feat(npm): share the remote tier and drop the URL boot check, part 1/3 (S31 plan: 14/19)

David Fernandezrequested to merge
10io/s31-step14-composition-root-part1of3 into main

📦 Stacked MRs

This is part 1 of 3 of Step 14 of the S31 (npm-virtual) plan, the composition root. The step is split into three stacked MRs to keep each within the review size limit. Part 1 targets main, and each later part targets the part below it. Review and merge bottom-up.

🎯 What this part does

  • The NewVirtualResolution facade no longer refuses an unset npm.public_registry_url at boot. The assembly already refuses per request for a remote position, which is how the npm remote tier behaves, so a hosted-only deployment boots.
  • The npm remote tier builds its flight registry, cache stores and operations provider once per boot (npmRemoteShared), so the remote and the virtual read paths can share one of each.
  • The run recipe seeds an npm virtual repository (two associations and a deny rule) and smoke-checks the three npm virtual routes, which still answer 501. The smoke count moves from 94 to 97.

📝 Plan and spec amendments

  • The plan asserted that an unset npm.public_registry_url fails the facade's construction. It is accepted at construction, and the plan text now says so: the three passages that gave the facade the guard now name the assembly's per-request refusal.

The remaining plan corrections for this step land with part 2.

✅ Tests

  • The facade tests flip from refusing an unset URL to accepting it, and the internal fixtures drop the removed case.
  • The shared-tier builders keep their unit suite: the packument and tarball routes share one flight, an unbuilt audit sink and an unbuildable registry panic with the builder's name.
  • driver.sh smoke passes on a fresh rig: 97 passed, 0 failed.
  • The run recipe records the seed-npm-virtual validation: a cold start, a re-seed of an already-seeded slug, and a second named repository.

docs/testing/ and docs/user/ are unchanged: no route answers differently, and the three npm virtual routes stay on the interim 501.

Stacked MRs (review/merge bottom-up)

Related to #895 (closed)

Edited by David Fernandez

Merge request reports