fix: remove backup for declared repository (CM-1305)

[ulemons]

Summary

Removes the API-level fallback to declared_repository_url (the raw, non-normalized registry value) in the public package detail response, so provenance.repositoryMapping.declaredRepo never emits a website URL, placeholder, or free-form string — only a canonical repository link or null.

Changes

• backend/src/api/public/v1/packages/getPackage.ts: declaredRepo is now pkg.repoUrl ?? pkg.repositoryUrl ?? null (dropped the trailing ?? pkg.declaredRepositoryUrl). Both /v1/packages/detail and /v1/akrites/packages/detail share this handler, so the fix applies to both endpoints.
• No schema/route changes — same response shape, declaredRepo can now be null in cases where it previously returned a raw, non-canonical value.

Type of change

• Bug fix
• New feature
• Refactor / cleanup
• Performance improvement
• Chore / dependency update
• Documentation

JIRA ticket

CM-1305

[cursor]

PR Summary

Low Risk
Single-field API semantics fix with no auth or persistence changes; only affects clients that relied on non-canonical declared_repo strings.

Overview
provenance.repositoryMapping.declaredRepo on the public package detail handler no longer falls back to declaredRepositoryUrl (raw registry metadata).

The value is now pkg.repoUrl ?? pkg.repositoryUrl ?? null, so clients only see canonical repository URLs or null—not project homepages, placeholders, or other non-normalized strings. /v1/packages/detail and /v1/akrites/packages/detail share this handler; response shape is unchanged, but some packages that previously returned a raw string will now return null when no canonical URL is available.

^{Reviewed by Cursor Bugbot for commit e72c6a5. Bugbot is set up for automated code reviews on this repo. Configure here.}

[Copilot]

Pull request overview

This PR updates the public package detail response to stop falling back to the raw, non-normalized declared_repository_url value when emitting provenance.repositoryMapping.declaredRepo, ensuring the field only returns a canonical repository URL or null.

Changes:

• Removed the API-level fallback to pkg.declaredRepositoryUrl when computing provenance.repositoryMapping.declaredRepo.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.