vtgen

> If you're going to allow all, why not disable CORS? because the browser will complain/fail; even though a normal api client works

same here fwiw. we are pretty heavily ingrained into yarn; with yarn specific tooling already stable and entrenched. i think we can generate a package.lock.json temporarily; but after a couple...