@meddleware/frontend-config 0.0.4 → 0.0.6

package/CHANGELOG.md

@@ -5,6 +5,18 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.0.6] - 2026-11-07
+
+### Fixed
+
+- `mw-network-status` and `mw-sync` did nothing when run as an installed bin (they compared the symlink in `node_modules/.bin` with the real path); both now compare real paths, and a test runs each through a symlink.
+
+## [0.0.5] - 2026-11-07
+
+### Added
+
+- `mw-network-status --check <file>`: fails when the committed network file differs from the deployment records (for CI).
+
 ## [0.0.4] - 2026-11-07
 
 ### Added

package/README.md

@@ -23,7 +23,7 @@ same accessibility and browser-support bar.
 | `/tsconfig/vue-app.json` | The compiler options of a Vue app (`"extends": "@meddleware/frontend-config/tsconfig/vue-app.json"`); the repository keeps only its `include`. |
 | `/csp` | `buildCsp(options)`, `cspForProfile(name, current?)`, `PROFILES`, `scriptHashesOf(csp)` — the Content-Security-Policy every app image serves, as six named profiles (`static`, `static-strict`, `console`, `chain`, `chain-wasm`, `docs`), so the policy is written once. |
 | `mw-sync` | `mw-sync --check` / `--write` in a repository root: the files every frontend repository copies (dependabot.yml, .dockerignore, postcss/stylelint configs, the Lighthouse allowlist) equal this package's `templates/`, and the Dockerfile's `ARG CSP` equals its profile. Declared in package.json: `"meddleware": { "kind": "app", "csp": "chain-wasm", "lhci": true }`. |
-| `mw-network-status` | `mw-network-status [--out src/network.json]`: which networks MeddleWare is deployed on, from the installed clients' deployment records through `networkAvailability` (`@meddleware/web-utils`). A static site runs it as `prebuild`, so "mainnet is coming" turns into "live" by the records alone. |
+| `mw-network-status` | `mw-network-status --out src/network.json` (or `--check src/network.json` in CI): which networks MeddleWare is deployed on, from the installed clients' deployment records through `networkAvailability` (`@meddleware/web-utils`). The file is committed and CI checks it, so "mainnet is coming" turns into "live" by the records alone. |
 | `mw-audit-gate` | CI dependency gate: `npm audit` at high/critical minus the dated, reasoned entries of `.github/audit-allowlist.json` (an entry with no reason or an expired date fails). |
 | `mw-third-party-licenses` | Writes `dist/THIRD_PARTY_LICENSES` from the lockfile's production packages and their installed licence texts; `--check` fails when none can be written. |
 | `mw-check-csp-inline` | `mw-check-csp-inline <policy or @Dockerfile> [dist]`: every inline script in the built pages is allowed by a `sha256` source in the policy, and the policy never allows `'unsafe-inline'` scripts. |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@meddleware/frontend-config",
-  "version": "0.0.4",
+  "version": "0.0.6",
   "type": "module",
   "description": "Shared frontend tooling for MeddleWare apps: browser support, ESLint, Stylelint, html-validate, PostCSS, Playwright, axe, screenshots, Lighthouse and the Vite target.",
   "license": "0BSD",

package/src/network-status.js

@@ -4,10 +4,12 @@
 // site (landing page, docs, developer docs) says "mainnet is coming" until the records have a `mainnet` key and says "live" the moment they do.
 //
 //   mw-network-status [--out src/network.json]     (default: print to stdout)
+//   mw-network-status --check src/network.json     fail (exit 1) when the committed file differs from the records
 //
-// Run it from the repository root before the build (a `prebuild` script). The repository needs `@meddleware/web-utils` and the two clients
+// The file is committed, so the page and its tests never depend on a hidden build step; CI runs `--check`, and bumping a client package
+// (Dependabot, or a release that adds a mainnet record) fails the check until the file is regenerated with `--out`. The repository needs `@meddleware/web-utils` and the two clients
 // (`@meddleware/access-gate-client`, `@meddleware/sealed-storage-client`) installed; it fails when one is missing rather than guess.
-import { writeFileSync } from 'node:fs'
+import { readFileSync, realpathSync, writeFileSync } from 'node:fs'
 import { createRequire } from 'node:module'
 import { join } from 'node:path'
 import { pathToFileURL } from 'node:url'
@@ -26,17 +28,31 @@ export function networkStatus(utils, records) {
   return utils.networkAvailability(Object.fromEntries(Object.entries(records).map(([name, deployments]) => [name, Object.keys(deployments)])))
 }
 
-if (import.meta.url === pathToFileURL(process.argv[1] ?? '').href) {
+// `process.argv[1]` is the symlink in node_modules/.bin when run as a bin: compare real paths.
+if (process.argv[1] && import.meta.url === pathToFileURL(realpathSync(process.argv[1])).href) {
   const args = process.argv.slice(2)
   const outIndex = args.indexOf('--out')
   const out = outIndex >= 0 ? args[outIndex + 1] : undefined
+  const checkIndex = args.indexOf('--check')
+  const check = checkIndex >= 0 ? args[checkIndex + 1] : undefined
   try {
     const utils = await load('@meddleware/web-utils')
     const gate = await load('@meddleware/access-gate-client')
     const sealed = await load('@meddleware/sealed-storage-client')
     const status = networkStatus(utils, { 'access gate': gate.ACCESS_GATE_DEPLOYMENTS, 'sealed storage': sealed.SEAL_POLICIES_DEPLOYMENTS })
     const json = JSON.stringify(status, null, 2) + '\n'
-    if (out) writeFileSync(out, json)
+    if (check) {
+      let have = ''
+      try {
+        have = readFileSync(check, 'utf8')
+      } catch {
+        // missing counts as different
+      }
+      if (have !== json) {
+        console.error(`mw-network-status: ${check} is out of date with the deployment records; run \`mw-network-status --out ${check}\``)
+        process.exit(1)
+      }
+    } else if (out) writeFileSync(out, json)
     else process.stdout.write(json)
   } catch (err) {
     console.error(`mw-network-status: ${err instanceof Error ? err.message : String(err)}`)

package/src/sync.js

@@ -11,7 +11,7 @@
 //   kind  "app"  → .github/dependabot.yml, .dockerignore, postcss.config.js, stylelint.config.js are the templates
 //   csp   a profile of ./csp.js → the Dockerfile's `ARG CSP="…"` is that profile's policy (`docs` keeps the script hashes already there)
 //   lhci  true   → .github/audit-allowlist.json is the template (the dated allowlist for the Lighthouse CI tool chain; one expiry, reviewed together)
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs'
+import { existsSync, mkdirSync, readFileSync, realpathSync, writeFileSync } from 'node:fs'
 import { dirname, join } from 'node:path'
 import { fileURLToPath } from 'node:url'
 import { cspForProfile } from './csp.js'
@@ -67,7 +67,8 @@ export function sync(root, options = {}) {
   return out
 }
 
-if (process.argv[1] && fileURLToPath(import.meta.url) === process.argv[1]) {
+// `process.argv[1]` is the symlink in node_modules/.bin when run as a bin: compare real paths.
+if (process.argv[1] && fileURLToPath(import.meta.url) === realpathSync(process.argv[1])) {
   const args = process.argv.slice(2)
   const write = args.includes('--write')
   if (!write && !args.includes('--check')) {