fix: npm repository url gap (CM-1305)

[ulemons]

Summary

Fixes the npm repository_url normalization gap (Gap D): canonicalizeRepoUrl failed to parse scp-style SSH URLs written under the ssh:// scheme (e.g. ssh://git@github.com:owner/repo.git), returning null and leaving repository_url empty even though a usable repo URL was declared. Adds an offline backfill so existing npm rows can be recomputed from the already-stored declared_repository_url without re-fetching the registry.

Changes

• src/utils/canonicalizeRepoUrl.ts: handle ssh://git@host:owner/repo (colon before the path) before the existing ssh://git@host/owner/repo (slash) case — new URL() throws on the colon form because the segment after the host looks like a port, so it's rewritten to https:// first.
• src/utils/__tests__/canonicalizeRepoUrl.test.ts: added cases for the scp-colon form and a digit-leading owner name (1inch/...), plus extra unparseable-input cases.
• services/libs/data-access-layer/src/packages/packages.ts: new listNpmPackagesForRepoUrlRecompute / updateNpmRepositoryUrls DAL functions (keyset-paginated scan by id, split clear-vs-set UPDATE to avoid NULLs inside a text[] literal), modeled directly on the existing Maven equivalents.
• src/npm/backfillRepositoryUrl.ts (new): recomputes repository_url for every npm row from its stored declared_repository_url — no packument re-fetch. Keeps package_repos consistent: prunes the stale source='declared' link and re-links via the same getOrCreateRepoByUrl/upsertPackageRepo pair the ingest path uses. Wrapped in withDeadlockRetry (duplicated from Maven's helper — see Notes) since the UPDATE + prune + relink must commit atomically per batch.
• src/bin/npm-repo-url-backfill.ts (new): CLI entrypoint, mirrors bin/maven-repo-url-backfill.ts (--dry-run, --critical-only, graceful SIGINT/SIGTERM, NPM_REPO_URL_BACKFILL_BATCH_SIZE env var).
• package.json: added backfill:npm-repo-url / backfill:npm-repo-url:local scripts.

Type of change

• Bug fix
• New feature
• Refactor / cleanup
• Performance improvement
• Chore / dependency update
• Documentation

JIRA ticket

CM-1305

---

Note

Medium Risk
Batch writes touch packages, repos, and package_repos at scale; transactions and idempotent updates limit inconsistency, but a full backfill run still mutates core package metadata.

Overview
Fixes npm repository_url gaps where canonicalizeRepoUrl returned null for scp-style SSH declarations (ssh://git@github.com:owner/repo), leaving canonical URLs empty despite a stored declared_repository_url.

canonicalizeRepoUrl now rewrites ssh://git@host:path (colon before the path) to https:// before URL parsing, while still treating a numeric segment after the colon as a real SSH port. Tests cover digit-leading owners, git+https, and additional invalid inputs.

Adds an offline npm repo-url backfill (Maven-style): keyset scan of npm rows with a declared URL, recompute repository_url without packument fetches, and keep package_repos in sync via atomic batch transactions (update, prune stale declared links, relink) with deadlock retry. New DAL helpers listNpmPackagesForRepoUrlRecompute / updateNpmRepositoryUrls, CLI npm-repo-url-backfill (--dry-run, --critical-only, graceful shutdown), and backfill:npm-repo-url scripts.

^{Reviewed by Cursor Bugbot for commit 79e3552. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit a9be6d4. Configure here.}

[Copilot]

Pull request overview

Fixes npm repository_url normalization for scp-style SSH URLs under ssh:// and introduces an offline backfill to recompute packages.repository_url (and keep package_repos consistent) from already-stored declared_repository_url without re-fetching npm registry data.

Changes:

• Extend canonicalizeRepoUrl to handle ssh://git@host:owner/repo(.git) inputs and add unit tests for the new cases.
• Add DAL helpers to keyset-scan npm package rows and batch-update repository_url (including NULL clears) while bumping last_synced_at.
• Add an npm repo-url backfill worker + CLI entrypoint and expose it via package.json scripts.

Reviewed changes

Copilot reviewed 5 out of 6 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
services/libs/data-access-layer/src/packages/packages.ts	Adds npm-specific scan/update helpers for recomputing repository_url in batches.
services/apps/packages_worker/src/utils/canonicalizeRepoUrl.ts	Adds normalization for ssh://git@host:owner/repo scp-colon form.
services/apps/packages_worker/src/utils/tests/canonicalizeRepoUrl.test.ts	Adds regression tests for new canonicalization inputs.
services/apps/packages_worker/src/npm/backfillRepositoryUrl.ts	New offline backfill: recompute URLs and sync package_repos in atomic batches.
services/apps/packages_worker/src/bin/npm-repo-url-backfill.ts	New CLI wrapper with --dry-run / --critical-only and batch-size env var.
services/apps/packages_worker/package.json	Adds backfill:npm-repo-url scripts.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 5 out of 6 changed files in this pull request and generated 1 comment.

[Copilot]

Pull request overview

Copilot reviewed 5 out of 6 changed files in this pull request and generated 2 comments.