@meddleware/token-deployer-ui 0.0.10 → 0.0.12

package/.env.example

@@ -1,72 +0,0 @@
-# Copy to .env (or set in the Cloudflare Pages dashboard) before deploying.
-# All are optional; sensible public defaults are used when unset.
-#
-# Canonical domain: sui-token-deployer.meddleware.co.uk (k8s SPA, primary)
-# GitHub Pages mirror: meddleware.github.io/vault/token-deployer-ui/
-
-# Operator fee (MIST) split from the user's gas coin into your treasury.
-# Default 1 SUI (1000000000 MIST) — trivial, ~7.5x under competitor pricing.
-VITE_FEE_MIST=1000000000
-
-# Operator treasury addresses per network (REQUIRED for the fee to be collected).
-# The committed operator defaults live in `.env.production` (auto-loaded by
-# `vite build`). A production build FAILS if a selectable network's treasury is
-# still the zero address, so revenue can never silently burn — set both below or
-# in `.env.production`. Set VITE_ALLOW_UNSET_TREASURY=1 to bypass (dev/e2e only).
-VITE_FEE_TREASURY_TESTNET=0xe6b2810abfc5a6f37a375f73e3ba76cfc37584196e453255ad3c9ca2f0ede0ed
-VITE_FEE_TREASURY_MAINNET=0xe6b2810abfc5a6f37a375f73e3ba76cfc37584196e453255ad3c9ca2f0ede0ed
-
-# Optional gRPC fullnode overrides. Set a paid/private endpoint for production to avoid
-# public rate limits. These must be gRPC(-web) endpoints — public fullnodes have deprecated
-# JSON-RPC. The same VITE_RPC_TESTNET is what the real-chain e2e (npm run e2e:testnet)
-# builds against; point E2E_RPC at the same endpoint.
-# VITE_RPC_TESTNET=https://fullnode.testnet.sui.io:443
-# VITE_RPC_MAINNET=https://fullnode.mainnet.sui.io:443
-
-# Optional publish gas budget (MIST).
-# VITE_PUBLISH_GAS_BUDGET=500000000
-
-# --- Walrus icon upload -----------------------------------------------------
-# Operator's own upload relay per network. Set these to a relay YOU run (the
-# stock mysten/walrus-upload-relay container) to collect the native per-upload
-# tip as revenue. Unset → the public Mysten relay is used (uploads still work
-# but tip Mysten, not you). See the relay runbook in README.md / CLAUDE.md.
-# VITE_WALRUS_RELAY_TESTNET=https://sui-walrus-relay-testnet.meddleware.co.uk
-# VITE_WALRUS_RELAY_MAINNET=https://sui-walrus-relay.meddleware.co.uk
-
-# Optional separate gRPC fullnode for the Walrus icon-upload client. Defaults to
-# VITE_RPC_* (also gRPC); set only if Walrus traffic should use a different node.
-# VITE_WALRUS_RPC_TESTNET=https://fullnode.testnet.sui.io:443
-# VITE_WALRUS_RPC_MAINNET=https://fullnode.mainnet.sui.io:443
-
-# Client-side max relay tip (MIST). COUPLING: the Walrus SDK hard-fails an upload
-# if your relay's tip exceeds this, so keep it comfortably ABOVE the relay tip.
-# Default 0.05 SUI. Raising the relay tip past this needs a frontend redeploy.
-# VITE_WALRUS_MAX_TIP_MIST=50000000
-
-# NFT-gated relay access (OPTIONAL). If your operator relay runs behind an
-# `nft-gate` gateway, set these to require holders of the access NFT. When UNSET,
-# the relay behaves exactly as before (no gating). Values come from the
-# access_gate publish (`.env.<network>`: ACCESS_GATE_PACKAGE_ID, ACCESS_GATE_GATE_ID,
-# and ACCESS_NFT_TYPE or SOULBOUND_NFT_TYPE). Set all three (PACKAGE/ID/NFT_TYPE)
-# to enable. Per-network isolation is automatic (the NFT type embeds the package id).
-# VITE_ACCESS_GATE_PACKAGE_TESTNET=0x…
-# VITE_ACCESS_GATE_ID_TESTNET=0x…
-# VITE_ACCESS_GATE_NFT_TYPE_TESTNET=0x…::access_gate::SoulboundAccessNFT
-# VITE_ACCESS_GATE_SOULBOUND_TESTNET=true      # selects consume vs consume_soulbound
-# VITE_ACCESS_GATE_PRICE_MIST_TESTNET=0        # display + purchase price
-# VITE_ACCESS_GATE_PACKAGE_MAINNET=0x…
-# VITE_ACCESS_GATE_ID_MAINNET=0x…
-# VITE_ACCESS_GATE_NFT_TYPE_MAINNET=0x…::access_gate::SoulboundAccessNFT
-# VITE_ACCESS_GATE_SOULBOUND_MAINNET=true
-# VITE_ACCESS_GATE_PRICE_MIST_MAINNET=0
-
-# Icon constraints (UX/cost guard only — the authoritative cap is the edge body
-# limit in front of the relay). Default 100 KiB; PNG/JPEG/WebP/SVG.
-# VITE_ICON_MAX_BYTES=102400
-# VITE_ICON_ALLOWED_TYPES=image/png,image/jpeg,image/webp,image/svg+xml
-
-# Public site origin for canonical/OpenGraph/JSON-LD URLs (index.html). Committed
-# defaults live in .env.production / .env.development; a staging deploy should set
-# this so it never claims the production URL.
-# VITE_PUBLIC_URL=https://sui-token-deployer.meddleware.co.uk

package/.gitattributes

@@ -1 +0,0 @@
-* text=auto eol=lf

package/.github/workflows/docker-publish.yml

@@ -1,348 +0,0 @@
-name: Publish (Docker)
-on:
-  push:
-    tags:
-      - "v*"
-
-env:
-  IMAGE: token-deployer-ui
-
-jobs:
-  verify:
-    name: Verify (type-check + test)
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v7.0.1
-      - uses: actions/setup-node@v7.0.0
-        with:
-          node-version: '24'
-      - name: Install dependencies
-        run: npm ci
-      - name: Audit dependencies
-        run: npm audit --audit-level=high
-      - name: Type-check
-        run: npm run type-check --if-present
-      - name: Unit tests
-        run: npm run test --if-present
-
-  build-docker-amd64-public:
-    name: Docker amd64 (quay.io + Docker Hub)
-    runs-on: ubuntu-latest
-    needs: verify
-    permissions:
-      contents: read
-    steps:
-      - uses: actions/checkout@v7.0.1
-      - uses: docker/setup-buildx-action@v4.3.0
-
-      - name: Log in to quay.io
-        uses: docker/login-action@v4.6.0
-        with:
-          registry: quay.io
-          username: ${{ secrets.QUAY_USERNAME }}
-          password: ${{ secrets.QUAY_TOKEN }}
-
-      - name: Log in to Docker Hub
-        uses: docker/login-action@v4.6.0
-        with:
-          registry: docker.io
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
-
-      - name: Build and push (linux/amd64)
-        uses: docker/build-push-action@v7.3.0
-        with:
-          context: .
-          platforms: linux/amd64
-          push: true
-          tags: |
-            quay.io/${{ vars.QUAY_NAMESPACE }}/${{ env.IMAGE }}:${{ github.sha }}-amd64
-            docker.io/${{ vars.DOCKERHUB_NAMESPACE }}/${{ env.IMAGE }}:${{ github.sha }}-amd64
-          cache-from: type=gha,scope=amd64-public
-          cache-to: type=gha,scope=amd64-public,mode=max
-          build-args: |
-            VITE_NETWORK=${{ vars.VITE_NETWORK || 'testnet' }}
-            VITE_FEE_TREASURY_TESTNET=${{ vars.VITE_FEE_TREASURY_TESTNET }}
-            VITE_FEE_TREASURY_MAINNET=${{ vars.VITE_FEE_TREASURY_MAINNET }}
-            VITE_FEE_MIST=${{ vars.VITE_FEE_MIST }}
-            VITE_WALRUS_RELAY_TESTNET=${{ vars.VITE_WALRUS_RELAY_TESTNET }}
-            VITE_WALRUS_RELAY_MAINNET=${{ vars.VITE_WALRUS_RELAY_MAINNET }}
-            VITE_ACCESS_GATE_ID_TESTNET=${{ vars.VITE_ACCESS_GATE_ID_TESTNET }}
-            VITE_ACCESS_GATE_NFT_TYPE_TESTNET=${{ vars.VITE_ACCESS_GATE_NFT_TYPE_TESTNET }}
-            VITE_ACCESS_GATE_SOULBOUND_TESTNET=${{ vars.VITE_ACCESS_GATE_SOULBOUND_TESTNET }}
-            VITE_ACCESS_GATE_PRICE_MIST_TESTNET=${{ vars.VITE_ACCESS_GATE_PRICE_MIST_TESTNET }}
-            VITE_ACCESS_GATE_ID_MAINNET=${{ vars.VITE_ACCESS_GATE_ID_MAINNET }}
-            VITE_ACCESS_GATE_NFT_TYPE_MAINNET=${{ vars.VITE_ACCESS_GATE_NFT_TYPE_MAINNET }}
-            VITE_ACCESS_GATE_SOULBOUND_MAINNET=${{ vars.VITE_ACCESS_GATE_SOULBOUND_MAINNET }}
-            VITE_ACCESS_GATE_PRICE_MIST_MAINNET=${{ vars.VITE_ACCESS_GATE_PRICE_MIST_MAINNET }}
-            VITE_WALRUS_MAX_TIP_MIST=${{ vars.VITE_WALRUS_MAX_TIP_MIST }}
-            VITE_PUBLIC_URL=${{ vars.VITE_PUBLIC_URL }}
-
-  build-docker-arm64-public:
-    name: Docker arm64 (quay.io + Docker Hub)
-    runs-on: ubuntu-24.04-arm
-    needs: verify
-    permissions:
-      contents: read
-    steps:
-      - uses: actions/checkout@v7.0.1
-      - uses: docker/setup-buildx-action@v4.3.0
-
-      - name: Log in to quay.io
-        uses: docker/login-action@v4.6.0
-        with:
-          registry: quay.io
-          username: ${{ secrets.QUAY_USERNAME }}
-          password: ${{ secrets.QUAY_TOKEN }}
-
-      - name: Log in to Docker Hub
-        uses: docker/login-action@v4.6.0
-        with:
-          registry: docker.io
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
-
-      - name: Build and push (linux/arm64)
-        uses: docker/build-push-action@v7.3.0
-        with:
-          context: .
-          platforms: linux/arm64
-          push: true
-          tags: |
-            quay.io/${{ vars.QUAY_NAMESPACE }}/${{ env.IMAGE }}:${{ github.sha }}-arm64
-            docker.io/${{ vars.DOCKERHUB_NAMESPACE }}/${{ env.IMAGE }}:${{ github.sha }}-arm64
-          cache-from: type=gha,scope=arm64-public
-          cache-to: type=gha,scope=arm64-public,mode=max
-          build-args: |
-            VITE_NETWORK=${{ vars.VITE_NETWORK || 'testnet' }}
-            VITE_FEE_TREASURY_TESTNET=${{ vars.VITE_FEE_TREASURY_TESTNET }}
-            VITE_FEE_TREASURY_MAINNET=${{ vars.VITE_FEE_TREASURY_MAINNET }}
-            VITE_FEE_MIST=${{ vars.VITE_FEE_MIST }}
-            VITE_WALRUS_RELAY_TESTNET=${{ vars.VITE_WALRUS_RELAY_TESTNET }}
-            VITE_WALRUS_RELAY_MAINNET=${{ vars.VITE_WALRUS_RELAY_MAINNET }}
-            VITE_ACCESS_GATE_ID_TESTNET=${{ vars.VITE_ACCESS_GATE_ID_TESTNET }}
-            VITE_ACCESS_GATE_NFT_TYPE_TESTNET=${{ vars.VITE_ACCESS_GATE_NFT_TYPE_TESTNET }}
-            VITE_ACCESS_GATE_SOULBOUND_TESTNET=${{ vars.VITE_ACCESS_GATE_SOULBOUND_TESTNET }}
-            VITE_ACCESS_GATE_PRICE_MIST_TESTNET=${{ vars.VITE_ACCESS_GATE_PRICE_MIST_TESTNET }}
-            VITE_ACCESS_GATE_ID_MAINNET=${{ vars.VITE_ACCESS_GATE_ID_MAINNET }}
-            VITE_ACCESS_GATE_NFT_TYPE_MAINNET=${{ vars.VITE_ACCESS_GATE_NFT_TYPE_MAINNET }}
-            VITE_ACCESS_GATE_SOULBOUND_MAINNET=${{ vars.VITE_ACCESS_GATE_SOULBOUND_MAINNET }}
-            VITE_ACCESS_GATE_PRICE_MIST_MAINNET=${{ vars.VITE_ACCESS_GATE_PRICE_MIST_MAINNET }}
-            VITE_WALRUS_MAX_TIP_MIST=${{ vars.VITE_WALRUS_MAX_TIP_MIST }}
-            VITE_PUBLIC_URL=${{ vars.VITE_PUBLIC_URL }}
-
-  merge-docker-public:
-    name: Merge + sign (quay.io + Docker Hub)
-    needs: [build-docker-amd64-public, build-docker-arm64-public]
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      id-token: write
-      attestations: write
-    steps:
-      - uses: docker/setup-buildx-action@v4.3.0
-
-      - name: Log in to quay.io
-        uses: docker/login-action@v4.6.0
-        with:
-          registry: quay.io
-          username: ${{ secrets.QUAY_USERNAME }}
-          password: ${{ secrets.QUAY_TOKEN }}
-
-      - name: Log in to Docker Hub
-        uses: docker/login-action@v4.6.0
-        with:
-          registry: docker.io
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
-
-      - name: Compute final tags and labels
-        id: meta
-        uses: docker/metadata-action@v6.2.0
-        with:
-          images: |
-            quay.io/${{ vars.QUAY_NAMESPACE }}/${{ env.IMAGE }}
-            docker.io/${{ vars.DOCKERHUB_NAMESPACE }}/${{ env.IMAGE }}
-          tags: |
-            type=semver,pattern={{version}}
-            type=semver,pattern={{major}}.{{minor}}
-          flavor: |
-            latest=auto
-
-      - name: Merge multi-arch manifests
-        id: merge
-        env:
-          QUAY_NS: ${{ vars.QUAY_NAMESPACE }}
-          DOCKERHUB_NS: ${{ vars.DOCKERHUB_NAMESPACE }}
-          SHA: ${{ github.sha }}
-        run: |
-          QUAY_SRC="quay.io/${QUAY_NS}/${IMAGE}:${SHA}"
-          HUB_SRC="docker.io/${DOCKERHUB_NS}/${IMAGE}:${SHA}"
-
-          QUAY_FLAGS=""
-          HUB_FLAGS=""
-          while IFS= read -r tag; do
-            if [[ "$tag" == quay.io/* ]]; then
-              QUAY_FLAGS="$QUAY_FLAGS --tag $tag"
-            elif [[ "$tag" == docker.io/* ]]; then
-              HUB_FLAGS="$HUB_FLAGS --tag $tag"
-            fi
-          done <<< "${{ steps.meta.outputs.tags }}"
-
-          docker buildx imagetools create $QUAY_FLAGS "${QUAY_SRC}-amd64" "${QUAY_SRC}-arm64"
-          docker buildx imagetools create $HUB_FLAGS   "${HUB_SRC}-amd64"  "${HUB_SRC}-arm64"
-
-          PRIMARY=$(echo "${{ steps.meta.outputs.tags }}" | grep 'quay.io' | grep -v 'latest' | head -1)
-          DIGEST=$(docker buildx imagetools inspect "${PRIMARY}" --format '{{.Manifest.Digest}}')
-          echo "digest=${DIGEST}" >> "$GITHUB_OUTPUT"
-
-      - uses: sigstore/cosign-installer@v4.1.2
-
-      - name: Sign images (keyless)
-        env:
-          DIGEST: ${{ steps.merge.outputs.digest }}
-          QUAY_NS: ${{ vars.QUAY_NAMESPACE }}
-          DOCKERHUB_NS: ${{ vars.DOCKERHUB_NAMESPACE }}
-        run: |
-          cosign sign --yes "quay.io/${QUAY_NS}/${IMAGE}@${DIGEST}"
-          cosign sign --yes "docker.io/${DOCKERHUB_NS}/${IMAGE}@${DIGEST}"
-
-      - name: Attest build provenance (quay.io)
-        uses: actions/attest-build-provenance@v4.2.2
-        continue-on-error: true
-        with:
-          subject-name: quay.io/${{ vars.QUAY_NAMESPACE }}/${{ env.IMAGE }}
-          subject-digest: ${{ steps.merge.outputs.digest }}
-          push-to-registry: true
-
-      - name: Attest build provenance (Docker Hub)
-        uses: actions/attest-build-provenance@v4.2.2
-        continue-on-error: true
-        with:
-          subject-name: docker.io/${{ vars.DOCKERHUB_NAMESPACE }}/${{ env.IMAGE }}
-          subject-digest: ${{ steps.merge.outputs.digest }}
-          push-to-registry: true
-
-      - name: Summary
-        run: echo "Published & signed @ ${{ steps.merge.outputs.digest }}" >> "$GITHUB_STEP_SUMMARY"
-
-  # ── Self-hosted registry (best-effort) ─────────────────────────────────────
-
-  build-docker-amd64-private:
-    name: Docker amd64 (self-hosted registry)
-    runs-on: ubuntu-latest
-    needs: verify
-    continue-on-error: true
-    permissions:
-      contents: read
-    steps:
-      - uses: actions/checkout@v7.0.1
-      - uses: docker/setup-buildx-action@v4.3.0
-
-      - name: Log in to self-hosted registry
-        uses: docker/login-action@v4.6.0
-        with:
-          registry: ${{ vars.PRIVATE_REGISTRY }}
-          username: ${{ secrets.PRIVATE_REGISTRY_USERNAME }}
-          password: ${{ secrets.PRIVATE_REGISTRY_TOKEN }}
-
-      - name: Build and push (linux/amd64)
-        uses: docker/build-push-action@v7.3.0
-        with:
-          context: .
-          platforms: linux/amd64
-          push: true
-          tags: ${{ vars.PRIVATE_REGISTRY }}/${{ vars.PRIVATE_NAMESPACE }}/${{ env.IMAGE }}:${{ github.sha }}-amd64
-          cache-from: type=gha,scope=amd64-private
-          cache-to: type=gha,scope=amd64-private,mode=max
-          build-args: |
-            VITE_NETWORK=${{ vars.VITE_NETWORK || 'testnet' }}
-            VITE_FEE_TREASURY_TESTNET=${{ vars.VITE_FEE_TREASURY_TESTNET }}
-            VITE_FEE_TREASURY_MAINNET=${{ vars.VITE_FEE_TREASURY_MAINNET }}
-            VITE_FEE_MIST=${{ vars.VITE_FEE_MIST }}
-            VITE_WALRUS_RELAY_TESTNET=${{ vars.VITE_WALRUS_RELAY_TESTNET }}
-            VITE_ACCESS_GATE_ID_TESTNET=${{ vars.VITE_ACCESS_GATE_ID_TESTNET }}
-            VITE_ACCESS_GATE_NFT_TYPE_TESTNET=${{ vars.VITE_ACCESS_GATE_NFT_TYPE_TESTNET }}
-            VITE_ACCESS_GATE_SOULBOUND_TESTNET=${{ vars.VITE_ACCESS_GATE_SOULBOUND_TESTNET }}
-            VITE_ACCESS_GATE_PRICE_MIST_TESTNET=${{ vars.VITE_ACCESS_GATE_PRICE_MIST_TESTNET }}
-            VITE_WALRUS_MAX_TIP_MIST=${{ vars.VITE_WALRUS_MAX_TIP_MIST }}
-
-  build-docker-arm64-private:
-    name: Docker arm64 (self-hosted registry)
-    runs-on: ubuntu-24.04-arm
-    needs: verify
-    continue-on-error: true
-    permissions:
-      contents: read
-    steps:
-      - uses: actions/checkout@v7.0.1
-      - uses: docker/setup-buildx-action@v4.3.0
-
-      - name: Log in to self-hosted registry
-        uses: docker/login-action@v4.6.0
-        with:
-          registry: ${{ vars.PRIVATE_REGISTRY }}
-          username: ${{ secrets.PRIVATE_REGISTRY_USERNAME }}
-          password: ${{ secrets.PRIVATE_REGISTRY_TOKEN }}
-
-      - name: Build and push (linux/arm64)
-        uses: docker/build-push-action@v7.3.0
-        with:
-          context: .
-          platforms: linux/arm64
-          push: true
-          tags: ${{ vars.PRIVATE_REGISTRY }}/${{ vars.PRIVATE_NAMESPACE }}/${{ env.IMAGE }}:${{ github.sha }}-arm64
-          cache-from: type=gha,scope=arm64-private
-          cache-to: type=gha,scope=arm64-private,mode=max
-          build-args: |
-            VITE_NETWORK=${{ vars.VITE_NETWORK || 'testnet' }}
-            VITE_FEE_TREASURY_TESTNET=${{ vars.VITE_FEE_TREASURY_TESTNET }}
-            VITE_FEE_TREASURY_MAINNET=${{ vars.VITE_FEE_TREASURY_MAINNET }}
-            VITE_FEE_MIST=${{ vars.VITE_FEE_MIST }}
-            VITE_WALRUS_RELAY_TESTNET=${{ vars.VITE_WALRUS_RELAY_TESTNET }}
-            VITE_ACCESS_GATE_ID_TESTNET=${{ vars.VITE_ACCESS_GATE_ID_TESTNET }}
-            VITE_ACCESS_GATE_NFT_TYPE_TESTNET=${{ vars.VITE_ACCESS_GATE_NFT_TYPE_TESTNET }}
-            VITE_ACCESS_GATE_SOULBOUND_TESTNET=${{ vars.VITE_ACCESS_GATE_SOULBOUND_TESTNET }}
-            VITE_ACCESS_GATE_PRICE_MIST_TESTNET=${{ vars.VITE_ACCESS_GATE_PRICE_MIST_TESTNET }}
-            VITE_WALRUS_MAX_TIP_MIST=${{ vars.VITE_WALRUS_MAX_TIP_MIST }}
-
-  merge-docker-private:
-    name: Merge (self-hosted registry)
-    needs: [build-docker-amd64-private, build-docker-arm64-private]
-    runs-on: ubuntu-latest
-    continue-on-error: true
-    permissions:
-      contents: read
-    steps:
-      - uses: docker/setup-buildx-action@v4.3.0
-
-      - name: Log in to self-hosted registry
-        uses: docker/login-action@v4.6.0
-        with:
-          registry: ${{ vars.PRIVATE_REGISTRY }}
-          username: ${{ secrets.PRIVATE_REGISTRY_USERNAME }}
-          password: ${{ secrets.PRIVATE_REGISTRY_TOKEN }}
-
-      - name: Compute tags
-        id: meta
-        uses: docker/metadata-action@v6.2.0
-        with:
-          images: ${{ vars.PRIVATE_REGISTRY }}/${{ vars.PRIVATE_NAMESPACE }}/${{ env.IMAGE }}
-          tags: |
-            type=semver,pattern={{version}}
-            type=semver,pattern={{major}}.{{minor}}
-          flavor: |
-            latest=auto
-
-      - name: Merge multi-arch manifests
-        env:
-          SHA: ${{ github.sha }}
-          REG: ${{ vars.PRIVATE_REGISTRY }}
-          NS: ${{ vars.PRIVATE_NAMESPACE }}
-        run: |
-          SRC="${REG}/${NS}/${IMAGE}:${SHA}"
-          FLAGS=""
-          while IFS= read -r tag; do
-            FLAGS="$FLAGS --tag $tag"
-          done <<< "${{ steps.meta.outputs.tags }}"
-          docker buildx imagetools create $FLAGS "${SRC}-amd64" "${SRC}-arm64"

package/.github/workflows/e2e-realchain.yml

@@ -1,64 +0,0 @@
-# Real-chain deploy e2e for blockchain/sui/apps/token-deployer-ui.
-#
-# MANUAL ONLY (workflow_dispatch). This workflow publishes a REAL token and spends REAL SUI, so
-# it is never triggered on push or pull_request — it must be started by hand and mainnet requires
-# an explicit confirmation input. The automatic gates for the package remain `npm test` (Vitest)
-# and `npm run test:e2e` (Cypress, fully mocked), which should live in a separate always-on CI job.
-#
-# Secrets required (repository or environment secrets):
-#   SUI_PRIV_TESTNET / SUI_PRIV_MAINNET  — bech32 suiprivkey1… for a funded deployer key.
-#   FEE_TREASURY_TESTNET / FEE_TREASURY_MAINNET — operator treasury address (fee recipient).
-#   RPC_TESTNET / RPC_MAINNET (optional) — gRPC endpoint override (defaults to the public fullnodes).
-
-name: token-deployer real-chain e2e
-
-on:
-  workflow_dispatch:
-    inputs:
-      network:
-        description: Target network (mainnet publishes a REAL token and spends REAL SUI)
-        required: true
-        default: testnet
-        type: choice
-        options:
-          - testnet
-          - mainnet
-      confirm_mainnet:
-        description: Type "1" to confirm a mainnet run (ignored for testnet)
-        required: false
-        default: ""
-
-defaults:
-  run:
-    working-directory: blockchain/sui/apps/token-deployer-ui
-
-jobs:
-  deploy-e2e:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 22
-
-      - name: Install dependencies
-        run: npm ci
-
-      - name: Install Playwright Chromium
-        run: npx playwright install --with-deps chromium
-
-      - name: Run real-chain deploy e2e
-        env:
-          # Select the funded key + treasury + RPC for the chosen network.
-          SUI_PRIV: ${{ inputs.network == 'mainnet' && secrets.SUI_PRIV_MAINNET || secrets.SUI_PRIV_TESTNET }}
-          VITE_FEE_TREASURY_TESTNET: ${{ secrets.FEE_TREASURY_TESTNET }}
-          VITE_FEE_TREASURY_MAINNET: ${{ secrets.FEE_TREASURY_MAINNET }}
-          VITE_RPC_TESTNET: ${{ secrets.RPC_TESTNET }}
-          VITE_RPC_MAINNET: ${{ secrets.RPC_MAINNET }}
-          E2E_RPC: ${{ inputs.network == 'mainnet' && secrets.RPC_MAINNET || secrets.RPC_TESTNET }}
-          E2E_FEE_ADDR: ${{ inputs.network == 'mainnet' && secrets.FEE_TREASURY_MAINNET || secrets.FEE_TREASURY_TESTNET }}
-          # Mainnet fail-safe: only proceeds when the operator typed "1".
-          E2E_MAINNET_CONFIRM: ${{ inputs.network == 'mainnet' && inputs.confirm_mainnet || '' }}
-          # CHROME_PATH intentionally unset — the harness falls back to Playwright's bundled Chromium.
-        run: npm run "e2e:${{ inputs.network }}"

package/.github/workflows/node-ci.yml

@@ -1,43 +0,0 @@
-name: Node CI
-
-on:
-  push:
-    branches: [main]
-  pull_request:
-    branches: [main]
-
-jobs:
-  ci:
-    name: Lint, type-check, test, build
-    runs-on: ubuntu-latest
-
-    steps:
-      - uses: actions/checkout@v7.0.1
-
-      - uses: actions/setup-node@v6.5.0
-        with:
-          node-version: '24'
-
-      - name: Install dependencies
-        run: npm ci
-
-      - name: Audit dependencies
-        run: npm audit --audit-level=high
-
-      - name: Type-check
-        run: npm run type-check
-
-      - name: Lint CSS (stylelint)
-        run: npm run lint:css --if-present
-
-      - name: Lint JS (eslint + vuejs-a11y)
-        run: npm run lint:js --if-present
-
-      - name: Lint HTML (html-validate)
-        run: npm run lint:html --if-present
-
-      - name: Unit tests
-        run: npm test
-
-      - name: Build (dev — treasury guard bypassed for CI)
-        run: VITE_ALLOW_UNSET_TREASURY=1 npm run build

package/.github/workflows/npm-publish.yml

@@ -1,83 +0,0 @@
-name: Publish (npm)
-
-# Publishes the app's library entry (@meddleware/token-deployer-ui) to npmjs on a v* tag, so it can be
-# embedded by the dashboard. npm is a SECONDARY output here (the app also ships a
-# container image via docker-publish.yml), so publication is opt-in via the
-# repository variable NPM_PUBLISH and gated on a self-contained `verify` job.
-# Authentication uses npm OIDC trusted publishing — no long-lived NPM_TOKEN.
-
-on:
-  push:
-    tags:
-      - 'v*'
-
-permissions:
-  contents: read
-
-jobs:
-  verify:
-    name: Verify (type-check + test)
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v7.0.1
-      - uses: actions/setup-node@v7.0.0
-        with:
-          node-version: '24'
-      - name: Install dependencies
-        run: npm ci
-      - name: Audit dependencies
-        run: npm audit --audit-level=high
-      - name: Type-check
-        run: npm run type-check --if-present
-      - name: Unit tests
-        run: npm run test --if-present
-
-  publish-npm:
-    name: npmjs (@meddleware/token-deployer-ui)
-    needs: verify
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      id-token: write  # required for OIDC trusted publishing
-    steps:
-      - uses: actions/checkout@v7.0.1
-      - uses: actions/setup-node@v7.0.0
-        with:
-          node-version: '24'
-          registry-url: 'https://registry.npmjs.org'
-      # Trusted publishing (OIDC) requires npm >= 11.5.1; Node 24 ships an older npm.
-      - name: Upgrade npm for trusted publishing
-        run: npm install -g npm@latest
-      - name: Install dependencies
-        run: npm ci
-      # No build step: the npm package ships TypeScript source (exports → ./src),
-      # not the compiled SPA. The treasury-gated `vite build` belongs to
-      # docker-publish.yml, which injects the real treasury via build-args.
-      - name: Publish to npmjs (OIDC, idempotent, opt-in)
-        env:
-          NPM_PUBLISH: ${{ vars.NPM_PUBLISH }}
-        run: |
-          if [ "${NPM_PUBLISH}" != "true" ]; then
-            echo "::warning::npm publishing not configured — set repository variable NPM_PUBLISH=true and configure an npmjs trusted publisher to enable it. Skipping npm publication."
-            exit 0
-          fi
-          VERSION=$(node -p "require('./package.json').version")
-          NAME=$(node -p "require('./package.json').name")
-          ENC=$(printf '%s' "$NAME" | sed 's#/#%2f#')
-          # Check the registry directly — `npm view` can transiently miss a freshly
-          # first-published version and then attempt a re-publish. A 200 means it's live.
-          if [ "$(curl -s -o /dev/null -w '%{http_code}' "https://registry.npmjs.org/${ENC}/${VERSION}")" = "200" ]; then
-            echo "::notice::v${VERSION} already published to npmjs — skipping."
-          else
-            # Publish, but treat a "version already exists" error as success so a
-            # manually-published version (or a registry race) leaves the job green.
-            set +e; OUT=$(npm publish 2>&1); RC=$?; set -e
-            printf '%s\n' "$OUT"
-            if [ "$RC" -ne 0 ]; then
-              if printf '%s' "$OUT" | grep -qiE 'cannot publish over|previously published|EPUBLISHCONFLICT'; then
-                echo "::notice::v${VERSION} already published — treating as success."
-              else
-                exit "$RC"
-              fi
-            fi
-          fi

package/.htmlvalidate.mjs

@@ -1,30 +0,0 @@
-// html-validate over the Vue SFC templates (via html-validate-vue): checks element nesting and
-// content models (e.g. no <p> inside <ul>, no button inside a label) on top of the eslint a11y gate.
-export default {
-  plugins: ['html-validate-vue'],
-  extends: ['html-validate:recommended', 'html-validate-vue:recommended'],
-  elements: [
-    'html5',
-    // @meddleware/ui components that render a single native element, described to the validator so
-    // content models / form rules see through them (keys are lowercased tag names).
-    {
-      uibutton: { inherit: 'button' },
-      uitoolbarbutton: { inherit: 'button' },
-      uiselect: { inherit: 'select' },
-      uinotice: { inherit: 'p' },
-    },
-  ],
-  transform: {
-    '^.*\\.vue$': 'html-validate-vue',
-  },
-  rules: {
-    // Vue components are written in PascalCase (<UiStatusDot>, <KeepAlive>).
-    'element-case': ['error', { style: ['lowercase', 'pascalcase'] }],
-    'element-name': ['error', { pattern: '^(?:[a-z][a-z0-9\\-._]*-[a-z0-9\\-._]*|[A-Z][A-Za-z0-9]*)$' }],
-    // role="list" on styled lists is a deliberate Safari/VoiceOver workaround: WebKit drops list
-    // semantics when list-style is removed, so the explicit role must stay (matches the eslint
-    // vuejs-accessibility/no-redundant-roles override).
-    'no-redundant-role': 'off',
-    'prefer-native-element': ['error', { exclude: ['list'] }],
-  },
-}

package/.oxfmtrc.json

@@ -1,5 +0,0 @@
-{
-  "$schema": "./node_modules/oxfmt/configuration_schema.json",
-  "semi": false,
-  "singleQuote": true
-}

package/.oxlintrc.json

@@ -1,10 +0,0 @@
-{
-  "$schema": "./node_modules/oxlint/configuration_schema.json",
-  "plugins": ["eslint", "unicorn", "oxc", "vue", "vitest"],
-  "env": {
-    "browser": true
-  },
-  "categories": {
-    "correctness": "error"
-  }
-}

package/.vscode/extensions.json

@@ -1,9 +0,0 @@
-{
-  "recommendations": [
-    "Vue.volar",
-    "vitest.explorer",
-    "dbaeumer.vscode-eslint",
-    "EditorConfig.EditorConfig",
-    "oxc.oxc-vscode"
-  ]
-}