fix(package): avoid double-response on async upload cleanup errors

[codxbrexx]

Summary

This PR fixes a package upload error-handling bug in src/controller/package.ts.

During package extraction and cleanup, temporary blob deletion can fail asynchronously. Before this fix, those late cleanup errors still flowed into next(error) even after the upload had already returned 201 Created. That creates a second Express error path after the response is already committed, which can make the server try to send another response for the same request.

The fix adds a small response-settlement guard so asynchronous cleanup failures are only forwarded while the request is still active. If the response has already been sent, the error is safely ignored and logged instead of attempting a second response.

Problem statement

The package upload route performs asynchronous cleanup after the uploaded zip has been written and extracted. One of those cleanup steps deletes the temporary blob from disk.

If that cleanup fails after the success response has already been sent, the previous code still called the shared error handler. In Express, that means trying to enter the error middleware after headers are already sent, which leads to the classic double-response failure:

the server tries to handle the same request twice

In short, a non-critical cleanup failure could escalate into a runtime response-state error.

Related issue

• Testing Requirement: added focused controller tests covering pre-response forwarding and post-response async cleanup suppression

Type of change

• Bug fix
• New feature
• Documentation
• Chore / CI
• Breaking change

How to test

1. Checkout the branch with this change.
2. Run cd faas && npm test.
3. Verify the Fix: packageUpload Async Cleanup Error Handling suite passes.
4. Confirm async cleanup errors after a completed upload do not trigger a second Express error response.

Checklist

• I have read the contributing guidelines
• I added tests that prove my fix is effective or that my feature works
• I updated documentation if necessary

Note:
The guard is intentionally narrow. It does not hide upload failures that happen before the response is sent. It only prevents late asynchronous cleanup errors from re-entering Express after the request has already been settled.

Release notes

Fixed package upload so late async cleanup failures no longer trigger a second response attempt after success.