Publish @plasticdigits/cl8y-clickwrap to the public npm registry #14

New issue

PlasticDigits · 2026-08-29T11:16:24Z

PlasticDigits commented

2026-08-29 11:16:24 +00:00

(Migrated from gitlab.com)

Context

@plasticdigits/cl8y-clickwrap (packages/cl8y-clickwrap) already has publishConfig.access: public and the package README tells integrators to npm publish --access public against the @plasticdigits npm org.

What is actually published today is the GitLab project npm registry (https://gitlab.com/api/v4/projects/82547916/packages/npm/). That registry is already public: unauthenticated GET of the 0.1.0 metadata and tarball returns 200. DEX frontend-dapp/.npmrc scopes @plasticdigits there and Coolify builds without GITLAB_NPM_TOKEN. Voting should do the same — do not treat a GitLab npm token as required.

The package is not on registry.npmjs.org (npm view 404). A public npmjs copy would let integrators npm install @plasticdigits/cl8y-clickwrap with no scoped .npmrc. That is nicer, not a Coolify blocker.

Triggered while standing up voting Coolify (vote.cl8y.com).

Remaining work

Confirm @plasticdigits exists on npmjs.com and that a human with org publish rights can publish from a laptop (npm automation token in a password manager — never commit it, never put it in GitLab CI).
From a workstation: in packages/cl8y-clickwrap, bump if needed, npm run build, npm publish --access public.
Document in packages/cl8y-clickwrap/README.md that GitLab project packages are already public (DEX-style .npmrc, no token) and that npmjs is the unscoped default after this publish.
After npmjs publish, consumers may drop the scoped GitLab .npmrc. Until then, keep it — no GITLAB_NPM_TOKEN. Follow-up in DEX / voting repos.

Not in this issue

A GitLab CI publish job. This project is routinely ci_quota_exceeded (#13, #10). Publish from a laptop.
Registering Legal property vote.cl8y.com / CORS / portal VITE_REDIRECT_URI_ALLOWLIST (voting ops, voting#7).
Changing the SDK API (TermsGate, networks, redirect sanitize).
#7 wildcard CORS.

Verify

# GitLab registry already (no token)
curl -sS -o /dev/null -w '%{http_code}\n' \
  'https://gitlab.com/api/v4/projects/82547916/packages/npm/@plasticdigits/cl8y-clickwrap/-/@plasticdigits/cl8y-clickwrap-0.1.0.tgz'

# after laptop publish to npmjs
npm view @plasticdigits/cl8y-clickwrap version

## Context `@plasticdigits/cl8y-clickwrap` (`packages/cl8y-clickwrap`) already has `publishConfig.access: public` and the package README tells integrators to `npm publish --access public` against the `@plasticdigits` npm org. What is actually published today is the **GitLab project npm registry** (`https://gitlab.com/api/v4/projects/82547916/packages/npm/`). That registry is already **public**: unauthenticated `GET` of the `0.1.0` metadata and tarball returns 200. DEX `frontend-dapp/.npmrc` scopes `@plasticdigits` there and Coolify builds **without** `GITLAB_NPM_TOKEN`. Voting should do the same — do not treat a GitLab npm token as required. The package is **not** on registry.npmjs.org (`npm view` 404). A public npmjs copy would let integrators `npm install @plasticdigits/cl8y-clickwrap` with no scoped `.npmrc`. That is nicer, not a Coolify blocker. Triggered while standing up voting Coolify (`vote.cl8y.com`). ## Remaining work - [ ] Confirm `@plasticdigits` exists on [npmjs.com](https://www.npmjs.com) and that a human with org publish rights can publish from a laptop (npm automation token in a password manager — never commit it, never put it in GitLab CI). - [ ] From a workstation: in `packages/cl8y-clickwrap`, bump if needed, `npm run build`, `npm publish --access public`. - [ ] Document in `packages/cl8y-clickwrap/README.md` that GitLab project packages are already public (DEX-style `.npmrc`, no token) and that npmjs is the unscoped default after this publish. - [ ] After npmjs publish, consumers *may* drop the scoped GitLab `.npmrc`. Until then, keep it — no `GITLAB_NPM_TOKEN`. Follow-up in DEX / voting repos. ## Not in this issue - A GitLab CI publish job. This project is routinely `ci_quota_exceeded` ([#13](https://gitlab.com/PlasticDigits/cl8y-ecosystem-legal/-/issues/13), [#10](https://gitlab.com/PlasticDigits/cl8y-ecosystem-legal/-/issues/10)). Publish from a laptop. - Registering Legal property `vote.cl8y.com` / CORS / portal `VITE_REDIRECT_URI_ALLOWLIST` (voting ops, [voting#7](https://gitlab.com/PlasticDigits/voting/-/issues/7)). - Changing the SDK API (`TermsGate`, networks, redirect sanitize). - [#7](https://gitlab.com/PlasticDigits/cl8y-ecosystem-legal/-/issues/7) wildcard CORS. ## Verify ```bash # GitLab registry already (no token) curl -sS -o /dev/null -w '%{http_code}\n' \ 'https://gitlab.com/api/v4/projects/82547916/packages/npm/@plasticdigits/cl8y-clickwrap/-/@plasticdigits/cl8y-clickwrap-0.1.0.tgz' # after laptop publish to npmjs npm view @plasticdigits/cl8y-clickwrap version ```

PlasticDigits commented

2026-08-29 11:21:11 +00:00

(Migrated from gitlab.com)

changed the description

PlasticDigits commented

2026-08-29 11:21:13 +00:00

(Migrated from gitlab.com)

GitLab CI publish is out of scope: this project is almost always out of CI minutes (same class as #13 / #10). Do this from a laptop.

Also: the GitLab project npm package is already public. DEX Coolify installs @plasticdigits/cl8y-clickwrap with only frontend-dapp/.npmrc and no GITLAB_NPM_TOKEN. Voting can do the same; a token is not a Coolify requirement. npmjs.org still 404s — optional laptop npm publish --access public so consumers can drop the scoped registry later.

GitLab CI publish is out of scope: this project is almost always out of CI minutes (same class as #13 / #10). Do this from a laptop. Also: the GitLab project npm package is already public. DEX Coolify installs `@plasticdigits/cl8y-clickwrap` with only `frontend-dapp/.npmrc` and no `GITLAB_NPM_TOKEN`. Voting can do the same; a token is not a Coolify requirement. npmjs.org still 404s — optional laptop `npm publish --access public` so consumers can drop the scoped registry later.

PlasticDigits referenced this issue

2026-09-05 16:11:21 +00:00

design: TermsGate coverage parity for cl8y.com and bridge.cl8y.com #34

ops-worker added the

agent:implement

ready

labels

2026-09-05 19:04:27 +00:00

Sign in to join this conversation.