@meddleware/dashboard-ui 0.1.94 → 0.1.96

package/CHANGELOG.md

@@ -5,6 +5,26 @@ Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); version
 [Semantic Versioning](https://semver.org/). Before 0.2.0, breaking changes ship as patch releases.
 Releases before 0.1.85 are recorded in the git history only.
 
+## [0.1.96] - 2026-11-06
+
+### Changed
+
+- Takes `@meddleware/access-gate-ui` 0.1.46 (its gate-policy template reads type-check under every `vue-tsc`) and the Dependabot merges of 2026-11-06 (image base `static-server` 0.1.12, dev tools).
+
+## [0.1.95] - 2026-11-05
+
+### Fixed
+
+- The Blockchain view's tab strip sits under the header's real height and publishes its own offset (`--mw-sticky-extra`), so focus is not hidden behind the sticky header and strip (WCAG 2.4.11).
+
+### Security
+
+- CI and the image build scan the production bundle for the e2e harness (`check-prod-bundle` from `@meddleware/frontend-config`), and `src/e2e*.ts` is no longer in the published package.
+
+### Changed
+
+- Takes the embedded tools' 2026-11-05 releases (access-gate-ui 0.1.45, sealed-storage-ui 0.0.46, token-issuance-ui 0.0.44, treasury-ui 0.0.25, walrus-storage-ui 0.1.67) and `@meddleware/ui` ^0.1.38, `@meddleware/design-tokens` ^0.1.13, `@meddleware/web-utils` ^0.0.2, `@meddleware/frontend-config` ^0.0.2, `@meddleware/wallet-adapter` ^0.0.21.
+
 ## [0.1.94] - 2026-11-01
 
 - Shared shell, sidebar drawer on phones, tools updated, accessibility gates

package/LICENSE

@@ -0,0 +1,14 @@
+BSD Zero Clause License
+
+Copyright (c) 2024 Meddleware
+
+Permission to use, copy, modify, and/or distribute this software for any
+purpose with or without fee is hereby granted.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND
+FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+PERFORMANCE OF THIS SOFTWARE.

package/README.md

@@ -0,0 +1,23 @@
+# @meddleware/dashboard-ui
+
+The organisation-level Meddleware dashboard, served at [`dash.meddleware.co.uk`](https://dash.meddleware.co.uk): a Vue 3 + Vite single-page
+app that embeds each tool from its own package (Treasury, and under *Blockchain* the Walrus Storage, Sealed Storage, Access Gate and Token
+Issuance consoles) inside one shell with a chain selector. It holds no financial logic: every number is read from the chain by the embedded tool.
+
+- **Stack:** Vue 3, Vite, `@meddleware/design-tokens`, `@meddleware/ui`, `@meddleware/wallet-adapter`.
+- **Image:** `quay.io/meddleware-org/dashboard-ui`, built on `quay.io/meddleware-org/static-server` (see `Dockerfile`).
+- **Context for contributors and agents:** [CLAUDE.md](CLAUDE.md); the security review is `docs/audit/dashboard-ui-audit.md`.
+- **Licence:** BSD Zero Clause ([0BSD](LICENSE)).
+
+## Develop
+
+```bash
+npm ci
+npm run dev          # Vite dev server
+npm test             # unit tests (Vitest)
+npm run test:e2e     # builds the e2e variant and runs the Playwright sweep (E2E_BROWSERS=all adds Firefox, WebKit and two mobile profiles)
+npm run lint && npm run type-check
+npm run build && npm run check:bundle && npm run check:dist
+```
+
+`npm run check:bundle` fails if a test hook reached the production bundle; `npm run check:dist` fails if the build has an inline script the CSP would refuse.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@meddleware/dashboard-ui",
-  "version": "0.1.94",
+  "version": "0.1.96",
   "homepage": "https://docs.meddleware.co.uk/",
   "description": "Meddleware tools hub — Vue 3 SPA listing hosted services (Walrus, Access Gate) with white-label deploy options.",
   "author": "Meddleware <dev@meddleware.co.uk>",
@@ -15,7 +15,8 @@
     "index.html",
     "vite.config.ts",
     "tsconfig.json",
-    "CHANGELOG.md"
+    "CHANGELOG.md",
+    "!src/e2e*.ts"
   ],
   "scripts": {
     "dev": "vite",
@@ -34,28 +35,29 @@
     "check:licenses": "node scripts/third-party-licenses.mjs --check",
     "check:dist": "node scripts/check-inline-scripts.mjs",
     "shots": "SHOTS=1 playwright test",
-    "lhci": "npm run build && lhci autorun"
+    "lhci": "npm run build && lhci autorun",
+    "check:bundle": "check-prod-bundle dist"
   },
   "publishConfig": {
     "access": "public"
   },
   "dependencies": {
-    "@meddleware/access-gate-ui": "^0.1.44",
-    "@meddleware/design-tokens": "^0.1.12",
-    "@meddleware/sealed-storage-ui": "^0.0.45",
-    "@meddleware/token-issuance-ui": "^0.0.43",
-    "@meddleware/treasury-ui": "^0.0.24",
-    "@meddleware/ui": "^0.1.37",
-    "@meddleware/wallet-adapter": "^0.0.20",
-    "@meddleware/walrus-storage-ui": "^0.1.66",
-    "@meddleware/web-utils": "^0.0.1",
+    "@meddleware/access-gate-ui": "^0.1.46",
+    "@meddleware/design-tokens": "^0.1.13",
+    "@meddleware/sealed-storage-ui": "^0.0.46",
+    "@meddleware/token-issuance-ui": "^0.0.44",
+    "@meddleware/treasury-ui": "^0.0.25",
+    "@meddleware/ui": "^0.1.38",
+    "@meddleware/wallet-adapter": "^0.0.21",
+    "@meddleware/walrus-storage-ui": "^0.1.67",
+    "@meddleware/web-utils": "^0.0.2",
     "@mysten/sui": "^2.36.0",
     "vue": "^3.5.44",
     "vue-router": "^5.4.0"
   },
   "devDependencies": {
     "@lhci/cli": "^0.15.1",
-    "@meddleware/frontend-config": "^0.0.1",
+    "@meddleware/frontend-config": "^0.0.2",
     "@playwright/test": "~1.64.1",
     "@types/node": "~26.6.5",
     "@vitejs/plugin-vue": "^6.0.10",

package/src/views/BlockchainView.vue

@@ -3,7 +3,7 @@
 // chain is Sui; the `chain` prop is the sidebar's choice, so a second chain switches the tool set without a rewrite. Each tool view is lazy-loaded (its deps, incl. the Walrus
 // wasm, load only when its tab is first opened) and kept alive so switching tabs preserves state.
 import { computed, defineAsyncComponent, ref, watch } from 'vue'
-import { AppTabNav, UiTabPanel, type AppTab } from '@meddleware/ui'
+import { AppTabNav, UiTabPanel, useStickyOffset, type AppTab } from '@meddleware/ui'
 
 import { CHAINS, DEFAULT_CHAIN } from '../chains.js'
 
@@ -37,12 +37,16 @@ watch(
 )
 
 const activeComp = computed(() => tools.value.find((t) => t.id === active.value)?.comp)
+
+// The tab strip sticks under the header: publish its height so a focused field is never left behind either of them (WCAG 2.4.11).
+const strip = ref<{ $el?: unknown } | null>(null)
+useStickyOffset(strip, '--mw-sticky-extra')
 </script>
 
 <template>
   <section aria-labelledby="blockchain-title" class="blockchain-view">
     <h2 id="blockchain-title" class="mw-visually-hidden">{{ chainLabel }} tools</h2>
-    <AppTabNav v-model="active" :tabs="tabs" id-prefix="blockchain" variant="raised" size="lg" flush class="tabs" :aria-label="`${chainLabel} tools`" />
+    <AppTabNav v-model="active" :tabs="tabs" id-prefix="blockchain" variant="raised" size="lg" flush ref="strip" class="tabs" :aria-label="`${chainLabel} tools`" />
 
     <UiTabPanel id-prefix="blockchain" :tab="active" class="content">
       <KeepAlive>
@@ -59,10 +63,11 @@ const activeComp = computed(() => tools.value.find((t) => t.id === active.value)
   min-height: 0;
 }
 
-/* The tool tabs stay in view under the sticky header while the page scrolls. */
+/* The tool tabs stay in view under the sticky header while the page scrolls: under its real height, which is more than its minimum when
+   the header wraps on a phone. */
 .tabs {
   position: sticky;
-  top: var(--mw-header-height);
+  top: var(--mw-header-offset, var(--mw-header-height));
   z-index: var(--z-raised);
   background: var(--bg);
 }

package/src/e2e.ts

@@ -1,8 +0,0 @@
-// End-to-end build only (`vite build --mode e2e`; main.ts loads this when MODE is `e2e` and VITE_E2E is `1`, both static, so every other
-// build drops it). A mock wallet is registered like an extension and the chain client is a stub with nothing on it, so every embedded tool
-// can be checked connected (each tool's own flows are covered in its own repository).
-import { installE2eWallet } from '@meddleware/wallet-adapter/testing'
-
-export function installE2e(): void {
-  installE2eWallet()
-}