@meddleware/frontend-config 0.0.4 → 0.0.5

package/CHANGELOG.md

@@ -5,6 +5,12 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.0.5] - 2026-11-07
+
+### Added
+
+- `mw-network-status --check <file>`: fails when the committed network file differs from the deployment records (for CI).
+
 ## [0.0.4] - 2026-11-07
 
 ### Added

package/README.md

@@ -23,7 +23,7 @@ same accessibility and browser-support bar.
 | `/tsconfig/vue-app.json` | The compiler options of a Vue app (`"extends": "@meddleware/frontend-config/tsconfig/vue-app.json"`); the repository keeps only its `include`. |
 | `/csp` | `buildCsp(options)`, `cspForProfile(name, current?)`, `PROFILES`, `scriptHashesOf(csp)` — the Content-Security-Policy every app image serves, as six named profiles (`static`, `static-strict`, `console`, `chain`, `chain-wasm`, `docs`), so the policy is written once. |
 | `mw-sync` | `mw-sync --check` / `--write` in a repository root: the files every frontend repository copies (dependabot.yml, .dockerignore, postcss/stylelint configs, the Lighthouse allowlist) equal this package's `templates/`, and the Dockerfile's `ARG CSP` equals its profile. Declared in package.json: `"meddleware": { "kind": "app", "csp": "chain-wasm", "lhci": true }`. |
-| `mw-network-status` | `mw-network-status [--out src/network.json]`: which networks MeddleWare is deployed on, from the installed clients' deployment records through `networkAvailability` (`@meddleware/web-utils`). A static site runs it as `prebuild`, so "mainnet is coming" turns into "live" by the records alone. |
+| `mw-network-status` | `mw-network-status --out src/network.json` (or `--check src/network.json` in CI): which networks MeddleWare is deployed on, from the installed clients' deployment records through `networkAvailability` (`@meddleware/web-utils`). The file is committed and CI checks it, so "mainnet is coming" turns into "live" by the records alone. |
 | `mw-audit-gate` | CI dependency gate: `npm audit` at high/critical minus the dated, reasoned entries of `.github/audit-allowlist.json` (an entry with no reason or an expired date fails). |
 | `mw-third-party-licenses` | Writes `dist/THIRD_PARTY_LICENSES` from the lockfile's production packages and their installed licence texts; `--check` fails when none can be written. |
 | `mw-check-csp-inline` | `mw-check-csp-inline <policy or @Dockerfile> [dist]`: every inline script in the built pages is allowed by a `sha256` source in the policy, and the policy never allows `'unsafe-inline'` scripts. |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@meddleware/frontend-config",
-  "version": "0.0.4",
+  "version": "0.0.5",
   "type": "module",
   "description": "Shared frontend tooling for MeddleWare apps: browser support, ESLint, Stylelint, html-validate, PostCSS, Playwright, axe, screenshots, Lighthouse and the Vite target.",
   "license": "0BSD",

package/src/network-status.js

@@ -4,10 +4,12 @@
 // site (landing page, docs, developer docs) says "mainnet is coming" until the records have a `mainnet` key and says "live" the moment they do.
 //
 //   mw-network-status [--out src/network.json]     (default: print to stdout)
+//   mw-network-status --check src/network.json     fail (exit 1) when the committed file differs from the records
 //
-// Run it from the repository root before the build (a `prebuild` script). The repository needs `@meddleware/web-utils` and the two clients
+// The file is committed, so the page and its tests never depend on a hidden build step; CI runs `--check`, and bumping a client package
+// (Dependabot, or a release that adds a mainnet record) fails the check until the file is regenerated with `--out`. The repository needs `@meddleware/web-utils` and the two clients
 // (`@meddleware/access-gate-client`, `@meddleware/sealed-storage-client`) installed; it fails when one is missing rather than guess.
-import { writeFileSync } from 'node:fs'
+import { readFileSync, writeFileSync } from 'node:fs'
 import { createRequire } from 'node:module'
 import { join } from 'node:path'
 import { pathToFileURL } from 'node:url'
@@ -30,13 +32,26 @@ if (import.meta.url === pathToFileURL(process.argv[1] ?? '').href) {
   const args = process.argv.slice(2)
   const outIndex = args.indexOf('--out')
   const out = outIndex >= 0 ? args[outIndex + 1] : undefined
+  const checkIndex = args.indexOf('--check')
+  const check = checkIndex >= 0 ? args[checkIndex + 1] : undefined
   try {
     const utils = await load('@meddleware/web-utils')
     const gate = await load('@meddleware/access-gate-client')
     const sealed = await load('@meddleware/sealed-storage-client')
     const status = networkStatus(utils, { 'access gate': gate.ACCESS_GATE_DEPLOYMENTS, 'sealed storage': sealed.SEAL_POLICIES_DEPLOYMENTS })
     const json = JSON.stringify(status, null, 2) + '\n'
-    if (out) writeFileSync(out, json)
+    if (check) {
+      let have = ''
+      try {
+        have = readFileSync(check, 'utf8')
+      } catch {
+        // missing counts as different
+      }
+      if (have !== json) {
+        console.error(`mw-network-status: ${check} is out of date with the deployment records; run \`mw-network-status --out ${check}\``)
+        process.exit(1)
+      }
+    } else if (out) writeFileSync(out, json)
     else process.stdout.write(json)
   } catch (err) {
     console.error(`mw-network-status: ${err instanceof Error ? err.message : String(err)}`)