@meddleware/frontend-config 0.0.6 → 0.0.7

package/CHANGELOG.md

@@ -5,6 +5,12 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.0.7] - 2026-11-07
+
+### Fixed
+
+- `mw-network-status` failed on a real install: the client packages ship TypeScript source, which Node does not load from `node_modules`. It now reads each package's generated `deployments.ts` as text.
+
 ## [0.0.6] - 2026-11-07
 
 ### Fixed

package/README.md

@@ -23,7 +23,7 @@ same accessibility and browser-support bar.
 | `/tsconfig/vue-app.json` | The compiler options of a Vue app (`"extends": "@meddleware/frontend-config/tsconfig/vue-app.json"`); the repository keeps only its `include`. |
 | `/csp` | `buildCsp(options)`, `cspForProfile(name, current?)`, `PROFILES`, `scriptHashesOf(csp)` — the Content-Security-Policy every app image serves, as six named profiles (`static`, `static-strict`, `console`, `chain`, `chain-wasm`, `docs`), so the policy is written once. |
 | `mw-sync` | `mw-sync --check` / `--write` in a repository root: the files every frontend repository copies (dependabot.yml, .dockerignore, postcss/stylelint configs, the Lighthouse allowlist) equal this package's `templates/`, and the Dockerfile's `ARG CSP` equals its profile. Declared in package.json: `"meddleware": { "kind": "app", "csp": "chain-wasm", "lhci": true }`. |
-| `mw-network-status` | `mw-network-status --out src/network.json` (or `--check src/network.json` in CI): which networks MeddleWare is deployed on, from the installed clients' deployment records through `networkAvailability` (`@meddleware/web-utils`). The file is committed and CI checks it, so "mainnet is coming" turns into "live" by the records alone. |
+| `mw-network-status` | `mw-network-status --out src/network.json` (or `--check src/network.json` in CI): which networks MeddleWare is deployed on, from the installed clients' deployment records (read as text: the clients ship TypeScript source). The file is committed and CI checks it, so "mainnet is coming" turns into "live" by the records alone. |
 | `mw-audit-gate` | CI dependency gate: `npm audit` at high/critical minus the dated, reasoned entries of `.github/audit-allowlist.json` (an entry with no reason or an expired date fails). |
 | `mw-third-party-licenses` | Writes `dist/THIRD_PARTY_LICENSES` from the lockfile's production packages and their installed licence texts; `--check` fails when none can be written. |
 | `mw-check-csp-inline` | `mw-check-csp-inline <policy or @Dockerfile> [dist]`: every inline script in the built pages is allowed by a `sha256` source in the policy, and the policy never allows `'unsafe-inline'` scripts. |

package/dist/network-status.d.ts

@@ -1,8 +1,29 @@
 #!/usr/bin/env node
 /**
- * @param {{ networkAvailability: Function }} utils
- * @param {Record<string, Record<string, unknown>>} records product name → its deployments object
+ * The network keys of `export const <constant> = { … }` in generated source: the keys at the object's top level (two-space indent).
+ * @param {string} source
+ * @param {string} constant
+ * @returns {string[]}
  */
-export function networkStatus(utils: {
-    networkAvailability: Function;
-}, records: Record<string, Record<string, unknown>>): any;
+export function networksOf(source: string, constant: string): string[];
+/**
+ * Which networks are live: `live` when every product has a record there, `partial` when some do, `coming` when none does. (The same rule as
+ * `networkAvailability` in `@meddleware/web-utils`, which the dashboard uses at run time.)
+ * @param {Record<string, string[]>} products product name → the networks it has a record for
+ */
+export function availability(products: Record<string, string[]>): {
+    testnet: {
+        status: string;
+        live: string[];
+        missing: string[];
+    };
+    mainnet: {
+        status: string;
+        live: string[];
+        missing: string[];
+    };
+};
+/** @param {string} root */
+export function readRecords(root: string): Record<string, string[]>;
+/** The products and the constant that holds each one's records. */
+export const PRODUCTS: readonly [readonly ["access gate", "@meddleware/access-gate-client", "ACCESS_GATE_DEPLOYMENTS"], readonly ["sealed storage", "@meddleware/sealed-storage-client", "SEAL_POLICIES_DEPLOYMENTS"]];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@meddleware/frontend-config",
-  "version": "0.0.6",
+  "version": "0.0.7",
   "type": "module",
   "description": "Shared frontend tooling for MeddleWare apps: browser support, ESLint, Stylelint, html-validate, PostCSS, Playwright, axe, screenshots, Lighthouse and the Vite target.",
   "license": "0BSD",

package/src/network-status.js

@@ -3,44 +3,78 @@
 // mw-network-status — write which networks MeddleWare is deployed on, from the deployment records of the installed client packages, so a static
 // site (landing page, docs, developer docs) says "mainnet is coming" until the records have a `mainnet` key and says "live" the moment they do.
 //
-//   mw-network-status [--out src/network.json]     (default: print to stdout)
-//   mw-network-status --check src/network.json     fail (exit 1) when the committed file differs from the records
+//   mw-network-status --out src/network.json      write the file
+//   mw-network-status --check src/network.json    fail (exit 1) when the committed file differs from the records
+//   mw-network-status                             print to stdout
 //
 // The file is committed, so the page and its tests never depend on a hidden build step; CI runs `--check`, and bumping a client package
-// (Dependabot, or a release that adds a mainnet record) fails the check until the file is regenerated with `--out`. The repository needs `@meddleware/web-utils` and the two clients
-// (`@meddleware/access-gate-client`, `@meddleware/sealed-storage-client`) installed; it fails when one is missing rather than guess.
+// (Dependabot, or a release that adds a mainnet record) fails the check until the file is regenerated with `--out`.
+//
+// The client packages ship TypeScript source, which Node does not load from node_modules, so the records are read as text: each package's
+// generated `deployments.ts` has the shape `export const X_DEPLOYMENTS = { testnet: {…}, mainnet: {…} } as const`, and only the network keys
+// are needed. The repository needs `@meddleware/access-gate-client` and `@meddleware/sealed-storage-client` installed; a missing one is an error.
 import { readFileSync, realpathSync, writeFileSync } from 'node:fs'
 import { createRequire } from 'node:module'
-import { join } from 'node:path'
+import { dirname, join } from 'node:path'
 import { pathToFileURL } from 'node:url'
 
-/** @param {string} name */
-async function load(name) {
-  const require = createRequire(join(process.cwd(), 'noop.js'))
-  return import(pathToFileURL(require.resolve(name)).href)
+/** The products and the constant that holds each one's records. */
+export const PRODUCTS = /** @type {const} */ ([
+  ['access gate', '@meddleware/access-gate-client', 'ACCESS_GATE_DEPLOYMENTS'],
+  ['sealed storage', '@meddleware/sealed-storage-client', 'SEAL_POLICIES_DEPLOYMENTS'],
+])
+
+/**
+ * The network keys of `export const <constant> = { … }` in generated source: the keys at the object's top level (two-space indent).
+ * @param {string} source
+ * @param {string} constant
+ * @returns {string[]}
+ */
+export function networksOf(source, constant) {
+  const start = source.indexOf(`export const ${constant} =`)
+  if (start < 0) throw new Error(`${constant} not found`)
+  const open = source.indexOf('{', start)
+  const end = source.indexOf('\n} as const', open)
+  if (open < 0 || end < 0) throw new Error(`${constant} has an unexpected shape`)
+  return [...source.slice(open, end).matchAll(/^ {2}([a-z]+): \{/gm)].map((m) => /** @type {string} */ (m[1]))
 }
 
 /**
- * @param {{ networkAvailability: Function }} utils
- * @param {Record<string, Record<string, unknown>>} records product name → its deployments object
+ * Which networks are live: `live` when every product has a record there, `partial` when some do, `coming` when none does. (The same rule as
+ * `networkAvailability` in `@meddleware/web-utils`, which the dashboard uses at run time.)
+ * @param {Record<string, string[]>} products product name → the networks it has a record for
  */
-export function networkStatus(utils, records) {
-  return utils.networkAvailability(Object.fromEntries(Object.entries(records).map(([name, deployments]) => [name, Object.keys(deployments)])))
+export function availability(products) {
+  const names = Object.keys(products)
+  /** @param {string} network */
+  const report = (network) => {
+    const live = names.filter((p) => products[p]?.includes(network))
+    const missing = names.filter((p) => !products[p]?.includes(network))
+    return { status: names.length > 0 && missing.length === 0 ? 'live' : live.length > 0 ? 'partial' : 'coming', live, missing }
+  }
+  return { testnet: report('testnet'), mainnet: report('mainnet') }
+}
+
+/** @param {string} root */
+export function readRecords(root) {
+  const require = createRequire(join(root, 'noop.js'))
+  /** @type {Record<string, string[]>} */
+  const out = {}
+  for (const [name, pkg, constant] of PRODUCTS) {
+    const entry = require.resolve(pkg)
+    out[name] = networksOf(readFileSync(join(dirname(entry), 'deployments.ts'), 'utf8'), constant)
+  }
+  return out
 }
 
 // `process.argv[1]` is the symlink in node_modules/.bin when run as a bin: compare real paths.
 if (process.argv[1] && import.meta.url === pathToFileURL(realpathSync(process.argv[1])).href) {
   const args = process.argv.slice(2)
-  const outIndex = args.indexOf('--out')
-  const out = outIndex >= 0 ? args[outIndex + 1] : undefined
-  const checkIndex = args.indexOf('--check')
-  const check = checkIndex >= 0 ? args[checkIndex + 1] : undefined
+  const value = (/** @type {string} */ flag) => (args.includes(flag) ? args[args.indexOf(flag) + 1] : undefined)
+  const out = value('--out')
+  const check = value('--check')
   try {
-    const utils = await load('@meddleware/web-utils')
-    const gate = await load('@meddleware/access-gate-client')
-    const sealed = await load('@meddleware/sealed-storage-client')
-    const status = networkStatus(utils, { 'access gate': gate.ACCESS_GATE_DEPLOYMENTS, 'sealed storage': sealed.SEAL_POLICIES_DEPLOYMENTS })
-    const json = JSON.stringify(status, null, 2) + '\n'
+    const json = JSON.stringify(availability(readRecords(process.cwd())), null, 2) + '\n'
     if (check) {
       let have = ''
       try {