fix(npm-stats): stop summary cards overcounting co-installed packages

[tombeckenham]

Problem

The NPM Stats summary cards (All-time, Monthly, Weekly, Daily) were inflated by ~9×. For TanStack Start, Weekly showed 148.1M when the real figure is ~16.5M.

Cause: the cards summed every @tanstack/*start* package mapped to the library (43 of them). ~9 of those — start-client-core, start-server-core, start-plugin-core, react-start, etc. — are transitive dependencies of a single @tanstack/react-start install, so each install was counted ~9 times. The chart directly below the cards was already correct because it uses the library's declared npmPackageNames.

Fix

Make the summary cards honor npmPackageNames too, so they match the chart:

• Daily/Weekly/Monthly — NPMSummary now uses the shared recentDownloadsQuery (which passes npmPackageNames) instead of a local copy that dropped it and fell back to the full registered-package set.
• All-time — rebuildOssStatsCache now restricts each library's aggregate to its declared npmPackageNames when present (libraries without an explicit list are unchanged).

Testing

No DB required — the stats code falls back to live npm data when there's no cache. Run pnpm dev, open /start/latest/docs/npm-stats: Weekly now shows ~16.5M (matching the chart) instead of 148.1M.

Note: the all-time card reads a precomputed cache row in production, so it corrects on the next rebuildOssStatsCache run.

🤖 Generated with Claude Code

Summary by CodeRabbit

Release Notes

• Bug Fixes
  • NPM statistics (downloads and package counts) are now calculated more accurately by only counting explicitly included packages for each library, excluding transitive dependencies that were previously inflating totals.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 7916a651-9667-4d2c-8366-cacd937749ea

📥 Commits

Reviewing files that changed from the base of the PR and between 762e5d8 and 21c6b45.

📒 Files selected for processing (2)

• src/components/npm-stats/NPMSummary.tsx
• src/utils/stats-db.server.ts

---

📝 Walkthrough

Walkthrough

Two independent changes: NPMSummary.tsx has its inline query builder imports replaced with pre-built ossStatsQuery and recentDownloadsQuery from ~/queries/stats. In stats-db.server.ts, rebuildOssStatsCache gains an explicit package allowlist map built from libraries[].npmPackageNames, with a skip guard in the aggregation loop that excludes unlisted packages from library and org totals.

Changes

NPMSummary query import cleanup

Layer / File(s)	Summary
Centralize query imports in NPMSummary src/components/npm-stats/NPMSummary.tsx	Import block switched from inline queryOptions/fetchRecentDownloadStats to ossStatsQuery/recentDownloadsQuery from ~/queries/stats. The useSuspenseQuery call is reformatted to multi-line with no logic change.

Explicit package allowlist filtering in rebuildOssStatsCache

Layer / File(s)	Summary
Build and apply explicitPackagesByLibrary allowlist src/utils/stats-db.server.ts	Constructs a Map<libraryId, Set<packageName>> from libraries[].npmPackageNames, then adds a guard in the npmPackages aggregation loop to skip any row whose packageName is absent from the allowlist for its library.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Poem

🐇 Hop, hop, skip the sub-packages away,
No sneaky deps shall bloat the count today!
Allowlists built, the numbers ring true,
And imports tidied, neat as morning dew.
The stats cache shines — a rabbit's work is through! ✨

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 66.67% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately reflects the main objective of the PR, which is to fix NPM stats summary cards from overcounting co-installed packages by ensuring they honor the npmPackageNames configuration.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/npm-summary-stats-overcounting

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[KevinVandy]

If we change the weekly number, wouldn't we have to change the monthly and daily numbers?

adf

[KevinVandy]

Let's have @tannerlinsley review the download number changes before this gets merged. I think I agree with the change, but this will be a quite visible change in how we've been displaying the download numbers.