[feat] introduce `jsdelivr` registry, cross origin resource sharing `npm/package@version/file`

[loynoir]

Feature Description

In npm ecosystem, browser is able to access npm package inner resource.

Thus, I think, it would be nice to let browser able to access gitea npm package inner resource.

---

https://esm.sh/

import Module from "https://esm.sh/PKG@SEMVER[/PATH]";

https://www.unpkg.com/

unpkg.com/:package@:version/:file

https://www.jsdelivr.com/

https://cdn.jsdelivr.net/npm/package@version/file

---

https://docs.gitea.com/usage/packages/npm

Below feature seems missing in gitea

https://gitea/user/-/packages/npm/hello/1.0.0/asset/dist/index.mjs

---

And the url should be importmap friendly

https://github.com/WICG/import-maps

With importmap versionize

  "scopes": {
    "user-url-scope": {
      "hello/": "https://gitea/user/-/packages/npm/hello/1.0.0/asset/",

Code

import {hello} from "hello/dist/index.mjs"

Equivalent

import {hello} from "https://gitea/user/-/packages/npm/hello/1.0.0/asset/dist/index.mjs"

Screenshots

No response

[wxiaoguang]

I think it is not feasible at the moment.

Gitea packages do not expose raw files directly, and the uploaded packages are stored in "compressed file" (zip, tar.gz, etc)

It's impossible to correctly serve these files without a new system.

[loynoir]

Related

#33209

#33216

#33219

---

Core problem

Within https://webapp/index.html

// index.mjs
import npm_approach from "https://gitea/XXX/npm/hello/1.0.0/files/index.mjs"
import rawgit_approach from "https://gitea/XXX/raw/branch/main/index.mjs"
import generic_approach from "https://gitea/XXx/generic/hello/1.0.0/index.mjs"

---

Currently, as comparison

• npm package approach: browser cannot access npm approach inner resource

• rawgit like approach: browser can access rawgit approach inner resource with correct mimetype, but lack of cors

• generic package approach: browser can access generic approach inner resource, but lack of cors and mimetype and directory support

---

I think, the easiest implement is removing limit of generic package, let it be able to cover all fallback cases.

---

I think, to avoid uncompressed files taking too much space, the most graceful implement would be

• option in to convert npm published tarball to zip

• index the zip, persist every inner resource subpath and offset

• serve subpath using zip offset

This implement is inspired by yarn/berry implement

https://github.com/yarnpkg/berry

[wxiaoguang]

It is an abuse of current Gitea's packages design.

If you propose to support serving files in packages directly, it is a new proposal and I think other issues could be merged (closed) into one.

[loynoir]

Personally, I think, there are three different feature requests.

Titles was not clear enough, renamed as below.

feat: introduce jsdelivr registry, cross origin resource sharing npm/package@version/file

feat: introduce rawgit registry, cross origin resource sharing repo/raw/branch/main/file

feat: introduce cors-static-file registry, cross origin resource sharing nested/directory/static/file/with/mimetype/mapping

[KN4CK3R]

esm.sh, unpkg.com and jsdelivr.net are not really the registry but a thirdparty service which then adds the needed mimetype and/or cors. It's not the npm registry which serves the content to the browser.

[loynoir]

esm.sh, unpkg.com and jsdelivr.net are not really the registry but a thirdparty service which then adds the needed mimetype and/or cors.

If it looks like a duck, swims like a duck, and quacks like a duck, then it probably is a duck.

They are no doubt thirdparty service.

They may or may not registry.

But they are part of browser javascript version control system.

https://ajax.googleapis.com/ajax/libs/jquery/3.7.1/jquery.min.js

https://cdn.jsdelivr.net/npm/jquery@3.6.4/dist/jquery.min.js

https://cdn.skypack.dev/bootstrap@next/dist/css/bootstrap.min.css

https://cdn.skypack.dev/preact@10.5.5

https://cdnjs.cloudflare.com/ajax/libs/jquery/3.7.1/jquery.min.js

https://esm.sh/react@18.2.0

https://www.unpkg.com/react@16.7.0/umd/react.production.min.js

It's not the npm registry which serves the content to the browser.

Do you mean /npm/pkg@ver style not sounds for browser?

What about /ajax/libs/pkg@ver style?

Name	Language	Package client
Generic	-	any HTTP client
npm	JavaScript	npm, yarn, pnpm
?	javascript	browser