perf: keep D3 out of shared route imports

[LadyBluenotes]

Summary

Reuse the existing npm-stats bin schema directly instead of importing it through the D3-backed chart utilities.

Remove unused chart-helper re-exports. Chart calculations stay unchanged, and comparison URLs retain their accepted bin values and weekly fallback.

Checks

• Added focused route tests for default, supported, and unsupported bin values.
• Full pnpm test and normal commit hooks passed.
• Production build, TypeScript, and targeted lint passed.
• Built output with the companion starter change contains no D3 or Zod modules in the shared startup graph.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 831889b1-9418-482f-b643-258e47317063

📥 Commits

Reviewing files that changed from the base of the PR and between 543f740 and 0905564.

📒 Files selected for processing (2)

• src/routes/stats/npm/-utils.ts
• tests/chart-route-validation.test.ts

Included review availability: This review used your included allowance. Your plan provides up to 4 included reviews per hour; 2 remain after this review.

---

📝 Walkthrough

Walkthrough

The npm stats route utility now re-exports binTypeSchema and BinType from the shared NPM stats module. Tests cover defaulting, accepted values, and invalid binType values.

Changes

NPM comparison bin type

Layer / File(s)	Summary
Bin type exports and route validation src/routes/stats/npm/-utils.ts, tests/chart-route-validation.test.ts	The utility re-exports binTypeSchema and BinType from the shared module and removes the binningOptions and getBinFunction re-exports. Tests check that omitted and invalid values resolve to weekly, and that yearly, monthly, weekly, and daily validate unchanged.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~8 minutes

Change: Refactor

Merge Risk: ⚪ Minimal · up to 09055

The npm comparison route retains its supported bin values and weekly fallback, with no identified in-repository breakage from the export changes. No actionable merge risk remains.

Security Architecture Review

Security architecture risk: ⚪ Minimal · up to 09055

The change separates route validation from chart utilities without changing accepted comparison URL values, fallback behavior, or route authority. No material security risk was identified in the reviewed change.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• inferred — The demonstrated exposure is the existing npm comparison route's binType search input. The reviewed export change does not expand that input's accepted values or establish additional service, tenant, credential, or data-store authority.

Trust Boundaries and Controls

• observed — Attacker-controlled binType values still pass through the route's picklist-based validation and optional/fallback wrappers. Changing the schema's export source preserves this control rather than bypassing it.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 2…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: preventing D3 from entering shared route imports.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}