modules/runtime/server/cache.ts (1)

249-257: Consider stabilising mock timestamps for deterministic fixtures.

Using one shared timestamp value in this block avoids per-item clock drift and keeps fixture output steadier.

♻️ Suggested tweak

   if (host === algoliaHost && pathname.endsWith('/query')) {
+    const now = new Date().toISOString()
     return {
       data: {
         hits: [
-          { name: 'nuxt', downloadsLast30Days: 500_000, modified: new Date().toISOString() },
-          { name: 'pnpm', downloadsLast30Days: 800_000, modified: new Date().toISOString() },
-          { name: 'express', downloadsLast30Days: 1_000_000, modified: new Date().toISOString() },
-          { name: 'minimatch', downloadsLast30Days: 600_000, modified: new Date().toISOString() },
-          { name: 'next', downloadsLast30Days: 700_000, modified: new Date().toISOString() },
-          { name: 'axios', downloadsLast30Days: 900_000, modified: new Date().toISOString() },
-          { name: 'remix', downloadsLast30Days: 400_000, modified: new Date().toISOString() },
-          { name: 'webpack', downloadsLast30Days: 750_000, modified: new Date().toISOString() },
+          { name: 'nuxt', downloadsLast30Days: 500_000, modified: now },
+          { name: 'pnpm', downloadsLast30Days: 800_000, modified: now },
+          { name: 'express', downloadsLast30Days: 1_000_000, modified: now },
+          { name: 'minimatch', downloadsLast30Days: 600_000, modified: now },
+          { name: 'next', downloadsLast30Days: 700_000, modified: now },
+          { name: 'axios', downloadsLast30Days: 900_000, modified: now },
+          { name: 'remix', downloadsLast30Days: 400_000, modified: now },
+          { name: 'webpack', downloadsLast30Days: 750_000, modified: now },
         ],
       },
     }
   }

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

test/fixtures/mock-routes.cjs (1)

571-571: ⚠️ Potential issue | 🟠 Major

Algolia wildcard host pattern will not match correctly.

The pattern https://*-dsn.algolia.net/** contains a hostname wildcard (*), but urlMatchesPattern() at lines 601-608 only handles /** suffix patterns via startsWith. The * in the hostname won't be matched, so Algolia requests won't be mocked when using matchRoute().

🔧 Proposed fix to support wildcard patterns

 function urlMatchesPattern(url, pattern) {
-  // Convert "https://example.com/**" to a prefix check
-  if (pattern.endsWith('/**')) {
-    const prefix = pattern.slice(0, -2)
-    return url.startsWith(prefix)
+  // Support wildcard patterns (e.g. https://*-dsn.algolia.net/**)
+  if (pattern.includes('*')) {
+    const escaped = pattern.replace(/[.+?^${}()|[\]\\]/g, '\\$&').replace(/\*\*/g, '.*').replace(/\*/g, '[^/]*')
+    return new RegExp(`^${escaped}`).test(url)
   }
   return url === pattern
 }

server/utils/picks.ts (1)

29-52: Selection logic is sound but consider defensive letterIndex handling.

The logic correctly handles empty pools via optional chaining and falls back to hardcoded values. However, if a candidate name were to somehow not contain the expected letter (edge case), indexOf would return -1.

Currently this is safe because:

1. Candidates are filtered by name.toLowerCase().includes(letter) in the API handler
2. Fallbacks are verified to contain their letters

For defensive coding, you might consider clamping to 0:

🛡️ Optional defensive fix

     picks.push({
       letter,
       name,
-      letterIndex: name.toLowerCase().indexOf(letter),
+      letterIndex: Math.max(0, name.toLowerCase().indexOf(letter)),
     })

server/api/picks.get.ts (1)

75-96: Type assertion on empty object is fragile.

The empty object {} is cast to Record<NpmxLetter, PickCandidate[]>, which bypasses type checking. While Promise.all ensures all letters are assigned before use, this pattern could mask issues if the code is refactored.

♻️ Safer initialisation with explicit typing

-    const candidatesByLetter = {} as Record<NpmxLetter, PickCandidate[]>
+    const candidatesByLetter: Partial<Record<NpmxLetter, PickCandidate[]>> = {}

     await Promise.all(
       NPMX_LETTERS.map(async letter => {
         // ... existing code ...
         candidatesByLetter[letter] = enriched
       }),
     )

-    const picks = selectPicks(candidatesByLetter)
+    const picks = selectPicks(candidatesByLetter as Record<NpmxLetter, PickCandidate[]>)

This makes the incomplete state explicit during construction, with the cast only at the point of use after all letters are guaranteed to be assigned.

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro