n8n-nodes-redactor 4.2.0 → 4.3.0

package/dist/nodes/Redactor/Redactor.node.js

@@ -1039,6 +1039,8 @@ class Redactor {
                 scanNumbers: true,
                 reservedTokens: (0, engine_1.collectTokenLike)(items.map((it) => it.json)),
                 keyOrigins: new WeakMap(),
+                inputText: (0, engine_1.collectInputText)(items.map((it) => it.json)),
+                lockedSpans: new Map(),
             };
             const allHits = [];
             const returnData = [];

package/dist/nodes/Redactor/engine.js

@@ -34,6 +34,7 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.collectTokenLike = collectTokenLike;
+exports.collectInputText = collectInputText;
 exports.redactValue = redactValue;
 exports.restoreValue = restoreValue;
 exports.enhanceWithPresidio = enhanceWithPresidio;
@@ -97,8 +98,8 @@ function maskValue(value, label) {
 function hashValue(value) {
     return crypto.createHash('sha256').update(value).digest('hex').slice(0, 12);
 }
-function storeReversible(match, pattern, vault, sessionId, dedup, makeToken) {
-    if (dedup) {
+function storeReversible(match, pattern, ctx, vault, sessionId, makeToken) {
+    if (ctx.dedup) {
         const existing = vault.findByOriginal(sessionId, match);
         if (existing && !existing.numeric)
             return existing.token;
@@ -120,14 +121,14 @@ const IRREVERSIBLE = {
     blackout: (match) => '\u2588'.repeat(match.length),
     remove: () => '',
 };
-function applyRedaction(match, pattern, mode, vault, sessionId, dedup, reserved) {
-    if (mode === 'token') {
-        return storeReversible(match, pattern, vault, sessionId, dedup, () => freshToken(pattern.label, vault, sessionId, reserved));
+function applyRedaction(match, pattern, ctx, vault, sessionId) {
+    if (ctx.mode === 'token') {
+        return storeReversible(match, pattern, ctx, vault, sessionId, () => freshToken(pattern.label, vault, sessionId, ctx.reservedTokens));
     }
-    if (mode === 'pseudonymize') {
-        return storeReversible(match, pattern, vault, sessionId, dedup, () => uniquePseudonym(vault, sessionId, match, pattern.label));
+    if (ctx.mode === 'pseudonymize') {
+        return storeReversible(match, pattern, ctx, vault, sessionId, () => uniquePseudonym(vault, sessionId, match, pattern.label, ctx));
     }
-    const irreversible = IRREVERSIBLE[mode];
+    const irreversible = IRREVERSIBLE[ctx.mode];
     return irreversible ? irreversible(match, pattern.label) : match;
 }
 function freshToken(label, vault, sessionId, reserved) {
@@ -140,36 +141,46 @@ function freshToken(label, vault, sessionId, reserved) {
     return token;
 }
 const TOKEN_LIKE_RE = /\[[A-Z][A-Z0-9_]*_\d+\]/g;
-function collectTokenLike(value, into = new Set()) {
-    const scan = (text) => {
-        for (const m of text.matchAll(TOKEN_LIKE_RE))
-            into.add(m[0]);
-    };
-    if (typeof value === 'string')
-        scan(value);
+function walkText(value, visit) {
+    if (typeof value === 'string' || typeof value === 'number')
+        visit(String(value));
     else if (Array.isArray(value))
-        value.forEach((v) => collectTokenLike(v, into));
+        value.forEach((v) => walkText(v, visit));
     else if (value !== null && typeof value === 'object') {
         for (const [k, v] of Object.entries(value)) {
-            scan(k);
-            collectTokenLike(v, into);
+            visit(k);
+            walkText(v, visit);
         }
     }
+}
+function collectTokenLike(value, into = new Set()) {
+    walkText(value, (text) => {
+        for (const m of text.matchAll(TOKEN_LIKE_RE))
+            into.add(m[0]);
+    });
     return into;
 }
-function uniquePseudonym(vault, sessionId, original, label) {
-    var _a, _b;
+function collectInputText(value) {
+    const parts = [];
+    walkText(value, (text) => parts.push(text));
+    return parts.join('\u0000');
+}
+function reusable(taken, original, ctx) {
+    return !!taken && taken.original === original && !!taken.numeric === !!ctx.numeric;
+}
+function uniquePseudonym(vault, sessionId, original, label, ctx) {
+    var _a, _b, _c;
     const entries = (_b = (_a = vault.getSession(sessionId)) === null || _a === void 0 ? void 0 : _a.entries) !== null && _b !== void 0 ? _b : {};
     for (let attempt = 0; attempt < 32; attempt++) {
         const seed = attempt === 0 ? original : `${original}\u0000${attempt}`;
         const candidate = (0, pseudonymize_1.generatePseudonym)(sessionId, seed, label);
-        const taken = entries[candidate];
-        if (candidate === original)
+        if (candidate === original || ((_c = ctx.inputText) === null || _c === void 0 ? void 0 : _c.includes(candidate)))
             continue;
-        if (!taken || taken.original === original)
+        const taken = entries[candidate];
+        if (!taken || reusable(taken, original, ctx))
             return candidate;
     }
-    return generateToken(label, Object.keys(entries).length);
+    return freshToken(label, vault, sessionId, ctx.reservedTokens);
 }
 function shouldProcessField(fieldPath, fieldMode, fieldRules) {
     if (fieldMode === 'all')
@@ -403,7 +414,7 @@ function getSemanticLabel(fieldKey, siblingKeys) {
     return null;
 }
 function redactSemantic(raw, ctx, vault, sessionId, hits, itemIndex, path, display, siblingKeys) {
-    var _a;
+    var _a, _b;
     const semantic = getSemanticLabel(path, siblingKeys);
     if (!semantic || !semantic.label || raw.trim().length === 0)
         return null;
@@ -412,7 +423,9 @@ function redactSemantic(raw, ctx, vault, sessionId, hits, itemIndex, path, displ
     const semConf = semantic.label === 'IDENTIFIER' ? context_1.AMBIGUOUS_FIELD_CONFIDENCE : context_1.SEMANTIC_CONFIDENCE;
     if (semConf < ((_a = ctx.confidenceThreshold) !== null && _a !== void 0 ? _a : 0))
         return null;
-    const replacement = applyRedaction(raw, { label: semantic.label, category: semantic.category }, ctx.mode, vault, sessionId, ctx.dedup, ctx.reservedTokens);
+    const replacement = applyRedaction(raw, { label: semantic.label, category: semantic.category }, ctx, vault, sessionId);
+    if (replacement)
+        (_b = ctx.lockedSpans) === null || _b === void 0 ? void 0 : _b.set(lockKey(itemIndex, display), [[0, replacement.length]]);
     hits.push({
         token: replacement, original: '***',
         patternName: `semantic_${semantic.label}`,
@@ -423,10 +436,24 @@ function redactSemantic(raw, ctx, vault, sessionId, hits, itemIndex, path, displ
     });
     return replacement;
 }
+function numericMapping(out, text, ctx, vault, sessionId) {
+    var _a, _b;
+    const entries = (_b = (_a = vault.getSession(sessionId)) === null || _a === void 0 ? void 0 : _a.entries) !== null && _b !== void 0 ? _b : {};
+    const existing = entries[out];
+    if ((existing === null || existing === void 0 ? void 0 : existing.original) === text) {
+        existing.numeric = true;
+        return out;
+    }
+    const token = existing ? freshToken('NUMBER', vault, sessionId, ctx.reservedTokens) : out;
+    vault.addEntry(sessionId, {
+        token, original: text, patternLabel: 'NUMBER', category: 'other', createdAt: new Date().toISOString(), numeric: true,
+    });
+    return token;
+}
 function redactNumber(value, ctx, vault, sessionId, hits, itemIndex, path, display, siblingKeys) {
     var _a;
     const text = String(value);
-    const numCtx = { ...ctx, dedup: false };
+    const numCtx = { ...ctx, dedup: false, numeric: true };
     let out = null;
     if (!ctx.skipSemantic)
         out = redactSemantic(text, numCtx, vault, sessionId, hits, itemIndex, path, display, siblingKeys);
@@ -434,10 +461,11 @@ function redactNumber(value, ctx, vault, sessionId, hits, itemIndex, path, displ
         out = redactText(text, numCtx, vault, sessionId, hits, itemIndex, display);
     if (out === null || out === text)
         return value;
-    const entry = (_a = vault.getSession(sessionId)) === null || _a === void 0 ? void 0 : _a.entries[out];
-    if (entry && entry.original === text)
-        entry.numeric = true;
-    return out;
+    if (ctx.mode !== 'token' && ctx.mode !== 'pseudonymize')
+        return out;
+    const mapped = numericMapping(out, text, ctx, vault, sessionId);
+    (_a = ctx.lockedSpans) === null || _a === void 0 ? void 0 : _a.set(lockKey(itemIndex, display), [[0, mapped.length]]);
+    return mapped;
 }
 function redactKey(key, taken, sourceKeys, ctx, vault, sessionId, itemIndex, keyHits) {
     var _a;
@@ -505,38 +533,53 @@ function redactValue(value, ctx, vault, sessionId, hits, itemIndex, currentPath
     return value;
 }
 const escapeRe = (text) => text.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
-function segments(text, produced) {
-    var _a;
-    if (produced.size === 0)
-        return [{ text, locked: false }];
-    const guard = new RegExp([...produced].sort((a, b) => b.length - a.length).map(escapeRe).join('|'), 'g');
+const USER_REGEX_WINDOW = 2048;
+function windows(seg, size) {
     const out = [];
+    let at = 0;
+    while (seg.text.length - at > size) {
+        const cut = seg.text.lastIndexOf(' ', at + size);
+        const end = cut > at + size / 2 ? cut + 1 : at + size;
+        out.push({ text: seg.text.slice(at, end), locked: false, src: seg.src + at });
+        at = end;
+    }
+    out.push({ text: seg.text.slice(at), locked: false, src: seg.src + at });
+    return out;
+}
+function replaceInFree(seg, re, fn, into) {
+    var _a;
     let last = 0;
-    for (const m of text.matchAll(guard)) {
+    for (const m of seg.text.matchAll(re)) {
         const at = (_a = m.index) !== null && _a !== void 0 ? _a : 0;
+        if (m[0] === '')
+            continue;
+        const replacement = fn(m[0], seg.src + at);
+        if (replacement === null)
+            continue;
         if (at > last)
-            out.push({ text: text.slice(last, at), locked: false });
-        out.push({ text: m[0], locked: true });
+            into.push({ text: seg.text.slice(last, at), locked: false, src: seg.src + last });
+        into.push({ text: replacement, locked: true, src: -1 });
         last = at + m[0].length;
     }
-    if (last < text.length)
-        out.push({ text: text.slice(last), locked: false });
-    return out;
-}
-function replaceOutside(text, produced, re, fn) {
-    return segments(text, produced)
-        .map((seg) => (seg.locked ? seg.text : seg.text.replace(new RegExp(re.source, re.flags), fn)))
-        .join('');
+    if (last < seg.text.length)
+        into.push({ text: seg.text.slice(last), locked: false, src: seg.src + last });
 }
-function occursOutside(text, produced, needle) {
-    return segments(text, produced).some((seg) => !seg.locked && seg.text.includes(needle));
+function replaceFree(pass, re, fn, window) {
+    const flags = re.flags.includes('g') ? re.flags : `${re.flags}g`;
+    const global = new RegExp(re.source, flags);
+    const next = [];
+    for (const seg of pass.segs) {
+        if (seg.locked)
+            next.push(seg);
+        else
+            for (const piece of window ? windows(seg, window) : [seg])
+                replaceInFree(piece, global, fn, next);
+    }
+    pass.segs = next;
 }
 function redactMatch(pass, match, pattern, detail) {
-    const { ctx, vault, sessionId } = pass;
-    const replacement = applyRedaction(match, pattern, ctx.mode, vault, sessionId, ctx.dedup, ctx.reservedTokens);
+    const replacement = applyRedaction(match, pattern, pass.ctx, pass.vault, pass.sessionId);
     pass.hits.push({ token: replacement, original: '***', field: pass.fieldPath, itemIndex: pass.itemIndex, ...detail });
-    if (replacement)
-        pass.produced.add(replacement);
     return replacement;
 }
 function denyListRegex(entry) {
@@ -551,26 +594,25 @@ function denyListStage(pass) {
             const re = denyListRegex(entry);
             if (!re)
                 continue;
-            pass.result = replaceOutside(pass.result, pass.produced, re, (match) => TOKEN_RE.test(match)
-                ? match
+            const window = entry.type === 'regex' ? USER_REGEX_WINDOW : undefined;
+            replaceFree(pass, re, (match) => TOKEN_RE.test(match)
+                ? null
                 : redactMatch(pass, match, { label: 'DENY_LIST', category: 'other' }, {
                     patternName: 'denyList', patternLabel: 'DENY_LIST', category: 'other', confidence: context_1.DENY_LIST_CONFIDENCE,
-                }));
+                }), window);
         }
         catch { }
     }
 }
-function builtInMatch(pass, pattern, match, args) {
+function builtInMatch(pass, pattern, match, offset) {
     if (TOKEN_RE.test(match) || (match.startsWith('[') && match.endsWith(']')))
-        return match;
+        return null;
     const validatorPassed = pattern.validate ? pattern.validate(match) : true;
     if (!validatorPassed || isAllowListed(match, pass.ctx.allowList))
-        return match;
-    const offsetArg = args[args.length - 2];
-    const offset = typeof offsetArg === 'number' ? offsetArg : 0;
+        return null;
     const confidence = (0, context_1.calculateConfidence)(pattern.name, !!pattern.validate, validatorPassed, pass.source, offset, offset + match.length);
     if (confidence < pass.threshold)
-        return match;
+        return null;
     return redactMatch(pass, match, pattern, {
         patternName: pattern.name, patternLabel: pattern.label, category: pattern.category, confidence,
     });
@@ -578,24 +620,36 @@ function builtInMatch(pass, pattern, match, args) {
 function builtInStage(pass) {
     const enabled = (0, patterns_1.getPatternsByNames)(pass.ctx.enabledPatterns);
     for (const pattern of [...enabled.filter((p) => p.validate), ...enabled.filter((p) => !p.validate)]) {
-        const re = new RegExp(pattern.regex.source, pattern.regex.flags);
-        pass.result = replaceOutside(pass.result, pass.produced, re, (match, ...args) => builtInMatch(pass, pattern, match, args));
+        replaceFree(pass, pattern.regex, (match, offset) => builtInMatch(pass, pattern, match, offset));
+    }
+}
+function freeNames(pass) {
+    const names = new Map();
+    for (const seg of pass.segs) {
+        if (seg.locked)
+            continue;
+        for (const nm of (0, names_1.detectNamesInText)(seg.text))
+            if (!names.has(nm.name))
+                names.set(nm.name, seg.src + nm.start);
     }
+    return names;
 }
 function nameStage(pass) {
     if (pass.ctx.skipSemantic)
         return;
-    for (const nm of (0, names_1.detectNamesInText)(pass.result)) {
-        if ((nm.name.includes('[') && nm.name.includes(']')) || isAllowListed(nm.name, pass.ctx.allowList))
+    for (const [name, start] of freeNames(pass)) {
+        if ((name.includes('[') && name.includes(']')) || isAllowListed(name, pass.ctx.allowList))
             continue;
-        const confidence = (0, context_1.hasContextWords)(pass.source, nm.start, nm.end, names_1.NAME_CONTEXT_WORDS) ? 0.8 : 0.65;
-        if (confidence < pass.threshold || !occursOutside(pass.result, pass.produced, nm.name))
+        const confidence = (0, context_1.hasContextWords)(pass.source, start, start + name.length, names_1.NAME_CONTEXT_WORDS) ? 0.8 : 0.65;
+        if (confidence < pass.threshold)
             continue;
-        const before = new Set(pass.produced);
-        const replacement = redactMatch(pass, nm.name, { label: 'PERSON_NAME', category: 'identity' }, {
-            patternName: 'personNameDict', patternLabel: 'PERSON_NAME', category: 'identity', confidence,
+        let replacement;
+        replaceFree(pass, new RegExp(escapeRe(name), 'g'), (match) => {
+            replacement !== null && replacement !== void 0 ? replacement : (replacement = redactMatch(pass, match, { label: 'PERSON_NAME', category: 'identity' }, {
+                patternName: 'personNameDict', patternLabel: 'PERSON_NAME', category: 'identity', confidence,
+            }));
+            return replacement;
         });
-        pass.result = replaceOutside(pass.result, before, new RegExp(escapeRe(nm.name), 'g'), () => replacement);
     }
 }
 function customStage(pass) {
@@ -606,27 +660,42 @@ function customStage(pass) {
             continue;
         const pattern = { label: cp.label.toUpperCase(), category: cp.category || 'identity' };
         try {
-            pass.result = replaceOutside(pass.result, pass.produced, new RegExp(cp.regex, 'g'), (match) => TOKEN_RE.test(match) || isAllowListed(match, pass.ctx.allowList)
-                ? match
+            replaceFree(pass, new RegExp(cp.regex, 'g'), (match) => TOKEN_RE.test(match) || isAllowListed(match, pass.ctx.allowList)
+                ? null
                 : redactMatch(pass, match, pattern, {
                     patternName: `custom_${cp.label}`, patternLabel: pattern.label, category: pattern.category,
                     confidence: context_1.CUSTOM_PATTERN_CONFIDENCE,
-                }));
+                }), USER_REGEX_WINDOW);
         }
         catch { }
     }
 }
+function recordLocked(ctx, itemIndex, fieldPath, segs) {
+    if (!ctx.lockedSpans || fieldPath === '')
+        return;
+    const spans = [];
+    let at = 0;
+    for (const seg of segs) {
+        if (seg.locked)
+            spans.push([at, at + seg.text.length]);
+        at += seg.text.length;
+    }
+    if (spans.length > 0)
+        ctx.lockedSpans.set(lockKey(itemIndex, fieldPath), spans);
+}
+const lockKey = (itemIndex, fieldPath) => `${itemIndex}\u0000${fieldPath}`;
 function redactText(text, ctx, vault, sessionId, hits, itemIndex, fieldPath) {
     var _a;
     const pass = {
-        source: text, result: text, produced: new Set(), threshold: (_a = ctx.confidenceThreshold) !== null && _a !== void 0 ? _a : 0,
+        source: text, segs: [{ text, locked: false, src: 0 }], threshold: (_a = ctx.confidenceThreshold) !== null && _a !== void 0 ? _a : 0,
         ctx, vault, sessionId, hits, itemIndex, fieldPath,
     };
     denyListStage(pass);
     builtInStage(pass);
     nameStage(pass);
     customStage(pass);
-    return pass.result;
+    recordLocked(ctx, itemIndex, fieldPath, pass.segs);
+    return pass.segs.map((s) => s.text).join('');
 }
 function makeRestorer(entries) {
     const tokens = Object.keys(entries).filter((t) => t.length > 0).sort((a, b) => b.length - a.length);
@@ -676,13 +745,18 @@ function resolveOverlaps(spans) {
     }
     return kept.sort((a, b) => b.start - a.start);
 }
+function presidioSpans(value, entities, ctx, key) {
+    var _a, _b, _c;
+    const threshold = (_a = ctx.confidenceThreshold) !== null && _a !== void 0 ? _a : 0;
+    const locked = (_c = (_b = ctx.lockedSpans) === null || _b === void 0 ? void 0 : _b.get(key)) !== null && _c !== void 0 ? _c : [];
+    const free = (s) => !locked.some(([start, end]) => s.start < end && start < s.end);
+    return resolveOverlaps(toUtf16Spans(value, entities).filter((s) => s.score >= threshold && free(s)));
+}
 async function presidioRedactString(value, ctx, vault, sessionId, hits, itemIndex, path) {
-    var _a;
     if (value.trim().length === 0 || TOKEN_RE.test(value))
         return value;
     const entities = await (0, presidio_1.analyzeWithPresidio)(ctx.presidioUrl, value, ctx.presidioLanguage || 'en', 0.4, 10000, ctx.presidioRequest);
-    const threshold = (_a = ctx.confidenceThreshold) !== null && _a !== void 0 ? _a : 0;
-    const spans = resolveOverlaps(toUtf16Spans(value, entities).filter((s) => s.score >= threshold));
+    const spans = presidioSpans(value, entities, ctx, lockKey(itemIndex, path));
     let text = value;
     for (const span of spans) {
         const matchedText = value.slice(span.start, span.end);
@@ -692,7 +766,7 @@ async function presidioRedactString(value, ctx, vault, sessionId, hits, itemInde
             continue;
         const label = (0, presidio_1.getRedactorLabel)(span.entityType);
         const category = (0, presidio_1.getRedactorCategory)(span.entityType);
-        const replacement = applyRedaction(matchedText, { label, category }, ctx.mode, vault, sessionId, ctx.dedup, ctx.reservedTokens);
+        const replacement = applyRedaction(matchedText, { label, category }, ctx, vault, sessionId);
         text = text.slice(0, span.start) + replacement + text.slice(span.end);
         hits.push({
             token: replacement, original: '***',

package/dist/nodes/Redactor/regexCharset.js

@@ -0,0 +1,107 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.emptySet = void 0;
+exports.union = union;
+exports.overlaps = overlaps;
+exports.atomCharset = atomCharset;
+const emptySet = () => ({ ascii: new Array(128).fill(false), other: false });
+exports.emptySet = emptySet;
+const fullSet = () => ({ ascii: new Array(128).fill(true), other: true });
+function addCode(set, code) {
+    if (code >= 128) {
+        set.other = true;
+        return;
+    }
+    set.ascii[code] = true;
+    const ch = String.fromCharCode(code);
+    for (const folded of [ch.toLowerCase(), ch.toUpperCase()])
+        set.ascii[folded.charCodeAt(0)] = true;
+}
+function addRange(set, from, to) {
+    for (let c = from; c <= Math.min(to, 127); c++)
+        addCode(set, c);
+    if (to >= 128)
+        set.other = true;
+}
+function union(a, b) {
+    return { ascii: a.ascii.map((v, i) => v || b.ascii[i]), other: a.other || b.other };
+}
+function overlaps(a, b) {
+    return (a.other && b.other) || a.ascii.some((v, i) => v && b.ascii[i]);
+}
+function complement(set) {
+    return { ascii: set.ascii.map((v) => !v), other: true };
+}
+const CLASS_ESCAPES = {
+    d: (s) => addRange(s, 48, 57),
+    w: (s) => {
+        addRange(s, 48, 57);
+        addRange(s, 65, 90);
+        addCode(s, 95);
+    },
+    s: (s) => {
+        for (const c of [9, 10, 11, 12, 13, 32])
+            addCode(s, c);
+        s.other = true;
+    },
+};
+function escapeSet(letter) {
+    const lower = letter.toLowerCase();
+    const fill = CLASS_ESCAPES[lower];
+    if (fill) {
+        const set = (0, exports.emptySet)();
+        fill(set);
+        return letter === lower ? set : complement(set);
+    }
+    if (/[a-zA-Z0-9]/.test(letter))
+        return fullSet();
+    const set = (0, exports.emptySet)();
+    addCode(set, letter.charCodeAt(0));
+    return set;
+}
+function classMember(body, j) {
+    var _a, _b;
+    if (body[j] === '\\') {
+        const set = escapeSet((_a = body[j + 1]) !== null && _a !== void 0 ? _a : '\\');
+        const single = /[a-zA-Z0-9]/.test((_b = body[j + 1]) !== null && _b !== void 0 ? _b : '') ? null : body.charCodeAt(j + 1);
+        return { set, next: j + 2, code: single };
+    }
+    const set = (0, exports.emptySet)();
+    addCode(set, body.charCodeAt(j));
+    return { set, next: j + 1, code: body.charCodeAt(j) };
+}
+function classSet(body) {
+    const negated = body.startsWith('^');
+    let set = (0, exports.emptySet)();
+    let j = negated ? 1 : 0;
+    while (j < body.length) {
+        const first = classMember(body, j);
+        j = first.next;
+        if (body[j] === '-' && j + 1 < body.length && first.code !== null) {
+            const last = classMember(body, j + 1);
+            if (last.code !== null)
+                addRange(set, first.code, last.code);
+            else
+                set = union(union(set, first.set), last.set);
+            j = last.next;
+        }
+        else
+            set = union(set, first.set);
+    }
+    return negated ? complement(set) : set;
+}
+function atomCharset(src, start, end) {
+    var _a, _b;
+    const c = src[start];
+    if (c === '^' || c === '$')
+        return null;
+    if (c === '\\')
+        return /[bB]/.test((_a = src[start + 1]) !== null && _a !== void 0 ? _a : '') ? null : escapeSet((_b = src[start + 1]) !== null && _b !== void 0 ? _b : '\\');
+    if (c === '[')
+        return classSet(src.slice(start + 1, end - 1));
+    if (c === '.')
+        return fullSet();
+    const set = (0, exports.emptySet)();
+    addCode(set, src.charCodeAt(start));
+    return set;
+}

package/dist/nodes/Redactor/regexSafety.js

@@ -1,7 +1,11 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.checkRegex = checkRegex;
+const regexCharset_1 = require("./regexCharset");
 const MAX_REGEX_LENGTH = 500;
+const newFrame = (zeroWidth = false) => ({
+    hasVariableQuantifier: false, hasAlternation: false, run: null, chars: (0, regexCharset_1.emptySet)(), zeroWidth,
+});
 function readBraces(src, i) {
     const m = /^\{(\d+)(,(\d*))?\}/.exec(src.slice(i));
     if (!m)
@@ -55,11 +59,12 @@ function readToken(src, i, stack) {
     if (c === '[')
         return { atomEnd: skipClass(src, i), closed: null };
     if (c === '(') {
-        stack.push({ hasVariableQuantifier: false, hasAlternation: false });
+        stack.push(newFrame(/^\(\?(?:=|!|<=|<!)/.test(src.slice(i))));
         return { atomEnd: i, closed: null, next: i + groupPrefixLength(src, i) };
     }
     if (c === '|') {
         stack[stack.length - 1].hasAlternation = true;
+        stack[stack.length - 1].run = null;
         return { atomEnd: i, closed: null, next: i + 1 };
     }
     const closed = c === ')' && stack.length > 1 ? stack.pop() : null;
@@ -69,7 +74,7 @@ const NESTED = 'a repeated group contains a quantifier or alternation (catastrop
 function isRisky(frame) {
     return !!frame && (frame.hasVariableQuantifier || frame.hasAlternation);
 }
-const NO_GROUP = { hasVariableQuantifier: false, hasAlternation: false };
+const NO_GROUP = newFrame();
 const repeats = (q) => q !== null && q.max > 1;
 const isVariable = (q) => q !== null && q.min !== q.max;
 function applyQuantifier(q, closed, top) {
@@ -80,8 +85,37 @@ function applyQuantifier(q, closed, top) {
     top.hasAlternation || (top.hasAlternation = inner.hasAlternation);
     return null;
 }
+const SEQUENTIAL = 'two repetitions in a row can match the same characters (catastrophic backtracking)';
+function applySequence(chars, variable, required, top) {
+    if (chars === null)
+        return null;
+    top.chars = (0, regexCharset_1.union)(top.chars, chars);
+    const shared = top.run !== null && (0, regexCharset_1.overlaps)(top.run, chars);
+    if (variable) {
+        if (shared)
+            return SEQUENTIAL;
+        top.run = top.run ? (0, regexCharset_1.union)(top.run, chars) : chars;
+    }
+    else if (required && !shared)
+        top.run = null;
+    return null;
+}
+function stepChars(src, i, step) {
+    const closed = step.closed;
+    if (!closed)
+        return (0, regexCharset_1.atomCharset)(src, i, step.atomEnd);
+    return closed.zeroWidth ? null : closed.chars;
+}
+function stepProblem(src, i, step, q, top) {
+    var _a, _b;
+    const problem = applyQuantifier(q, step.closed, top);
+    if (problem || (q === null || q === void 0 ? void 0 : q.max) === 0)
+        return problem;
+    const variable = isVariable(q) || ((_a = step.closed) === null || _a === void 0 ? void 0 : _a.hasVariableQuantifier) === true;
+    return applySequence(stepChars(src, i, step), variable, ((_b = q === null || q === void 0 ? void 0 : q.min) !== null && _b !== void 0 ? _b : 1) >= 1, top);
+}
 function structuralProblem(src) {
-    const stack = [{ hasVariableQuantifier: false, hasAlternation: false }];
+    const stack = [newFrame()];
     let i = 0;
     while (i < src.length) {
         const step = readToken(src, i, stack);
@@ -92,7 +126,7 @@ function structuralProblem(src) {
             continue;
         }
         const q = readQuantifier(src, step.atomEnd);
-        const problem = applyQuantifier(q, step.closed, stack[stack.length - 1]);
+        const problem = stepProblem(src, i, step, q, stack[stack.length - 1]);
         if (problem)
             return problem;
         i = step.atomEnd + (q ? q.length : 0);

package/dist/nodes/Redactor/runtime.js

@@ -27,12 +27,26 @@ async function resolvePassphrase(fns) {
         }
         return cred.passphrase;
     }
+    return legacyPassphrase(fns);
+}
+function legacyPassphrase(fns) {
+    let raw;
     try {
-        return fns.getNodeParameter('vaultPassphrase', 0, '') || '';
+        raw = fns.getNodeParameter('vaultPassphrase', 0, '');
     }
-    catch {
+    catch (error) {
+        throw new n8n_workflow_1.NodeOperationError(fns.getNode(), 'The legacy vault passphrase could not be evaluated, so the vault stays locked.', {
+            description: `Nothing was stored. Fix the expression, or move the passphrase into a Redactor Vault credential. Cause: ${error.message}`,
+        });
+    }
+    if (raw === undefined || raw === null || raw === '')
         return '';
+    if (typeof raw !== 'string') {
+        throw new n8n_workflow_1.NodeOperationError(fns.getNode(), 'The legacy vault passphrase is not text, so the vault stays locked.', {
+            description: 'Nothing was stored. Set the passphrase to a text value, or use a Redactor Vault credential.',
+        });
     }
+    return raw;
 }
 function workflowNamespace(fns) {
     try {
@@ -47,7 +61,7 @@ function workflowNamespace(fns) {
 function assertUserRegexes(fns, customPatterns, lists) {
     const refuse = (what, problem) => {
         throw new n8n_workflow_1.NodeOperationError(fns.getNode(), `${what} regex ${problem}`, {
-            description: 'Rewrite the pattern without nested or alternated repetition, for example [ab]+ instead of (a|b)+.',
+            description: 'Rewrite the pattern without nested or alternated repetition, for example [ab]+ instead of (a|b)+, and without two repetitions in a row that can match the same characters, for example \\d+ instead of \\d+\\d+. Put a fixed separator such as - or @ between repeated parts.',
         });
     };
     for (const cp of customPatterns) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "n8n-nodes-redactor",
-  "version": "4.2.0",
+  "version": "4.3.0",
   "description": "Redact, mask and anonymize PII before it reaches an LLM, then restore it. 216 patterns for emails, phones, addresses, IBAN, cards, names, SSN, passport and tax IDs. Reversible encrypted vault, GDPR Art.30 ROPA record, prompt-injection check. Runs on n8n Cloud and self-hosted n8n 2.x.",
   "keywords": [
     "n8n-community-node-package",