n8n-nodes-redactor 6.0.0 → 6.1.0

package/dist/nodes/Redactor/Redactor.node.js

@@ -798,6 +798,7 @@ class Redactor {
                 fieldRules: [],
                 fieldMode: 'all',
                 skipSemantic: operation === 'verify',
+                skipNames: operation === 'verify' && this.getNode().typeVersion < 2,
                 scanNumbers: true,
             };
             const allHits = [];
@@ -1032,7 +1033,8 @@ class Redactor {
                 { name: 'Deny list', entries: denyList },
             ]);
             try {
-                vault.getOrCreateSession(sessionId, sessionTtl * 60 * 1000);
+                const session = vault.getOrCreateSession(sessionId, sessionTtl * 60 * 1000);
+                sessionTtl = session.ttl / 60000;
             }
             catch (error) {
                 throw new n8n_workflow_1.NodeOperationError(this.getNode(), error.message);

package/dist/nodes/Redactor/engine.js

@@ -611,39 +611,45 @@ function redactMatch(pass, match, decision) {
     }
     return replacement;
 }
-function segmentAfter(segs, pos) {
-    let lo = 0;
-    let hi = segs.length;
-    while (lo < hi) {
-        const mid = (lo + hi) >> 1;
-        if (segs[mid].end <= pos)
-            lo = mid + 1;
-        else
-            hi = mid;
+function coveringPending(pending, cursor, pos) {
+    while (cursor.i < pending.length && pending[cursor.i].end <= pos)
+        cursor.i++;
+    for (let k = cursor.i; k < pending.length && pending[k].start <= pos; k++) {
+        if (pending[k].end > pos)
+            return pending[k];
     }
-    return lo;
+    return undefined;
 }
-function claimPending(pass, pending) {
-    for (const p of pending) {
-        let i = segmentAfter(pass.segs, p.start);
-        while (i < pass.segs.length && pass.segs[i].src < p.end) {
-            const seg = pass.segs[i];
-            if (seg.locked) {
-                i++;
-                continue;
-            }
-            const start = Math.max(seg.src, p.start);
+function claimSegment(pass, seg, pending, cursor, into) {
+    let pos = seg.src;
+    while (pos < seg.end) {
+        const p = coveringPending(pending, cursor, pos);
+        if (p) {
             const end = Math.min(seg.end, p.end);
-            const parts = [];
-            if (start > seg.src)
-                parts.push(freeSlice(seg, seg.src, start));
-            parts.push({ text: redactMatch(pass, pass.source.slice(start, end), p.decision), locked: true, src: start, end });
-            if (end < seg.end)
-                parts.push(freeSlice(seg, end, seg.end));
-            pass.segs.splice(i, 1, ...parts);
-            i += parts.length;
+            into.push({ text: redactMatch(pass, pass.source.slice(pos, end), p.decision), locked: true, src: pos, end });
+            pos = end;
+            continue;
         }
+        const next = cursor.i < pending.length ? Math.max(pos + 1, pending[cursor.i].start) : seg.end;
+        const end = Math.min(seg.end, next);
+        into.push(freeSlice(seg, pos, end));
+        pos = end;
+    }
+}
+function claimPending(pass, pending) {
+    var _a;
+    if (pending.length === 0)
+        return;
+    pending.sort((a, b) => a.start - b.start);
+    const next = [];
+    const cursor = { i: 0 };
+    for (const seg of pass.segs) {
+        if (seg.locked || seg.end <= ((_a = pending[cursor.i]) === null || _a === void 0 ? void 0 : _a.start) || cursor.i >= pending.length)
+            next.push(seg);
+        else
+            claimSegment(pass, seg, pending, cursor, next);
     }
+    pass.segs = next;
 }
 function claimOne(pass, cursor, pending, start, end, decide) {
     const text = pass.source.slice(start, end);
@@ -736,7 +742,8 @@ function nameSpans(pass) {
     return spans;
 }
 function nameStage(pass) {
-    if (pass.ctx.skipSemantic)
+    var _a;
+    if ((_a = pass.ctx.skipNames) !== null && _a !== void 0 ? _a : pass.ctx.skipSemantic)
         return;
     replaceSpans(pass, nameSpans(pass), (match, start) => {
         if (isAllowListed(match, pass.ctx.allowList))
@@ -873,49 +880,84 @@ function toUtf16Spans(text, entities) {
         .filter((e) => Number.isInteger(e.start) && Number.isInteger(e.end) && e.start >= 0 && e.end > e.start && e.end < offsets.length)
         .map((e) => ({ start: offsets[e.start], end: offsets[e.end], score: e.score, entityType: e.entity_type }));
 }
-function resolveOverlaps(spans) {
-    const ranked = [...spans].sort((a, b) => b.score - a.score || (b.end - b.start) - (a.end - a.start) || a.start - b.start);
+function resolveCluster(cluster) {
+    const ranked = [...cluster].sort((a, b) => b.score - a.score || (b.end - b.start) - (a.end - a.start) || a.start - b.start);
     const kept = [];
     for (const span of ranked) {
         if (!kept.some((k) => span.start < k.end && k.start < span.end))
             kept.push(span);
     }
-    return kept.sort((a, b) => b.start - a.start);
+    return kept;
+}
+function resolveOverlaps(spans) {
+    const sorted = [...spans].sort((a, b) => a.start - b.start);
+    const out = [];
+    let cluster = [];
+    let reach = -1;
+    for (const span of sorted) {
+        if (span.start >= reach && cluster.length > 0) {
+            out.push(...resolveCluster(cluster));
+            cluster = [];
+        }
+        cluster.push(span);
+        reach = Math.max(reach, span.end);
+    }
+    out.push(...resolveCluster(cluster));
+    return out.sort((a, b) => a.start - b.start);
+}
+function subtractLocked(spans, locked) {
+    const sortedLocks = [...locked].sort((a, b) => a[0] - b[0]);
+    const out = [];
+    let k = 0;
+    for (const span of spans) {
+        while (k < sortedLocks.length && sortedLocks[k][1] <= span.start)
+            k++;
+        let pos = span.start;
+        for (let j = k; j < sortedLocks.length && sortedLocks[j][0] < span.end; j++) {
+            if (sortedLocks[j][0] > pos)
+                out.push({ ...span, start: pos, end: sortedLocks[j][0] });
+            pos = Math.max(pos, sortedLocks[j][1]);
+        }
+        if (pos < span.end)
+            out.push({ ...span, start: pos, end: span.end });
+    }
+    return out;
 }
 function presidioSpans(value, entities, ctx, locked) {
     var _a;
     const threshold = (_a = ctx.confidenceThreshold) !== null && _a !== void 0 ? _a : 0;
-    const free = (s) => !locked.some(([start, end]) => s.start < end && start < s.end);
-    return resolveOverlaps(toUtf16Spans(value, entities).filter((s) => s.score >= threshold && free(s)));
+    return subtractLocked(resolveOverlaps(toUtf16Spans(value, entities).filter((s) => s.score >= threshold)), locked);
 }
 async function presidioRedactString(value, ctx, vault, sessionId, hits, itemIndex, path, locked) {
     if (value.trim().length === 0)
         return value;
     const entities = await (0, presidio_1.analyzeWithPresidio)(ctx.presidioUrl, value, ctx.presidioLanguage || 'en', 0.4, 10000, ctx.presidioRequest);
-    const spans = presidioSpans(value, entities, ctx, locked);
-    let text = value;
-    for (const span of spans) {
+    const parts = [];
+    let last = 0;
+    for (const span of presidioSpans(value, entities, ctx, locked)) {
         const matchedText = value.slice(span.start, span.end);
         if (isAllowListed(matchedText, ctx.allowList))
             continue;
         const label = (0, presidio_1.getRedactorLabel)(span.entityType);
         const category = (0, presidio_1.getRedactorCategory)(span.entityType);
         const replacement = applyRedaction(matchedText, { label, category }, ctx, vault, sessionId);
-        text = text.slice(0, span.start) + replacement + text.slice(span.end);
+        parts.push(value.slice(last, span.start), replacement);
+        last = span.end;
         hits.push({
             token: replacement, original: '***',
             patternName: `presidio_${span.entityType}`, patternLabel: label,
             category, field: path, itemIndex, confidence: span.score,
         });
     }
-    return text;
+    parts.push(value.slice(last));
+    return parts.join('');
 }
 const IDENTIFIER_KEY = /^[\p{L}_$][\p{L}\p{N}_$-]*$/u;
-async function presidioKey(key, original, taken, ctx, vault, sessionId, hits, itemIndex, path, policyPath) {
+async function presidioKey(key, original, source, taken, ctx, vault, sessionId, hits, itemIndex, path, policyPath) {
     var _a, _b, _c;
     if (IDENTIFIER_KEY.test(key) || !shouldProcessField(policyPath, ctx.fieldMode, ctx.fieldRules))
         return key;
-    const locked = (_c = (_b = (_a = ctx.keyLocks) === null || _a === void 0 ? void 0 : _a.get(taken)) === null || _b === void 0 ? void 0 : _b.get(key)) !== null && _c !== void 0 ? _c : [];
+    const locked = (_c = (_b = (_a = ctx.keyLocks) === null || _a === void 0 ? void 0 : _a.get(source)) === null || _b === void 0 ? void 0 : _b.get(key)) !== null && _c !== void 0 ? _c : [];
     let out = key;
     try {
         out = await presidioRedactString(key, ctx, vault, sessionId, hits, itemIndex, path, locked);
@@ -923,10 +965,19 @@ async function presidioKey(key, original, taken, ctx, vault, sessionId, hits, it
     catch {
         return key;
     }
-    const clashes = (k) => k === '' || Object.prototype.hasOwnProperty.call(taken, k);
+    const others = new Set(Object.keys(source).filter((k) => k !== key));
+    const clashes = (k) => k === '' || Object.prototype.hasOwnProperty.call(taken, k) || others.has(k);
     if (out === key || !clashes(out))
         return out;
-    return distinctKey(out, original, clashes, ctx, vault, sessionId, Object.keys(taken));
+    return distinctKey(out, original, clashes, ctx, vault, sessionId, [...others, ...Object.keys(taken)]);
+}
+function renamePaths(hits, from, to) {
+    for (const h of hits) {
+        if (h.field === from)
+            h.field = to;
+        else if (h.field.startsWith(`${from}.`) || h.field.startsWith(`${from}[`))
+            h.field = to + h.field.slice(from.length);
+    }
 }
 async function presidioWalk(value, ctx, vault, sessionId, hits, itemIndex, path, policyPath, locked = []) {
     var _a, _b, _c, _d, _e, _f;
@@ -956,8 +1007,15 @@ async function presidioWalk(value, ctx, vault, sessionId, hits, itemIndex, path,
             const child = path ? `${path}.${k}` : k;
             const childPolicy = policyPath ? `${policyPath}.${original}` : original;
             const lock = (_f = (_e = ctx.lockedSpans) === null || _e === void 0 ? void 0 : _e.get(value)) === null || _f === void 0 ? void 0 : _f.get(k);
-            const key = await presidioKey(k, original, out, ctx, vault, sessionId, hits, itemIndex, child, childPolicy);
-            setOwn(out, key, await presidioWalk(v, ctx, vault, sessionId, hits, itemIndex, child, childPolicy, lock));
+            const keyHits = [];
+            const source = value;
+            const key = await presidioKey(k, original, source, out, ctx, vault, sessionId, keyHits, itemIndex, child, childPolicy);
+            const finalChild = path ? `${path}.${key}` : key;
+            if (key !== k)
+                renamePaths(hits, child, finalChild);
+            for (const h of keyHits)
+                hits.push({ ...h, field: finalChild });
+            setOwn(out, key, await presidioWalk(v, ctx, vault, sessionId, hits, itemIndex, finalChild, childPolicy, lock));
         }
         return out;
     }

package/dist/nodes/Redactor/injection.js

@@ -206,12 +206,18 @@ exports.INJECTION_DESCRIPTIONS = [
     'Invisible Unicode characters detected',
     'Base64-encoded injection payload detected',
 ];
-const ZERO_WIDTH_RE = /(?:\u200B|\u200C|\u200D|\uFEFF|\u00AD|\u2060|\u2061|\u2062|\u2063|\u2064|\u2066|\u2067|\u2068|\u2069|\u206A|\u206B|\u206C|\u206D|\u206E|\u206F)/g;
+const ZERO_WIDTH_RE = /(?:\u200B|\u200C|\u200D|\uFEFF|\u00AD|\u2060|\u2061|\u2062|\u2063|\u2064|\u2066|\u2067|\u2068|\u2069|\u206A|\u206B|\u206C|\u206D|\u206E|\u206F)/;
 const BASE64_SUSPICIOUS_RE = /[A-Za-z0-9+/]{40,}={0,2}/g;
-const INJECTION_SEEDS = [
-    'ignore', 'override', 'system', 'prompt', 'instruction', 'jailbreak',
-    'developer mode', 'DAN', 'bypass', 'unrestricted',
-];
+const INJECTION_SEED_RE = /ignore|override|system|prompt|instruction|jailbreak|developer mode|\bdan\b|bypass|unrestricted/i;
+function messageFor(action, score, count) {
+    if (count === 0)
+        return 'No prompt injection detected.';
+    if (action === 'BLOCK')
+        return `BLOCKED: High-confidence prompt injection detected (score: ${score}). ${count} suspicious pattern(s) found.`;
+    if (action === 'FLAG')
+        return `FLAGGED: Potential prompt injection detected (score: ${score}). Review recommended.`;
+    return `Low-confidence match (score: ${score}). Likely safe but logged for review.`;
+}
 function detectPromptInjection(text) {
     if (!text || text.trim().length === 0) {
         return {
@@ -257,8 +263,7 @@ function detectPromptInjection(text) {
         for (const b64 of base64Matches.slice(0, 5)) {
             try {
                 const decoded = Buffer.from(b64, 'base64').toString('utf-8');
-                const decodedLower = decoded.toLowerCase();
-                if (INJECTION_SEEDS.some((seed) => decodedLower.includes(seed))) {
+                if (INJECTION_SEED_RE.test(decoded)) {
                     encodedPayloadsFound = true;
                     totalScore += 0.35;
                     matches.push({
@@ -284,19 +289,7 @@ function detectPromptInjection(text) {
         action = 'FLAG';
     else if (matches.length > 0)
         action = 'LOG_ONLY';
-    let message;
-    if (!matches.length) {
-        message = 'No prompt injection detected.';
-    }
-    else if (action === 'BLOCK') {
-        message = `BLOCKED: High-confidence prompt injection detected (score: ${totalScore}). ${matches.length} suspicious pattern(s) found.`;
-    }
-    else if (action === 'FLAG') {
-        message = `FLAGGED: Potential prompt injection detected (score: ${totalScore}). Review recommended.`;
-    }
-    else {
-        message = `Low-confidence match (score: ${totalScore}). Likely safe but logged for review.`;
-    }
+    const message = messageFor(action, totalScore, matches.length);
     return {
         detected: matches.length > 0,
         score: totalScore,
@@ -316,11 +309,22 @@ function collectStrings(value, path, into) {
         value.forEach((item, i) => collectStrings(item, `${path}[${i}]`, into));
     }
     else if (value !== null && typeof value === 'object') {
-        for (const [key, item] of Object.entries(value)) {
-            collectStrings(item, path ? `${path}.${key}` : key, into);
-        }
+        collectEntries(value, path, into);
     }
 }
+function collectEntries(value, path, into) {
+    const keyPath = path ? `${path} (key)` : '(key)';
+    for (const [key, item] of Object.entries(value)) {
+        if (key.trim().length > 0)
+            into.push({ path: keyPath, text: key, key: true });
+        collectStrings(item, path ? `${path}.${key}` : key, into);
+    }
+}
+function withheld(result, key) {
+    if (!key)
+        return result;
+    return { ...result, matchedPatterns: result.matchedPatterns.map((m) => ({ ...m, matchedText: '(key text withheld)' })) };
+}
 function actionFor(score, detected) {
     if (score >= 0.7)
         return 'BLOCK';
@@ -332,7 +336,7 @@ function scanForInjection(data, currentPath = '') {
     const fields = [];
     collectStrings(data, currentPath, fields);
     const found = fields
-        .map((f) => ({ path: f.path, result: detectPromptInjection(f.text) }))
+        .map((f) => ({ path: f.path, result: withheld(detectPromptInjection(f.text), f.key) }))
         .filter((f) => f.result.detected)
         .sort((a, b) => b.result.score - a.result.score || (a.path < b.path ? -1 : a.path > b.path ? 1 : 0));
     if (found.length === 0) {
@@ -341,13 +345,15 @@ function scanForInjection(data, currentPath = '') {
             encodedPayloadsFound: false, zeroWidthCharsFound: false, message: 'No prompt injection detected.',
         };
     }
-    const score = Math.min(1.0, found.slice(1).reduce((sum, f) => sum + f.result.score * 0.3, found[0].result.score));
+    const raw = found.slice(1).reduce((sum, f) => sum + f.result.score * 0.3, found[0].result.score);
+    const score = Math.round(Math.min(1.0, raw) * 100) / 100;
     const matchedPatterns = found.flatMap((f) => f.result.matchedPatterns.map((m) => ({ ...m, pattern: `[${f.path}] ${m.pattern}` })));
     return {
         ...found[0].result,
         detected: true,
         score,
         action: actionFor(score, true),
+        message: messageFor(actionFor(score, true), score, matchedPatterns.length),
         matchedPatterns,
         encodedPayloadsFound: found.some((f) => f.result.encodedPayloadsFound),
         zeroWidthCharsFound: found.some((f) => f.result.zeroWidthCharsFound),

package/dist/nodes/Redactor/names.js

@@ -1613,37 +1613,54 @@ const NOT_NAMES = new Set([
 for (const surname of ['Solangi', 'Ghaffar', 'Shaikh', 'Syed', 'Qureshi', 'Mirza', 'Abbasi', 'Awan', 'Bhutto', 'Butt', 'Chaudhry', 'Durrani', 'Gilani', 'Hashmi', 'Iqbal', 'Jatoi', 'Leghari', 'Mengal', 'Niazi', 'Raisani', 'Talpur', 'Zardari']) {
     exports.LAST_NAMES.add(surname);
 }
+const NAME_WORD = String.raw `\p{Lu}\p{Ll}*(?:\p{Lu}\p{Ll}+)*(?:['’-]\p{Lu}?\p{Ll}+(?:\p{Lu}\p{Ll}+)*)*`;
+const CAPITAL_RUN = new RegExp(String.raw `(?<![\p{L}\p{N}'’-])${NAME_WORD}(?:\s+${NAME_WORD})*(?![\p{L}\p{N}])`, 'gu');
+const MAX_NAME_WORDS = 4;
+function isKnownName(word) {
+    const parts = word.split('-').flatMap((p) => [p, p.replace(/^(?:O['’]|Mc|Mac)(?=\p{Lu})/u, '')]);
+    return parts.some((p) => exports.FIRST_NAMES.has(p) || exports.LAST_NAMES.has(p));
+}
 function detectNamesInText(text) {
     const results = [];
-    const capitalWordSeq = /\b([A-ZÀ-ÿ][a-zà-ÿ]{1,20}(?:\s+[A-ZÀ-ÿ][a-zà-ÿ]{1,20}){1,3})\b/g;
-    let match;
-    while ((match = capitalWordSeq.exec(text)) !== null) {
-        for (const run of nameRuns(match[1], match.index))
-            results.push(run);
+    for (const match of text.matchAll(CAPITAL_RUN)) {
+        if (!/\p{Ll}/u.test(match[0]))
+            continue;
+        const words = [...match[0].matchAll(/\S+/g)].map((w) => { var _a, _b; return ({ word: w[0], at: ((_a = match.index) !== null && _a !== void 0 ? _a : 0) + ((_b = w.index) !== null && _b !== void 0 ? _b : 0) }); });
+        for (const segment of nameSegments(words))
+            results.push(...chunkSegment(text, segment));
     }
     return results;
 }
-function nameRuns(sequence, offset) {
-    var _a;
-    const runs = [];
-    let words = [];
+function nameSegments(words) {
+    const segments = [];
+    let current = [];
     const flush = () => {
-        const known = words.some((w) => exports.FIRST_NAMES.has(w.word) || exports.LAST_NAMES.has(w.word));
-        if (words.length >= 2 && known) {
-            const start = offset + words[0].at;
-            const last = words[words.length - 1];
-            runs.push({ name: sequence.slice(words[0].at, last.at + last.word.length), start, end: offset + last.at + last.word.length });
-        }
-        words = [];
+        const anchored = current.some((w) => isKnownName(w.word) && !NOT_NAMES.has(w.word));
+        if (anchored)
+            segments.push(current);
+        current = [];
     };
-    for (const m of sequence.matchAll(/\S+/g)) {
-        if (NOT_NAMES.has(m[0]))
+    for (const w of words) {
+        if (NOT_NAMES.has(w.word) && !isKnownName(w.word))
             flush();
         else
-            words.push({ word: m[0], at: (_a = m.index) !== null && _a !== void 0 ? _a : 0 });
+            current.push(w);
     }
     flush();
-    return runs;
+    return segments;
+}
+function chunkSegment(text, segment) {
+    const spans = [];
+    for (let i = 0; i < segment.length; i += MAX_NAME_WORDS) {
+        const chunk = segment.slice(i, i + MAX_NAME_WORDS);
+        if (chunk.length < 2 || !chunk.some((w) => isKnownName(w.word)))
+            continue;
+        const last = chunk[chunk.length - 1];
+        const start = chunk[0].at;
+        const end = last.at + last.word.length;
+        spans.push({ name: text.slice(start, end), start, end });
+    }
+    return spans;
 }
 exports.NAME_CONTEXT_WORDS = [
     'spoke with', 'contact', 'customer', 'client', 'patient', 'employee',

package/dist/nodes/Redactor/patterns.js

@@ -21,12 +21,35 @@ function luhnCheck(num) {
 }
 const EMAIL_LOCAL = /[A-Za-z0-9._%+'!#$&*/=?^`{|}~-]/;
 const EMAIL_DOMAIN = /[\p{L}\p{N}.-]/u;
-const EMAIL_DOMAIN_SHAPE = /^[\p{L}\p{N}-]+(?:[.][\p{L}\p{N}-]+)*[.]\p{L}{2,}$/u;
+const EMAIL_DOMAIN_SHAPE = /^[\p{L}\p{N}-]+(?:[.][\p{L}\p{N}-]+)*[.](?:\p{L}{2,}|xn--[a-z0-9-]{2,59})$/iu;
+const QUOTED_LOCAL_MAX = 128;
+function openingQuote(text, close) {
+    for (let j = close - 1; j >= Math.max(0, close - QUOTED_LOCAL_MAX); j--) {
+        if (text[j] === '\r' || text[j] === '\n')
+            return -1;
+        if (text[j] !== '"')
+            continue;
+        let slashes = 0;
+        while (text[j - 1 - slashes] === '\\')
+            slashes++;
+        if (slashes % 2 === 0)
+            return j;
+    }
+    return -1;
+}
+function addressLiteralEnd(text, at) {
+    const close = text.indexOf(']', at + 2);
+    if (close < 0 || close - at > 64)
+        return -1;
+    const inner = text.slice(at + 2, close);
+    const v4 = /^\d{1,3}(?:[.]\d{1,3}){3}$/.test(inner) && inner.split('.').every((n) => Number(n) <= 255);
+    const v6 = /^IPv6:/i.test(inner) && isIpv6(inner.slice(5));
+    return v4 || v6 ? close + 1 : -1;
+}
 function emailLocalStart(text, at) {
     if (text[at - 1] === '"') {
-        const open = text.lastIndexOf('"', at - 2);
-        const quoted = open >= 0 ? text.slice(open + 1, at - 1) : '';
-        return quoted.length > 0 && !/[\r\n"]/.test(quoted) ? open : -1;
+        const open = openingQuote(text, at - 1);
+        return open >= 0 && open < at - 2 ? open : -1;
     }
     let start = at;
     while (start > 0 && EMAIL_LOCAL.test(text[start - 1]))
@@ -34,6 +57,8 @@ function emailLocalStart(text, at) {
     return start < at ? start : -1;
 }
 function emailDomainEnd(text, at) {
+    if (text[at + 1] === '[')
+        return addressLiteralEnd(text, at);
     let end = at + 1;
     while (end < text.length && EMAIL_DOMAIN.test(text[end]))
         end++;
@@ -62,6 +87,142 @@ function ibanCheck(iban) {
         .reduce((acc, chunk) => (parseInt(acc + chunk, 10) % 97).toString(), '');
     return parseInt(remainder, 10) === 1;
 }
+function firstAtLeast(sorted, min) {
+    let lo = 0;
+    let hi = sorted.length;
+    while (lo < hi) {
+        const mid = (lo + hi) >> 1;
+        if (sorted[mid] < min)
+            lo = mid + 1;
+        else
+            hi = mid;
+    }
+    return lo < sorted.length ? lo : -1;
+}
+function bodyEnd(text, from, limit) {
+    let end = from;
+    while (end < limit && /[A-Za-z0-9+/=:\s]/.test(text[end]))
+        end++;
+    return end;
+}
+function scanBlocks(text, header, endLine) {
+    const spans = [];
+    const starts = [...text.matchAll(header)].map((m) => { var _a; return ({ at: (_a = m.index) !== null && _a !== void 0 ? _a : 0, len: m[0].length }); });
+    const ends = [...text.matchAll(endLine)].map((m) => { var _a; return ({ at: (_a = m.index) !== null && _a !== void 0 ? _a : 0, len: m[0].length }); });
+    const endAt = ends.map((e) => e.at);
+    let reach = 0;
+    starts.forEach((s, i) => {
+        if (s.at < reach)
+            return;
+        const nextStart = i + 1 < starts.length ? starts[i + 1].at : text.length;
+        const k = firstAtLeast(endAt, s.at + s.len);
+        const end = k >= 0 && endAt[k] < nextStart ? endAt[k] + ends[k].len : bodyEnd(text, s.at + s.len, nextStart);
+        spans.push({ start: s.at, end });
+        reach = end;
+    });
+    return spans;
+}
+const scanPemKeys = (text) => scanBlocks(text, /-----BEGIN (?:RSA |DSA |EC |OPENSSH |ENCRYPTED )?PRIVATE KEY-----/g, /-----END (?:RSA |DSA |EC |OPENSSH |ENCRYPTED )?PRIVATE KEY-----/g);
+const scanPgpKeys = (text) => scanBlocks(text, /-----BEGIN PGP PRIVATE KEY BLOCK-----/g, /-----END PGP PRIVATE KEY BLOCK-----/g);
+const scanEduEmails = (text) => scanEmails(text).filter((s) => /[.]edu$/i.test(text.slice(s.start, s.end)));
+const IBAN_LENGTHS = {
+    AD: 24, AE: 23, AL: 28, AT: 20, AZ: 28, BA: 20, BE: 16, BG: 22, BH: 22, BI: 27, BR: 29, BY: 28, CH: 21, CR: 22,
+    CY: 28, CZ: 24, DE: 22, DJ: 27, DK: 18, DO: 28, EE: 20, EG: 29, ES: 24, FI: 18, FK: 18, FO: 18, FR: 27, GB: 22,
+    GE: 22, GI: 23, GL: 18, GR: 27, GT: 28, HR: 21, HU: 28, IE: 22, IL: 23, IQ: 23, IS: 26, IT: 27, JO: 30, KW: 30,
+    KZ: 20, LB: 28, LC: 32, LI: 21, LT: 20, LU: 20, LV: 21, LY: 25, MC: 27, MD: 24, ME: 22, MK: 19, MN: 20, MR: 27,
+    MT: 31, MU: 30, NI: 28, NL: 18, NO: 15, OM: 23, PK: 24, PL: 28, PS: 29, PT: 25, QA: 29, RO: 24, RS: 22, RU: 33,
+    SA: 24, SC: 31, SD: 18, SE: 24, SI: 19, SK: 24, SM: 27, SO: 23, ST: 25, SV: 28, TL: 23, TN: 24, TR: 26, UA: 29,
+    VA: 22, VG: 24, XK: 20, YE: 30,
+};
+const ALNUM = /[A-Za-z0-9]/;
+const groupGap = (text, at, compact) => { var _a; return text[at] === ' ' && compact % 4 === 0 && ALNUM.test((_a = text[at + 1]) !== null && _a !== void 0 ? _a : ''); };
+function ibanEnd(text, start, length) {
+    var _a;
+    let compact = 0;
+    let end = start;
+    while (end < text.length && compact < length) {
+        if (/[A-Z0-9]/.test(text[end]))
+            compact++;
+        else if (!groupGap(text, end, compact))
+            break;
+        end++;
+    }
+    return compact === length && !ALNUM.test((_a = text[end]) !== null && _a !== void 0 ? _a : '') ? end : -1;
+}
+function scanIbans(text) {
+    var _a;
+    const spans = [];
+    for (const m of text.matchAll(/(?<![A-Za-z0-9])([A-Z]{2})\d{2}/g)) {
+        const length = IBAN_LENGTHS[m[1]];
+        const start = (_a = m.index) !== null && _a !== void 0 ? _a : 0;
+        const end = length ? ibanEnd(text, start, length) : -1;
+        if (end > 0)
+            spans.push({ start, end });
+    }
+    return spans;
+}
+function longestCard(groups, i) {
+    let best = -1;
+    let digits = '';
+    for (let j = i; j < groups.length && digits.length + groups[j].digits.length <= 19; j++) {
+        digits += groups[j].digits;
+        if (digits.length >= 13 && luhnCheck(digits))
+            best = j;
+    }
+    return best;
+}
+function cardsInRun(groups, spans) {
+    let i = 0;
+    while (i < groups.length) {
+        const best = longestCard(groups, i);
+        if (best >= 0)
+            spans.push({ start: groups[i].start, end: groups[best].start + groups[best].digits.length });
+        i = best >= 0 ? best + 1 : i + 1;
+    }
+}
+function scanCards(text) {
+    var _a;
+    const spans = [];
+    for (const run of text.matchAll(/(?<![0-9A-Za-z_])\d+(?:[\s-]\d+)*(?![0-9A-Za-z_])/g)) {
+        const base = (_a = run.index) !== null && _a !== void 0 ? _a : 0;
+        cardsInRun([...run[0].matchAll(/\d+/g)].map((g) => { var _a; return ({ start: base + ((_a = g.index) !== null && _a !== void 0 ? _a : 0), digits: g[0] }); }), spans);
+    }
+    return spans;
+}
+function isIpv6(candidate) {
+    var _a;
+    const halves = candidate.split('::');
+    if (halves.length > 2)
+        return false;
+    const parts = (h) => (h === '' ? [] : h.split(':'));
+    const head = parts(halves[0]);
+    const tail = halves.length === 2 ? parts(halves[1]) : [];
+    const all = [...head, ...tail];
+    const last = (_a = all[all.length - 1]) !== null && _a !== void 0 ? _a : '';
+    const v4 = /^\d{1,3}(?:[.]\d{1,3}){3}$/.test(last) && last.split('.').every((n) => Number(n) <= 255);
+    const groups = all.length + (v4 ? 1 : 0);
+    if (!all.slice(0, v4 ? -1 : undefined).every((g) => /^[0-9A-Fa-f]{1,4}$/.test(g)))
+        return false;
+    return halves.length === 2 ? groups <= 7 : groups === 8;
+}
+function trimIpv6(s) {
+    let out = s;
+    while (out.endsWith('.') || (out.endsWith(':') && !out.endsWith('::')))
+        out = out.slice(0, -1);
+    return out;
+}
+const looksLikeIpv6 = (s) => s.split(':').length >= 3 && /[0-9A-Fa-f]/.test(s) && isIpv6(s);
+function scanIpv6(text) {
+    var _a;
+    const spans = [];
+    for (const m of text.matchAll(/(?<![0-9A-Za-z:.])[0-9A-Fa-f:.]*:[0-9A-Fa-f:.]*/g)) {
+        const s = trimIpv6(m[0]);
+        const start = (_a = m.index) !== null && _a !== void 0 ? _a : 0;
+        if (looksLikeIpv6(s))
+            spans.push({ start, end: start + s.length });
+    }
+    return spans;
+}
 exports.PII_PATTERNS = [
     {
         name: 'email',
@@ -83,7 +244,7 @@ exports.PII_PATTERNS = [
         name: 'phoneUK',
         label: 'PHONE_UK',
         category: 'contact',
-        regex: /\b(?:0|\+44)\s?\d{2,4}\s?\d{3,4}\s?\d{3,4}\b/g,
+        regex: /(?<![\w+])(?:0|\+44)\s?\d{2,4}\s?\d{3,4}\s?\d{3,4}\b/g,
         description: 'UK phone numbers',
     },
     {
@@ -111,21 +272,21 @@ exports.PII_PATTERNS = [
         name: 'phoneFR',
         label: 'PHONE_FR',
         category: 'contact',
-        regex: /\b(?:0|\+33)\s?\d[\s.]\d{2}[\s.]\d{2}[\s.]\d{2}[\s.]\d{2}\b/g,
+        regex: /(?<![\w+])(?:0|\+33)\s?\d[\s.]\d{2}[\s.]\d{2}[\s.]\d{2}[\s.]\d{2}\b/g,
         description: 'French phone numbers (06 12 34 56 78)',
     },
     {
         name: 'phoneNL',
         label: 'PHONE_NL',
         category: 'contact',
-        regex: /\b(?:0|\+31)\s?\d{1,3}[\s-]\d{3,4}[\s-]\d{2,4}\b/g,
+        regex: /(?<![\w+])(?:0|\+31)\s?\d{1,3}[\s-]\d{3,4}[\s-]\d{2,4}\b/g,
         description: 'Dutch phone numbers',
     },
     {
         name: 'personName',
         label: 'PERSON',
         category: 'identity',
-        regex: /\b(?:Mr\.?|Mrs\.?|Ms\.?|Miss|Dr\.?|Prof\.?|Sr\.?|Jr\.?|Herr|Frau|Monsieur|Madame|Señor|Señora)\s+[A-Z][a-zA-ZÀ-ÿ]+(?:\s+[A-Z][a-zA-ZÀ-ÿ]+){0,3}\b/g,
+        regex: /(?<![\p{L}\p{N}])(?:Mr\.?|Mrs\.?|Ms\.?|Miss|Dr\.?|Prof\.?|Sr\.?|Jr\.?|Herr|Frau|Monsieur|Madame|Señor|Señora)\s+\p{Lu}\p{Ll}*(?:\p{Lu}\p{Ll}+)*(?:['’-]\p{Lu}?\p{Ll}+(?:\p{Lu}\p{Ll}+)*)*(?:\s+\p{Lu}\p{Ll}*(?:\p{Lu}\p{Ll}+)*(?:['’-]\p{Lu}?\p{Ll}+(?:\p{Lu}\p{Ll}+)*)*){0,3}(?![\p{L}\p{N}])/gu,
         description: 'Person names with title prefixes (Mr., Mrs., Dr., etc.)',
     },
     {
@@ -312,6 +473,7 @@ exports.PII_PATTERNS = [
         label: 'CREDIT_CARD',
         category: 'financial',
         regex: /\b(?:\d[\s-]?){12,18}\d\b/g,
+        scan: scanCards,
         validate: (match) => luhnCheck(match),
         description: 'Credit/debit card numbers, 13 to 19 digits (Luhn validated)',
     },
@@ -320,6 +482,7 @@ exports.PII_PATTERNS = [
         label: 'IBAN',
         category: 'financial',
         regex: /\b[A-Z]{2}\d{2}[\s]?[\dA-Z]{4}[\s]?(?:[\dA-Z]{4}[\s]?){2,7}[\dA-Z]{1,4}\b/g,
+        scan: scanIbans,
         validate: (match) => ibanCheck(match),
         description: 'International Bank Account Numbers (IBAN checksum validated)',
     },
@@ -356,7 +519,8 @@ exports.PII_PATTERNS = [
         label: 'IPV6_ADDRESS',
         category: 'network',
         regex: /\b(?:[0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}\b|\b(?:[0-9a-fA-F]{1,4}:){1,7}:\b|\b(?:[0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}\b/g,
-        description: 'IPv6 addresses',
+        scan: scanIpv6,
+        description: 'IPv6 addresses, full, compressed (RFC 5952) and with an IPv4 tail',
     },
     {
         name: 'macAddress',
@@ -460,7 +624,7 @@ exports.PII_PATTERNS = [
         name: 'addressDE',
         label: 'ADDRESS_DE',
         category: 'location',
-        regex: /(?:[A-ZÀ-ÿa-zà-ÿ]+(?:straße|strasse|str\.|weg|gasse|platz|allee|ring|damm|ufer|chaussee))\s+\d{1,5}[a-z]?(?:\s*[,/]\s*\d{5}\s+[A-ZÀ-ÿ][a-zà-ÿ]+(?:\s+[a-zà-ÿ]+\.?\s+[A-ZÀ-ÿ][a-zà-ÿ]+)?)?/gi,
+        regex: /(?<![A-ZÀ-ÿa-zà-ÿ])(?:[A-ZÀ-ÿa-zà-ÿ]{1,60}(?:straße|strasse|str\.|weg|gasse|platz|allee|ring|damm|ufer|chaussee))\s+\d{1,5}[a-z]?(?:\s*[,/]\s*\d{5}\s+[A-ZÀ-ÿ][a-zà-ÿ]+(?:\s+[a-zà-ÿ]+\.?\s+[A-ZÀ-ÿ][a-zà-ÿ]+)?)?/gi,
         description: 'German street addresses (Musterstraße 12, 80331 München)',
     },
     {
@@ -768,7 +932,7 @@ exports.PII_PATTERNS = [
         name: 'ldapDN',
         label: 'LDAP_DN',
         category: 'enterprise',
-        regex: /(?:CN|OU|DC|O|C|L|ST)=[^,]+(?:,\s*(?:CN|OU|DC|O|C|L|ST)=[^,]+){1,}/gi,
+        regex: /(?<![A-Za-z])(?:CN|OU|DC|O|C|L|ST)=[^,]{1,256}(?:,\s*(?:CN|OU|DC|O|C|L|ST)=[^,]{1,256}){1,32}/gi,
         description: 'LDAP Distinguished Names (CN=...,OU=...,DC=...)',
     },
     {
@@ -796,7 +960,7 @@ exports.PII_PATTERNS = [
         name: 'connStringKV',
         label: 'CONN_STRING',
         category: 'enterprise',
-        regex: /(?:Server|Data Source|Host)=[^;]+;[^;]*(?:;[^;]*){0,10}(?:Password|Pwd)=[^;]+/gi,
+        regex: /(?<![A-Za-z])(?:Server|Data Source|Host)=[^;]{1,512};[^;]{0,512}(?:;[^;]{0,512}){0,10}(?:Password|Pwd)=[^;]{1,512}/gi,
         description: 'Connection strings with credentials (ADO.NET / key=value style)',
     },
     {
@@ -860,6 +1024,8 @@ exports.PII_PATTERNS = [
         label: 'PRIVATE_KEY',
         category: 'enterprise',
         regex: /-----BEGIN (RSA |DSA |EC |OPENSSH |ENCRYPTED )?PRIVATE KEY-----(?:[\s\S]*?-----END \1?PRIVATE KEY-----|[A-Za-z0-9+/=\s]*)/g,
+        anchor: '-----BEGIN',
+        scan: scanPemKeys,
         description: 'PEM private keys, the whole block through the END line',
     },
     {
@@ -978,35 +1144,35 @@ exports.PII_PATTERNS = [
         name: 'phoneES',
         label: 'PHONE_ES',
         category: 'contact',
-        regex: /\b(?:\+?34[\s\-.]?)?\d{3}[\s\-.]\d{3}[\s\-.]\d{3}\b/g,
+        regex: /(?<![\w+])(?:\+?34[\s\-.]?)?\d{3}[\s\-.]\d{3}[\s\-.]\d{3}\b/g,
         description: 'Spanish phone numbers',
     },
     {
         name: 'phoneAU',
         label: 'PHONE_AU',
         category: 'contact',
-        regex: /\b(?:\+?61[\s\-.]?)?0?\d[\s\-.]\d{4}[\s\-.]\d{4}\b/g,
+        regex: /(?<![\w+])(?:\+?61[\s\-.]?)?0?\d[\s\-.]\d{4}[\s\-.]\d{4}\b/g,
         description: 'Australian phone numbers',
     },
     {
         name: 'phoneIN',
         label: 'PHONE_IN',
         category: 'contact',
-        regex: /\b(?:\+?91[\s\-.]?)?[6-9]\d{4}[\s\-.]\d{5}\b/g,
+        regex: /(?<![\w+])(?:\+?91[\s\-.]?)?[6-9]\d{4}[\s\-.]\d{5}\b/g,
         description: 'Indian phone numbers',
     },
     {
         name: 'phoneJP',
         label: 'PHONE_JP',
         category: 'contact',
-        regex: /\b(?:\+?81[\s\-.]?)?0?\d{1,4}[\s\-.]\d{1,4}[\s\-.]\d{4}\b/g,
+        regex: /(?<![\w+])(?:\+?81[\s\-.]?)?0?\d{1,4}[\s\-.]\d{1,4}[\s\-.]\d{4}\b/g,
         description: 'Japanese phone numbers',
     },
     {
         name: 'phoneBR',
         label: 'PHONE_BR',
         category: 'contact',
-        regex: /\b(?:\+?55[\s\-.]?)?\(?\d{2}\)?[\s\-.]?\d{4,5}[\s\-.]\d{4}\b/g,
+        regex: /(?<![\w+])(?:\+?55[\s\-.]?)?\(?\d{2}\)?[\s\-.]?\d{4,5}[\s\-.]\d{4}\b/g,
         description: 'Brazilian phone numbers',
     },
     {
@@ -1020,35 +1186,35 @@ exports.PII_PATTERNS = [
         name: 'phoneCN',
         label: 'PHONE_CN',
         category: 'contact',
-        regex: /\b(?:\+?86[\s\-.]?)?1[3-9]\d{9}\b/g,
+        regex: /(?<![\w+])(?:\+?86[\s\-.]?)?1[3-9]\d{9}\b/g,
         description: 'Chinese mobile phone numbers',
     },
     {
         name: 'phoneKR',
         label: 'PHONE_KR',
         category: 'contact',
-        regex: /\b(?:\+?82[\s\-.]?)?0?\d{1,2}[\s\-.]\d{3,4}[\s\-.]\d{4}\b/g,
+        regex: /(?<![\w+])(?:\+?82[\s\-.]?)?0?\d{1,2}[\s\-.]\d{3,4}[\s\-.]\d{4}\b/g,
         description: 'South Korean phone numbers',
     },
     {
         name: 'phoneRU',
         label: 'PHONE_RU',
         category: 'contact',
-        regex: /\b(?:\+?7[\s\-.]?)?\d{3}[\s\-.]\d{3}[\s\-.]\d{2}[\s\-.]\d{2}\b/g,
+        regex: /(?<![\w+])(?:\+?7[\s\-.]?)?\d{3}[\s\-.]\d{3}[\s\-.]\d{2}[\s\-.]\d{2}\b/g,
         description: 'Russian phone numbers',
     },
     {
         name: 'phoneMX',
         label: 'PHONE_MX',
         category: 'contact',
-        regex: /\b(?:\+?52[\s\-.]?)?\d{2,3}[\s\-.]\d{3,4}[\s\-.]\d{4}\b/g,
+        regex: /(?<![\w+])(?:\+?52[\s\-.]?)?\d{2,3}[\s\-.]\d{3,4}[\s\-.]\d{4}\b/g,
         description: 'Mexican phone numbers',
     },
     {
         name: 'phoneZA',
         label: 'PHONE_ZA',
         category: 'contact',
-        regex: /\b(?:\+?27[\s\-.]?)?0?\d{2}[\s\-.]\d{3}[\s\-.]\d{4}\b/g,
+        regex: /(?<![\w+])(?:\+?27[\s\-.]?)?0?\d{2}[\s\-.]\d{3}[\s\-.]\d{4}\b/g,
         description: 'South African phone numbers',
     },
     {
@@ -1483,6 +1649,8 @@ exports.PII_PATTERNS = [
         label: 'PGP_KEY',
         category: 'enterprise',
         regex: /-----BEGIN PGP PRIVATE KEY BLOCK-----(?:[\s\S]*?-----END PGP PRIVATE KEY BLOCK-----|[A-Za-z0-9+/=:\s]*)/g,
+        anchor: '-----BEGIN',
+        scan: scanPgpKeys,
         description: 'PGP private key blocks, the whole block through the END line',
     },
     {
@@ -1574,6 +1742,8 @@ exports.PII_PATTERNS = [
         label: 'EDU_EMAIL',
         category: 'contact',
         regex: /[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.edu/g,
+        anchor: '@',
+        scan: scanEduEmails,
         description: 'Educational email addresses (.edu)',
     },
     {

package/dist/nodes/Redactor/presidio.js

@@ -6,6 +6,7 @@ exports.analyzeWithPresidio = analyzeWithPresidio;
 exports.getRedactorLabel = getRedactorLabel;
 exports.getRedactorCategory = getRedactorCategory;
 exports.getPresidioEntities = getPresidioEntities;
+const patterns_1 = require("./patterns");
 const PRESIDIO_TO_REDACTOR_LABEL = {
     PERSON: 'PERSON_NAME',
     EMAIL_ADDRESS: 'EMAIL',
@@ -132,7 +133,10 @@ function getRedactorLabel(presidioEntityType) {
     return PRESIDIO_TO_REDACTOR_LABEL[presidioEntityType] || presidioEntityType;
 }
 function getRedactorCategory(presidioEntityType) {
-    return PRESIDIO_TO_CATEGORY[presidioEntityType] || 'identity';
+    var _a, _b;
+    const label = getRedactorLabel(presidioEntityType);
+    const builtIn = patterns_1.PII_PATTERNS.find((p) => p.label === label);
+    return (_b = (_a = builtIn === null || builtIn === void 0 ? void 0 : builtIn.category) !== null && _a !== void 0 ? _a : PRESIDIO_TO_CATEGORY[presidioEntityType]) !== null && _b !== void 0 ? _b : 'identity';
 }
 async function getPresidioEntities(baseUrl, request) {
     if (!request || !isHttpUrl(baseUrl))

package/dist/nodes/Redactor/regexSafety.js

@@ -4,7 +4,7 @@ exports.checkRegex = checkRegex;
 const regexCharset_1 = require("./regexCharset");
 const MAX_REGEX_LENGTH = 500;
 const newFrame = (zeroWidth = false, inLook = zeroWidth) => ({
-    hasVariableQuantifier: false, hasAlternation: false, run: null, chars: (0, regexCharset_1.emptySet)(), zeroWidth,
+    hasVariableQuantifier: false, hasAlternation: false, run: null, altRun: null, chars: (0, regexCharset_1.emptySet)(), zeroWidth,
     branchConsumes: false, allConsume: true, nullable: false, inLook,
 });
 function endBranch(frame) {
@@ -58,6 +58,7 @@ function alternation(stack, i) {
     const top = stack[stack.length - 1];
     top.hasAlternation = true;
     top.run = null;
+    top.altRun = null;
     endBranch(top);
     return { atomEnd: i, closed: null, next: i + 1 };
 }
@@ -103,6 +104,7 @@ function applyQuantifier(q, closed, top) {
     return null;
 }
 const SEQUENTIAL = 'two repetitions in a row can match the same characters (catastrophic backtracking)';
+const CHAINED = 'two groups of alternatives in a row can match the same characters (catastrophic backtracking)';
 function applySequence(chars, variable, required, top) {
     if (chars === null)
         return null;
@@ -117,6 +119,19 @@ function applySequence(chars, variable, required, top) {
         top.run = null;
     return null;
 }
+function applyBranching(chars, branching, required, top) {
+    if (chars === null)
+        return null;
+    const shared = top.altRun !== null && (0, regexCharset_1.overlaps)(top.altRun, chars);
+    if (branching) {
+        if (shared)
+            return CHAINED;
+        top.altRun = top.altRun ? (0, regexCharset_1.union)(top.altRun, chars) : chars;
+    }
+    else if (required && !shared)
+        top.altRun = null;
+    return null;
+}
 function stepChars(src, i, step) {
     const closed = step.closed;
     if (!closed)
@@ -140,8 +155,10 @@ function stepProblem(src, i, step, q, top) {
     const required = consumes(q, chars, step.closed);
     if (required)
         top.branchConsumes = true;
-    return applySequence(chars, isVariable(q) || !!((_a = step.closed) === null || _a === void 0 ? void 0 : _a.hasVariableQuantifier), required, top);
+    return (_a = applyBranching(chars, isBranching(step.closed), required, top)) !== null && _a !== void 0 ? _a : applySequence(chars, variesInLength(q, step.closed), required, top);
 }
+const isBranching = (closed) => !!(closed === null || closed === void 0 ? void 0 : closed.hasAlternation) && !closed.zeroWidth;
+const variesInLength = (q, closed) => isVariable(q) || !!(closed === null || closed === void 0 ? void 0 : closed.hasVariableQuantifier);
 function structuralProblem(src) {
     const stack = [newFrame()];
     let i = 0;

package/dist/nodes/Redactor/vault.js

@@ -106,20 +106,26 @@ class MemoryVault {
             return;
         assertNoConflict(session, entry);
         session.entries[entry.token] = entry;
-        if (!reverseIndex.has(key))
-            reverseIndex.set(key, new Map());
-        reverseIndex.get(key).set(entry.original, entry);
+        const index = this.index(key, session);
+        const first = index.get(entry.original);
+        if (!first || first.token === entry.token)
+            index.set(entry.original, entry);
     }
     findByOriginal(sessionId, original) {
-        var _a;
         const key = this.key(sessionId);
-        const entry = (_a = reverseIndex.get(key)) === null || _a === void 0 ? void 0 : _a.get(original);
-        if (entry)
-            return entry;
         const session = memoryStore.get(key);
-        if (!session)
-            return undefined;
-        return Object.values(session.entries).find((e) => e.original === original);
+        return session ? this.index(key, session).get(original) : undefined;
+    }
+    index(key, session) {
+        let index = reverseIndex.get(key);
+        if (!index) {
+            index = new Map();
+            for (const e of Object.values(session.entries))
+                if (!index.has(e.original))
+                    index.set(e.original, e);
+            reverseIndex.set(key, index);
+        }
+        return index;
     }
     deleteSession(sessionId) {
         this.drop(this.key(sessionId));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "n8n-nodes-redactor",
-  "version": "6.0.0",
+  "version": "6.1.0",
   "description": "Redact, mask and anonymize PII before it reaches an LLM, then restore it. 216 patterns for emails, phones, addresses, IBAN, cards, names, SSN, passport and tax IDs. Reversible encrypted vault, GDPR Art.30 ROPA record, prompt-injection check. Runs on n8n Cloud and self-hosted n8n 2.x.",
   "keywords": [
     "n8n-community-node-package",