);
+}
+async function presidioRedactString(value, ctx, vault, sessionId, hits, itemIndex, path) {
+    var _a;
+    if (value.trim().length === 0 || TOKEN_RE.test(value))
+        return value;
+    const entities = await (0, presidio_1.analyzeWithPresidio)(ctx.presidioUrl, value, ctx.presidioLanguage || 'en', 0.4, 10000, ctx.presidioRequest);
+    const threshold = (_a = ctx.confidenceThreshold) !== null && _a !== void 0 ? _a : 0;
+    const spans = resolveOverlaps(toUtf16Spans(value, entities).filter((s) => s.score >= threshold));
+    let text = value;
+    for (const span of spans) {
+        const matchedText = value.slice(span.start, span.end);
+        if (TOKEN_RE.test(matchedText) || (matchedText.startsWith('[') && matchedText.endsWith(']')))
+            continue;
+        if (isAllowListed(matchedText, ctx.allowList))
+            continue;
+        const label = (0, presidio_1.getRedactorLabel)(span.entityType);
+        const category = (0, presidio_1.getRedactorCategory)(span.entityType);
+        const replacement = applyRedaction(matchedText, { label, category }, ctx.mode, vault, sessionId, ctx.dedup, ctx.reservedTokens);
+        text = text.slice(0, span.start) + replacement + text.slice(span.end);
+        hits.push({
+            token: replacement, original: '***',
+            patternName: `presidio_${span.entityType}`, patternLabel: label,
+            category, field: path, itemIndex, confidence: span.score,
+        });
+    }
+    return text;
+}
+async function presidioWalk(value, ctx, vault, sessionId, hits, itemIndex, path, policyPath) {
+    var _a, _b;
     if (typeof value === 'string') {
-        let result = value;
-        for (const [token, e] of Object.entries(session.entries)) {
-            result = result.split(token).join(e.original);
+        if (!shouldProcessField(policyPath, ctx.fieldMode, ctx.fieldRules))
+            return value;
+        try {
+            return await presidioRedactString(value, ctx, vault, sessionId, hits, itemIndex, path);
+        }
+        catch {
+            return value;
         }
-        return result;
     }
     if (Array.isArray(value)) {
-        return value.map((v) => restoreValue(v, vault, sessionId));
+        const out = [];
+        for (let i = 0; i < value.length; i++) {
+            out.push(await presidioWalk(value[i], ctx, vault, sessionId, hits, itemIndex, `${path}[${i}]`, `${policyPath}[${i}]`));
+        }
+        return out;
     }
     if (value !== null && typeof value === 'object') {
-        const obj = {};
+        const origins = (_a = ctx.keyOrigins) === null || _a === void 0 ? void 0 : _a.get(value);
+        const out = {};
         for (const [k, v] of Object.entries(value)) {
-            obj[k] = restoreValue(v, vault, sessionId);
+            const original = (_b = origins === null || origins === void 0 ? void 0 : origins.get(k)) !== null && _b !== void 0 ? _b : k;
+            const child = path ? `${path}.${k}` : k;
+            const childPolicy = policyPath ? `${policyPath}.${original}` : original;
+            out[k] = await presidioWalk(v, ctx, vault, sessionId, hits, itemIndex, child, childPolicy);
         }
-        return obj;
+        return out;
     }
     return value;
 }
 async function enhanceWithPresidio(data, ctx, vault, sessionId, hits, itemIndex) {
-    var _a;
     if (!ctx.presidioUrl)
         return data;
-    const result = { ...data };
-    for (const [key, value] of Object.entries(result)) {
-        if (value !== null && typeof value === 'object' && !Array.isArray(value)) {
-            result[key] = await enhanceWithPresidio(value, ctx, vault, sessionId, hits, itemIndex);
-            continue;
-        }
-        if (Array.isArray(value)) {
-            const arr = [];
-            for (const item of value) {
-                if (item !== null && typeof item === 'object') {
-                    arr.push(await enhanceWithPresidio(item, ctx, vault, sessionId, hits, itemIndex));
-                }
-                else {
-                    arr.push(item);
-                }
-            }
-            result[key] = arr;
-            continue;
-        }
-        if (typeof value !== 'string')
-            continue;
-        if (value.trim().length === 0)
-            continue;
-        if (TOKEN_RE.test(value))
-            continue;
-        try {
-            const entities = await (0, presidio_1.analyzeWithPresidio)(ctx.presidioUrl, value, ctx.presidioLanguage || 'en', 0.4, 10000, ctx.presidioRequest);
-            if (entities.length === 0)
-                continue;
-            const sorted = entities.sort((a, b) => b.start - a.start);
-            let text = value;
-            for (const entity of sorted) {
-                const matchedText = text.slice(entity.start, entity.end);
-                if (TOKEN_RE.test(matchedText) || (matchedText.startsWith('[') && matchedText.endsWith(']')))
-                    continue;
-                if (isAllowListed(matchedText, ctx.allowList))
-                    continue;
-                if (entity.score < ((_a = ctx.confidenceThreshold) !== null && _a !== void 0 ? _a : 0))
-                    continue;
-                const label = (0, presidio_1.getRedactorLabel)(entity.entity_type);
-                const category = (0, presidio_1.getRedactorCategory)(entity.entity_type);
-                const replacement = applyRedaction(matchedText, { label, category }, ctx.mode, vault, sessionId, ctx.dedup);
-                text = text.slice(0, entity.start) + replacement + text.slice(entity.end);
-                hits.push({
-                    token: replacement,
-                    original: '***',
-                    patternName: `presidio_${entity.entity_type}`,
-                    patternLabel: label,
-                    category,
-                    field: key,
-                    itemIndex,
-                    confidence: entity.score,
-                });
-            }
-            result[key] = text;
-        }
-        catch {
-            continue;
-        }
-    }
-    return result;
+    return (await presidioWalk(data, ctx, vault, sessionId, hits, itemIndex, '', ''));
 }
 function buildReport(sessionId, hits) {
     const hitsByCategory = {};