feat(npm): packument GET core serve (S11 Step 11 part 1/4)

David Fernandezrequested to merge
10io/npm-hosted-step11-part1of4 into main

📦 Summary

Part 1 of 4 of the npm hosted packument GET handler (S11 Step 11), split into a stacked series for reviewability. This part lands the core serve path:

  • Route parsing for {slug}/npm/{repo}/{package_name} (scoped @scope/name rejoining)
  • Accept negotiation (full kind=0 vs abbreviated kind=2) and the matching Content-Type
  • Repository lookup, including the deleted-in-resolve-window race arm returning 404 repository_not_found
  • Package lookup returning 404 package_not_found (new CodePackageNotFound / MsgPackageNotFound in transport.go)
  • Inline packument build via the Step 25 generator, with a strong ETag over the generated bytes
  • writeServerError and base-URL helpers

The cache-hit path (part 2), conditional GET + visibility-varying cache headers (part 3), and the read-side singleflight (part 4) build on this.

🧪 Tests

Unit: full/abbreviated content negotiation, package-not-found. Integration: package-not-found. Further acceptance-criteria coverage arrives with the slices that introduce each behavior; the complete spec-coverage table is satisfied across the full stack.

🗂️ Stack

Part 1/4, targets main. Parts 2–4 stack on top, each targeting its predecessor.

📏 Size justification

~860 reviewable LoC — deliberately above the usual ~600 ceiling. This slice carries the irreducible core handler (~430 LoC of handler plus its doc-comments) and the minimum honest test scaffold to exercise it. Splitting further would only yield a non-servable sub-slice or require stripping doc-comments, so the core ships as one coherent, fully-documented unit; parts 2–4 are each ≤600 LoC.

Related to #129 (closed)

🔗 Stacked MRs (review/merge bottom-up)

Edited by David Fernandez

Merge request reports