gitea serves the registry's public root, and the lab trusts a tarball only at it or the forge's own origin (hq ADR 0346, issue 624)

The forge writes every tarball at its public name and the lab reaches it at a private address, so npm 12 refused every locked @novox package. The public name now comes from the mesh's own composition of the forge's route, through the lab's binding, and the lab compares scheme, host and port.
2026-10-13 16:53:26 +02:00
parent 5f491e0c09
commit 9e2c1531e4
5 changed files with 124 additions and 21 deletions
@@ -68,7 +68,8 @@
    "npm-package-registry": {
      "scheme": "http",
      "port": 3000,
-      "npm-path": "/api/packages/novox/npm/"
+      "npm-path": "/api/packages/novox/npm/",
+      "public-root": "https://${bound:route:name-web}/api/packages/novox/npm/"
    },
    "git": {
      "scheme": "http",