@oriro/orirocli 0.1.9 → 0.1.11

package/skills/craft/vercel-optimize/lib/sanitizers/vercel-directive-strip.mjs

@@ -1,37 +1,37 @@
-// Strip Cache-Control directives Vercel's CDN silently ignores
-// (stale-if-error, proxy-revalidate, must-revalidate). s-maxage/max-age/
-// stale-while-revalidate/no-store/private/public are honored — leave them.
-
-import { escapeRegex } from "../util.mjs";
-
-const STRIP_DIRECTIVES = ["stale-if-error", "proxy-revalidate", "must-revalidate"];
-
-export const metadata = {
-  id: "vercel-directive-strip",
-  description: "Strip cache-control directives Vercel's CDN does not honor.",
-};
-
-export function apply(rec, _ctx = {}) {
-  const fields = ["fix", "currentBehavior", "desiredBehavior"];
-  const strippedSet = new Set();
-  for (const f of fields) {
-    if (typeof rec[f] !== "string") continue;
-    for (const directive of STRIP_DIRECTIVES) {
-      const re = new RegExp(`(?:,\\s*)?\\b${escapeRegex(directive)}\\b(?:\\s*,)?`, "g");
-      if (re.test(rec[f])) {
-        rec[f] = rec[f]
-          .replace(new RegExp(`\\b${escapeRegex(directive)}\\b`, "g"), "")
-          .replace(/,\s*,/g, ",")
-          .replace(/(['"])\s*,\s*/g, "$1, ")
-          .replace(/,\s*(['"])/g, ", $1")
-          .replace(/(['"])\s*,\s*(['"])/g, "$1, $2")
-          .replace(/\b(Cache-Control|cache-control)\b:\s*,\s*/g, "$1: ")
-          .replace(/(['"])\s*,\s*\1/g, "$1");
-        strippedSet.add(directive);
-      }
-    }
-  }
-  const stripped = [...strippedSet];
-  if (stripped.length === 0) return {};
-  return { tags: stripped.map((d) => `vercel-directive-strip:${d}`) };
-}
+// Strip Cache-Control directives Vercel's CDN silently ignores
+// (stale-if-error, proxy-revalidate, must-revalidate). s-maxage/max-age/
+// stale-while-revalidate/no-store/private/public are honored — leave them.
+
+import { escapeRegex } from "../util.mjs";
+
+const STRIP_DIRECTIVES = ["stale-if-error", "proxy-revalidate", "must-revalidate"];
+
+export const metadata = {
+  id: "vercel-directive-strip",
+  description: "Strip cache-control directives Vercel's CDN does not honor.",
+};
+
+export function apply(rec, _ctx = {}) {
+  const fields = ["fix", "currentBehavior", "desiredBehavior"];
+  const strippedSet = new Set();
+  for (const f of fields) {
+    if (typeof rec[f] !== "string") continue;
+    for (const directive of STRIP_DIRECTIVES) {
+      const re = new RegExp(`(?:,\\s*)?\\b${escapeRegex(directive)}\\b(?:\\s*,)?`, "g");
+      if (re.test(rec[f])) {
+        rec[f] = rec[f]
+          .replace(new RegExp(`\\b${escapeRegex(directive)}\\b`, "g"), "")
+          .replace(/,\s*,/g, ",")
+          .replace(/(['"])\s*,\s*/g, "$1, ")
+          .replace(/,\s*(['"])/g, ", $1")
+          .replace(/(['"])\s*,\s*(['"])/g, "$1, $2")
+          .replace(/\b(Cache-Control|cache-control)\b:\s*,\s*/g, "$1: ")
+          .replace(/(['"])\s*,\s*\1/g, "$1");
+        strippedSet.add(directive);
+      }
+    }
+  }
+  const stripped = [...strippedSet];
+  if (stripped.length === 0) return {};
+  return { tags: stripped.map((d) => `vercel-directive-strip:${d}`) };
+}

package/skills/craft/vercel-optimize/lib/sanitizers/window-units.mjs

@@ -1,26 +1,26 @@
-// The metrics window is fixed by collect-signals (currently 14d). Do not let
-// agent prose turn observed counts into monthly counts.
-
-import { normalizeObservedWindowUnits } from "../display-labels.mjs";
-
-export const metadata = {
-  id: "window-units",
-  description:
-    "Rewrite observed /mo or monthly count units to /window so reports do not imply extrapolated monthly data.",
-};
-
-const STRING_FIELDS = ["what", "why", "fix", "currentBehavior", "desiredBehavior", "verify"];
-
-export function apply(rec) {
-  const tags = [];
-  for (const field of STRING_FIELDS) {
-    if (typeof rec?.[field] !== "string") continue;
-    const before = rec[field];
-    const after = normalizeObservedWindowUnits(before);
-    if (after !== before) {
-      rec[field] = after;
-      tags.push(`window-units:${field}`);
-    }
-  }
-  return tags.length > 0 ? { tags } : {};
-}
+// The metrics window is fixed by collect-signals (currently 14d). Do not let
+// agent prose turn observed counts into monthly counts.
+
+import { normalizeObservedWindowUnits } from "../display-labels.mjs";
+
+export const metadata = {
+  id: "window-units",
+  description:
+    "Rewrite observed /mo or monthly count units to /window so reports do not imply extrapolated monthly data.",
+};
+
+const STRING_FIELDS = ["what", "why", "fix", "currentBehavior", "desiredBehavior", "verify"];
+
+export function apply(rec) {
+  const tags = [];
+  for (const field of STRING_FIELDS) {
+    if (typeof rec?.[field] !== "string") continue;
+    const before = rec[field];
+    const after = normalizeObservedWindowUnits(before);
+    if (after !== before) {
+      rec[field] = after;
+      tags.push(`window-units:${field}`);
+    }
+  }
+  return tags.length > 0 ? { tags } : {};
+}

package/skills/craft/vercel-optimize/lib/scanners/cache-components-suspense-dedupe.mjs

@@ -1,114 +1,114 @@
-// Detects the Cache Components anti-pattern where `'use cache'` doesn't dedupe across
-// separate `<Suspense>` boundaries — each boundary triggers a separate evaluation of the
-// "shared" cached function, multiplying invocations and ISR write pressure.
-//
-// Simplified single-file heuristic (cross-file segment analysis is out of scope):
-//   File contains `'use cache'` directive (or `use cache` keyword)
-//   AND file has 2+ `<Suspense ...>` boundaries
-//   AND a repeated fetch URL or function call appears in the body.
-//
-// False positives are tolerable: the support-topic body recommends a known-good remediation
-// (hoist promise to page, or move to `'use cache: remote'`) whether or not the specific call
-// site is the exact one paying the cost. The verifier abstains when the file structure
-// doesn't match the pitfall.
-
-import { lineOf } from "../util.mjs";
-
-export const metadata = {
-  id: "cache-components-suspense-dedupe",
-  title: "'use cache' with multiple Suspense boundaries on the same data",
-  severity: "medium",
-  billingDimension: "function-duration",
-  trafficIndependent: false,
-  description:
-    "Default `'use cache'` does not dedupe identical calls across separate `<Suspense>` boundaries on the same render. Each boundary re-invokes the cached function, multiplying function-duration cost and inflating ISR write churn when the output is large.",
-  fix: "Hoist the promise to the page level (`const dataPromise = fetchData()` at the top, passed down to each Suspense child) OR move the shared fetch into a `'use cache: remote'` data-access layer so cross-request and cross-boundary dedupe applies.",
-  citations: [
-    "https://nextjs.org/docs/app/api-reference/directives/use-cache",
-    "https://nextjs.org/docs/app/api-reference/config/next-config-js/cacheComponents",
-    "https://nextjs.org/docs/app/guides/migrating-to-cache-components",
-  ],
-  excludeGlobs: [
-    "node_modules/**",
-    ".next/**",
-    "dist/**",
-    "__tests__/**",
-    "**/*.test.*",
-    "**/*.spec.*",
-  ],
-  includeGlobs: [
-    "**/page.{ts,tsx,js,jsx}",
-    "**/layout.{ts,tsx,js,jsx}",
-    "**/components/**/*.{tsx,jsx}",
-  ],
-};
-
-const USE_CACHE_RE = /^[\t ]*['"]use cache['"]/m;
-const SUSPENSE_TAG_RE = /<Suspense\b/g;
-const FETCH_LITERAL_RE = /fetch\s*\(\s*(['"`])([^'"`]{6,200})\1/g;
-// Helper function calls that look like data-fetchers (lowercase camel, no JSX/HTML noise).
-const HELPER_CALL_RE = /\b(get|fetch|load|find|query|read)[A-Z][A-Za-z0-9_]+\s*\(/g;
-
-export function scan({ files }) {
-  const out = [];
-  for (const { path, content } of files) {
-    if (!USE_CACHE_RE.test(content)) continue;
-
-    const suspenseCount = countMatches(content, SUSPENSE_TAG_RE);
-    if (suspenseCount < 2) continue;
-
-    const repeated = findRepeated(content);
-    if (repeated.length === 0) continue;
-
-    // Anchor the finding to the first repeated call site so the customer
-    // can locate the duplicate quickly.
-    const first = repeated[0];
-    out.push({
-      pattern: metadata.id,
-      file: path,
-      line: lineOf(content, first.firstIdx),
-      evidence:
-        first.kind === "fetch"
-          ? `fetch("${truncate(first.token, 60)}") called ${first.count}× across Suspense boundaries`
-          : `${first.token}() called ${first.count}× across Suspense boundaries`,
-      trafficIndependent: metadata.trafficIndependent,
-      subtype: first.kind === "fetch" ? "fetch-literal" : "helper-call",
-    });
-  }
-  return out;
-}
-
-function countMatches(content, re) {
-  re.lastIndex = 0;
-  let n = 0;
-  while (re.exec(content) !== null) n++;
-  return n;
-}
-
-function findRepeated(content) {
-  const tokens = new Map(); // token -> { kind, count, firstIdx }
-  let m;
-  FETCH_LITERAL_RE.lastIndex = 0;
-  while ((m = FETCH_LITERAL_RE.exec(content)) !== null) {
-    record(tokens, m[2], "fetch", m.index);
-  }
-  HELPER_CALL_RE.lastIndex = 0;
-  while ((m = HELPER_CALL_RE.exec(content)) !== null) {
-    const name = m[0].replace(/\s*\($/, "").trim();
-    record(tokens, name, "helper", m.index);
-  }
-  return [...tokens.values()].filter((t) => t.count >= 2).sort((a, b) => b.count - a.count);
-}
-
-function record(map, token, kind, idx) {
-  if (!token) return;
-  if (!map.has(token)) {
-    map.set(token, { token, kind, count: 0, firstIdx: idx });
-  }
-  map.get(token).count++;
-}
-
-function truncate(s, n) {
-  if (s.length <= n) return s;
-  return s.slice(0, n - 1) + "…";
-}
+// Detects the Cache Components anti-pattern where `'use cache'` doesn't dedupe across
+// separate `<Suspense>` boundaries — each boundary triggers a separate evaluation of the
+// "shared" cached function, multiplying invocations and ISR write pressure.
+//
+// Simplified single-file heuristic (cross-file segment analysis is out of scope):
+//   File contains `'use cache'` directive (or `use cache` keyword)
+//   AND file has 2+ `<Suspense ...>` boundaries
+//   AND a repeated fetch URL or function call appears in the body.
+//
+// False positives are tolerable: the support-topic body recommends a known-good remediation
+// (hoist promise to page, or move to `'use cache: remote'`) whether or not the specific call
+// site is the exact one paying the cost. The verifier abstains when the file structure
+// doesn't match the pitfall.
+
+import { lineOf } from "../util.mjs";
+
+export const metadata = {
+  id: "cache-components-suspense-dedupe",
+  title: "'use cache' with multiple Suspense boundaries on the same data",
+  severity: "medium",
+  billingDimension: "function-duration",
+  trafficIndependent: false,
+  description:
+    "Default `'use cache'` does not dedupe identical calls across separate `<Suspense>` boundaries on the same render. Each boundary re-invokes the cached function, multiplying function-duration cost and inflating ISR write churn when the output is large.",
+  fix: "Hoist the promise to the page level (`const dataPromise = fetchData()` at the top, passed down to each Suspense child) OR move the shared fetch into a `'use cache: remote'` data-access layer so cross-request and cross-boundary dedupe applies.",
+  citations: [
+    "https://nextjs.org/docs/app/api-reference/directives/use-cache",
+    "https://nextjs.org/docs/app/api-reference/config/next-config-js/cacheComponents",
+    "https://nextjs.org/docs/app/guides/migrating-to-cache-components",
+  ],
+  excludeGlobs: [
+    "node_modules/**",
+    ".next/**",
+    "dist/**",
+    "__tests__/**",
+    "**/*.test.*",
+    "**/*.spec.*",
+  ],
+  includeGlobs: [
+    "**/page.{ts,tsx,js,jsx}",
+    "**/layout.{ts,tsx,js,jsx}",
+    "**/components/**/*.{tsx,jsx}",
+  ],
+};
+
+const USE_CACHE_RE = /^[\t ]*['"]use cache['"]/m;
+const SUSPENSE_TAG_RE = /<Suspense\b/g;
+const FETCH_LITERAL_RE = /fetch\s*\(\s*(['"`])([^'"`]{6,200})\1/g;
+// Helper function calls that look like data-fetchers (lowercase camel, no JSX/HTML noise).
+const HELPER_CALL_RE = /\b(get|fetch|load|find|query|read)[A-Z][A-Za-z0-9_]+\s*\(/g;
+
+export function scan({ files }) {
+  const out = [];
+  for (const { path, content } of files) {
+    if (!USE_CACHE_RE.test(content)) continue;
+
+    const suspenseCount = countMatches(content, SUSPENSE_TAG_RE);
+    if (suspenseCount < 2) continue;
+
+    const repeated = findRepeated(content);
+    if (repeated.length === 0) continue;
+
+    // Anchor the finding to the first repeated call site so the customer
+    // can locate the duplicate quickly.
+    const first = repeated[0];
+    out.push({
+      pattern: metadata.id,
+      file: path,
+      line: lineOf(content, first.firstIdx),
+      evidence:
+        first.kind === "fetch"
+          ? `fetch("${truncate(first.token, 60)}") called ${first.count}× across Suspense boundaries`
+          : `${first.token}() called ${first.count}× across Suspense boundaries`,
+      trafficIndependent: metadata.trafficIndependent,
+      subtype: first.kind === "fetch" ? "fetch-literal" : "helper-call",
+    });
+  }
+  return out;
+}
+
+function countMatches(content, re) {
+  re.lastIndex = 0;
+  let n = 0;
+  while (re.exec(content) !== null) n++;
+  return n;
+}
+
+function findRepeated(content) {
+  const tokens = new Map(); // token -> { kind, count, firstIdx }
+  let m;
+  FETCH_LITERAL_RE.lastIndex = 0;
+  while ((m = FETCH_LITERAL_RE.exec(content)) !== null) {
+    record(tokens, m[2], "fetch", m.index);
+  }
+  HELPER_CALL_RE.lastIndex = 0;
+  while ((m = HELPER_CALL_RE.exec(content)) !== null) {
+    const name = m[0].replace(/\s*\($/, "").trim();
+    record(tokens, name, "helper", m.index);
+  }
+  return [...tokens.values()].filter((t) => t.count >= 2).sort((a, b) => b.count - a.count);
+}
+
+function record(map, token, kind, idx) {
+  if (!token) return;
+  if (!map.has(token)) {
+    map.set(token, { token, kind, count: 0, firstIdx: idx });
+  }
+  map.get(token).count++;
+}
+
+function truncate(s, n) {
+  if (s.length <= n) return s;
+  return s.slice(0, n - 1) + "…";
+}

package/skills/craft/vercel-optimize/lib/scanners/edge-heavy-import.mjs

@@ -1,102 +1,102 @@
-// Flag node-only / heavy imports in edge-runtime files (either a
-// middleware basename or an `export const runtime = 'edge'`). These
-// either fail at deploy (node: builtins, native bindings) or inflate
-// cold-start latency. Line-anchored matches + type-only-import skip
-// keep FP low.
-
-const EDGE_RUNTIME_RE = /export\s+const\s+runtime\s*=\s*['"]edge['"]/;
-const IMPORT_RE = /^\s*import\s+(?:type\s+)?(?:[^'"]*\s+from\s+)?['"]([^'"]+)['"]/gm;
-const DYNAMIC_IMPORT_RE = /\bimport\(\s*['"]([^'"]+)['"]\s*\)/g;
-const REQUIRE_RE = /\brequire\(\s*['"]([^'"]+)['"]\s*\)/g;
-const TYPE_IMPORT_RE = /^\s*import\s+type\s+/;
-
-const HEAVY_PATTERNS = [
-  /^node:/,
-  /^sharp$/,
-  /^@aws-sdk\//,
-  /^@prisma\/client$/,
-  /^prisma$/,
-  /^pg$/,
-  /^mysql2(?:\/|$)/,
-  /^puppeteer(?:-core)?(?:\/|$)/,
-  /^playwright(?:-core)?(?:\/|$)/,
-  /^bcrypt$/,
-  /^jsonwebtoken$/,
-  /^canvas$/,
-  /^@google-cloud\//,
-];
-
-export const metadata = {
-  id: "edge-heavy-import",
-  title: "Heavy / node-only import inside edge-runtime file",
-  severity: "high",
-  billingDimension: "function-duration",
-  trafficIndependent: true,
-  description:
-    "Edge runtime is a constrained sandbox with no node: builtins and a much smaller cold-start budget than Node functions. Heavy SDKs (sharp, @aws-sdk/*, @prisma/client, pg, puppeteer) either fail at deploy or inflate cold-start latency. Move the import to a Node runtime function, or replace with an edge-compatible alternative (e.g., neon-driver instead of pg).",
-  fix: "Either (a) drop the `export const runtime = 'edge'` so the route runs on Node (default in 2026), or (b) replace the heavy import with an edge-compatible alternative. For DB: use @neondatabase/serverless or @planetscale/database instead of pg/mysql2. For image: do the work in a Node route handler. For auth signing: use jose (Web Crypto) instead of jsonwebtoken.",
-  citations: [
-    "https://vercel.com/docs/functions/runtimes/edge-runtime",
-    "https://vercel.com/docs/fluid-compute",
-  ],
-  excludeGlobs: [
-    "node_modules/**",
-    ".next/**",
-    "dist/**",
-    "__tests__/**",
-    "**/*.test.*",
-    "**/*.spec.*",
-  ],
-  includeGlobs: ["**/*.{ts,tsx,js,mjs}"],
-};
-
-export function scan({ files }) {
-  const out = [];
-  for (const { path, content } of files) {
-    if (!isEdgeRuntimeFile(path, content)) continue;
-    const lines = content.split("\n");
-    for (let i = 0; i < lines.length; i++) {
-      const line = lines[i];
-      // Type-only imports are erased at compile, never reach runtime.
-      if (TYPE_IMPORT_RE.test(line)) continue;
-      const specifiers = extractSpecifiers(line);
-      for (const spec of specifiers) {
-        const match = HEAVY_PATTERNS.find((re) => re.test(spec));
-        if (!match) continue;
-        out.push({
-          pattern: metadata.id,
-          file: path,
-          line: i + 1,
-          evidence: `import "${spec}" in edge-runtime file`,
-          edgeReason: isMiddleware(path)
-            ? "middleware (always edge)"
-            : 'export const runtime = "edge"',
-          importedModule: spec,
-          trafficIndependent: metadata.trafficIndependent,
-        });
-      }
-    }
-  }
-  return out;
-}
-
-function isEdgeRuntimeFile(path, content) {
-  return isMiddleware(path) || EDGE_RUNTIME_RE.test(content);
-}
-
-function isMiddleware(path) {
-  return /(?:^|\/)middleware\.(ts|tsx|js|mjs)$/.test(path);
-}
-
-function extractSpecifiers(line) {
-  const out = new Set();
-  // IMPORT_RE has `gm` flag — reset lastIndex per call.
-  IMPORT_RE.lastIndex = 0;
-  let m;
-  while ((m = IMPORT_RE.exec(line)) !== null) out.add(m[1]);
-  DYNAMIC_IMPORT_RE.lastIndex = 0;
-  while ((m = DYNAMIC_IMPORT_RE.exec(line)) !== null) out.add(m[1]);
-  REQUIRE_RE.lastIndex = 0;
-  while ((m = REQUIRE_RE.exec(line)) !== null) out.add(m[1]);
-  return [...out];
-}
+// Flag node-only / heavy imports in edge-runtime files (either a
+// middleware basename or an `export const runtime = 'edge'`). These
+// either fail at deploy (node: builtins, native bindings) or inflate
+// cold-start latency. Line-anchored matches + type-only-import skip
+// keep FP low.
+
+const EDGE_RUNTIME_RE = /export\s+const\s+runtime\s*=\s*['"]edge['"]/;
+const IMPORT_RE = /^\s*import\s+(?:type\s+)?(?:[^'"]*\s+from\s+)?['"]([^'"]+)['"]/gm;
+const DYNAMIC_IMPORT_RE = /\bimport\(\s*['"]([^'"]+)['"]\s*\)/g;
+const REQUIRE_RE = /\brequire\(\s*['"]([^'"]+)['"]\s*\)/g;
+const TYPE_IMPORT_RE = /^\s*import\s+type\s+/;
+
+const HEAVY_PATTERNS = [
+  /^node:/,
+  /^sharp$/,
+  /^@aws-sdk\//,
+  /^@prisma\/client$/,
+  /^prisma$/,
+  /^pg$/,
+  /^mysql2(?:\/|$)/,
+  /^puppeteer(?:-core)?(?:\/|$)/,
+  /^playwright(?:-core)?(?:\/|$)/,
+  /^bcrypt$/,
+  /^jsonwebtoken$/,
+  /^canvas$/,
+  /^@google-cloud\//,
+];
+
+export const metadata = {
+  id: "edge-heavy-import",
+  title: "Heavy / node-only import inside edge-runtime file",
+  severity: "high",
+  billingDimension: "function-duration",
+  trafficIndependent: true,
+  description:
+    "Edge runtime is a constrained sandbox with no node: builtins and a much smaller cold-start budget than Node functions. Heavy SDKs (sharp, @aws-sdk/*, @prisma/client, pg, puppeteer) either fail at deploy or inflate cold-start latency. Move the import to a Node runtime function, or replace with an edge-compatible alternative (e.g., neon-driver instead of pg).",
+  fix: "Either (a) drop the `export const runtime = 'edge'` so the route runs on Node (default in 2026), or (b) replace the heavy import with an edge-compatible alternative. For DB: use @neondatabase/serverless or @planetscale/database instead of pg/mysql2. For image: do the work in a Node route handler. For auth signing: use jose (Web Crypto) instead of jsonwebtoken.",
+  citations: [
+    "https://vercel.com/docs/functions/runtimes/edge-runtime",
+    "https://vercel.com/docs/fluid-compute",
+  ],
+  excludeGlobs: [
+    "node_modules/**",
+    ".next/**",
+    "dist/**",
+    "__tests__/**",
+    "**/*.test.*",
+    "**/*.spec.*",
+  ],
+  includeGlobs: ["**/*.{ts,tsx,js,mjs}"],
+};
+
+export function scan({ files }) {
+  const out = [];
+  for (const { path, content } of files) {
+    if (!isEdgeRuntimeFile(path, content)) continue;
+    const lines = content.split("\n");
+    for (let i = 0; i < lines.length; i++) {
+      const line = lines[i];
+      // Type-only imports are erased at compile, never reach runtime.
+      if (TYPE_IMPORT_RE.test(line)) continue;
+      const specifiers = extractSpecifiers(line);
+      for (const spec of specifiers) {
+        const match = HEAVY_PATTERNS.find((re) => re.test(spec));
+        if (!match) continue;
+        out.push({
+          pattern: metadata.id,
+          file: path,
+          line: i + 1,
+          evidence: `import "${spec}" in edge-runtime file`,
+          edgeReason: isMiddleware(path)
+            ? "middleware (always edge)"
+            : 'export const runtime = "edge"',
+          importedModule: spec,
+          trafficIndependent: metadata.trafficIndependent,
+        });
+      }
+    }
+  }
+  return out;
+}
+
+function isEdgeRuntimeFile(path, content) {
+  return isMiddleware(path) || EDGE_RUNTIME_RE.test(content);
+}
+
+function isMiddleware(path) {
+  return /(?:^|\/)middleware\.(ts|tsx|js|mjs)$/.test(path);
+}
+
+function extractSpecifiers(line) {
+  const out = new Set();
+  // IMPORT_RE has `gm` flag — reset lastIndex per call.
+  IMPORT_RE.lastIndex = 0;
+  let m;
+  while ((m = IMPORT_RE.exec(line)) !== null) out.add(m[1]);
+  DYNAMIC_IMPORT_RE.lastIndex = 0;
+  while ((m = DYNAMIC_IMPORT_RE.exec(line)) !== null) out.add(m[1]);
+  REQUIRE_RE.lastIndex = 0;
+  while ((m = REQUIRE_RE.exec(line)) !== null) out.add(m[1]);
+  return [...out];
+}

package/skills/craft/vercel-optimize/lib/scanners/force-dynamic.mjs

@@ -1,39 +1,39 @@
-export const metadata = {
-  id: "force-dynamic",
-  title: "export const dynamic = 'force-dynamic'",
-  severity: "medium",
-  billingDimension: "function-duration",
-  trafficIndependent: false,
-  description:
-    "force-dynamic disables static + ISR rendering. The route runs the function on every request. Sometimes necessary (cookies, headers, real-time data), often a habit that costs function-duration and edge-requests at scale.",
-  fix: "Audit the route. If dynamic behavior comes from cookies()/headers()/searchParams, force-dynamic may be redundant — Next infers dynamic automatically. Consider revalidate / 'use cache' / generateStaticParams if any portion can be pre-rendered.",
-  citations: ["https://nextjs.org/docs/app/api-reference/file-conventions/route-segment-config"],
-  excludeGlobs: ["node_modules/**", ".next/**", "dist/**", "__tests__/**"],
-  includeGlobs: ["**/route.{ts,tsx,js,jsx}", "**/page.{ts,tsx,js,jsx}"],
-};
-
-const RE = /export\s+const\s+dynamic\s*=\s*["']force-dynamic["']/;
-
-export function scan({ files }) {
-  const out = [];
-  for (const { path, content } of files) {
-    if (!isApplicable(path)) continue;
-    const m = RE.exec(content);
-    if (m) {
-      out.push({
-        pattern: metadata.id,
-        file: path,
-        line: lineOf(content, m.index),
-        evidence: 'export const dynamic = "force-dynamic"',
-        trafficIndependent: metadata.trafficIndependent,
-      });
-    }
-  }
-  return out;
-}
-
-import { lineOf } from "../util.mjs";
-
-function isApplicable(path) {
-  return /(\/route|\/page)\.(tsx?|jsx?)$/.test(path);
-}
+export const metadata = {
+  id: "force-dynamic",
+  title: "export const dynamic = 'force-dynamic'",
+  severity: "medium",
+  billingDimension: "function-duration",
+  trafficIndependent: false,
+  description:
+    "force-dynamic disables static + ISR rendering. The route runs the function on every request. Sometimes necessary (cookies, headers, real-time data), often a habit that costs function-duration and edge-requests at scale.",
+  fix: "Audit the route. If dynamic behavior comes from cookies()/headers()/searchParams, force-dynamic may be redundant — Next infers dynamic automatically. Consider revalidate / 'use cache' / generateStaticParams if any portion can be pre-rendered.",
+  citations: ["https://nextjs.org/docs/app/api-reference/file-conventions/route-segment-config"],
+  excludeGlobs: ["node_modules/**", ".next/**", "dist/**", "__tests__/**"],
+  includeGlobs: ["**/route.{ts,tsx,js,jsx}", "**/page.{ts,tsx,js,jsx}"],
+};
+
+const RE = /export\s+const\s+dynamic\s*=\s*["']force-dynamic["']/;
+
+export function scan({ files }) {
+  const out = [];
+  for (const { path, content } of files) {
+    if (!isApplicable(path)) continue;
+    const m = RE.exec(content);
+    if (m) {
+      out.push({
+        pattern: metadata.id,
+        file: path,
+        line: lineOf(content, m.index),
+        evidence: 'export const dynamic = "force-dynamic"',
+        trafficIndependent: metadata.trafficIndependent,
+      });
+    }
+  }
+  return out;
+}
+
+import { lineOf } from "../util.mjs";
+
+function isApplicable(path) {
+  return /(\/route|\/page)\.(tsx?|jsx?)$/.test(path);
+}