n8n-nodes-redactor 5.1.0 → 6.0.0

package/dist/nodes/Redactor/Redactor.node.js

@@ -43,6 +43,16 @@ const RECOMMENDED_PATTERNS = [
     'vin',
     'uuid', 'imei', 'iccid',
 ];
+function versionRopaSummary(ropa, byLevel, typeVersion) {
+    const summary = ropa.processingSummary;
+    if (typeVersion >= 2) {
+        summary.hitsBySensitivity = { ...byLevel };
+    }
+    else {
+        summary.hitsByPiiCategory = summary.hitsByCategory;
+        summary.hitsByCategory = { ...byLevel };
+    }
+}
 class Redactor {
     constructor() {
         this.description = {
@@ -50,7 +60,8 @@ class Redactor {
             name: 'redactor',
             icon: { light: 'file:redactor.svg', dark: 'file:redactor.dark.svg' },
             group: ['transform'],
-            version: 1,
+            version: [1, 2],
+            defaultVersion: 2,
             subtitle: '={{$parameter["operation"]}}',
             usableAsTool: true,
             description: 'Redact and remove sensitive data, PII, personal information, emails, phone numbers, addresses, IBAN, credit cards, names before sending to LLM. Anonymize, mask, sanitize, scrub customer data. Restore original values after. Helps GDPR, HIPAA and CCPA workflows. Data privacy, data protection, data masking, data anonymization.',
@@ -767,7 +778,7 @@ class Redactor {
         };
     }
     async execute() {
-        var _a, _b, _c, _d, _e, _f, _g;
+        var _a, _b, _c, _d, _e, _f, _g, _h;
         const items = this.getInputData();
         const allPaired = items.map((_, i) => ({ item: i }));
         const operation = this.getNodeParameter('operation', 0);
@@ -793,7 +804,8 @@ class Redactor {
             for (let i = 0; i < items.length; i++) {
                 const hits = [];
                 (0, engine_1.redactValue)(items[i].json, ctx, tempVault, tempSessionId, hits, i);
-                allHits.push(...hits);
+                for (const hit of hits)
+                    allHits.push(hit);
             }
             tempVault.deleteSession(tempSessionId);
             if (operation === 'detect') {
@@ -867,12 +879,14 @@ class Redactor {
                 dedup: true,
                 fieldRules: [],
                 fieldMode: 'all',
+                scanNumbers: true,
             };
             const allHits = [];
             for (let i = 0; i < items.length; i++) {
                 const hits = [];
                 (0, engine_1.redactValue)(items[i].json, ctx, tempVault, tempSessionId, hits, i);
-                allHits.push(...hits);
+                for (const hit of hits)
+                    allHits.push(hit);
             }
             tempVault.deleteSession(tempSessionId);
             const classification = (0, classification_1.classifyData)(allHits);
@@ -1041,6 +1055,8 @@ class Redactor {
                 keyOrigins: new WeakMap(),
                 inputText: (0, engine_1.collectInputText)(items.map((it) => it.json)),
                 lockedSpans: new WeakMap(),
+                keyLocks: new WeakMap(),
+                priorTokens: (0, engine_1.priorTokenMatcher)((_e = vault.getSession(sessionId)) === null || _e === void 0 ? void 0 : _e.entries),
             };
             const allHits = [];
             const returnData = [];
@@ -1056,7 +1072,8 @@ class Redactor {
                     }
                 }
                 returnData.push({ json: redacted, pairedItem: { item: i } });
-                allHits.push(...hits);
+                for (const hit of hits)
+                    allHits.push(hit);
             }
             vault.save(sessionId);
             let injectionResult = null;
@@ -1091,7 +1108,8 @@ class Redactor {
                 if (includeReport && this.getNodeParameter('includeRopa', 0, false)) {
                     const d = this.getNodeParameter('ropa', 0, {});
                     const list = (v) => String(v !== null && v !== void 0 ? v : '').split(',').map((x) => x.trim()).filter(Boolean);
-                    report.ropa = (0, ropa_1.generateRopaRecord)(allHits, (0, classification_1.classifyData)(allHits), items.length, enabledPatterns.length, mode, sessionTtl, !!vaultPassphrase, auditLog, { name: String((_e = d.controllerName) !== null && _e !== void 0 ? _e : ''), contactEmail: String((_f = d.controllerContact) !== null && _f !== void 0 ? _f : ''), dpo: d.dpo ? String(d.dpo) : undefined }, list(d.purposes), String((_g = d.legalBasis) !== null && _g !== void 0 ? _g : 'legitimate_interest'), list(d.dataSubjects), list(d.recipients), []);
+                    report.ropa = (0, ropa_1.generateRopaRecord)(allHits, (0, classification_1.classifyData)(allHits), items.length, enabledPatterns.length, mode, sessionTtl, !!vaultPassphrase, auditLog, { name: String((_f = d.controllerName) !== null && _f !== void 0 ? _f : ''), contactEmail: String((_g = d.controllerContact) !== null && _g !== void 0 ? _g : ''), dpo: d.dpo ? String(d.dpo) : undefined }, list(d.purposes), String((_h = d.legalBasis) !== null && _h !== void 0 ? _h : 'legitimate_interest'), list(d.dataSubjects), list(d.recipients), []);
+                    versionRopaSummary(report.ropa, (0, classification_1.classifyData)(allHits).hitCountByLevel, this.getNode().typeVersion);
                 }
                 return [returnData, [{ json: report, pairedItem: allPaired }]];
             }

package/dist/nodes/Redactor/classification.js

@@ -22,6 +22,7 @@ const LEVEL_NUMERIC = {
     RESTRICTED: 3,
 };
 function classifyData(hits) {
+    var _a;
     if (hits.length === 0) {
         return {
             level: 'PUBLIC',
@@ -40,12 +41,14 @@ function classifyData(hits) {
         CONFIDENTIAL: 0,
         RESTRICTED: 0,
     };
-    const categoryCounts = {};
+    const categoryCounts = new Map();
     let totalConfidence = 0;
     for (const hit of hits) {
-        const catLevel = CATEGORY_SENSITIVITY[hit.category] || 'INTERNAL';
+        const catLevel = Object.prototype.hasOwnProperty.call(CATEGORY_SENSITIVITY, hit.category)
+            ? CATEGORY_SENSITIVITY[hit.category]
+            : 'INTERNAL';
         hitCountByLevel[catLevel]++;
-        categoryCounts[hit.category] = (categoryCounts[hit.category] || 0) + 1;
+        categoryCounts.set(hit.category, ((_a = categoryCounts.get(hit.category)) !== null && _a !== void 0 ? _a : 0) + 1);
         totalConfidence += hit.confidence || 0.65;
     }
     let level = 'PUBLIC';
@@ -64,10 +67,10 @@ function classifyData(hits) {
         level = 'CONFIDENTIAL';
         escalated = true;
     }
-    const topCategory = Object.entries(categoryCounts)
-        .sort((a, b) => b[1] - a[1])[0][0];
+    const ranked = [...categoryCounts.entries()].sort((a, b) => b[1] - a[1]);
+    const topCategory = ranked[0][0];
     const reasonParts = [];
-    for (const [cat, count] of Object.entries(categoryCounts).sort((a, b) => b[1] - a[1])) {
+    for (const [cat, count] of ranked) {
         reasonParts.push(`${count} ${cat}`);
     }
     let reason = `Contains: ${reasonParts.join(', ')}.`;

package/dist/nodes/Redactor/engine.js

@@ -36,12 +36,14 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.collectTokenLike = collectTokenLike;
 exports.collectInputText = collectInputText;
 exports.redactValue = redactValue;
+exports.priorTokenMatcher = priorTokenMatcher;
 exports.restoreValue = restoreValue;
 exports.enhanceWithPresidio = enhanceWithPresidio;
 exports.buildReport = buildReport;
 const crypto = __importStar(require("crypto"));
 const patterns_1 = require("./patterns");
 const regexSafety_1 = require("./regexSafety");
+const types_1 = require("./types");
 const context_1 = require("./context");
 const names_1 = require("./names");
 const pseudonymize_1 = require("./pseudonymize");
@@ -76,7 +78,6 @@ function generateToken(label, index) {
 function setOwn(obj, key, value) {
     Object.defineProperty(obj, key, { value, enumerable: true, writable: true, configurable: true });
 }
-const TOKEN_RE = /^\[[A-Z][A-Z0-9_]*_\d+\]$/;
 function maskValue(value, label) {
     if (value.length <= 2)
         return '*'.repeat(value.length);
@@ -135,13 +136,15 @@ function applyRedaction(match, pattern, ctx, vault, sessionId) {
     const irreversible = IRREVERSIBLE[ctx.mode];
     return irreversible ? irreversible(match, pattern.label) : match;
 }
+const nextIndex = new WeakMap();
 function freshToken(label, vault, sessionId, reserved) {
-    var _a, _b;
+    var _a, _b, _c;
     const entries = (_b = (_a = vault.getSession(sessionId)) === null || _a === void 0 ? void 0 : _a.entries) !== null && _b !== void 0 ? _b : {};
-    let index = Object.keys(entries).length;
+    let index = (_c = nextIndex.get(entries)) !== null && _c !== void 0 ? _c : Object.keys(entries).length;
     let token = generateToken(label, index);
     while (entries[token] || (reserved === null || reserved === void 0 ? void 0 : reserved.has(token)))
         token = generateToken(label, ++index);
+    nextIndex.set(entries, index + 1);
     return token;
 }
 const TOKEN_LIKE_RE = /\[[A-Z][A-Z0-9_]*_\d+\]/g;
@@ -454,7 +457,7 @@ function numericMapping(out, text, ctx, vault, sessionId) {
     return token;
 }
 function redactNumber(value, ctx, vault, sessionId, hits, itemIndex, path, display, siblingKeys) {
-    const text = String(value);
+    const text = Object.is(value, -0) ? '-0' : String(value);
     const numCtx = { ...ctx, dedup: false, numeric: true };
     let out = null;
     if (!ctx.skipSemantic)
@@ -471,17 +474,12 @@ function redactNumber(value, ctx, vault, sessionId, hits, itemIndex, path, displ
     ctx.lastLocked = [[0, mapped.length]];
     return mapped;
 }
-function redactKey(key, taken, sourceKeys, ctx, vault, sessionId, itemIndex, keyHits) {
+function distinctKey(out, original, clashes, ctx, vault, sessionId, reserved) {
     var _a;
-    const out = redactText(key, ctx, vault, sessionId, keyHits, itemIndex, '');
-    if (out === key)
-        return key;
-    const clashes = (k) => k === '' || Object.prototype.hasOwnProperty.call(taken, k) || sourceKeys.has(k);
-    if (!clashes(out))
-        return out;
     if (ctx.mode === 'token' || ctx.mode === 'pseudonymize') {
-        const token = freshToken('KEY', vault, sessionId, new Set([...((_a = ctx.reservedTokens) !== null && _a !== void 0 ? _a : []), ...sourceKeys, ...Object.keys(taken)]));
-        vault.addEntry(sessionId, { token, original: key, patternLabel: 'KEY', category: 'other', createdAt: new Date().toISOString() });
+        const token = freshToken('KEY', vault, sessionId, new Set([...((_a = ctx.reservedTokens) !== null && _a !== void 0 ? _a : []), ...reserved]));
+        vault.addEntry(sessionId, { token, original, patternLabel: 'KEY', category: 'other', createdAt: new Date().toISOString() });
+        ctx.lastLocked = [[0, token.length]];
         return token;
     }
     let suffixed = out;
@@ -489,6 +487,24 @@ function redactKey(key, taken, sourceKeys, ctx, vault, sessionId, itemIndex, key
         suffixed = `${out}_${n}`;
     return suffixed;
 }
+function redactKey(key, taken, sourceKeys, ctx, vault, sessionId, itemIndex, keyHits) {
+    const out = redactText(key, ctx, vault, sessionId, keyHits, itemIndex, '');
+    if (out === key)
+        return key;
+    const clashes = (k) => k === '' || Object.prototype.hasOwnProperty.call(taken, k) || sourceKeys.has(k);
+    if (!clashes(out))
+        return out;
+    return distinctKey(out, key, clashes, ctx, vault, sessionId, [...sourceKeys, ...Object.keys(taken)]);
+}
+function rememberKeyLock(ctx, container, key) {
+    var _a;
+    if (ctx.lastLocked && ctx.keyLocks) {
+        const byKey = (_a = ctx.keyLocks.get(container)) !== null && _a !== void 0 ? _a : new Map();
+        byKey.set(key, ctx.lastLocked);
+        ctx.keyLocks.set(container, byKey);
+    }
+    ctx.lastLocked = undefined;
+}
 function redactObject(value, ctx, vault, sessionId, hits, itemIndex, path, display) {
     var _a;
     const entries = Object.entries(value);
@@ -499,9 +515,11 @@ function redactObject(value, ctx, vault, sessionId, hits, itemIndex, path, displ
     for (const [k, v] of entries) {
         const fieldPath = path ? `${path}.${k}` : k;
         const keyHits = [];
+        ctx.lastLocked = undefined;
         const outKey = shouldProcessField(fieldPath, ctx.fieldMode, ctx.fieldRules)
             ? redactKey(k, obj, sourceKeys, ctx, vault, sessionId, itemIndex, keyHits)
-            : k;
+            : protectLiterals(k, ctx, vault, sessionId, hits, itemIndex);
+        rememberKeyLock(ctx, obj, outKey);
         origins.set(outKey, k);
         const childDisplay = display ? `${display}.${outKey}` : outKey;
         for (const h of keyHits)
@@ -515,7 +533,7 @@ function redactValue(value, ctx, vault, sessionId, hits, itemIndex, currentPath
     const processed = shouldProcessField(currentPath, ctx.fieldMode, ctx.fieldRules);
     if (typeof value === 'string') {
         if (!processed)
-            return value;
+            return protectLiterals(value, ctx, vault, sessionId, hits, itemIndex);
         if (!ctx.skipSemantic) {
             const semantic = redactSemantic(value, ctx, vault, sessionId, hits, itemIndex, currentPath, displayPath, siblingKeys);
             if (semantic !== null)
@@ -548,44 +566,131 @@ function assertUserRegexInput(text, what) {
     throw new Error(`${what} cannot scan a value of ${text.length} characters, the limit is ${USER_REGEX_MAX_INPUT}. ` +
         'Exclude the field with field rules, or remove the regex.');
 }
-function freeSegmentAt(segs, start, end) {
-    return segs.findIndex((seg) => !seg.locked && seg.src <= start && end <= seg.src + seg.text.length);
+class SegmentCursor {
+    constructor(segs) {
+        this.segs = segs;
+        this.next = [];
+        this.i = 0;
+        this.cur = segs[0];
+    }
+    freeAt(start, end) {
+        while (this.cur && (this.cur.locked || this.cur.end <= start))
+            this.take();
+        const cur = this.cur;
+        return cur && cur.src <= start && end <= cur.end ? cur : undefined;
+    }
+    lock(start, end, replacement) {
+        const cur = this.cur;
+        if (start > cur.src)
+            this.next.push(freeSlice(cur, cur.src, start));
+        this.next.push({ text: replacement, locked: true, src: start, end });
+        if (end < cur.end)
+            this.cur = freeSlice(cur, end, cur.end);
+        else
+            this.cur = this.segs[++this.i];
+    }
+    finish() {
+        while (this.cur)
+            this.take();
+        return this.next;
+    }
+    take() {
+        this.next.push(this.cur);
+        this.cur = this.segs[++this.i];
+    }
+}
+function freeSlice(seg, start, end) {
+    return { text: seg.text.slice(start - seg.src, end - seg.src), locked: false, src: start, end };
+}
+function redactMatch(pass, match, decision) {
+    if (decision.store)
+        return decision.store(match);
+    const replacement = applyRedaction(match, decision.pattern, pass.ctx, pass.vault, pass.sessionId);
+    if (decision.detail) {
+        pass.hits.push({ token: replacement, original: '***', field: pass.fieldPath, itemIndex: pass.itemIndex, ...decision.detail });
+    }
+    return replacement;
 }
-function lockRange(segs, index, start, end, replacement) {
-    const seg = segs[index];
-    const parts = [];
-    if (start > seg.src)
-        parts.push({ text: seg.text.slice(0, start - seg.src), locked: false, src: seg.src });
-    parts.push({ text: replacement, locked: true, src: -1 });
-    const tail = end - seg.src;
-    if (tail < seg.text.length)
-        parts.push({ text: seg.text.slice(tail), locked: false, src: end });
-    segs.splice(index, 1, ...parts);
-}
-function replaceFree(pass, re, fn) {
-    var _a;
-    const flags = re.flags.includes('g') ? re.flags : `${re.flags}g`;
-    for (const m of pass.source.matchAll(new RegExp(re.source, flags))) {
-        const start = (_a = m.index) !== null && _a !== void 0 ? _a : 0;
-        const end = start + m[0].length;
-        const index = m[0] === '' ? -1 : freeSegmentAt(pass.segs, start, end);
-        if (index < 0)
-            continue;
-        const replacement = fn(m[0], start);
-        if (replacement !== null)
-            lockRange(pass.segs, index, start, end, replacement);
+function segmentAfter(segs, pos) {
+    let lo = 0;
+    let hi = segs.length;
+    while (lo < hi) {
+        const mid = (lo + hi) >> 1;
+        if (segs[mid].end <= pos)
+            lo = mid + 1;
+        else
+            hi = mid;
+    }
+    return lo;
+}
+function claimPending(pass, pending) {
+    for (const p of pending) {
+        let i = segmentAfter(pass.segs, p.start);
+        while (i < pass.segs.length && pass.segs[i].src < p.end) {
+            const seg = pass.segs[i];
+            if (seg.locked) {
+                i++;
+                continue;
+            }
+            const start = Math.max(seg.src, p.start);
+            const end = Math.min(seg.end, p.end);
+            const parts = [];
+            if (start > seg.src)
+                parts.push(freeSlice(seg, seg.src, start));
+            parts.push({ text: redactMatch(pass, pass.source.slice(start, end), p.decision), locked: true, src: start, end });
+            if (end < seg.end)
+                parts.push(freeSlice(seg, end, seg.end));
+            pass.segs.splice(i, 1, ...parts);
+            i += parts.length;
+        }
     }
 }
-function redactMatch(pass, match, pattern, detail) {
-    const replacement = applyRedaction(match, pattern, pass.ctx, pass.vault, pass.sessionId);
-    pass.hits.push({ token: replacement, original: '***', field: pass.fieldPath, itemIndex: pass.itemIndex, ...detail });
-    return replacement;
+function claimOne(pass, cursor, pending, start, end, decide) {
+    const text = pass.source.slice(start, end);
+    const free = cursor.freeAt(start, end) !== undefined;
+    const decision = decide(text, start);
+    if (decision && free)
+        cursor.lock(start, end, redactMatch(pass, text, decision));
+    else if (decision)
+        pending.push({ start, end, decision });
+    return free;
+}
+function replaceFree(pass, re, decide) {
+    const global = new RegExp(re.source, re.flags.includes('g') ? re.flags : `${re.flags}g`);
+    const cursor = new SegmentCursor(pass.segs);
+    const pending = [];
+    let m;
+    while ((m = global.exec(pass.source)) !== null) {
+        const start = m.index;
+        if (m[0] === '' || !claimOne(pass, cursor, pending, start, start + m[0].length, decide))
+            global.lastIndex = start + 1;
+    }
+    pass.segs = cursor.finish();
+    claimPending(pass, pending);
+}
+function replaceSpans(pass, spans, decide) {
+    const ordered = [...spans].sort((a, b) => a.start - b.start || b.end - a.end);
+    const cursor = new SegmentCursor(pass.segs);
+    const pending = [];
+    let reach = -1;
+    for (const span of ordered) {
+        if (span.end <= reach)
+            continue;
+        claimOne(pass, cursor, pending, span.start, span.end, decide);
+        reach = span.end;
+    }
+    pass.segs = cursor.finish();
+    claimPending(pass, pending);
 }
 function denyListRegex(entry) {
     if (entry.type === 'regex')
         return isSafeRegex(entry.value) ? new RegExp(entry.value, 'gi') : null;
     return new RegExp(escapeRe(entry.value), 'gi');
 }
+const DENY_DECISION = {
+    pattern: { label: 'DENY_LIST', category: 'other' },
+    detail: { patternName: 'denyList', patternLabel: 'DENY_LIST', category: 'other', confidence: context_1.DENY_LIST_CONFIDENCE },
+};
 function denyListStage(pass) {
     var _a;
     for (const entry of (_a = pass.ctx.denyList) !== null && _a !== void 0 ? _a : []) {
@@ -593,57 +698,57 @@ function denyListStage(pass) {
             assertUserRegexInput(pass.source, `Deny list regex "${entry.value}"`);
         try {
             const re = denyListRegex(entry);
-            if (!re)
-                continue;
-            replaceFree(pass, re, (match) => TOKEN_RE.test(match)
-                ? null
-                : redactMatch(pass, match, { label: 'DENY_LIST', category: 'other' }, {
-                    patternName: 'denyList', patternLabel: 'DENY_LIST', category: 'other', confidence: context_1.DENY_LIST_CONFIDENCE,
-                }));
+            if (re)
+                replaceFree(pass, re, () => DENY_DECISION);
         }
         catch { }
     }
 }
-function builtInMatch(pass, pattern, match, offset) {
-    if (TOKEN_RE.test(match) || (match.startsWith('[') && match.endsWith(']')))
-        return null;
+function builtInDecision(pass, pattern, match, offset) {
     const validatorPassed = pattern.validate ? pattern.validate(match) : true;
     if (!validatorPassed || isAllowListed(match, pass.ctx.allowList))
         return null;
     const confidence = (0, context_1.calculateConfidence)(pattern.name, !!pattern.validate, validatorPassed, pass.source, offset, offset + match.length);
     if (confidence < pass.threshold)
         return null;
-    return redactMatch(pass, match, pattern, {
-        patternName: pattern.name, patternLabel: pattern.label, category: pattern.category, confidence,
-    });
+    return { pattern, detail: { patternName: pattern.name, patternLabel: pattern.label, category: pattern.category, confidence } };
 }
 function builtInStage(pass) {
     const enabled = (0, patterns_1.getPatternsByNames)(pass.ctx.enabledPatterns);
     for (const pattern of [...enabled.filter((p) => p.validate), ...enabled.filter((p) => !p.validate)]) {
-        replaceFree(pass, pattern.regex, (match, offset) => builtInMatch(pass, pattern, match, offset));
+        if (pattern.anchor && !pass.source.includes(pattern.anchor))
+            continue;
+        const decide = (match, offset) => builtInDecision(pass, pattern, match, offset);
+        if (pattern.scan)
+            replaceSpans(pass, pattern.scan(pass.source), decide);
+        else
+            replaceFree(pass, pattern.regex, decide);
     }
 }
-function sourceNames(pass) {
-    const names = new Set((0, names_1.detectNamesInText)(pass.source).map((nm) => nm.name));
-    return [...names].sort((x, y) => y.length - x.length);
+function nameSpans(pass) {
+    const spans = (0, names_1.detectNamesInText)(pass.source).map((nm) => ({ start: nm.start, end: nm.end }));
+    for (const seg of pass.segs) {
+        if (seg.locked)
+            continue;
+        for (const nm of (0, names_1.detectNamesInText)(seg.text))
+            spans.push({ start: seg.src + nm.start, end: seg.src + nm.end });
+    }
+    return spans;
 }
 function nameStage(pass) {
     if (pass.ctx.skipSemantic)
         return;
-    for (const name of sourceNames(pass)) {
-        if ((name.includes('[') && name.includes(']')) || isAllowListed(name, pass.ctx.allowList))
-            continue;
-        let replacement;
-        replaceFree(pass, new RegExp(escapeRe(name), 'g'), (match, start) => {
-            const confidence = (0, context_1.hasContextWords)(pass.source, start, start + match.length, names_1.NAME_CONTEXT_WORDS) ? 0.8 : 0.65;
-            if (confidence < pass.threshold)
-                return null;
-            replacement !== null && replacement !== void 0 ? replacement : (replacement = redactMatch(pass, match, { label: 'PERSON_NAME', category: 'identity' }, {
-                patternName: 'personNameDict', patternLabel: 'PERSON_NAME', category: 'identity', confidence,
-            }));
-            return replacement;
-        });
-    }
+    replaceSpans(pass, nameSpans(pass), (match, start) => {
+        if (isAllowListed(match, pass.ctx.allowList))
+            return null;
+        const confidence = (0, context_1.hasContextWords)(pass.source, start, start + match.length, names_1.NAME_CONTEXT_WORDS) ? 0.8 : 0.65;
+        if (confidence < pass.threshold)
+            return null;
+        return {
+            pattern: { label: 'PERSON_NAME', category: 'identity' },
+            detail: { patternName: 'personNameDict', patternLabel: 'PERSON_NAME', category: 'identity', confidence },
+        };
+    });
 }
 function customStage(pass) {
     if (context_1.CUSTOM_PATTERN_CONFIDENCE < pass.threshold)
@@ -651,15 +756,15 @@ function customStage(pass) {
     for (const cp of pass.ctx.customPatterns) {
         if (!cp.label || !cp.regex || !isSafeRegex(cp.regex))
             continue;
-        const pattern = { label: cp.label.toUpperCase(), category: cp.category || 'identity' };
+        const category = (0, types_1.isPiiCategory)(cp.category) ? cp.category : cp.category ? 'other' : 'identity';
+        const pattern = { label: cp.label.toUpperCase(), category };
+        const decision = {
+            pattern,
+            detail: { patternName: `custom_${cp.label}`, patternLabel: pattern.label, category: pattern.category, confidence: context_1.CUSTOM_PATTERN_CONFIDENCE },
+        };
         assertUserRegexInput(pass.source, `Custom pattern "${cp.label}"`);
         try {
-            replaceFree(pass, new RegExp(cp.regex, 'g'), (match) => TOKEN_RE.test(match) || isAllowListed(match, pass.ctx.allowList)
-                ? null
-                : redactMatch(pass, match, pattern, {
-                    patternName: `custom_${cp.label}`, patternLabel: pattern.label, category: pattern.category,
-                    confidence: context_1.CUSTOM_PATTERN_CONFIDENCE,
-                }));
+            replaceFree(pass, new RegExp(cp.regex, 'g'), (match) => (isAllowListed(match, pass.ctx.allowList) ? null : decision));
         }
         catch { }
     }
@@ -686,12 +791,42 @@ function lockChild(ctx, container, key, compute) {
     ctx.lastLocked = undefined;
     return out;
 }
+function priorTokenMatcher(entries) {
+    const tokens = Object.keys(entries !== null && entries !== void 0 ? entries : {}).filter((t) => t.length > 0).sort((a, b) => b.length - a.length);
+    return tokens.length > 0 ? new RegExp(tokens.map(escapeRe).join('|'), 'g') : undefined;
+}
+function literalStage(pass) {
+    const { ctx, vault, sessionId } = pass;
+    if (!ctx.priorTokens || (ctx.mode !== 'token' && ctx.mode !== 'pseudonymize'))
+        return;
+    const decision = {
+        pattern: { label: 'LITERAL', category: 'other' },
+        store: (match) => {
+            const token = freshToken('LITERAL', vault, sessionId, ctx.reservedTokens);
+            vault.addEntry(sessionId, { token, original: match, patternLabel: 'LITERAL', category: 'other', createdAt: new Date().toISOString() });
+            return token;
+        },
+    };
+    replaceFree(pass, ctx.priorTokens, () => decision);
+}
+function protectLiterals(text, ctx, vault, sessionId, hits, itemIndex) {
+    if (!ctx.priorTokens)
+        return text;
+    const pass = {
+        source: text, segs: [{ text, locked: false, src: 0, end: text.length }], threshold: 0,
+        ctx, vault, sessionId, hits, itemIndex, fieldPath: '',
+    };
+    literalStage(pass);
+    recordLocked(ctx, pass.segs);
+    return pass.segs.map((seg) => seg.text).join('');
+}
 function redactText(text, ctx, vault, sessionId, hits, itemIndex, fieldPath) {
     var _a;
     const pass = {
-        source: text, segs: [{ text, locked: false, src: 0 }], threshold: (_a = ctx.confidenceThreshold) !== null && _a !== void 0 ? _a : 0,
+        source: text, segs: [{ text, locked: false, src: 0, end: text.length }], threshold: (_a = ctx.confidenceThreshold) !== null && _a !== void 0 ? _a : 0,
         ctx, vault, sessionId, hits, itemIndex, fieldPath,
     };
+    literalStage(pass);
     denyListStage(pass);
     builtInStage(pass);
     nameStage(pass);
@@ -754,15 +889,13 @@ function presidioSpans(value, entities, ctx, locked) {
     return resolveOverlaps(toUtf16Spans(value, entities).filter((s) => s.score >= threshold && free(s)));
 }
 async function presidioRedactString(value, ctx, vault, sessionId, hits, itemIndex, path, locked) {
-    if (value.trim().length === 0 || TOKEN_RE.test(value))
+    if (value.trim().length === 0)
         return value;
     const entities = await (0, presidio_1.analyzeWithPresidio)(ctx.presidioUrl, value, ctx.presidioLanguage || 'en', 0.4, 10000, ctx.presidioRequest);
     const spans = presidioSpans(value, entities, ctx, locked);
     let text = value;
     for (const span of spans) {
         const matchedText = value.slice(span.start, span.end);
-        if (TOKEN_RE.test(matchedText) || (matchedText.startsWith('[') && matchedText.endsWith(']')))
-            continue;
         if (isAllowListed(matchedText, ctx.allowList))
             continue;
         const label = (0, presidio_1.getRedactorLabel)(span.entityType);
@@ -777,6 +910,24 @@ async function presidioRedactString(value, ctx, vault, sessionId, hits, itemInde
     }
     return text;
 }
+const IDENTIFIER_KEY = /^[\p{L}_$][\p{L}\p{N}_$-]*$/u;
+async function presidioKey(key, original, taken, ctx, vault, sessionId, hits, itemIndex, path, policyPath) {
+    var _a, _b, _c;
+    if (IDENTIFIER_KEY.test(key) || !shouldProcessField(policyPath, ctx.fieldMode, ctx.fieldRules))
+        return key;
+    const locked = (_c = (_b = (_a = ctx.keyLocks) === null || _a === void 0 ? void 0 : _a.get(taken)) === null || _b === void 0 ? void 0 : _b.get(key)) !== null && _c !== void 0 ? _c : [];
+    let out = key;
+    try {
+        out = await presidioRedactString(key, ctx, vault, sessionId, hits, itemIndex, path, locked);
+    }
+    catch {
+        return key;
+    }
+    const clashes = (k) => k === '' || Object.prototype.hasOwnProperty.call(taken, k);
+    if (out === key || !clashes(out))
+        return out;
+    return distinctKey(out, original, clashes, ctx, vault, sessionId, Object.keys(taken));
+}
 async function presidioWalk(value, ctx, vault, sessionId, hits, itemIndex, path, policyPath, locked = []) {
     var _a, _b, _c, _d, _e, _f;
     if (typeof value === 'string') {
@@ -805,7 +956,8 @@ async function presidioWalk(value, ctx, vault, sessionId, hits, itemIndex, path,
             const child = path ? `${path}.${k}` : k;
             const childPolicy = policyPath ? `${policyPath}.${original}` : original;
             const lock = (_f = (_e = ctx.lockedSpans) === null || _e === void 0 ? void 0 : _e.get(value)) === null || _f === void 0 ? void 0 : _f.get(k);
-            setOwn(out, k, await presidioWalk(v, ctx, vault, sessionId, hits, itemIndex, child, childPolicy, lock));
+            const key = await presidioKey(k, original, out, ctx, vault, sessionId, hits, itemIndex, child, childPolicy);
+            setOwn(out, key, await presidioWalk(v, ctx, vault, sessionId, hits, itemIndex, child, childPolicy, lock));
         }
         return out;
     }

package/dist/nodes/Redactor/injection.js

@@ -307,72 +307,49 @@ function detectPromptInjection(text) {
         message,
     };
 }
-function scanForInjection(data, currentPath = '') {
-    let worstResult = {
-        detected: false,
-        score: 0,
-        action: 'CLEAN',
-        matchedPatterns: [],
-        encodedPayloadsFound: false,
-        zeroWidthCharsFound: false,
-        message: 'No prompt injection detected.',
-    };
-    for (const [key, value] of Object.entries(data)) {
-        const fieldPath = currentPath ? `${currentPath}.${key}` : key;
-        if (typeof value === 'string' && value.trim().length > 0) {
-            const result = detectPromptInjection(value);
-            if (result.score > worstResult.score) {
-                worstResult = {
-                    ...result,
-                    matchedPatterns: result.matchedPatterns.map((m) => ({
-                        ...m,
-                        pattern: `[${fieldPath}] ${m.pattern}`,
-                    })),
-                };
-            }
-            else if (result.detected) {
-                worstResult.matchedPatterns.push(...result.matchedPatterns.map((m) => ({
-                    ...m,
-                    pattern: `[${fieldPath}] ${m.pattern}`,
-                })));
-                worstResult.score = Math.min(1.0, worstResult.score + result.score * 0.3);
-                worstResult.detected = true;
-                if (result.encodedPayloadsFound)
-                    worstResult.encodedPayloadsFound = true;
-                if (result.zeroWidthCharsFound)
-                    worstResult.zeroWidthCharsFound = true;
-            }
-        }
-        if (value !== null && typeof value === 'object' && !Array.isArray(value)) {
-            const nested = scanForInjection(value, fieldPath);
-            if (nested.score > worstResult.score) {
-                worstResult = nested;
-            }
-            else if (nested.detected) {
-                worstResult.matchedPatterns.push(...nested.matchedPatterns);
-                worstResult.score = Math.min(1.0, worstResult.score + nested.score * 0.3);
-                worstResult.detected = true;
-            }
-        }
-        if (Array.isArray(value)) {
-            for (let i = 0; i < value.length; i++) {
-                const item = value[i];
-                if (item !== null && typeof item === 'object') {
-                    const nested = scanForInjection(item, `${fieldPath}[${i}]`);
-                    if (nested.detected) {
-                        worstResult.matchedPatterns.push(...nested.matchedPatterns);
-                        worstResult.score = Math.min(1.0, worstResult.score + nested.score * 0.3);
-                        worstResult.detected = true;
-                    }
-                }
-            }
+function collectStrings(value, path, into) {
+    if (typeof value === 'string') {
+        if (value.trim().length > 0)
+            into.push({ path, text: value });
+    }
+    else if (Array.isArray(value)) {
+        value.forEach((item, i) => collectStrings(item, `${path}[${i}]`, into));
+    }
+    else if (value !== null && typeof value === 'object') {
+        for (const [key, item] of Object.entries(value)) {
+            collectStrings(item, path ? `${path}.${key}` : key, into);
         }
     }
-    if (worstResult.score >= 0.7)
-        worstResult.action = 'BLOCK';
-    else if (worstResult.score >= 0.3)
-        worstResult.action = 'FLAG';
-    else if (worstResult.detected)
-        worstResult.action = 'LOG_ONLY';
-    return worstResult;
+}
+function actionFor(score, detected) {
+    if (score >= 0.7)
+        return 'BLOCK';
+    if (score >= 0.3)
+        return 'FLAG';
+    return detected ? 'LOG_ONLY' : 'CLEAN';
+}
+function scanForInjection(data, currentPath = '') {
+    const fields = [];
+    collectStrings(data, currentPath, fields);
+    const found = fields
+        .map((f) => ({ path: f.path, result: detectPromptInjection(f.text) }))
+        .filter((f) => f.result.detected)
+        .sort((a, b) => b.result.score - a.result.score || (a.path < b.path ? -1 : a.path > b.path ? 1 : 0));
+    if (found.length === 0) {
+        return {
+            detected: false, score: 0, action: 'CLEAN', matchedPatterns: [],
+            encodedPayloadsFound: false, zeroWidthCharsFound: false, message: 'No prompt injection detected.',
+        };
+    }
+    const score = Math.min(1.0, found.slice(1).reduce((sum, f) => sum + f.result.score * 0.3, found[0].result.score));
+    const matchedPatterns = found.flatMap((f) => f.result.matchedPatterns.map((m) => ({ ...m, pattern: `[${f.path}] ${m.pattern}` })));
+    return {
+        ...found[0].result,
+        detected: true,
+        score,
+        action: actionFor(score, true),
+        matchedPatterns,
+        encodedPayloadsFound: found.some((f) => f.result.encodedPayloadsFound),
+        zeroWidthCharsFound: found.some((f) => f.result.zeroWidthCharsFound),
+    };
 }

package/dist/nodes/Redactor/names.js

@@ -1609,29 +1609,42 @@ const NOT_NAMES = new Set([
     'True', 'False', 'Null', 'None', 'Default', 'Admin', 'System', 'Test', 'Debug', 'Config',
     'Company', 'Corporation', 'Inc', 'Ltd', 'GmbH', 'LLC', 'Group', 'Team', 'Department', 'Division',
     'Total', 'Amount', 'Price', 'Cost', 'Rate', 'Tax', 'Fee', 'Balance',
-    'Solangi', 'Ghaffar', 'Shaikh', 'Syed', 'Qureshi', 'Mirza', 'Abbasi', 'Awan', 'Bhutto', 'Butt', 'Chaudhry', 'Durrani', 'Gilani', 'Hashmi', 'Iqbal', 'Jatoi', 'Leghari', 'Mengal', 'Niazi', 'Raisani', 'Talpur', 'Zardari',
 ]);
+for (const surname of ['Solangi', 'Ghaffar', 'Shaikh', 'Syed', 'Qureshi', 'Mirza', 'Abbasi', 'Awan', 'Bhutto', 'Butt', 'Chaudhry', 'Durrani', 'Gilani', 'Hashmi', 'Iqbal', 'Jatoi', 'Leghari', 'Mengal', 'Niazi', 'Raisani', 'Talpur', 'Zardari']) {
+    exports.LAST_NAMES.add(surname);
+}
 function detectNamesInText(text) {
     const results = [];
     const capitalWordSeq = /\b([A-ZÀ-ÿ][a-zà-ÿ]{1,20}(?:\s+[A-ZÀ-ÿ][a-zà-ÿ]{1,20}){1,3})\b/g;
     let match;
     while ((match = capitalWordSeq.exec(text)) !== null) {
-        const fullMatch = match[1];
-        const words = fullMatch.split(/\s+/);
-        if (words.some((w) => NOT_NAMES.has(w)))
-            continue;
-        const hasFirstName = words.some((w) => exports.FIRST_NAMES.has(w));
-        const hasLastName = words.some((w) => exports.LAST_NAMES.has(w));
-        if (hasFirstName || hasLastName) {
-            results.push({
-                name: fullMatch,
-                start: match.index,
-                end: match.index + fullMatch.length,
-            });
-        }
+        for (const run of nameRuns(match[1], match.index))
+            results.push(run);
     }
     return results;
 }
+function nameRuns(sequence, offset) {
+    var _a;
+    const runs = [];
+    let words = [];
+    const flush = () => {
+        const known = words.some((w) => exports.FIRST_NAMES.has(w.word) || exports.LAST_NAMES.has(w.word));
+        if (words.length >= 2 && known) {
+            const start = offset + words[0].at;
+            const last = words[words.length - 1];
+            runs.push({ name: sequence.slice(words[0].at, last.at + last.word.length), start, end: offset + last.at + last.word.length });
+        }
+        words = [];
+    };
+    for (const m of sequence.matchAll(/\S+/g)) {
+        if (NOT_NAMES.has(m[0]))
+            flush();
+        else
+            words.push({ word: m[0], at: (_a = m.index) !== null && _a !== void 0 ? _a : 0 });
+    }
+    flush();
+    return runs;
+}
 exports.NAME_CONTEXT_WORDS = [
     'spoke with', 'contact', 'customer', 'client', 'patient', 'employee',
     'user', 'member', 'subscriber', 'applicant', 'candidate', 'tenant',

package/dist/nodes/Redactor/patterns.js

@@ -19,6 +19,38 @@ function luhnCheck(num) {
     }
     return sum % 10 === 0;
 }
+const EMAIL_LOCAL = /[A-Za-z0-9._%+'!#$&*/=?^`{|}~-]/;
+const EMAIL_DOMAIN = /[\p{L}\p{N}.-]/u;
+const EMAIL_DOMAIN_SHAPE = /^[\p{L}\p{N}-]+(?:[.][\p{L}\p{N}-]+)*[.]\p{L}{2,}$/u;
+function emailLocalStart(text, at) {
+    if (text[at - 1] === '"') {
+        const open = text.lastIndexOf('"', at - 2);
+        const quoted = open >= 0 ? text.slice(open + 1, at - 1) : '';
+        return quoted.length > 0 && !/[\r\n"]/.test(quoted) ? open : -1;
+    }
+    let start = at;
+    while (start > 0 && EMAIL_LOCAL.test(text[start - 1]))
+        start--;
+    return start < at ? start : -1;
+}
+function emailDomainEnd(text, at) {
+    let end = at + 1;
+    while (end < text.length && EMAIL_DOMAIN.test(text[end]))
+        end++;
+    while (end > at + 1 && /[.-]/.test(text[end - 1]))
+        end--;
+    return EMAIL_DOMAIN_SHAPE.test(text.slice(at + 1, end)) ? end : -1;
+}
+function scanEmails(text) {
+    const spans = [];
+    for (let at = text.indexOf('@'); at >= 0; at = text.indexOf('@', at + 1)) {
+        const start = emailLocalStart(text, at);
+        const end = start < 0 ? -1 : emailDomainEnd(text, at);
+        if (end > 0)
+            spans.push({ start, end });
+    }
+    return spans;
+}
 function ibanCheck(iban) {
     const cleaned = iban.replace(/\s/g, '').toUpperCase();
     if (cleaned.length < 15 || cleaned.length > 34)
@@ -35,8 +67,10 @@ exports.PII_PATTERNS = [
         name: 'email',
         label: 'EMAIL',
         category: 'contact',
-        regex: /[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}/g,
-        description: 'Email addresses',
+        regex: /[a-zA-Z0-9._%+'-]+@[\p{L}\p{N}.-]+[.]\p{L}{2,}/gu,
+        anchor: '@',
+        scan: scanEmails,
+        description: 'Email addresses, including quoted local parts and international domains',
     },
     {
         name: 'phone',
@@ -56,7 +90,7 @@ exports.PII_PATTERNS = [
         name: 'phoneDE',
         label: 'PHONE_DE',
         category: 'contact',
-        regex: /(?:0|\+49)\s?\d{2,4}[\s/]\d{3,8}(?:[\s-]\d{1,5})?/g,
+        regex: /(?:0|\+49)\s?\d{2,4}[\s/]\d{3,8}(?:[\s-]\d{1,5})?|\+49\d{9,12}\b/g,
         description: 'German phone numbers (089 1234 5678, +49 30 12345678)',
     },
     {
@@ -277,9 +311,9 @@ exports.PII_PATTERNS = [
         name: 'creditCard',
         label: 'CREDIT_CARD',
         category: 'financial',
-        regex: /\b(?:\d{4}[\s-]?){3}\d{4}\b/g,
+        regex: /\b(?:\d[\s-]?){12,18}\d\b/g,
         validate: (match) => luhnCheck(match),
-        description: 'Credit/debit card numbers (Luhn validated)',
+        description: 'Credit/debit card numbers, 13 to 19 digits (Luhn validated)',
     },
     {
         name: 'iban',
@@ -825,8 +859,8 @@ exports.PII_PATTERNS = [
         name: 'pemPrivateKey',
         label: 'PRIVATE_KEY',
         category: 'enterprise',
-        regex: /-----BEGIN (?:RSA |DSA |EC |OPENSSH |ENCRYPTED )?PRIVATE KEY-----/g,
-        description: 'PEM private key headers',
+        regex: /-----BEGIN (RSA |DSA |EC |OPENSSH |ENCRYPTED )?PRIVATE KEY-----(?:[\s\S]*?-----END \1?PRIVATE KEY-----|[A-Za-z0-9+/=\s]*)/g,
+        description: 'PEM private keys, the whole block through the END line',
     },
     {
         name: 'sshPublicKey',
@@ -1448,8 +1482,8 @@ exports.PII_PATTERNS = [
         name: 'pgpPrivateKey',
         label: 'PGP_KEY',
         category: 'enterprise',
-        regex: /-----BEGIN PGP PRIVATE KEY BLOCK-----/g,
-        description: 'PGP private key block headers',
+        regex: /-----BEGIN PGP PRIVATE KEY BLOCK-----(?:[\s\S]*?-----END PGP PRIVATE KEY BLOCK-----|[A-Za-z0-9+/=:\s]*)/g,
+        description: 'PGP private key blocks, the whole block through the END line',
     },
     {
         name: 'envSecrets',

package/dist/nodes/Redactor/profiles.js

@@ -120,7 +120,7 @@ function parseTenantProfile(input, knownPatterns) {
     }
     if (!isObject(raw))
         fail('must be a JSON object');
-    const unknown = Object.keys(raw).filter((k) => !(k in PARSERS));
+    const unknown = Object.keys(raw).filter((k) => !Object.prototype.hasOwnProperty.call(PARSERS, k));
     if (unknown.length)
         fail(`unknown field(s) ${unknown.join(', ')}`);
     const profile = {};

package/dist/nodes/Redactor/regexCharset.js

@@ -93,6 +93,8 @@ function escapeSet(src, i) {
 function classMember(body, j) {
     if (body[j] === '\\' && body[j + 1] === 'b')
         return { set: codeSet(8), next: j + 2, code: 8 };
+    if (body[j] === '\\' && body[j + 1] === 'B')
+        return { set: codeSet(66), next: j + 2, code: 66 };
     if (body[j] === '\\') {
         const { length, code } = readEscape(body, j);
         return { set: escapeSet(body, j), next: j + length, code };

package/dist/nodes/Redactor/regexSafety.js

@@ -3,9 +3,9 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.checkRegex = checkRegex;
 const regexCharset_1 = require("./regexCharset");
 const MAX_REGEX_LENGTH = 500;
-const newFrame = (zeroWidth = false) => ({
+const newFrame = (zeroWidth = false, inLook = zeroWidth) => ({
     hasVariableQuantifier: false, hasAlternation: false, run: null, chars: (0, regexCharset_1.emptySet)(), zeroWidth,
-    branchConsumes: false, allConsume: true, nullable: false,
+    branchConsumes: false, allConsume: true, nullable: false, inLook,
 });
 function endBranch(frame) {
     frame.allConsume && (frame.allConsume = frame.branchConsumes);
@@ -48,7 +48,7 @@ function skipClass(src, i) {
 function groupPrefixLength(src, i) {
     if (src[i + 1] !== '?')
         return 1;
-    const named = /^\(\?<[A-Za-z_$][\w$]*>/.exec(src.slice(i));
+    const named = /^\(\?<[^=!>][^>]*>/.exec(src.slice(i));
     if (named)
         return named[0].length;
     const look = /^\(\?(?::|=|!|<=|<!)/.exec(src.slice(i));
@@ -79,7 +79,8 @@ function readToken(src, i, stack) {
     if (c === '[')
         return { atomEnd: skipClass(src, i), closed: null };
     if (c === '(') {
-        stack.push(newFrame(/^\(\?(?:=|!|<=|<!)/.test(src.slice(i))));
+        const look = /^\(\?(?:=|!|<=|<!)/.test(src.slice(i));
+        stack.push(newFrame(look, look || stack[stack.length - 1].inLook));
         return { atomEnd: i, closed: null, next: i + groupPrefixLength(src, i) };
     }
     if (c === '|')
@@ -127,8 +128,11 @@ function consumes(q, chars, closed) {
         return false;
     return !(closed === null || closed === void 0 ? void 0 : closed.nullable);
 }
+const IN_LOOK = 'repeats a variable part inside a lookahead or lookbehind, which is not supported';
 function stepProblem(src, i, step, q, top) {
     var _a;
+    if (top.inLook && isVariable(q))
+        return IN_LOOK;
     const problem = applyQuantifier(q, step.closed, top);
     if (problem || (q === null || q === void 0 ? void 0 : q.max) === 0)
         return problem;

package/dist/nodes/Redactor/ropa.js

@@ -1,6 +1,22 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.generateRopaRecord = generateRopaRecord;
+function retentionDescription(vaultTtlMinutes, auditLogEnabled) {
+    const vault = vaultTtlMinutes > 0
+        ? `Vault sessions expire after ${vaultTtlMinutes} minutes.`
+        : 'Vault sessions do not expire automatically. Purge them when they are no longer needed.';
+    const audit = auditLogEnabled
+        ? 'Audit entries go to the Report output. Their retention depends on where the workflow stores them.'
+        : 'No audit log is written.';
+    return `${vault} ${audit}`;
+}
+function countByCategory(hits) {
+    var _a;
+    const counts = new Map();
+    for (const hit of hits)
+        counts.set(hit.category, ((_a = counts.get(hit.category)) !== null && _a !== void 0 ? _a : 0) + 1);
+    return Object.fromEntries(counts);
+}
 function generateRopaRecord(hits, classification, itemCount, patternsUsed, redactionMode, vaultTtlMinutes, encryptionEnabled, auditLogEnabled, controller, processingPurposes, legalBasis, dataSubjectCategories, recipientCategories, thirdCountryTransfers) {
     const categoryMap = {};
     for (const hit of hits) {
@@ -30,8 +46,8 @@ function generateRopaRecord(hits, classification, itemCount, patternsUsed, redac
         personalDataCategories,
         retentionPolicy: {
             vaultTtlMinutes,
-            auditLogRetentionDays: 2555,
-            description: `Vault sessions auto-expire after ${vaultTtlMinutes} minutes. Audit logs retained for 7 years.`,
+            auditLogRetentionDays: null,
+            description: retentionDescription(vaultTtlMinutes, auditLogEnabled),
         },
         securityMeasures: {
             encryptionAtRest: encryptionEnabled,
@@ -46,7 +62,7 @@ function generateRopaRecord(hits, classification, itemCount, patternsUsed, redac
             redactionMode,
             patternsUsed,
             classificationLevel: classification.level,
-            hitsByCategory: classification.hitCountByLevel,
+            hitsByCategory: countByCategory(hits),
         },
     };
 }

package/dist/nodes/Redactor/runtime.js

@@ -6,6 +6,7 @@ exports.assertUserRegexes = assertUserRegexes;
 exports.sanitizeInjection = sanitizeInjection;
 const n8n_workflow_1 = require("n8n-workflow");
 const regexSafety_1 = require("./regexSafety");
+const types_1 = require("./types");
 const injection_1 = require("./injection");
 const VAULT_CREDENTIAL = 'redactorVaultApi';
 async function resolvePassphrase(fns) {
@@ -58,6 +59,13 @@ function workflowNamespace(fns) {
     }
     return 'wf:unsaved';
 }
+function assertCategory(fns, cp) {
+    if (fns.getNode().typeVersion < 2 || !cp.category || (0, types_1.isPiiCategory)(cp.category))
+        return;
+    throw new n8n_workflow_1.NodeOperationError(fns.getNode(), `Custom pattern "${cp.label}" has an unknown category "${cp.category}"`, {
+        description: `Use one of ${types_1.PII_CATEGORIES.join(', ')}.`,
+    });
+}
 function assertUserRegexes(fns, customPatterns, lists) {
     const refuse = (what, problem) => {
         throw new n8n_workflow_1.NodeOperationError(fns.getNode(), `${what} regex ${problem}`, {
@@ -67,6 +75,7 @@ function assertUserRegexes(fns, customPatterns, lists) {
     for (const cp of customPatterns) {
         if (!cp.label || !cp.regex)
             continue;
+        assertCategory(fns, cp);
         const problem = (0, regexSafety_1.checkRegex)(cp.regex);
         if (problem)
             refuse(`Custom pattern "${cp.label}"`, problem);

package/dist/nodes/Redactor/types.js

@@ -1,2 +1,9 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.isPiiCategory = exports.PII_CATEGORIES = void 0;
+exports.PII_CATEGORIES = [
+    'identity', 'financial', 'contact', 'network', 'location', 'temporal',
+    'medical', 'crypto', 'enterprise', 'vehicle', 'biometric', 'other',
+];
+const isPiiCategory = (value) => typeof value === 'string' && exports.PII_CATEGORIES.includes(value);
+exports.isPiiCategory = isPiiCategory;

package/dist/nodes/Redactor/vault.js

@@ -167,6 +167,7 @@ class WorkflowVault {
     constructor(store, passphrase = '') {
         this.store = store;
         this.passphrase = passphrase;
+        this.originals = new WeakMap();
         this.cache = new Map();
     }
     get sessions() {
@@ -240,12 +241,27 @@ class WorkflowVault {
             return;
         assertNoConflict(session, entry);
         session.entries[entry.token] = entry;
+        const index = this.originals.get(session);
+        const first = index === null || index === void 0 ? void 0 : index.get(entry.original);
+        if (index && (!first || first.token === entry.token))
+            index.set(entry.original, entry);
     }
     findByOriginal(sessionId, original) {
         const session = this.cache.get(sessionId);
         if (!session)
             return undefined;
-        return Object.values(session.entries).find((e) => e.original === original);
+        return this.originalIndex(session).get(original);
+    }
+    originalIndex(session) {
+        let index = this.originals.get(session);
+        if (!index) {
+            index = new Map();
+            for (const entry of Object.values(session.entries))
+                if (!index.has(entry.original))
+                    index.set(entry.original, entry);
+            this.originals.set(session, index);
+        }
+        return index;
     }
     deleteSession(sessionId) {
         this.cache.delete(sessionId);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "n8n-nodes-redactor",
-  "version": "5.1.0",
+  "version": "6.0.0",
   "description": "Redact, mask and anonymize PII before it reaches an LLM, then restore it. 216 patterns for emails, phones, addresses, IBAN, cards, names, SSN, passport and tax IDs. Reversible encrypted vault, GDPR Art.30 ROPA record, prompt-injection check. Runs on n8n Cloud and self-hosted n8n 2.x.",
   "keywords": [
     "n8n-community-node-package",