n8n-nodes-redactor 4.2.0 → 5.0.0

package/dist/nodes/Redactor/Redactor.node.js

@@ -1039,6 +1039,8 @@ class Redactor {
                 scanNumbers: true,
                 reservedTokens: (0, engine_1.collectTokenLike)(items.map((it) => it.json)),
                 keyOrigins: new WeakMap(),
+                inputText: (0, engine_1.collectInputText)(items.map((it) => it.json)),
+                lockedSpans: new WeakMap(),
             };
             const allHits = [];
             const returnData = [];

package/dist/nodes/Redactor/engine.js

@@ -34,6 +34,7 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.collectTokenLike = collectTokenLike;
+exports.collectInputText = collectInputText;
 exports.redactValue = redactValue;
 exports.restoreValue = restoreValue;
 exports.enhanceWithPresidio = enhanceWithPresidio;
@@ -56,7 +57,7 @@ function isAllowListed(value, allowList) {
                 case 'contains':
                     return value.includes(entry.value);
                 case 'regex':
-                    if (!isSafeRegex(entry.value))
+                    if (!isSafeRegex(entry.value) || value.length > USER_REGEX_MAX_INPUT)
                         return false;
                     return new RegExp(entry.value, 'i').test(value);
                 default:
@@ -97,8 +98,8 @@ function maskValue(value, label) {
 function hashValue(value) {
     return crypto.createHash('sha256').update(value).digest('hex').slice(0, 12);
 }
-function storeReversible(match, pattern, vault, sessionId, dedup, makeToken) {
-    if (dedup) {
+function storeReversible(match, pattern, ctx, vault, sessionId, makeToken) {
+    if (ctx.dedup) {
         const existing = vault.findByOriginal(sessionId, match);
         if (existing && !existing.numeric)
             return existing.token;
@@ -120,14 +121,14 @@ const IRREVERSIBLE = {
     blackout: (match) => '\u2588'.repeat(match.length),
     remove: () => '',
 };
-function applyRedaction(match, pattern, mode, vault, sessionId, dedup, reserved) {
-    if (mode === 'token') {
-        return storeReversible(match, pattern, vault, sessionId, dedup, () => freshToken(pattern.label, vault, sessionId, reserved));
+function applyRedaction(match, pattern, ctx, vault, sessionId) {
+    if (ctx.mode === 'token') {
+        return storeReversible(match, pattern, ctx, vault, sessionId, () => freshToken(pattern.label, vault, sessionId, ctx.reservedTokens));
     }
-    if (mode === 'pseudonymize') {
-        return storeReversible(match, pattern, vault, sessionId, dedup, () => uniquePseudonym(vault, sessionId, match, pattern.label));
+    if (ctx.mode === 'pseudonymize') {
+        return storeReversible(match, pattern, ctx, vault, sessionId, () => uniquePseudonym(vault, sessionId, match, pattern.label, ctx));
     }
-    const irreversible = IRREVERSIBLE[mode];
+    const irreversible = IRREVERSIBLE[ctx.mode];
     return irreversible ? irreversible(match, pattern.label) : match;
 }
 function freshToken(label, vault, sessionId, reserved) {
@@ -140,36 +141,46 @@ function freshToken(label, vault, sessionId, reserved) {
     return token;
 }
 const TOKEN_LIKE_RE = /\[[A-Z][A-Z0-9_]*_\d+\]/g;
-function collectTokenLike(value, into = new Set()) {
-    const scan = (text) => {
-        for (const m of text.matchAll(TOKEN_LIKE_RE))
-            into.add(m[0]);
-    };
-    if (typeof value === 'string')
-        scan(value);
+function walkText(value, visit) {
+    if (typeof value === 'string' || typeof value === 'number')
+        visit(String(value));
     else if (Array.isArray(value))
-        value.forEach((v) => collectTokenLike(v, into));
+        value.forEach((v) => walkText(v, visit));
     else if (value !== null && typeof value === 'object') {
         for (const [k, v] of Object.entries(value)) {
-            scan(k);
-            collectTokenLike(v, into);
+            visit(k);
+            walkText(v, visit);
         }
     }
+}
+function collectTokenLike(value, into = new Set()) {
+    walkText(value, (text) => {
+        for (const m of text.matchAll(TOKEN_LIKE_RE))
+            into.add(m[0]);
+    });
     return into;
 }
-function uniquePseudonym(vault, sessionId, original, label) {
-    var _a, _b;
+function collectInputText(value) {
+    const parts = [];
+    walkText(value, (text) => parts.push(text));
+    return parts.join('\u0000');
+}
+function reusable(taken, original, ctx) {
+    return !!taken && taken.original === original && !!taken.numeric === !!ctx.numeric;
+}
+function uniquePseudonym(vault, sessionId, original, label, ctx) {
+    var _a, _b, _c;
     const entries = (_b = (_a = vault.getSession(sessionId)) === null || _a === void 0 ? void 0 : _a.entries) !== null && _b !== void 0 ? _b : {};
     for (let attempt = 0; attempt < 32; attempt++) {
         const seed = attempt === 0 ? original : `${original}\u0000${attempt}`;
         const candidate = (0, pseudonymize_1.generatePseudonym)(sessionId, seed, label);
-        const taken = entries[candidate];
-        if (candidate === original)
+        if (candidate === original || ((_c = ctx.inputText) === null || _c === void 0 ? void 0 : _c.includes(candidate)))
             continue;
-        if (!taken || taken.original === original)
+        const taken = entries[candidate];
+        if (!taken || reusable(taken, original, ctx))
             return candidate;
     }
-    return generateToken(label, Object.keys(entries).length);
+    return freshToken(label, vault, sessionId, ctx.reservedTokens);
 }
 function shouldProcessField(fieldPath, fieldMode, fieldRules) {
     if (fieldMode === 'all')
@@ -412,7 +423,8 @@ function redactSemantic(raw, ctx, vault, sessionId, hits, itemIndex, path, displ
     const semConf = semantic.label === 'IDENTIFIER' ? context_1.AMBIGUOUS_FIELD_CONFIDENCE : context_1.SEMANTIC_CONFIDENCE;
     if (semConf < ((_a = ctx.confidenceThreshold) !== null && _a !== void 0 ? _a : 0))
         return null;
-    const replacement = applyRedaction(raw, { label: semantic.label, category: semantic.category }, ctx.mode, vault, sessionId, ctx.dedup, ctx.reservedTokens);
+    const replacement = applyRedaction(raw, { label: semantic.label, category: semantic.category }, ctx, vault, sessionId);
+    ctx.lastLocked = replacement ? [[0, replacement.length]] : undefined;
     hits.push({
         token: replacement, original: '***',
         patternName: `semantic_${semantic.label}`,
@@ -423,10 +435,23 @@ function redactSemantic(raw, ctx, vault, sessionId, hits, itemIndex, path, displ
     });
     return replacement;
 }
+function numericMapping(out, text, ctx, vault, sessionId) {
+    var _a, _b;
+    const entries = (_b = (_a = vault.getSession(sessionId)) === null || _a === void 0 ? void 0 : _a.entries) !== null && _b !== void 0 ? _b : {};
+    const existing = entries[out];
+    if ((existing === null || existing === void 0 ? void 0 : existing.original) === text) {
+        existing.numeric = true;
+        return out;
+    }
+    const token = freshToken('NUMBER', vault, sessionId, ctx.reservedTokens);
+    vault.addEntry(sessionId, {
+        token, original: text, patternLabel: 'NUMBER', category: 'other', createdAt: new Date().toISOString(), numeric: true,
+    });
+    return token;
+}
 function redactNumber(value, ctx, vault, sessionId, hits, itemIndex, path, display, siblingKeys) {
-    var _a;
     const text = String(value);
-    const numCtx = { ...ctx, dedup: false };
+    const numCtx = { ...ctx, dedup: false, numeric: true };
     let out = null;
     if (!ctx.skipSemantic)
         out = redactSemantic(text, numCtx, vault, sessionId, hits, itemIndex, path, display, siblingKeys);
@@ -434,10 +459,13 @@ function redactNumber(value, ctx, vault, sessionId, hits, itemIndex, path, displ
         out = redactText(text, numCtx, vault, sessionId, hits, itemIndex, display);
     if (out === null || out === text)
         return value;
-    const entry = (_a = vault.getSession(sessionId)) === null || _a === void 0 ? void 0 : _a.entries[out];
-    if (entry && entry.original === text)
-        entry.numeric = true;
-    return out;
+    if (ctx.mode !== 'token' && ctx.mode !== 'pseudonymize') {
+        ctx.lastLocked = [[0, out.length]];
+        return out;
+    }
+    const mapped = numericMapping(out, text, ctx, vault, sessionId);
+    ctx.lastLocked = [[0, mapped.length]];
+    return mapped;
 }
 function redactKey(key, taken, sourceKeys, ctx, vault, sessionId, itemIndex, keyHits) {
     var _a;
@@ -474,7 +502,7 @@ function redactObject(value, ctx, vault, sessionId, hits, itemIndex, path, displ
         const childDisplay = display ? `${display}.${outKey}` : outKey;
         for (const h of keyHits)
             hits.push({ ...h, field: childDisplay });
-        obj[outKey] = redactValue(v, ctx, vault, sessionId, hits, itemIndex, fieldPath, siblingKeys, childDisplay);
+        obj[outKey] = lockChild(ctx, obj, outKey, () => redactValue(v, ctx, vault, sessionId, hits, itemIndex, fieldPath, siblingKeys, childDisplay));
     }
     (_a = ctx.keyOrigins) === null || _a === void 0 ? void 0 : _a.set(obj, origins);
     return obj;
@@ -497,7 +525,11 @@ function redactValue(value, ctx, vault, sessionId, hits, itemIndex, currentPath
         return redactNumber(value, ctx, vault, sessionId, hits, itemIndex, currentPath, displayPath, siblingKeys);
     }
     if (Array.isArray(value)) {
-        return value.map((v, i) => redactValue(v, ctx, vault, sessionId, hits, itemIndex, `${currentPath}[${i}]`, undefined, `${displayPath}[${i}]`));
+        const out = [];
+        value.forEach((v, i) => {
+            out.push(lockChild(ctx, out, String(i), () => redactValue(v, ctx, vault, sessionId, hits, itemIndex, `${currentPath}[${i}]`, undefined, `${displayPath}[${i}]`)));
+        });
+        return out;
     }
     if (value !== null && typeof value === 'object') {
         return redactObject(value, ctx, vault, sessionId, hits, itemIndex, currentPath, displayPath);
@@ -505,38 +537,46 @@ function redactValue(value, ctx, vault, sessionId, hits, itemIndex, currentPath
     return value;
 }
 const escapeRe = (text) => text.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
-function segments(text, produced) {
+const USER_REGEX_MAX_INPUT = 20000;
+function assertUserRegexInput(text, what) {
+    if (text.length <= USER_REGEX_MAX_INPUT)
+        return;
+    throw new Error(`${what} cannot scan a value of ${text.length} characters, the limit is ${USER_REGEX_MAX_INPUT}. ` +
+        'Exclude the field with field rules, or remove the regex.');
+}
+function replaceInFree(seg, re, fn, into) {
     var _a;
-    if (produced.size === 0)
-        return [{ text, locked: false }];
-    const guard = new RegExp([...produced].sort((a, b) => b.length - a.length).map(escapeRe).join('|'), 'g');
-    const out = [];
     let last = 0;
-    for (const m of text.matchAll(guard)) {
+    for (const m of seg.text.matchAll(re)) {
         const at = (_a = m.index) !== null && _a !== void 0 ? _a : 0;
+        if (m[0] === '')
+            continue;
+        const replacement = fn(m[0], seg.src + at);
+        if (replacement === null)
+            continue;
         if (at > last)
-            out.push({ text: text.slice(last, at), locked: false });
-        out.push({ text: m[0], locked: true });
+            into.push({ text: seg.text.slice(last, at), locked: false, src: seg.src + last });
+        into.push({ text: replacement, locked: true, src: -1 });
         last = at + m[0].length;
     }
-    if (last < text.length)
-        out.push({ text: text.slice(last), locked: false });
-    return out;
-}
-function replaceOutside(text, produced, re, fn) {
-    return segments(text, produced)
-        .map((seg) => (seg.locked ? seg.text : seg.text.replace(new RegExp(re.source, re.flags), fn)))
-        .join('');
+    if (last < seg.text.length)
+        into.push({ text: seg.text.slice(last), locked: false, src: seg.src + last });
 }
-function occursOutside(text, produced, needle) {
-    return segments(text, produced).some((seg) => !seg.locked && seg.text.includes(needle));
+function replaceFree(pass, re, fn) {
+    const flags = re.flags.includes('g') ? re.flags : `${re.flags}g`;
+    const global = new RegExp(re.source, flags);
+    const next = [];
+    for (const seg of pass.segs) {
+        if (seg.locked)
+            next.push(seg);
+        else
+            replaceInFree(seg, global, fn, next);
+    }
+    pass.segs = next;
 }
 function redactMatch(pass, match, pattern, detail) {
-    const { ctx, vault, sessionId } = pass;
-    const replacement = applyRedaction(match, pattern, ctx.mode, vault, sessionId, ctx.dedup, ctx.reservedTokens);
+    const replacement = applyRedaction(match, pattern, pass.ctx, pass.vault, pass.sessionId);
     pass.hits.push({ token: replacement, original: '***', field: pass.fieldPath, itemIndex: pass.itemIndex, ...detail });
-    if (replacement)
-        pass.produced.add(replacement);
     return replacement;
 }
 function denyListRegex(entry) {
@@ -547,12 +587,14 @@ function denyListRegex(entry) {
 function denyListStage(pass) {
     var _a;
     for (const entry of (_a = pass.ctx.denyList) !== null && _a !== void 0 ? _a : []) {
+        if (entry.type === 'regex')
+            assertUserRegexInput(pass.source, `Deny list regex "${entry.value}"`);
         try {
             const re = denyListRegex(entry);
             if (!re)
                 continue;
-            pass.result = replaceOutside(pass.result, pass.produced, re, (match) => TOKEN_RE.test(match)
-                ? match
+            replaceFree(pass, re, (match) => TOKEN_RE.test(match)
+                ? null
                 : redactMatch(pass, match, { label: 'DENY_LIST', category: 'other' }, {
                     patternName: 'denyList', patternLabel: 'DENY_LIST', category: 'other', confidence: context_1.DENY_LIST_CONFIDENCE,
                 }));
@@ -560,17 +602,15 @@ function denyListStage(pass) {
         catch { }
     }
 }
-function builtInMatch(pass, pattern, match, args) {
+function builtInMatch(pass, pattern, match, offset) {
     if (TOKEN_RE.test(match) || (match.startsWith('[') && match.endsWith(']')))
-        return match;
+        return null;
     const validatorPassed = pattern.validate ? pattern.validate(match) : true;
     if (!validatorPassed || isAllowListed(match, pass.ctx.allowList))
-        return match;
-    const offsetArg = args[args.length - 2];
-    const offset = typeof offsetArg === 'number' ? offsetArg : 0;
+        return null;
     const confidence = (0, context_1.calculateConfidence)(pattern.name, !!pattern.validate, validatorPassed, pass.source, offset, offset + match.length);
     if (confidence < pass.threshold)
-        return match;
+        return null;
     return redactMatch(pass, match, pattern, {
         patternName: pattern.name, patternLabel: pattern.label, category: pattern.category, confidence,
     });
@@ -578,24 +618,34 @@ function builtInMatch(pass, pattern, match, args) {
 function builtInStage(pass) {
     const enabled = (0, patterns_1.getPatternsByNames)(pass.ctx.enabledPatterns);
     for (const pattern of [...enabled.filter((p) => p.validate), ...enabled.filter((p) => !p.validate)]) {
-        const re = new RegExp(pattern.regex.source, pattern.regex.flags);
-        pass.result = replaceOutside(pass.result, pass.produced, re, (match, ...args) => builtInMatch(pass, pattern, match, args));
+        replaceFree(pass, pattern.regex, (match, offset) => builtInMatch(pass, pattern, match, offset));
     }
 }
+function freeNames(pass) {
+    const names = new Set();
+    for (const seg of pass.segs) {
+        if (!seg.locked)
+            for (const nm of (0, names_1.detectNamesInText)(seg.text))
+                names.add(nm.name);
+    }
+    return names;
+}
 function nameStage(pass) {
     if (pass.ctx.skipSemantic)
         return;
-    for (const nm of (0, names_1.detectNamesInText)(pass.result)) {
-        if ((nm.name.includes('[') && nm.name.includes(']')) || isAllowListed(nm.name, pass.ctx.allowList))
-            continue;
-        const confidence = (0, context_1.hasContextWords)(pass.source, nm.start, nm.end, names_1.NAME_CONTEXT_WORDS) ? 0.8 : 0.65;
-        if (confidence < pass.threshold || !occursOutside(pass.result, pass.produced, nm.name))
+    for (const name of freeNames(pass)) {
+        if ((name.includes('[') && name.includes(']')) || isAllowListed(name, pass.ctx.allowList))
             continue;
-        const before = new Set(pass.produced);
-        const replacement = redactMatch(pass, nm.name, { label: 'PERSON_NAME', category: 'identity' }, {
-            patternName: 'personNameDict', patternLabel: 'PERSON_NAME', category: 'identity', confidence,
+        let replacement;
+        replaceFree(pass, new RegExp(escapeRe(name), 'g'), (match, start) => {
+            const confidence = (0, context_1.hasContextWords)(pass.source, start, start + match.length, names_1.NAME_CONTEXT_WORDS) ? 0.8 : 0.65;
+            if (confidence < pass.threshold)
+                return null;
+            replacement !== null && replacement !== void 0 ? replacement : (replacement = redactMatch(pass, match, { label: 'PERSON_NAME', category: 'identity' }, {
+                patternName: 'personNameDict', patternLabel: 'PERSON_NAME', category: 'identity', confidence,
+            }));
+            return replacement;
         });
-        pass.result = replaceOutside(pass.result, before, new RegExp(escapeRe(nm.name), 'g'), () => replacement);
     }
 }
 function customStage(pass) {
@@ -605,9 +655,10 @@ function customStage(pass) {
         if (!cp.label || !cp.regex || !isSafeRegex(cp.regex))
             continue;
         const pattern = { label: cp.label.toUpperCase(), category: cp.category || 'identity' };
+        assertUserRegexInput(pass.source, `Custom pattern "${cp.label}"`);
         try {
-            pass.result = replaceOutside(pass.result, pass.produced, new RegExp(cp.regex, 'g'), (match) => TOKEN_RE.test(match) || isAllowListed(match, pass.ctx.allowList)
-                ? match
+            replaceFree(pass, new RegExp(cp.regex, 'g'), (match) => TOKEN_RE.test(match) || isAllowListed(match, pass.ctx.allowList)
+                ? null
                 : redactMatch(pass, match, pattern, {
                     patternName: `custom_${cp.label}`, patternLabel: pattern.label, category: pattern.category,
                     confidence: context_1.CUSTOM_PATTERN_CONFIDENCE,
@@ -616,17 +667,40 @@ function customStage(pass) {
         catch { }
     }
 }
+function recordLocked(ctx, segs) {
+    const spans = [];
+    let at = 0;
+    for (const seg of segs) {
+        if (seg.locked)
+            spans.push([at, at + seg.text.length]);
+        at += seg.text.length;
+    }
+    ctx.lastLocked = spans.length > 0 ? spans : undefined;
+}
+function lockChild(ctx, container, key, compute) {
+    var _a;
+    ctx.lastLocked = undefined;
+    const out = compute();
+    if (ctx.lastLocked && ctx.lockedSpans && typeof out === 'string') {
+        const byKey = (_a = ctx.lockedSpans.get(container)) !== null && _a !== void 0 ? _a : new Map();
+        byKey.set(key, ctx.lastLocked);
+        ctx.lockedSpans.set(container, byKey);
+    }
+    ctx.lastLocked = undefined;
+    return out;
+}
 function redactText(text, ctx, vault, sessionId, hits, itemIndex, fieldPath) {
     var _a;
     const pass = {
-        source: text, result: text, produced: new Set(), threshold: (_a = ctx.confidenceThreshold) !== null && _a !== void 0 ? _a : 0,
+        source: text, segs: [{ text, locked: false, src: 0 }], threshold: (_a = ctx.confidenceThreshold) !== null && _a !== void 0 ? _a : 0,
         ctx, vault, sessionId, hits, itemIndex, fieldPath,
     };
     denyListStage(pass);
     builtInStage(pass);
     nameStage(pass);
     customStage(pass);
-    return pass.result;
+    recordLocked(ctx, pass.segs);
+    return pass.segs.map((s) => s.text).join('');
 }
 function makeRestorer(entries) {
     const tokens = Object.keys(entries).filter((t) => t.length > 0).sort((a, b) => b.length - a.length);
@@ -676,13 +750,17 @@ function resolveOverlaps(spans) {
     }
     return kept.sort((a, b) => b.start - a.start);
 }
-async function presidioRedactString(value, ctx, vault, sessionId, hits, itemIndex, path) {
+function presidioSpans(value, entities, ctx, locked) {
     var _a;
+    const threshold = (_a = ctx.confidenceThreshold) !== null && _a !== void 0 ? _a : 0;
+    const free = (s) => !locked.some(([start, end]) => s.start < end && start < s.end);
+    return resolveOverlaps(toUtf16Spans(value, entities).filter((s) => s.score >= threshold && free(s)));
+}
+async function presidioRedactString(value, ctx, vault, sessionId, hits, itemIndex, path, locked) {
     if (value.trim().length === 0 || TOKEN_RE.test(value))
         return value;
     const entities = await (0, presidio_1.analyzeWithPresidio)(ctx.presidioUrl, value, ctx.presidioLanguage || 'en', 0.4, 10000, ctx.presidioRequest);
-    const threshold = (_a = ctx.confidenceThreshold) !== null && _a !== void 0 ? _a : 0;
-    const spans = resolveOverlaps(toUtf16Spans(value, entities).filter((s) => s.score >= threshold));
+    const spans = presidioSpans(value, entities, ctx, locked);
     let text = value;
     for (const span of spans) {
         const matchedText = value.slice(span.start, span.end);
@@ -692,7 +770,7 @@ async function presidioRedactString(value, ctx, vault, sessionId, hits, itemInde
             continue;
         const label = (0, presidio_1.getRedactorLabel)(span.entityType);
         const category = (0, presidio_1.getRedactorCategory)(span.entityType);
-        const replacement = applyRedaction(matchedText, { label, category }, ctx.mode, vault, sessionId, ctx.dedup, ctx.reservedTokens);
+        const replacement = applyRedaction(matchedText, { label, category }, ctx, vault, sessionId);
         text = text.slice(0, span.start) + replacement + text.slice(span.end);
         hits.push({
             token: replacement, original: '***',
@@ -702,13 +780,13 @@ async function presidioRedactString(value, ctx, vault, sessionId, hits, itemInde
     }
     return text;
 }
-async function presidioWalk(value, ctx, vault, sessionId, hits, itemIndex, path, policyPath) {
-    var _a, _b;
+async function presidioWalk(value, ctx, vault, sessionId, hits, itemIndex, path, policyPath, locked = []) {
+    var _a, _b, _c, _d, _e, _f;
     if (typeof value === 'string') {
         if (!shouldProcessField(policyPath, ctx.fieldMode, ctx.fieldRules))
             return value;
         try {
-            return await presidioRedactString(value, ctx, vault, sessionId, hits, itemIndex, path);
+            return await presidioRedactString(value, ctx, vault, sessionId, hits, itemIndex, path, locked);
         }
         catch {
             return value;
@@ -717,18 +795,20 @@ async function presidioWalk(value, ctx, vault, sessionId, hits, itemIndex, path,
     if (Array.isArray(value)) {
         const out = [];
         for (let i = 0; i < value.length; i++) {
-            out.push(await presidioWalk(value[i], ctx, vault, sessionId, hits, itemIndex, `${path}[${i}]`, `${policyPath}[${i}]`));
+            const lock = (_b = (_a = ctx.lockedSpans) === null || _a === void 0 ? void 0 : _a.get(value)) === null || _b === void 0 ? void 0 : _b.get(String(i));
+            out.push(await presidioWalk(value[i], ctx, vault, sessionId, hits, itemIndex, `${path}[${i}]`, `${policyPath}[${i}]`, lock));
         }
         return out;
     }
     if (value !== null && typeof value === 'object') {
-        const origins = (_a = ctx.keyOrigins) === null || _a === void 0 ? void 0 : _a.get(value);
+        const origins = (_c = ctx.keyOrigins) === null || _c === void 0 ? void 0 : _c.get(value);
         const out = {};
         for (const [k, v] of Object.entries(value)) {
-            const original = (_b = origins === null || origins === void 0 ? void 0 : origins.get(k)) !== null && _b !== void 0 ? _b : k;
+            const original = (_d = origins === null || origins === void 0 ? void 0 : origins.get(k)) !== null && _d !== void 0 ? _d : k;
             const child = path ? `${path}.${k}` : k;
             const childPolicy = policyPath ? `${policyPath}.${original}` : original;
-            out[k] = await presidioWalk(v, ctx, vault, sessionId, hits, itemIndex, child, childPolicy);
+            const lock = (_f = (_e = ctx.lockedSpans) === null || _e === void 0 ? void 0 : _e.get(value)) === null || _f === void 0 ? void 0 : _f.get(k);
+            out[k] = await presidioWalk(v, ctx, vault, sessionId, hits, itemIndex, child, childPolicy, lock);
         }
         return out;
     }

package/dist/nodes/Redactor/regexCharset.js

@@ -0,0 +1,131 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.emptySet = void 0;
+exports.union = union;
+exports.overlaps = overlaps;
+exports.readEscape = readEscape;
+exports.atomCharset = atomCharset;
+const emptySet = () => ({ ascii: new Array(128).fill(false), other: false });
+exports.emptySet = emptySet;
+const fullSet = () => ({ ascii: new Array(128).fill(true), other: true });
+function addCode(set, code) {
+    if (code >= 128)
+        set.other = true;
+    else
+        set.ascii[code] = true;
+}
+function addRange(set, from, to) {
+    for (let c = from; c <= Math.min(to, 127); c++)
+        addCode(set, c);
+    if (to >= 128)
+        set.other = true;
+}
+function union(a, b) {
+    return { ascii: a.ascii.map((v, i) => v || b.ascii[i]), other: a.other || b.other };
+}
+function overlaps(a, b) {
+    return (a.other && b.other) || a.ascii.some((v, i) => v && b.ascii[i]);
+}
+function complement(set) {
+    return { ascii: set.ascii.map((v) => !v), other: true };
+}
+function fold(set) {
+    const ascii = [...set.ascii];
+    for (let c = 65; c <= 90; c++)
+        ascii[c] = ascii[c + 32] = set.ascii[c] || set.ascii[c + 32];
+    return { ascii, other: set.other };
+}
+const CLASS_ESCAPES = {
+    d: (s) => addRange(s, 48, 57),
+    w: (s) => {
+        addRange(s, 48, 57);
+        addRange(s, 65, 90);
+        addRange(s, 97, 122);
+        addCode(s, 95);
+    },
+    s: (s) => {
+        for (const c of [9, 10, 11, 12, 13, 32])
+            addCode(s, c);
+        s.other = true;
+    },
+};
+const HEX = /^[0-9a-fA-F]+$/;
+function readEscape(src, i) {
+    var _a, _b;
+    const e = (_a = src[i + 1]) !== null && _a !== void 0 ? _a : '';
+    const hex = (n) => (HEX.test(src.slice(i + 2, i + 2 + n)) && src.length >= i + 2 + n ? n : 0);
+    if (e === 'x' && hex(2))
+        return { length: 4, code: parseInt(src.slice(i + 2, i + 4), 16) };
+    if (e === 'u' && hex(4))
+        return { length: 6, code: parseInt(src.slice(i + 2, i + 6), 16) };
+    if (e === 'c' && /[A-Za-z]/.test((_b = src[i + 2]) !== null && _b !== void 0 ? _b : ''))
+        return { length: 3, code: src.charCodeAt(i + 2) % 32 };
+    if (e === '0')
+        return { length: 2, code: 0 };
+    if (/[a-zA-Z0-9]/.test(e))
+        return { length: 2, code: null };
+    return { length: 2, code: e.charCodeAt(0) };
+}
+function escapeSet(src, i) {
+    var _a;
+    const { code } = readEscape(src, i);
+    const set = (0, exports.emptySet)();
+    if (code !== null) {
+        addCode(set, code);
+        return set;
+    }
+    const letter = (_a = src[i + 1]) !== null && _a !== void 0 ? _a : '';
+    const fill = CLASS_ESCAPES[letter.toLowerCase()];
+    if (!fill)
+        return fullSet();
+    fill(set);
+    return letter === letter.toLowerCase() ? set : complement(set);
+}
+function classMember(body, j) {
+    if (body[j] === '\\') {
+        const { length, code } = readEscape(body, j);
+        return { set: escapeSet(body, j), next: j + length, code };
+    }
+    const set = (0, exports.emptySet)();
+    addCode(set, body.charCodeAt(j));
+    return { set, next: j + 1, code: body.charCodeAt(j) };
+}
+function classSet(body) {
+    const negated = body.startsWith('^');
+    let set = (0, exports.emptySet)();
+    let j = negated ? 1 : 0;
+    while (j < body.length) {
+        const first = classMember(body, j);
+        j = first.next;
+        if (body[j] === '-' && j + 1 < body.length && first.code !== null) {
+            const last = classMember(body, j + 1);
+            if (last.code !== null)
+                addRange(set, first.code, last.code);
+            else
+                set = union(union(set, first.set), last.set);
+            j = last.next;
+        }
+        else
+            set = union(set, first.set);
+    }
+    return negated ? complement(set) : set;
+}
+function rawCharset(src, start, end) {
+    var _a;
+    const c = src[start];
+    if (c === '^' || c === '$')
+        return null;
+    if (c === '\\')
+        return /[bB]/.test((_a = src[start + 1]) !== null && _a !== void 0 ? _a : '') ? null : escapeSet(src, start);
+    if (c === '[')
+        return classSet(src.slice(start + 1, end - 1));
+    if (c === '.')
+        return fullSet();
+    const set = (0, exports.emptySet)();
+    addCode(set, src.charCodeAt(start));
+    return set;
+}
+function atomCharset(src, start, end) {
+    const set = rawCharset(src, start, end);
+    return set && fold(set);
+}

package/dist/nodes/Redactor/regexSafety.js

@@ -1,7 +1,17 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.checkRegex = checkRegex;
+const regexCharset_1 = require("./regexCharset");
 const MAX_REGEX_LENGTH = 500;
+const newFrame = (zeroWidth = false) => ({
+    hasVariableQuantifier: false, hasAlternation: false, run: null, chars: (0, regexCharset_1.emptySet)(), zeroWidth,
+    branchConsumes: false, allConsume: true, nullable: false,
+});
+function endBranch(frame) {
+    frame.allConsume && (frame.allConsume = frame.branchConsumes);
+    frame.branchConsumes = false;
+    frame.nullable = !frame.allConsume;
+}
 function readBraces(src, i) {
     const m = /^\{(\d+)(,(\d*))?\}/.exec(src.slice(i));
     if (!m)
@@ -44,32 +54,43 @@ function groupPrefixLength(src, i) {
     const look = /^\(\?(?::|=|!|<=|<!)/.exec(src.slice(i));
     return look ? look[0].length : 1;
 }
+function alternation(stack, i) {
+    const top = stack[stack.length - 1];
+    top.hasAlternation = true;
+    top.run = null;
+    endBranch(top);
+    return { atomEnd: i, closed: null, next: i + 1 };
+}
+function closeGroup(c, stack) {
+    if (c !== ')' || stack.length <= 1)
+        return null;
+    const closed = stack.pop();
+    endBranch(closed);
+    return closed;
+}
 function readToken(src, i, stack) {
     var _a;
     const c = src[i];
     if (c === '\\') {
         if (/[1-9k]/.test((_a = src[i + 1]) !== null && _a !== void 0 ? _a : ''))
             return { atomEnd: i, closed: null, error: 'back-references are not supported' };
-        return { atomEnd: i + 2, closed: null };
+        return { atomEnd: i + (0, regexCharset_1.readEscape)(src, i).length, closed: null };
     }
     if (c === '[')
         return { atomEnd: skipClass(src, i), closed: null };
     if (c === '(') {
-        stack.push({ hasVariableQuantifier: false, hasAlternation: false });
+        stack.push(newFrame(/^\(\?(?:=|!|<=|<!)/.test(src.slice(i))));
         return { atomEnd: i, closed: null, next: i + groupPrefixLength(src, i) };
     }
-    if (c === '|') {
-        stack[stack.length - 1].hasAlternation = true;
-        return { atomEnd: i, closed: null, next: i + 1 };
-    }
-    const closed = c === ')' && stack.length > 1 ? stack.pop() : null;
-    return { atomEnd: i + 1, closed };
+    if (c === '|')
+        return alternation(stack, i);
+    return { atomEnd: i + 1, closed: closeGroup(c, stack) };
 }
 const NESTED = 'a repeated group contains a quantifier or alternation (catastrophic backtracking)';
 function isRisky(frame) {
     return !!frame && (frame.hasVariableQuantifier || frame.hasAlternation);
 }
-const NO_GROUP = { hasVariableQuantifier: false, hasAlternation: false };
+const NO_GROUP = newFrame();
 const repeats = (q) => q !== null && q.max > 1;
 const isVariable = (q) => q !== null && q.min !== q.max;
 function applyQuantifier(q, closed, top) {
@@ -80,8 +101,45 @@ function applyQuantifier(q, closed, top) {
     top.hasAlternation || (top.hasAlternation = inner.hasAlternation);
     return null;
 }
+const SEQUENTIAL = 'two repetitions in a row can match the same characters (catastrophic backtracking)';
+function applySequence(chars, variable, required, top) {
+    if (chars === null)
+        return null;
+    top.chars = (0, regexCharset_1.union)(top.chars, chars);
+    const shared = top.run !== null && (0, regexCharset_1.overlaps)(top.run, chars);
+    if (variable) {
+        if (shared)
+            return SEQUENTIAL;
+        top.run = top.run ? (0, regexCharset_1.union)(top.run, chars) : chars;
+    }
+    else if (required && !shared)
+        top.run = null;
+    return null;
+}
+function stepChars(src, i, step) {
+    const closed = step.closed;
+    if (!closed)
+        return (0, regexCharset_1.atomCharset)(src, i, step.atomEnd);
+    return closed.zeroWidth ? null : closed.chars;
+}
+function consumes(q, chars, closed) {
+    if (chars === null || (q !== null && q.min < 1))
+        return false;
+    return !(closed === null || closed === void 0 ? void 0 : closed.nullable);
+}
+function stepProblem(src, i, step, q, top) {
+    var _a;
+    const problem = applyQuantifier(q, step.closed, top);
+    if (problem || (q === null || q === void 0 ? void 0 : q.max) === 0)
+        return problem;
+    const chars = stepChars(src, i, step);
+    const required = consumes(q, chars, step.closed);
+    if (required)
+        top.branchConsumes = true;
+    return applySequence(chars, isVariable(q) || !!((_a = step.closed) === null || _a === void 0 ? void 0 : _a.hasVariableQuantifier), required, top);
+}
 function structuralProblem(src) {
-    const stack = [{ hasVariableQuantifier: false, hasAlternation: false }];
+    const stack = [newFrame()];
     let i = 0;
     while (i < src.length) {
         const step = readToken(src, i, stack);
@@ -92,7 +150,7 @@ function structuralProblem(src) {
             continue;
         }
         const q = readQuantifier(src, step.atomEnd);
-        const problem = applyQuantifier(q, step.closed, stack[stack.length - 1]);
+        const problem = stepProblem(src, i, step, q, stack[stack.length - 1]);
         if (problem)
             return problem;
         i = step.atomEnd + (q ? q.length : 0);

package/dist/nodes/Redactor/runtime.js

@@ -27,12 +27,26 @@ async function resolvePassphrase(fns) {
         }
         return cred.passphrase;
     }
+    return legacyPassphrase(fns);
+}
+function legacyPassphrase(fns) {
+    let raw;
     try {
-        return fns.getNodeParameter('vaultPassphrase', 0, '') || '';
+        raw = fns.getNodeParameter('vaultPassphrase', 0, '');
     }
-    catch {
+    catch (error) {
+        throw new n8n_workflow_1.NodeOperationError(fns.getNode(), 'The legacy vault passphrase could not be evaluated, so the vault stays locked.', {
+            description: `Nothing was stored. Fix the expression, or move the passphrase into a Redactor Vault credential. Cause: ${error.message}`,
+        });
+    }
+    if (raw === undefined || raw === null || raw === '')
         return '';
+    if (typeof raw !== 'string') {
+        throw new n8n_workflow_1.NodeOperationError(fns.getNode(), 'The legacy vault passphrase is not text, so the vault stays locked.', {
+            description: 'Nothing was stored. Set the passphrase to a text value, or use a Redactor Vault credential.',
+        });
     }
+    return raw;
 }
 function workflowNamespace(fns) {
     try {
@@ -47,7 +61,7 @@ function workflowNamespace(fns) {
 function assertUserRegexes(fns, customPatterns, lists) {
     const refuse = (what, problem) => {
         throw new n8n_workflow_1.NodeOperationError(fns.getNode(), `${what} regex ${problem}`, {
-            description: 'Rewrite the pattern without nested or alternated repetition, for example [ab]+ instead of (a|b)+.',
+            description: 'Rewrite the pattern without nested or alternated repetition, for example [ab]+ instead of (a|b)+, and without two repetitions in a row that can match the same characters, for example \\d+ instead of \\d+\\d+. Put a fixed separator such as - or @ between repeated parts.',
         });
     };
     for (const cp of customPatterns) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "n8n-nodes-redactor",
-  "version": "4.2.0",
+  "version": "5.0.0",
   "description": "Redact, mask and anonymize PII before it reaches an LLM, then restore it. 216 patterns for emails, phones, addresses, IBAN, cards, names, SSN, passport and tax IDs. Reversible encrypted vault, GDPR Art.30 ROPA record, prompt-injection check. Runs on n8n Cloud and self-hosted n8n 2.x.",
   "keywords": [
     "n8n-community-node-package",