camada 0.2.0 → 0.2.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 0d3fbef4ecb9e7381ff18ff7f00298f155db47809898b7a2f62ee2d0a3d8d90f
-  data.tar.gz: 25e2f5efe68f77b02d8903d04b59752ea25587c1ac9834c930ea28d24c14eb98
+  metadata.gz: b73c94df7715601ab82c6a470ccd976e6bb934f6dcf6c8c54c5bfc3fe00b97df
+  data.tar.gz: 94bd0d19b9259b6e03ae0e6df41ca717afbd9aa915d7b1f273c99b89b3dab425
 SHA512:
-  metadata.gz: d2f3c3bb076396b25ced5e13ad2371b53709cbb8c73f7a48fb6553ebdb4e576736b88ca22731fc18c2abbd45cddc65b43861eb99f5073f8bb94af7f92b23b6e3
-  data.tar.gz: 61947d1b869a9b5ea49fdaca8e8c8e62c66d9677c52889756a369fae54356e51927bc04767fa9b0c250a3bf128bb24d07971ddef7aecb8a5c6936ac3d8a40259
+  metadata.gz: 6b6a3f8d9b8185f0979dccfb92498bc6fac1b62fdb1221f0130f69ca606edf5783ef25df6414e11997a13bb1a1dc5b18b874b5e3b570bef8e980230626c55fa6
+  data.tar.gz: 0e879615dbc999eed321ca8bc7821498622ee91a0be08345c846508a9cbd74aea4eab42f55eb7468fbc27482d593c190fa8e94b66c19e7482731dc3cf5159100

data/README.md

@@ -170,9 +170,7 @@ valid `_cch`, then `nil`. A non-page (non-HTML) request also gets `nil` and is s
 `sdk-ruby` is an in-app tap: status, latency, session, the beacon's browser signals and your
 outcomes. Puma hands the env to Rack as binary strings; the middleware reads them as UTF-8 with
 invalid bytes replaced (U+FFFD) before matching and shipping, so a stray high byte in a header
-neither escapes a rule nor costs the batch it rides in. The Rack env carries no wire header order (`hord` is the env's order), so the analyst
-reads no HEADER_ORDER signal from this tap, and it never scores the absence of header order, ASN,
-country or a TLS fingerprint against a request; ASN and country it resolves itself. Enforcement
+neither escapes a rule nor costs the batch it rides in. The Rack env carries no wire header order (`hord` is the env's order), so this tap ships no header-order signal; camada resolves ASN and country itself. Enforcement
 at this position covers ip, path, user-agent and header conditions — ASN, country and TLS entries
 fail open in-app. `matches` patterns are JS regexes read by Ruby's Onigmo: named groups are
 native, `[^]` and `\cX` are translated, `^`/`$` become `\A`/`\z` (Ruby's are line anchors,

data/lib/camada/constants.rb

@@ -4,8 +4,8 @@ require "json"
 
 module Camada
   # Tap identifier this SDK claims on the wire. The server validates against its own enum and
-  # derives the capability mask itself (edge-analyst src/capabilities.js): an SDK can never grant
-  # itself capability bits, only name its position — and an unknown name is silently read as a
+  # decides itself what each tap can see: an SDK can never grant
+  # itself more than that, only name its position — and an unknown name is silently read as a
   # proxy, so this literal is load-bearing.
   TAP = "sdk-ruby"
 

data/lib/camada/snapshot/parse.rb

@@ -149,9 +149,10 @@ module Camada
 
     # A pattern this runtime rejects never matches, and never throws (fail open). Patterns are
     # authored as JS regexes (the analyst validates them with `new RegExp`), so the JS spellings
-    # Onigmo reads differently are translated first — see js_to_onigmo; \d \w \b are ASCII in
-    # Ruby by default, as JS reads them. An astral char is one code point here and two UTF-16 units
-    # in JS, so `.`, `[^a]` and `\S` count it once (an accepted gap, camada-all-vuvo).
+    # Onigmo reads differently are translated first — see js_to_onigmo; \d \w are ASCII in
+    # Ruby by default, as JS reads them, and \b \B are emitted as (?a:\b) for the same reason.
+    # An astral char is one code point here and two UTF-16 units in JS,
+    # so `.`, `[^a]` and `\S` count it once (an accepted gap, camada-all-vuvo).
     # A quantifier right after a raw astral char repeats the whole char here but only its low unit in JS,
     # so js_to_onigmo answers as V8 does: the char when the count allows 1, else `(?!)` (camada-all-5lra, see astral_count).
     # Where a lookbehind ends up holding `(?!)`, Onigmo cannot compile it, so compile_regex returns nil and the rule never matches.
@@ -163,7 +164,8 @@ module Camada
     # "ff", and an ASCII-only pattern does the same once Ruby recompiles it for a non-ASCII value. Extra matches only, so a rule hits a
     # value JS would not and never misses one; splitting every literal run would slow string search (an accepted gap, camada-all-wdii).
     # Inside a lookbehind js_to_onigmo splits adjacent literals (camada-all-ccjo) so it stays fixed-length, which stops ss folding to ß,
-    # but a lone ß or ff there still matches "SS" / "FF".
+    # and reads a multi-fold char (ß, ff, İ) case-sensitively, as JS matches it: Onigmo there reads it as its fold alone (ß as "ss",
+    # never "ß"; Ruby 3.3.13 and 3.4.12 do the same for ff and İ, camada-all-ozix).
     # A backreference JS and Onigmo read differently is rewritten or, when it cannot be, fails open (scan_groups).
     # A `(?` or `(*` group JS lacks (`(?i)`, `(?>`, `(*FAIL)`, ...) fails open too: JS rejects it or V8 mis-evaluates it (camada-all-lsl8).
     # Only a UTF-8 or ASCII pattern is walked: snapshot patterns arrive as UTF-8 JSON, and the binary walk
@@ -366,9 +368,12 @@ module Camada
     # Under IGNORECASE Onigmo folds several chars at once (`ss` ~ ß, and a positive class holding
     # `\S` gains such folds), which makes a lookbehind variable-length and uncompilable; JS folds one
     # char at a time. So inside a lookbehind adjacent literal chars are split with `(?:)` (`ab` -> `a(?:)b`; a
-    # lone literal stays a plain string node, which Onigmo can still expand for a multi-char fold) and a positive
+    # lone literal stays a plain string node) and a positive
     # class with `\S` (or `\W`/`\D`) becomes `(?:[^WS]|[rest])`, and a closed one-char class counts as a literal for
-    # that split (camada-all-ccjo, camada-all-fe1r).
+    # that split (camada-all-ccjo, camada-all-fe1r). A char whose fold is several chars (ß, ff, İ; raw, `\u00df` or `\ß`)
+    # becomes `(?-i:ß)` there, pulled out of a positive class like `\S` unless a `-` is beside it (camada-all-ozix):
+    # JS /i matches it only to itself, and Onigmo would read it as its fold alone (version-dependent).
+    # One of the 63 iota-subscript chars in a positive class is pulled out the same way in any context (camada-all-rmje).
     # In a class `\c` is a control char only before a letter, digit or `_` (ClassControlLetter); before
     # anything else (`[\c*]`) it is a literal `\` then `c` (camada-all-mqcb).
     # A `{m,n}` bound above Onigmo's 100000 is clamped: m to 100000, and an n above it drops (`{m,}`,
@@ -395,11 +400,26 @@ module Camada
       bars = [-1] # per open group, the root first: the index of the last `|` in it or an ancestor
       lbs = [false] # per open group, the root first: inside a lookbehind (camada-all-ccjo)
       lit_end = -1 # the pattern index right after the last literal emitted inside a lookbehind
-      class_start = nil # the out index of an open positive class's `[` inside a lookbehind
-      class_alts = [] # the `\S`/`\W`/`\D` that class held
+      class_start = nil # the out index of an open positive class's `[`
+      class_alts = [] # the `\S`/`\W`/`\D` and multi-fold chars that class held
       last_named = {} # name -> the index of its last opener
       while i < n
         ch = pattern[i]
+        w = multi_fold(pattern, i)
+        iota = w && IOTA_SUBSCRIPT.match?(w[2])
+        if !in_class && !lbs.last && iota
+          out << "(?-i:#{w[0]})" # outside a lookbehind (the branch below) and a class; JS /i matches it only to itself (camada-all-zn38)
+          i += w[1]
+          next
+        end
+        # in a lookbehind (positive class too, unless a range end) a multi-fold char becomes `(?-i:c)` (camada-all-ozix)
+        # an iota-subscript char in a positive class is pulled out the same way, in a lookbehind or not (camada-all-rmje)
+        if (lbs.last || (in_class && iota)) && (!in_class || class_start) && w &&
+           !(in_class && (pattern[i - 1] == "-" || pattern[i + w[1]] == "-"))
+          in_class ? class_alts << "(?-i:#{w[0]})" : out << "(?-i:#{w[0]})"
+          i += w[1]
+          next
+        end
         if ch == "\\" && i + 1 < n
           if !in_class && (r = plan[i])
             if r[1] == :empty
@@ -413,7 +433,7 @@ module Camada
             next
           end
           l = pattern[i + 1]
-          if in_class && class_start && (l == "S" || l == "W" || l == "D")
+          if in_class && class_start && lbs.last && (l == "S" || l == "W" || l == "D")
             class_alts << (l == "S" ? JS_SPACE["S"] : "\\#{l}") # spliced in at the `]`: a positive class holding one gains multi-char folds
             pull_end = i + 2
             i += 2
@@ -425,6 +445,11 @@ module Camada
             i += 2
             next
           end
+          if !in_class && (l == "b" || l == "B")
+            out << "(?a:\\#{l})" # Onigmo's \b reads é as a word char, JS (no u flag) as ASCII only
+            i += 2
+            next
+          end
           if l == "c" && pattern[i + 2]&.match?(in_class ? /[A-Za-z0-9_]/ : /[A-Za-z]/) # JS Annex B: `[\c1]` too
             out << Regexp.escape((pattern[i + 2].ord & 0x1F).chr)
             i += 3
@@ -447,12 +472,13 @@ module Camada
             i += 1
             next
           end
-          kept = !l.match?(/[A-Za-z]/) || pattern.match?(JS_ESCAPE, i + 1) || (l == "B" && !in_class) ||
+          kept = !l.match?(/[A-Za-z]/) || pattern.match?(JS_ESCAPE, i + 1) ||
                  (l == "k" && named)
           l = "\\\\c" if l == "c" # JS reads `\c` before a non-letter as text
           if kept
             e = (pattern.match(/\G\\\d+/n, i) || pattern.match(JS_ATOM, i))[0] # the whole escape: a lookbehind must not split `\x41`
-            out << e
+            # JS reads \xHH above 0x7F as that code point, Onigmo as a raw byte (camada-all-w2w4)
+            out << (e.match?(/\A\\x[89a-fA-F]\h\z/) ? "\\u00#{e[2..]}" : e)
             i += e.length
             next
           end
@@ -477,12 +503,12 @@ module Camada
             else
               out << "]"
             end
-            lit_end = i + 1 if class_start # Onigmo merges a one-char class into the literals beside it
+            lit_end = i + 1 if class_start && lbs.last # Onigmo merges a one-char class into the literals beside it
             class_start = nil
             i += 1
             next
           end
-          if ch == "-" && (pull_end == i || solo_end == i || pattern.match?(class_start ? /\G-\\[sSWD]/ : /\G-\\[sS]/, i))
+          if ch == "-" && (pull_end == i || solo_end == i || pattern.match?(class_start && lbs.last ? /\G-\\[sSWD]/ : /\G-\\[sS]/, i))
             if pull_end == i # JS reads the atom after that dash as standalone: a dash right after it is text too
               m = pattern.match(JS_ATOM, i + 1) # nil when the pattern ends on the dash
               solo_end = m ? i + 1 + m[0].length : pattern.length
@@ -539,10 +565,8 @@ module Camada
             i = j + 1
             next
           end
-          if !neg && lbs.last
-            out << "(?:)" if lit_end == i
-            class_start = out.length
-          end
+          out << "(?:)" if !neg && lbs.last && lit_end == i
+          class_start = out.length unless neg
           out << pattern[i...j]
           i = j
           in_class = true
@@ -614,6 +638,31 @@ module Camada
       str.encoding == Encoding::BINARY ? str : str.b
     end
 
+    # The 63 Greek chars whose fold ends in an iota (ᾀ -> ἀι): Onigmo never matches one before a lookaround under /i.
+    IOTA_SUBSCRIPT = /\A[\u1F80-\u1FAF\u1FB2-\u1FB4\u1FB7\u1FBC\u1FC2-\u1FC4\u1FC7\u1FCC\u1FF2-\u1FF4\u1FF7\u1FFC]/
+
+    # [its text, its length, the char] when the char at i (raw UTF-8, `\uXXXX` or an identity escape `\ß`) has a case fold of
+    # several chars (ß, İ, ff: 104 of them), else nil. JS /i without `u` matches each of them only to itself.
+    def self.multi_fold(pattern, i)
+      if pattern[i] == "\\"
+        return (w = multi_fold(pattern, i + 1)) && [w[0], w[1] + 1, w[2]] if pattern.getbyte(i + 1).to_i >= 0x80
+
+        m = pattern.match(/\G\\(?:u(\h{4})|x([89a-fA-F]\h))/n, i) # `\xHH` above 0x7F is the code point (camada-all-w2w4)
+        return nil unless m && !(cp = (m[1] || m[2]).hex).between?(0xD800, 0xDFFF)
+
+        c = cp.chr(Encoding::UTF_8)
+        len = m[0].length
+        return [format("\\u%04x", cp), len] if c.downcase(:fold).length > 1 && m[2]
+      else
+        b = pattern.getbyte(i)
+        return nil unless b.between?(0xC2, 0xEF) # a 2- or 3-byte lead: every such char is in the BMP
+
+        len = b < 0xE0 ? 2 : 3
+        c = pattern.byteslice(i, len).force_encoding(Encoding::UTF_8)
+      end
+      [pattern.byteslice(i, len), len, c] if c.valid_encoding? && c.downcase(:fold).length > 1
+    end
+
     def self.brace_quantifier(match)
       lo, hi = canonical_bounds(match[1], match[3])
       return match[0] unless lo # m > n is a JS SyntaxError: leave it for Onigmo to reject

data/lib/camada/version.rb

@@ -6,6 +6,6 @@ module Camada
   # camada-web, camada-mkt) parse this file with /^\s*VERSION = "([^"]+)"/m the way they parse
   # a package.json. Plain X.Y.Z only, and @camada/ruby must stay in the analyst's SDK_NAMES:
   # its sdkId drops anything else.
-  VERSION = "0.2.0"
+  VERSION = "0.2.2"
   SDK_ID = "@camada/ruby/#{VERSION}".freeze
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: camada
 version: !ruby/object:Gem::Version
-  version: 0.2.0
+  version: 0.2.2
 platform: ruby
 authors:
 - camada
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-10-26 00:00:00.000000000 Z
+date: 2026-10-28 00:00:00.000000000 Z
 dependencies: []
 description: 'camada SDK for Ruby: inline enforcement of your snapshot (ordered custom
   rules, then allow, block, challenge), first-party beacon and proof-of-work challenge,