camada 0.2.1 → 0.2.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 6ff3ec1e73a6da51f20af06916fb4438fe50fc9fa87a9023445e90561c1a7cf8
-  data.tar.gz: d9d10163bdb349345ccb3a65666966624640fef0352d4727f848485abc0ea734
+  metadata.gz: b73c94df7715601ab82c6a470ccd976e6bb934f6dcf6c8c54c5bfc3fe00b97df
+  data.tar.gz: 94bd0d19b9259b6e03ae0e6df41ca717afbd9aa915d7b1f273c99b89b3dab425
 SHA512:
-  metadata.gz: 42beca1c8a2d5299814aa3b09963e21963e0e25344238e70cf087d19d484feb7cd91dbaae8930ec0c5236eb77c6906c5f9de1b5cd265704798061a99fae40040
-  data.tar.gz: 79148a9dd5427db583f916520b64726a6baede851368a2677a55e846ed6f4ed83500ec020544b6ba90c263ee189d42acd8c11a52f8f1a2a713d908d7d867476f
+  metadata.gz: 6b6a3f8d9b8185f0979dccfb92498bc6fac1b62fdb1221f0130f69ca606edf5783ef25df6414e11997a13bb1a1dc5b18b874b5e3b570bef8e980230626c55fa6
+  data.tar.gz: 0e879615dbc999eed321ca8bc7821498622ee91a0be08345c846508a9cbd74aea4eab42f55eb7468fbc27482d593c190fa8e94b66c19e7482731dc3cf5159100

data/README.md

@@ -170,9 +170,7 @@ valid `_cch`, then `nil`. A non-page (non-HTML) request also gets `nil` and is s
 `sdk-ruby` is an in-app tap: status, latency, session, the beacon's browser signals and your
 outcomes. Puma hands the env to Rack as binary strings; the middleware reads them as UTF-8 with
 invalid bytes replaced (U+FFFD) before matching and shipping, so a stray high byte in a header
-neither escapes a rule nor costs the batch it rides in. The Rack env carries no wire header order (`hord` is the env's order), so the analyst
-reads no HEADER_ORDER signal from this tap, and it never scores the absence of header order, ASN,
-country or a TLS fingerprint against a request; ASN and country it resolves itself. Enforcement
+neither escapes a rule nor costs the batch it rides in. The Rack env carries no wire header order (`hord` is the env's order), so this tap ships no header-order signal; camada resolves ASN and country itself. Enforcement
 at this position covers ip, path, user-agent and header conditions — ASN, country and TLS entries
 fail open in-app. `matches` patterns are JS regexes read by Ruby's Onigmo: named groups are
 native, `[^]` and `\cX` are translated, `^`/`$` become `\A`/`\z` (Ruby's are line anchors,

data/lib/camada/constants.rb

@@ -4,8 +4,8 @@ require "json"
 
 module Camada
   # Tap identifier this SDK claims on the wire. The server validates against its own enum and
-  # derives the capability mask itself (edge-analyst src/capabilities.js): an SDK can never grant
-  # itself capability bits, only name its position — and an unknown name is silently read as a
+  # decides itself what each tap can see: an SDK can never grant
+  # itself more than that, only name its position — and an unknown name is silently read as a
   # proxy, so this literal is load-bearing.
   TAP = "sdk-ruby"
 

data/lib/camada/snapshot/parse.rb

@@ -149,9 +149,10 @@ module Camada
 
     # A pattern this runtime rejects never matches, and never throws (fail open). Patterns are
     # authored as JS regexes (the analyst validates them with `new RegExp`), so the JS spellings
-    # Onigmo reads differently are translated first — see js_to_onigmo; \d \w \b are ASCII in
-    # Ruby by default, as JS reads them. An astral char is one code point here and two UTF-16 units
-    # in JS, so `.`, `[^a]` and `\S` count it once (an accepted gap, camada-all-vuvo).
+    # Onigmo reads differently are translated first — see js_to_onigmo; \d \w are ASCII in
+    # Ruby by default, as JS reads them, and \b \B are emitted as (?a:\b) for the same reason.
+    # An astral char is one code point here and two UTF-16 units in JS,
+    # so `.`, `[^a]` and `\S` count it once (an accepted gap, camada-all-vuvo).
     # A quantifier right after a raw astral char repeats the whole char here but only its low unit in JS,
     # so js_to_onigmo answers as V8 does: the char when the count allows 1, else `(?!)` (camada-all-5lra, see astral_count).
     # Where a lookbehind ends up holding `(?!)`, Onigmo cannot compile it, so compile_regex returns nil and the rule never matches.
@@ -372,6 +373,7 @@ module Camada
     # that split (camada-all-ccjo, camada-all-fe1r). A char whose fold is several chars (ß, ff, İ; raw, `\u00df` or `\ß`)
     # becomes `(?-i:ß)` there, pulled out of a positive class like `\S` unless a `-` is beside it (camada-all-ozix):
     # JS /i matches it only to itself, and Onigmo would read it as its fold alone (version-dependent).
+    # One of the 63 iota-subscript chars in a positive class is pulled out the same way in any context (camada-all-rmje).
     # In a class `\c` is a control char only before a letter, digit or `_` (ClassControlLetter); before
     # anything else (`[\c*]`) it is a literal `\` then `c` (camada-all-mqcb).
     # A `{m,n}` bound above Onigmo's 100000 is clamped: m to 100000, and an n above it drops (`{m,}`,
@@ -398,13 +400,21 @@ module Camada
       bars = [-1] # per open group, the root first: the index of the last `|` in it or an ancestor
       lbs = [false] # per open group, the root first: inside a lookbehind (camada-all-ccjo)
       lit_end = -1 # the pattern index right after the last literal emitted inside a lookbehind
-      class_start = nil # the out index of an open positive class's `[` inside a lookbehind
+      class_start = nil # the out index of an open positive class's `[`
       class_alts = [] # the `\S`/`\W`/`\D` and multi-fold chars that class held
       last_named = {} # name -> the index of its last opener
       while i < n
         ch = pattern[i]
+        w = multi_fold(pattern, i)
+        iota = w && IOTA_SUBSCRIPT.match?(w[2])
+        if !in_class && !lbs.last && iota
+          out << "(?-i:#{w[0]})" # outside a lookbehind (the branch below) and a class; JS /i matches it only to itself (camada-all-zn38)
+          i += w[1]
+          next
+        end
         # in a lookbehind (positive class too, unless a range end) a multi-fold char becomes `(?-i:c)` (camada-all-ozix)
-        if lbs.last && (!in_class || class_start) && (w = multi_fold(pattern, i)) &&
+        # an iota-subscript char in a positive class is pulled out the same way, in a lookbehind or not (camada-all-rmje)
+        if (lbs.last || (in_class && iota)) && (!in_class || class_start) && w &&
            !(in_class && (pattern[i - 1] == "-" || pattern[i + w[1]] == "-"))
           in_class ? class_alts << "(?-i:#{w[0]})" : out << "(?-i:#{w[0]})"
           i += w[1]
@@ -423,7 +433,7 @@ module Camada
             next
           end
           l = pattern[i + 1]
-          if in_class && class_start && (l == "S" || l == "W" || l == "D")
+          if in_class && class_start && lbs.last && (l == "S" || l == "W" || l == "D")
             class_alts << (l == "S" ? JS_SPACE["S"] : "\\#{l}") # spliced in at the `]`: a positive class holding one gains multi-char folds
             pull_end = i + 2
             i += 2
@@ -435,6 +445,11 @@ module Camada
             i += 2
             next
           end
+          if !in_class && (l == "b" || l == "B")
+            out << "(?a:\\#{l})" # Onigmo's \b reads é as a word char, JS (no u flag) as ASCII only
+            i += 2
+            next
+          end
           if l == "c" && pattern[i + 2]&.match?(in_class ? /[A-Za-z0-9_]/ : /[A-Za-z]/) # JS Annex B: `[\c1]` too
             out << Regexp.escape((pattern[i + 2].ord & 0x1F).chr)
             i += 3
@@ -457,12 +472,13 @@ module Camada
             i += 1
             next
           end
-          kept = !l.match?(/[A-Za-z]/) || pattern.match?(JS_ESCAPE, i + 1) || (l == "B" && !in_class) ||
+          kept = !l.match?(/[A-Za-z]/) || pattern.match?(JS_ESCAPE, i + 1) ||
                  (l == "k" && named)
           l = "\\\\c" if l == "c" # JS reads `\c` before a non-letter as text
           if kept
             e = (pattern.match(/\G\\\d+/n, i) || pattern.match(JS_ATOM, i))[0] # the whole escape: a lookbehind must not split `\x41`
-            out << e
+            # JS reads \xHH above 0x7F as that code point, Onigmo as a raw byte (camada-all-w2w4)
+            out << (e.match?(/\A\\x[89a-fA-F]\h\z/) ? "\\u00#{e[2..]}" : e)
             i += e.length
             next
           end
@@ -487,12 +503,12 @@ module Camada
             else
               out << "]"
             end
-            lit_end = i + 1 if class_start # Onigmo merges a one-char class into the literals beside it
+            lit_end = i + 1 if class_start && lbs.last # Onigmo merges a one-char class into the literals beside it
             class_start = nil
             i += 1
             next
           end
-          if ch == "-" && (pull_end == i || solo_end == i || pattern.match?(class_start ? /\G-\\[sSWD]/ : /\G-\\[sS]/, i))
+          if ch == "-" && (pull_end == i || solo_end == i || pattern.match?(class_start && lbs.last ? /\G-\\[sSWD]/ : /\G-\\[sS]/, i))
             if pull_end == i # JS reads the atom after that dash as standalone: a dash right after it is text too
               m = pattern.match(JS_ATOM, i + 1) # nil when the pattern ends on the dash
               solo_end = m ? i + 1 + m[0].length : pattern.length
@@ -549,10 +565,8 @@ module Camada
             i = j + 1
             next
           end
-          if !neg && lbs.last
-            out << "(?:)" if lit_end == i
-            class_start = out.length
-          end
+          out << "(?:)" if !neg && lbs.last && lit_end == i
+          class_start = out.length unless neg
           out << pattern[i...j]
           i = j
           in_class = true
@@ -624,17 +638,21 @@ module Camada
       str.encoding == Encoding::BINARY ? str : str.b
     end
 
-    # [its text, its length] when the char at i (raw UTF-8, `\uXXXX` or an identity escape `\ß`) has a case fold of
+    # The 63 Greek chars whose fold ends in an iota (ᾀ -> ἀι): Onigmo never matches one before a lookaround under /i.
+    IOTA_SUBSCRIPT = /\A[\u1F80-\u1FAF\u1FB2-\u1FB4\u1FB7\u1FBC\u1FC2-\u1FC4\u1FC7\u1FCC\u1FF2-\u1FF4\u1FF7\u1FFC]/
+
+    # [its text, its length, the char] when the char at i (raw UTF-8, `\uXXXX` or an identity escape `\ß`) has a case fold of
     # several chars (ß, İ, ff: 104 of them), else nil. JS /i without `u` matches each of them only to itself.
     def self.multi_fold(pattern, i)
       if pattern[i] == "\\"
-        return (w = multi_fold(pattern, i + 1)) && [w[0], w[1] + 1] if pattern.getbyte(i + 1).to_i >= 0x80
+        return (w = multi_fold(pattern, i + 1)) && [w[0], w[1] + 1, w[2]] if pattern.getbyte(i + 1).to_i >= 0x80
 
-        m = pattern.match(/\G\\u(\h{4})/n, i)
-        return nil unless m && !(cp = m[1].hex).between?(0xD800, 0xDFFF)
+        m = pattern.match(/\G\\(?:u(\h{4})|x([89a-fA-F]\h))/n, i) # `\xHH` above 0x7F is the code point (camada-all-w2w4)
+        return nil unless m && !(cp = (m[1] || m[2]).hex).between?(0xD800, 0xDFFF)
 
         c = cp.chr(Encoding::UTF_8)
-        len = 6
+        len = m[0].length
+        return [format("\\u%04x", cp), len] if c.downcase(:fold).length > 1 && m[2]
       else
         b = pattern.getbyte(i)
         return nil unless b.between?(0xC2, 0xEF) # a 2- or 3-byte lead: every such char is in the BMP
@@ -642,7 +660,7 @@ module Camada
         len = b < 0xE0 ? 2 : 3
         c = pattern.byteslice(i, len).force_encoding(Encoding::UTF_8)
       end
-      [pattern.byteslice(i, len), len] if c.valid_encoding? && c.downcase(:fold).length > 1
+      [pattern.byteslice(i, len), len, c] if c.valid_encoding? && c.downcase(:fold).length > 1
     end
 
     def self.brace_quantifier(match)

data/lib/camada/version.rb

@@ -6,6 +6,6 @@ module Camada
   # camada-web, camada-mkt) parse this file with /^\s*VERSION = "([^"]+)"/m the way they parse
   # a package.json. Plain X.Y.Z only, and @camada/ruby must stay in the analyst's SDK_NAMES:
   # its sdkId drops anything else.
-  VERSION = "0.2.1"
+  VERSION = "0.2.2"
   SDK_ID = "@camada/ruby/#{VERSION}".freeze
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: camada
 version: !ruby/object:Gem::Version
-  version: 0.2.1
+  version: 0.2.2
 platform: ruby
 authors:
 - camada
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-10-26 00:00:00.000000000 Z
+date: 2026-10-28 00:00:00.000000000 Z
 dependencies: []
 description: 'camada SDK for Ruby: inline enforcement of your snapshot (ordered custom
   rules, then allow, block, challenge), first-party beacon and proof-of-work challenge,