n8n-nodes-redactor 4.1.0 → 4.2.0

package/dist/nodes/Redactor/Redactor.node.js

@@ -1036,6 +1036,9 @@ class Redactor {
                 presidioUrl: enablePresidio ? presidioUrl : undefined,
                 presidioLanguage: enablePresidio ? presidioLanguage : undefined,
                 presidioRequest: enablePresidio ? presidioRequester : undefined,
+                scanNumbers: true,
+                reservedTokens: (0, engine_1.collectTokenLike)(items.map((it) => it.json)),
+                keyOrigins: new WeakMap(),
             };
             const allHits = [];
             const returnData = [];
@@ -1118,48 +1121,27 @@ class Redactor {
                 if (!purgeSessionId) {
                     throw new n8n_workflow_1.NodeOperationError(this.getNode(), 'Session ID is required for purging a specific session.');
                 }
-                const session = vault.getSession(purgeSessionId);
-                if (session) {
-                    const entryCount = Object.keys(session.entries).length;
-                    vault.deleteSession(purgeSessionId);
-                    return [[{
-                                json: {
-                                    purged: true,
-                                    sessionId: purgeSessionId,
-                                    entriesDeleted: entryCount,
-                                    message: `Session purged successfully.`,
-                                },
-                                pairedItem: allPaired,
-                            }]];
-                }
-                else {
-                    return [[{
-                                json: {
-                                    purged: false,
-                                    sessionId: purgeSessionId,
-                                    message: `No session found with this ID.`,
-                                },
-                                pairedItem: allPaired,
-                            }]];
-                }
-            }
-            else {
-                const sessions = vault.listSessions();
-                let totalEntries = 0;
-                for (const s of sessions) {
-                    totalEntries += s.entryCount;
-                    vault.deleteSession(s.sessionId);
-                }
+                const purged = vault.purgeSession(purgeSessionId);
                 return [[{
                             json: {
-                                purged: true,
-                                sessionsPurged: sessions.length,
-                                totalEntriesDeleted: totalEntries,
-                                message: `All ${sessions.length} session(s) purged successfully.`,
+                                purged: purged.found,
+                                sessionId: purgeSessionId,
+                                ...(purged.found ? { entriesDeleted: purged.entries } : {}),
+                                message: purged.found ? 'Session purged successfully.' : 'No session found with this ID.',
                             },
                             pairedItem: allPaired,
                         }]];
             }
+            const all = vault.purgeAll();
+            return [[{
+                        json: {
+                            purged: true,
+                            sessionsPurged: all.sessions,
+                            totalEntriesDeleted: all.entries,
+                            message: `All ${all.sessions} session(s) purged successfully.`,
+                        },
+                        pairedItem: allPaired,
+                    }]];
         }
         return [[]];
     }

package/dist/nodes/Redactor/engine.js

@@ -33,6 +33,7 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.collectTokenLike = collectTokenLike;
 exports.redactValue = redactValue;
 exports.restoreValue = restoreValue;
 exports.enhanceWithPresidio = enhanceWithPresidio;
@@ -99,7 +100,7 @@ function hashValue(value) {
 function storeReversible(match, pattern, vault, sessionId, dedup, makeToken) {
     if (dedup) {
         const existing = vault.findByOriginal(sessionId, match);
-        if (existing)
+        if (existing && !existing.numeric)
             return existing.token;
     }
     const token = makeToken();
@@ -119,12 +120,9 @@ const IRREVERSIBLE = {
     blackout: (match) => '\u2588'.repeat(match.length),
     remove: () => '',
 };
-function applyRedaction(match, pattern, mode, vault, sessionId, dedup) {
+function applyRedaction(match, pattern, mode, vault, sessionId, dedup, reserved) {
     if (mode === 'token') {
-        return storeReversible(match, pattern, vault, sessionId, dedup, () => {
-            const session = vault.getSession(sessionId);
-            return generateToken(pattern.label, session ? Object.keys(session.entries).length : 0);
-        });
+        return storeReversible(match, pattern, vault, sessionId, dedup, () => freshToken(pattern.label, vault, sessionId, reserved));
     }
     if (mode === 'pseudonymize') {
         return storeReversible(match, pattern, vault, sessionId, dedup, () => uniquePseudonym(vault, sessionId, match, pattern.label));
@@ -132,6 +130,33 @@ function applyRedaction(match, pattern, mode, vault, sessionId, dedup) {
     const irreversible = IRREVERSIBLE[mode];
     return irreversible ? irreversible(match, pattern.label) : match;
 }
+function freshToken(label, vault, sessionId, reserved) {
+    var _a, _b;
+    const entries = (_b = (_a = vault.getSession(sessionId)) === null || _a === void 0 ? void 0 : _a.entries) !== null && _b !== void 0 ? _b : {};
+    let index = Object.keys(entries).length;
+    let token = generateToken(label, index);
+    while (entries[token] || (reserved === null || reserved === void 0 ? void 0 : reserved.has(token)))
+        token = generateToken(label, ++index);
+    return token;
+}
+const TOKEN_LIKE_RE = /\[[A-Z][A-Z0-9_]*_\d+\]/g;
+function collectTokenLike(value, into = new Set()) {
+    const scan = (text) => {
+        for (const m of text.matchAll(TOKEN_LIKE_RE))
+            into.add(m[0]);
+    };
+    if (typeof value === 'string')
+        scan(value);
+    else if (Array.isArray(value))
+        value.forEach((v) => collectTokenLike(v, into));
+    else if (value !== null && typeof value === 'object') {
+        for (const [k, v] of Object.entries(value)) {
+            scan(k);
+            collectTokenLike(v, into);
+        }
+    }
+    return into;
+}
 function uniquePseudonym(vault, sessionId, original, label) {
     var _a, _b;
     const entries = (_b = (_a = vault.getSession(sessionId)) === null || _a === void 0 ? void 0 : _a.entries) !== null && _b !== void 0 ? _b : {};
@@ -139,6 +164,8 @@ function uniquePseudonym(vault, sessionId, original, label) {
         const seed = attempt === 0 ? original : `${original}\u0000${attempt}`;
         const candidate = (0, pseudonymize_1.generatePseudonym)(sessionId, seed, label);
         const taken = entries[candidate];
+        if (candidate === original)
+            continue;
         if (!taken || taken.original === original)
             return candidate;
     }
@@ -385,7 +412,7 @@ function redactSemantic(raw, ctx, vault, sessionId, hits, itemIndex, path, displ
     const semConf = semantic.label === 'IDENTIFIER' ? context_1.AMBIGUOUS_FIELD_CONFIDENCE : context_1.SEMANTIC_CONFIDENCE;
     if (semConf < ((_a = ctx.confidenceThreshold) !== null && _a !== void 0 ? _a : 0))
         return null;
-    const replacement = applyRedaction(raw, { label: semantic.label, category: semantic.category }, ctx.mode, vault, sessionId, ctx.dedup);
+    const replacement = applyRedaction(raw, { label: semantic.label, category: semantic.category }, ctx.mode, vault, sessionId, ctx.dedup, ctx.reservedTokens);
     hits.push({
         token: replacement, original: '***',
         patternName: `semantic_${semantic.label}`,
@@ -397,41 +424,59 @@ function redactSemantic(raw, ctx, vault, sessionId, hits, itemIndex, path, displ
     return replacement;
 }
 function redactNumber(value, ctx, vault, sessionId, hits, itemIndex, path, display, siblingKeys) {
+    var _a;
     const text = String(value);
-    if (!ctx.skipSemantic) {
-        const semantic = redactSemantic(text, ctx, vault, sessionId, hits, itemIndex, path, display, siblingKeys);
-        if (semantic !== null)
-            return semantic;
-    }
-    if (!ctx.scanNumbers)
+    const numCtx = { ...ctx, dedup: false };
+    let out = null;
+    if (!ctx.skipSemantic)
+        out = redactSemantic(text, numCtx, vault, sessionId, hits, itemIndex, path, display, siblingKeys);
+    if (out === null && ctx.scanNumbers)
+        out = redactText(text, numCtx, vault, sessionId, hits, itemIndex, display);
+    if (out === null || out === text)
         return value;
-    const scanned = redactText(text, ctx, vault, sessionId, hits, itemIndex, display);
-    return scanned === text ? value : scanned;
+    const entry = (_a = vault.getSession(sessionId)) === null || _a === void 0 ? void 0 : _a.entries[out];
+    if (entry && entry.original === text)
+        entry.numeric = true;
+    return out;
 }
-function redactKey(key, taken, ctx, vault, sessionId, itemIndex, keyHits) {
-    let out = redactText(key, ctx, vault, sessionId, keyHits, itemIndex, '');
+function redactKey(key, taken, sourceKeys, ctx, vault, sessionId, itemIndex, keyHits) {
+    var _a;
+    const out = redactText(key, ctx, vault, sessionId, keyHits, itemIndex, '');
     if (out === key)
         return key;
-    const base = out;
-    for (let n = 1; out === '' || out in taken; n++)
-        out = `${base}_${n}`;
-    return out;
+    const clashes = (k) => k === '' || k in taken || sourceKeys.has(k);
+    if (!clashes(out))
+        return out;
+    if (ctx.mode === 'token' || ctx.mode === 'pseudonymize') {
+        const token = freshToken('KEY', vault, sessionId, new Set([...((_a = ctx.reservedTokens) !== null && _a !== void 0 ? _a : []), ...sourceKeys, ...Object.keys(taken)]));
+        vault.addEntry(sessionId, { token, original: key, patternLabel: 'KEY', category: 'other', createdAt: new Date().toISOString() });
+        return token;
+    }
+    let suffixed = out;
+    for (let n = 1; clashes(suffixed); n++)
+        suffixed = `${out}_${n}`;
+    return suffixed;
 }
 function redactObject(value, ctx, vault, sessionId, hits, itemIndex, path, display) {
+    var _a;
     const entries = Object.entries(value);
     const siblingKeys = entries.map(([k]) => k);
+    const sourceKeys = new Set(siblingKeys);
+    const origins = new Map();
     const obj = {};
     for (const [k, v] of entries) {
         const fieldPath = path ? `${path}.${k}` : k;
         const keyHits = [];
         const outKey = shouldProcessField(fieldPath, ctx.fieldMode, ctx.fieldRules)
-            ? redactKey(k, obj, ctx, vault, sessionId, itemIndex, keyHits)
+            ? redactKey(k, obj, sourceKeys, ctx, vault, sessionId, itemIndex, keyHits)
             : k;
+        origins.set(outKey, k);
         const childDisplay = display ? `${display}.${outKey}` : outKey;
         for (const h of keyHits)
             hits.push({ ...h, field: childDisplay });
         obj[outKey] = redactValue(v, ctx, vault, sessionId, hits, itemIndex, fieldPath, siblingKeys, childDisplay);
     }
+    (_a = ctx.keyOrigins) === null || _a === void 0 ? void 0 : _a.set(obj, origins);
     return obj;
 }
 function redactValue(value, ctx, vault, sessionId, hits, itemIndex, currentPath = '', siblingKeys, displayPath = currentPath) {
@@ -459,123 +504,129 @@ function redactValue(value, ctx, vault, sessionId, hits, itemIndex, currentPath
     }
     return value;
 }
-function redactText(text, ctx, vault, sessionId, hits, itemIndex, fieldPath) {
+const escapeRe = (text) => text.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+function segments(text, produced) {
     var _a;
-    let result = text;
-    const threshold = (_a = ctx.confidenceThreshold) !== null && _a !== void 0 ? _a : 0;
-    if (ctx.denyList && ctx.denyList.length > 0) {
-        for (const entry of ctx.denyList) {
-            try {
-                let re;
-                switch (entry.type) {
-                    case 'regex':
-                        if (!isSafeRegex(entry.value))
-                            continue;
-                        re = new RegExp(entry.value, 'gi');
-                        break;
-                    case 'contains':
-                        re = new RegExp(entry.value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&'), 'gi');
-                        break;
-                    default:
-                        re = new RegExp(entry.value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&'), 'gi');
-                }
-                result = result.replace(re, (match) => {
-                    if (TOKEN_RE.test(match))
-                        return match;
-                    const replacement = applyRedaction(match, { label: 'DENY_LIST', category: 'other' }, ctx.mode, vault, sessionId, ctx.dedup);
-                    hits.push({
-                        token: replacement, original: '***',
-                        patternName: 'denyList', patternLabel: 'DENY_LIST',
-                        category: 'other', field: fieldPath, itemIndex,
-                        confidence: context_1.DENY_LIST_CONFIDENCE,
-                    });
-                    return replacement;
-                });
-            }
-            catch { }
-        }
-    }
-    const enabled = (0, patterns_1.getPatternsByNames)(ctx.enabledPatterns);
-    const activePatterns = [...enabled.filter((p) => p.validate), ...enabled.filter((p) => !p.validate)];
-    for (const pattern of activePatterns) {
-        const re = new RegExp(pattern.regex.source, pattern.regex.flags);
-        result = result.replace(re, (match, ...args) => {
-            if (TOKEN_RE.test(match) || (match.startsWith('[') && match.endsWith(']')))
-                return match;
-            const validatorPassed = pattern.validate ? pattern.validate(match) : true;
-            if (pattern.validate && !validatorPassed)
-                return match;
-            if (isAllowListed(match, ctx.allowList))
-                return match;
-            const matchOffset = typeof args[args.length - 2] === 'number' ? args[args.length - 2] : 0;
-            const confidence = (0, context_1.calculateConfidence)(pattern.name, !!pattern.validate, validatorPassed, text, matchOffset, matchOffset + match.length);
-            if (confidence < threshold)
-                return match;
-            const replacement = applyRedaction(match, pattern, ctx.mode, vault, sessionId, ctx.dedup);
-            hits.push({
-                token: replacement, original: '***',
-                patternName: pattern.name, patternLabel: pattern.label,
-                category: pattern.category, field: fieldPath, itemIndex,
-                confidence,
-            });
-            return replacement;
-        });
+    if (produced.size === 0)
+        return [{ text, locked: false }];
+    const guard = new RegExp([...produced].sort((a, b) => b.length - a.length).map(escapeRe).join('|'), 'g');
+    const out = [];
+    let last = 0;
+    for (const m of text.matchAll(guard)) {
+        const at = (_a = m.index) !== null && _a !== void 0 ? _a : 0;
+        if (at > last)
+            out.push({ text: text.slice(last, at), locked: false });
+        out.push({ text: m[0], locked: true });
+        last = at + m[0].length;
     }
-    if (!ctx.skipSemantic) {
-        const nameMatches = (0, names_1.detectNamesInText)(result);
-        for (const nm of nameMatches) {
-            if (nm.name.includes('[') && nm.name.includes(']'))
-                continue;
-            if (isAllowListed(nm.name, ctx.allowList))
-                continue;
-            let nameConfidence = 0.65;
-            if ((0, context_1.hasContextWords)(text, nm.start, nm.end, names_1.NAME_CONTEXT_WORDS)) {
-                nameConfidence = 0.80;
-            }
-            if (nameConfidence < threshold)
+    if (last < text.length)
+        out.push({ text: text.slice(last), locked: false });
+    return out;
+}
+function replaceOutside(text, produced, re, fn) {
+    return segments(text, produced)
+        .map((seg) => (seg.locked ? seg.text : seg.text.replace(new RegExp(re.source, re.flags), fn)))
+        .join('');
+}
+function occursOutside(text, produced, needle) {
+    return segments(text, produced).some((seg) => !seg.locked && seg.text.includes(needle));
+}
+function redactMatch(pass, match, pattern, detail) {
+    const { ctx, vault, sessionId } = pass;
+    const replacement = applyRedaction(match, pattern, ctx.mode, vault, sessionId, ctx.dedup, ctx.reservedTokens);
+    pass.hits.push({ token: replacement, original: '***', field: pass.fieldPath, itemIndex: pass.itemIndex, ...detail });
+    if (replacement)
+        pass.produced.add(replacement);
+    return replacement;
+}
+function denyListRegex(entry) {
+    if (entry.type === 'regex')
+        return isSafeRegex(entry.value) ? new RegExp(entry.value, 'gi') : null;
+    return new RegExp(escapeRe(entry.value), 'gi');
+}
+function denyListStage(pass) {
+    var _a;
+    for (const entry of (_a = pass.ctx.denyList) !== null && _a !== void 0 ? _a : []) {
+        try {
+            const re = denyListRegex(entry);
+            if (!re)
                 continue;
-            const replacement = applyRedaction(nm.name, { label: 'PERSON_NAME', category: 'identity' }, ctx.mode, vault, sessionId, ctx.dedup);
-            result = result.split(nm.name).join(replacement);
-            hits.push({
-                token: replacement, original: '***',
-                patternName: 'personNameDict', patternLabel: 'PERSON_NAME',
-                category: 'identity', field: fieldPath, itemIndex,
-                confidence: nameConfidence,
-            });
+            pass.result = replaceOutside(pass.result, pass.produced, re, (match) => TOKEN_RE.test(match)
+                ? match
+                : redactMatch(pass, match, { label: 'DENY_LIST', category: 'other' }, {
+                    patternName: 'denyList', patternLabel: 'DENY_LIST', category: 'other', confidence: context_1.DENY_LIST_CONFIDENCE,
+                }));
         }
+        catch { }
     }
-    for (const cp of ctx.customPatterns) {
-        if (!cp.label || !cp.regex)
+}
+function builtInMatch(pass, pattern, match, args) {
+    if (TOKEN_RE.test(match) || (match.startsWith('[') && match.endsWith(']')))
+        return match;
+    const validatorPassed = pattern.validate ? pattern.validate(match) : true;
+    if (!validatorPassed || isAllowListed(match, pass.ctx.allowList))
+        return match;
+    const offsetArg = args[args.length - 2];
+    const offset = typeof offsetArg === 'number' ? offsetArg : 0;
+    const confidence = (0, context_1.calculateConfidence)(pattern.name, !!pattern.validate, validatorPassed, pass.source, offset, offset + match.length);
+    if (confidence < pass.threshold)
+        return match;
+    return redactMatch(pass, match, pattern, {
+        patternName: pattern.name, patternLabel: pattern.label, category: pattern.category, confidence,
+    });
+}
+function builtInStage(pass) {
+    const enabled = (0, patterns_1.getPatternsByNames)(pass.ctx.enabledPatterns);
+    for (const pattern of [...enabled.filter((p) => p.validate), ...enabled.filter((p) => !p.validate)]) {
+        const re = new RegExp(pattern.regex.source, pattern.regex.flags);
+        pass.result = replaceOutside(pass.result, pass.produced, re, (match, ...args) => builtInMatch(pass, pattern, match, args));
+    }
+}
+function nameStage(pass) {
+    if (pass.ctx.skipSemantic)
+        return;
+    for (const nm of (0, names_1.detectNamesInText)(pass.result)) {
+        if ((nm.name.includes('[') && nm.name.includes(']')) || isAllowListed(nm.name, pass.ctx.allowList))
             continue;
-        if (!isSafeRegex(cp.regex))
+        const confidence = (0, context_1.hasContextWords)(pass.source, nm.start, nm.end, names_1.NAME_CONTEXT_WORDS) ? 0.8 : 0.65;
+        if (confidence < pass.threshold || !occursOutside(pass.result, pass.produced, nm.name))
             continue;
+        const before = new Set(pass.produced);
+        const replacement = redactMatch(pass, nm.name, { label: 'PERSON_NAME', category: 'identity' }, {
+            patternName: 'personNameDict', patternLabel: 'PERSON_NAME', category: 'identity', confidence,
+        });
+        pass.result = replaceOutside(pass.result, before, new RegExp(escapeRe(nm.name), 'g'), () => replacement);
+    }
+}
+function customStage(pass) {
+    if (context_1.CUSTOM_PATTERN_CONFIDENCE < pass.threshold)
+        return;
+    for (const cp of pass.ctx.customPatterns) {
+        if (!cp.label || !cp.regex || !isSafeRegex(cp.regex))
+            continue;
+        const pattern = { label: cp.label.toUpperCase(), category: cp.category || 'identity' };
         try {
-            const re = new RegExp(cp.regex, 'g');
-            result = result.replace(re, (match) => {
-                if (TOKEN_RE.test(match))
-                    return match;
-                if (isAllowListed(match, ctx.allowList))
-                    return match;
-                if (context_1.CUSTOM_PATTERN_CONFIDENCE < threshold)
-                    return match;
-                const pseudoPattern = {
-                    label: cp.label.toUpperCase(),
-                    category: cp.category || 'identity',
-                };
-                const replacement = applyRedaction(match, pseudoPattern, ctx.mode, vault, sessionId, ctx.dedup);
-                hits.push({
-                    token: replacement, original: '***',
-                    patternName: `custom_${cp.label}`, patternLabel: pseudoPattern.label,
-                    category: pseudoPattern.category, field: fieldPath, itemIndex,
+            pass.result = replaceOutside(pass.result, pass.produced, new RegExp(cp.regex, 'g'), (match) => TOKEN_RE.test(match) || isAllowListed(match, pass.ctx.allowList)
+                ? match
+                : redactMatch(pass, match, pattern, {
+                    patternName: `custom_${cp.label}`, patternLabel: pattern.label, category: pattern.category,
                     confidence: context_1.CUSTOM_PATTERN_CONFIDENCE,
-                });
-                return replacement;
-            });
-        }
-        catch {
+                }));
         }
+        catch { }
     }
-    return result;
+}
+function redactText(text, ctx, vault, sessionId, hits, itemIndex, fieldPath) {
+    var _a;
+    const pass = {
+        source: text, result: text, produced: new Set(), threshold: (_a = ctx.confidenceThreshold) !== null && _a !== void 0 ? _a : 0,
+        ctx, vault, sessionId, hits, itemIndex, fieldPath,
+    };
+    denyListStage(pass);
+    builtInStage(pass);
+    nameStage(pass);
+    customStage(pass);
+    return pass.result;
 }
 function makeRestorer(entries) {
     const tokens = Object.keys(entries).filter((t) => t.length > 0).sort((a, b) => b.length - a.length);
@@ -584,15 +635,19 @@ function makeRestorer(entries) {
     const re = new RegExp(tokens.map((t) => t.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')).join('|'), 'g');
     return (text) => text.replace(re, (token) => entries[token].original);
 }
-function restoreWith(value, restore) {
-    if (typeof value === 'string')
+function restoreWith(value, restore, entries) {
+    if (typeof value === 'string') {
+        const exact = entries[value];
+        if ((exact === null || exact === void 0 ? void 0 : exact.numeric) && Number.isFinite(Number(exact.original)))
+            return Number(exact.original);
         return restore(value);
+    }
     if (Array.isArray(value))
-        return value.map((v) => restoreWith(v, restore));
+        return value.map((v) => restoreWith(v, restore, entries));
     if (value !== null && typeof value === 'object') {
         const obj = {};
         for (const [k, v] of Object.entries(value)) {
-            obj[restore(k)] = restoreWith(v, restore);
+            obj[restore(k)] = restoreWith(v, restore, entries);
         }
         return obj;
     }
@@ -602,7 +657,7 @@ function restoreValue(value, vault, sessionId) {
     const session = vault.getSession(sessionId);
     if (!session)
         return value;
-    return restoreWith(value, makeRestorer(session.entries));
+    return restoreWith(value, makeRestorer(session.entries), session.entries);
 }
 function toUtf16Spans(text, entities) {
     const offsets = [0];
@@ -637,7 +692,7 @@ async function presidioRedactString(value, ctx, vault, sessionId, hits, itemInde
             continue;
         const label = (0, presidio_1.getRedactorLabel)(span.entityType);
         const category = (0, presidio_1.getRedactorCategory)(span.entityType);
-        const replacement = applyRedaction(matchedText, { label, category }, ctx.mode, vault, sessionId, ctx.dedup);
+        const replacement = applyRedaction(matchedText, { label, category }, ctx.mode, vault, sessionId, ctx.dedup, ctx.reservedTokens);
         text = text.slice(0, span.start) + replacement + text.slice(span.end);
         hits.push({
             token: replacement, original: '***',
@@ -647,9 +702,10 @@ async function presidioRedactString(value, ctx, vault, sessionId, hits, itemInde
     }
     return text;
 }
-async function presidioWalk(value, ctx, vault, sessionId, hits, itemIndex, path) {
+async function presidioWalk(value, ctx, vault, sessionId, hits, itemIndex, path, policyPath) {
+    var _a, _b;
     if (typeof value === 'string') {
-        if (!shouldProcessField(path, ctx.fieldMode, ctx.fieldRules))
+        if (!shouldProcessField(policyPath, ctx.fieldMode, ctx.fieldRules))
             return value;
         try {
             return await presidioRedactString(value, ctx, vault, sessionId, hits, itemIndex, path);
@@ -660,14 +716,19 @@ async function presidioWalk(value, ctx, vault, sessionId, hits, itemIndex, path)
     }
     if (Array.isArray(value)) {
         const out = [];
-        for (let i = 0; i < value.length; i++)
-            out.push(await presidioWalk(value[i], ctx, vault, sessionId, hits, itemIndex, `${path}[${i}]`));
+        for (let i = 0; i < value.length; i++) {
+            out.push(await presidioWalk(value[i], ctx, vault, sessionId, hits, itemIndex, `${path}[${i}]`, `${policyPath}[${i}]`));
+        }
         return out;
     }
     if (value !== null && typeof value === 'object') {
+        const origins = (_a = ctx.keyOrigins) === null || _a === void 0 ? void 0 : _a.get(value);
         const out = {};
         for (const [k, v] of Object.entries(value)) {
-            out[k] = await presidioWalk(v, ctx, vault, sessionId, hits, itemIndex, path ? `${path}.${k}` : k);
+            const original = (_b = origins === null || origins === void 0 ? void 0 : origins.get(k)) !== null && _b !== void 0 ? _b : k;
+            const child = path ? `${path}.${k}` : k;
+            const childPolicy = policyPath ? `${policyPath}.${original}` : original;
+            out[k] = await presidioWalk(v, ctx, vault, sessionId, hits, itemIndex, child, childPolicy);
         }
         return out;
     }
@@ -676,7 +737,7 @@ async function presidioWalk(value, ctx, vault, sessionId, hits, itemIndex, path)
 async function enhanceWithPresidio(data, ctx, vault, sessionId, hits, itemIndex) {
     if (!ctx.presidioUrl)
         return data;
-    return (await presidioWalk(data, ctx, vault, sessionId, hits, itemIndex, ''));
+    return (await presidioWalk(data, ctx, vault, sessionId, hits, itemIndex, '', ''));
 }
 function buildReport(sessionId, hits) {
     const hitsByCategory = {};

package/dist/nodes/Redactor/injection.js

@@ -1,5 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.INJECTION_DESCRIPTIONS = void 0;
 exports.detectPromptInjection = detectPromptInjection;
 exports.scanForInjection = scanForInjection;
 const INJECTION_PATTERNS = [
@@ -200,6 +201,11 @@ const INJECTION_PATTERNS = [
         description: 'Fake end-of-prompt marker',
     },
 ];
+exports.INJECTION_DESCRIPTIONS = [
+    ...INJECTION_PATTERNS.map((p) => p.description),
+    'Invisible Unicode characters detected',
+    'Base64-encoded injection payload detected',
+];
 const ZERO_WIDTH_RE = /(?:\u200B|\u200C|\u200D|\uFEFF|\u00AD|\u2060|\u2061|\u2062|\u2063|\u2064|\u2066|\u2067|\u2068|\u2069|\u206A|\u206B|\u206C|\u206D|\u206E|\u206F)/g;
 const BASE64_SUSPICIOUS_RE = /[A-Za-z0-9+/]{40,}={0,2}/g;
 const INJECTION_SEEDS = [

package/dist/nodes/Redactor/regexSafety.js

@@ -69,12 +69,15 @@ const NESTED = 'a repeated group contains a quantifier or alternation (catastrop
 function isRisky(frame) {
     return !!frame && (frame.hasVariableQuantifier || frame.hasAlternation);
 }
+const NO_GROUP = { hasVariableQuantifier: false, hasAlternation: false };
+const repeats = (q) => q !== null && q.max > 1;
+const isVariable = (q) => q !== null && q.min !== q.max;
 function applyQuantifier(q, closed, top) {
-    const repeats = q !== null && q.max > 1;
-    if (repeats && isRisky(closed))
+    if (repeats(q) && isRisky(closed))
         return NESTED;
-    const variable = repeats && q.min !== q.max;
-    top.hasVariableQuantifier = top.hasVariableQuantifier || variable || !!(closed === null || closed === void 0 ? void 0 : closed.hasVariableQuantifier);
+    const inner = closed !== null && closed !== void 0 ? closed : NO_GROUP;
+    top.hasVariableQuantifier || (top.hasVariableQuantifier = isVariable(q) || inner.hasVariableQuantifier);
+    top.hasAlternation || (top.hasAlternation = inner.hasAlternation);
     return null;
 }
 function structuralProblem(src) {

package/dist/nodes/Redactor/runtime.js

@@ -5,18 +5,27 @@ exports.workflowNamespace = workflowNamespace;
 exports.assertUserRegexes = assertUserRegexes;
 exports.sanitizeInjection = sanitizeInjection;
 const n8n_workflow_1 = require("n8n-workflow");
-const patterns_1 = require("./patterns");
-const vault_1 = require("./vault");
-const engine_1 = require("./engine");
 const regexSafety_1 = require("./regexSafety");
+const injection_1 = require("./injection");
 const VAULT_CREDENTIAL = 'redactorVaultApi';
 async function resolvePassphrase(fns) {
-    try {
-        const cred = await fns.getCredentials(VAULT_CREDENTIAL);
-        if (cred && typeof cred.passphrase === 'string' && cred.passphrase)
-            return cred.passphrase;
-    }
-    catch {
+    var _a;
+    if ((_a = fns.getNode().credentials) === null || _a === void 0 ? void 0 : _a[VAULT_CREDENTIAL]) {
+        let cred;
+        try {
+            cred = (await fns.getCredentials(VAULT_CREDENTIAL));
+        }
+        catch (error) {
+            throw new n8n_workflow_1.NodeOperationError(fns.getNode(), 'The Redactor Vault credential could not be read, so the vault stays locked.', {
+                description: `Nothing was stored. Re-enter the passphrase in the credential. Cause: ${error.message}`,
+            });
+        }
+        if (typeof cred.passphrase !== 'string' || cred.passphrase === '') {
+            throw new n8n_workflow_1.NodeOperationError(fns.getNode(), 'The Redactor Vault credential has an empty passphrase.', {
+                description: 'Nothing was stored. Set a passphrase in the credential, or remove the credential from the node.',
+            });
+        }
+        return cred.passphrase;
     }
     try {
         return fns.getNodeParameter('vaultPassphrase', 0, '') || '';
@@ -57,19 +66,15 @@ function assertUserRegexes(fns, customPatterns, lists) {
     }
 }
 function sanitizeInjection(result) {
-    const vault = (0, vault_1.createVault)('memory', undefined, undefined, 'injection-scrub');
-    const sessionId = 'scrub';
-    vault.getOrCreateSession(sessionId, 60000);
-    const ctx = {
-        enabledPatterns: (0, patterns_1.getPatternOptions)().map((p) => p.value),
-        customPatterns: [],
-        mode: 'redact',
-        dedup: false,
-        fieldRules: [],
-        fieldMode: 'all',
-    };
-    const scrub = (text) => (0, engine_1.redactValue)(text, ctx, vault, sessionId, [], 0);
-    const matchedPatterns = result.matchedPatterns.map((m) => ({ ...m, pattern: scrub(m.pattern), matchedText: scrub(m.matchedText) }));
-    vault.deleteSession(sessionId);
+    const matchedPatterns = result.matchedPatterns.map((m) => {
+        var _a;
+        return ({
+            category: m.category,
+            pattern: (_a = injection_1.INJECTION_DESCRIPTIONS.find((d) => m.pattern === d || m.pattern.endsWith(` ${d}`))) !== null && _a !== void 0 ? _a : 'Prompt injection detector',
+            matchedText: '(withheld)',
+            severity: m.severity,
+            score: m.score,
+        });
+    });
     return { ...result, matchedPatterns };
 }

package/dist/nodes/Redactor/vault.js

@@ -124,6 +124,17 @@ class MemoryVault {
     deleteSession(sessionId) {
         this.drop(this.key(sessionId));
     }
+    purgeAll() {
+        const keys = this.ownKeys();
+        const entries = keys.reduce((n, k) => { var _a, _b; return n + Object.keys((_b = (_a = memoryStore.get(k)) === null || _a === void 0 ? void 0 : _a.entries) !== null && _b !== void 0 ? _b : {}).length; }, 0);
+        keys.forEach((k) => this.drop(k));
+        return { sessions: keys.length, entries };
+    }
+    purgeSession(sessionId) {
+        const session = memoryStore.get(this.key(sessionId));
+        this.deleteSession(sessionId);
+        return { found: !!session, entries: session ? Object.keys(session.entries).length : null };
+    }
     listSessions() {
         return this.ownKeys()
             .map((k) => memoryStore.get(k))
@@ -242,6 +253,25 @@ class WorkflowVault {
         if (k in this.sessions)
             delete this.writableSessions()[k];
     }
+    purgeAll() {
+        const stored = Object.values(this.sessions);
+        const entries = stored.reduce((n, rec) => {
+            const session = rec && typeof rec === 'object' ? this.decode(rec) : null;
+            return n + (session ? Object.keys(session.entries).length : 0);
+        }, 0);
+        this.cache.clear();
+        if (stored.length)
+            this.store[STORE_KEY] = {};
+        return { sessions: stored.length, entries };
+    }
+    purgeSession(sessionId) {
+        var _a;
+        const stored = this.sessions[this.key(sessionId)];
+        const live = (_a = this.cache.get(sessionId)) !== null && _a !== void 0 ? _a : (stored && typeof stored === 'object' ? this.decode(stored) : null);
+        const found = !!stored || this.cache.has(sessionId);
+        this.deleteSession(sessionId);
+        return { found, entries: live && live.sessionId === sessionId ? Object.keys(live.entries).length : null };
+    }
     listSessions() {
         const out = [];
         for (const stored of Object.values(this.sessions)) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "n8n-nodes-redactor",
-  "version": "4.1.0",
+  "version": "4.2.0",
   "description": "Redact, mask and anonymize PII before it reaches an LLM, then restore it. 216 patterns for emails, phones, addresses, IBAN, cards, names, SSN, passport and tax IDs. Reversible encrypted vault, GDPR Art.30 ROPA record, prompt-injection check. Runs on n8n Cloud and self-hosted n8n 2.x.",
   "keywords": [
     "n8n-community-node-package",