@fanboynz/network-scanner 2.0.59 → 2.0.60

package/lib/adblock.js

@@ -3,6 +3,16 @@
 // Optimizations: Map domains + URL cache + skip third-party calc + cached hostname split
 
 const fs = require('fs');
+const psl = require('psl');
+
+// Hoisted constants — avoid recreating per rule (~80K times for EasyList)
+const COSMETIC_OPTIONS = new Set(['generichide', 'elemhide', 'specifichide', 'genericblock']);
+const PARSE_TYPE_MAP = {
+  'script': 'script', 'stylesheet': 'stylesheet', 'css': 'stylesheet',
+  'image': 'image', 'xmlhttprequest': 'xhr', 'xhr': 'xhr', 'font': 'font',
+  'media': 'media', 'websocket': 'websocket', 'subdocument': 'subdocument',
+  'document': 'document', 'ping': 'ping', 'other': 'other'
+};
 
 /**
  * Simple LRU cache for URL parsing results
@@ -106,10 +116,10 @@ function parseAdblockRules(filePath, options = {}) {
 
     // Skip rules with cosmetic-only options (not for network blocking)
     // These options only affect element hiding, not network requests
-    const cosmeticOnlyOptions = ['generichide', 'elemhide', 'specifichide'];
-    const hasCosmeticOption = cosmeticOnlyOptions.some(opt => 
-      line.includes(`$${opt}`) || line.includes(`,${opt}`)
-    );
+    let hasCosmeticOption = false;
+    for (const opt of COSMETIC_OPTIONS) {
+      if (line.includes(`$${opt}`) || line.includes(`,${opt}`)) { hasCosmeticOption = true; break; }
+    }
     if (hasCosmeticOption) {
       rules.stats.elementHiding++;
       continue;
@@ -121,7 +131,7 @@ function parseAdblockRules(filePath, options = {}) {
       // Whitelist rules (exception rules)
       if (line.startsWith('@@')) {
         const cleanLine = line.substring(2);
-        const parsedRule = parseRule(cleanLine, true);
+        const parsedRule = parseRule(cleanLine, true, enableLogging);
         
         // Store exact domains in Map for O(1) lookup, wildcards in array
         if (parsedRule.isDomain && parsedRule.domain && !parsedRule.domain.includes('*')) {
@@ -134,7 +144,7 @@ function parseAdblockRules(filePath, options = {}) {
       }
 
       // Regular blocking rules
-      const parsedRule = parseRule(line, false);
+      const parsedRule = parseRule(line, false, enableLogging);
       
       // Categorize based on rule type
       if (parsedRule.isThirdParty) {
@@ -194,20 +204,19 @@ function parseAdblockRules(filePath, options = {}) {
  * @param {boolean} isWhitelist - Whether this is a whitelist rule
  * @returns {Object} Parsed rule object
  */
-function parseRule(rule, isWhitelist) {
+function parseRule(rule, isWhitelist, enableLogging = false) {
   const parsed = {
-    raw: rule,
+    raw: enableLogging ? rule : null, // Only store for logging — saves memory on large lists
     isWhitelist,
     isDomain: false,
     isThirdParty: false,
     isFirstParty: false,
     isScript: false,
-    resourceTypes: null,       // Array of allowed resource types, null = all types
-    excludedResourceTypes: null, // Array of excluded resource types ($~script, $~image)
+    resourceTypes: null,       // Set of allowed resource types, null = all types
+    excludedResourceTypes: null, // Set of excluded resource types ($~script, $~image)
     isRegex: false,
     domainRestrictions: null,  // { include: ['site.com'], exclude: ['~site.com'] }
     pattern: '',
-    options: {},
     matcher: null
   };
 
@@ -215,105 +224,81 @@ function parseRule(rule, isWhitelist) {
   let [pattern, optionsStr] = rule.split('$');
   parsed.pattern = pattern;
 
-  // Parse options
+  // Parse options into local object (not stored on parsed — freed after this block)
   if (optionsStr) {
     const options = optionsStr.split(',');
+    const parsedOptions = {};
 
-    // Filter out cosmetic-only options that don't affect network blocking
-    const networkOptions = options.filter(opt => {
-      const optKey = opt.split('=')[0].trim();
-      // Skip cosmetic filtering options
-      const cosmeticOptions = [
-        'generichide',
-        'elemhide', 
-        'specifichide',
-        'genericblock'  // Also cosmetic-related
-      ];
-      return !cosmeticOptions.includes(optKey);
-    });
-
-    // Only process network-related options
-    for (const opt of networkOptions) {
+    for (const opt of options) {
       const [key, value] = opt.split('=');
-      parsed.options[key.trim()] = value ? value.trim() : true;
+      const trimmedKey = key.trim();
+      if (!COSMETIC_OPTIONS.has(trimmedKey)) {
+        parsedOptions[trimmedKey] = value ? value.trim() : true;
+      }
     }
-    
+
     // Check for third-party option
-    if (parsed.options['third-party'] || parsed.options['3p']) {
+    if (parsedOptions['third-party'] || parsedOptions['3p']) {
       parsed.isThirdParty = true;
     }
-    
+
     // Check for first-party option ($first-party, $1p, $~third-party)
-    if (parsed.options['first-party'] || parsed.options['1p'] || parsed.options['~third-party']) {
+    if (parsedOptions['first-party'] || parsedOptions['1p'] || parsedOptions['~third-party']) {
       parsed.isFirstParty = true;
     }
 
-    // Parse resource type options
-    const TYPE_MAP = {
-      'script': 'script',
-      'stylesheet': 'stylesheet',
-      'css': 'stylesheet',
-      'image': 'image',
-      'xmlhttprequest': 'xhr',
-      'xhr': 'xhr',
-      'font': 'font',
-      'media': 'media',
-      'websocket': 'websocket',
-      'subdocument': 'subdocument',
-      'document': 'document',
-      'ping': 'ping',
-      'other': 'other'
-    };
-    
-    const matchedTypes = Object.keys(parsed.options)
-      .filter(key => TYPE_MAP[key])
-      .map(key => TYPE_MAP[key]);
-  
-    const excludedTypes = Object.keys(parsed.options)
-      .filter(key => key.startsWith('~') && TYPE_MAP[key.substring(1)])
-      .map(key => TYPE_MAP[key.substring(1)]);
+    // Parse resource type options using module-level PARSE_TYPE_MAP
+    const matchedTypes = Object.keys(parsedOptions)
+      .filter(key => PARSE_TYPE_MAP[key])
+      .map(key => PARSE_TYPE_MAP[key]);
+
+    const excludedTypes = Object.keys(parsedOptions)
+      .filter(key => key.startsWith('~') && PARSE_TYPE_MAP[key.substring(1)])
+      .map(key => PARSE_TYPE_MAP[key.substring(1)]);
 
     if (matchedTypes.length > 0) {
-      parsed.resourceTypes = matchedTypes;
-      if (parsed.options['script']) {
+      // $document rules act as full domain blocks — no resource type restriction
+      if (matchedTypes.length === 1 && matchedTypes[0] === 'document') {
+        // Don't set resourceTypes — treat as standard block matching all types
+      } else {
+        parsed.resourceTypes = new Set(matchedTypes);
+      }
+      if (parsedOptions['script']) {
         parsed.isScript = true;
       }
     }
 
     if (excludedTypes.length > 0) {
-      parsed.excludedResourceTypes = excludedTypes;
+      parsed.excludedResourceTypes = new Set(excludedTypes);
     }
 
     // Parse domain option: $domain=site1.com|site2.com|~excluded.com
-    if (parsed.options['domain']) {
-      const domainList = parsed.options['domain'];
+    if (parsedOptions['domain']) {
+      const domainList = parsedOptions['domain'];
       const domains = domainList.split('|').map(d => d.trim()).filter(d => d);
-      
+
       const include = [];
       const exclude = [];
-      
+
       for (const domain of domains) {
         if (domain.startsWith('~')) {
-          // Negation: exclude this domain
           exclude.push(domain.substring(1).toLowerCase());
         } else {
-          // Positive: include this domain
           include.push(domain.toLowerCase());
         }
       }
-      
-      // Store parsed domain restrictions
+
       parsed.domainRestrictions = {
         include: include.length > 0 ? include : null,
         exclude: exclude.length > 0 ? exclude : null
       };
-      
+    }
+    // parsedOptions goes out of scope here — GC can reclaim
   }
- }
 
   // Domain rules: ||domain.com^ or ||domain.com
   if (pattern.startsWith('||')) {
-    const domain = pattern.substring(2).replace(/\^.*$/, '').replace(/\*$/, '');
+    const domain = pattern.substring(2).replace(/[\^\/\*].*$/, '');
     const afterDomain = pattern.substring(2 + domain.length);
     if (!afterDomain || afterDomain === '^') {
       // Pure domain rule: ||domain.com^ or ||domain.com
@@ -321,16 +306,34 @@ function parseRule(rule, isWhitelist) {
       parsed.domain = domain;
       parsed.matcher = createDomainMatcher(domain);
     } else {
-      // Domain + path rule: ||domain.com^*path or ||domain.com/path
-      parsed.matcher = createPatternMatcher(pattern);
+      // Domain + path rule: ||domain.com/path or ||domain.com^*path
+      // Split into fast domain check + path pattern to avoid full-URL regex
+      parsed.isDomain = true;
+      parsed.domain = domain;
+      const domainMatcher = createDomainMatcher(domain);
+      const pathMatcher = createPatternMatcher(afterDomain);
+      parsed.matcher = (url, hostname) => {
+        if (!domainMatcher(url, hostname)) return false;
+        // Extract path portion after hostname for path matching
+        const hostIdx = url.indexOf(hostname);
+        if (hostIdx === -1) return false;
+        const pathPart = url.substring(hostIdx + hostname.length);
+        return pathMatcher(pathPart);
+      };
     }
   }
   // Regex rules: /pattern/
   else if (pattern.startsWith('/') && pattern.endsWith('/')) {
     parsed.isRegex = true;
-    const regexPattern = pattern.substring(1, pattern.length - 1);
-    const regex = new RegExp(regexPattern, 'i');
-    parsed.matcher = (url) => regex.test(url);
+    const cached = _regexCache.get(pattern);
+    if (cached) {
+      parsed.matcher = cached;
+    } else {
+      const regexPattern = pattern.substring(1, pattern.length - 1);
+      const regex = new RegExp(regexPattern, 'i');
+      parsed.matcher = (url) => regex.test(url);
+      _regexCache.set(pattern, parsed.matcher);
+    }
   }
   // Path/wildcard rules: /ads/* or ad.js
   else {
@@ -348,34 +351,58 @@ function parseRule(rule, isWhitelist) {
 function createDomainMatcher(domain) {
   const lowerDomain = domain.toLowerCase();
   const dotDomain = '.' + lowerDomain;
+  // hostname is already lowercased by shouldBlock() before being passed here
   return (url, hostname) => {
-    const lowerHostname = hostname.toLowerCase();
-    // Exact match or subdomain match
-    return lowerHostname === lowerDomain ||
-           lowerHostname.endsWith(dotDomain);
+    return hostname === lowerDomain ||
+           hostname.endsWith(dotDomain);
   };
 }
 
+/**
+ * Shared regex cache — deduplicates identical compiled patterns across rules
+ * Large lists (EasyList ~80K rules) often have thousands of duplicate patterns
+ */
+const _regexCache = new Map();
+
 /**
  * Creates a pattern matcher for path/wildcard rules
  * @param {string} pattern - Pattern with wildcards
  * @returns {Function} Matcher function
  */
 function createPatternMatcher(pattern) {
+  // Check cache for already-compiled identical pattern
+  const cached = _regexCache.get(pattern);
+  if (cached) return cached;
+
   // Convert adblock pattern to regex
   // * matches anything
   // ^ matches separator (/, ?, &, =, :)
   // | matches start/end of URL
-  
+
+  // Handle | anchors before escaping — only at very start/end of pattern
+  let anchorStart = false;
+  let anchorEnd = false;
+  if (pattern.startsWith('|') && !pattern.startsWith('||')) {
+    anchorStart = true;
+    pattern = pattern.substring(1);
+  }
+  if (pattern.endsWith('|')) {
+    anchorEnd = true;
+    pattern = pattern.slice(0, -1);
+  }
+
   let regexPattern = pattern
-    .replace(/[.+?{}()[\]\\]/g, '\\$&')  // Escape regex special chars
+    .replace(/[.+?{}()[\]\\|]/g, '\\$&')  // Escape regex special chars including literal |
     .replace(/\*/g, '.*')                 // * -> .*
-    .replace(/\^/g, '[/?&=:]')            // ^ -> separator chars
-    .replace(/^\|/, '^')                  // | at start -> ^
-    .replace(/\|$/, '$');                 // | at end -> $
-  
+    .replace(/\^/g, '[/?&=:]');           // ^ -> separator chars
+
+  if (anchorStart) regexPattern = '^' + regexPattern;
+  if (anchorEnd) regexPattern = regexPattern + '$';
+
   const regex = new RegExp(regexPattern, 'i');
-  return (url) => regex.test(url);
+  const matcher = (url) => regex.test(url);
+  _regexCache.set(pattern, matcher);
+  return matcher;
 }
 
 /**
@@ -387,15 +414,25 @@ function createPatternMatcher(pattern) {
 function createMatcher(rules, options = {}) {
   const { enableLogging = false, caseSensitive = false } = options;
   
-  const urlCache = new URLCache(8000);
+  const urlCache = new URLCache(16000);
   let cacheHits = 0;
   let cacheMisses = 0;
   const hasPartyRules = rules.thirdPartyRules.length > 0 || rules.firstPartyRules.length > 0;
-  const resultCache = new URLCache(8000);  // Cache full shouldBlock results
-  
+  // Result cache with LRU eviction — evicts oldest entries one at a time
+  // instead of clearing everything when full
+  const resultCache = new URLCache(32000);
+
+  function resultCacheGet(url, sourceUrl, resourceType) {
+    return resultCache.get(url + '\0' + sourceUrl + '\0' + resourceType);
+  }
+
+  function resultCacheSet(url, sourceUrl, resourceType, result) {
+    resultCache.set(url + '\0' + sourceUrl + '\0' + resourceType, result);
+  }
+
   return {
     rules,
-    
+
     /**
      * Check if URL should be blocked
      * @param {string} url - URL to check
@@ -406,8 +443,7 @@ function createMatcher(rules, options = {}) {
     shouldBlock(url, sourceUrl = '', resourceType = '') {
       try {
         // Check result cache — same URL+source+type always produces same result
-        const resultKey = url + '\0' + sourceUrl + '\0' + resourceType;
-        const cachedResult = resultCache.get(resultKey);
+        const cachedResult = resultCacheGet(url, sourceUrl, resourceType);
         if (cachedResult) {
           cacheHits++;
           return cachedResult;
@@ -435,14 +471,16 @@ function createMatcher(rules, options = {}) {
           cacheMisses++;
         }
         
-        // Calculate hostname parts once and reuse
-        const hostnameParts = lowerHostname.split('.');
-
-        // Precompute parent domains once, reused for whitelist and block checks
-        const parentDomains = [];
-        const partsLen = hostnameParts.length;
-        for (let i = 1; i < partsLen; i++) {
-          parentDomains.push(hostnameParts.slice(i).join('.'));
+        // Lazy parent domain computation — only built when exact Map lookup misses
+        let parentDomains = null;
+        function getParentDomains() {
+          if (parentDomains) return parentDomains;
+          parentDomains = [];
+          const hostnameParts = lowerHostname.split('.');
+          for (let i = 1; i < hostnameParts.length; i++) {
+            parentDomains.push(hostnameParts.slice(i).join('.'));
+          }
+          return parentDomains;
         }
     
         // Extract and cache source page domain for $domain and third-party checks
@@ -482,26 +520,27 @@ function createMatcher(rules, options = {}) {
         // Fast path: Check exact domain in Map (O(1))
         let rule = rules.whitelistMap.get(lowerHostname);  // V8: Single Map lookup
         if (rule) {
-          if (enableLogging) {  // V8: Check after getting rule (inlined)
-            console.log(`[Adblock] Whitelisted: ${url} (${rule.raw})`);
-          }
-          if (matchesDomainRestrictions(rule, sourceDomain)) {
-            const r = { blocked: false, rule: rule.raw, reason: 'whitelisted' };
-            resultCache.set(resultKey, r);
+          if (matchesRule(rule, url, hostname, isThirdParty, resourceType, sourceDomain)) {
+            if (enableLogging) {
+              console.log(`[Adblock] Whitelisted: ${url} (${rule.raw || rule.pattern})`);
+            }
+            const r = { blocked: false, rule: rule.raw || rule.pattern, reason: 'whitelisted' };
+            resultCacheSet(url, sourceUrl, resourceType, r);
             return r;
           }
         }
-        
+
         // Check parent domains for subdomain matches (e.g., sub.example.com -> example.com)
-        for (let i = 0; i < parentDomains.length; i++) {
-          rule = rules.whitelistMap.get(parentDomains[i]);
+        const parents = getParentDomains();
+        for (let i = 0; i < parents.length; i++) {
+          rule = rules.whitelistMap.get(parents[i]);
           if (rule) {
-            if (enableLogging) {
-              console.log(`[Adblock] Whitelisted: ${url} (${rule.raw})`);
-            }
-            if (matchesDomainRestrictions(rule, sourceDomain)) {
-              const r = { blocked: false, rule: rule.raw, reason: 'whitelisted' };
-              resultCache.set(resultKey, r);
+            if (matchesRule(rule, url, hostname, isThirdParty, resourceType, sourceDomain)) {
+              if (enableLogging) {
+                console.log(`[Adblock] Whitelisted: ${url} (${rule.raw || rule.pattern})`);
+              }
+              const r = { blocked: false, rule: rule.raw || rule.pattern, reason: 'whitelisted' };
+              resultCacheSet(url, sourceUrl, resourceType, r);
               return r;
             }
           }
@@ -513,39 +552,39 @@ function createMatcher(rules, options = {}) {
           const rule = rules.whitelist[i];
           if (matchesRule(rule, url, hostname, isThirdParty, resourceType, sourceDomain)) {
             if (enableLogging) {
-              console.log(`[Adblock] Whitelisted: ${url} (${rule.raw})`);
+              console.log(`[Adblock] Whitelisted: ${url} (${rule.raw || rule.pattern})`);
             }
-              const r = { blocked: false, rule: rule.raw, reason: 'whitelisted' };
-              resultCache.set(resultKey, r);
+              const r = { blocked: false, rule: rule.raw || rule.pattern, reason: 'whitelisted' };
+              resultCacheSet(url, sourceUrl, resourceType, r);
               return r;
           }
         }
 
         // === DOMAIN BLOCKING CHECK ===
-        
+
         // Fast path: Check exact domain in Map (O(1))
         rule = rules.domainMap.get(lowerHostname);  // V8: Single Map lookup
         if (rule) {
-          if (enableLogging) {
-            console.log(`[Adblock] Blocked domain: ${url} (${rule.raw})`);
-          }
-          if (matchesDomainRestrictions(rule, sourceDomain)) {
-            const r = { blocked: true, rule: rule.raw, reason: 'domain_rule' };
-            resultCache.set(resultKey, r);
+          if (matchesRule(rule, url, hostname, isThirdParty, resourceType, sourceDomain)) {
+            if (enableLogging) {
+              console.log(`[Adblock] Blocked domain: ${url} (${rule.raw || rule.pattern})`);
+            }
+            const r = { blocked: true, rule: rule.raw || rule.pattern, reason: 'domain_rule' };
+            resultCacheSet(url, sourceUrl, resourceType, r);
             return r;
           }
         }
-        
+
         // Check parent domains for subdomain matches (e.g., ads.example.com -> example.com)
-        for (let i = 0; i < parentDomains.length; i++) {
-          rule = rules.domainMap.get(parentDomains[i]);
+        for (let i = 0; i < parents.length; i++) {
+          rule = rules.domainMap.get(parents[i]);
           if (rule) {
-            if (enableLogging) {
-              console.log(`[Adblock] Blocked domain: ${url} (${rule.raw})`);
-            }
-            if (matchesDomainRestrictions(rule, sourceDomain)) {
-              const r = { blocked: true, rule: rule.raw, reason: 'domain_rule' };
-              resultCache.set(resultKey, r);
+            if (matchesRule(rule, url, hostname, isThirdParty, resourceType, sourceDomain)) {
+              if (enableLogging) {
+                console.log(`[Adblock] Blocked domain: ${url} (${rule.raw || rule.pattern})`);
+              }
+              const r = { blocked: true, rule: rule.raw || rule.pattern, reason: 'domain_rule' };
+              resultCacheSet(url, sourceUrl, resourceType, r);
               return r;
             }
           }
@@ -557,10 +596,10 @@ function createMatcher(rules, options = {}) {
           const rule = rules.domainRules[i];
           if (matchesRule(rule, url, hostname, isThirdParty, resourceType, sourceDomain)) {
             if (enableLogging) {
-              console.log(`[Adblock] Blocked domain: ${url} (${rule.raw})`);
+              console.log(`[Adblock] Blocked domain: ${url} (${rule.raw || rule.pattern})`);
             }
-            const r = { blocked: true, rule: rule.raw, reason: 'domain_rule' };
-            resultCache.set(resultKey, r);
+            const r = { blocked: true, rule: rule.raw || rule.pattern, reason: 'domain_rule' };
+            resultCacheSet(url, sourceUrl, resourceType, r);
             return r;
           }
         }
@@ -572,10 +611,10 @@ function createMatcher(rules, options = {}) {
             const rule = rules.thirdPartyRules[i];
             if (matchesRule(rule, url, hostname, isThirdParty, resourceType, sourceDomain)) {
               if (enableLogging) {
-                console.log(`[Adblock] Blocked third-party: ${url} (${rule.raw})`);
+                console.log(`[Adblock] Blocked third-party: ${url} (${rule.raw || rule.pattern})`);
               }
-              const r = { blocked: true, rule: rule.raw, reason: 'third_party_rule' };
-              resultCache.set(resultKey, r);
+              const r = { blocked: true, rule: rule.raw || rule.pattern, reason: 'third_party_rule' };
+              resultCacheSet(url, sourceUrl, resourceType, r);
               return r;
             }
           }
@@ -588,10 +627,10 @@ function createMatcher(rules, options = {}) {
             const rule = rules.firstPartyRules[i];
             if (matchesRule(rule, url, hostname, isThirdParty, resourceType, sourceDomain)) {
               if (enableLogging) {
-                console.log(`[Adblock] Blocked first-party: ${url} (${rule.raw})`);
+                console.log(`[Adblock] Blocked first-party: ${url} (${rule.raw || rule.pattern})`);
               }
-              const r = { blocked: true, rule: rule.raw, reason: 'first_party_rule' };
-              resultCache.set(resultKey, r);
+              const r = { blocked: true, rule: rule.raw || rule.pattern, reason: 'first_party_rule' };
+              resultCacheSet(url, sourceUrl, resourceType, r);
               return r;
             }
           }
@@ -604,10 +643,10 @@ function createMatcher(rules, options = {}) {
             const rule = rules.scriptRules[i];
            if (matchesRule(rule, url, hostname, isThirdParty, resourceType, sourceDomain)) {
               if (enableLogging) {
-                console.log(`[Adblock] Blocked script: ${url} (${rule.raw})`);
+                console.log(`[Adblock] Blocked script: ${url} (${rule.raw || rule.pattern})`);
               }
-              const r = { blocked: true, rule: rule.raw, reason: 'script_rule' };
-              resultCache.set(resultKey, r);
+              const r = { blocked: true, rule: rule.raw || rule.pattern, reason: 'script_rule' };
+              resultCacheSet(url, sourceUrl, resourceType, r);
               return r;
             }
           }
@@ -619,10 +658,10 @@ function createMatcher(rules, options = {}) {
           const rule = rules.pathRules[i];
           if (matchesRule(rule, url, hostname, isThirdParty, resourceType, sourceDomain)) {
             if (enableLogging) {
-              console.log(`[Adblock] Blocked path: ${url} (${rule.raw})`);
+              console.log(`[Adblock] Blocked path: ${url} (${rule.raw || rule.pattern})`);
             }
-            const r = { blocked: true, rule: rule.raw, reason: 'path_rule' };
-            resultCache.set(resultKey, r);
+            const r = { blocked: true, rule: rule.raw || rule.pattern, reason: 'path_rule' };
+            resultCacheSet(url, sourceUrl, resourceType, r);
             return r;
           }
         }
@@ -633,17 +672,17 @@ function createMatcher(rules, options = {}) {
           const rule = rules.regexRules[i];
           if (matchesRule(rule, url, hostname, isThirdParty, resourceType, sourceDomain)) {
             if (enableLogging) {
-              console.log(`[Adblock] Blocked regex: ${url} (${rule.raw})`);
+              console.log(`[Adblock] Blocked regex: ${url} (${rule.raw || rule.pattern})`);
             }
-            const r = { blocked: true, rule: rule.raw, reason: 'regex_rule' };
-            resultCache.set(resultKey, r);
+            const r = { blocked: true, rule: rule.raw || rule.pattern, reason: 'regex_rule' };
+            resultCacheSet(url, sourceUrl, resourceType, r);
             return r;
           }
         }
 
         // No match - allow request
         const r = { blocked: false, rule: null, reason: 'no_match' };
-        resultCache.set(resultKey, r);
+        resultCacheSet(url, sourceUrl, resourceType, r);
         return r;
 
       } catch (err) {
@@ -674,7 +713,8 @@ function createMatcher(rules, options = {}) {
           hits: cacheHits,
           misses: cacheMisses,
           hitRate: hitRate,
-          size: urlCache.cache.size,
+          urlCacheSize: urlCache.cache.size,
+          resultCacheSize: resultCache.cache.size,
           maxSize: urlCache.maxSize
         }
       };
@@ -785,26 +825,18 @@ function matchesRule(rule, url, hostname, isThirdParty, resourceType, sourceDoma
     return false;
   }
 
-  // Check resource type restrictions
-  if (rule.resourceTypes) {
-    if (!resourceType) {
-      // No resource type info available — allow match for safety
-    } else {
-      // Normalize Puppeteer resource types to match our type names
-      const normalizedType = RESOURCE_TYPE_ALIASES[resourceType] || resourceType;
-      if (!rule.resourceTypes.includes(normalizedType)) {
-        return false;
-      }
+  // Normalize resource type once for both checks
+  if (resourceType && (rule.resourceTypes || rule.excludedResourceTypes)) {
+    const normalizedType = RESOURCE_TYPE_ALIASES[resourceType] || resourceType;
+
+    // Check resource type restrictions
+    if (rule.resourceTypes && !rule.resourceTypes.has(normalizedType)) {
+      return false;
     }
-  }
 
-  // Check negated resource type restrictions ($~script, $~image, etc.)
-  if (rule.excludedResourceTypes) {
-    if (resourceType) {
-      const normalizedType = RESOURCE_TYPE_ALIASES[resourceType] || resourceType;
-      if (rule.excludedResourceTypes.includes(normalizedType)) {
-        return false;
-      }
+    // Check negated resource type restrictions ($~script, $~image, etc.)
+    if (rule.excludedResourceTypes && rule.excludedResourceTypes.has(normalizedType)) {
+      return false;
     }
   }
 
@@ -817,17 +849,21 @@ function matchesRule(rule, url, hostname, isThirdParty, resourceType, sourceDoma
 }
 
 /**
- * Extract base domain from hostname
+ * Extract base domain from hostname using Public Suffix List
+ * Correctly handles multi-part TLDs like .co.uk, .com.au, .com.br
  * @param {string} hostname - Full hostname
  * @returns {string} Base domain
  */
+const _baseDomainCache = new Map();
 function getBaseDomain(hostname) {
-  const parts = hostname.split('.');
-  if (parts.length <= 2) {
-    return hostname;
-  }
-  // Return last two parts (example.com from sub.example.com)
-  return parts.slice(-2).join('.');
+  const cached = _baseDomainCache.get(hostname);
+  if (cached) return cached;
+  const parsed = psl.parse(hostname);
+  const result = (parsed && parsed.domain) ? parsed.domain : hostname;
+  // Cap cache size
+  if (_baseDomainCache.size > 10000) _baseDomainCache.clear();
+  _baseDomainCache.set(hostname, result);
+  return result;
 }
 
 module.exports = {