[agocharbhatia]

Summary

The npm proxy drops query parameters on registry requests. Forward-proxy requests can also classify a tarball as metadata when its URL has a query.

classify using the path
forward the original query
cache each query variant separately

Evidence

• Identical native regressions: three failing groups on base become passes, with both control groups preserved.
• The public server API probe now returns the correct variants and reuses repeated requests.
• npm/cache tests, race tests, vet and build pass locally on Go 1.26.5. No-query cache keys remain unchanged.

Merge Danger

Door: Two-way. No public API or database schema change.

Blast Radius: npm. Query routing and cache identity only. Cloud, Docker and whole-repository checks were not run.