@meddleware/token-deployer-ui 0.0.1 → 0.0.2

package/.github/workflows/publish.yml

@@ -0,0 +1,367 @@
+name: Publish
+
+on:
+  push:
+    tags:
+      - "v*"
+
+env:
+  IMAGE: token-deployer-ui
+
+jobs:
+  # ── Library source: @meddleware/token-deployer-ui → npmjs ──────────────────
+  # Uses OIDC trusted publisher — no static NPM_TOKEN secret required.
+  publish-npm:
+    name: npmjs (@meddleware/token-deployer-ui)
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - uses: actions/checkout@v7.0.1
+
+      - uses: actions/setup-node@v7.0.0
+        with:
+          node-version: '24'
+          registry-url: 'https://registry.npmjs.org'
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Type-check
+        run: npm run type-check
+
+      - name: Test
+        run: npm test
+
+      - name: Publish to npmjs (provenance via OIDC, idempotent)
+        run: |
+          VERSION=$(node -p "require('./package.json').version")
+          if npm view "@meddleware/token-deployer-ui@${VERSION}" version >/dev/null 2>&1; then
+            echo "::notice::v${VERSION} already published to npmjs — skipping"
+          else
+            npm publish --provenance
+          fi
+
+  # ── App: Docker image → quay.io + Docker Hub ────────────────────────────────
+  # Split into per-arch native builds + merge so each platform compiles on its
+  # own native runner. The arm64 Vite build runs on ubuntu-24.04-arm rather than
+  # QEMU emulation, eliminating the ~3-5× slowdown for npm install + tsc + vite.
+
+  build-docker-amd64-public:
+    name: Docker amd64 (quay.io + Docker Hub)
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@v7.0.1
+      - uses: docker/setup-buildx-action@v4.3.0
+
+      - name: Log in to quay.io
+        uses: docker/login-action@v4.6.0
+        with:
+          registry: quay.io
+          username: ${{ secrets.QUAY_USERNAME }}
+          password: ${{ secrets.QUAY_TOKEN }}
+
+      - name: Log in to Docker Hub
+        uses: docker/login-action@v4.6.0
+        with:
+          registry: docker.io
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      - name: Build and push (linux/amd64)
+        uses: docker/build-push-action@v7.3.0
+        with:
+          context: .
+          platforms: linux/amd64
+          push: true
+          tags: |
+            quay.io/${{ vars.QUAY_NAMESPACE }}/${{ env.IMAGE }}:${{ github.sha }}-amd64
+            docker.io/${{ vars.DOCKERHUB_NAMESPACE }}/${{ env.IMAGE }}:${{ github.sha }}-amd64
+          cache-from: type=gha,scope=amd64-public
+          cache-to: type=gha,scope=amd64-public,mode=max
+          build-args: |
+            VITE_NETWORK=${{ vars.VITE_NETWORK || 'testnet' }}
+            VITE_FEE_TREASURY_TESTNET=${{ vars.VITE_FEE_TREASURY_TESTNET }}
+            VITE_FEE_TREASURY_MAINNET=${{ vars.VITE_FEE_TREASURY_MAINNET }}
+            VITE_FEE_MIST=${{ vars.VITE_FEE_MIST }}
+            VITE_WALRUS_RELAY_TESTNET=${{ vars.VITE_WALRUS_RELAY_TESTNET }}
+            VITE_WALRUS_RELAY_MAINNET=${{ vars.VITE_WALRUS_RELAY_MAINNET }}
+            VITE_ACCESS_GATE_ID_TESTNET=${{ vars.VITE_ACCESS_GATE_ID_TESTNET }}
+            VITE_ACCESS_GATE_NFT_TYPE_TESTNET=${{ vars.VITE_ACCESS_GATE_NFT_TYPE_TESTNET }}
+            VITE_ACCESS_GATE_SOULBOUND_TESTNET=${{ vars.VITE_ACCESS_GATE_SOULBOUND_TESTNET }}
+            VITE_ACCESS_GATE_PRICE_MIST_TESTNET=${{ vars.VITE_ACCESS_GATE_PRICE_MIST_TESTNET }}
+            VITE_ACCESS_GATE_ID_MAINNET=${{ vars.VITE_ACCESS_GATE_ID_MAINNET }}
+            VITE_ACCESS_GATE_NFT_TYPE_MAINNET=${{ vars.VITE_ACCESS_GATE_NFT_TYPE_MAINNET }}
+            VITE_ACCESS_GATE_SOULBOUND_MAINNET=${{ vars.VITE_ACCESS_GATE_SOULBOUND_MAINNET }}
+            VITE_ACCESS_GATE_PRICE_MIST_MAINNET=${{ vars.VITE_ACCESS_GATE_PRICE_MIST_MAINNET }}
+            VITE_WALRUS_MAX_TIP_MIST=${{ vars.VITE_WALRUS_MAX_TIP_MIST }}
+            VITE_PUBLIC_URL=${{ vars.VITE_PUBLIC_URL }}
+
+  build-docker-arm64-public:
+    name: Docker arm64 (quay.io + Docker Hub)
+    runs-on: ubuntu-24.04-arm
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@v7.0.1
+      - uses: docker/setup-buildx-action@v4.3.0
+
+      - name: Log in to quay.io
+        uses: docker/login-action@v4.6.0
+        with:
+          registry: quay.io
+          username: ${{ secrets.QUAY_USERNAME }}
+          password: ${{ secrets.QUAY_TOKEN }}
+
+      - name: Log in to Docker Hub
+        uses: docker/login-action@v4.6.0
+        with:
+          registry: docker.io
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      - name: Build and push (linux/arm64)
+        uses: docker/build-push-action@v7.3.0
+        with:
+          context: .
+          platforms: linux/arm64
+          push: true
+          tags: |
+            quay.io/${{ vars.QUAY_NAMESPACE }}/${{ env.IMAGE }}:${{ github.sha }}-arm64
+            docker.io/${{ vars.DOCKERHUB_NAMESPACE }}/${{ env.IMAGE }}:${{ github.sha }}-arm64
+          cache-from: type=gha,scope=arm64-public
+          cache-to: type=gha,scope=arm64-public,mode=max
+          build-args: |
+            VITE_NETWORK=${{ vars.VITE_NETWORK || 'testnet' }}
+            VITE_FEE_TREASURY_TESTNET=${{ vars.VITE_FEE_TREASURY_TESTNET }}
+            VITE_FEE_TREASURY_MAINNET=${{ vars.VITE_FEE_TREASURY_MAINNET }}
+            VITE_FEE_MIST=${{ vars.VITE_FEE_MIST }}
+            VITE_WALRUS_RELAY_TESTNET=${{ vars.VITE_WALRUS_RELAY_TESTNET }}
+            VITE_WALRUS_RELAY_MAINNET=${{ vars.VITE_WALRUS_RELAY_MAINNET }}
+            VITE_ACCESS_GATE_ID_TESTNET=${{ vars.VITE_ACCESS_GATE_ID_TESTNET }}
+            VITE_ACCESS_GATE_NFT_TYPE_TESTNET=${{ vars.VITE_ACCESS_GATE_NFT_TYPE_TESTNET }}
+            VITE_ACCESS_GATE_SOULBOUND_TESTNET=${{ vars.VITE_ACCESS_GATE_SOULBOUND_TESTNET }}
+            VITE_ACCESS_GATE_PRICE_MIST_TESTNET=${{ vars.VITE_ACCESS_GATE_PRICE_MIST_TESTNET }}
+            VITE_ACCESS_GATE_ID_MAINNET=${{ vars.VITE_ACCESS_GATE_ID_MAINNET }}
+            VITE_ACCESS_GATE_NFT_TYPE_MAINNET=${{ vars.VITE_ACCESS_GATE_NFT_TYPE_MAINNET }}
+            VITE_ACCESS_GATE_SOULBOUND_MAINNET=${{ vars.VITE_ACCESS_GATE_SOULBOUND_MAINNET }}
+            VITE_ACCESS_GATE_PRICE_MIST_MAINNET=${{ vars.VITE_ACCESS_GATE_PRICE_MIST_MAINNET }}
+            VITE_WALRUS_MAX_TIP_MIST=${{ vars.VITE_WALRUS_MAX_TIP_MIST }}
+            VITE_PUBLIC_URL=${{ vars.VITE_PUBLIC_URL }}
+
+  merge-docker-public:
+    name: Merge + sign (quay.io + Docker Hub)
+    needs: [build-docker-amd64-public, build-docker-arm64-public]
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
+      attestations: write
+    steps:
+      - uses: docker/setup-buildx-action@v4.3.0
+
+      - name: Log in to quay.io
+        uses: docker/login-action@v4.6.0
+        with:
+          registry: quay.io
+          username: ${{ secrets.QUAY_USERNAME }}
+          password: ${{ secrets.QUAY_TOKEN }}
+
+      - name: Log in to Docker Hub
+        uses: docker/login-action@v4.6.0
+        with:
+          registry: docker.io
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      - name: Compute final tags and labels
+        id: meta
+        uses: docker/metadata-action@v6.2.0
+        with:
+          images: |
+            quay.io/${{ vars.QUAY_NAMESPACE }}/${{ env.IMAGE }}
+            docker.io/${{ vars.DOCKERHUB_NAMESPACE }}/${{ env.IMAGE }}
+          tags: |
+            type=semver,pattern={{version}}
+            type=semver,pattern={{major}}.{{minor}}
+          flavor: |
+            latest=auto
+
+      - name: Merge multi-arch manifests
+        id: merge
+        env:
+          QUAY_NS: ${{ vars.QUAY_NAMESPACE }}
+          DOCKERHUB_NS: ${{ vars.DOCKERHUB_NAMESPACE }}
+          SHA: ${{ github.sha }}
+        run: |
+          QUAY_SRC="quay.io/${QUAY_NS}/${IMAGE}:${SHA}"
+          HUB_SRC="docker.io/${DOCKERHUB_NS}/${IMAGE}:${SHA}"
+
+          QUAY_FLAGS=""
+          HUB_FLAGS=""
+          while IFS= read -r tag; do
+            if [[ "$tag" == quay.io/* ]]; then
+              QUAY_FLAGS="$QUAY_FLAGS --tag $tag"
+            elif [[ "$tag" == docker.io/* ]]; then
+              HUB_FLAGS="$HUB_FLAGS --tag $tag"
+            fi
+          done <<< "${{ steps.meta.outputs.tags }}"
+
+          docker buildx imagetools create $QUAY_FLAGS "${QUAY_SRC}-amd64" "${QUAY_SRC}-arm64"
+          docker buildx imagetools create $HUB_FLAGS   "${HUB_SRC}-amd64"  "${HUB_SRC}-arm64"
+
+          PRIMARY=$(echo "${{ steps.meta.outputs.tags }}" | grep 'quay.io' | grep -v 'latest' | head -1)
+          DIGEST=$(docker buildx imagetools inspect "${PRIMARY}" --format '{{.Manifest.Digest}}')
+          echo "digest=${DIGEST}" >> "$GITHUB_OUTPUT"
+
+      - uses: sigstore/cosign-installer@v4.1.2
+
+      - name: Sign images (keyless)
+        env:
+          DIGEST: ${{ steps.merge.outputs.digest }}
+          QUAY_NS: ${{ vars.QUAY_NAMESPACE }}
+          DOCKERHUB_NS: ${{ vars.DOCKERHUB_NAMESPACE }}
+        run: |
+          cosign sign --yes "quay.io/${QUAY_NS}/${IMAGE}@${DIGEST}"
+          cosign sign --yes "docker.io/${DOCKERHUB_NS}/${IMAGE}@${DIGEST}"
+
+      - name: Attest build provenance (quay.io)
+        uses: actions/attest-build-provenance@v4.2.2
+        continue-on-error: true
+        with:
+          subject-name: quay.io/${{ vars.QUAY_NAMESPACE }}/${{ env.IMAGE }}
+          subject-digest: ${{ steps.merge.outputs.digest }}
+          push-to-registry: true
+
+      - name: Attest build provenance (Docker Hub)
+        uses: actions/attest-build-provenance@v4.2.2
+        continue-on-error: true
+        with:
+          subject-name: docker.io/${{ vars.DOCKERHUB_NAMESPACE }}/${{ env.IMAGE }}
+          subject-digest: ${{ steps.merge.outputs.digest }}
+          push-to-registry: true
+
+      - name: Summary
+        run: echo "Published & signed @ ${{ steps.merge.outputs.digest }}" >> "$GITHUB_STEP_SUMMARY"
+
+  # ── Self-hosted registry (best-effort) ─────────────────────────────────────
+
+  build-docker-amd64-private:
+    name: Docker amd64 (self-hosted registry)
+    runs-on: ubuntu-latest
+    continue-on-error: true
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@v7.0.1
+      - uses: docker/setup-buildx-action@v4.3.0
+
+      - name: Log in to self-hosted registry
+        uses: docker/login-action@v4.6.0
+        with:
+          registry: ${{ vars.PRIVATE_REGISTRY }}
+          username: ${{ secrets.PRIVATE_REGISTRY_USERNAME }}
+          password: ${{ secrets.PRIVATE_REGISTRY_TOKEN }}
+
+      - name: Build and push (linux/amd64)
+        uses: docker/build-push-action@v7.3.0
+        with:
+          context: .
+          platforms: linux/amd64
+          push: true
+          tags: ${{ vars.PRIVATE_REGISTRY }}/${{ vars.PRIVATE_NAMESPACE }}/${{ env.IMAGE }}:${{ github.sha }}-amd64
+          cache-from: type=gha,scope=amd64-private
+          cache-to: type=gha,scope=amd64-private,mode=max
+          build-args: |
+            VITE_NETWORK=${{ vars.VITE_NETWORK || 'testnet' }}
+            VITE_FEE_TREASURY_TESTNET=${{ vars.VITE_FEE_TREASURY_TESTNET }}
+            VITE_FEE_TREASURY_MAINNET=${{ vars.VITE_FEE_TREASURY_MAINNET }}
+            VITE_FEE_MIST=${{ vars.VITE_FEE_MIST }}
+            VITE_WALRUS_RELAY_TESTNET=${{ vars.VITE_WALRUS_RELAY_TESTNET }}
+            VITE_ACCESS_GATE_ID_TESTNET=${{ vars.VITE_ACCESS_GATE_ID_TESTNET }}
+            VITE_ACCESS_GATE_NFT_TYPE_TESTNET=${{ vars.VITE_ACCESS_GATE_NFT_TYPE_TESTNET }}
+            VITE_ACCESS_GATE_SOULBOUND_TESTNET=${{ vars.VITE_ACCESS_GATE_SOULBOUND_TESTNET }}
+            VITE_ACCESS_GATE_PRICE_MIST_TESTNET=${{ vars.VITE_ACCESS_GATE_PRICE_MIST_TESTNET }}
+            VITE_WALRUS_MAX_TIP_MIST=${{ vars.VITE_WALRUS_MAX_TIP_MIST }}
+
+  build-docker-arm64-private:
+    name: Docker arm64 (self-hosted registry)
+    runs-on: ubuntu-24.04-arm
+    continue-on-error: true
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@v7.0.1
+      - uses: docker/setup-buildx-action@v4.3.0
+
+      - name: Log in to self-hosted registry
+        uses: docker/login-action@v4.6.0
+        with:
+          registry: ${{ vars.PRIVATE_REGISTRY }}
+          username: ${{ secrets.PRIVATE_REGISTRY_USERNAME }}
+          password: ${{ secrets.PRIVATE_REGISTRY_TOKEN }}
+
+      - name: Build and push (linux/arm64)
+        uses: docker/build-push-action@v7.3.0
+        with:
+          context: .
+          platforms: linux/arm64
+          push: true
+          tags: ${{ vars.PRIVATE_REGISTRY }}/${{ vars.PRIVATE_NAMESPACE }}/${{ env.IMAGE }}:${{ github.sha }}-arm64
+          cache-from: type=gha,scope=arm64-private
+          cache-to: type=gha,scope=arm64-private,mode=max
+          build-args: |
+            VITE_NETWORK=${{ vars.VITE_NETWORK || 'testnet' }}
+            VITE_FEE_TREASURY_TESTNET=${{ vars.VITE_FEE_TREASURY_TESTNET }}
+            VITE_FEE_TREASURY_MAINNET=${{ vars.VITE_FEE_TREASURY_MAINNET }}
+            VITE_FEE_MIST=${{ vars.VITE_FEE_MIST }}
+            VITE_WALRUS_RELAY_TESTNET=${{ vars.VITE_WALRUS_RELAY_TESTNET }}
+            VITE_ACCESS_GATE_ID_TESTNET=${{ vars.VITE_ACCESS_GATE_ID_TESTNET }}
+            VITE_ACCESS_GATE_NFT_TYPE_TESTNET=${{ vars.VITE_ACCESS_GATE_NFT_TYPE_TESTNET }}
+            VITE_ACCESS_GATE_SOULBOUND_TESTNET=${{ vars.VITE_ACCESS_GATE_SOULBOUND_TESTNET }}
+            VITE_ACCESS_GATE_PRICE_MIST_TESTNET=${{ vars.VITE_ACCESS_GATE_PRICE_MIST_TESTNET }}
+            VITE_WALRUS_MAX_TIP_MIST=${{ vars.VITE_WALRUS_MAX_TIP_MIST }}
+
+  merge-docker-private:
+    name: Merge (self-hosted registry)
+    needs: [build-docker-amd64-private, build-docker-arm64-private]
+    runs-on: ubuntu-latest
+    continue-on-error: true
+    permissions:
+      contents: read
+    steps:
+      - uses: docker/setup-buildx-action@v4.3.0
+
+      - name: Log in to self-hosted registry
+        uses: docker/login-action@v4.6.0
+        with:
+          registry: ${{ vars.PRIVATE_REGISTRY }}
+          username: ${{ secrets.PRIVATE_REGISTRY_USERNAME }}
+          password: ${{ secrets.PRIVATE_REGISTRY_TOKEN }}
+
+      - name: Compute tags
+        id: meta
+        uses: docker/metadata-action@v6.2.0
+        with:
+          images: ${{ vars.PRIVATE_REGISTRY }}/${{ vars.PRIVATE_NAMESPACE }}/${{ env.IMAGE }}
+          tags: |
+            type=semver,pattern={{version}}
+            type=semver,pattern={{major}}.{{minor}}
+          flavor: |
+            latest=auto
+
+      - name: Merge multi-arch manifests
+        env:
+          SHA: ${{ github.sha }}
+          REG: ${{ vars.PRIVATE_REGISTRY }}
+          NS: ${{ vars.PRIVATE_NAMESPACE }}
+        run: |
+          SRC="${REG}/${NS}/${IMAGE}:${SHA}"
+          FLAGS=""
+          while IFS= read -r tag; do
+            FLAGS="$FLAGS --tag $tag"
+          done <<< "${{ steps.meta.outputs.tags }}"
+          docker buildx imagetools create $FLAGS "${SRC}-amd64" "${SRC}-arm64"

package/Dockerfile

@@ -0,0 +1,96 @@
+# ── build stage ───────────────────────────────────────────────────────────────
+# Standalone build — the Docker context is this repo root. All @meddleware/*
+# dependencies resolve from the npm registry, so they must be published before
+# this image is built.
+#
+#   docker build \
+#     --build-arg VITE_NETWORK=testnet \
+#     --build-arg VITE_FEE_TREASURY_TESTNET=0x... \
+#     --build-arg VITE_FEE_TREASURY_MAINNET=0x... \
+#     -t token-deployer-ui:<tag> .
+#
+# Build args (VITE_* are baked into the static bundle at build time):
+#   VITE_NETWORK                        — "testnet" | "mainnet"  (default: testnet)
+#   VITE_FEE_TREASURY_TESTNET           — operator treasury for testnet (REQUIRED — build fails without it)
+#   VITE_FEE_TREASURY_MAINNET           — operator treasury for mainnet (REQUIRED — build fails without it)
+#   VITE_FEE_MIST                       — fee in MIST (optional, default 1000000000)
+#   VITE_WALRUS_RELAY_TESTNET           — operator relay URL for testnet (optional)
+#   VITE_WALRUS_RELAY_MAINNET           — operator relay URL for mainnet (optional)
+#   VITE_WALRUS_RPC_TESTNET             — gRPC fullnode for Walrus testnet (optional)
+#   VITE_WALRUS_RPC_MAINNET             — gRPC fullnode for Walrus mainnet (optional)
+#   VITE_RPC_TESTNET / VITE_RPC_MAINNET — override JSON-RPC fullnode URLs (optional)
+#   VITE_ACCESS_GATE_ID_{NET}           — operator's Gate shared object ID (optional)
+#   VITE_ACCESS_GATE_NFT_TYPE_{NET}     — access NFT type (optional)
+#   VITE_ACCESS_GATE_SOULBOUND_{NET}    — "true" if soulbound (optional)
+#   VITE_ACCESS_GATE_PRICE_MIST_{NET}   — purchase price in MIST (optional)
+#   VITE_WALRUS_MAX_TIP_MIST            — max relay tip cap in MIST (optional)
+#   VITE_PUBLIC_URL                     — canonical origin for OG/JSON-LD (optional)
+#
+# .env.production is gitignored — treasury addresses must be supplied via build args.
+FROM node:24-slim AS build
+
+WORKDIR /app
+
+COPY package.json package-lock.json ./
+
+RUN npm ci
+
+COPY . .
+
+ARG VITE_NETWORK=testnet
+ARG VITE_FEE_TREASURY_TESTNET
+ARG VITE_FEE_TREASURY_MAINNET
+ARG VITE_FEE_MIST
+ARG VITE_WALRUS_RELAY_TESTNET
+ARG VITE_WALRUS_RELAY_MAINNET
+ARG VITE_WALRUS_RPC_TESTNET
+ARG VITE_WALRUS_RPC_MAINNET
+ARG VITE_RPC_TESTNET
+ARG VITE_RPC_MAINNET
+ARG VITE_ACCESS_GATE_ID_TESTNET
+ARG VITE_ACCESS_GATE_NFT_TYPE_TESTNET
+ARG VITE_ACCESS_GATE_SOULBOUND_TESTNET
+ARG VITE_ACCESS_GATE_PRICE_MIST_TESTNET
+ARG VITE_ACCESS_GATE_ID_MAINNET
+ARG VITE_ACCESS_GATE_NFT_TYPE_MAINNET
+ARG VITE_ACCESS_GATE_SOULBOUND_MAINNET
+ARG VITE_ACCESS_GATE_PRICE_MIST_MAINNET
+ARG VITE_WALRUS_MAX_TIP_MIST
+ARG VITE_PUBLIC_URL
+
+ENV VITE_NETWORK=${VITE_NETWORK} \
+    VITE_FEE_TREASURY_TESTNET=${VITE_FEE_TREASURY_TESTNET} \
+    VITE_FEE_TREASURY_MAINNET=${VITE_FEE_TREASURY_MAINNET} \
+    VITE_FEE_MIST=${VITE_FEE_MIST} \
+    VITE_WALRUS_RELAY_TESTNET=${VITE_WALRUS_RELAY_TESTNET} \
+    VITE_WALRUS_RELAY_MAINNET=${VITE_WALRUS_RELAY_MAINNET} \
+    VITE_WALRUS_RPC_TESTNET=${VITE_WALRUS_RPC_TESTNET} \
+    VITE_WALRUS_RPC_MAINNET=${VITE_WALRUS_RPC_MAINNET} \
+    VITE_RPC_TESTNET=${VITE_RPC_TESTNET} \
+    VITE_RPC_MAINNET=${VITE_RPC_MAINNET} \
+    VITE_ACCESS_GATE_ID_TESTNET=${VITE_ACCESS_GATE_ID_TESTNET} \
+    VITE_ACCESS_GATE_NFT_TYPE_TESTNET=${VITE_ACCESS_GATE_NFT_TYPE_TESTNET} \
+    VITE_ACCESS_GATE_SOULBOUND_TESTNET=${VITE_ACCESS_GATE_SOULBOUND_TESTNET} \
+    VITE_ACCESS_GATE_PRICE_MIST_TESTNET=${VITE_ACCESS_GATE_PRICE_MIST_TESTNET} \
+    VITE_ACCESS_GATE_ID_MAINNET=${VITE_ACCESS_GATE_ID_MAINNET} \
+    VITE_ACCESS_GATE_NFT_TYPE_MAINNET=${VITE_ACCESS_GATE_NFT_TYPE_MAINNET} \
+    VITE_ACCESS_GATE_SOULBOUND_MAINNET=${VITE_ACCESS_GATE_SOULBOUND_MAINNET} \
+    VITE_ACCESS_GATE_PRICE_MIST_MAINNET=${VITE_ACCESS_GATE_PRICE_MIST_MAINNET} \
+    VITE_WALRUS_MAX_TIP_MIST=${VITE_WALRUS_MAX_TIP_MIST} \
+    VITE_PUBLIC_URL=${VITE_PUBLIC_URL}
+
+RUN npm run build
+
+# ── runtime stage ─────────────────────────────────────────────────────────────
+# static-server is a minimal Go binary image — no shell, no package manager.
+# SPA_FALLBACK serves index.html for any extensionless path (Vue Router history mode).
+# CACHE_IMMUTABLE_PREFIX matches the /assets/ directory Vite emits with content hashes.
+FROM quay.io/meddleware-org/static-server:0.1.1
+
+COPY --from=build /app/dist /app/public
+
+ENV SERVE_DIR=/app/public \
+    SPA_FALLBACK=true \
+    CACHE_IMMUTABLE_PREFIX=/assets/
+
+EXPOSE 8080

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@meddleware/token-deployer-ui",
-  "version": "0.0.1",
+  "version": "0.0.2",
   "type": "module",
   "exports": {
     ".": { "default": "./src/index.ts" }
@@ -31,7 +31,7 @@
   },
   "dependencies": {
     "@meddleware/wallet-adapter": "^0.0.7",
-    "@meddleware/walrus-relay": "^0.1.0",
+    "@meddleware/walrus-relay": "^0.1.16",
     "@mysten/bcs": "~2.1.0",
     "@mysten/move-bytecode-template": "~0.4.0",
     "@mysten/sui": "^2.31.0",
@@ -59,7 +59,7 @@
     "vue-tsc": "~3.3.0"
   },
   "optionalDependencies": {
-    "@meddleware/sui-token-template": "^1.0.0"
+    "@meddleware/sui-token-template": "^1.0.1"
   },
   "engines": {
     "node": "^22.18.0 || >=24.12.0"

package/scripts/sync-template-src.sh

@@ -25,7 +25,7 @@ const files = {
   'Move.toml': read('Move.toml'),
   'source.move': read('sources/sui_token_template.move'),
   'scripts/publish.sh': read('templates/publish.sh'),
-  '.gitignore': read('templates/.gitignore'),
+  '.gitignore': read('templates/gitignore'),
   'README.md': read('templates/README.md'),
   'deployments.md': read('templates/deployments.md'),
   'CLAUDE.md': read('templates/CLAUDE.md'),

package/tests/templateParity.test.ts

@@ -32,7 +32,7 @@ const SOURCE_OF: Record<string, string> = {
   'Move.toml': 'Move.toml',
   'source.move': 'sources/sui_token_template.move',
   'scripts/publish.sh': 'templates/publish.sh',
-  '.gitignore': 'templates/.gitignore',
+  '.gitignore': 'templates/gitignore',
   'README.md': 'templates/README.md',
   'deployments.md': 'templates/deployments.md',
   'CLAUDE.md': 'templates/CLAUDE.md',

package/.env.production

@@ -1,7 +0,0 @@
-# Committed defaults for the standalone SPA production build (auto-loaded by `vite build`).
-# These are public Sui addresses — not secrets — so they are safe to commit.
-# Override at deploy time via Cloudflare Pages environment variables (takes precedence).
-# Local dev: copy .env.example to .env.local and edit there (never commit .env.local).
-
-VITE_FEE_TREASURY_TESTNET=0xe6b2810abfc5a6f37a375f73e3ba76cfc37584196e453255ad3c9ca2f0ede0ed
-VITE_FEE_TREASURY_MAINNET=0xe6b2810abfc5a6f37a375f73e3ba76cfc37584196e453255ad3c9ca2f0ede0ed