If new code is pulled from the registry, the api.js needs to be parsed again and the endpoints it adds to core need to be replaced. A few thoughts in the moment in case this doesn't get done for a while:
could do a simple override in our proxy code. instead of the api.js adding endpoints directly to the core locker app, it could just add them to an object and the proxy code could check for a match.
to simplify things, if we need to do any of our own checking/matching, all we use is the /:something syntax which we could hardcode into out match, kinda gross, but probably ok as a first step.
If new code is pulled from the registry, the api.js needs to be parsed again and the endpoints it adds to core need to be replaced. A few thoughts in the moment in case this doesn't get done for a while: