# PHP preg regular-expression engine

Regex Tools runs patterns in the actual PHP 8.5.8 `preg` implementation,
backed by PCRE2 10.44. The browser runtime is the Asyncify build from
`@php-wasm/web-8-5@3.1.46`; its host API is
`@php-wasm/universal@3.1.46`.

The fixed `bridge.php` file is installed in PHP's private virtual filesystem.
Pattern, flags, subject, limits, and replacement are written separately as
JSON. No user-controlled value is evaluated or interpolated into PHP source.
The bridge selects a safe preg delimiter and passes only validated modifiers.

PHP reports `PREG_OFFSET_CAPTURE` positions as UTF-8 bytes. The adapter retains
those native ranges and normalizes code-point boundaries to browser UTF-16.
Unpaired UTF-16 surrogates are rejected before entering the runtime. Without
the `u` modifier, a byte-oriented match that splits a UTF-8 character is
reported as unsupported because it cannot be represented losslessly in a
browser string.

Replacement never asks `preg_replace` to materialize an unbounded result.
Native `preg_match` records remain authoritative; a fixed bridge parser mirrors
PHP 8.5.8's `preg_get_backref()` rules and streams literal/capture bytes into
the requested cap. The identity self-test compares that fixed implementation
with `preg_replace` only as a parity oracle. The bridge returns bounded bytes as
base64 so JSON escaping cannot unexpectedly multiply the transport envelope.
A timeout, cancellation, supersession, or crash terminates the dedicated
worker and its entire PHP WebAssembly heap.

## Exact source and native-component boundary

The shipped `php.wasm` is SHA-256
`ed97ea5422dbf23e0687c98203cc8c6d7f2772a3d71b03d4991d2fdd93a048f0`
from `@php-wasm/web-8-5@3.1.46`. That npm package records WordPress Playground
commit `581c7c172428159eb4e6c5309054a568cd39a97a` (`v3.1.46`). The PHP source
base is tag `php-8.5.8`, tag object
`8a3b5a5124006c11a8fbfce838ec7dd53615cc77`, peeled commit
`26b97507444c4fbda072f57dda1820f7b7d5e467`; the final main module uses
Emscripten 4.0.19 at
`08e2de1031913e4ba7963b1c56f35f036a7d4d56`.

`native-components.json` is the machine-readable inventory for this exact
binary. It records 32 linked source/component surfaces:

- PHP and its bundled PCRE2, libbcmath, timelib/tzdata, libmagic, Lexbor,
  libmbfl, uriparser and libavifinfo code;
- zlib, libzip, libxml2, SQLite, libgd, libjpeg-turbo, libpng,
  libwebp/libsharpyuv, libavif, libaom/libyuv, OpenSSL, curl, libiconv and
  Oniguruma;
- the WordPress Playground wrapper plus the Emscripten runtime, musl,
  compiler-rt, libc++, libc++abi and dlmalloc surfaces.

Every versioned external archive or Git route, available archive hash/commit,
runtime evidence, licence/notice route and patent notice is recorded there.
The Oniguruma recipe is the one upstream exception: it cloned its default
branch without a revision. The inventory therefore does not falsely identify
the release tag as the build commit. It pins the exact committed `libonig.a`
blob and SHA-256, its Emscripten 4.0.5 compiler provenance, the installed header
blob, runtime version 6.9.10, audited release source and the bounded upstream
source interval `005482a…3eb317d` before the header changed.

The same inventory explicitly records why GMP, libsodium, tidy and ICU/intl
names found by a raw string scan are not linked extensions: those names are
Zend optimizer metadata or an unshipped side module, and the runtime verifier
asserts their absence. It also records that FreeType is disabled in the exact
libgd recipe even though the recipe's synthetic `gdlib-config --features`
string makes `gd_info()` report it, that ImageMagick/imagick is disabled, and
that libavif's local AOM 3.12.1—not the adjacent standalone AOM 3.13.1
recipe—is linked. Positive extension/library versions, negative detections and
AOM/libjpeg binary markers are executable pack-verification gates.

## Redistribution

The pack explicitly elects PHP License version 4 (`BSD-3-Clause`) for the PHP
8.5.8 codebase through the earlier licence's later-version option.
The pack also carries the exact Zend Engine licence, php-src's official binary
redistribution notice, the CLI HTTP parser's MIT terms, and the
public-domain, CC0 and FNV permission statements for the linked hash
implementations. `@php-wasm` retains GPL-2.0-or-later. Linked LGPL, BSD, MIT,
Apache, zlib, public-domain and patent-notice obligations are carried in 42
independently SHA-256-pinned legal files. The builder copies the inventory and
those exact files into the closed pack; `SHA256SUMS` and
`engine-metadata.json` cover them again, but cannot replace the independent
hashes in the verifier lock.