n8n-nodes-redactor 5.2.0 → 6.1.0

package/dist/nodes/Redactor/engine.js

@@ -43,6 +43,7 @@ exports.buildReport = buildReport;
 const crypto = __importStar(require("crypto"));
 const patterns_1 = require("./patterns");
 const regexSafety_1 = require("./regexSafety");
+const types_1 = require("./types");
 const context_1 = require("./context");
 const names_1 = require("./names");
 const pseudonymize_1 = require("./pseudonymize");
@@ -77,7 +78,6 @@ function generateToken(label, index) {
 function setOwn(obj, key, value) {
     Object.defineProperty(obj, key, { value, enumerable: true, writable: true, configurable: true });
 }
-const TOKEN_RE = /^\[[A-Z][A-Z0-9_]*_\d+\]$/;
 function maskValue(value, label) {
     if (value.length <= 2)
         return '*'.repeat(value.length);
@@ -136,13 +136,15 @@ function applyRedaction(match, pattern, ctx, vault, sessionId) {
     const irreversible = IRREVERSIBLE[ctx.mode];
     return irreversible ? irreversible(match, pattern.label) : match;
 }
+const nextIndex = new WeakMap();
 function freshToken(label, vault, sessionId, reserved) {
-    var _a, _b;
+    var _a, _b, _c;
     const entries = (_b = (_a = vault.getSession(sessionId)) === null || _a === void 0 ? void 0 : _a.entries) !== null && _b !== void 0 ? _b : {};
-    let index = Object.keys(entries).length;
+    let index = (_c = nextIndex.get(entries)) !== null && _c !== void 0 ? _c : Object.keys(entries).length;
     let token = generateToken(label, index);
     while (entries[token] || (reserved === null || reserved === void 0 ? void 0 : reserved.has(token)))
         token = generateToken(label, ++index);
+    nextIndex.set(entries, index + 1);
     return token;
 }
 const TOKEN_LIKE_RE = /\[[A-Z][A-Z0-9_]*_\d+\]/g;
@@ -455,7 +457,7 @@ function numericMapping(out, text, ctx, vault, sessionId) {
     return token;
 }
 function redactNumber(value, ctx, vault, sessionId, hits, itemIndex, path, display, siblingKeys) {
-    const text = String(value);
+    const text = Object.is(value, -0) ? '-0' : String(value);
     const numCtx = { ...ctx, dedup: false, numeric: true };
     let out = null;
     if (!ctx.skipSemantic)
@@ -472,17 +474,12 @@ function redactNumber(value, ctx, vault, sessionId, hits, itemIndex, path, displ
     ctx.lastLocked = [[0, mapped.length]];
     return mapped;
 }
-function redactKey(key, taken, sourceKeys, ctx, vault, sessionId, itemIndex, keyHits) {
+function distinctKey(out, original, clashes, ctx, vault, sessionId, reserved) {
     var _a;
-    const out = redactText(key, ctx, vault, sessionId, keyHits, itemIndex, '');
-    if (out === key)
-        return key;
-    const clashes = (k) => k === '' || Object.prototype.hasOwnProperty.call(taken, k) || sourceKeys.has(k);
-    if (!clashes(out))
-        return out;
     if (ctx.mode === 'token' || ctx.mode === 'pseudonymize') {
-        const token = freshToken('KEY', vault, sessionId, new Set([...((_a = ctx.reservedTokens) !== null && _a !== void 0 ? _a : []), ...sourceKeys, ...Object.keys(taken)]));
-        vault.addEntry(sessionId, { token, original: key, patternLabel: 'KEY', category: 'other', createdAt: new Date().toISOString() });
+        const token = freshToken('KEY', vault, sessionId, new Set([...((_a = ctx.reservedTokens) !== null && _a !== void 0 ? _a : []), ...reserved]));
+        vault.addEntry(sessionId, { token, original, patternLabel: 'KEY', category: 'other', createdAt: new Date().toISOString() });
+        ctx.lastLocked = [[0, token.length]];
         return token;
     }
     let suffixed = out;
@@ -490,6 +487,24 @@ function redactKey(key, taken, sourceKeys, ctx, vault, sessionId, itemIndex, key
         suffixed = `${out}_${n}`;
     return suffixed;
 }
+function redactKey(key, taken, sourceKeys, ctx, vault, sessionId, itemIndex, keyHits) {
+    const out = redactText(key, ctx, vault, sessionId, keyHits, itemIndex, '');
+    if (out === key)
+        return key;
+    const clashes = (k) => k === '' || Object.prototype.hasOwnProperty.call(taken, k) || sourceKeys.has(k);
+    if (!clashes(out))
+        return out;
+    return distinctKey(out, key, clashes, ctx, vault, sessionId, [...sourceKeys, ...Object.keys(taken)]);
+}
+function rememberKeyLock(ctx, container, key) {
+    var _a;
+    if (ctx.lastLocked && ctx.keyLocks) {
+        const byKey = (_a = ctx.keyLocks.get(container)) !== null && _a !== void 0 ? _a : new Map();
+        byKey.set(key, ctx.lastLocked);
+        ctx.keyLocks.set(container, byKey);
+    }
+    ctx.lastLocked = undefined;
+}
 function redactObject(value, ctx, vault, sessionId, hits, itemIndex, path, display) {
     var _a;
     const entries = Object.entries(value);
@@ -500,9 +515,11 @@ function redactObject(value, ctx, vault, sessionId, hits, itemIndex, path, displ
     for (const [k, v] of entries) {
         const fieldPath = path ? `${path}.${k}` : k;
         const keyHits = [];
+        ctx.lastLocked = undefined;
         const outKey = shouldProcessField(fieldPath, ctx.fieldMode, ctx.fieldRules)
             ? redactKey(k, obj, sourceKeys, ctx, vault, sessionId, itemIndex, keyHits)
-            : k;
+            : protectLiterals(k, ctx, vault, sessionId, hits, itemIndex);
+        rememberKeyLock(ctx, obj, outKey);
         origins.set(outKey, k);
         const childDisplay = display ? `${display}.${outKey}` : outKey;
         for (const h of keyHits)
@@ -516,7 +533,7 @@ function redactValue(value, ctx, vault, sessionId, hits, itemIndex, currentPath
     const processed = shouldProcessField(currentPath, ctx.fieldMode, ctx.fieldRules);
     if (typeof value === 'string') {
         if (!processed)
-            return value;
+            return protectLiterals(value, ctx, vault, sessionId, hits, itemIndex);
         if (!ctx.skipSemantic) {
             const semantic = redactSemantic(value, ctx, vault, sessionId, hits, itemIndex, currentPath, displayPath, siblingKeys);
             if (semantic !== null)
@@ -557,19 +574,18 @@ class SegmentCursor {
         this.cur = segs[0];
     }
     freeAt(start, end) {
-        while (this.cur && (this.cur.locked || this.cur.src + this.cur.text.length <= start))
+        while (this.cur && (this.cur.locked || this.cur.end <= start))
             this.take();
         const cur = this.cur;
-        return cur && cur.src <= start && end <= cur.src + cur.text.length ? cur : undefined;
+        return cur && cur.src <= start && end <= cur.end ? cur : undefined;
     }
     lock(start, end, replacement) {
         const cur = this.cur;
         if (start > cur.src)
-            this.next.push({ text: cur.text.slice(0, start - cur.src), locked: false, src: cur.src });
-        this.next.push({ text: replacement, locked: true, src: -1 });
-        const tail = end - cur.src;
-        if (tail < cur.text.length)
-            this.cur = { text: cur.text.slice(tail), locked: false, src: end };
+            this.next.push(freeSlice(cur, cur.src, start));
+        this.next.push({ text: replacement, locked: true, src: start, end });
+        if (end < cur.end)
+            this.cur = freeSlice(cur, end, cur.end);
         else
             this.cur = this.segs[++this.i];
     }
@@ -583,33 +599,104 @@ class SegmentCursor {
         this.cur = this.segs[++this.i];
     }
 }
-function replaceFree(pass, re, fn) {
+function freeSlice(seg, start, end) {
+    return { text: seg.text.slice(start - seg.src, end - seg.src), locked: false, src: start, end };
+}
+function redactMatch(pass, match, decision) {
+    if (decision.store)
+        return decision.store(match);
+    const replacement = applyRedaction(match, decision.pattern, pass.ctx, pass.vault, pass.sessionId);
+    if (decision.detail) {
+        pass.hits.push({ token: replacement, original: '***', field: pass.fieldPath, itemIndex: pass.itemIndex, ...decision.detail });
+    }
+    return replacement;
+}
+function coveringPending(pending, cursor, pos) {
+    while (cursor.i < pending.length && pending[cursor.i].end <= pos)
+        cursor.i++;
+    for (let k = cursor.i; k < pending.length && pending[k].start <= pos; k++) {
+        if (pending[k].end > pos)
+            return pending[k];
+    }
+    return undefined;
+}
+function claimSegment(pass, seg, pending, cursor, into) {
+    let pos = seg.src;
+    while (pos < seg.end) {
+        const p = coveringPending(pending, cursor, pos);
+        if (p) {
+            const end = Math.min(seg.end, p.end);
+            into.push({ text: redactMatch(pass, pass.source.slice(pos, end), p.decision), locked: true, src: pos, end });
+            pos = end;
+            continue;
+        }
+        const next = cursor.i < pending.length ? Math.max(pos + 1, pending[cursor.i].start) : seg.end;
+        const end = Math.min(seg.end, next);
+        into.push(freeSlice(seg, pos, end));
+        pos = end;
+    }
+}
+function claimPending(pass, pending) {
+    var _a;
+    if (pending.length === 0)
+        return;
+    pending.sort((a, b) => a.start - b.start);
+    const next = [];
+    const cursor = { i: 0 };
+    for (const seg of pass.segs) {
+        if (seg.locked || seg.end <= ((_a = pending[cursor.i]) === null || _a === void 0 ? void 0 : _a.start) || cursor.i >= pending.length)
+            next.push(seg);
+        else
+            claimSegment(pass, seg, pending, cursor, next);
+    }
+    pass.segs = next;
+}
+function claimOne(pass, cursor, pending, start, end, decide) {
+    const text = pass.source.slice(start, end);
+    const free = cursor.freeAt(start, end) !== undefined;
+    const decision = decide(text, start);
+    if (decision && free)
+        cursor.lock(start, end, redactMatch(pass, text, decision));
+    else if (decision)
+        pending.push({ start, end, decision });
+    return free;
+}
+function replaceFree(pass, re, decide) {
     const global = new RegExp(re.source, re.flags.includes('g') ? re.flags : `${re.flags}g`);
     const cursor = new SegmentCursor(pass.segs);
+    const pending = [];
     let m;
     while ((m = global.exec(pass.source)) !== null) {
         const start = m.index;
-        const end = start + m[0].length;
-        if (m[0] === '' || !cursor.freeAt(start, end)) {
+        if (m[0] === '' || !claimOne(pass, cursor, pending, start, start + m[0].length, decide))
             global.lastIndex = start + 1;
-            continue;
-        }
-        const replacement = fn(m[0], start);
-        if (replacement !== null)
-            cursor.lock(start, end, replacement);
     }
     pass.segs = cursor.finish();
+    claimPending(pass, pending);
 }
-function redactMatch(pass, match, pattern, detail) {
-    const replacement = applyRedaction(match, pattern, pass.ctx, pass.vault, pass.sessionId);
-    pass.hits.push({ token: replacement, original: '***', field: pass.fieldPath, itemIndex: pass.itemIndex, ...detail });
-    return replacement;
+function replaceSpans(pass, spans, decide) {
+    const ordered = [...spans].sort((a, b) => a.start - b.start || b.end - a.end);
+    const cursor = new SegmentCursor(pass.segs);
+    const pending = [];
+    let reach = -1;
+    for (const span of ordered) {
+        if (span.end <= reach)
+            continue;
+        claimOne(pass, cursor, pending, span.start, span.end, decide);
+        reach = span.end;
+    }
+    pass.segs = cursor.finish();
+    claimPending(pass, pending);
 }
 function denyListRegex(entry) {
     if (entry.type === 'regex')
         return isSafeRegex(entry.value) ? new RegExp(entry.value, 'gi') : null;
     return new RegExp(escapeRe(entry.value), 'gi');
 }
+const DENY_DECISION = {
+    pattern: { label: 'DENY_LIST', category: 'other' },
+    detail: { patternName: 'denyList', patternLabel: 'DENY_LIST', category: 'other', confidence: context_1.DENY_LIST_CONFIDENCE },
+};
 function denyListStage(pass) {
     var _a;
     for (const entry of (_a = pass.ctx.denyList) !== null && _a !== void 0 ? _a : []) {
@@ -617,61 +704,58 @@ function denyListStage(pass) {
             assertUserRegexInput(pass.source, `Deny list regex "${entry.value}"`);
         try {
             const re = denyListRegex(entry);
-            if (!re)
-                continue;
-            replaceFree(pass, re, (match) => TOKEN_RE.test(match)
-                ? null
-                : redactMatch(pass, match, { label: 'DENY_LIST', category: 'other' }, {
-                    patternName: 'denyList', patternLabel: 'DENY_LIST', category: 'other', confidence: context_1.DENY_LIST_CONFIDENCE,
-                }));
+            if (re)
+                replaceFree(pass, re, () => DENY_DECISION);
         }
         catch { }
     }
 }
-function builtInMatch(pass, pattern, match, offset) {
-    if (TOKEN_RE.test(match) || (match.startsWith('[') && match.endsWith(']')))
-        return null;
+function builtInDecision(pass, pattern, match, offset) {
     const validatorPassed = pattern.validate ? pattern.validate(match) : true;
     if (!validatorPassed || isAllowListed(match, pass.ctx.allowList))
         return null;
     const confidence = (0, context_1.calculateConfidence)(pattern.name, !!pattern.validate, validatorPassed, pass.source, offset, offset + match.length);
     if (confidence < pass.threshold)
         return null;
-    return redactMatch(pass, match, pattern, {
-        patternName: pattern.name, patternLabel: pattern.label, category: pattern.category, confidence,
-    });
+    return { pattern, detail: { patternName: pattern.name, patternLabel: pattern.label, category: pattern.category, confidence } };
 }
 function builtInStage(pass) {
     const enabled = (0, patterns_1.getPatternsByNames)(pass.ctx.enabledPatterns);
     for (const pattern of [...enabled.filter((p) => p.validate), ...enabled.filter((p) => !p.validate)]) {
-        replaceFree(pass, pattern.regex, (match, offset) => builtInMatch(pass, pattern, match, offset));
+        if (pattern.anchor && !pass.source.includes(pattern.anchor))
+            continue;
+        const decide = (match, offset) => builtInDecision(pass, pattern, match, offset);
+        if (pattern.scan)
+            replaceSpans(pass, pattern.scan(pass.source), decide);
+        else
+            replaceFree(pass, pattern.regex, decide);
     }
 }
-function sourceNames(pass) {
-    const names = new Set((0, names_1.detectNamesInText)(pass.source).map((nm) => nm.name));
-    for (const seg of pass.segs)
-        if (!seg.locked)
-            for (const nm of (0, names_1.detectNamesInText)(seg.text))
-                names.add(nm.name);
-    return [...names].sort((x, y) => y.length - x.length);
+function nameSpans(pass) {
+    const spans = (0, names_1.detectNamesInText)(pass.source).map((nm) => ({ start: nm.start, end: nm.end }));
+    for (const seg of pass.segs) {
+        if (seg.locked)
+            continue;
+        for (const nm of (0, names_1.detectNamesInText)(seg.text))
+            spans.push({ start: seg.src + nm.start, end: seg.src + nm.end });
+    }
+    return spans;
 }
 function nameStage(pass) {
-    if (pass.ctx.skipSemantic)
+    var _a;
+    if ((_a = pass.ctx.skipNames) !== null && _a !== void 0 ? _a : pass.ctx.skipSemantic)
         return;
-    for (const name of sourceNames(pass)) {
-        if ((name.includes('[') && name.includes(']')) || isAllowListed(name, pass.ctx.allowList))
-            continue;
-        let replacement;
-        replaceFree(pass, new RegExp(escapeRe(name), 'g'), (match, start) => {
-            const confidence = (0, context_1.hasContextWords)(pass.source, start, start + match.length, names_1.NAME_CONTEXT_WORDS) ? 0.8 : 0.65;
-            if (confidence < pass.threshold)
-                return null;
-            replacement !== null && replacement !== void 0 ? replacement : (replacement = redactMatch(pass, match, { label: 'PERSON_NAME', category: 'identity' }, {
-                patternName: 'personNameDict', patternLabel: 'PERSON_NAME', category: 'identity', confidence,
-            }));
-            return replacement;
-        });
-    }
+    replaceSpans(pass, nameSpans(pass), (match, start) => {
+        if (isAllowListed(match, pass.ctx.allowList))
+            return null;
+        const confidence = (0, context_1.hasContextWords)(pass.source, start, start + match.length, names_1.NAME_CONTEXT_WORDS) ? 0.8 : 0.65;
+        if (confidence < pass.threshold)
+            return null;
+        return {
+            pattern: { label: 'PERSON_NAME', category: 'identity' },
+            detail: { patternName: 'personNameDict', patternLabel: 'PERSON_NAME', category: 'identity', confidence },
+        };
+    });
 }
 function customStage(pass) {
     if (context_1.CUSTOM_PATTERN_CONFIDENCE < pass.threshold)
@@ -679,15 +763,15 @@ function customStage(pass) {
     for (const cp of pass.ctx.customPatterns) {
         if (!cp.label || !cp.regex || !isSafeRegex(cp.regex))
             continue;
-        const pattern = { label: cp.label.toUpperCase(), category: cp.category || 'identity' };
+        const category = (0, types_1.isPiiCategory)(cp.category) ? cp.category : cp.category ? 'other' : 'identity';
+        const pattern = { label: cp.label.toUpperCase(), category };
+        const decision = {
+            pattern,
+            detail: { patternName: `custom_${cp.label}`, patternLabel: pattern.label, category: pattern.category, confidence: context_1.CUSTOM_PATTERN_CONFIDENCE },
+        };
         assertUserRegexInput(pass.source, `Custom pattern "${cp.label}"`);
         try {
-            replaceFree(pass, new RegExp(cp.regex, 'g'), (match) => TOKEN_RE.test(match) || isAllowListed(match, pass.ctx.allowList)
-                ? null
-                : redactMatch(pass, match, pattern, {
-                    patternName: `custom_${cp.label}`, patternLabel: pattern.label, category: pattern.category,
-                    confidence: context_1.CUSTOM_PATTERN_CONFIDENCE,
-                }));
+            replaceFree(pass, new RegExp(cp.regex, 'g'), (match) => (isAllowListed(match, pass.ctx.allowList) ? null : decision));
         }
         catch { }
     }
@@ -722,16 +806,31 @@ function literalStage(pass) {
     const { ctx, vault, sessionId } = pass;
     if (!ctx.priorTokens || (ctx.mode !== 'token' && ctx.mode !== 'pseudonymize'))
         return;
-    replaceFree(pass, ctx.priorTokens, (match) => {
-        const token = freshToken('LITERAL', vault, sessionId, ctx.reservedTokens);
-        vault.addEntry(sessionId, { token, original: match, patternLabel: 'LITERAL', category: 'other', createdAt: new Date().toISOString() });
-        return token;
-    });
+    const decision = {
+        pattern: { label: 'LITERAL', category: 'other' },
+        store: (match) => {
+            const token = freshToken('LITERAL', vault, sessionId, ctx.reservedTokens);
+            vault.addEntry(sessionId, { token, original: match, patternLabel: 'LITERAL', category: 'other', createdAt: new Date().toISOString() });
+            return token;
+        },
+    };
+    replaceFree(pass, ctx.priorTokens, () => decision);
+}
+function protectLiterals(text, ctx, vault, sessionId, hits, itemIndex) {
+    if (!ctx.priorTokens)
+        return text;
+    const pass = {
+        source: text, segs: [{ text, locked: false, src: 0, end: text.length }], threshold: 0,
+        ctx, vault, sessionId, hits, itemIndex, fieldPath: '',
+    };
+    literalStage(pass);
+    recordLocked(ctx, pass.segs);
+    return pass.segs.map((seg) => seg.text).join('');
 }
 function redactText(text, ctx, vault, sessionId, hits, itemIndex, fieldPath) {
     var _a;
     const pass = {
-        source: text, segs: [{ text, locked: false, src: 0 }], threshold: (_a = ctx.confidenceThreshold) !== null && _a !== void 0 ? _a : 0,
+        source: text, segs: [{ text, locked: false, src: 0, end: text.length }], threshold: (_a = ctx.confidenceThreshold) !== null && _a !== void 0 ? _a : 0,
         ctx, vault, sessionId, hits, itemIndex, fieldPath,
     };
     literalStage(pass);
@@ -781,44 +880,104 @@ function toUtf16Spans(text, entities) {
         .filter((e) => Number.isInteger(e.start) && Number.isInteger(e.end) && e.start >= 0 && e.end > e.start && e.end < offsets.length)
         .map((e) => ({ start: offsets[e.start], end: offsets[e.end], score: e.score, entityType: e.entity_type }));
 }
-function resolveOverlaps(spans) {
-    const ranked = [...spans].sort((a, b) => b.score - a.score || (b.end - b.start) - (a.end - a.start) || a.start - b.start);
+function resolveCluster(cluster) {
+    const ranked = [...cluster].sort((a, b) => b.score - a.score || (b.end - b.start) - (a.end - a.start) || a.start - b.start);
     const kept = [];
     for (const span of ranked) {
         if (!kept.some((k) => span.start < k.end && k.start < span.end))
             kept.push(span);
     }
-    return kept.sort((a, b) => b.start - a.start);
+    return kept;
+}
+function resolveOverlaps(spans) {
+    const sorted = [...spans].sort((a, b) => a.start - b.start);
+    const out = [];
+    let cluster = [];
+    let reach = -1;
+    for (const span of sorted) {
+        if (span.start >= reach && cluster.length > 0) {
+            out.push(...resolveCluster(cluster));
+            cluster = [];
+        }
+        cluster.push(span);
+        reach = Math.max(reach, span.end);
+    }
+    out.push(...resolveCluster(cluster));
+    return out.sort((a, b) => a.start - b.start);
+}
+function subtractLocked(spans, locked) {
+    const sortedLocks = [...locked].sort((a, b) => a[0] - b[0]);
+    const out = [];
+    let k = 0;
+    for (const span of spans) {
+        while (k < sortedLocks.length && sortedLocks[k][1] <= span.start)
+            k++;
+        let pos = span.start;
+        for (let j = k; j < sortedLocks.length && sortedLocks[j][0] < span.end; j++) {
+            if (sortedLocks[j][0] > pos)
+                out.push({ ...span, start: pos, end: sortedLocks[j][0] });
+            pos = Math.max(pos, sortedLocks[j][1]);
+        }
+        if (pos < span.end)
+            out.push({ ...span, start: pos, end: span.end });
+    }
+    return out;
 }
 function presidioSpans(value, entities, ctx, locked) {
     var _a;
     const threshold = (_a = ctx.confidenceThreshold) !== null && _a !== void 0 ? _a : 0;
-    const free = (s) => !locked.some(([start, end]) => s.start < end && start < s.end);
-    return resolveOverlaps(toUtf16Spans(value, entities).filter((s) => s.score >= threshold && free(s)));
+    return subtractLocked(resolveOverlaps(toUtf16Spans(value, entities).filter((s) => s.score >= threshold)), locked);
 }
 async function presidioRedactString(value, ctx, vault, sessionId, hits, itemIndex, path, locked) {
-    if (value.trim().length === 0 || TOKEN_RE.test(value))
+    if (value.trim().length === 0)
         return value;
     const entities = await (0, presidio_1.analyzeWithPresidio)(ctx.presidioUrl, value, ctx.presidioLanguage || 'en', 0.4, 10000, ctx.presidioRequest);
-    const spans = presidioSpans(value, entities, ctx, locked);
-    let text = value;
-    for (const span of spans) {
+    const parts = [];
+    let last = 0;
+    for (const span of presidioSpans(value, entities, ctx, locked)) {
         const matchedText = value.slice(span.start, span.end);
-        if (TOKEN_RE.test(matchedText) || (matchedText.startsWith('[') && matchedText.endsWith(']')))
-            continue;
         if (isAllowListed(matchedText, ctx.allowList))
             continue;
         const label = (0, presidio_1.getRedactorLabel)(span.entityType);
         const category = (0, presidio_1.getRedactorCategory)(span.entityType);
         const replacement = applyRedaction(matchedText, { label, category }, ctx, vault, sessionId);
-        text = text.slice(0, span.start) + replacement + text.slice(span.end);
+        parts.push(value.slice(last, span.start), replacement);
+        last = span.end;
         hits.push({
             token: replacement, original: '***',
             patternName: `presidio_${span.entityType}`, patternLabel: label,
             category, field: path, itemIndex, confidence: span.score,
         });
     }
-    return text;
+    parts.push(value.slice(last));
+    return parts.join('');
+}
+const IDENTIFIER_KEY = /^[\p{L}_$][\p{L}\p{N}_$-]*$/u;
+async function presidioKey(key, original, source, taken, ctx, vault, sessionId, hits, itemIndex, path, policyPath) {
+    var _a, _b, _c;
+    if (IDENTIFIER_KEY.test(key) || !shouldProcessField(policyPath, ctx.fieldMode, ctx.fieldRules))
+        return key;
+    const locked = (_c = (_b = (_a = ctx.keyLocks) === null || _a === void 0 ? void 0 : _a.get(source)) === null || _b === void 0 ? void 0 : _b.get(key)) !== null && _c !== void 0 ? _c : [];
+    let out = key;
+    try {
+        out = await presidioRedactString(key, ctx, vault, sessionId, hits, itemIndex, path, locked);
+    }
+    catch {
+        return key;
+    }
+    const others = new Set(Object.keys(source).filter((k) => k !== key));
+    const clashes = (k) => k === '' || Object.prototype.hasOwnProperty.call(taken, k) || others.has(k);
+    if (out === key || !clashes(out))
+        return out;
+    return distinctKey(out, original, clashes, ctx, vault, sessionId, [...others, ...Object.keys(taken)]);
+}
+function renamePaths(hits, from, to) {
+    for (const h of hits) {
+        if (h.field === from)
+            h.field = to;
+        else if (h.field.startsWith(`${from}.`) || h.field.startsWith(`${from}[`))
+            h.field = to + h.field.slice(from.length);
+    }
 }
 async function presidioWalk(value, ctx, vault, sessionId, hits, itemIndex, path, policyPath, locked = []) {
     var _a, _b, _c, _d, _e, _f;
@@ -848,7 +1007,15 @@ async function presidioWalk(value, ctx, vault, sessionId, hits, itemIndex, path,
             const child = path ? `${path}.${k}` : k;
             const childPolicy = policyPath ? `${policyPath}.${original}` : original;
             const lock = (_f = (_e = ctx.lockedSpans) === null || _e === void 0 ? void 0 : _e.get(value)) === null || _f === void 0 ? void 0 : _f.get(k);
-            setOwn(out, k, await presidioWalk(v, ctx, vault, sessionId, hits, itemIndex, child, childPolicy, lock));
+            const keyHits = [];
+            const source = value;
+            const key = await presidioKey(k, original, source, out, ctx, vault, sessionId, keyHits, itemIndex, child, childPolicy);
+            const finalChild = path ? `${path}.${key}` : key;
+            if (key !== k)
+                renamePaths(hits, child, finalChild);
+            for (const h of keyHits)
+                hits.push({ ...h, field: finalChild });
+            setOwn(out, key, await presidioWalk(v, ctx, vault, sessionId, hits, itemIndex, finalChild, childPolicy, lock));
         }
         return out;
     }