test(npm): cover the virtual document serve, part 2/2 (S31 plan: 13/19)

David Fernandezrequested to merge
10io/s31-step13-part3-serve-surface-part2of2 into main

Split into 2 stacked MRs to keep each within the review size limit (about 800 ideal, 1000 acceptable). Each part targets the previous one, and part 1 targets the source branch of the Part 2 collection MR. They are reviewed and merged bottom-up.

Part 2 of 2 of docs/plans/2026-08-21-s31-npm-virtual.md, Step 13: metadata merge and serve surface (Part 3: the serve surface).

Tests only. They cover the serve function that part 1 adds:

  • Cache-Control from the virtual repository's visibility on the 200 and the 304, for the packument and dist-tags routes.
  • The ETag and If-None-Match, and a 304 that opens no blob, for GET and HEAD.
  • HEAD parity with GET, for a partial merge and for a sole unparseable contributor.
  • An abandoned fill and a canceled leader giving the identical 503 with Retry-After, through the real collector.
  • The repository lookup (not found gives 404, any other error gives 500) and a target outside the metadata kinds failing closed.
  • Chunked framing with no Content-Length over a real HTTP/1.1 connection, and an unexpected EOF after a committed mid-body failure.
  • Robustness: a client that stops reading does not leak the merge goroutine; a merge panic answers 500; a copy-side panic after commit aborts the response and still releases the merge goroutine; a hosted position's deadline never shortens the caller's; the abort applies the effective deadline; a read-error writer that wrote nothing still owes a 500.

This part depends on part 1 and adds no production code.

Stacked MRs (review/merge bottom-up)

Spec: S31 (npm-virtual) Plan: docs/plans/2026-08-21-s31-npm-virtual.md

Related to #894 (closed)

Edited by David Fernandez

Merge request reports