@kici-dev/engine 0.6.1 → 0.7.0

package/dist/labels-match.js

@@ -1,4 +1,6 @@
 import "./rolldown-runtime-ClRpJifh.js";
+import { canonicalizeLabel } from "./labels-canonical.js";
+import { stripStatefulRegexFlags } from "./regex-flags.js";
 import { z } from "zod";
 //#region src/labels-match.ts
 /**
@@ -17,12 +19,21 @@ const LabelMatcher = z.discriminatedUnion("kind", [z.object({
 	flags: z.string()
 })]);
 const regexCache = /* @__PURE__ */ new Map();
-/** Compile (and cache) the `RegExp` for a regex matcher. */
+/**
+* Compile (and cache) the `RegExp` for a regex matcher.
+*
+* `g` and `y` are stripped before compiling and before building the memo key.
+* They are worse than useless here: `matcherSatisfiedBy` below loops `.test()`
+* over a label *set*, so one successful match would leave `lastIndex` pointing
+* into the middle of the next label. Stripping at the reader also tolerates a
+* lock file written by a compiler that predates the producer-side strip.
+*/
 function compileRegexMatcher(m) {
-	const key = `${m.flags} ${m.source}`;
+	const flags = stripStatefulRegexFlags(m.flags);
+	const key = `${flags} ${m.source}`;
 	let re = regexCache.get(key);
 	if (!re) {
-		re = new RegExp(m.source, m.flags);
+		re = new RegExp(m.source, flags);
 		regexCache.set(key, re);
 	}
 	return re;
@@ -31,7 +42,32 @@ function compileRegexMatcher(m) {
 function matcherMatches(m, label) {
 	return m.kind === "exact" ? label === m.value : compileRegexMatcher(m).test(label);
 }
-/** Whether some label in the set satisfies the matcher. */
+/**
+* Fold a matcher into the canonical matching domain.
+*
+* `exact` values lowercase directly. A regex source CANNOT be lowercased
+* without corrupting the pattern (character classes, escapes, anchors), so the
+* `i` flag carries the fold instead. This is the ONLY place `i` is added:
+* `compileRegexMatcher` must stay flag-faithful because `matchHostPattern`
+* uses it to match agent IDs, which are not labels.
+*/
+function canonicalizeMatcher(m) {
+	let folded;
+	if (m.kind === "exact") folded = {
+		kind: "exact",
+		value: canonicalizeLabel(m.value)
+	};
+	else {
+		const flags = stripStatefulRegexFlags(m.flags);
+		folded = {
+			kind: "regex",
+			source: m.source,
+			flags: flags.includes("i") ? flags : `${flags}i`
+		};
+	}
+	return folded;
+}
+/** Whether some label in the canonical set satisfies the canonical matcher. */
 function matcherSatisfiedBy(m, labels) {
 	if (m.kind === "exact") return labels.has(m.value);
 	const re = compileRegexMatcher(m);
@@ -57,14 +93,14 @@ const HostTargetSelector = z.object({
 * include matchers match and none of its exclude matchers match.
 */
 function hostSatisfiesTarget(labels, target) {
-	return target.values.every((v) => v.include.every((m) => matcherSatisfiedBy(m, labels)) && !v.exclude.some((m) => matcherSatisfiedBy(m, labels)));
+	return target.values.every((v) => v.include.every((m) => matcherSatisfiedBy(canonicalizeMatcher(m), labels)) && !v.exclude.some((m) => matcherSatisfiedBy(canonicalizeMatcher(m), labels)));
 }
-/** Split a matcher list into exact label strings and the remaining regex matchers. */
+/** Split a matcher list into canonical exact labels and canonical regex matchers. */
 function partitionMatchers(ms) {
 	const exact = [];
 	const regex = [];
-	for (const m of ms) if (m.kind === "exact") exact.push(m.value);
-	else if (m.kind === "regex") regex.push(m);
+	for (const m of ms) if (m.kind === "exact") exact.push(canonicalizeLabel(m.value));
+	else if (m.kind === "regex") regex.push(canonicalizeMatcher(m));
 	else throw new Error(`partitionMatchers: invalid label matcher ${JSON.stringify(m)} — expected { kind: 'exact', value } or { kind: 'regex', source, flags }. The lock file is likely stale or compiled by an older engine — recompile with \`kici compile\`.`);
 	return {
 		exact,
@@ -72,6 +108,6 @@ function partitionMatchers(ms) {
 	};
 }
 //#endregion
-export { HostTargetSelector, HostTargetValue, LabelMatcher, compileRegexMatcher, hostSatisfiesTarget, matcherMatches, matcherSatisfiedBy, partitionMatchers };
+export { HostTargetSelector, HostTargetValue, LabelMatcher, canonicalizeMatcher, compileRegexMatcher, hostSatisfiesTarget, matcherMatches, matcherSatisfiedBy, partitionMatchers };
 
 //# sourceMappingURL=labels-match.js.map

package/dist/metrics/catalog-policy.js

@@ -191,6 +191,7 @@ const METRIC_LABEL_POLICY = {
 		provider: { values: ["static"] },
 		scope: { maxUniqueValues: 100 }
 	},
+	kici_orch_container_registry_auth_contributor_stripped_total: { trust_tier: { values: ["unknown", "known"] } },
 	kici_orch_install_secrets_contributor_stripped_total: { trust_tier: { values: ["unknown", "known"] } },
 	kici_orch_install_secrets_token_resolution_duration_seconds: { environment: { maxUniqueValues: 50 } },
 	kici_cross_source_errors_total: { reason: { values: ["clone_token", "bundle_missing"] } },
@@ -223,7 +224,11 @@ const METRIC_LABEL_POLICY = {
 		"dashboard_relay_org_mismatch",
 		"response_source_mismatch",
 		"payload_stream_source_mismatch",
-		"ack_source_mismatch"
+		"ack_source_mismatch",
+		"source_register_org_segment_mismatch",
+		"source_register_unknown_prefix",
+		"github_routing_key_multi_org_claim",
+		"unverified_delivery_id_claim"
 	] } },
 	kici_platform_orch_metrics_filtered_total: {
 		reason: { values: [