n8n-nodes-redactor 4.1.0 → 4.3.0

package/dist/nodes/Redactor/Redactor.node.js

@@ -1036,6 +1036,11 @@ class Redactor {
                 presidioUrl: enablePresidio ? presidioUrl : undefined,
                 presidioLanguage: enablePresidio ? presidioLanguage : undefined,
                 presidioRequest: enablePresidio ? presidioRequester : undefined,
+                scanNumbers: true,
+                reservedTokens: (0, engine_1.collectTokenLike)(items.map((it) => it.json)),
+                keyOrigins: new WeakMap(),
+                inputText: (0, engine_1.collectInputText)(items.map((it) => it.json)),
+                lockedSpans: new Map(),
             };
             const allHits = [];
             const returnData = [];
@@ -1118,48 +1123,27 @@ class Redactor {
                 if (!purgeSessionId) {
                     throw new n8n_workflow_1.NodeOperationError(this.getNode(), 'Session ID is required for purging a specific session.');
                 }
-                const session = vault.getSession(purgeSessionId);
-                if (session) {
-                    const entryCount = Object.keys(session.entries).length;
-                    vault.deleteSession(purgeSessionId);
-                    return [[{
-                                json: {
-                                    purged: true,
-                                    sessionId: purgeSessionId,
-                                    entriesDeleted: entryCount,
-                                    message: `Session purged successfully.`,
-                                },
-                                pairedItem: allPaired,
-                            }]];
-                }
-                else {
-                    return [[{
-                                json: {
-                                    purged: false,
-                                    sessionId: purgeSessionId,
-                                    message: `No session found with this ID.`,
-                                },
-                                pairedItem: allPaired,
-                            }]];
-                }
-            }
-            else {
-                const sessions = vault.listSessions();
-                let totalEntries = 0;
-                for (const s of sessions) {
-                    totalEntries += s.entryCount;
-                    vault.deleteSession(s.sessionId);
-                }
+                const purged = vault.purgeSession(purgeSessionId);
                 return [[{
                             json: {
-                                purged: true,
-                                sessionsPurged: sessions.length,
-                                totalEntriesDeleted: totalEntries,
-                                message: `All ${sessions.length} session(s) purged successfully.`,
+                                purged: purged.found,
+                                sessionId: purgeSessionId,
+                                ...(purged.found ? { entriesDeleted: purged.entries } : {}),
+                                message: purged.found ? 'Session purged successfully.' : 'No session found with this ID.',
                             },
                             pairedItem: allPaired,
                         }]];
             }
+            const all = vault.purgeAll();
+            return [[{
+                        json: {
+                            purged: true,
+                            sessionsPurged: all.sessions,
+                            totalEntriesDeleted: all.entries,
+                            message: `All ${all.sessions} session(s) purged successfully.`,
+                        },
+                        pairedItem: allPaired,
+                    }]];
         }
         return [[]];
     }

package/dist/nodes/Redactor/engine.js

@@ -33,6 +33,8 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.collectTokenLike = collectTokenLike;
+exports.collectInputText = collectInputText;
 exports.redactValue = redactValue;
 exports.restoreValue = restoreValue;
 exports.enhanceWithPresidio = enhanceWithPresidio;
@@ -96,10 +98,10 @@ function maskValue(value, label) {
 function hashValue(value) {
     return crypto.createHash('sha256').update(value).digest('hex').slice(0, 12);
 }
-function storeReversible(match, pattern, vault, sessionId, dedup, makeToken) {
-    if (dedup) {
+function storeReversible(match, pattern, ctx, vault, sessionId, makeToken) {
+    if (ctx.dedup) {
         const existing = vault.findByOriginal(sessionId, match);
-        if (existing)
+        if (existing && !existing.numeric)
             return existing.token;
     }
     const token = makeToken();
@@ -119,30 +121,66 @@ const IRREVERSIBLE = {
     blackout: (match) => '\u2588'.repeat(match.length),
     remove: () => '',
 };
-function applyRedaction(match, pattern, mode, vault, sessionId, dedup) {
-    if (mode === 'token') {
-        return storeReversible(match, pattern, vault, sessionId, dedup, () => {
-            const session = vault.getSession(sessionId);
-            return generateToken(pattern.label, session ? Object.keys(session.entries).length : 0);
-        });
+function applyRedaction(match, pattern, ctx, vault, sessionId) {
+    if (ctx.mode === 'token') {
+        return storeReversible(match, pattern, ctx, vault, sessionId, () => freshToken(pattern.label, vault, sessionId, ctx.reservedTokens));
     }
-    if (mode === 'pseudonymize') {
-        return storeReversible(match, pattern, vault, sessionId, dedup, () => uniquePseudonym(vault, sessionId, match, pattern.label));
+    if (ctx.mode === 'pseudonymize') {
+        return storeReversible(match, pattern, ctx, vault, sessionId, () => uniquePseudonym(vault, sessionId, match, pattern.label, ctx));
     }
-    const irreversible = IRREVERSIBLE[mode];
+    const irreversible = IRREVERSIBLE[ctx.mode];
     return irreversible ? irreversible(match, pattern.label) : match;
 }
-function uniquePseudonym(vault, sessionId, original, label) {
+function freshToken(label, vault, sessionId, reserved) {
     var _a, _b;
     const entries = (_b = (_a = vault.getSession(sessionId)) === null || _a === void 0 ? void 0 : _a.entries) !== null && _b !== void 0 ? _b : {};
+    let index = Object.keys(entries).length;
+    let token = generateToken(label, index);
+    while (entries[token] || (reserved === null || reserved === void 0 ? void 0 : reserved.has(token)))
+        token = generateToken(label, ++index);
+    return token;
+}
+const TOKEN_LIKE_RE = /\[[A-Z][A-Z0-9_]*_\d+\]/g;
+function walkText(value, visit) {
+    if (typeof value === 'string' || typeof value === 'number')
+        visit(String(value));
+    else if (Array.isArray(value))
+        value.forEach((v) => walkText(v, visit));
+    else if (value !== null && typeof value === 'object') {
+        for (const [k, v] of Object.entries(value)) {
+            visit(k);
+            walkText(v, visit);
+        }
+    }
+}
+function collectTokenLike(value, into = new Set()) {
+    walkText(value, (text) => {
+        for (const m of text.matchAll(TOKEN_LIKE_RE))
+            into.add(m[0]);
+    });
+    return into;
+}
+function collectInputText(value) {
+    const parts = [];
+    walkText(value, (text) => parts.push(text));
+    return parts.join('\u0000');
+}
+function reusable(taken, original, ctx) {
+    return !!taken && taken.original === original && !!taken.numeric === !!ctx.numeric;
+}
+function uniquePseudonym(vault, sessionId, original, label, ctx) {
+    var _a, _b, _c;
+    const entries = (_b = (_a = vault.getSession(sessionId)) === null || _a === void 0 ? void 0 : _a.entries) !== null && _b !== void 0 ? _b : {};
     for (let attempt = 0; attempt < 32; attempt++) {
         const seed = attempt === 0 ? original : `${original}\u0000${attempt}`;
         const candidate = (0, pseudonymize_1.generatePseudonym)(sessionId, seed, label);
+        if (candidate === original || ((_c = ctx.inputText) === null || _c === void 0 ? void 0 : _c.includes(candidate)))
+            continue;
         const taken = entries[candidate];
-        if (!taken || taken.original === original)
+        if (!taken || reusable(taken, original, ctx))
             return candidate;
     }
-    return generateToken(label, Object.keys(entries).length);
+    return freshToken(label, vault, sessionId, ctx.reservedTokens);
 }
 function shouldProcessField(fieldPath, fieldMode, fieldRules) {
     if (fieldMode === 'all')
@@ -376,7 +414,7 @@ function getSemanticLabel(fieldKey, siblingKeys) {
     return null;
 }
 function redactSemantic(raw, ctx, vault, sessionId, hits, itemIndex, path, display, siblingKeys) {
-    var _a;
+    var _a, _b;
     const semantic = getSemanticLabel(path, siblingKeys);
     if (!semantic || !semantic.label || raw.trim().length === 0)
         return null;
@@ -385,7 +423,9 @@ function redactSemantic(raw, ctx, vault, sessionId, hits, itemIndex, path, displ
     const semConf = semantic.label === 'IDENTIFIER' ? context_1.AMBIGUOUS_FIELD_CONFIDENCE : context_1.SEMANTIC_CONFIDENCE;
     if (semConf < ((_a = ctx.confidenceThreshold) !== null && _a !== void 0 ? _a : 0))
         return null;
-    const replacement = applyRedaction(raw, { label: semantic.label, category: semantic.category }, ctx.mode, vault, sessionId, ctx.dedup);
+    const replacement = applyRedaction(raw, { label: semantic.label, category: semantic.category }, ctx, vault, sessionId);
+    if (replacement)
+        (_b = ctx.lockedSpans) === null || _b === void 0 ? void 0 : _b.set(lockKey(itemIndex, display), [[0, replacement.length]]);
     hits.push({
         token: replacement, original: '***',
         patternName: `semantic_${semantic.label}`,
@@ -396,42 +436,75 @@ function redactSemantic(raw, ctx, vault, sessionId, hits, itemIndex, path, displ
     });
     return replacement;
 }
+function numericMapping(out, text, ctx, vault, sessionId) {
+    var _a, _b;
+    const entries = (_b = (_a = vault.getSession(sessionId)) === null || _a === void 0 ? void 0 : _a.entries) !== null && _b !== void 0 ? _b : {};
+    const existing = entries[out];
+    if ((existing === null || existing === void 0 ? void 0 : existing.original) === text) {
+        existing.numeric = true;
+        return out;
+    }
+    const token = existing ? freshToken('NUMBER', vault, sessionId, ctx.reservedTokens) : out;
+    vault.addEntry(sessionId, {
+        token, original: text, patternLabel: 'NUMBER', category: 'other', createdAt: new Date().toISOString(), numeric: true,
+    });
+    return token;
+}
 function redactNumber(value, ctx, vault, sessionId, hits, itemIndex, path, display, siblingKeys) {
+    var _a;
     const text = String(value);
-    if (!ctx.skipSemantic) {
-        const semantic = redactSemantic(text, ctx, vault, sessionId, hits, itemIndex, path, display, siblingKeys);
-        if (semantic !== null)
-            return semantic;
-    }
-    if (!ctx.scanNumbers)
+    const numCtx = { ...ctx, dedup: false, numeric: true };
+    let out = null;
+    if (!ctx.skipSemantic)
+        out = redactSemantic(text, numCtx, vault, sessionId, hits, itemIndex, path, display, siblingKeys);
+    if (out === null && ctx.scanNumbers)
+        out = redactText(text, numCtx, vault, sessionId, hits, itemIndex, display);
+    if (out === null || out === text)
         return value;
-    const scanned = redactText(text, ctx, vault, sessionId, hits, itemIndex, display);
-    return scanned === text ? value : scanned;
+    if (ctx.mode !== 'token' && ctx.mode !== 'pseudonymize')
+        return out;
+    const mapped = numericMapping(out, text, ctx, vault, sessionId);
+    (_a = ctx.lockedSpans) === null || _a === void 0 ? void 0 : _a.set(lockKey(itemIndex, display), [[0, mapped.length]]);
+    return mapped;
 }
-function redactKey(key, taken, ctx, vault, sessionId, itemIndex, keyHits) {
-    let out = redactText(key, ctx, vault, sessionId, keyHits, itemIndex, '');
+function redactKey(key, taken, sourceKeys, ctx, vault, sessionId, itemIndex, keyHits) {
+    var _a;
+    const out = redactText(key, ctx, vault, sessionId, keyHits, itemIndex, '');
     if (out === key)
         return key;
-    const base = out;
-    for (let n = 1; out === '' || out in taken; n++)
-        out = `${base}_${n}`;
-    return out;
+    const clashes = (k) => k === '' || k in taken || sourceKeys.has(k);
+    if (!clashes(out))
+        return out;
+    if (ctx.mode === 'token' || ctx.mode === 'pseudonymize') {
+        const token = freshToken('KEY', vault, sessionId, new Set([...((_a = ctx.reservedTokens) !== null && _a !== void 0 ? _a : []), ...sourceKeys, ...Object.keys(taken)]));
+        vault.addEntry(sessionId, { token, original: key, patternLabel: 'KEY', category: 'other', createdAt: new Date().toISOString() });
+        return token;
+    }
+    let suffixed = out;
+    for (let n = 1; clashes(suffixed); n++)
+        suffixed = `${out}_${n}`;
+    return suffixed;
 }
 function redactObject(value, ctx, vault, sessionId, hits, itemIndex, path, display) {
+    var _a;
     const entries = Object.entries(value);
     const siblingKeys = entries.map(([k]) => k);
+    const sourceKeys = new Set(siblingKeys);
+    const origins = new Map();
     const obj = {};
     for (const [k, v] of entries) {
         const fieldPath = path ? `${path}.${k}` : k;
         const keyHits = [];
         const outKey = shouldProcessField(fieldPath, ctx.fieldMode, ctx.fieldRules)
-            ? redactKey(k, obj, ctx, vault, sessionId, itemIndex, keyHits)
+            ? redactKey(k, obj, sourceKeys, ctx, vault, sessionId, itemIndex, keyHits)
             : k;
+        origins.set(outKey, k);
         const childDisplay = display ? `${display}.${outKey}` : outKey;
         for (const h of keyHits)
             hits.push({ ...h, field: childDisplay });
         obj[outKey] = redactValue(v, ctx, vault, sessionId, hits, itemIndex, fieldPath, siblingKeys, childDisplay);
     }
+    (_a = ctx.keyOrigins) === null || _a === void 0 ? void 0 : _a.set(obj, origins);
     return obj;
 }
 function redactValue(value, ctx, vault, sessionId, hits, itemIndex, currentPath = '', siblingKeys, displayPath = currentPath) {
@@ -459,123 +532,170 @@ function redactValue(value, ctx, vault, sessionId, hits, itemIndex, currentPath
     }
     return value;
 }
-function redactText(text, ctx, vault, sessionId, hits, itemIndex, fieldPath) {
+const escapeRe = (text) => text.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+const USER_REGEX_WINDOW = 2048;
+function windows(seg, size) {
+    const out = [];
+    let at = 0;
+    while (seg.text.length - at > size) {
+        const cut = seg.text.lastIndexOf(' ', at + size);
+        const end = cut > at + size / 2 ? cut + 1 : at + size;
+        out.push({ text: seg.text.slice(at, end), locked: false, src: seg.src + at });
+        at = end;
+    }
+    out.push({ text: seg.text.slice(at), locked: false, src: seg.src + at });
+    return out;
+}
+function replaceInFree(seg, re, fn, into) {
     var _a;
-    let result = text;
-    const threshold = (_a = ctx.confidenceThreshold) !== null && _a !== void 0 ? _a : 0;
-    if (ctx.denyList && ctx.denyList.length > 0) {
-        for (const entry of ctx.denyList) {
-            try {
-                let re;
-                switch (entry.type) {
-                    case 'regex':
-                        if (!isSafeRegex(entry.value))
-                            continue;
-                        re = new RegExp(entry.value, 'gi');
-                        break;
-                    case 'contains':
-                        re = new RegExp(entry.value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&'), 'gi');
-                        break;
-                    default:
-                        re = new RegExp(entry.value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&'), 'gi');
-                }
-                result = result.replace(re, (match) => {
-                    if (TOKEN_RE.test(match))
-                        return match;
-                    const replacement = applyRedaction(match, { label: 'DENY_LIST', category: 'other' }, ctx.mode, vault, sessionId, ctx.dedup);
-                    hits.push({
-                        token: replacement, original: '***',
-                        patternName: 'denyList', patternLabel: 'DENY_LIST',
-                        category: 'other', field: fieldPath, itemIndex,
-                        confidence: context_1.DENY_LIST_CONFIDENCE,
-                    });
-                    return replacement;
-                });
-            }
-            catch { }
-        }
+    let last = 0;
+    for (const m of seg.text.matchAll(re)) {
+        const at = (_a = m.index) !== null && _a !== void 0 ? _a : 0;
+        if (m[0] === '')
+            continue;
+        const replacement = fn(m[0], seg.src + at);
+        if (replacement === null)
+            continue;
+        if (at > last)
+            into.push({ text: seg.text.slice(last, at), locked: false, src: seg.src + last });
+        into.push({ text: replacement, locked: true, src: -1 });
+        last = at + m[0].length;
     }
-    const enabled = (0, patterns_1.getPatternsByNames)(ctx.enabledPatterns);
-    const activePatterns = [...enabled.filter((p) => p.validate), ...enabled.filter((p) => !p.validate)];
-    for (const pattern of activePatterns) {
-        const re = new RegExp(pattern.regex.source, pattern.regex.flags);
-        result = result.replace(re, (match, ...args) => {
-            if (TOKEN_RE.test(match) || (match.startsWith('[') && match.endsWith(']')))
-                return match;
-            const validatorPassed = pattern.validate ? pattern.validate(match) : true;
-            if (pattern.validate && !validatorPassed)
-                return match;
-            if (isAllowListed(match, ctx.allowList))
-                return match;
-            const matchOffset = typeof args[args.length - 2] === 'number' ? args[args.length - 2] : 0;
-            const confidence = (0, context_1.calculateConfidence)(pattern.name, !!pattern.validate, validatorPassed, text, matchOffset, matchOffset + match.length);
-            if (confidence < threshold)
-                return match;
-            const replacement = applyRedaction(match, pattern, ctx.mode, vault, sessionId, ctx.dedup);
-            hits.push({
-                token: replacement, original: '***',
-                patternName: pattern.name, patternLabel: pattern.label,
-                category: pattern.category, field: fieldPath, itemIndex,
-                confidence,
-            });
-            return replacement;
-        });
+    if (last < seg.text.length)
+        into.push({ text: seg.text.slice(last), locked: false, src: seg.src + last });
+}
+function replaceFree(pass, re, fn, window) {
+    const flags = re.flags.includes('g') ? re.flags : `${re.flags}g`;
+    const global = new RegExp(re.source, flags);
+    const next = [];
+    for (const seg of pass.segs) {
+        if (seg.locked)
+            next.push(seg);
+        else
+            for (const piece of window ? windows(seg, window) : [seg])
+                replaceInFree(piece, global, fn, next);
     }
-    if (!ctx.skipSemantic) {
-        const nameMatches = (0, names_1.detectNamesInText)(result);
-        for (const nm of nameMatches) {
-            if (nm.name.includes('[') && nm.name.includes(']'))
-                continue;
-            if (isAllowListed(nm.name, ctx.allowList))
-                continue;
-            let nameConfidence = 0.65;
-            if ((0, context_1.hasContextWords)(text, nm.start, nm.end, names_1.NAME_CONTEXT_WORDS)) {
-                nameConfidence = 0.80;
-            }
-            if (nameConfidence < threshold)
+    pass.segs = next;
+}
+function redactMatch(pass, match, pattern, detail) {
+    const replacement = applyRedaction(match, pattern, pass.ctx, pass.vault, pass.sessionId);
+    pass.hits.push({ token: replacement, original: '***', field: pass.fieldPath, itemIndex: pass.itemIndex, ...detail });
+    return replacement;
+}
+function denyListRegex(entry) {
+    if (entry.type === 'regex')
+        return isSafeRegex(entry.value) ? new RegExp(entry.value, 'gi') : null;
+    return new RegExp(escapeRe(entry.value), 'gi');
+}
+function denyListStage(pass) {
+    var _a;
+    for (const entry of (_a = pass.ctx.denyList) !== null && _a !== void 0 ? _a : []) {
+        try {
+            const re = denyListRegex(entry);
+            if (!re)
                 continue;
-            const replacement = applyRedaction(nm.name, { label: 'PERSON_NAME', category: 'identity' }, ctx.mode, vault, sessionId, ctx.dedup);
-            result = result.split(nm.name).join(replacement);
-            hits.push({
-                token: replacement, original: '***',
-                patternName: 'personNameDict', patternLabel: 'PERSON_NAME',
-                category: 'identity', field: fieldPath, itemIndex,
-                confidence: nameConfidence,
-            });
+            const window = entry.type === 'regex' ? USER_REGEX_WINDOW : undefined;
+            replaceFree(pass, re, (match) => TOKEN_RE.test(match)
+                ? null
+                : redactMatch(pass, match, { label: 'DENY_LIST', category: 'other' }, {
+                    patternName: 'denyList', patternLabel: 'DENY_LIST', category: 'other', confidence: context_1.DENY_LIST_CONFIDENCE,
+                }), window);
         }
+        catch { }
     }
-    for (const cp of ctx.customPatterns) {
-        if (!cp.label || !cp.regex)
+}
+function builtInMatch(pass, pattern, match, offset) {
+    if (TOKEN_RE.test(match) || (match.startsWith('[') && match.endsWith(']')))
+        return null;
+    const validatorPassed = pattern.validate ? pattern.validate(match) : true;
+    if (!validatorPassed || isAllowListed(match, pass.ctx.allowList))
+        return null;
+    const confidence = (0, context_1.calculateConfidence)(pattern.name, !!pattern.validate, validatorPassed, pass.source, offset, offset + match.length);
+    if (confidence < pass.threshold)
+        return null;
+    return redactMatch(pass, match, pattern, {
+        patternName: pattern.name, patternLabel: pattern.label, category: pattern.category, confidence,
+    });
+}
+function builtInStage(pass) {
+    const enabled = (0, patterns_1.getPatternsByNames)(pass.ctx.enabledPatterns);
+    for (const pattern of [...enabled.filter((p) => p.validate), ...enabled.filter((p) => !p.validate)]) {
+        replaceFree(pass, pattern.regex, (match, offset) => builtInMatch(pass, pattern, match, offset));
+    }
+}
+function freeNames(pass) {
+    const names = new Map();
+    for (const seg of pass.segs) {
+        if (seg.locked)
+            continue;
+        for (const nm of (0, names_1.detectNamesInText)(seg.text))
+            if (!names.has(nm.name))
+                names.set(nm.name, seg.src + nm.start);
+    }
+    return names;
+}
+function nameStage(pass) {
+    if (pass.ctx.skipSemantic)
+        return;
+    for (const [name, start] of freeNames(pass)) {
+        if ((name.includes('[') && name.includes(']')) || isAllowListed(name, pass.ctx.allowList))
             continue;
-        if (!isSafeRegex(cp.regex))
+        const confidence = (0, context_1.hasContextWords)(pass.source, start, start + name.length, names_1.NAME_CONTEXT_WORDS) ? 0.8 : 0.65;
+        if (confidence < pass.threshold)
             continue;
+        let replacement;
+        replaceFree(pass, new RegExp(escapeRe(name), 'g'), (match) => {
+            replacement !== null && replacement !== void 0 ? replacement : (replacement = redactMatch(pass, match, { label: 'PERSON_NAME', category: 'identity' }, {
+                patternName: 'personNameDict', patternLabel: 'PERSON_NAME', category: 'identity', confidence,
+            }));
+            return replacement;
+        });
+    }
+}
+function customStage(pass) {
+    if (context_1.CUSTOM_PATTERN_CONFIDENCE < pass.threshold)
+        return;
+    for (const cp of pass.ctx.customPatterns) {
+        if (!cp.label || !cp.regex || !isSafeRegex(cp.regex))
+            continue;
+        const pattern = { label: cp.label.toUpperCase(), category: cp.category || 'identity' };
         try {
-            const re = new RegExp(cp.regex, 'g');
-            result = result.replace(re, (match) => {
-                if (TOKEN_RE.test(match))
-                    return match;
-                if (isAllowListed(match, ctx.allowList))
-                    return match;
-                if (context_1.CUSTOM_PATTERN_CONFIDENCE < threshold)
-                    return match;
-                const pseudoPattern = {
-                    label: cp.label.toUpperCase(),
-                    category: cp.category || 'identity',
-                };
-                const replacement = applyRedaction(match, pseudoPattern, ctx.mode, vault, sessionId, ctx.dedup);
-                hits.push({
-                    token: replacement, original: '***',
-                    patternName: `custom_${cp.label}`, patternLabel: pseudoPattern.label,
-                    category: pseudoPattern.category, field: fieldPath, itemIndex,
+            replaceFree(pass, new RegExp(cp.regex, 'g'), (match) => TOKEN_RE.test(match) || isAllowListed(match, pass.ctx.allowList)
+                ? null
+                : redactMatch(pass, match, pattern, {
+                    patternName: `custom_${cp.label}`, patternLabel: pattern.label, category: pattern.category,
                     confidence: context_1.CUSTOM_PATTERN_CONFIDENCE,
-                });
-                return replacement;
-            });
-        }
-        catch {
+                }), USER_REGEX_WINDOW);
         }
+        catch { }
+    }
+}
+function recordLocked(ctx, itemIndex, fieldPath, segs) {
+    if (!ctx.lockedSpans || fieldPath === '')
+        return;
+    const spans = [];
+    let at = 0;
+    for (const seg of segs) {
+        if (seg.locked)
+            spans.push([at, at + seg.text.length]);
+        at += seg.text.length;
     }
-    return result;
+    if (spans.length > 0)
+        ctx.lockedSpans.set(lockKey(itemIndex, fieldPath), spans);
+}
+const lockKey = (itemIndex, fieldPath) => `${itemIndex}\u0000${fieldPath}`;
+function redactText(text, ctx, vault, sessionId, hits, itemIndex, fieldPath) {
+    var _a;
+    const pass = {
+        source: text, segs: [{ text, locked: false, src: 0 }], threshold: (_a = ctx.confidenceThreshold) !== null && _a !== void 0 ? _a : 0,
+        ctx, vault, sessionId, hits, itemIndex, fieldPath,
+    };
+    denyListStage(pass);
+    builtInStage(pass);
+    nameStage(pass);
+    customStage(pass);
+    recordLocked(ctx, itemIndex, fieldPath, pass.segs);
+    return pass.segs.map((s) => s.text).join('');
 }
 function makeRestorer(entries) {
     const tokens = Object.keys(entries).filter((t) => t.length > 0).sort((a, b) => b.length - a.length);
@@ -584,15 +704,19 @@ function makeRestorer(entries) {
     const re = new RegExp(tokens.map((t) => t.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')).join('|'), 'g');
     return (text) => text.replace(re, (token) => entries[token].original);
 }
-function restoreWith(value, restore) {
-    if (typeof value === 'string')
+function restoreWith(value, restore, entries) {
+    if (typeof value === 'string') {
+        const exact = entries[value];
+        if ((exact === null || exact === void 0 ? void 0 : exact.numeric) && Number.isFinite(Number(exact.original)))
+            return Number(exact.original);
         return restore(value);
+    }
     if (Array.isArray(value))
-        return value.map((v) => restoreWith(v, restore));
+        return value.map((v) => restoreWith(v, restore, entries));
     if (value !== null && typeof value === 'object') {
         const obj = {};
         for (const [k, v] of Object.entries(value)) {
-            obj[restore(k)] = restoreWith(v, restore);
+            obj[restore(k)] = restoreWith(v, restore, entries);
         }
         return obj;
     }
@@ -602,7 +726,7 @@ function restoreValue(value, vault, sessionId) {
     const session = vault.getSession(sessionId);
     if (!session)
         return value;
-    return restoreWith(value, makeRestorer(session.entries));
+    return restoreWith(value, makeRestorer(session.entries), session.entries);
 }
 function toUtf16Spans(text, entities) {
     const offsets = [0];
@@ -621,13 +745,18 @@ function resolveOverlaps(spans) {
     }
     return kept.sort((a, b) => b.start - a.start);
 }
+function presidioSpans(value, entities, ctx, key) {
+    var _a, _b, _c;
+    const threshold = (_a = ctx.confidenceThreshold) !== null && _a !== void 0 ? _a : 0;
+    const locked = (_c = (_b = ctx.lockedSpans) === null || _b === void 0 ? void 0 : _b.get(key)) !== null && _c !== void 0 ? _c : [];
+    const free = (s) => !locked.some(([start, end]) => s.start < end && start < s.end);
+    return resolveOverlaps(toUtf16Spans(value, entities).filter((s) => s.score >= threshold && free(s)));
+}
 async function presidioRedactString(value, ctx, vault, sessionId, hits, itemIndex, path) {
-    var _a;
     if (value.trim().length === 0 || TOKEN_RE.test(value))
         return value;
     const entities = await (0, presidio_1.analyzeWithPresidio)(ctx.presidioUrl, value, ctx.presidioLanguage || 'en', 0.4, 10000, ctx.presidioRequest);
-    const threshold = (_a = ctx.confidenceThreshold) !== null && _a !== void 0 ? _a : 0;
-    const spans = resolveOverlaps(toUtf16Spans(value, entities).filter((s) => s.score >= threshold));
+    const spans = presidioSpans(value, entities, ctx, lockKey(itemIndex, path));
     let text = value;
     for (const span of spans) {
         const matchedText = value.slice(span.start, span.end);
@@ -637,7 +766,7 @@ async function presidioRedactString(value, ctx, vault, sessionId, hits, itemInde
             continue;
         const label = (0, presidio_1.getRedactorLabel)(span.entityType);
         const category = (0, presidio_1.getRedactorCategory)(span.entityType);
-        const replacement = applyRedaction(matchedText, { label, category }, ctx.mode, vault, sessionId, ctx.dedup);
+        const replacement = applyRedaction(matchedText, { label, category }, ctx, vault, sessionId);
         text = text.slice(0, span.start) + replacement + text.slice(span.end);
         hits.push({
             token: replacement, original: '***',
@@ -647,9 +776,10 @@ async function presidioRedactString(value, ctx, vault, sessionId, hits, itemInde
     }
     return text;
 }
-async function presidioWalk(value, ctx, vault, sessionId, hits, itemIndex, path) {
+async function presidioWalk(value, ctx, vault, sessionId, hits, itemIndex, path, policyPath) {
+    var _a, _b;
     if (typeof value === 'string') {
-        if (!shouldProcessField(path, ctx.fieldMode, ctx.fieldRules))
+        if (!shouldProcessField(policyPath, ctx.fieldMode, ctx.fieldRules))
             return value;
         try {
             return await presidioRedactString(value, ctx, vault, sessionId, hits, itemIndex, path);
@@ -660,14 +790,19 @@ async function presidioWalk(value, ctx, vault, sessionId, hits, itemIndex, path)
     }
     if (Array.isArray(value)) {
         const out = [];
-        for (let i = 0; i < value.length; i++)
-            out.push(await presidioWalk(value[i], ctx, vault, sessionId, hits, itemIndex, `${path}[${i}]`));
+        for (let i = 0; i < value.length; i++) {
+            out.push(await presidioWalk(value[i], ctx, vault, sessionId, hits, itemIndex, `${path}[${i}]`, `${policyPath}[${i}]`));
+        }
         return out;
     }
     if (value !== null && typeof value === 'object') {
+        const origins = (_a = ctx.keyOrigins) === null || _a === void 0 ? void 0 : _a.get(value);
         const out = {};
         for (const [k, v] of Object.entries(value)) {
-            out[k] = await presidioWalk(v, ctx, vault, sessionId, hits, itemIndex, path ? `${path}.${k}` : k);
+            const original = (_b = origins === null || origins === void 0 ? void 0 : origins.get(k)) !== null && _b !== void 0 ? _b : k;
+            const child = path ? `${path}.${k}` : k;
+            const childPolicy = policyPath ? `${policyPath}.${original}` : original;
+            out[k] = await presidioWalk(v, ctx, vault, sessionId, hits, itemIndex, child, childPolicy);
         }
         return out;
     }
@@ -676,7 +811,7 @@ async function presidioWalk(value, ctx, vault, sessionId, hits, itemIndex, path)
 async function enhanceWithPresidio(data, ctx, vault, sessionId, hits, itemIndex) {
     if (!ctx.presidioUrl)
         return data;
-    return (await presidioWalk(data, ctx, vault, sessionId, hits, itemIndex, ''));
+    return (await presidioWalk(data, ctx, vault, sessionId, hits, itemIndex, '', ''));
 }
 function buildReport(sessionId, hits) {
     const hitsByCategory = {};

package/dist/nodes/Redactor/injection.js

@@ -1,5 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.INJECTION_DESCRIPTIONS = void 0;
 exports.detectPromptInjection = detectPromptInjection;
 exports.scanForInjection = scanForInjection;
 const INJECTION_PATTERNS = [
@@ -200,6 +201,11 @@ const INJECTION_PATTERNS = [
         description: 'Fake end-of-prompt marker',
     },
 ];
+exports.INJECTION_DESCRIPTIONS = [
+    ...INJECTION_PATTERNS.map((p) => p.description),
+    'Invisible Unicode characters detected',
+    'Base64-encoded injection payload detected',
+];
 const ZERO_WIDTH_RE = /(?:\u200B|\u200C|\u200D|\uFEFF|\u00AD|\u2060|\u2061|\u2062|\u2063|\u2064|\u2066|\u2067|\u2068|\u2069|\u206A|\u206B|\u206C|\u206D|\u206E|\u206F)/g;
 const BASE64_SUSPICIOUS_RE = /[A-Za-z0-9+/]{40,}={0,2}/g;
 const INJECTION_SEEDS = [

package/dist/nodes/Redactor/regexCharset.js

@@ -0,0 +1,107 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.emptySet = void 0;
+exports.union = union;
+exports.overlaps = overlaps;
+exports.atomCharset = atomCharset;
+const emptySet = () => ({ ascii: new Array(128).fill(false), other: false });
+exports.emptySet = emptySet;
+const fullSet = () => ({ ascii: new Array(128).fill(true), other: true });
+function addCode(set, code) {
+    if (code >= 128) {
+        set.other = true;
+        return;
+    }
+    set.ascii[code] = true;
+    const ch = String.fromCharCode(code);
+    for (const folded of [ch.toLowerCase(), ch.toUpperCase()])
+        set.ascii[folded.charCodeAt(0)] = true;
+}
+function addRange(set, from, to) {
+    for (let c = from; c <= Math.min(to, 127); c++)
+        addCode(set, c);
+    if (to >= 128)
+        set.other = true;
+}
+function union(a, b) {
+    return { ascii: a.ascii.map((v, i) => v || b.ascii[i]), other: a.other || b.other };
+}
+function overlaps(a, b) {
+    return (a.other && b.other) || a.ascii.some((v, i) => v && b.ascii[i]);
+}
+function complement(set) {
+    return { ascii: set.ascii.map((v) => !v), other: true };
+}
+const CLASS_ESCAPES = {
+    d: (s) => addRange(s, 48, 57),
+    w: (s) => {
+        addRange(s, 48, 57);
+        addRange(s, 65, 90);
+        addCode(s, 95);
+    },
+    s: (s) => {
+        for (const c of [9, 10, 11, 12, 13, 32])
+            addCode(s, c);
+        s.other = true;
+    },
+};
+function escapeSet(letter) {
+    const lower = letter.toLowerCase();
+    const fill = CLASS_ESCAPES[lower];
+    if (fill) {
+        const set = (0, exports.emptySet)();
+        fill(set);
+        return letter === lower ? set : complement(set);
+    }
+    if (/[a-zA-Z0-9]/.test(letter))
+        return fullSet();
+    const set = (0, exports.emptySet)();
+    addCode(set, letter.charCodeAt(0));
+    return set;
+}
+function classMember(body, j) {
+    var _a, _b;
+    if (body[j] === '\\') {
+        const set = escapeSet((_a = body[j + 1]) !== null && _a !== void 0 ? _a : '\\');
+        const single = /[a-zA-Z0-9]/.test((_b = body[j + 1]) !== null && _b !== void 0 ? _b : '') ? null : body.charCodeAt(j + 1);
+        return { set, next: j + 2, code: single };
+    }
+    const set = (0, exports.emptySet)();
+    addCode(set, body.charCodeAt(j));
+    return { set, next: j + 1, code: body.charCodeAt(j) };
+}
+function classSet(body) {
+    const negated = body.startsWith('^');
+    let set = (0, exports.emptySet)();
+    let j = negated ? 1 : 0;
+    while (j < body.length) {
+        const first = classMember(body, j);
+        j = first.next;
+        if (body[j] === '-' && j + 1 < body.length && first.code !== null) {
+            const last = classMember(body, j + 1);
+            if (last.code !== null)
+                addRange(set, first.code, last.code);
+            else
+                set = union(union(set, first.set), last.set);
+            j = last.next;
+        }
+        else
+            set = union(set, first.set);
+    }
+    return negated ? complement(set) : set;
+}
+function atomCharset(src, start, end) {
+    var _a, _b;
+    const c = src[start];
+    if (c === '^' || c === '$')
+        return null;
+    if (c === '\\')
+        return /[bB]/.test((_a = src[start + 1]) !== null && _a !== void 0 ? _a : '') ? null : escapeSet((_b = src[start + 1]) !== null && _b !== void 0 ? _b : '\\');
+    if (c === '[')
+        return classSet(src.slice(start + 1, end - 1));
+    if (c === '.')
+        return fullSet();
+    const set = (0, exports.emptySet)();
+    addCode(set, src.charCodeAt(start));
+    return set;
+}

package/dist/nodes/Redactor/regexSafety.js

@@ -1,7 +1,11 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.checkRegex = checkRegex;
+const regexCharset_1 = require("./regexCharset");
 const MAX_REGEX_LENGTH = 500;
+const newFrame = (zeroWidth = false) => ({
+    hasVariableQuantifier: false, hasAlternation: false, run: null, chars: (0, regexCharset_1.emptySet)(), zeroWidth,
+});
 function readBraces(src, i) {
     const m = /^\{(\d+)(,(\d*))?\}/.exec(src.slice(i));
     if (!m)
@@ -55,11 +59,12 @@ function readToken(src, i, stack) {
     if (c === '[')
         return { atomEnd: skipClass(src, i), closed: null };
     if (c === '(') {
-        stack.push({ hasVariableQuantifier: false, hasAlternation: false });
+        stack.push(newFrame(/^\(\?(?:=|!|<=|<!)/.test(src.slice(i))));
         return { atomEnd: i, closed: null, next: i + groupPrefixLength(src, i) };
     }
     if (c === '|') {
         stack[stack.length - 1].hasAlternation = true;
+        stack[stack.length - 1].run = null;
         return { atomEnd: i, closed: null, next: i + 1 };
     }
     const closed = c === ')' && stack.length > 1 ? stack.pop() : null;
@@ -69,16 +74,48 @@ const NESTED = 'a repeated group contains a quantifier or alternation (catastrop
 function isRisky(frame) {
     return !!frame && (frame.hasVariableQuantifier || frame.hasAlternation);
 }
+const NO_GROUP = newFrame();
+const repeats = (q) => q !== null && q.max > 1;
+const isVariable = (q) => q !== null && q.min !== q.max;
 function applyQuantifier(q, closed, top) {
-    const repeats = q !== null && q.max > 1;
-    if (repeats && isRisky(closed))
+    if (repeats(q) && isRisky(closed))
         return NESTED;
-    const variable = repeats && q.min !== q.max;
-    top.hasVariableQuantifier = top.hasVariableQuantifier || variable || !!(closed === null || closed === void 0 ? void 0 : closed.hasVariableQuantifier);
+    const inner = closed !== null && closed !== void 0 ? closed : NO_GROUP;
+    top.hasVariableQuantifier || (top.hasVariableQuantifier = isVariable(q) || inner.hasVariableQuantifier);
+    top.hasAlternation || (top.hasAlternation = inner.hasAlternation);
     return null;
 }
+const SEQUENTIAL = 'two repetitions in a row can match the same characters (catastrophic backtracking)';
+function applySequence(chars, variable, required, top) {
+    if (chars === null)
+        return null;
+    top.chars = (0, regexCharset_1.union)(top.chars, chars);
+    const shared = top.run !== null && (0, regexCharset_1.overlaps)(top.run, chars);
+    if (variable) {
+        if (shared)
+            return SEQUENTIAL;
+        top.run = top.run ? (0, regexCharset_1.union)(top.run, chars) : chars;
+    }
+    else if (required && !shared)
+        top.run = null;
+    return null;
+}
+function stepChars(src, i, step) {
+    const closed = step.closed;
+    if (!closed)
+        return (0, regexCharset_1.atomCharset)(src, i, step.atomEnd);
+    return closed.zeroWidth ? null : closed.chars;
+}
+function stepProblem(src, i, step, q, top) {
+    var _a, _b;
+    const problem = applyQuantifier(q, step.closed, top);
+    if (problem || (q === null || q === void 0 ? void 0 : q.max) === 0)
+        return problem;
+    const variable = isVariable(q) || ((_a = step.closed) === null || _a === void 0 ? void 0 : _a.hasVariableQuantifier) === true;
+    return applySequence(stepChars(src, i, step), variable, ((_b = q === null || q === void 0 ? void 0 : q.min) !== null && _b !== void 0 ? _b : 1) >= 1, top);
+}
 function structuralProblem(src) {
-    const stack = [{ hasVariableQuantifier: false, hasAlternation: false }];
+    const stack = [newFrame()];
     let i = 0;
     while (i < src.length) {
         const step = readToken(src, i, stack);
@@ -89,7 +126,7 @@ function structuralProblem(src) {
             continue;
         }
         const q = readQuantifier(src, step.atomEnd);
-        const problem = applyQuantifier(q, step.closed, stack[stack.length - 1]);
+        const problem = stepProblem(src, i, step, q, stack[stack.length - 1]);
         if (problem)
             return problem;
         i = step.atomEnd + (q ? q.length : 0);

package/dist/nodes/Redactor/runtime.js

@@ -5,25 +5,48 @@ exports.workflowNamespace = workflowNamespace;
 exports.assertUserRegexes = assertUserRegexes;
 exports.sanitizeInjection = sanitizeInjection;
 const n8n_workflow_1 = require("n8n-workflow");
-const patterns_1 = require("./patterns");
-const vault_1 = require("./vault");
-const engine_1 = require("./engine");
 const regexSafety_1 = require("./regexSafety");
+const injection_1 = require("./injection");
 const VAULT_CREDENTIAL = 'redactorVaultApi';
 async function resolvePassphrase(fns) {
-    try {
-        const cred = await fns.getCredentials(VAULT_CREDENTIAL);
-        if (cred && typeof cred.passphrase === 'string' && cred.passphrase)
-            return cred.passphrase;
-    }
-    catch {
+    var _a;
+    if ((_a = fns.getNode().credentials) === null || _a === void 0 ? void 0 : _a[VAULT_CREDENTIAL]) {
+        let cred;
+        try {
+            cred = (await fns.getCredentials(VAULT_CREDENTIAL));
+        }
+        catch (error) {
+            throw new n8n_workflow_1.NodeOperationError(fns.getNode(), 'The Redactor Vault credential could not be read, so the vault stays locked.', {
+                description: `Nothing was stored. Re-enter the passphrase in the credential. Cause: ${error.message}`,
+            });
+        }
+        if (typeof cred.passphrase !== 'string' || cred.passphrase === '') {
+            throw new n8n_workflow_1.NodeOperationError(fns.getNode(), 'The Redactor Vault credential has an empty passphrase.', {
+                description: 'Nothing was stored. Set a passphrase in the credential, or remove the credential from the node.',
+            });
+        }
+        return cred.passphrase;
     }
+    return legacyPassphrase(fns);
+}
+function legacyPassphrase(fns) {
+    let raw;
     try {
-        return fns.getNodeParameter('vaultPassphrase', 0, '') || '';
+        raw = fns.getNodeParameter('vaultPassphrase', 0, '');
     }
-    catch {
+    catch (error) {
+        throw new n8n_workflow_1.NodeOperationError(fns.getNode(), 'The legacy vault passphrase could not be evaluated, so the vault stays locked.', {
+            description: `Nothing was stored. Fix the expression, or move the passphrase into a Redactor Vault credential. Cause: ${error.message}`,
+        });
+    }
+    if (raw === undefined || raw === null || raw === '')
         return '';
+    if (typeof raw !== 'string') {
+        throw new n8n_workflow_1.NodeOperationError(fns.getNode(), 'The legacy vault passphrase is not text, so the vault stays locked.', {
+            description: 'Nothing was stored. Set the passphrase to a text value, or use a Redactor Vault credential.',
+        });
     }
+    return raw;
 }
 function workflowNamespace(fns) {
     try {
@@ -38,7 +61,7 @@ function workflowNamespace(fns) {
 function assertUserRegexes(fns, customPatterns, lists) {
     const refuse = (what, problem) => {
         throw new n8n_workflow_1.NodeOperationError(fns.getNode(), `${what} regex ${problem}`, {
-            description: 'Rewrite the pattern without nested or alternated repetition, for example [ab]+ instead of (a|b)+.',
+            description: 'Rewrite the pattern without nested or alternated repetition, for example [ab]+ instead of (a|b)+, and without two repetitions in a row that can match the same characters, for example \\d+ instead of \\d+\\d+. Put a fixed separator such as - or @ between repeated parts.',
         });
     };
     for (const cp of customPatterns) {
@@ -57,19 +80,15 @@ function assertUserRegexes(fns, customPatterns, lists) {
     }
 }
 function sanitizeInjection(result) {
-    const vault = (0, vault_1.createVault)('memory', undefined, undefined, 'injection-scrub');
-    const sessionId = 'scrub';
-    vault.getOrCreateSession(sessionId, 60000);
-    const ctx = {
-        enabledPatterns: (0, patterns_1.getPatternOptions)().map((p) => p.value),
-        customPatterns: [],
-        mode: 'redact',
-        dedup: false,
-        fieldRules: [],
-        fieldMode: 'all',
-    };
-    const scrub = (text) => (0, engine_1.redactValue)(text, ctx, vault, sessionId, [], 0);
-    const matchedPatterns = result.matchedPatterns.map((m) => ({ ...m, pattern: scrub(m.pattern), matchedText: scrub(m.matchedText) }));
-    vault.deleteSession(sessionId);
+    const matchedPatterns = result.matchedPatterns.map((m) => {
+        var _a;
+        return ({
+            category: m.category,
+            pattern: (_a = injection_1.INJECTION_DESCRIPTIONS.find((d) => m.pattern === d || m.pattern.endsWith(` ${d}`))) !== null && _a !== void 0 ? _a : 'Prompt injection detector',
+            matchedText: '(withheld)',
+            severity: m.severity,
+            score: m.score,
+        });
+    });
     return { ...result, matchedPatterns };
 }

package/dist/nodes/Redactor/vault.js

@@ -124,6 +124,17 @@ class MemoryVault {
     deleteSession(sessionId) {
         this.drop(this.key(sessionId));
     }
+    purgeAll() {
+        const keys = this.ownKeys();
+        const entries = keys.reduce((n, k) => { var _a, _b; return n + Object.keys((_b = (_a = memoryStore.get(k)) === null || _a === void 0 ? void 0 : _a.entries) !== null && _b !== void 0 ? _b : {}).length; }, 0);
+        keys.forEach((k) => this.drop(k));
+        return { sessions: keys.length, entries };
+    }
+    purgeSession(sessionId) {
+        const session = memoryStore.get(this.key(sessionId));
+        this.deleteSession(sessionId);
+        return { found: !!session, entries: session ? Object.keys(session.entries).length : null };
+    }
     listSessions() {
         return this.ownKeys()
             .map((k) => memoryStore.get(k))
@@ -242,6 +253,25 @@ class WorkflowVault {
         if (k in this.sessions)
             delete this.writableSessions()[k];
     }
+    purgeAll() {
+        const stored = Object.values(this.sessions);
+        const entries = stored.reduce((n, rec) => {
+            const session = rec && typeof rec === 'object' ? this.decode(rec) : null;
+            return n + (session ? Object.keys(session.entries).length : 0);
+        }, 0);
+        this.cache.clear();
+        if (stored.length)
+            this.store[STORE_KEY] = {};
+        return { sessions: stored.length, entries };
+    }
+    purgeSession(sessionId) {
+        var _a;
+        const stored = this.sessions[this.key(sessionId)];
+        const live = (_a = this.cache.get(sessionId)) !== null && _a !== void 0 ? _a : (stored && typeof stored === 'object' ? this.decode(stored) : null);
+        const found = !!stored || this.cache.has(sessionId);
+        this.deleteSession(sessionId);
+        return { found, entries: live && live.sessionId === sessionId ? Object.keys(live.entries).length : null };
+    }
     listSessions() {
         const out = [];
         for (const stored of Object.values(this.sessions)) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "n8n-nodes-redactor",
-  "version": "4.1.0",
+  "version": "4.3.0",
   "description": "Redact, mask and anonymize PII before it reaches an LLM, then restore it. 216 patterns for emails, phones, addresses, IBAN, cards, names, SSN, passport and tax IDs. Reversible encrypted vault, GDPR Art.30 ROPA record, prompt-injection check. Runs on n8n Cloud and self-hosted n8n 2.x.",
   "keywords": [
     "n8n-community-node-package",