Use abbreviated npm metadata when cooldown is disabled

Request application/vnd.npm.install-v1+json from the npm registry
when cooldown filtering is not enabled. This format strips READMEs
and other bulk data, reducing drizzle-orm metadata from 92MB to 4MB.

Fall back to full metadata when cooldown is enabled since the
abbreviated format lacks the time map needed for publish-date filtering.

Author: andrew

internal/handler/npm.go

@@ -73,7 +73,13 @@ func (h *NPMHandler) handlePackageMetadata(w http.ResponseWriter, r *http.Reques
 		JSONError(w, http.StatusInternalServerError, "failed to create request")
 		return
 	}
-	req.Header.Set("Accept", "application/json")
+	// Use abbreviated metadata when cooldown is disabled — it's much smaller
+	// (e.g. drizzle-orm: 4MB vs 92MB) but lacks the time map needed for cooldown.
+	if h.proxy.Cooldown != nil && h.proxy.Cooldown.Enabled() {
+		req.Header.Set("Accept", "application/json")
+	} else {
+		req.Header.Set("Accept", "application/vnd.npm.install-v1+json")
+	}
 
 	resp, err := h.proxy.HTTPClient.Do(req)
 	if err != nil {

internal/handler/npm_test.go

@@ -293,6 +293,62 @@ func TestNPMRewriteMetadataCooldownExemptPackage(t *testing.T) {
 	}
 }
 
+func TestNPMHandlerUsesAbbreviatedMetadata(t *testing.T) {
+	var gotAccept string
+	upstream := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		gotAccept = r.Header.Get("Accept")
+		w.Header().Set("Content-Type", "application/json")
+		_, _ = w.Write([]byte(`{
+			"name": "testpkg",
+			"versions": {
+				"1.0.0": {
+					"name": "testpkg",
+					"version": "1.0.0",
+					"dist": {
+						"tarball": "https://registry.npmjs.org/testpkg/-/testpkg-1.0.0.tgz"
+					}
+				}
+			}
+		}`))
+	}))
+	defer upstream.Close()
+
+	t.Run("no cooldown uses abbreviated metadata", func(t *testing.T) {
+		h := &NPMHandler{
+			proxy:       testProxy(),
+			upstreamURL: upstream.URL,
+			proxyURL:    "http://proxy.local",
+		}
+
+		req := httptest.NewRequest(http.MethodGet, "/testpkg", nil)
+		w := httptest.NewRecorder()
+		h.handlePackageMetadata(w, req)
+
+		if gotAccept != "application/vnd.npm.install-v1+json" {
+			t.Errorf("Accept = %q, want abbreviated metadata header", gotAccept)
+		}
+	})
+
+	t.Run("cooldown enabled uses full metadata", func(t *testing.T) {
+		proxy := testProxy()
+		proxy.Cooldown = &cooldown.Config{Default: "3d"}
+
+		h := &NPMHandler{
+			proxy:       proxy,
+			upstreamURL: upstream.URL,
+			proxyURL:    "http://proxy.local",
+		}
+
+		req := httptest.NewRequest(http.MethodGet, "/testpkg", nil)
+		w := httptest.NewRecorder()
+		h.handlePackageMetadata(w, req)
+
+		if gotAccept == "application/vnd.npm.install-v1+json" {
+			t.Error("cooldown enabled should use full metadata, not abbreviated")
+		}
+	})
+}
+
 func TestNPMHandlerMetadataNotFound(t *testing.T) {
 	upstream := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		w.WriteHeader(http.StatusNotFound)