Skip to content

Surface static package dependents after publish - #430

Merged
kentcdodds merged 11 commits into
mainfrom
cursor/package-publish-dependent-summary
May 10, 2026
Merged

kentcdodds merged 11 commits into
mainfrom
cursor/package-publish-dependent-summary

Conversation

@kentcdodds

@kentcdodds kentcdodds commented May 10, 2026 •

Copy link
Copy Markdown
Owner

Summary

  • Add bounded static dependent summaries to package_publish_external_push published/already_published responses.
  • Query persisted published bundle artifact dependency metadata instead of scanning package repos.
  • Preserve visibility-only behavior: no automatic dependent republishing.
  • Add a breaking manifest contract: direct bundled kody:@... imports must match package.json#kody.dependencies declarations.
  • Align type-only kody:@ imports so they do not count as static dependencies or get bundled; declaration files are treated as type-only; literal dynamic import("kody:@...") is bundled and must be declared.
  • Record bundle dependency metadata from entrypoint-reachable source files, including self kody:@this-package/... exports, so dependent entrypoints are not over-reported and dead files do not break unrelated entrypoints.
  • Prioritize stale dependent entrypoints in bounded summaries so agents can see why a dependent is stale.
  • Document static kody:@ bundled snapshot semantics and dependent republish guidance.

Validation

  • npx vitest run --project node-unit --project workers-unit packages/worker/src/package-runtime/import-specifiers.node.test.ts packages/worker/src/package-runtime/module-graph.node.test.ts packages/worker/src/repo/checks.node.test.ts packages/worker/src/package-runtime/published-bundle-artifacts.node.test.ts packages/worker/src/repo/published-bundle-artifacts-repo.workers.test.ts packages/worker/src/package-runtime/static-package-dependents.node.test.ts packages/worker/src/mcp/capabilities/packages/publish-external-push.node.test.ts (62 tests passed)
  • npm run typecheck
  • npm run validate
Open in Web Open in Cursor 

Summary by CodeRabbit

  • Documentation

    • Added guidance on declaring static Kody package dependencies (kody.dependencies), how static imports are bundled as snapshots, and publish-time metadata behavior.
  • New Features

    • Publish responses now include a bounded summary of directly dependent packages and their staleness relative to the published commit.
  • Tests

    • Expanded test coverage for static-dependents reporting, dependency validation, import collection, and DB query behavior.

Review Change Stack

Co-authored-by: Kent C. Dodds <me+github@kentcdodds.com>
@coderabbitai

coderabbitai Bot commented May 10, 2026 •

Copy link
Copy Markdown
📝 Walkthrough

Walkthrough

This PR adds static package dependents metadata to publish responses. It introduces a DB query layer to identify packages with statically bundled references to a published package, a summary builder that groups and ranks those dependents, integrates the summary into the publish-external-push capability handler, extends repo checks and manifest schema for kody.dependencies, and updates tests and docs.

Changes

Static Dependents Reporting

Layer / File(s) Summary
Static import collection & filtering
packages/worker/src/package-runtime/static-kody-imports.ts, packages/worker/src/package-runtime/import-specifiers.ts, packages/worker/src/package-runtime/import-specifiers.node.test.ts, packages/worker/src/package-runtime/published-bundle-artifacts.ts
Collect literal kody:@... imports from in-memory files, ignore .d.ts-like files and type-only import/export nodes, and replace regex scanning with the collector.
Package manifest schema
packages/worker/src/package-registry/types.ts
Add kody.dependencies validation: scoped package name regex, trimmed unique array, and extend authoredPackageKodySchema.
Repo types & DB queries
packages/worker/src/repo/published-bundle-artifacts-repo.ts
Add StaticDependentBundleArtifactRow/StaticDependentBundleArtifactCounts types and countStaticDependentBundleArtifactPackages / listStaticDependentBundleArtifactRows query helpers (CTEs, windowing, limits).
DB query tests
packages/worker/src/repo/published-bundle-artifacts-repo.node.test.ts, packages/worker/src/repo/published-bundle-artifacts-repo.workers.test.ts
Mocked D1 tests validating SQL generation, binding parameters, JSON dependency access, windowing, and end-to-end workers test for summary results.
Summary builder & entrypoint
packages/worker/src/package-runtime/static-package-dependents.ts
buildStaticPackageDependentsSummary groups rows by dependent, computes stale/truncation flags, entrypoints, recommended actions; getStaticPackageDependentsSummary coordinates DB queries and delegates to builder.
Builder tests
packages/worker/src/package-runtime/static-package-dependents.node.test.ts
Tests for stale detection, mixed/missing commit handling, entrypoint-driven truncation, empty input, and truncation semantics.
Handler schemas & helper
packages/worker/src/mcp/capabilities/packages/publish-external-push.ts
Add Zod schemas for static_dependents. Helper getPublishStaticDependents computes summary from published commit; capability description updated.
Handler integration & tests
packages/worker/src/mcp/capabilities/packages/publish-external-push.ts, packages/worker/src/mcp/capabilities/packages/publish-external-push.node.test.ts
Merge computed static_dependents into already_published and published responses; extend tests to mock/assert static_dependents and call args; update retry expectations.
Repo checks & tests
packages/worker/src/repo/checks.ts, packages/worker/src/repo/checks.node.test.ts
Validate manifest.kody.dependencies against collected static kody:@... imports; add helpers and tests for missing/unused/invalid declarations, ignoring type-only and .d.ts imports, and literal dynamic import declaration requirements.
Documentation
docs/contributing/packages-and-manifests.md, docs/use/packages.md
Document kody.dependencies manifest field, snapshot bundling semantics for static kody:@... imports, and that package_publish_external_push may return bounded static_dependents without republishing dependents automatically.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~25 minutes

Possibly related PRs

  • kentcdodds/kody#352: Extends the external publish flow and previously touched publish-external-push behavior; related at the publish capability level.
  • kentcdodds/kody#427: Also modifies the publish-external-push capability handler; likely overlaps in handler logic.
  • kentcdodds/kody#251: Introduced published bundle artifact storage and DB schema used by these static-dependent queries.

Poem

🐰 In bundles bundled, snapshots stay frozen in time,
While dependents wait, their commits out of rhyme,
I counted the links and tidied the list—
A rabbit’s reminder: republish if missed!

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Docstring Coverage ⚠️ Warning Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (4 passed)
Check name Status Explanation
Title check ✅ Passed The title clearly and concisely summarizes the main change: exposing static package dependents in the response after publishing a package.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
📝 Generate docstrings
  • Create stacked PR
  • Commit on current branch
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch cursor/package-publish-dependent-summary

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

@github-actions

github-actions Bot commented May 10, 2026 •

Copy link
Copy Markdown
Contributor

🔎 Preview deployed: https://kody-pr-430.kentcdodds.workers.dev

Worker: kody-pr-430
D1: kody-pr-430-db
KV: kody-pr-430-oauth-kv

Mocks:

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧹 Nitpick comments (6)
docs/use/packages.md (1)

75-78: 💤 Low value

LGTM — accurately documents static snapshot semantics and the static_dependents payload.

The snapshot/dynamic distinction is clearly framed and matches the runtime behavior. One tiny copy nit (skip if you don't care): "when the metadata is available" on line 228-229 is a bit hand-wavy — the contributing doc's "when the published commit is available" is sharper since that's the actual precondition in getPublishStaticDependents.

Also applies to: 228-241

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/use/packages.md` around lines 75 - 78, Update the wording in the docs to
replace the vague phrase "when the metadata is available" with the precise
precondition "when the published commit is available" to match the
implementation in getPublishStaticDependents; find the occurrences around the
paragraph describing static snapshot semantics (lines referenced in the review)
and change the phrasing so the docs state that static dependents are applied
when the published commit is available, ensuring consistency with the
getPublishStaticDependents behavior.
packages/worker/src/package-runtime/static-package-dependents.ts (2)

7-8: 💤 Low value

Optional: export both default limits for symmetry.

defaultStaticDependentPackageLimit is exported but defaultStaticDependentArtifactsPerPackageLimit is module-private. Callers that want to override packageLimit while keeping the artifacts default consistent (or surface defaults in docs/tests) currently can't reference the latter without duplicating the literal. Cheap to expose.

♻️ Proposed change
 export const defaultStaticDependentPackageLimit = 10
-const defaultStaticDependentArtifactsPerPackageLimit = 5
+export const defaultStaticDependentArtifactsPerPackageLimit = 5
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@packages/worker/src/package-runtime/static-package-dependents.ts` around
lines 7 - 8, The second default constant
defaultStaticDependentArtifactsPerPackageLimit is module-private but should be
exported for symmetry and reuse; update its declaration to export it (export
const defaultStaticDependentArtifactsPerPackageLimit = 5) so callers/tests/docs
can reference the artifacts-per-package default just like
defaultStaticDependentPackageLimit and avoid duplicating the literal; ensure any
imports elsewhere use the exported name from static-package-dependents.

138-157: 💤 Low value

Minor: entrypoints_truncated semantics are slightly broader than the schema docstring suggests.

The flag fires when matchingArtifactCount > min(entrypoints.length, artifactsPerPackageLimit). Because entrypoints is deduplicated by entryPoint, two artifacts that share an entryPoint but differ in artifactKind/artifactName collapse to one entry, which can flip entrypoints_truncated to true even when every retrieved row is represented. The corresponding staticDependentItemSchema.entrypoints_truncated description in publish-external-push.ts ("True when the dependent has more matching entrypoints than returned") implies a stricter "more entrypoints than returned" semantic. Either is defensible, but agents reading the schema may interpret it more narrowly than the implementation.

Two low-cost options:

  • Tighten the wording to e.g. "True when the dependent has more matching artifacts than the entrypoints returned".
  • Or rank/dedupe entrypoints against matchingArtifactCount in a way that aligns with the docstring.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@packages/worker/src/package-runtime/static-package-dependents.ts` around
lines 138 - 157, The current entrypoints_truncated logic uses
matchingArtifactCount > Math.min(item.entrypoints.length,
artifactsPerPackageLimit) which mixes artifact-level counts with deduped
entrypoint rows; update the logic and docs to be consistent: either (A) change
the boolean computation in static-package-dependents.ts (the
entrypoints_truncated field) to compare matchingArtifactCount against
artifactsPerPackageLimit (e.g. matchingArtifactCount > artifactsPerPackageLimit)
so it reflects "more matching artifacts than returned", or (B) leave the code
but update the staticDependentItemSchema docstring in publish-external-push.ts
to explicitly say "True when the dependent has more matching artifacts than the
entrypoints returned (artifacts may collapse to fewer entrypoints)"; pick one
approach and apply it to the variables entrypoints_truncated,
matchingArtifactCount, artifactsPerPackageLimit, and staticDependentItemSchema
so semantics and docs align.
packages/worker/src/repo/published-bundle-artifacts-repo.ts (1)

112-248: ⚡ Quick win

SQL is correct; flag for operational follow-up at scale.

Both queries correctly bound results (package_rank/artifact_rank) and stale-rank packages first, and the bind order matches the ? positions. One operational note: the dependent-side filter is json_extract(dependency.value, '$.sourceId') = ?, which D1/SQLite cannot satisfy with a normal column index on published_bundle_artifacts. Each publish for a user will effectively scan that user's artifacts and expand dependencies_json via json_each. That's fine today but is worth keeping in mind as bundle counts grow.

Possible follow-ups (no action needed in this PR):

  • Add a lightweight published_bundle_artifact_dependencies association table (artifact_id, dependency_source_id, dependency_published_commit) populated alongside the existing dependencies_json upserts, with an index on (user_id, dependency_source_id). Then the count/list queries can target that table directly and stay sub-linear in artifact count.
  • Or, add a generated/expression index (where supported) on the JSON path, though D1's support for that is more limited.
  • Add a query timing log or Sentry breadcrumb around getStaticPackageDependentsSummary so growth in this hot path on publish surfaces in observability.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@packages/worker/src/repo/published-bundle-artifacts-repo.ts` around lines 112
- 248, The queries in countStaticDependentBundleArtifactPackages and
listStaticDependentBundleArtifactRows currently filter on
json_extract(dependency.value, '$.sourceId') = ? which forces per-user scans and
json_each expansion as bundle counts grow; to address this operationally, add a
lightweight published_bundle_artifact_dependencies association table
(artifact_id, dependency_source_id, dependency_published_commit, user_id)
populated during the same upsert that writes dependencies_json (or maintain it
in the publish flow), index (user_id, dependency_source_id), and update
getStaticPackageDependentsSummary to query that table instead of json_each;
alternatively, add a generated/expression index on the JSON path where supported
and add timing/log breadcrumbs around getStaticPackageDependentsSummary to
surface regressions.
packages/worker/src/mcp/capabilities/packages/publish-external-push.node.test.ts (1)

75-237: 💤 Low value

LGTM — mock + tests cover the new contract well, including currentDependencyCommit plumbing.

Asserting that getStaticPackageDependentsSummary was called with currentDependencyCommit: 'commit-new' is exactly the right hook to lock down the publish-time wiring. The outputTypeDefinition substring checks also nicely guard the schema surface.

Optional, low-priority: the 'No published bundle artifacts currently declare a static dependency on this package.' literal is duplicated across beforeEach, the basic already_published test, and the retry test. Pulling it into a shared const (or importing it from the runtime module if exported) would prevent drift if the copy is tweaked.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In
`@packages/worker/src/mcp/capabilities/packages/publish-external-push.node.test.ts`
around lines 75 - 237, The duplicate recommendation string is repeated in the
test setup and two tests; introduce a single shared constant (e.g., const
NO_STATIC_DEPENDENTS_MSG = 'No published bundle artifacts currently declare a
static dependency on this package.') at the top of the test file and replace the
three literal occurrences (the initial
mockModule.getStaticPackageDependentsSummary.mockResolvedValue call in the
beforeEach, the expected static_dependents.recommended_next_action in the
'returns already_published' test, and any other repeated assertions) with that
constant, or alternatively import the canonical value from the runtime module if
it is exported; update all references so the tests assert against
NO_STATIC_DEPENDENTS_MSG instead of the hard-coded string.
packages/worker/src/mcp/capabilities/packages/publish-external-push.ts (1)

266-317: 💤 Low value

Optional: collapse the three static_dependents augmentation sites into one helper.

The early already_published, the post-publishFromExternalRef already_published, and the published branches all repeat the same wiring (db: ctx.env.APP_DB, userId: user.userId, sourceId: source.id, then call getPublishStaticDependents, then spread). A tiny helper makes the handler easier to read and keeps the three branches from drifting apart over time.

♻️ Sketch
const augmentWithStaticDependents = async <
	T extends { published_commit: string | null },
>(
	result: T,
): Promise<T & { static_dependents: StaticPackageDependentsSummary }> => ({
	...result,
	static_dependents: await getPublishStaticDependents({
		db: ctx.env.APP_DB,
		userId: user.userId,
		sourceId: source.id,
		publishedCommit: result.published_commit,
	}),
})

Then each branch becomes return await augmentWithStaticDependents(...).

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@packages/worker/src/mcp/capabilities/packages/publish-external-push.ts`
around lines 266 - 317, Extract the repeated augmentation logic that calls
getPublishStaticDependents into a small helper (e.g.
augmentWithStaticDependents) and replace the three places that manually spread
static_dependents (the early already_published branch, the result.status ===
'already_published' branch, and the published branch after
repoSessionRpc(...).publishFromExternalRef) with a single call to that helper;
the helper should accept the result object (typed to have published_commit) and
return the result plus static_dependents using ctx.env.APP_DB, user.userId and
source.id so callers simply do "return await
augmentWithStaticDependents(resultOrInlineObject)".
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@docs/use/packages.md`:
- Around line 75-78: Update the wording in the docs to replace the vague phrase
"when the metadata is available" with the precise precondition "when the
published commit is available" to match the implementation in
getPublishStaticDependents; find the occurrences around the paragraph describing
static snapshot semantics (lines referenced in the review) and change the
phrasing so the docs state that static dependents are applied when the published
commit is available, ensuring consistency with the getPublishStaticDependents
behavior.

In
`@packages/worker/src/mcp/capabilities/packages/publish-external-push.node.test.ts`:
- Around line 75-237: The duplicate recommendation string is repeated in the
test setup and two tests; introduce a single shared constant (e.g., const
NO_STATIC_DEPENDENTS_MSG = 'No published bundle artifacts currently declare a
static dependency on this package.') at the top of the test file and replace the
three literal occurrences (the initial
mockModule.getStaticPackageDependentsSummary.mockResolvedValue call in the
beforeEach, the expected static_dependents.recommended_next_action in the
'returns already_published' test, and any other repeated assertions) with that
constant, or alternatively import the canonical value from the runtime module if
it is exported; update all references so the tests assert against
NO_STATIC_DEPENDENTS_MSG instead of the hard-coded string.

In `@packages/worker/src/mcp/capabilities/packages/publish-external-push.ts`:
- Around line 266-317: Extract the repeated augmentation logic that calls
getPublishStaticDependents into a small helper (e.g.
augmentWithStaticDependents) and replace the three places that manually spread
static_dependents (the early already_published branch, the result.status ===
'already_published' branch, and the published branch after
repoSessionRpc(...).publishFromExternalRef) with a single call to that helper;
the helper should accept the result object (typed to have published_commit) and
return the result plus static_dependents using ctx.env.APP_DB, user.userId and
source.id so callers simply do "return await
augmentWithStaticDependents(resultOrInlineObject)".

In `@packages/worker/src/package-runtime/static-package-dependents.ts`:
- Around line 7-8: The second default constant
defaultStaticDependentArtifactsPerPackageLimit is module-private but should be
exported for symmetry and reuse; update its declaration to export it (export
const defaultStaticDependentArtifactsPerPackageLimit = 5) so callers/tests/docs
can reference the artifacts-per-package default just like
defaultStaticDependentPackageLimit and avoid duplicating the literal; ensure any
imports elsewhere use the exported name from static-package-dependents.
- Around line 138-157: The current entrypoints_truncated logic uses
matchingArtifactCount > Math.min(item.entrypoints.length,
artifactsPerPackageLimit) which mixes artifact-level counts with deduped
entrypoint rows; update the logic and docs to be consistent: either (A) change
the boolean computation in static-package-dependents.ts (the
entrypoints_truncated field) to compare matchingArtifactCount against
artifactsPerPackageLimit (e.g. matchingArtifactCount > artifactsPerPackageLimit)
so it reflects "more matching artifacts than returned", or (B) leave the code
but update the staticDependentItemSchema docstring in publish-external-push.ts
to explicitly say "True when the dependent has more matching artifacts than the
entrypoints returned (artifacts may collapse to fewer entrypoints)"; pick one
approach and apply it to the variables entrypoints_truncated,
matchingArtifactCount, artifactsPerPackageLimit, and staticDependentItemSchema
so semantics and docs align.

In `@packages/worker/src/repo/published-bundle-artifacts-repo.ts`:
- Around line 112-248: The queries in countStaticDependentBundleArtifactPackages
and listStaticDependentBundleArtifactRows currently filter on
json_extract(dependency.value, '$.sourceId') = ? which forces per-user scans and
json_each expansion as bundle counts grow; to address this operationally, add a
lightweight published_bundle_artifact_dependencies association table
(artifact_id, dependency_source_id, dependency_published_commit, user_id)
populated during the same upsert that writes dependencies_json (or maintain it
in the publish flow), index (user_id, dependency_source_id), and update
getStaticPackageDependentsSummary to query that table instead of json_each;
alternatively, add a generated/expression index on the JSON path where supported
and add timing/log breadcrumbs around getStaticPackageDependentsSummary to
surface regressions.

ℹ️ Review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: b91b09e9-afca-40b8-aa37-f80f1beadbc0

📥 Commits

Reviewing files that changed from the base of the PR and between b4ab025 and 9a79fe9.

📒 Files selected for processing (8)
  • docs/contributing/packages-and-manifests.md
  • docs/use/packages.md
  • packages/worker/src/mcp/capabilities/packages/publish-external-push.node.test.ts
  • packages/worker/src/mcp/capabilities/packages/publish-external-push.ts
  • packages/worker/src/package-runtime/static-package-dependents.node.test.ts
  • packages/worker/src/package-runtime/static-package-dependents.ts
  • packages/worker/src/repo/published-bundle-artifacts-repo.node.test.ts
  • packages/worker/src/repo/published-bundle-artifacts-repo.ts

Comment thread packages/worker/src/package-runtime/static-package-dependents.ts Outdated
Comment thread packages/worker/src/package-runtime/static-package-dependents.ts Outdated
cursoragent and others added 2 commits May 10, 2026 13:34
Co-authored-by: Kent C. Dodds <me+github@kentcdodds.com>
Co-authored-by: Kent C. Dodds <me+github@kentcdodds.com>
published_commit: string | null
packageStale: boolean
matchingArtifactCount: number
artifactRows: Array<StaticDependentBundleArtifactRow>

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Accumulator artifactRows array populated but never read

Low Severity

The artifactRows field on StaticDependentPackageAccumulator is declared, initialized as an empty array, and receives a .push() for every row — but is never read anywhere in the summary-building logic. This is dead code that needlessly allocates and grows an array per dependent package.

Additional Locations (1)
Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit ab0d77c. Configure here.

cursoragent and others added 3 commits May 10, 2026 13:42
Co-authored-by: Kent C. Dodds <me+github@kentcdodds.com>
Co-authored-by: Kent C. Dodds <me+github@kentcdodds.com>
Co-authored-by: Kent C. Dodds <me+github@kentcdodds.com>
Comment thread packages/worker/src/package-runtime/static-kody-imports.ts
Co-authored-by: Kent C. Dodds <me+github@kentcdodds.com>

@cursor cursor Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Cursor Bugbot has reviewed your changes and found 1 potential issue.

There are 2 total unresolved issues (including 1 from previous review).

Fix All in Cursor

❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.

Reviewed by Cursor Bugbot for commit 4a7fff0. Configure here.

Comment thread packages/worker/src/package-runtime/static-kody-imports.ts Outdated
cursoragent and others added 2 commits May 10, 2026 14:26
Co-authored-by: Kent C. Dodds <me+github@kentcdodds.com>
Co-authored-by: Kent C. Dodds <me+github@kentcdodds.com>

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧹 Nitpick comments (5)
packages/worker/src/repo/published-bundle-artifacts-repo.workers.test.ts (3)

175-189: ⚡ Quick win

Add a comment explaining the duplicate entrypoint.

This artifact intentionally reuses entrypoint 'src/current-0.ts' to test that multiple artifacts can share the same entrypoint and are counted correctly. Adding a brief comment would make this test case more explicit.

📝 Suggested comment
+	// Duplicate entrypoint to verify multiple artifacts can share the same entrypoint
 	await insertArtifact({
 		userId,
 		sourceId: sourceB,
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@packages/worker/src/repo/published-bundle-artifacts-repo.workers.test.ts`
around lines 175 - 189, Add a brief inline comment above the insertArtifact call
explaining that the entryPoint 'src/current-0.ts' is intentionally reused
(duplicate entrypoint) to test that multiple artifacts can share the same
entrypoint and are counted correctly; reference the insertArtifact invocation
and artifactName 'a-current-0-importable' so reviewers know this is a deliberate
test case rather than a copy-paste mistake.

258-259: 💤 Low value

Document the entrypoint truncation limit.

The assertion expects exactly 5 entrypoints and verifies truncation behavior, but the limit of 5 is not documented. Consider adding a comment explaining this is testing the per-package entrypoint truncation limit.

📝 Suggested comment
+	// Verify entrypoint truncation at limit of 5 per package
 	expect(summary.items[0]?.entrypoints).toHaveLength(5)
 	expect(summary.items[0]?.entrypoints).not.toContain('src/stale.ts')
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@packages/worker/src/repo/published-bundle-artifacts-repo.workers.test.ts`
around lines 258 - 259, The test assertions on summary.items[0]?.entrypoints
assume a per-package entrypoint truncation limit of 5 but don't document it;
update the test (in published-bundle-artifacts-repo.workers.test.ts) by adding a
brief inline comment above the assertions referencing the truncation limit being
tested (e.g., "tests per-package entrypoint truncation limit = 5") and why we
check not-to-contain 'src/stale.ts', so future readers understand that
expect(summary.items[0]?.entrypoints).toHaveLength(5) is intentionally enforcing
the truncation behavior for the entrypoints collection.

242-267: ⚡ Quick win

Verify that package D is excluded from results.

The test setup creates an obsolete artifact for package D (with commit-d-obsolete while the package has commit-d-current), which should be filtered out. The assertions validate items[0] and items[1] but don't explicitly confirm that package D is absent or that items.length === 2.

✅ Proposed assertion to verify exclusion
 	expect(summary.items[1]).toEqual(
 		expect.objectContaining({
 			name: `@kentcdodds/package-c-${unique}`,
 			stale: true,
 			bundled_dependency_commit: null,
 		}),
 	)
+	// Verify package D with obsolete artifact is excluded
+	expect(summary.items).toHaveLength(2)
+	expect(summary.items.every(item => !item.name.includes('package-d'))).toBe(true)
 })
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@packages/worker/src/repo/published-bundle-artifacts-repo.workers.test.ts`
around lines 242 - 267, Add explicit assertions to confirm package D is excluded
by checking summary.items length equals 2 and that neither item has the package
D name; use the existing summary and unique variables (e.g., assert
summary.items.length === 2 and that summary.items.every(i => i.name !==
`@kentcdodds/package-d-${unique}`)) so the test verifies the obsolete artifact
for package D is filtered out.
docs/contributing/packages-and-manifests.md (2)

73-84: ⚡ Quick win

Well-documented static import contract.

The bundled snapshot semantics and manifest contract requirements are thoroughly explained. The distinction between type-only imports and bundled literal dynamic imports is clear.

Optional: Consider adding a brief example for literal dynamic imports

The explanation of literal dynamic import("kody:@...") being bundled is accurate but abstract. A quick example might help readers:

  declaration files such as `.d.ts` are treated as type-only. Literal dynamic
  `import("kody:@...")` expressions are bundled snapshots too, so they must be
- declared.
+ declared. For example, `const mod = await import("kody:`@scope/my-package`")`
+ is bundled and requires `"@scope/my-package"` in `kody.dependencies`.

This is purely optional—the current explanation is sufficient.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/contributing/packages-and-manifests.md` around lines 73 - 84, The docs
currently explain static `kody:@...` imports and the manifest contract but a
short concrete example showing a literal dynamic import pattern and how to
declare it would improve clarity; add a one-line example illustrating
import("kody:`@scope/my-package`") being treated as a bundled snapshot and show
the corresponding package.json entry under package.json#kody.dependencies (e.g.,
including "@scope/my-package"), and note that type-only imports and `.d.ts`
files are excluded so they need not be listed.

236-237: ⚡ Quick win

Clarify what "bounded" means for the static_dependents summary.

The documentation mentions a "bounded summary" but doesn't specify the bounds (e.g., maximum number of dependents shown, truncation rules). Adding this detail would help readers understand what to expect in the response.

Suggested clarification

If the bounds are defined in the implementation, consider adding them here:

-with `static_dependents`, a bounded summary of direct saved packages whose
+with `static_dependents`, a summary of up to [N] direct saved packages whose

Or reference where the bounds are enforced if they're documented elsewhere.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/contributing/packages-and-manifests.md` around lines 236 - 237, The
phrase "bounded summary" in the static_dependents description is ambiguous;
update the docs for static_dependents to explicitly state the bounds (e.g.,
maximum number of dependents returned, truncation/order rules, and whether
counts are approximate) and either list the numeric limits and truncation
behavior directly or add a clear cross-reference to the implementation/function
that enforces them (e.g., mention the function or config that caps results for
static_dependents). Ensure you reference the symbol static_dependents in the
text so readers can find the related behavior and include where to look
(implementation file or section) if the limits are maintained elsewhere.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@docs/contributing/packages-and-manifests.md`:
- Around line 73-84: The docs currently explain static `kody:@...` imports and
the manifest contract but a short concrete example showing a literal dynamic
import pattern and how to declare it would improve clarity; add a one-line
example illustrating import("kody:`@scope/my-package`") being treated as a bundled
snapshot and show the corresponding package.json entry under
package.json#kody.dependencies (e.g., including "@scope/my-package"), and note
that type-only imports and `.d.ts` files are excluded so they need not be
listed.
- Around line 236-237: The phrase "bounded summary" in the static_dependents
description is ambiguous; update the docs for static_dependents to explicitly
state the bounds (e.g., maximum number of dependents returned, truncation/order
rules, and whether counts are approximate) and either list the numeric limits
and truncation behavior directly or add a clear cross-reference to the
implementation/function that enforces them (e.g., mention the function or config
that caps results for static_dependents). Ensure you reference the symbol
static_dependents in the text so readers can find the related behavior and
include where to look (implementation file or section) if the limits are
maintained elsewhere.

In `@packages/worker/src/repo/published-bundle-artifacts-repo.workers.test.ts`:
- Around line 175-189: Add a brief inline comment above the insertArtifact call
explaining that the entryPoint 'src/current-0.ts' is intentionally reused
(duplicate entrypoint) to test that multiple artifacts can share the same
entrypoint and are counted correctly; reference the insertArtifact invocation
and artifactName 'a-current-0-importable' so reviewers know this is a deliberate
test case rather than a copy-paste mistake.
- Around line 258-259: The test assertions on summary.items[0]?.entrypoints
assume a per-package entrypoint truncation limit of 5 but don't document it;
update the test (in published-bundle-artifacts-repo.workers.test.ts) by adding a
brief inline comment above the assertions referencing the truncation limit being
tested (e.g., "tests per-package entrypoint truncation limit = 5") and why we
check not-to-contain 'src/stale.ts', so future readers understand that
expect(summary.items[0]?.entrypoints).toHaveLength(5) is intentionally enforcing
the truncation behavior for the entrypoints collection.
- Around line 242-267: Add explicit assertions to confirm package D is excluded
by checking summary.items length equals 2 and that neither item has the package
D name; use the existing summary and unique variables (e.g., assert
summary.items.length === 2 and that summary.items.every(i => i.name !==
`@kentcdodds/package-d-${unique}`)) so the test verifies the obsolete artifact
for package D is filtered out.

ℹ️ Review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 33218d2d-818e-4526-81f7-387e26a34fd0

📥 Commits

Reviewing files that changed from the base of the PR and between 9a79fe9 and e08edb2.

📒 Files selected for processing (15)
  • docs/contributing/packages-and-manifests.md
  • docs/use/packages.md
  • packages/worker/src/package-registry/types.ts
  • packages/worker/src/package-runtime/import-specifiers.node.test.ts
  • packages/worker/src/package-runtime/import-specifiers.ts
  • packages/worker/src/package-runtime/module-graph.ts
  • packages/worker/src/package-runtime/published-bundle-artifacts.ts
  • packages/worker/src/package-runtime/static-kody-imports.ts
  • packages/worker/src/package-runtime/static-package-dependents.node.test.ts
  • packages/worker/src/package-runtime/static-package-dependents.ts
  • packages/worker/src/repo/checks.node.test.ts
  • packages/worker/src/repo/checks.ts
  • packages/worker/src/repo/published-bundle-artifacts-repo.node.test.ts
  • packages/worker/src/repo/published-bundle-artifacts-repo.ts
  • packages/worker/src/repo/published-bundle-artifacts-repo.workers.test.ts
✅ Files skipped from review due to trivial changes (2)
  • packages/worker/src/package-runtime/import-specifiers.node.test.ts
  • docs/use/packages.md
🚧 Files skipped from review as they are similar to previous changes (3)
  • packages/worker/src/repo/published-bundle-artifacts-repo.ts
  • packages/worker/src/package-runtime/static-package-dependents.ts
  • packages/worker/src/repo/published-bundle-artifacts-repo.node.test.ts

cursoragent and others added 2 commits May 10, 2026 14:47
Co-authored-by: Kent C. Dodds <me+github@kentcdodds.com>
Co-authored-by: Kent C. Dodds <me+github@kentcdodds.com>
@kentcdodds
kentcdodds merged commit cc1f9cd into main May 10, 2026
5 checks passed
@kentcdodds
kentcdodds deleted the cursor/package-publish-dependent-summary branch May 10, 2026 15:11
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants