@oriro/orirocli 0.1.11 → 0.1.12

package/skills/craft/vercel-optimize/lib/sanitizers/bot-protection-certainty.mjs

@@ -1,56 +1,56 @@
-// Bot Protection evidence is usually account-level summary data. Avoid turning
-// observed bot traffic into unsupported statements about exact WAF rule state.
-
-export const metadata = {
-  id: "bot-protection-certainty",
-  description:
-    "Soften unsupported Bot Protection / WAF certainty and require a staged rollout caveat.",
-};
-
-const STRING_FIELDS = ["what", "why", "fix", "currentBehavior", "desiredBehavior", "verify"];
-
-export function apply(rec) {
-  if (!String(rec?.candidateRef ?? "").startsWith("platform_bot_protection:")) return {};
-  const tags = [];
-  for (const field of STRING_FIELDS) {
-    if (typeof rec?.[field] !== "string") continue;
-    const before = rec[field];
-    let after = before
-      .replace(
-        /\bno\s+(?:firewall\s+)?bot_filter\s+rule\b/gi,
-        "the collected firewall summary did not show an enforced bot-filter rule",
-      )
-      .replace(
-        /\b(?:bots?|bot traffic)\s+(?:is|are)\s+the\s+cause\b/gi,
-        "bot traffic is a likely contributor",
-      )
-      .replace(
-        /\bwithout\s+false[- ]positive\s+risk\b/gi,
-        "with false-positive risk monitored during rollout",
-      )
-      .replace(
-        /\bno\s+false[- ]positive\s+risk\b/gi,
-        "false-positive risk still needs rollout monitoring",
-      );
-    if (after !== before) {
-      rec[field] = after;
-      tags.push(`bot-protection-certainty:${field}`);
-    }
-  }
-
-  const text = STRING_FIELDS.map((field) => rec?.[field])
-    .filter((s) => typeof s === "string")
-    .join("\n");
-  if (
-    /\b(?:Bot Protection|BotID|bot_filter|WAF)\b/i.test(text) &&
-    !/\bstaged\b[\s\S]{0,80}\b(?:log|allowlist|exclusions?)\b/i.test(text)
-  ) {
-    const caveat =
-      " Use a staged rollout that starts in Log mode where available, then moves to the appropriate Challenge or Deny action only after allowlist/exclusion review for known monitoring and partner clients.";
-    if (typeof rec.fix === "string") rec.fix += caveat;
-    else rec.fix = caveat.trim();
-    tags.push("bot-protection-certainty:staged-rollout");
-  }
-
-  return tags.length > 0 ? { tags, needsReview: true } : {};
-}
+// Bot Protection evidence is usually account-level summary data. Avoid turning
+// observed bot traffic into unsupported statements about exact WAF rule state.
+
+export const metadata = {
+  id: "bot-protection-certainty",
+  description:
+    "Soften unsupported Bot Protection / WAF certainty and require a staged rollout caveat.",
+};
+
+const STRING_FIELDS = ["what", "why", "fix", "currentBehavior", "desiredBehavior", "verify"];
+
+export function apply(rec) {
+  if (!String(rec?.candidateRef ?? "").startsWith("platform_bot_protection:")) return {};
+  const tags = [];
+  for (const field of STRING_FIELDS) {
+    if (typeof rec?.[field] !== "string") continue;
+    const before = rec[field];
+    let after = before
+      .replace(
+        /\bno\s+(?:firewall\s+)?bot_filter\s+rule\b/gi,
+        "the collected firewall summary did not show an enforced bot-filter rule",
+      )
+      .replace(
+        /\b(?:bots?|bot traffic)\s+(?:is|are)\s+the\s+cause\b/gi,
+        "bot traffic is a likely contributor",
+      )
+      .replace(
+        /\bwithout\s+false[- ]positive\s+risk\b/gi,
+        "with false-positive risk monitored during rollout",
+      )
+      .replace(
+        /\bno\s+false[- ]positive\s+risk\b/gi,
+        "false-positive risk still needs rollout monitoring",
+      );
+    if (after !== before) {
+      rec[field] = after;
+      tags.push(`bot-protection-certainty:${field}`);
+    }
+  }
+
+  const text = STRING_FIELDS.map((field) => rec?.[field])
+    .filter((s) => typeof s === "string")
+    .join("\n");
+  if (
+    /\b(?:Bot Protection|BotID|bot_filter|WAF)\b/i.test(text) &&
+    !/\bstaged\b[\s\S]{0,80}\b(?:log|allowlist|exclusions?)\b/i.test(text)
+  ) {
+    const caveat =
+      " Use a staged rollout that starts in Log mode where available, then moves to the appropriate Challenge or Deny action only after allowlist/exclusion review for known monitoring and partner clients.";
+    if (typeof rec.fix === "string") rec.fix += caveat;
+    else rec.fix = caveat.trim();
+    tags.push("bot-protection-certainty:staged-rollout");
+  }
+
+  return tags.length > 0 ? { tags, needsReview: true } : {};
+}

package/skills/craft/vercel-optimize/lib/sanitizers/cache-tag-invalidation-certainty.mjs

@@ -1,33 +1,33 @@
-// A cacheTag() in the cached function is not proof that CMS edits invalidate it.
-// The report must not claim "existing tags preserve instant updates" unless the
-// investigation verifies matching revalidateTag/updateTag paths.
-
-export const metadata = {
-  id: "cache-tag-invalidation-certainty",
-  description:
-    "Remove unsupported certainty that existing cache tags already preserve CMS/on-demand invalidation.",
-};
-
-const STRING_FIELDS = ["what", "why", "fix", "currentBehavior", "desiredBehavior", "verify"];
-const UNSUPPORTED_TAG_CERTAINTY =
-  /\b(?:existing|current)\s+(?:cache\s+)?tags?\b[^.!?\n]{0,160}\b(?:preserve|keep|cover|maintain|ensure)\b[^.!?\n]{0,160}\b(?:instant|on-demand|CMS|content|publish|update|updates|invalidation|revalidation)\b[^.!?\n]*(?:[.!?]|$)/gi;
-const SAFE_REPLACEMENT =
-  "Confirm a matching revalidateTag() or updateTag() path for each cacheTag() before increasing the cache lifetime.";
-
-export function apply(rec) {
-  const text = STRING_FIELDS.map((field) => rec?.[field])
-    .filter((s) => typeof s === "string")
-    .join("\n");
-  if (!/\bcache(?:Life|Tag)\b/.test(text)) return {};
-  const tags = [];
-  for (const field of STRING_FIELDS) {
-    if (typeof rec?.[field] !== "string") continue;
-    const before = rec[field];
-    const after = before.replace(UNSUPPORTED_TAG_CERTAINTY, SAFE_REPLACEMENT);
-    if (after !== before) {
-      rec[field] = after;
-      tags.push(`cache-tag-invalidation-certainty:${field}`);
-    }
-  }
-  return tags.length > 0 ? { tags, needsReview: true } : {};
-}
+// A cacheTag() in the cached function is not proof that CMS edits invalidate it.
+// The report must not claim "existing tags preserve instant updates" unless the
+// investigation verifies matching revalidateTag/updateTag paths.
+
+export const metadata = {
+  id: "cache-tag-invalidation-certainty",
+  description:
+    "Remove unsupported certainty that existing cache tags already preserve CMS/on-demand invalidation.",
+};
+
+const STRING_FIELDS = ["what", "why", "fix", "currentBehavior", "desiredBehavior", "verify"];
+const UNSUPPORTED_TAG_CERTAINTY =
+  /\b(?:existing|current)\s+(?:cache\s+)?tags?\b[^.!?\n]{0,160}\b(?:preserve|keep|cover|maintain|ensure)\b[^.!?\n]{0,160}\b(?:instant|on-demand|CMS|content|publish|update|updates|invalidation|revalidation)\b[^.!?\n]*(?:[.!?]|$)/gi;
+const SAFE_REPLACEMENT =
+  "Confirm a matching revalidateTag() or updateTag() path for each cacheTag() before increasing the cache lifetime.";
+
+export function apply(rec) {
+  const text = STRING_FIELDS.map((field) => rec?.[field])
+    .filter((s) => typeof s === "string")
+    .join("\n");
+  if (!/\bcache(?:Life|Tag)\b/.test(text)) return {};
+  const tags = [];
+  for (const field of STRING_FIELDS) {
+    if (typeof rec?.[field] !== "string") continue;
+    const before = rec[field];
+    const after = before.replace(UNSUPPORTED_TAG_CERTAINTY, SAFE_REPLACEMENT);
+    if (after !== before) {
+      rec[field] = after;
+      tags.push(`cache-tag-invalidation-certainty:${field}`);
+    }
+  }
+  return tags.length > 0 ? { tags, needsReview: true } : {};
+}

package/skills/craft/vercel-optimize/lib/sanitizers/count-correct.mjs

@@ -1,53 +1,53 @@
-// Rewrite verifier-failed count claims to ground truth (or "a number of"
-// when actual isn't numeric) so we don't ship false precision.
-
-import { escapeRegex } from "../util.mjs";
-
-export const metadata = {
-  id: "count-correct",
-  description:
-    'Rewrite count claims to verified ground truth (count-correct) or "a number of" (count-strip) when verifier disagrees.',
-};
-
-const COUNT_CLAIM_TYPES = new Set(["pattern_count", "repo_count", "cited_count_literal"]);
-
-export function apply(rec, ctx = {}) {
-  const results = ctx.verifyResults ?? rec.verifyResults ?? rec.verification?.failed ?? null;
-  if (!Array.isArray(results) || results.length === 0) return {};
-
-  const tags = [];
-
-  for (const r of results) {
-    if (!r) continue;
-    const type = r.type ?? r.claimType;
-    if (!COUNT_CLAIM_TYPES.has(type)) continue;
-    const disp = r.disposition ?? (r.actual !== r.expected ? "failed" : "verified");
-    if (disp !== "failed") continue;
-    const expected = r.expected;
-    const actual = r.actual;
-    const token = r.token ?? r.text ?? expected;
-    if (expected == null || token == null) continue;
-
-    if (typeof actual === "number" && Number.isFinite(actual)) {
-      rewriteCount(rec, token, expected, `~${actual}`);
-      tags.push(`count-correct:${token}:${expected}->${actual}`);
-    } else {
-      rewriteCount(rec, token, expected, "a number of");
-      tags.push(`count-strip:${token}`);
-    }
-  }
-
-  if (tags.length === 0) return {};
-  return { tags };
-}
-
-function rewriteCount(rec, token, oldCount, replacement) {
-  const fields = ["what", "why", "fix", "currentBehavior", "desiredBehavior"];
-  // Matches "60", "~60", and "60+" — LLM commonly writes "60+ icons".
-  const oldEsc = escapeRegex(String(oldCount));
-  const re = new RegExp(`\\b~?${oldEsc}\\+?\\s+${escapeRegex(token)}\\b`, "g");
-  for (const f of fields) {
-    if (typeof rec[f] !== "string") continue;
-    rec[f] = rec[f].replace(re, `${replacement} ${token}`);
-  }
-}
+// Rewrite verifier-failed count claims to ground truth (or "a number of"
+// when actual isn't numeric) so we don't ship false precision.
+
+import { escapeRegex } from "../util.mjs";
+
+export const metadata = {
+  id: "count-correct",
+  description:
+    'Rewrite count claims to verified ground truth (count-correct) or "a number of" (count-strip) when verifier disagrees.',
+};
+
+const COUNT_CLAIM_TYPES = new Set(["pattern_count", "repo_count", "cited_count_literal"]);
+
+export function apply(rec, ctx = {}) {
+  const results = ctx.verifyResults ?? rec.verifyResults ?? rec.verification?.failed ?? null;
+  if (!Array.isArray(results) || results.length === 0) return {};
+
+  const tags = [];
+
+  for (const r of results) {
+    if (!r) continue;
+    const type = r.type ?? r.claimType;
+    if (!COUNT_CLAIM_TYPES.has(type)) continue;
+    const disp = r.disposition ?? (r.actual !== r.expected ? "failed" : "verified");
+    if (disp !== "failed") continue;
+    const expected = r.expected;
+    const actual = r.actual;
+    const token = r.token ?? r.text ?? expected;
+    if (expected == null || token == null) continue;
+
+    if (typeof actual === "number" && Number.isFinite(actual)) {
+      rewriteCount(rec, token, expected, `~${actual}`);
+      tags.push(`count-correct:${token}:${expected}->${actual}`);
+    } else {
+      rewriteCount(rec, token, expected, "a number of");
+      tags.push(`count-strip:${token}`);
+    }
+  }
+
+  if (tags.length === 0) return {};
+  return { tags };
+}
+
+function rewriteCount(rec, token, oldCount, replacement) {
+  const fields = ["what", "why", "fix", "currentBehavior", "desiredBehavior"];
+  // Matches "60", "~60", and "60+" — LLM commonly writes "60+ icons".
+  const oldEsc = escapeRegex(String(oldCount));
+  const re = new RegExp(`\\b~?${oldEsc}\\+?\\s+${escapeRegex(token)}\\b`, "g");
+  for (const f of fields) {
+    if (typeof rec[f] !== "string") continue;
+    rec[f] = rec[f].replace(re, `${replacement} ${token}`);
+  }
+}

package/skills/craft/vercel-optimize/lib/sanitizers/function-duration-invocations.mjs

@@ -1,32 +1,32 @@
-// A function-duration optimization can reduce p95/CPU/GB-hr. It does not by
-// itself reduce function invocation count unless the fix also adds CDN/static
-// response caching.
-
-export const metadata = {
-  id: "function-duration-invocations",
-  description:
-    "Remove false claims that slow-route data-cache fixes reduce function invocation count.",
-};
-
-const STRING_FIELDS = ["what", "why", "fix", "currentBehavior", "desiredBehavior", "verify"];
-
-const BAD_INVOCATION_CLAIM =
-  /\bfunction invocations?\b[^.!?\n]{0,120}\b(?:drop|drops|fall|falls|decrease|decreases|decline|declines|reduce|reduces|reduced|cut|cuts)\b[^.!?\n]*(?:[.!?]|$)|\b(?:drop|drops|fall|falls|decrease|decreases|decline|declines|reduce|reduces|reduced|cut|cuts)\b[^.!?\n]{0,120}\bfunction invocations?\b[^.!?\n]*(?:[.!?]|$)/gi;
-
-const SAFE_REPLACEMENT =
-  "95th percentile duration should drop; function invocation count may stay flat unless a separate CDN or static-rendering change is made.";
-
-export function apply(rec) {
-  if (!String(rec?.candidateRef ?? "").startsWith("slow_route:")) return {};
-  const tags = [];
-  for (const field of STRING_FIELDS) {
-    if (typeof rec?.[field] !== "string") continue;
-    const before = rec[field];
-    const after = before.replace(BAD_INVOCATION_CLAIM, SAFE_REPLACEMENT);
-    if (after !== before) {
-      rec[field] = after;
-      tags.push(`function-duration-invocations:${field}`);
-    }
-  }
-  return tags.length > 0 ? { tags } : {};
-}
+// A function-duration optimization can reduce p95/CPU/GB-hr. It does not by
+// itself reduce function invocation count unless the fix also adds CDN/static
+// response caching.
+
+export const metadata = {
+  id: "function-duration-invocations",
+  description:
+    "Remove false claims that slow-route data-cache fixes reduce function invocation count.",
+};
+
+const STRING_FIELDS = ["what", "why", "fix", "currentBehavior", "desiredBehavior", "verify"];
+
+const BAD_INVOCATION_CLAIM =
+  /\bfunction invocations?\b[^.!?\n]{0,120}\b(?:drop|drops|fall|falls|decrease|decreases|decline|declines|reduce|reduces|reduced|cut|cuts)\b[^.!?\n]*(?:[.!?]|$)|\b(?:drop|drops|fall|falls|decrease|decreases|decline|declines|reduce|reduces|reduced|cut|cuts)\b[^.!?\n]{0,120}\bfunction invocations?\b[^.!?\n]*(?:[.!?]|$)/gi;
+
+const SAFE_REPLACEMENT =
+  "95th percentile duration should drop; function invocation count may stay flat unless a separate CDN or static-rendering change is made.";
+
+export function apply(rec) {
+  if (!String(rec?.candidateRef ?? "").startsWith("slow_route:")) return {};
+  const tags = [];
+  for (const field of STRING_FIELDS) {
+    if (typeof rec?.[field] !== "string") continue;
+    const before = rec[field];
+    const after = before.replace(BAD_INVOCATION_CLAIM, SAFE_REPLACEMENT);
+    if (after !== before) {
+      rec[field] = after;
+      tags.push(`function-duration-invocations:${field}`);
+    }
+  }
+  return tags.length > 0 ? { tags } : {};
+}

package/skills/craft/vercel-optimize/lib/sanitizers/index.mjs

@@ -1,87 +1,87 @@
-// Sanitizer orchestrator. Order matters: citation strippers must run
-// before missing-citation so an emptied citations[] still drops the rec.
-
-import { sanitizeCitations } from "../citations.mjs";
-import { applyDollarStrip } from "../impact-magnitude.mjs";
-import * as botProtectionCertainty from "./bot-protection-certainty.mjs";
-import * as cacheTagInvalidationCertainty from "./cache-tag-invalidation-certainty.mjs";
-import * as countCorrect from "./count-correct.mjs";
-import * as functionDurationInvocations from "./function-duration-invocations.mjs";
-import * as middlewareConflict from "./middleware-conflict.mjs";
-import * as missingCitation from "./missing-citation.mjs";
-import * as preRelease from "./pre-release.mjs";
-import * as rateLimit from "./rate-limit.mjs";
-import * as renderingModeMislabel from "./rendering-mode-mislabel.mjs";
-import * as undeclaredDep from "./undeclared-dep.mjs";
-import * as vercelDirectiveStrip from "./vercel-directive-strip.mjs";
-import * as windowUnits from "./window-units.mjs";
-
-export const SANITIZERS = [
-  vercelDirectiveStrip,
-  rateLimit,
-  preRelease,
-  middlewareConflict,
-  undeclaredDep,
-  countCorrect,
-  renderingModeMislabel,
-  windowUnits,
-  functionDurationInvocations,
-  botProtectionCertainty,
-  cacheTagInvalidationCertainty,
-];
-
-export function recordSanitizer(rec, tag) {
-  rec.sanitizerTrail = rec.sanitizerTrail ?? [];
-  rec.sanitizerTrail.push(tag);
-}
-
-export async function applySanitizers(rec, ctx = {}) {
-  applyDollarStrip(rec);
-
-  for (const s of SANITIZERS) {
-    const result = s.apply(rec, ctx) ?? {};
-    const tags = result.tags ?? (result.tag ? [result.tag] : []);
-    for (const t of tags) recordSanitizer(rec, t);
-    if (result.needsReview) rec.needsReview = true;
-    if (result.dropped) {
-      return {
-        kept: false,
-        rec,
-        dropReason: tags[0] ?? `dropped-by:${s.metadata?.id ?? "unknown"}`,
-      };
-    }
-  }
-
-  if (ctx.framework && ctx.version) {
-    const before = (rec.citations ?? []).slice();
-    const { strippedUnknown, strippedVersion } = await sanitizeCitations(
-      rec,
-      ctx.framework,
-      ctx.version,
-    );
-    for (const u of strippedUnknown) recordSanitizer(rec, `unknown-citation:${u}`);
-    for (const u of strippedVersion) recordSanitizer(rec, `version-mismatch:${u}`);
-    const lostAny = strippedUnknown.length > 0 || strippedVersion.length > 0;
-    const lostAll = lostAny && (rec.citations ?? []).length === 0 && before.length > 0;
-    if (lostAll) rec.needsReview = true;
-  }
-
-  // missing-citation runs LAST so citation strippers above can starve a rec.
-  const missing = missingCitation.apply(rec, ctx) ?? {};
-  if (missing.dropped) {
-    return { kept: false, rec, dropReason: missing.tag ?? "missing-citation" };
-  }
-
-  return { kept: true, rec };
-}
-
-export async function applySanitizersBatch(recs, ctx = {}) {
-  const kept = [];
-  const dropped = [];
-  for (const rec of recs) {
-    const r = await applySanitizers(rec, ctx);
-    if (r.kept) kept.push(r.rec);
-    else dropped.push({ rec: r.rec, dropReason: r.dropReason });
-  }
-  return { kept, dropped };
-}
+// Sanitizer orchestrator. Order matters: citation strippers must run
+// before missing-citation so an emptied citations[] still drops the rec.
+
+import { sanitizeCitations } from "../citations.mjs";
+import { applyDollarStrip } from "../impact-magnitude.mjs";
+import * as botProtectionCertainty from "./bot-protection-certainty.mjs";
+import * as cacheTagInvalidationCertainty from "./cache-tag-invalidation-certainty.mjs";
+import * as countCorrect from "./count-correct.mjs";
+import * as functionDurationInvocations from "./function-duration-invocations.mjs";
+import * as middlewareConflict from "./middleware-conflict.mjs";
+import * as missingCitation from "./missing-citation.mjs";
+import * as preRelease from "./pre-release.mjs";
+import * as rateLimit from "./rate-limit.mjs";
+import * as renderingModeMislabel from "./rendering-mode-mislabel.mjs";
+import * as undeclaredDep from "./undeclared-dep.mjs";
+import * as vercelDirectiveStrip from "./vercel-directive-strip.mjs";
+import * as windowUnits from "./window-units.mjs";
+
+export const SANITIZERS = [
+  vercelDirectiveStrip,
+  rateLimit,
+  preRelease,
+  middlewareConflict,
+  undeclaredDep,
+  countCorrect,
+  renderingModeMislabel,
+  windowUnits,
+  functionDurationInvocations,
+  botProtectionCertainty,
+  cacheTagInvalidationCertainty,
+];
+
+export function recordSanitizer(rec, tag) {
+  rec.sanitizerTrail = rec.sanitizerTrail ?? [];
+  rec.sanitizerTrail.push(tag);
+}
+
+export async function applySanitizers(rec, ctx = {}) {
+  applyDollarStrip(rec);
+
+  for (const s of SANITIZERS) {
+    const result = s.apply(rec, ctx) ?? {};
+    const tags = result.tags ?? (result.tag ? [result.tag] : []);
+    for (const t of tags) recordSanitizer(rec, t);
+    if (result.needsReview) rec.needsReview = true;
+    if (result.dropped) {
+      return {
+        kept: false,
+        rec,
+        dropReason: tags[0] ?? `dropped-by:${s.metadata?.id ?? "unknown"}`,
+      };
+    }
+  }
+
+  if (ctx.framework && ctx.version) {
+    const before = (rec.citations ?? []).slice();
+    const { strippedUnknown, strippedVersion } = await sanitizeCitations(
+      rec,
+      ctx.framework,
+      ctx.version,
+    );
+    for (const u of strippedUnknown) recordSanitizer(rec, `unknown-citation:${u}`);
+    for (const u of strippedVersion) recordSanitizer(rec, `version-mismatch:${u}`);
+    const lostAny = strippedUnknown.length > 0 || strippedVersion.length > 0;
+    const lostAll = lostAny && (rec.citations ?? []).length === 0 && before.length > 0;
+    if (lostAll) rec.needsReview = true;
+  }
+
+  // missing-citation runs LAST so citation strippers above can starve a rec.
+  const missing = missingCitation.apply(rec, ctx) ?? {};
+  if (missing.dropped) {
+    return { kept: false, rec, dropReason: missing.tag ?? "missing-citation" };
+  }
+
+  return { kept: true, rec };
+}
+
+export async function applySanitizersBatch(recs, ctx = {}) {
+  const kept = [];
+  const dropped = [];
+  for (const rec of recs) {
+    const r = await applySanitizers(rec, ctx);
+    if (r.kept) kept.push(r.rec);
+    else dropped.push({ rec: r.rec, dropReason: r.dropReason });
+  }
+  return { kept, dropped };
+}

package/skills/craft/vercel-optimize/lib/sanitizers/middleware-conflict.mjs

@@ -1,37 +1,37 @@
-// Append a caveat when a rec targets a route covered by middleware: e.g.
-// middleware setting Set-Cookie downstream poisons cache headers the rec
-// adds. Trusts finding.routesCovered rather than re-implementing Next's
-// matcher algorithm.
-
-import { extractRoute } from "../util.mjs";
-
-export const metadata = {
-  id: "middleware-conflict",
-  description: "Append caveat when rec targets a route covered by middleware.",
-};
-
-export function apply(rec, ctx = {}) {
-  const findings = ctx?.signals?.codebase?.findings ?? [];
-  const middlewareFinding = findings.find(
-    (f) => f?.scannerId === "middleware-broad-matcher" || f?.id === "middleware-broad-matcher",
-  );
-  if (!middlewareFinding) return {};
-
-  const route = extractRoute(rec);
-  if (!route) return {};
-
-  const matcher =
-    middlewareFinding.detail?.matcher ?? middlewareFinding.matcher ?? "(unspecified matcher)";
-  const middlewareFile = middlewareFinding.file ?? middlewareFinding.path ?? "middleware.ts";
-
-  const covered = middlewareFinding.detail?.routesCovered ?? middlewareFinding.routesCovered;
-  if (Array.isArray(covered) && covered.length > 0 && !covered.includes(route)) {
-    return {};
-  }
-
-  const tag = `middleware-conflict:${matcher}`;
-  const caveat = `\n\n_Caveat: Middleware at \`${middlewareFile}\` (matcher: \`${matcher}\`) may intercept \`${route}\` and alter request/response before this fix takes effect. Verify the middleware does not set headers (e.g. \`Set-Cookie\`) that would invalidate caching._`;
-
-  if (typeof rec.fix === "string") rec.fix += caveat;
-  return { tag, needsReview: true };
-}
+// Append a caveat when a rec targets a route covered by middleware: e.g.
+// middleware setting Set-Cookie downstream poisons cache headers the rec
+// adds. Trusts finding.routesCovered rather than re-implementing Next's
+// matcher algorithm.
+
+import { extractRoute } from "../util.mjs";
+
+export const metadata = {
+  id: "middleware-conflict",
+  description: "Append caveat when rec targets a route covered by middleware.",
+};
+
+export function apply(rec, ctx = {}) {
+  const findings = ctx?.signals?.codebase?.findings ?? [];
+  const middlewareFinding = findings.find(
+    (f) => f?.scannerId === "middleware-broad-matcher" || f?.id === "middleware-broad-matcher",
+  );
+  if (!middlewareFinding) return {};
+
+  const route = extractRoute(rec);
+  if (!route) return {};
+
+  const matcher =
+    middlewareFinding.detail?.matcher ?? middlewareFinding.matcher ?? "(unspecified matcher)";
+  const middlewareFile = middlewareFinding.file ?? middlewareFinding.path ?? "middleware.ts";
+
+  const covered = middlewareFinding.detail?.routesCovered ?? middlewareFinding.routesCovered;
+  if (Array.isArray(covered) && covered.length > 0 && !covered.includes(route)) {
+    return {};
+  }
+
+  const tag = `middleware-conflict:${matcher}`;
+  const caveat = `\n\n_Caveat: Middleware at \`${middlewareFile}\` (matcher: \`${matcher}\`) may intercept \`${route}\` and alter request/response before this fix takes effect. Verify the middleware does not set headers (e.g. \`Set-Cookie\`) that would invalidate caching._`;
+
+  if (typeof rec.fix === "string") rec.fix += caveat;
+  return { tag, needsReview: true };
+}

package/skills/craft/vercel-optimize/lib/sanitizers/missing-citation.mjs

@@ -1,16 +1,16 @@
-// Final-gate sanitizer: drops a rec with no citations left after
-// unknown-citation + version-mismatch have run. Every rec must carry ≥1
-// citation.
-
-export const metadata = {
-  id: "missing-citation",
-  description: "Drop rec when citations[] is empty after other sanitizers.",
-};
-
-export function apply(rec, _ctx = {}) {
-  const cites = Array.isArray(rec.citations) ? rec.citations : [];
-  if (cites.length === 0) {
-    return { dropped: true, tag: "missing-citation" };
-  }
-  return {};
-}
+// Final-gate sanitizer: drops a rec with no citations left after
+// unknown-citation + version-mismatch have run. Every rec must carry ≥1
+// citation.
+
+export const metadata = {
+  id: "missing-citation",
+  description: "Drop rec when citations[] is empty after other sanitizers.",
+};
+
+export function apply(rec, _ctx = {}) {
+  const cites = Array.isArray(rec.citations) ? rec.citations : [];
+  if (cites.length === 0) {
+    return { dropped: true, tag: "missing-citation" };
+  }
+  return {};
+}