n8n-nodes-redactor 4.3.0 → 5.0.0

package/dist/nodes/Redactor/Redactor.node.js

@@ -1040,7 +1040,7 @@ class Redactor {
                 reservedTokens: (0, engine_1.collectTokenLike)(items.map((it) => it.json)),
                 keyOrigins: new WeakMap(),
                 inputText: (0, engine_1.collectInputText)(items.map((it) => it.json)),
-                lockedSpans: new Map(),
+                lockedSpans: new WeakMap(),
             };
             const allHits = [];
             const returnData = [];

package/dist/nodes/Redactor/engine.js

@@ -57,7 +57,7 @@ function isAllowListed(value, allowList) {
                 case 'contains':
                     return value.includes(entry.value);
                 case 'regex':
-                    if (!isSafeRegex(entry.value))
+                    if (!isSafeRegex(entry.value) || value.length > USER_REGEX_MAX_INPUT)
                         return false;
                     return new RegExp(entry.value, 'i').test(value);
                 default:
@@ -414,7 +414,7 @@ function getSemanticLabel(fieldKey, siblingKeys) {
     return null;
 }
 function redactSemantic(raw, ctx, vault, sessionId, hits, itemIndex, path, display, siblingKeys) {
-    var _a, _b;
+    var _a;
     const semantic = getSemanticLabel(path, siblingKeys);
     if (!semantic || !semantic.label || raw.trim().length === 0)
         return null;
@@ -424,8 +424,7 @@ function redactSemantic(raw, ctx, vault, sessionId, hits, itemIndex, path, displ
     if (semConf < ((_a = ctx.confidenceThreshold) !== null && _a !== void 0 ? _a : 0))
         return null;
     const replacement = applyRedaction(raw, { label: semantic.label, category: semantic.category }, ctx, vault, sessionId);
-    if (replacement)
-        (_b = ctx.lockedSpans) === null || _b === void 0 ? void 0 : _b.set(lockKey(itemIndex, display), [[0, replacement.length]]);
+    ctx.lastLocked = replacement ? [[0, replacement.length]] : undefined;
     hits.push({
         token: replacement, original: '***',
         patternName: `semantic_${semantic.label}`,
@@ -444,14 +443,13 @@ function numericMapping(out, text, ctx, vault, sessionId) {
         existing.numeric = true;
         return out;
     }
-    const token = existing ? freshToken('NUMBER', vault, sessionId, ctx.reservedTokens) : out;
+    const token = freshToken('NUMBER', vault, sessionId, ctx.reservedTokens);
     vault.addEntry(sessionId, {
         token, original: text, patternLabel: 'NUMBER', category: 'other', createdAt: new Date().toISOString(), numeric: true,
     });
     return token;
 }
 function redactNumber(value, ctx, vault, sessionId, hits, itemIndex, path, display, siblingKeys) {
-    var _a;
     const text = String(value);
     const numCtx = { ...ctx, dedup: false, numeric: true };
     let out = null;
@@ -461,10 +459,12 @@ function redactNumber(value, ctx, vault, sessionId, hits, itemIndex, path, displ
         out = redactText(text, numCtx, vault, sessionId, hits, itemIndex, display);
     if (out === null || out === text)
         return value;
-    if (ctx.mode !== 'token' && ctx.mode !== 'pseudonymize')
+    if (ctx.mode !== 'token' && ctx.mode !== 'pseudonymize') {
+        ctx.lastLocked = [[0, out.length]];
         return out;
+    }
     const mapped = numericMapping(out, text, ctx, vault, sessionId);
-    (_a = ctx.lockedSpans) === null || _a === void 0 ? void 0 : _a.set(lockKey(itemIndex, display), [[0, mapped.length]]);
+    ctx.lastLocked = [[0, mapped.length]];
     return mapped;
 }
 function redactKey(key, taken, sourceKeys, ctx, vault, sessionId, itemIndex, keyHits) {
@@ -502,7 +502,7 @@ function redactObject(value, ctx, vault, sessionId, hits, itemIndex, path, displ
         const childDisplay = display ? `${display}.${outKey}` : outKey;
         for (const h of keyHits)
             hits.push({ ...h, field: childDisplay });
-        obj[outKey] = redactValue(v, ctx, vault, sessionId, hits, itemIndex, fieldPath, siblingKeys, childDisplay);
+        obj[outKey] = lockChild(ctx, obj, outKey, () => redactValue(v, ctx, vault, sessionId, hits, itemIndex, fieldPath, siblingKeys, childDisplay));
     }
     (_a = ctx.keyOrigins) === null || _a === void 0 ? void 0 : _a.set(obj, origins);
     return obj;
@@ -525,7 +525,11 @@ function redactValue(value, ctx, vault, sessionId, hits, itemIndex, currentPath
         return redactNumber(value, ctx, vault, sessionId, hits, itemIndex, currentPath, displayPath, siblingKeys);
     }
     if (Array.isArray(value)) {
-        return value.map((v, i) => redactValue(v, ctx, vault, sessionId, hits, itemIndex, `${currentPath}[${i}]`, undefined, `${displayPath}[${i}]`));
+        const out = [];
+        value.forEach((v, i) => {
+            out.push(lockChild(ctx, out, String(i), () => redactValue(v, ctx, vault, sessionId, hits, itemIndex, `${currentPath}[${i}]`, undefined, `${displayPath}[${i}]`)));
+        });
+        return out;
     }
     if (value !== null && typeof value === 'object') {
         return redactObject(value, ctx, vault, sessionId, hits, itemIndex, currentPath, displayPath);
@@ -533,18 +537,12 @@ function redactValue(value, ctx, vault, sessionId, hits, itemIndex, currentPath
     return value;
 }
 const escapeRe = (text) => text.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
-const USER_REGEX_WINDOW = 2048;
-function windows(seg, size) {
-    const out = [];
-    let at = 0;
-    while (seg.text.length - at > size) {
-        const cut = seg.text.lastIndexOf(' ', at + size);
-        const end = cut > at + size / 2 ? cut + 1 : at + size;
-        out.push({ text: seg.text.slice(at, end), locked: false, src: seg.src + at });
-        at = end;
-    }
-    out.push({ text: seg.text.slice(at), locked: false, src: seg.src + at });
-    return out;
+const USER_REGEX_MAX_INPUT = 20000;
+function assertUserRegexInput(text, what) {
+    if (text.length <= USER_REGEX_MAX_INPUT)
+        return;
+    throw new Error(`${what} cannot scan a value of ${text.length} characters, the limit is ${USER_REGEX_MAX_INPUT}. ` +
+        'Exclude the field with field rules, or remove the regex.');
 }
 function replaceInFree(seg, re, fn, into) {
     var _a;
@@ -564,7 +562,7 @@ function replaceInFree(seg, re, fn, into) {
     if (last < seg.text.length)
         into.push({ text: seg.text.slice(last), locked: false, src: seg.src + last });
 }
-function replaceFree(pass, re, fn, window) {
+function replaceFree(pass, re, fn) {
     const flags = re.flags.includes('g') ? re.flags : `${re.flags}g`;
     const global = new RegExp(re.source, flags);
     const next = [];
@@ -572,8 +570,7 @@ function replaceFree(pass, re, fn, window) {
         if (seg.locked)
             next.push(seg);
         else
-            for (const piece of window ? windows(seg, window) : [seg])
-                replaceInFree(piece, global, fn, next);
+            replaceInFree(seg, global, fn, next);
     }
     pass.segs = next;
 }
@@ -590,16 +587,17 @@ function denyListRegex(entry) {
 function denyListStage(pass) {
     var _a;
     for (const entry of (_a = pass.ctx.denyList) !== null && _a !== void 0 ? _a : []) {
+        if (entry.type === 'regex')
+            assertUserRegexInput(pass.source, `Deny list regex "${entry.value}"`);
         try {
             const re = denyListRegex(entry);
             if (!re)
                 continue;
-            const window = entry.type === 'regex' ? USER_REGEX_WINDOW : undefined;
             replaceFree(pass, re, (match) => TOKEN_RE.test(match)
                 ? null
                 : redactMatch(pass, match, { label: 'DENY_LIST', category: 'other' }, {
                     patternName: 'denyList', patternLabel: 'DENY_LIST', category: 'other', confidence: context_1.DENY_LIST_CONFIDENCE,
-                }), window);
+                }));
         }
         catch { }
     }
@@ -624,27 +622,25 @@ function builtInStage(pass) {
     }
 }
 function freeNames(pass) {
-    const names = new Map();
+    const names = new Set();
     for (const seg of pass.segs) {
-        if (seg.locked)
-            continue;
-        for (const nm of (0, names_1.detectNamesInText)(seg.text))
-            if (!names.has(nm.name))
-                names.set(nm.name, seg.src + nm.start);
+        if (!seg.locked)
+            for (const nm of (0, names_1.detectNamesInText)(seg.text))
+                names.add(nm.name);
     }
     return names;
 }
 function nameStage(pass) {
     if (pass.ctx.skipSemantic)
         return;
-    for (const [name, start] of freeNames(pass)) {
+    for (const name of freeNames(pass)) {
         if ((name.includes('[') && name.includes(']')) || isAllowListed(name, pass.ctx.allowList))
             continue;
-        const confidence = (0, context_1.hasContextWords)(pass.source, start, start + name.length, names_1.NAME_CONTEXT_WORDS) ? 0.8 : 0.65;
-        if (confidence < pass.threshold)
-            continue;
         let replacement;
-        replaceFree(pass, new RegExp(escapeRe(name), 'g'), (match) => {
+        replaceFree(pass, new RegExp(escapeRe(name), 'g'), (match, start) => {
+            const confidence = (0, context_1.hasContextWords)(pass.source, start, start + match.length, names_1.NAME_CONTEXT_WORDS) ? 0.8 : 0.65;
+            if (confidence < pass.threshold)
+                return null;
             replacement !== null && replacement !== void 0 ? replacement : (replacement = redactMatch(pass, match, { label: 'PERSON_NAME', category: 'identity' }, {
                 patternName: 'personNameDict', patternLabel: 'PERSON_NAME', category: 'identity', confidence,
             }));
@@ -659,20 +655,19 @@ function customStage(pass) {
         if (!cp.label || !cp.regex || !isSafeRegex(cp.regex))
             continue;
         const pattern = { label: cp.label.toUpperCase(), category: cp.category || 'identity' };
+        assertUserRegexInput(pass.source, `Custom pattern "${cp.label}"`);
         try {
             replaceFree(pass, new RegExp(cp.regex, 'g'), (match) => TOKEN_RE.test(match) || isAllowListed(match, pass.ctx.allowList)
                 ? null
                 : redactMatch(pass, match, pattern, {
                     patternName: `custom_${cp.label}`, patternLabel: pattern.label, category: pattern.category,
                     confidence: context_1.CUSTOM_PATTERN_CONFIDENCE,
-                }), USER_REGEX_WINDOW);
+                }));
         }
         catch { }
     }
 }
-function recordLocked(ctx, itemIndex, fieldPath, segs) {
-    if (!ctx.lockedSpans || fieldPath === '')
-        return;
+function recordLocked(ctx, segs) {
     const spans = [];
     let at = 0;
     for (const seg of segs) {
@@ -680,10 +675,20 @@ function recordLocked(ctx, itemIndex, fieldPath, segs) {
             spans.push([at, at + seg.text.length]);
         at += seg.text.length;
     }
-    if (spans.length > 0)
-        ctx.lockedSpans.set(lockKey(itemIndex, fieldPath), spans);
+    ctx.lastLocked = spans.length > 0 ? spans : undefined;
+}
+function lockChild(ctx, container, key, compute) {
+    var _a;
+    ctx.lastLocked = undefined;
+    const out = compute();
+    if (ctx.lastLocked && ctx.lockedSpans && typeof out === 'string') {
+        const byKey = (_a = ctx.lockedSpans.get(container)) !== null && _a !== void 0 ? _a : new Map();
+        byKey.set(key, ctx.lastLocked);
+        ctx.lockedSpans.set(container, byKey);
+    }
+    ctx.lastLocked = undefined;
+    return out;
 }
-const lockKey = (itemIndex, fieldPath) => `${itemIndex}\u0000${fieldPath}`;
 function redactText(text, ctx, vault, sessionId, hits, itemIndex, fieldPath) {
     var _a;
     const pass = {
@@ -694,7 +699,7 @@ function redactText(text, ctx, vault, sessionId, hits, itemIndex, fieldPath) {
     builtInStage(pass);
     nameStage(pass);
     customStage(pass);
-    recordLocked(ctx, itemIndex, fieldPath, pass.segs);
+    recordLocked(ctx, pass.segs);
     return pass.segs.map((s) => s.text).join('');
 }
 function makeRestorer(entries) {
@@ -745,18 +750,17 @@ function resolveOverlaps(spans) {
     }
     return kept.sort((a, b) => b.start - a.start);
 }
-function presidioSpans(value, entities, ctx, key) {
-    var _a, _b, _c;
+function presidioSpans(value, entities, ctx, locked) {
+    var _a;
     const threshold = (_a = ctx.confidenceThreshold) !== null && _a !== void 0 ? _a : 0;
-    const locked = (_c = (_b = ctx.lockedSpans) === null || _b === void 0 ? void 0 : _b.get(key)) !== null && _c !== void 0 ? _c : [];
     const free = (s) => !locked.some(([start, end]) => s.start < end && start < s.end);
     return resolveOverlaps(toUtf16Spans(value, entities).filter((s) => s.score >= threshold && free(s)));
 }
-async function presidioRedactString(value, ctx, vault, sessionId, hits, itemIndex, path) {
+async function presidioRedactString(value, ctx, vault, sessionId, hits, itemIndex, path, locked) {
     if (value.trim().length === 0 || TOKEN_RE.test(value))
         return value;
     const entities = await (0, presidio_1.analyzeWithPresidio)(ctx.presidioUrl, value, ctx.presidioLanguage || 'en', 0.4, 10000, ctx.presidioRequest);
-    const spans = presidioSpans(value, entities, ctx, lockKey(itemIndex, path));
+    const spans = presidioSpans(value, entities, ctx, locked);
     let text = value;
     for (const span of spans) {
         const matchedText = value.slice(span.start, span.end);
@@ -776,13 +780,13 @@ async function presidioRedactString(value, ctx, vault, sessionId, hits, itemInde
     }
     return text;
 }
-async function presidioWalk(value, ctx, vault, sessionId, hits, itemIndex, path, policyPath) {
-    var _a, _b;
+async function presidioWalk(value, ctx, vault, sessionId, hits, itemIndex, path, policyPath, locked = []) {
+    var _a, _b, _c, _d, _e, _f;
     if (typeof value === 'string') {
         if (!shouldProcessField(policyPath, ctx.fieldMode, ctx.fieldRules))
             return value;
         try {
-            return await presidioRedactString(value, ctx, vault, sessionId, hits, itemIndex, path);
+            return await presidioRedactString(value, ctx, vault, sessionId, hits, itemIndex, path, locked);
         }
         catch {
             return value;
@@ -791,18 +795,20 @@ async function presidioWalk(value, ctx, vault, sessionId, hits, itemIndex, path,
     if (Array.isArray(value)) {
         const out = [];
         for (let i = 0; i < value.length; i++) {
-            out.push(await presidioWalk(value[i], ctx, vault, sessionId, hits, itemIndex, `${path}[${i}]`, `${policyPath}[${i}]`));
+            const lock = (_b = (_a = ctx.lockedSpans) === null || _a === void 0 ? void 0 : _a.get(value)) === null || _b === void 0 ? void 0 : _b.get(String(i));
+            out.push(await presidioWalk(value[i], ctx, vault, sessionId, hits, itemIndex, `${path}[${i}]`, `${policyPath}[${i}]`, lock));
         }
         return out;
     }
     if (value !== null && typeof value === 'object') {
-        const origins = (_a = ctx.keyOrigins) === null || _a === void 0 ? void 0 : _a.get(value);
+        const origins = (_c = ctx.keyOrigins) === null || _c === void 0 ? void 0 : _c.get(value);
         const out = {};
         for (const [k, v] of Object.entries(value)) {
-            const original = (_b = origins === null || origins === void 0 ? void 0 : origins.get(k)) !== null && _b !== void 0 ? _b : k;
+            const original = (_d = origins === null || origins === void 0 ? void 0 : origins.get(k)) !== null && _d !== void 0 ? _d : k;
             const child = path ? `${path}.${k}` : k;
             const childPolicy = policyPath ? `${policyPath}.${original}` : original;
-            out[k] = await presidioWalk(v, ctx, vault, sessionId, hits, itemIndex, child, childPolicy);
+            const lock = (_f = (_e = ctx.lockedSpans) === null || _e === void 0 ? void 0 : _e.get(value)) === null || _f === void 0 ? void 0 : _f.get(k);
+            out[k] = await presidioWalk(v, ctx, vault, sessionId, hits, itemIndex, child, childPolicy, lock);
         }
         return out;
     }

package/dist/nodes/Redactor/regexCharset.js

@@ -3,19 +3,16 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.emptySet = void 0;
 exports.union = union;
 exports.overlaps = overlaps;
+exports.readEscape = readEscape;
 exports.atomCharset = atomCharset;
 const emptySet = () => ({ ascii: new Array(128).fill(false), other: false });
 exports.emptySet = emptySet;
 const fullSet = () => ({ ascii: new Array(128).fill(true), other: true });
 function addCode(set, code) {
-    if (code >= 128) {
+    if (code >= 128)
         set.other = true;
-        return;
-    }
-    set.ascii[code] = true;
-    const ch = String.fromCharCode(code);
-    for (const folded of [ch.toLowerCase(), ch.toUpperCase()])
-        set.ascii[folded.charCodeAt(0)] = true;
+    else
+        set.ascii[code] = true;
 }
 function addRange(set, from, to) {
     for (let c = from; c <= Math.min(to, 127); c++)
@@ -32,11 +29,18 @@ function overlaps(a, b) {
 function complement(set) {
     return { ascii: set.ascii.map((v) => !v), other: true };
 }
+function fold(set) {
+    const ascii = [...set.ascii];
+    for (let c = 65; c <= 90; c++)
+        ascii[c] = ascii[c + 32] = set.ascii[c] || set.ascii[c + 32];
+    return { ascii, other: set.other };
+}
 const CLASS_ESCAPES = {
     d: (s) => addRange(s, 48, 57),
     w: (s) => {
         addRange(s, 48, 57);
         addRange(s, 65, 90);
+        addRange(s, 97, 122);
         addCode(s, 95);
     },
     s: (s) => {
@@ -45,26 +49,42 @@ const CLASS_ESCAPES = {
         s.other = true;
     },
 };
-function escapeSet(letter) {
-    const lower = letter.toLowerCase();
-    const fill = CLASS_ESCAPES[lower];
-    if (fill) {
-        const set = (0, exports.emptySet)();
-        fill(set);
-        return letter === lower ? set : complement(set);
+const HEX = /^[0-9a-fA-F]+$/;
+function readEscape(src, i) {
+    var _a, _b;
+    const e = (_a = src[i + 1]) !== null && _a !== void 0 ? _a : '';
+    const hex = (n) => (HEX.test(src.slice(i + 2, i + 2 + n)) && src.length >= i + 2 + n ? n : 0);
+    if (e === 'x' && hex(2))
+        return { length: 4, code: parseInt(src.slice(i + 2, i + 4), 16) };
+    if (e === 'u' && hex(4))
+        return { length: 6, code: parseInt(src.slice(i + 2, i + 6), 16) };
+    if (e === 'c' && /[A-Za-z]/.test((_b = src[i + 2]) !== null && _b !== void 0 ? _b : ''))
+        return { length: 3, code: src.charCodeAt(i + 2) % 32 };
+    if (e === '0')
+        return { length: 2, code: 0 };
+    if (/[a-zA-Z0-9]/.test(e))
+        return { length: 2, code: null };
+    return { length: 2, code: e.charCodeAt(0) };
+}
+function escapeSet(src, i) {
+    var _a;
+    const { code } = readEscape(src, i);
+    const set = (0, exports.emptySet)();
+    if (code !== null) {
+        addCode(set, code);
+        return set;
     }
-    if (/[a-zA-Z0-9]/.test(letter))
+    const letter = (_a = src[i + 1]) !== null && _a !== void 0 ? _a : '';
+    const fill = CLASS_ESCAPES[letter.toLowerCase()];
+    if (!fill)
         return fullSet();
-    const set = (0, exports.emptySet)();
-    addCode(set, letter.charCodeAt(0));
-    return set;
+    fill(set);
+    return letter === letter.toLowerCase() ? set : complement(set);
 }
 function classMember(body, j) {
-    var _a, _b;
     if (body[j] === '\\') {
-        const set = escapeSet((_a = body[j + 1]) !== null && _a !== void 0 ? _a : '\\');
-        const single = /[a-zA-Z0-9]/.test((_b = body[j + 1]) !== null && _b !== void 0 ? _b : '') ? null : body.charCodeAt(j + 1);
-        return { set, next: j + 2, code: single };
+        const { length, code } = readEscape(body, j);
+        return { set: escapeSet(body, j), next: j + length, code };
     }
     const set = (0, exports.emptySet)();
     addCode(set, body.charCodeAt(j));
@@ -90,13 +110,13 @@ function classSet(body) {
     }
     return negated ? complement(set) : set;
 }
-function atomCharset(src, start, end) {
-    var _a, _b;
+function rawCharset(src, start, end) {
+    var _a;
     const c = src[start];
     if (c === '^' || c === '$')
         return null;
     if (c === '\\')
-        return /[bB]/.test((_a = src[start + 1]) !== null && _a !== void 0 ? _a : '') ? null : escapeSet((_b = src[start + 1]) !== null && _b !== void 0 ? _b : '\\');
+        return /[bB]/.test((_a = src[start + 1]) !== null && _a !== void 0 ? _a : '') ? null : escapeSet(src, start);
     if (c === '[')
         return classSet(src.slice(start + 1, end - 1));
     if (c === '.')
@@ -105,3 +125,7 @@ function atomCharset(src, start, end) {
     addCode(set, src.charCodeAt(start));
     return set;
 }
+function atomCharset(src, start, end) {
+    const set = rawCharset(src, start, end);
+    return set && fold(set);
+}

package/dist/nodes/Redactor/regexSafety.js

@@ -5,7 +5,13 @@ const regexCharset_1 = require("./regexCharset");
 const MAX_REGEX_LENGTH = 500;
 const newFrame = (zeroWidth = false) => ({
     hasVariableQuantifier: false, hasAlternation: false, run: null, chars: (0, regexCharset_1.emptySet)(), zeroWidth,
+    branchConsumes: false, allConsume: true, nullable: false,
 });
+function endBranch(frame) {
+    frame.allConsume && (frame.allConsume = frame.branchConsumes);
+    frame.branchConsumes = false;
+    frame.nullable = !frame.allConsume;
+}
 function readBraces(src, i) {
     const m = /^\{(\d+)(,(\d*))?\}/.exec(src.slice(i));
     if (!m)
@@ -48,13 +54,27 @@ function groupPrefixLength(src, i) {
     const look = /^\(\?(?::|=|!|<=|<!)/.exec(src.slice(i));
     return look ? look[0].length : 1;
 }
+function alternation(stack, i) {
+    const top = stack[stack.length - 1];
+    top.hasAlternation = true;
+    top.run = null;
+    endBranch(top);
+    return { atomEnd: i, closed: null, next: i + 1 };
+}
+function closeGroup(c, stack) {
+    if (c !== ')' || stack.length <= 1)
+        return null;
+    const closed = stack.pop();
+    endBranch(closed);
+    return closed;
+}
 function readToken(src, i, stack) {
     var _a;
     const c = src[i];
     if (c === '\\') {
         if (/[1-9k]/.test((_a = src[i + 1]) !== null && _a !== void 0 ? _a : ''))
             return { atomEnd: i, closed: null, error: 'back-references are not supported' };
-        return { atomEnd: i + 2, closed: null };
+        return { atomEnd: i + (0, regexCharset_1.readEscape)(src, i).length, closed: null };
     }
     if (c === '[')
         return { atomEnd: skipClass(src, i), closed: null };
@@ -62,13 +82,9 @@ function readToken(src, i, stack) {
         stack.push(newFrame(/^\(\?(?:=|!|<=|<!)/.test(src.slice(i))));
         return { atomEnd: i, closed: null, next: i + groupPrefixLength(src, i) };
     }
-    if (c === '|') {
-        stack[stack.length - 1].hasAlternation = true;
-        stack[stack.length - 1].run = null;
-        return { atomEnd: i, closed: null, next: i + 1 };
-    }
-    const closed = c === ')' && stack.length > 1 ? stack.pop() : null;
-    return { atomEnd: i + 1, closed };
+    if (c === '|')
+        return alternation(stack, i);
+    return { atomEnd: i + 1, closed: closeGroup(c, stack) };
 }
 const NESTED = 'a repeated group contains a quantifier or alternation (catastrophic backtracking)';
 function isRisky(frame) {
@@ -106,13 +122,21 @@ function stepChars(src, i, step) {
         return (0, regexCharset_1.atomCharset)(src, i, step.atomEnd);
     return closed.zeroWidth ? null : closed.chars;
 }
+function consumes(q, chars, closed) {
+    if (chars === null || (q !== null && q.min < 1))
+        return false;
+    return !(closed === null || closed === void 0 ? void 0 : closed.nullable);
+}
 function stepProblem(src, i, step, q, top) {
-    var _a, _b;
+    var _a;
     const problem = applyQuantifier(q, step.closed, top);
     if (problem || (q === null || q === void 0 ? void 0 : q.max) === 0)
         return problem;
-    const variable = isVariable(q) || ((_a = step.closed) === null || _a === void 0 ? void 0 : _a.hasVariableQuantifier) === true;
-    return applySequence(stepChars(src, i, step), variable, ((_b = q === null || q === void 0 ? void 0 : q.min) !== null && _b !== void 0 ? _b : 1) >= 1, top);
+    const chars = stepChars(src, i, step);
+    const required = consumes(q, chars, step.closed);
+    if (required)
+        top.branchConsumes = true;
+    return applySequence(chars, isVariable(q) || !!((_a = step.closed) === null || _a === void 0 ? void 0 : _a.hasVariableQuantifier), required, top);
 }
 function structuralProblem(src) {
     const stack = [newFrame()];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "n8n-nodes-redactor",
-  "version": "4.3.0",
+  "version": "5.0.0",
   "description": "Redact, mask and anonymize PII before it reaches an LLM, then restore it. 216 patterns for emails, phones, addresses, IBAN, cards, names, SSN, passport and tax IDs. Reversible encrypted vault, GDPR Art.30 ROPA record, prompt-injection check. Runs on n8n Cloud and self-hosted n8n 2.x.",
   "keywords": [
     "n8n-community-node-package",