@meddleware/frontend-config 0.0.3 → 0.0.5

package/CHANGELOG.md

@@ -5,6 +5,18 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.0.5] - 2026-11-07
+
+### Added
+
+- `mw-network-status --check <file>`: fails when the committed network file differs from the deployment records (for CI).
+
+## [0.0.4] - 2026-11-07
+
+### Added
+
+- `mw-network-status`: writes the networks the platform is deployed on from the clients' deployment records, for the landing page, docs and developer docs.
+
 ## [0.0.3] - 2026-11-07
 
 ### Added

package/README.md

@@ -23,6 +23,7 @@ same accessibility and browser-support bar.
 | `/tsconfig/vue-app.json` | The compiler options of a Vue app (`"extends": "@meddleware/frontend-config/tsconfig/vue-app.json"`); the repository keeps only its `include`. |
 | `/csp` | `buildCsp(options)`, `cspForProfile(name, current?)`, `PROFILES`, `scriptHashesOf(csp)` — the Content-Security-Policy every app image serves, as six named profiles (`static`, `static-strict`, `console`, `chain`, `chain-wasm`, `docs`), so the policy is written once. |
 | `mw-sync` | `mw-sync --check` / `--write` in a repository root: the files every frontend repository copies (dependabot.yml, .dockerignore, postcss/stylelint configs, the Lighthouse allowlist) equal this package's `templates/`, and the Dockerfile's `ARG CSP` equals its profile. Declared in package.json: `"meddleware": { "kind": "app", "csp": "chain-wasm", "lhci": true }`. |
+| `mw-network-status` | `mw-network-status --out src/network.json` (or `--check src/network.json` in CI): which networks MeddleWare is deployed on, from the installed clients' deployment records through `networkAvailability` (`@meddleware/web-utils`). The file is committed and CI checks it, so "mainnet is coming" turns into "live" by the records alone. |
 | `mw-audit-gate` | CI dependency gate: `npm audit` at high/critical minus the dated, reasoned entries of `.github/audit-allowlist.json` (an entry with no reason or an expired date fails). |
 | `mw-third-party-licenses` | Writes `dist/THIRD_PARTY_LICENSES` from the lockfile's production packages and their installed licence texts; `--check` fails when none can be written. |
 | `mw-check-csp-inline` | `mw-check-csp-inline <policy or @Dockerfile> [dist]`: every inline script in the built pages is allowed by a `sha256` source in the policy, and the policy never allows `'unsafe-inline'` scripts. |

package/dist/network-status.d.ts

@@ -0,0 +1,8 @@
+#!/usr/bin/env node
+/**
+ * @param {{ networkAvailability: Function }} utils
+ * @param {Record<string, Record<string, unknown>>} records product name → its deployments object
+ */
+export function networkStatus(utils: {
+    networkAvailability: Function;
+}, records: Record<string, Record<string, unknown>>): any;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@meddleware/frontend-config",
-  "version": "0.0.3",
+  "version": "0.0.5",
   "type": "module",
   "description": "Shared frontend tooling for MeddleWare apps: browser support, ESLint, Stylelint, html-validate, PostCSS, Playwright, axe, screenshots, Lighthouse and the Vite target.",
   "license": "0BSD",
@@ -175,6 +175,7 @@
     "mw-audit-gate": "./src/audit-gate.js",
     "mw-third-party-licenses": "./src/third-party-licenses.js",
     "mw-check-csp-inline": "./src/check-csp-inline.js",
-    "mw-sync": "./src/sync.js"
+    "mw-sync": "./src/sync.js",
+    "mw-network-status": "./src/network-status.js"
   }
 }

package/src/network-status.js

@@ -0,0 +1,60 @@
+#!/usr/bin/env node
+// @ts-check
+// mw-network-status — write which networks MeddleWare is deployed on, from the deployment records of the installed client packages, so a static
+// site (landing page, docs, developer docs) says "mainnet is coming" until the records have a `mainnet` key and says "live" the moment they do.
+//
+//   mw-network-status [--out src/network.json]     (default: print to stdout)
+//   mw-network-status --check src/network.json     fail (exit 1) when the committed file differs from the records
+//
+// The file is committed, so the page and its tests never depend on a hidden build step; CI runs `--check`, and bumping a client package
+// (Dependabot, or a release that adds a mainnet record) fails the check until the file is regenerated with `--out`. The repository needs `@meddleware/web-utils` and the two clients
+// (`@meddleware/access-gate-client`, `@meddleware/sealed-storage-client`) installed; it fails when one is missing rather than guess.
+import { readFileSync, writeFileSync } from 'node:fs'
+import { createRequire } from 'node:module'
+import { join } from 'node:path'
+import { pathToFileURL } from 'node:url'
+
+/** @param {string} name */
+async function load(name) {
+  const require = createRequire(join(process.cwd(), 'noop.js'))
+  return import(pathToFileURL(require.resolve(name)).href)
+}
+
+/**
+ * @param {{ networkAvailability: Function }} utils
+ * @param {Record<string, Record<string, unknown>>} records product name → its deployments object
+ */
+export function networkStatus(utils, records) {
+  return utils.networkAvailability(Object.fromEntries(Object.entries(records).map(([name, deployments]) => [name, Object.keys(deployments)])))
+}
+
+if (import.meta.url === pathToFileURL(process.argv[1] ?? '').href) {
+  const args = process.argv.slice(2)
+  const outIndex = args.indexOf('--out')
+  const out = outIndex >= 0 ? args[outIndex + 1] : undefined
+  const checkIndex = args.indexOf('--check')
+  const check = checkIndex >= 0 ? args[checkIndex + 1] : undefined
+  try {
+    const utils = await load('@meddleware/web-utils')
+    const gate = await load('@meddleware/access-gate-client')
+    const sealed = await load('@meddleware/sealed-storage-client')
+    const status = networkStatus(utils, { 'access gate': gate.ACCESS_GATE_DEPLOYMENTS, 'sealed storage': sealed.SEAL_POLICIES_DEPLOYMENTS })
+    const json = JSON.stringify(status, null, 2) + '\n'
+    if (check) {
+      let have = ''
+      try {
+        have = readFileSync(check, 'utf8')
+      } catch {
+        // missing counts as different
+      }
+      if (have !== json) {
+        console.error(`mw-network-status: ${check} is out of date with the deployment records; run \`mw-network-status --out ${check}\``)
+        process.exit(1)
+      }
+    } else if (out) writeFileSync(out, json)
+    else process.stdout.write(json)
+  } catch (err) {
+    console.error(`mw-network-status: ${err instanceof Error ? err.message : String(err)}`)
+    process.exit(1)
+  }
+}