fix: check the file tree before the timeline reports removed types

[thribhuvan003]

The timeline computed hasTypes from packument fields only, so packages that ship declaration files next to their entry points (without a types field) showed a false "TypeScript types removed" event.

Now when a version would produce that event, the endpoint fetches its file tree and re-checks it with the same detectTypesStatus the package page uses, capped at 5 lookups per request so a timeline page never fans out. Added unit tests for the implicit-declarations case, a genuine removal, and a failed file tree lookup.

fixes #2791

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
npmx.dev	Ready	Preview, Comment	Jul 7, 2026 12:49pm

2 Skipped Deployments

Project	Deployment	Actions	Updated (UTC)
docs.npmx.dev	Ignored	Preview	Jul 7, 2026 12:49pm
npmx-lunaria	Ignored		Jul 7, 2026 12:49pm

[github-actions]

Hello! Thank you for opening your first PR to npmx, @thribhuvan003! 🚀

Here’s what will happen next:

1. Our GitHub bots will run to check your changes.
   If they spot any issues you will see some error messages on this PR.
   Don’t hesitate to ask any questions if you’re not sure what these mean!

2. In a few minutes, you’ll be able to see a preview of your changes on Vercel

3. One or more of our maintainers will take a look and may ask you to make changes.
   We try to be responsive, but don’t worry if this takes a few days.

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

📝 Walkthrough

Walkthrough

The timeline endpoint now re-checks missing hasTypes values using package file-tree analysis with a per-request cap, and the repository also adds a large set of generated lexicon barrels, definitions, and entrypoints across the app, blue, com, dev, site, and tools namespaces.

Changes

Timeline hasTypes detection fix

Layer / File(s)	Summary
Bounded hasTypes re-check server/api/registry/timeline/[...pkg].get.ts	Imports package analysis helpers, defines the lookup cap, and adds a reverse pass that backfills hasTypes for older versions when declaration files are detected, while preserving original values on failure.
hasTypes inference tests test/unit/server/api/registry/timeline/pkg.get.spec.ts	Stubs the package lookup helper and adds tests for declaration-file detection, missing declaration files, and rejected lookups.

Generated lexicon modules

Layer / File(s)	Summary
App bsky barrels and actor types src/lexicons/app.ts, src/lexicons/app/bsky.ts, src/lexicons/app/bsky/actor*	Adds the app/bsky namespace barrels and the actor entrypoint modules, plus the generated actor definitions and profile/status/getProfiles schemas.
App bsky embed schemas src/lexicons/app/bsky/embed*	Adds the embed namespace barrels and generated schema modules for aspect ratio, external, images, record, record-with-media, and video embeds.
App bsky feed schemas src/lexicons/app/bsky/feed*	Adds the feed namespace barrels and generated feed definitions for post, threadgate, postgate, getLikes, getPosts, and getPostThread.
App bsky graph, labeler, notification, richtext src/lexicons/app/bsky/{graph*,labeler*,notification*,richtext*}	Adds generated graph, labeler, notification, and richtext definitions plus their entrypoint modules and namespace barrels.
Blue microcosm modules src/lexicons/blue*	Adds the blue namespace barrels and generated identity, links, and repo definitions and entrypoints.
Com atproto core modules src/lexicons/com*	Adds the com namespace barrels and generated identity, label, moderation, repo, and sync definitions and entrypoints.
Dev npmx modules src/lexicons/dev*	Adds the dev namespace barrels and generated actor profile and feed like definitions and entrypoints.
Site standard modules src/lexicons/site*	Adds the site namespace barrels and generated document, publication, and theme definitions and entrypoints.
Tools ozone report modules src/lexicons/tools*	Adds the tools namespace barrels and the generated ozone report reason definitions.

Sequence Diagram(s)

sequenceDiagram
  participant TimelineEndpoint
  participant PackageLookup
  participant PackageAnalysis

  TimelineEndpoint->>TimelineEndpoint: Sort versions and scan backwards
  loop up to MAX_FILE_TREE_CHECKS
    TimelineEndpoint->>PackageLookup: fetchPackageWithTypesAndFiles(package, version)
    alt lookup succeeds
      PackageLookup-->>TimelineEndpoint: types/files
      TimelineEndpoint->>PackageAnalysis: analyzePackage(typesPackage, files)
      PackageAnalysis-->>TimelineEndpoint: types included or not
      TimelineEndpoint->>TimelineEndpoint: Update current.hasTypes
    else lookup fails
      PackageLookup-->>TimelineEndpoint: error
      TimelineEndpoint->>TimelineEndpoint: Keep existing hasTypes
    end
  end

Loading

Suggested reviewers: ghostdevv

🚥 Pre-merge checks | ✅ 3 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Out of Scope Changes check	⚠️ Warning	The PR also includes a large generated lexicon regeneration across many namespaces, which is unrelated to the timeline fix.	Move the lexicon regeneration into a separate PR or explain why it is required for this issue.

✅ Passed checks (3 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly describes the main fix: checking the file tree before reporting removed types.
Description check	✅ Passed	The description matches the implemented timeline fix, bounded lookups, and added tests.
Linked Issues check	✅ Passed	The change addresses #2791 by re-checking the file tree before emitting removed-types events.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

❌ Patch coverage is 84.61538% with 2 lines in your changes missing coverage. Please review.
✅ All tests successful. No failed tests found.

Files with missing lines	Patch %	Lines
server/api/registry/timeline/[...pkg].get.ts	84.61%	0 Missing and 2 partials ⚠️

📢 Thoughts on this report? Let us know!

[coderabbitai]

🧹 Nitpick comments (1)

server/api/registry/timeline/[...pkg].get.ts (1)

105-114: 🩺 Stability & Availability | 🔵 Trivial | ⚡ Quick win

Bound the file-tree lookups

getPackageFileTree accepts a signal, but this handler never supplies one. Add AbortSignal.timeout(...) here — or wire event.node.req close into an AbortController if you need disconnect cancellation — so a slow jsDelivr response cannot hold the request open across all MAX_FILE_TREE_CHECKS.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@server/api/registry/timeline/`[...pkg].get.ts around lines 105 - 114, The
file-tree lookup in the timeline handler is not bounded, so a slow
getPackageFileTree call can keep the request open too long. Update the logic in
the [...pkg].get handler to pass an AbortSignal to getPackageFileTree,
preferably using AbortSignal.timeout(...), or wire event.node.req close into an
AbortController if you want disconnect cancellation. Keep the existing try/catch
behavior and make sure the signal is applied consistently for the
MAX_FILE_TREE_CHECKS loop.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@server/api/registry/timeline/`[...pkg].get.ts:
- Around line 105-114: The file-tree lookup in the timeline handler is not
bounded, so a slow getPackageFileTree call can keep the request open too long.
Update the logic in the [...pkg].get handler to pass an AbortSignal to
getPackageFileTree, preferably using AbortSignal.timeout(...), or wire
event.node.req close into an AbortController if you want disconnect
cancellation. Keep the existing try/catch behavior and make sure the signal is
applied consistently for the MAX_FILE_TREE_CHECKS loop.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 365f9fa2-20ff-4bab-9df5-6313dc69d7b2

📥 Commits

Reviewing files that changed from the base of the PR and between e731a54 and de82b27.

📒 Files selected for processing (2)

• server/api/registry/timeline/[...pkg].get.ts
• test/unit/server/api/registry/timeline/pkg.get.spec.ts

[ghostdevv]

There seems to be a util we can re-use analyzePackage, for example:

npmx.dev/server/api/registry/analysis/[...pkg].get.ts

Lines 36 to 42 in 32e324a

	const { pkg, typesPackage, files } = await fetchPackageWithTypesAndFiles(packageName, version)
	const createPackage = await findAssociatedCreatePackage(packageName, pkg)
	const analysis = analyzePackage(pkg, {
	typesPackage,
	createPackage,
	files,
	})

(we don't need to pass createPackage here)

[thribhuvan003]

ah nice, missed that util — switched to fetchPackageWithTypesAndFiles + analyzePackage, much cleaner. thanks!

[thribhuvan003]

oops, my local generate:lexicons run leaked into a commit — cleaned it up, diff is just the two files now