camada 0.1.5 → 0.2.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 86d9659607a031e6d4802b62fa614a63c5cf682c8b25ad753e08dad5d5890f04
-  data.tar.gz: 3837b8f2e624efdca08154e3dabe053c4e924af155688be40a2980c59d9370c6
+  metadata.gz: 6ff3ec1e73a6da51f20af06916fb4438fe50fc9fa87a9023445e90561c1a7cf8
+  data.tar.gz: d9d10163bdb349345ccb3a65666966624640fef0352d4727f848485abc0ea734
 SHA512:
-  metadata.gz: 4b5eaee46ab80bf9d7b8af4fb2499461c4a2ad3a3ba604f691d77bef227eceb97d9698a1a37688bbc2e87949059f86569103cb43b83e96331012d22bae9bf0ee
-  data.tar.gz: 99709f2521ed91d8be8dd8714396e7184667814581c401031f33ba9d1b55ad5edda46a5d65139f5fdac44cc918974c768f544919e5ecb9f2fceeb6c6cfde8cf3
+  metadata.gz: 42beca1c8a2d5299814aa3b09963e21963e0e25344238e70cf087d19d484feb7cd91dbaae8930ec0c5236eb77c6906c5f9de1b5cd265704798061a99fae40040
+  data.tar.gz: 79148a9dd5427db583f916520b64726a6baede851368a2677a55e846ed6f4ed83500ec020544b6ba90c263ee189d42acd8c11a52f8f1a2a713d908d7d867476f

data/README.md

@@ -94,8 +94,9 @@ use Camada::Rack, engine
    A block answers `403 Forbidden` with `x-block-reason`, `x-block-version` and, when a rule
    decided, `x-block-rule`; its event ships with `blk` (and `rl`). A `warn` rule passes and stamps
    `wrn`; a `skip` rule passes with nothing stamped. Cold (no snapshot yet) passes: fail open.
-4. Challenge: a `challenge` verdict gets the self-contained proof-of-work page (or 403 JSON for a
-   non-HTML request); `POST /__camada/challenge` verifies the solution, sets `_cch` (bound to the
+4. Challenge: a `challenge` verdict gets the self-contained proof-of-work page on a page load. Any other
+   request passes to your app signalled: `x-camada-challenge: 1`, `cache-control: no-store` and the CDN cache headers (replacing
+   yours) and `chs: 1` on its event, which ships whatever `sample` and `exclude` say; `POST /__camada/challenge` verifies the solution, sets `_cch` (bound to the
    ip, one hour) and 302s back. A request whose ip cannot be resolved is never challenged. The page
    carries its own `Content-Security-Policy` (its inline solver and style by hash, nothing else)
    and replaces any policy your app set on it (Rails' `content_security_policy`,
@@ -161,7 +162,8 @@ event name is free-form; the analyst's app-context rules read this vocabulary:
 
 A route you gate yourself: `Camada.serve_challenge(env)` returns a Rack triple
 `[status, headers, [body]]` to answer with (Sinatra: `halt(*answer)`) until the browser holds a
-valid `_cch`, then `nil`.
+valid `_cch`, then `nil`. A non-page (non-HTML) request also gets `nil` and is signalled
+(`x-camada-challenge: 1`, `no-store`, `chs: 1`).
 
 ## What this tap can see
 
@@ -175,7 +177,11 @@ at this position covers ip, path, user-agent and header conditions — ASN, coun
 fail open in-app. `matches` patterns are JS regexes read by Ruby's Onigmo: named groups are
 native, `[^]` and `\cX` are translated, `^`/`$` become `\A`/`\z` (Ruby's are line anchors,
 JS's are not), `\d`/`\w`/`\b` are ASCII as in JS; a spelling Ruby still rejects never matches
-here (and never raises), while it does at the edge.
+here (and never raises), while it does at the edge. An astral character (an emoji, say) is one
+character here and two UTF-16 units at the edge, so a pattern that counts characters around one
+(`^.$`, `.{2}`, `[^a]`, `\S`) or puts one in a class or before a quantifier can disagree; `.*`
+and a bare emoji agree. A repeated capture group whose body can match empty (as in `((x?[ab]*)+?[ab]){2}`) can
+match differently here than at the edge: that is an Onigmo engine difference.
 
 ## Deploying it
 

data/lib/camada/beacon_js.rb

@@ -4,7 +4,7 @@
 # dist/auto.global.js) vendored as a String literal: served at /_cam/b.js with no runtime file
 # read. spec/beacon_js_spec.rb pins it to the sibling build byte for byte.
 module Camada
-  BEACON_VERSION = "0.3.2"
-  BEACON_SHA256 = "3a9d99002ad5bae090043b26646378287f179cc1f1fd65934ebd00e9d1fd05cf"
-  BEACON_JS = "\"use strict\";(()=>{var k=\"0.3.2\";var _=\"@camada/browser\";var b=`${_}/${k}`;function t(n){try{return n()}catch{return null}}function x(n){let e=2166136261;for(let i=0;i<n.length;i++)e^=n.charCodeAt(i),e=Math.imul(e,16777619);return(e>>>0).toString(16)}function M(){let n=document.createElement(\"canvas\");n.width=240,n.height=60;let e=n.getContext(\"2d\");return e?(e.textBaseline=\"alphabetic\",e.fillStyle=\"#f60\",e.fillRect(120,5,60,20),e.fillStyle=\"#069\",e.font=\"15px Arial\",e.fillText(\"Sfp\\u2603 1.0\",2,15),e.fillStyle=\"rgba(102,204,0,0.7)\",e.font=\"17px Times\",e.fillText(\"Sfp\\u2603 1.0\",4,45),x(n.toDataURL())):null}function R(){let n=document.createElement(\"canvas\"),e=n.getContext(\"webgl\")||n.getContext(\"experimental-webgl\");if(!e)return null;let i=e.getExtension(\"WEBGL_debug_renderer_info\");return{v:i?e.getParameter(i.UNMASKED_VENDOR_WEBGL):e.getParameter(e.VENDOR),r:i?e.getParameter(i.UNMASKED_RENDERER_WEBGL):e.getParameter(e.RENDERER)}}function S(){return x([Math.tan(-1e300),Math.sinh(1),Math.expm1(1),Math.cbrt(100),Math.log1p(10),Math.atanh(.5)].join(\"|\"))}var N=/^\\$?cdc_|^__webdriver|^__selenium|^__nightmare|^__playwright|^callPhantom/,L=/^\\$?cdc_|^__webdriver|^__selenium|^__nightmare|^__playwright|^callPhantom|^_phantom/;function j(){let n=document,e=navigator,i=window,o=0;for(let s in n)N.test(s)&&o++;for(let s in i)L.test(s)&&o++;return{wd:e.webdriver===!0?1:0,cdc:o,chrome:typeof i.chrome<\"u\"?1:0,plugins:e.plugins?e.plugins.length:-1,langs:e.languages?e.languages.length:-1,outer:window.outerWidth===0&&window.outerHeight===0?1:0,perm:t(()=>Notification.permission),pdf:typeof e.pdfViewerEnabled==\"boolean\"?e.pdfViewerEnabled?1:0:-1,err:t(()=>{try{null.x}catch(s){let c=s.stack;return c?c.split(`\n`).length:0}})}}function T({endpoint:n,rid:e}){let i=e||null,o=performance.now(),s=0,c=0,m=0,f=0,h=0,u=null;function l(){u===null&&(u=Math.round(performance.now()-o))}addEventListener(\"mousemove\",()=>{s++,l()},{passive:!0}),addEventListener(\"scroll\",()=>{c++,l()},{passive:!0}),addEventListener(\"keydown\",()=>{m++,l()},{passive:!0}),addEventListener(\"touchstart\",()=>{f++,l()},{passive:!0}),addEventListener(\"click\",()=>{h++,l()},{passive:!0});function w(){let r=navigator,a=t(()=>performance.getEntriesByType(\"navigation\")[0]),D=t(()=>{let p=performance.getEntriesByType(\"paint\");return p.length?Math.round(p[p.length-1].startTime):null}),d=t(()=>r.connection)||{};return{sdk:b,rid:i,ts:Date.now(),scr:t(()=>[screen.width,screen.height,screen.availWidth,screen.availHeight,screen.colorDepth]),win:t(()=>[window.innerWidth,window.innerHeight,window.outerWidth,window.outerHeight]),dpr:t(()=>window.devicePixelRatio),tz:t(()=>Intl.DateTimeFormat().resolvedOptions().timeZone),tzo:t(()=>new Date().getTimezoneOffset()),lang:t(()=>r.language),langs:t(()=>r.languages?Array.prototype.slice.call(r.languages,0,5):null),plat:t(()=>r.platform),cores:t(()=>r.hardwareConcurrency),mem:t(()=>r.deviceMemory),touch:t(()=>r.maxTouchPoints),ua:t(()=>r.userAgent),dnt:t(()=>r.doNotTrack),cookies:t(()=>r.cookieEnabled?1:0),conn:t(()=>[d.effectiveType,d.rtt,d.downlink,d.saveData?1:0]),gl:t(R),cv:t(M),mf:t(S),auto:t(j),vis:t(()=>document.visibilityState),focus:t(()=>document.hasFocus()?1:0),timing:a?[Math.round(a.domContentLoadedEventEnd),Math.round(a.loadEventEnd),Math.round(a.responseEnd-a.requestStart)]:null,paint:D,input:{moves:s,scrolls:c,keys:m,touches:f,clicks:h,first:u,at:Math.round(performance.now()-o)}}}function v(r){let a=JSON.stringify(r?Object.assign(w(),{hi:r}):w());navigator.sendBeacon&&navigator.sendBeacon(n,new Blob([a],{type:\"application/json\"}))||fetch(n,{method:\"POST\",body:a,keepalive:!0,headers:{\"content-type\":\"application/json\"}}).catch(()=>{})}let g=navigator.userAgentData,E=g&&g.getHighEntropyValues?g.getHighEntropyValues([\"architecture\",\"bitness\",\"model\",\"platformVersion\",\"fullVersionList\"]).catch(()=>null):Promise.resolve(null);setTimeout(()=>{E.then(v)},2e3),addEventListener(\"pagehide\",()=>{E.then(r=>{v(r)})},{once:!0})}function O(n){let e=new URL(n,\"http://_\"),i=e.pathname.split(\"/\");return i[i.length-1]=\"fp\",{endpoint:i.join(\"/\"),rid:e.searchParams.get(\"r\")}}(function(){try{let n=document.currentScript,e=n&&n.src;if(!e)return;let{endpoint:i,rid:o}=O(e);T({endpoint:i,rid:o})}catch{}})();})();\n"
+  BEACON_VERSION = "0.4.0"
+  BEACON_SHA256 = "59233fa412e6f2f1b09a851e3ccf8021c8dd550476004bf1e280bf1511d7bf7e"
+  BEACON_JS = "\"use strict\";(()=>{var k=\"0.4.0\";var _=\"@camada/browser\";var b=`${_}/${k}`;function t(n){try{return n()}catch{return null}}function x(n){let e=2166136261;for(let i=0;i<n.length;i++)e^=n.charCodeAt(i),e=Math.imul(e,16777619);return(e>>>0).toString(16)}function M(){let n=document.createElement(\"canvas\");n.width=240,n.height=60;let e=n.getContext(\"2d\");return e?(e.textBaseline=\"alphabetic\",e.fillStyle=\"#f60\",e.fillRect(120,5,60,20),e.fillStyle=\"#069\",e.font=\"15px Arial\",e.fillText(\"Sfp\\u2603 1.0\",2,15),e.fillStyle=\"rgba(102,204,0,0.7)\",e.font=\"17px Times\",e.fillText(\"Sfp\\u2603 1.0\",4,45),x(n.toDataURL())):null}function R(){let n=document.createElement(\"canvas\"),e=n.getContext(\"webgl\")||n.getContext(\"experimental-webgl\");if(!e)return null;let i=e.getExtension(\"WEBGL_debug_renderer_info\");return{v:i?e.getParameter(i.UNMASKED_VENDOR_WEBGL):e.getParameter(e.VENDOR),r:i?e.getParameter(i.UNMASKED_RENDERER_WEBGL):e.getParameter(e.RENDERER)}}function S(){return x([Math.tan(-1e300),Math.sinh(1),Math.expm1(1),Math.cbrt(100),Math.log1p(10),Math.atanh(.5)].join(\"|\"))}var N=/^\\$?cdc_|^__webdriver|^__selenium|^__nightmare|^__playwright|^callPhantom/,L=/^\\$?cdc_|^__webdriver|^__selenium|^__nightmare|^__playwright|^callPhantom|^_phantom/;function j(){let n=document,e=navigator,i=window,o=0;for(let s in n)N.test(s)&&o++;for(let s in i)L.test(s)&&o++;return{wd:e.webdriver===!0?1:0,cdc:o,chrome:typeof i.chrome<\"u\"?1:0,plugins:e.plugins?e.plugins.length:-1,langs:e.languages?e.languages.length:-1,outer:window.outerWidth===0&&window.outerHeight===0?1:0,perm:t(()=>Notification.permission),pdf:typeof e.pdfViewerEnabled==\"boolean\"?e.pdfViewerEnabled?1:0:-1,err:t(()=>{try{null.x}catch(s){let c=s.stack;return c?c.split(`\n`).length:0}})}}function T({endpoint:n,rid:e}){let i=e||null,o=performance.now(),s=0,c=0,m=0,f=0,h=0,u=null;function l(){u===null&&(u=Math.round(performance.now()-o))}addEventListener(\"mousemove\",()=>{s++,l()},{passive:!0}),addEventListener(\"scroll\",()=>{c++,l()},{passive:!0}),addEventListener(\"keydown\",()=>{m++,l()},{passive:!0}),addEventListener(\"touchstart\",()=>{f++,l()},{passive:!0}),addEventListener(\"click\",()=>{h++,l()},{passive:!0});function w(){let r=navigator,a=t(()=>performance.getEntriesByType(\"navigation\")[0]),D=t(()=>{let p=performance.getEntriesByType(\"paint\");return p.length?Math.round(p[p.length-1].startTime):null}),d=t(()=>r.connection)||{};return{sdk:b,rid:i,ts:Date.now(),scr:t(()=>[screen.width,screen.height,screen.availWidth,screen.availHeight,screen.colorDepth]),win:t(()=>[window.innerWidth,window.innerHeight,window.outerWidth,window.outerHeight]),dpr:t(()=>window.devicePixelRatio),tz:t(()=>Intl.DateTimeFormat().resolvedOptions().timeZone),tzo:t(()=>new Date().getTimezoneOffset()),lang:t(()=>r.language),langs:t(()=>r.languages?Array.prototype.slice.call(r.languages,0,5):null),plat:t(()=>r.platform),cores:t(()=>r.hardwareConcurrency),mem:t(()=>r.deviceMemory),touch:t(()=>r.maxTouchPoints),ua:t(()=>r.userAgent),dnt:t(()=>r.doNotTrack),cookies:t(()=>r.cookieEnabled?1:0),conn:t(()=>[d.effectiveType,d.rtt,d.downlink,d.saveData?1:0]),gl:t(R),cv:t(M),mf:t(S),auto:t(j),vis:t(()=>document.visibilityState),focus:t(()=>document.hasFocus()?1:0),timing:a?[Math.round(a.domContentLoadedEventEnd),Math.round(a.loadEventEnd),Math.round(a.responseEnd-a.requestStart)]:null,paint:D,input:{moves:s,scrolls:c,keys:m,touches:f,clicks:h,first:u,at:Math.round(performance.now()-o)}}}function v(r){let a=JSON.stringify(r?Object.assign(w(),{hi:r}):w());navigator.sendBeacon&&navigator.sendBeacon(n,new Blob([a],{type:\"application/json\"}))||fetch(n,{method:\"POST\",body:a,keepalive:!0,headers:{\"content-type\":\"application/json\"}}).catch(()=>{})}let g=navigator.userAgentData,E=g&&g.getHighEntropyValues?g.getHighEntropyValues([\"architecture\",\"bitness\",\"model\",\"platformVersion\",\"fullVersionList\"]).catch(()=>null):Promise.resolve(null);setTimeout(()=>{E.then(v)},2e3),addEventListener(\"pagehide\",()=>{E.then(r=>{v(r)})},{once:!0})}function O(n){let e=new URL(n,\"http://_\"),i=e.pathname.split(\"/\");return i[i.length-1]=\"fp\",{endpoint:i.join(\"/\"),rid:e.searchParams.get(\"r\")}}(function(){try{let n=document.currentScript,e=n&&n.src;if(!e)return;let{endpoint:i,rid:o}=O(e);T({endpoint:i,rid:o})}catch{}})();})();\n"
 end

data/lib/camada/constants.rb

@@ -19,6 +19,9 @@ module Camada
   FP_MAX = 32 * 1024                # matches the server's /fp cap: never accept what ingest will 413
   CHALLENGE_PATH = "/__camada/challenge"
   BODY_MAX = 4 * 1024               # the verify form is ~120 bytes; anything larger is not ours
+  # Row keys only the SDK can attest (TLS/network facts, outcome, session, track()). A beacon body is the
+  # visitor's, so these never ride a sig:1 row; the analyst joins them from the beacon's request row.
+  REQUEST_ROW_KEYS = %w[tlsx ja4 asn cc sid ns st dur rt blk rl wrn chs ch et uid].freeze
 
   SESSION_COOKIE = "_sfp"           # same cookie as the edge collector: sid/ns comparable across taps
   SESSION_MAX_AGE = 2_592_000       # 30 days

data/lib/camada/engine.rb

@@ -83,6 +83,8 @@ module Camada
   # done. Everything runs inside the fail-open envelope: a camada bug must never 5xx the customer,
   # and CAMADA_DISABLED=1 bypasses the SDK entirely.
   class Engine
+    NO_STORE_HEADERS = %w[cache-control cdn-cache-control surrogate-control cloudflare-cdn-cache-control
+                          vercel-cdn-cache-control netlify-cdn-cache-control].freeze
     CHALLENGE_HEADERS = { "cache-control" => "no-store", "x-camada-challenge" => "1" }.freeze
 
     attr_reader :env, :snap, :queue, :kit, :script_path, :fp_path, :challenge_path, :challenge_on
@@ -148,8 +150,9 @@ module Camada
     end
 
     # Serve the challenge for this request on demand — for a route the app wants to gate itself.
-    # nil when the client already holds a valid _cch (render your own page), or when the client
-    # cannot be identified (fail open).
+    # nil when the client already holds a valid _cch (render your own page), when the client
+    # cannot be identified (fail open), or when it is not a page load: that request is signalled
+    # instead (`x-camada-challenge: 1`, `chs: 1`) and the app renders.
     def serve_challenge(ctx)
       return nil if disabled? || @kit.nil? || ctx.nil?
 
@@ -157,6 +160,11 @@ module Camada
       ip = ctx["ip"]
       return nil if req.nil? || ip.nil? || ip.empty? || challenge_passed?(req, ip)
 
+      unless Challenge.wants_html?(req.header("accept"), req.header("sec-fetch-dest"))
+        ctx["signalled"] = true
+        return nil
+      end
+
       ctx["challenged"] = true
       serve_challenge_answer(req, ip, ctx["sid"])
     rescue StandardError => e
@@ -230,11 +238,18 @@ module Camada
       # A challenge needs a resolved client IP: the nonce and the _cch cookie are bound to it,
       # so without one a single solve would mint a cookie every unidentified client could
       # present. No ip -> no challenge (fail open), the same stance ip rules take.
+      signalled = false
       if @challenge_on && ip && !ip.empty?
         # The verify endpoint answers first: a challenged client must be able to reach it.
         return verify(req, body, ip) if req.method == "POST" && req.path == @challenge_path
+
         if v.challenge && !challenge_passed?(req, ip)
-          return serve_challenge_answer(req, ip, Camada.cookie_value(req.header("cookie"), SESSION_COOKIE))
+          # Only a page load can be challenged; anything else passes, signalled (camada-all-7cgs).
+          if Challenge.wants_html?(req.header("accept"), req.header("sec-fetch-dest"))
+            return serve_challenge_answer(req, ip, Camada.cookie_value(req.header("cookie"), SESSION_COOKIE))
+          end
+
+          signalled = true
         end
       end
 
@@ -256,6 +271,7 @@ module Camada
         set_cookie += "; Secure" if secure?(req)
       end
       ctx = { "rid" => rid, "sid" => sid, "ip" => ip, "_req" => req, "_engine" => self }
+      ctx["signalled"] = true if signalled
 
       cfg = @snap.config || {}
       excluded = (cfg["exclude"] || []).any? { |x| req.path.start_with?(x.to_s) }
@@ -266,9 +282,12 @@ module Camada
       on_finish = lambda do |status|
         # serve_challenge may have answered from inside the app, and it already shipped the
         # `blk: "challenge"` row — one request, one event.
-        next if ctx["challenged"] || excluded || !sampled
+        next if ctx["challenged"]
+        # a signalled row ships whatever sample and exclude say, like the 403 row it replaces
+        next if !ctx["signalled"] && (excluded || !sampled)
 
         ev = event(req, rid, sid, new_session, ip)
+        ev["chs"] = 1 if ctx["signalled"] # challenge signalled (contract §A3)
         ev["ts"] = ts0
         ev["st"] = status
         ev["dur"] = ((Process.clock_gettime(Process::CLOCK_MONOTONIC) - t0) * 1000).to_i
@@ -299,7 +318,8 @@ module Camada
       parsed = Camada.parse_json(body)
       return answer unless parsed.is_a?(Hash)
 
-      @queue.push(parsed.merge("sig" => 1, "ip" => ip, "tap" => TAP)) # spread first: ip and tap are the server's word
+      # spread first: ip, tap and rts (the relay clock) are the server's word
+      @queue.push(parsed.except(*REQUEST_ROW_KEYS).merge!("sig" => 1, "ip" => ip, "tap" => TAP, "rts" => now_ms))
       answer
     end
 
@@ -318,17 +338,10 @@ module Camada
       Answer.new(status: 403, headers: headers, body: html)
     end
 
-    # 403 + the proof-of-work page (HTML navigations) or 403 JSON (everything else), plus the
-    # `blk: "challenge"` event — a served challenge is reported like a block (contract §D2).
+    # 403 + the proof-of-work page, plus the `blk: "challenge"` event — a served challenge is
+    # reported like a block (contract §D2). Callers pass page loads only.
     def serve_challenge_answer(req, ip, sid)
-      to = Challenge.safe_return_to(req.path + req.query)
-      answer =
-        if Challenge.wants_html?(req.header("accept"), req.header("sec-fetch-dest"))
-          page(ip, to)
-        else
-          Answer.new(status: 403, headers: CHALLENGE_HEADERS.merge("content-type" => "application/json"),
-                     body: '{"error":"challenge_required"}')
-        end
+      answer = page(ip, Challenge.safe_return_to(req.path + req.query))
       begin
         ev = event(req, SecureRandom.uuid, sid, false, ip)
         ev["st"] = 403

data/lib/camada/rack.rb

@@ -168,6 +168,7 @@ module Camada
         raise
       end
       headers = stamp(status, headers, passed)
+      headers = signal(headers) if passed.ctx && passed.ctx["signalled"]
       headers = own_challenge_csp(headers) if passed.ctx && passed.ctx["challenged"]
       finish = passed.on_finish
       return [status, headers, body] if finish.nil?
@@ -197,6 +198,20 @@ module Camada
       headers
     end
 
+    # A request that passed under a challenge (handle() or serve_challenge() marked the ctx) carries
+    # `x-camada-challenge: 1`, and `no-store` in place of the app's cache-control and CDN cache headers: the signal
+    # is per client. CDNs read their own cache header ahead of cache-control, so all of these end up no-store.
+    def signal(headers)
+      headers = headers.to_h
+      headers.delete_if { |k, _| Engine::NO_STORE_HEADERS.include?(k.to_s.downcase) }
+      Engine::NO_STORE_HEADERS.each { |h| headers[h] = "no-store" }
+      headers["x-camada-challenge"] = "1"
+      headers
+    rescue StandardError => e
+      Guarded.log_rate_limited(e)
+      headers
+    end
+
     # A challenge page the app returned (serve_challenge) keeps its own CSP: a policy the app or its middleware put on
     # that response (Rails' content_security_policy, secure_headers) is dropped and the page's is set, or the solver
     # would be blocked (camada-all-y38o). Any other response comes back unchanged.

data/lib/camada/snapshot/match.rb

@@ -60,7 +60,12 @@ module Camada
         @snap = snap
       end
 
-      def match(i)
+      # The whole decision (rules, allow, block, challenge) runs in one request regex budget.
+      def match(i) = Snapshot.with_regex_budget { decide(i) }
+
+      private
+
+      def decide(i)
         s = @snap
         ip = i.ip || ""
         n4 = -1
@@ -76,9 +81,8 @@ module Camada
         unless s.rules.empty?
           r = RuleRequest.new(n4: n4, ip6: w, asn: i.asn, country: i.country, tlsx: i.tlsx,
                               paths: forms, ua: i.ua, header: i.header)
-          s.rules.each do |rule| # the order IS the precedence (§A4): first match wins
-            return Snapshot.rule_result(rule, s.version) if rule.conds.all? { |cond| cond.call(r) }
-          end
+          hit = s.rules.find { |rule| rule.conds.all? { |cond| cond.call(r) } } # the order IS the precedence (§A4): first match wins
+          return Snapshot.rule_result(hit, s.version) if hit
         end
         reason = side(s.allow, i, n4, w, forms, false) # an exemption: every canonical spelling must agree
         return MatchResult.new(allowed: true, reason: reason, version: s.version) if reason
@@ -92,8 +96,6 @@ module Camada
         MatchResult.new(version: s.version)
       end
 
-      private
-
       def blocked4?(n)
         s = @snap
         b = n >> 8

data/lib/camada/snapshot/parse.rb

@@ -134,46 +134,429 @@ module Camada
       cmp_words(r, o, w) <= 0 && cmp_words(r, o + 4, w) >= 0 # rubocop:disable Style/ComparableBetween -- two different comparisons
     end
 
+    # regex-limit v1: the longest one customer regex may run, and what one request's rule walk may spend on all of them.
+    MATCH_BUDGET_MS = 50
+    REQUEST_REGEX_BUDGET_MS = 100
+    MATCH_TIMEOUT = Regexp.respond_to?(:timeout) ? MATCH_BUDGET_MS / 1000.0 : nil
+
+    # Runs the block with a fresh per-request regex budget (seconds left, in request-scoped state), reset in ensure.
+    def self.with_regex_budget
+      Thread.current[:camada_regex_budget] = REQUEST_REGEX_BUDGET_MS / 1000.0
+      yield
+    ensure
+      Thread.current[:camada_regex_budget] = nil
+    end
+
     # A pattern this runtime rejects never matches, and never throws (fail open). Patterns are
     # authored as JS regexes (the analyst validates them with `new RegExp`), so the JS spellings
     # Onigmo reads differently are translated first — see js_to_onigmo; \d \w \b are ASCII in
-    # Ruby by default, as JS reads them.
+    # Ruby by default, as JS reads them. An astral char is one code point here and two UTF-16 units
+    # in JS, so `.`, `[^a]` and `\S` count it once (an accepted gap, camada-all-vuvo).
+    # A quantifier right after a raw astral char repeats the whole char here but only its low unit in JS,
+    # so js_to_onigmo answers as V8 does: the char when the count allows 1, else `(?!)` (camada-all-5lra, see astral_count).
+    # Where a lookbehind ends up holding `(?!)`, Onigmo cannot compile it, so compile_regex returns nil and the rule never matches.
+    # V8's zero-low-unit reading is not emulated.
+    # Onigmo also diverges from JS on a
+    # repeated capture group whose body can match empty, even with no backreference: `((x?[ab]*)+?[ab]){2}` on 'aa'
+    # matches in JS, not here (an accepted gap, camada-all-mx0s). Under IGNORECASE Onigmo also applies
+    # multi-char case folds JS /i (one char at a time) does not: `\A(?:ss)\z` matches "ß", `[ß]` and `[a\S]` match "SS", `ff` matches
+    # "ff", and an ASCII-only pattern does the same once Ruby recompiles it for a non-ASCII value. Extra matches only, so a rule hits a
+    # value JS would not and never misses one; splitting every literal run would slow string search (an accepted gap, camada-all-wdii).
+    # Inside a lookbehind js_to_onigmo splits adjacent literals (camada-all-ccjo) so it stays fixed-length, which stops ss folding to ß,
+    # and reads a multi-fold char (ß, ff, İ) case-sensitively, as JS matches it: Onigmo there reads it as its fold alone (ß as "ss",
+    # never "ß"; Ruby 3.3.13 and 3.4.12 do the same for ff and İ, camada-all-ozix).
+    # A backreference JS and Onigmo read differently is rewritten or, when it cannot be, fails open (scan_groups).
+    # A `(?` or `(*` group JS lacks (`(?i)`, `(?>`, `(*FAIL)`, ...) fails open too: JS rejects it or V8 mis-evaluates it (camada-all-lsl8).
+    # Only a UTF-8 or ASCII pattern is walked: snapshot patterns arrive as UTF-8 JSON, and the binary walk
+    # misreads other encodings.
     def self.compile_regex(pattern, options = 0)
-      Regexp.new(js_to_onigmo(pattern), options)
+      return nil unless pattern.is_a?(String) && (pattern.encoding == Encoding::UTF_8 || pattern.ascii_only?)
+
+      bin = pattern.b # the one binary copy both walks read (O(1) indexing; the syntax is ASCII)
+      scan = scan_groups(bin)
+      return nil if scan[1]
+
+      source = js_to_onigmo(bin, scan).force_encoding(pattern.encoding)
+      verbose = $VERBOSE
+      begin
+        $VERBOSE = nil # `[a\S]` expands to a class with a duplicated range; Onigmo warns under -w, matching is right
+        # Ruby >= 3.2: a per-regex match bound (regex-limit v1). Never the global Regexp.timeout, that is the host app's.
+        # Ruby 3.1 has no match-time bound and rejects the keyword, so it compiles without it.
+        MATCH_TIMEOUT ? Regexp.new(source, options, timeout: MATCH_TIMEOUT) : Regexp.new(source, options)
+      ensure
+        $VERBOSE = verbose
+      end
     rescue RegexpError, TypeError, ArgumentError, EncodingError
       nil
     end
 
-    # The JS-only spellings a tenant is likely to author: `[^]` (any char) -> `[\s\S]`, `\cX` ->
+    # One escape/class-aware walk: [the capture groups of a JS pattern in number order (the name, or
+    # nil when unnamed), whether the pattern fails open, {reference position => [end position, :empty or :cond]}].
+    # JS reads a backreference to a group that has not captured as empty and clears captures each
+    # iteration; Onigmo fails it and keeps the last capture. A reference to a group not closed before
+    # it (forward or self) is always empty in JS: kind :empty, written `(?:)`. One to a group that may not have
+    # captured (it or an enclosing group is followed by a min-0 quantifier or sits in a negative lookaround, or
+    # it lies in an alternation branch: a `|` in an enclosing group or at top level) becomes the conditional
+    # `(?(N)\N)` (kind :cond; unset reads as empty), unless the group or an ancestor repeats (an empty last iteration
+    # makes Onigmo overwrite the capture, JS rejects that iteration and keeps it and the per-iteration reset
+    # diverges) or the group sits inside a positive lookahead (a lookahead keeps its first successful path, and JS tries the
+    # paths in another order and rejects an empty optional iteration): fail open. So does a plain reference (the group
+    # closed before it, always captured) to a group that sits in, or is, a repeated body that can match empty
+    # (`(b*)+x\1`): the walk tracks per frame whether its body must consume input (solid) or can match empty (nullable).
+    # A reference inside that repeat reads its own iteration's capture and stays compiled. So does a backward reference to a
+    # name two groups share (JS allows that in separate
+    # branches; Onigmo reads another group). A backreference inside a lookbehind, or to a group with a lookbehind
+    # ancestor, fails open too: JS matches a lookbehind right to left ("closed before the reference" is backwards
+    # there; a quantified group keeps its leftmost repetition). Beside named groups, a `\k<name>` naming no group
+    # is a JS SyntaxError: fail open (Onigmo aborts the process on it).
+    # So does a plain reference to a group in a positive lookahead that holds a quantified frame with optional
+    # iterations and a body that can match empty (JS rejects the empty iteration, so the lookahead's first success differs).
+    # Walks a binary copy (O(1) indexing; the syntax is ASCII), so the names come back binary.
+    # After the walk one forward pass over the frames (a parent precedes its children) settles, per
+    # frame, what its ancestors imply, so each reference costs O(1) however deeply its group nests.
+    def self.scan_groups(pattern)
+      pattern = binary(pattern)
+      return [[], false, {}] unless pattern.match?(/\\[1-9k]/) # no reference: nothing reads the names or can diverge
+
+      cur = { parent: nil }
+      frames = [cur] # every group, capturing or not, in `(` order
+      groups = [] # capture groups in number order
+      refs = [] # [position, number or name]
+      in_class = false
+      i = 0
+      while i < pattern.length
+        ch = pattern[i]
+        if ch == "\\"
+          if in_class
+            refs << [i, :bad, cur, i + 2] if pattern[i + 1] == "k" # `[\k]` is a SyntaxError beside named groups
+          elsif (m = pattern.match(/\G(?:k<([^<>]*)>|([1-9][0-9]*)|(k))/, i + 1))
+            refs << [i, m[3] ? :bad : m[1] || m[2].to_i, cur, m.end(0)]
+            i = m.end(0) - 2 # the reference is no atom: skip its name or digits (the loop's step and the one below)
+          elsif (m = ESC_ATOM.match(pattern, i))
+            cur[:solid] = true unless min_zero?(pattern, m.end(0))
+            i = m.end(0) - 2
+          end
+          i += 1
+        elsif in_class
+          if ch == "]"
+            in_class = false
+            cur[:solid] = true unless min_zero?(pattern, i + 1)
+          end
+        elsif ch == "["
+          in_class = true
+        elsif ch == "("
+          cur = { parent: cur, neg: pattern.match?(/\G\(\?<?!/, i), lb: pattern.match?(/\G\(\?<[=!]/, i), la: pattern.match?(/\G\(\?=/, i) }
+          frames << cur
+          if pattern[i + 1] != "?"
+            groups << cur
+          elsif (m = pattern.match(/\G\(\?<([^=!<>][^<>]*)>/, i))
+            groups << cur.merge!(name: m[1])
+          end
+          if (m = pattern.match(/\G\(\?(?:<[=!]|<[^<>]*>|[A-Za-z-]*:|[=!])/, i))
+            i = m.end(0) - 1 # the group's prefix is no atom
+          end
+        elsif ch == ")" && cur[:parent]
+          cur[:end] = i
+          b = pattern.match(JS_BRACE, i + 1)
+          cur[:zero] = min_zero?(pattern, i + 1)
+          cur[:nullable] ||= !cur[:solid] || cur[:lb] || cur[:la] || cur[:neg] # a lookaround consumes nothing
+          cur[:rep] = pattern.match?(/\G[+*]/, i + 1) || (b && (b[2] ? b[3].empty? || over_one?(b[3]) : over_one?(b[1]))) # repeats
+          cur[:holds] ||= (cur[:zero] || cur[:rep]) && cur[:nullable] # it or a frame inside it: an optional nullable repeat
+          cur[:parent][:holds] ||= cur[:holds]
+          closed = cur
+          cur = cur[:parent]
+          cur[:solid] = true unless closed[:nullable] || closed[:zero] # the branch now holds an atom that must consume
+        elsif ch == "|"
+          cur[:alt] = true
+          cur[:nullable] ||= !cur[:solid]
+          cur[:solid] = false
+        elsif ch == "{" && (b = pattern.match(JS_BRACE, i))
+          i = b.end(0) - 1 # a quantifier, not an atom
+        elsif ch.ord >= 0xC0 || (ch.ord < 0x80 && !"^$?*+".include?(ch))
+          e = i + 1
+          e += 1 while e < pattern.length && pattern.getbyte(e).between?(0x80, 0xBF)
+          cur[:solid] = true unless min_zero?(pattern, e)
+          i = e - 1
+        end
+        i += 1
+      end
+      return [[], false, {}] if refs.empty? # an escaped backslash or a class `[\1]` is no reference
+
+      names = groups.map { |g| g[:name] }
+      index = names.each_with_index.reverse_each.to_h # name => first group number - 1
+      named = names.any?
+      frames.drop(1).each do |f|
+        p = f[:parent]
+        f[:la_div] = (f[:la] && f[:holds]) || p[:la_div]
+        f[:in_lb] = f[:lb] || p[:in_lb]
+        f[:unset] = f[:zero] || f[:neg] || p[:alt] || p[:unset] # may not have captured when a reference runs
+        f[:rep_above] = p[:rep] || p[:rep_above] # a strict ancestor repeats
+        f[:in_la] = f[:la] || p[:in_la] # inside a positive lookahead
+        f[:rn] = f[:rep] && f[:nullable] ? f : p[:rn] # innermost repeating frame (or ancestor) whose body can match empty
+      end
+      dups = names.compact.tally.select { |_, c| c > 1 }
+      plan = {}
+      diverges = refs.any? do |pos, ref, home, stop|
+        next named if ref == :bad # a `\k` not followed by `<name>`: a SyntaxError beside named groups
+
+        k = if ref.is_a?(String)
+              index[ref]
+            else
+              ref <= groups.length ? ref - 1 : nil
+            end
+        next named && ref.is_a?(String) unless k # a name with no group beside named groups: a JS SyntaxError
+
+        g = groups[k]
+        next true if home[:in_lb] || g[:in_lb]
+
+        unless g[:end] && g[:end] < pos
+          plan[pos] = [stop, :empty] # never captured yet: empty, and a quantifier after it keeps its atom
+          next false
+        end
+        next true if g[:name] && dups[g[:name]] # JS allows a name in two branches; Onigmo reads another group
+        # a repeat that can match empty: Onigmo's last empty iteration overwrites the capture, JS keeps it
+        next true if (rn = g[:rn]) && rn[:end] < pos
+
+        next true if g[:la_div]
+        next false unless g[:unset]
+        next true if g[:rep_above] || g[:rep] || g[:in_la]
+
+        plan[pos] = [stop, :cond]
+        false
+      end
+      [names, diverges, plan]
+    end
+
+    # Whether the text at j starts a min-0 quantifier (`?`, `*`, `{0}`, `{0,}`, `{0,m}`).
+    def self.min_zero?(pattern, j)
+      c = pattern.getbyte(j)
+      return true if c == 0x3F || c == 0x2A # ? *
+      return false unless c == 0x7B # {
+
+      b = pattern.match(JS_BRACE, j)
+      !b.nil? && b[1].delete("0").empty?
+    end
+
+    JS_BRACE = /\G\{([0-9]+)(?:(,)([0-9]*))?\}/
+    JS_QUANT = /\G(?:([?*+])|#{JS_BRACE.source.delete_prefix('\\G')})\??/ # a JS quantifier with its lazy `?`
+    ONIGMO_REPEAT_MAX = 100_000 # Onigmo rejects a repeat number above this ("too big number for repeat range")
+    JS_WS = "\\t-\\r\\u0020\\u00a0\\u1680\\u2000-\\u200a\\u2028\\u2029\\u202f\\u205f\\u3000\\ufeff" # JS \s (Ruby's is ASCII)
+    JS_SPACE = { "s" => "[#{JS_WS}]", "S" => "[^#{JS_WS}]" }.freeze
+    ANY_CHAR = '[\x00-\x7f]|[\xc0-\xff][\x80-\xbf]*|[\s\S]' # one char of a binary UTF-8 string, whole
+    JS_ATOM = /\G(?:\\(?:c[A-Za-z0-9_]|x\h{2}|u\h{4}|[0-3][0-7]{0,2}|[4-7][0-7]?|(?!c)(?:#{ANY_CHAR}))|#{ANY_CHAR})/n # one class atom
+    # One escape that must consume input (nil where it may match empty: \b \B, \c without a letter, a trailing \).
+    # An unsure escape is no match: calling it nullable only fails open, splitting an atom would not.
+    ESC_ATOM = /\G\\(?:c[A-Za-z]|x\h{2}|u\h{4}|0[0-7]{0,2}|(?![bBc])(?:#{ANY_CHAR}))/n
+    JS_DOT = "[^\\n\\r\\u2028\\u2029]" # JS . (Onigmo's excludes only \n)
+    NON_JS_GROUP = /\G\((?:\*|\?(?![:=!<]))/ # a `(?` or `(*` opening none of the JS forms `(?:` `(?=` `(?!` `(?<`
+    JS_OPENER = /\G\((?:\?(?:[:=!]|(<)[=!]))?/ # an unnamed group's opener; the capture is set for a lookbehind
+    JS_GROUP = /\G\(\?<(?![=!])([^<>]*)>/n # a named group's opener: a JS name holds no `<` or `>`
+    JS_NAME = /\A[\p{ID_Start}$_][\p{ID_Continue}$\u200c\u200d]*\z/ # a JS group name
+    JS_ESCAPE = /\G(?:[bdDfnrsStvwW]|x\h{2}|u\h{4})/ # the letter escapes JS reads without `u`
+
+    # The JS-only spellings a tenant is likely to author: `[^]` (any char) -> `(?m:.)`, `\cX` ->
     # the control character, and the anchors: JS `^`/`$` bind the whole input while Ruby's are
-    # line anchors, so outside a class they become `\A`/`\z`. `(?<name>` is native to Onigmo.
-    # Anything else Ruby rejects still fails open.
-    def self.js_to_onigmo(pattern)
-      out = +""
+    # line anchors, so outside a class they become `\A`/`\z`; a `{` that is no JS quantifier
+    # (`{,3}`, `{ 1}`) -> `\{` (JS reads it as text, Onigmo as a bound), and `x{n}?` -> `x{n}` (JS
+    # reads it as exact-n, Onigmo as optional). `\<letter>` outside JS's escape set is the bare
+    # letter, as JS reads it without `u` (`\p{L}` is "p{L}", `\A` is "A"). `.` -> JS_DOT, `[]` ->
+    # `(?!)` (never matches; a `]` right after `[`/`[^` closes the class, a stray `]` -> `\]`), and
+    # `\s`/`\S` -> the JS whitespace set; inside a class they nest as a class
+    # (`[a\s]` -> `[a[WS]]`: one atom, no ReDoS), a `-` beside one stays a literal dash, as in JS,
+    # and so does a `-` right after the atom that follows it.
+    # Under IGNORECASE Onigmo folds several chars at once (`ss` ~ ß, and a positive class holding
+    # `\S` gains such folds), which makes a lookbehind variable-length and uncompilable; JS folds one
+    # char at a time. So inside a lookbehind adjacent literal chars are split with `(?:)` (`ab` -> `a(?:)b`; a
+    # lone literal stays a plain string node) and a positive
+    # class with `\S` (or `\W`/`\D`) becomes `(?:[^WS]|[rest])`, and a closed one-char class counts as a literal for
+    # that split (camada-all-ccjo, camada-all-fe1r). A char whose fold is several chars (ß, ff, İ; raw, `\u00df` or `\ß`)
+    # becomes `(?-i:ß)` there, pulled out of a positive class like `\S` unless a `-` is beside it (camada-all-ozix):
+    # JS /i matches it only to itself, and Onigmo would read it as its fold alone (version-dependent).
+    # In a class `\c` is a control char only before a letter, digit or `_` (ClassControlLetter); before
+    # anything else (`[\c*]`) it is a literal `\` then `c` (camada-all-mqcb).
+    # A `{m,n}` bound above Onigmo's 100000 is clamped: m to 100000, and an n above it drops (`{m,}`,
+    # exact for any input shorter than n), where JS accepts it (camada-all-yh2t).
+    # A literal `[` or `&` in a class is escaped (no nesting, POSIX class or `&&`, as in JS).
+    # `(?<name>` and `\k<name>` are copied verbatim once the name fits JS's grammar (JS_NAME); a name
+    # used twice is kept only when the twins sit in different alternatives of one disjunction (JS
+    # throws otherwise), and then no backreference may exist (camada-all-7xyl). Anything else Ruby
+    # rejects still fails open.
+    # Raises RegexpError on a group JS lacks (see compile_regex).
+    # `scan` is the scan_groups result (default: scan the pattern). Walks a binary copy (O(1) indexing
+    # on a non-ASCII pattern) and returns the pattern's encoding.
+    def self.js_to_onigmo(pattern, scan = nil)
+      enc = pattern.encoding
+      pattern = binary(pattern)
+      out = String.new(encoding: Encoding::BINARY)
       i = 0
       n = pattern.length
       in_class = false
+      pull_end = solo_end = -1 # where the last in-class \\s/\\S ended; where the atom after its dash ended
+      group_names, _, plan = scan || scan_groups(pattern)
+      named = group_names.any?
+      opens = [] # the unclosed `(` indices outside a class
+      bars = [-1] # per open group, the root first: the index of the last `|` in it or an ancestor
+      lbs = [false] # per open group, the root first: inside a lookbehind (camada-all-ccjo)
+      lit_end = -1 # the pattern index right after the last literal emitted inside a lookbehind
+      class_start = nil # the out index of an open positive class's `[` inside a lookbehind
+      class_alts = [] # the `\S`/`\W`/`\D` and multi-fold chars that class held
+      last_named = {} # name -> the index of its last opener
       while i < n
         ch = pattern[i]
+        # in a lookbehind (positive class too, unless a range end) a multi-fold char becomes `(?-i:c)` (camada-all-ozix)
+        if lbs.last && (!in_class || class_start) && (w = multi_fold(pattern, i)) &&
+           !(in_class && (pattern[i - 1] == "-" || pattern[i + w[1]] == "-"))
+          in_class ? class_alts << "(?-i:#{w[0]})" : out << "(?-i:#{w[0]})"
+          i += w[1]
+          next
+        end
         if ch == "\\" && i + 1 < n
-          if pattern[i + 1] == "c" && i + 2 < n && pattern[i + 2].match?(/[A-Za-z]/)
-            out << Regexp.escape((pattern[i + 2].upcase.ord - 64).chr)
+          if !in_class && (r = plan[i])
+            if r[1] == :empty
+              out << "(?:)"
+            else
+              ref = pattern[(i + 1)...r[0]]
+              nm = ref.start_with?("k") ? ref[2..-2] : (named && group_names[ref.to_i - 1])
+              out << (nm ? "(?(<#{nm}>)\\k<#{nm}>)" : "(?(#{ref})\\#{ref})")
+            end
+            i = r[0]
+            next
+          end
+          l = pattern[i + 1]
+          if in_class && class_start && (l == "S" || l == "W" || l == "D")
+            class_alts << (l == "S" ? JS_SPACE["S"] : "\\#{l}") # spliced in at the `]`: a positive class holding one gains multi-char folds
+            pull_end = i + 2
+            i += 2
+            next
+          end
+          if l == "s" || l == "S"
+            out << JS_SPACE[l] # in a class too: Onigmo nests classes, one atom
+            pull_end = i + 2 if in_class
+            i += 2
+            next
+          end
+          if l == "c" && pattern[i + 2]&.match?(in_class ? /[A-Za-z0-9_]/ : /[A-Za-z]/) # JS Annex B: `[\c1]` too
+            out << Regexp.escape((pattern[i + 2].ord & 0x1F).chr)
             i += 3
             next
           end
-          out << pattern[i, 2]
+          if named && !in_class && (m = pattern.match(/\G[1-9][0-9]*/, i + 1)) && (m[0].to_i <= group_names.length)
+            nm = group_names[m[0].to_i - 1] # Onigmo rejects a numbered backreference beside named groups
+            if nm
+              out << "\\k<#{nm}>"
+              i += 1 + m[0].length
+              next
+            end
+          end
+          if named && !in_class && l == "k" && (m = pattern.match(/\G\\k<[^<>]*>/n, i))
+            out << m[0] # a `$` in the name is no anchor; scan_groups failed open on a name no group has
+            i += m[0].length
+            next
+          end
+          if !in_class && l.ord >= 0xF0 && pattern.match?(JS_QUANT, i + 5) # `\😀?` reads as `😀?` (camada-all-5lra)
+            i += 1
+            next
+          end
+          kept = !l.match?(/[A-Za-z]/) || pattern.match?(JS_ESCAPE, i + 1) || (l == "B" && !in_class) ||
+                 (l == "k" && named)
+          l = "\\\\c" if l == "c" # JS reads `\c` before a non-letter as text
+          if kept
+            e = (pattern.match(/\G\\\d+/n, i) || pattern.match(JS_ATOM, i))[0] # the whole escape: a lookbehind must not split `\x41`
+            out << e
+            i += e.length
+            next
+          end
+          if !in_class && lbs.last # a bare letter is a literal (2 long): split it from a literal just before
+            out << "(?:)" if lit_end == i
+            lit_end = i + 2
+          end
+          out << l
           i += 2
           next
         end
         if in_class
-          in_class = ch != "]"
+          if ch == "]"
+            in_class = false
+            if class_alts.any?
+              rest = out.slice!(class_start..)[1..]
+              rest = "\\#{rest}" if rest.start_with?("^") # `[^..]` would negate the spliced class
+              alts = class_alts.join("|")
+              alts = "(?:#{alts}" + (rest.empty? ? ")" : "|[#{rest}])") if class_alts.length > 1 || !rest.empty?
+              out << alts
+              class_alts = []
+            else
+              out << "]"
+            end
+            lit_end = i + 1 if class_start # Onigmo merges a one-char class into the literals beside it
+            class_start = nil
+            i += 1
+            next
+          end
+          if ch == "-" && (pull_end == i || solo_end == i || pattern.match?(class_start ? /\G-\\[sSWD]/ : /\G-\\[sS]/, i))
+            if pull_end == i # JS reads the atom after that dash as standalone: a dash right after it is text too
+              m = pattern.match(JS_ATOM, i + 1) # nil when the pattern ends on the dash
+              solo_end = m ? i + 1 + m[0].length : pattern.length
+            end
+            ch = "\\-"
+          end
+          ch = "\\#{ch}" if ch == "[" || ch == "&" # JS: `[[:alpha:]]` is {[ : a l p h} then `]`
+        elsif ch == "(" && pattern.match?(NON_JS_GROUP, i)
+          raise RegexpError, "non-JS group" # compile_regex fails open
+        elsif ch == "(" && (m = pattern.match(JS_GROUP, i))
+          nm = m[1].dup.force_encoding(Encoding::UTF_8)
+          raise RegexpError, "invalid group name" unless nm.valid_encoding? && nm.match?(JS_NAME)
+
+          # the twin is exclusive when a group open since before it has seen a `|` since (transitive:
+          # checking the last twin is enough)
+          if (prev = last_named[nm]) && (named || bars[opens.bsearch_index { |o| o >= prev } || opens.length] < prev)
+            raise RegexpError, "duplicate group name"
+          end
+
+          last_named[nm] = i
+          opens << i
+          bars << bars.last
+          lbs << lbs.last
+          out << m[0]
+          i += m[0].length
+          next
+        elsif ch == "("
+          m = pattern.match(JS_OPENER, i)
+          opens << i
+          bars << bars.last
+          lbs << (lbs.last || !m[1].nil?)
+          out << m[0]
+          i += m[0].length
+          next
+        elsif ch == "|"
+          bars[-1] = i
+        elsif ch == ")" && opens.any?
+          opens.pop
+          bars.pop
+          lbs.pop
+        elsif ch == "."
+          out << JS_DOT
+          i += 1
+          next
+        elsif ch == "]"
+          out << "\\]"
+          i += 1
+          next
         elsif ch == "["
-          if pattern[i, 3] == "[^]"
-            out << "[\\s\\S]"
-            i += 3
+          neg = pattern[i + 1] == "^"
+          j = i + (neg ? 2 : 1)
+          if pattern[j] == "]"
+            out << (neg ? "(?m:.)" : "(?!)")
+            i = j + 1
             next
           end
+          if !neg && lbs.last
+            out << "(?:)" if lit_end == i
+            class_start = out.length
+          end
+          out << pattern[i...j]
+          i = j
           in_class = true
+          next
         elsif ch == "^"
           out << "\\A"
           i += 1
@@ -182,23 +565,121 @@ module Camada
           out << "\\z"
           i += 1
           next
+        elsif ch == "{"
+          m = pattern.match(JS_BRACE, i)
+          out << (m ? brace_quantifier(m) : "\\{")
+          i += m ? m[0].length : 1
+          i += 1 if m && !m[0].include?(",") && pattern[i] == "?"
+          next
+        end
+        if !in_class && ch.ord >= 0xF0 && (q = pattern.match(JS_QUANT, i + 4)) && !(count = astral_count(q)).nil?
+          if count && lbs.last # the char alone is a literal
+            out << "(?:)" if lit_end == i
+            lit_end = q.end(0)
+          end
+          # `(?!)` inside a lookbehind is not compilable by Onigmo: compile_regex returns nil and the rule never matches
+          out << (count ? pattern[i, 4] : "(?!)")
+          i = q.end(0)
+          next
+        end
+        # a literal in a lookbehind directly after another gets `(?:)` (never inside a UTF-8 char): Onigmo folds `ss` to ß under /i
+        if !in_class && lbs.last && !"()|*+?".include?(ch)
+          if ch.ord.between?(0x80, 0xBF)
+            lit_end = i + 1 if lit_end == i
+          else
+            out << "(?:)" if lit_end == i
+            lit_end = i + 1
+          end
         end
         out << ch
         i += 1
       end
-      out
+      out.force_encoding(enc)
+    end
+
+    # V8 repeats only the low unit of an astral char: true when the quantifier allows one, false when not, nil when m > n (left as written).
+    # V8's zero-low-unit reading (the high unit alone: `x😀{0}` on "x😀", a trailing `x😀?` on "x😁") is not emulated: that branch
+    # never matches, as the whole pattern never matches in the linear engines (camada-all-k938).
+    def self.astral_count(match)
+      sym, lo, comma, hi = match.captures
+      lo, hi = { "?" => %w[0 1], "*" => ["0", nil], "+" => ["1", nil] }[sym] || [lo, comma ? hi : lo]
+      lo, hi = canonical_bounds(lo, hi)
+      return nil unless lo # m > n
+
+      !over_one?(lo) && hi != "0"
+    end
+
+    # [lo, hi] without leading zeros (hi "" is no upper bound), or nil when m > n: a JS SyntaxError, left as written
+    def self.canonical_bounds(lo, hi)
+      lo, hi = [lo, hi.to_s].map { |d| d.sub(/\A0+(?=.)/, "") }
+      [lo, hi] unless hi != "" && ([lo.length, lo] <=> [hi.length, hi]).positive?
+    end
+
+    def self.over_one?(digits)
+      digits = digits.sub(/\A0+/, "") # a digit-string test: to_i on a huge one is slow
+      digits.length > 1 || digits > "1"
+    end
+
+    def self.binary(str)
+      str.encoding == Encoding::BINARY ? str : str.b
+    end
+
+    # [its text, its length] when the char at i (raw UTF-8, `\uXXXX` or an identity escape `\ß`) has a case fold of
+    # several chars (ß, İ, ff: 104 of them), else nil. JS /i without `u` matches each of them only to itself.
+    def self.multi_fold(pattern, i)
+      if pattern[i] == "\\"
+        return (w = multi_fold(pattern, i + 1)) && [w[0], w[1] + 1] if pattern.getbyte(i + 1).to_i >= 0x80
+
+        m = pattern.match(/\G\\u(\h{4})/n, i)
+        return nil unless m && !(cp = m[1].hex).between?(0xD800, 0xDFFF)
+
+        c = cp.chr(Encoding::UTF_8)
+        len = 6
+      else
+        b = pattern.getbyte(i)
+        return nil unless b.between?(0xC2, 0xEF) # a 2- or 3-byte lead: every such char is in the BMP
+
+        len = b < 0xE0 ? 2 : 3
+        c = pattern.byteslice(i, len).force_encoding(Encoding::UTF_8)
+      end
+      [pattern.byteslice(i, len), len] if c.valid_encoding? && c.downcase(:fold).length > 1
+    end
+
+    def self.brace_quantifier(match)
+      lo, hi = canonical_bounds(match[1], match[3])
+      return match[0] unless lo # m > n is a JS SyntaxError: leave it for Onigmo to reject
+
+      lo = ONIGMO_REPEAT_MAX.to_s if over_repeat_max?(lo)
+      hi = "" if over_repeat_max?(hi) # an upper bound past it never binds a real input
+      "{#{lo}#{match[2]}#{hi}}"
+    end
+
+    def self.over_repeat_max?(digits)
+      digits = digits.to_s # nil: `{m}` has no upper bound
+      digits.length > 6 || digits.to_i > ONIGMO_REPEAT_MAX # length first: to_i on a huge digit string is slow
     end
 
     # A regex test that never raises: a value in an encoding the pattern cannot read (a binary
     # PATH_INFO with high bytes, say) reads as "no match" rather than an exception on the request path.
     #
-    # `on_error` is what a value the engine cannot read answers. The legacy block-side path regexes
-    # keep false; a custom `matches` rule passes `deny` (regex-cap-sdk v1: an unevaluable value is a
+    # `on_error` is what a value the engine cannot read answers. A caller with no side passes false;
+    # a `matches` condition (a custom rule or a meta `pathsRegex` entry) passes `deny` (regex-cap-sdk v1: an unevaluable value is a
     # hit for block/challenge/warn and a miss for skip, the same as an over-cap one, camada-all-cwb4).
+    #
+    # Inside a match decision the request's regex budget is spent first: once it is gone the regex does not
+    # run and answers `on_error`, like an over-limit run (Regexp::TimeoutError is a StandardError).
     def self.regex_hit?(rx, value, on_error = false)
-      rx.match?(utf8_view(value))
-    rescue StandardError
-      on_error
+      left = Thread.current[:camada_regex_budget]
+      return on_error if left && left <= 0
+
+      t0 = Process.clock_gettime(Process::CLOCK_MONOTONIC) if left
+      begin
+        rx.match?(utf8_view(value))
+      rescue StandardError
+        on_error
+      ensure
+        Thread.current[:camada_regex_budget] = left - (Process.clock_gettime(Process::CLOCK_MONOTONIC) - t0) if left
+      end
     end
 
     # A value tagged ASCII-8BIT (Rack) whose bytes are valid UTF-8 is read as UTF-8, so a non-ASCII
@@ -339,17 +820,23 @@ module Camada
       false
     end
 
-    # One path form against a side's (or the block side's) exact, prefix and regex entries.
+    # One path form against a side's (or the block side's) exact, prefix and regex predicates.
     def self.path_in?(st, path, regexes = [])
       return true if st.paths_exact.include?(path)
       return true if !st.paths_prefix.empty? && prefix_hit?(st.paths_prefix, path)
 
-      regexes.any? { |rx| regex_hit?(rx, path) }
+      regexes.any? { |pred| pred.call(path) }
     end
 
     # Does the block hold for this request's path? deny = any spelling; an exemption = both canonical forms.
     def self.path_hit?(forms, deny, &pred)
-      deny ? (pred.call(forms[0]) || pred.call(forms[1]) || pred.call(forms[2])) : (pred.call(forms[1]) && pred.call(forms[2]))
+      if deny
+        # a form equal to one already tried is not matched again, so a repeat never spends the request's regex budget twice
+        return pred.call(forms[0]) ||
+               (forms[1] != forms[0] && pred.call(forms[1])) ||
+               (forms[2] != forms[0] && forms[2] != forms[1] && pred.call(forms[2]))
+      end
+      pred.call(forms[1]) && (forms[2] == forms[1] || pred.call(forms[2]))
     end
 
     # One path condition -> a predicate over a single path form. A `matches` form over MAX_MATCH_INPUT
@@ -389,6 +876,10 @@ module Camada
     def self.compile_cond(c, sets, deny = true)
       f = c["f"].to_s
       op = c["op"].to_s
+      # camada-all-zpbv: a stored `matches` value that is "" or not a String never matches (no to_s
+      # coercion into a regex; "" would match everything). First, so it also beats the over-cap fail-closed.
+      return ->(_r) { false } if op == "matches" && (!c["v"].is_a?(String) || c["v"].empty?)
+
       if f == "path" # every path op reads the canonical forms (see "paths" above)
         raw = c["v"]
         pred = path_pred(op, raw.is_a?(Array) ? raw.map(&:to_s) : [raw.to_s], deny)
@@ -531,7 +1022,7 @@ module Camada
         tls: (meta["tls"] || []).to_set,
         paths_exact: (meta["pathsExact"] || []).to_set { |p| canon_path(p.to_s) },
         paths_prefix: (meta["pathsPrefix"] || []).to_set { |p| dir_key(p.to_s) },
-        paths_regex: (meta["pathsRegex"] || []).filter_map { |p| compile_regex(p, Regexp::IGNORECASE) },
+        paths_regex: (meta["pathsRegex"] || []).map { |p| path_pred("matches", [p], true) },
         allow: range_set(sec.fetch(10, EMPTY), sec.fetch(11, EMPTY), meta["allow"]),
         challenge: range_set(sec.fetch(12, EMPTY), sec.fetch(13, EMPTY), meta["challenge"]),
         rules: compile_rules(meta, rule4, rule6)

data/lib/camada/version.rb

@@ -4,7 +4,8 @@ module Camada
   # The SDK's wire identity: x-camada-sdk: @camada/ruby/<version>. This literal is the single
   # source: camada.gemspec reads it at build, and the sibling drift guards (camada-backend,
   # camada-web, camada-mkt) parse this file with /^\s*VERSION = "([^"]+)"/m the way they parse
-  # a package.json. Plain X.Y.Z only: the analyst's SDK_RE drops anything else.
-  VERSION = "0.1.5"
+  # a package.json. Plain X.Y.Z only, and @camada/ruby must stay in the analyst's SDK_NAMES:
+  # its sdkId drops anything else.
+  VERSION = "0.2.1"
   SDK_ID = "@camada/ruby/#{VERSION}".freeze
 end

data/lib/camada.rb

@@ -83,7 +83,8 @@ module Camada
     end
 
     # A Rack triple [status, headers, [body]] to answer with (Sinatra: `halt(*answer)`) until the
-    # browser holds a valid _cch, then nil.
+    # browser holds a valid _cch, then nil. A non-page (non-HTML) request also gets nil and is
+    # signalled (x-camada-challenge: 1, no-store, chs: 1).
     def serve_challenge(env)
       ctx = ctx_of(env)
       engine_for(ctx).serve_challenge(ctx)&.to_rack

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: camada
 version: !ruby/object:Gem::Version
-  version: 0.1.5
+  version: 0.2.1
 platform: ruby
 authors:
 - camada
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-10-19 00:00:00.000000000 Z
+date: 2026-10-26 00:00:00.000000000 Z
 dependencies: []
 description: 'camada SDK for Ruby: inline enforcement of your snapshot (ordered custom
   rules, then allow, block, challenge), first-party beacon and proof-of-work challenge,