@meddleware/token-deployer-ui 0.0.16 → 0.0.18

package/README.md

@@ -1,30 +1,30 @@
 # @meddleware/token-deployer-ui
 
 A browser front-end that lets anyone deploy their own Sui coin — a client-side
-equivalent of `blockchain/sui/sui-token-template`. **Everything runs in the
+equivalent of [`sui-token-template`](https://github.com/meddleware-org/sui-token-template)'s CLI. **Everything runs in the
 browser**: the user's wallet signs and pays gas, and nothing is compiled or
 signed on a server. The user also gets the full, verifiable Move source package,
 and can optionally push it to a new GitHub repo in their own account.
 
 ## How it works
 
-1. Ships one pre-compiled `sui_token_template` Move module whose metadata fields
-   are DISTINCT named constants, so they can be patched
-   ([src/move-template/](src/move-template/)).
+The token logic is [`@meddleware/sui-token-client`](https://github.com/meddleware-org/sui-token-client);
+this app is its UI.
+
+1. The client ships one pre-compiled `sui_token_template` module (generated from the pinned
+   `@meddleware/sui-token-template`) whose metadata fields are distinct named constants.
 2. In the browser, [`@mysten/move-bytecode-template`](https://www.npmjs.com/package/@mysten/move-bytecode-template)
-   deserialises the module; the identifiers + constant pool are patched to the
-   user's values ([src/lib/template.ts](src/lib/template.ts)) and it is re-serialised.
-3. A publish PTB ([src/lib/buildPublishTx.ts](src/lib/buildPublishTx.ts)) publishes
-   the module, applies the UpgradeCap policy, and splits a trivial fee to the
-   operator treasury. A follow-up finalize PTB mints the initial supply and applies
-   the supply/metadata policies when they differ from the defaults.
-4. The same inputs generate a full, downloadable source package
-   ([src/lib/generatePackage.ts](src/lib/generatePackage.ts)) that is **byte-identical**
-   to the CLI generator's output, so the on-chain package is source-verifiable.
-5. Licenses are fetched live from SPDX ([src/lib/licenses.ts](src/lib/licenses.ts)); an
-   optional icon upload goes to Walrus (`@meddleware/walrus-client/flow`, from
-   [src/components/IconPicker.vue](src/components/IconPicker.vue)); and an
-   optional GitHub push uses the user's own token ([src/lib/github.ts](src/lib/github.ts)).
+   decodes it; the identifiers and constant pool are patched to the user's values and it is
+   re-encoded ([src/templateWasm.ts](src/templateWasm.ts) points the patcher at the wasm asset).
+3. A publish PTB publishes the module, applies the UpgradeCap policy and splits a trivial fee to the
+   operator treasury; a finalize PTB registers the currency, mints the initial supply and applies the
+   supply/metadata policies.
+4. The same inputs generate a full, downloadable source package that matches the CLI generator's
+   output, so the on-chain package is source-verifiable.
+5. Licences are fetched live from SPDX ([src/lib/licenses.ts](src/lib/licenses.ts)); an optional
+   icon upload goes to Walrus (`@meddleware/walrus-client/flow`, from
+   [src/components/IconPicker.vue](src/components/IconPicker.vue)); and an optional GitHub push uses
+   the user's own token ([src/lib/github.ts](src/lib/github.ts)).
 
 ## Security & trust model
 
@@ -34,11 +34,9 @@ and can optionally push it to a new GitHub repo in their own account.
 - **No endorsement.** The tool is neutral; it does not vet or endorse created
   tokens or their creators. This is stated in the review, result, and footer UI.
 - **Defence in depth.** User input is validated at the form
-  ([src/lib/validation.ts](src/lib/validation.ts)) *and* re-asserted before it is
-  substituted into Move source / shell scripts
-  ([src/lib/generatePackage.ts](src/lib/generatePackage.ts)) and before it is
-  patched into the bytecode ([src/lib/template.ts](src/lib/template.ts)), so no
-  quote/backslash/control character or reserved Move keyword can ever produce an
+  ([src/lib/validation.ts](src/lib/validation.ts)) *and* re-asserted by the client
+  (`assertTokenConfig`) before it is patched into bytecode or substituted into Move source and
+  shell scripts, so no quote/backslash/control character or reserved Move keyword can produce an
   injectable package.
 - **Fee integrity.** The fee is split from the user's own gas coin to the operator
   treasury inside the publish PTB and cannot be redirected at runtime. A production
@@ -141,26 +139,15 @@ tip, so third-party use is *profitable* as long as the tip keeps margin.
 
 ## Keeping the template in sync (single source of truth)
 
-The shipped bytecode and the downloadable source both derive from
-`@meddleware/sui-token-template` (`optionalDependencies`). After changing that template, re-run:
-
-```bash
-npm run regen:template   # recompiles + refreshes src/move-template/*
-npm run sync:template    # refreshes src/template-src/files.json
-npm run verify:template  # bytecode round-trip + provenance/parity tests
-```
-
-Two tests enforce this invariant in CI so it can never silently drift:
-
-- [tests/templateParity.test.ts](tests/templateParity.test.ts) — `files.json`
-  matches the canonical template sources verbatim.
-- [tests/templateArtifact.test.ts](tests/templateArtifact.test.ts) — the shipped
-  `.mv` still contains the identifiers/constants the patcher expects.
+The bytecode and the downloadable source both come from `@meddleware/sui-token-client`, which
+generates them from the exact `@meddleware/sui-token-template` it pins and checks them in CI. After a
+template change: release the template, bump it in the client (`npm run gen:template`), release the
+client, then bump the client here.
 
 ## Verification scripts
 
-- `scripts/publish-localnet.mjs` — patch → publish → finalize against a local Sui node
-  (node, no browser).
+- `npm run e2e:localnet` in `@meddleware/sui-token-client` — patch → publish → finalize against a
+  local Sui node (node, no browser).
 - `scripts/e2e-deploy.mjs` — the **network-parametrized real-chain deploy e2e** (headless
   browser + injected wallet): drives the full UI, does a REAL publish, waits for real
   confirmation, checks the result panel, downloads the source zip, and verifies coin type +

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@meddleware/token-deployer-ui",
-  "version": "0.0.16",
+  "version": "0.0.18",
   "type": "module",
   "license": "0BSD",
   "repository": {
@@ -42,24 +42,20 @@
     "lint": "npm run lint:css && npm run lint:js && npm run lint:html",
     "format": "oxfmt src/",
     "docs": "typedoc",
-    "regen:template": "bash scripts/regen-template.sh",
-    "sync:template": "bash scripts/sync-template-src.sh",
     "gen:og-image": "node scripts/gen-og-image.mjs",
-    "verify:template": "node scripts/verify-bytecode.mjs && vitest run tests/templateArtifact.test.ts tests/templateParity.test.ts",
     "lint:css": "stylelint \"src/**/*.{css,vue}\"",
     "lint:js": "eslint .",
     "lint:html": "html-validate \"src/**/*.vue\""
   },
   "dependencies": {
     "@meddleware/design-tokens": "^0.1.7",
+    "@meddleware/sui-token-client": "^0.0.1",
     "@meddleware/ui": "^0.1.28",
-    "@meddleware/walrus-client": "^0.0.21",
+    "@meddleware/walrus-client": "^0.0.22",
     "@meddleware/walrus-relay": "^0.1.22",
-    "@mysten/bcs": "~2.1.2",
     "@mysten/move-bytecode-template": "~0.4.1",
     "@mysten/sui": "^2.33.1",
     "@mysten/walrus": "~1.2.32",
-    "fflate": "^0.8.3",
     "vue": "^3.5.0"
   },
   "peerDependencies": {
@@ -99,9 +95,6 @@
     "vue-eslint-parser": "^10.4.1",
     "vue-tsc": "~3.3.0"
   },
-  "optionalDependencies": {
-    "@meddleware/sui-token-template": "^1.0.5"
-  },
   "engines": {
     "node": "^22.18.0 || >=24.12.0"
   },

package/src/components/ConfigForm.vue

@@ -3,7 +3,7 @@ import { computed, reactive } from 'vue'
 import type { FormModel } from '../lib/form.js'
 import type { FormErrors } from '../lib/validation.js'
 import { deriveStructName } from '../lib/validation.js'
-import type { Network } from '../lib/types.js'
+import type { TokenNetwork as Network } from '@meddleware/sui-token-client'
 import LicensePicker from './LicensePicker.vue'
 import IconPicker from './IconPicker.vue'
 import { UiFormField, UiSelect, UiFieldHint } from '@meddleware/ui'

package/src/components/DeployProgress.vue

@@ -1,5 +1,5 @@
 <script lang="ts">
-import type { DeployStep } from '../lib/deploy.js'
+import type { DeployStep } from '@meddleware/sui-token-client/deploy'
 
 const ORDER: { key: DeployStep; label: string }[] = [
   { key: 'patching', label: 'Preparing the module' },

package/src/components/GithubPush.vue

@@ -1,8 +1,8 @@
 <script setup lang="ts">
 import { ref } from 'vue'
-import type { PublishResult, TokenConfig } from '../lib/types.js'
+import type { PublishResult, TokenConfig } from '@meddleware/sui-token-client'
 import { UiNotice, safeHref } from '@meddleware/ui'
-import { buildPackageFiles } from '../lib/generatePackage.js'
+import { buildPackageFiles } from '@meddleware/sui-token-client/package'
 import { fetchLicenseText } from '../lib/licenses.js'
 import { createRepoAndPush } from '../lib/github.js'
 

package/src/components/IconPicker.vue

@@ -2,7 +2,7 @@
 import { ref, computed, onMounted, watch } from 'vue'
 import { useWallet } from '@meddleware/wallet-adapter'
 import { buildDeployExecutor } from '../lib/deployExecutor.js'
-import { getReadClient } from '../lib/readClient.js'
+import { getReadClient } from '../wallet.js'
 import { useWalrusRelay } from '../composables/useWalrusRelay.js'
 import { useAccessGate } from '@meddleware/walrus-relay'
 // The flow subpath carries no wasm; it loads the Walrus client lazily when an upload starts.
@@ -10,7 +10,7 @@ import { consumeStorageKey, createGatedAccess, runBlobUpload } from '@meddleware
 import { ICON_EPOCHS } from '../lib/walrus-constants.js'
 import { ACCESS_GATE, ICON_MAX_BYTES, WALRUS_MAX_TIP_MIST, WALRUS_RPC_URLS, validateIconFile } from '../config.js'
 import type { WalrusNetwork } from '../config.js'
-import type { Network } from '../lib/types.js'
+import type { TokenNetwork as Network } from '@meddleware/sui-token-client'
 import { UiNotice, UiFieldHint, UiSegmentedControl } from '@meddleware/ui'
 import WalrusBlobBrowser from './WalrusBlobBrowser.vue'
 import walrusWasmUrl from '@mysten/walrus-wasm/web/walrus_wasm_bg.wasm?url'

package/src/components/MyTokens.vue

@@ -9,8 +9,9 @@ import {
   suiExplorerUrl,
   type SuiNetwork,
 } from '@meddleware/ui'
-import { listMyTokens, type DeployedToken } from '../lib/listMyTokens.js'
-import type { Network } from '../lib/types.js'
+import { listMyTokens, type DeployedToken } from '@meddleware/sui-token-client'
+import { getReadClient } from '../wallet.js'
+import type { TokenNetwork as Network } from '@meddleware/sui-token-client'
 
 const props = defineProps<{ owner: string | null; network: Network }>()
 
@@ -18,9 +19,6 @@ const props = defineProps<{ owner: string | null; network: Network }>()
 const explorerNetwork = computed<SuiNetwork | null>(() =>
   props.network === 'localnet' ? null : props.network,
 )
-function objectHref(id: string): string | null {
-  return explorerNetwork.value ? suiExplorerUrl('object', id, explorerNetwork.value) : null
-}
 
 const tokens = ref<DeployedToken[]>([])
 const loading = ref(false)
@@ -34,7 +32,7 @@ async function load(): Promise<void> {
   loading.value = true
   error.value = null
   try {
-    tokens.value = await listMyTokens(props.owner, props.network)
+    tokens.value = await listMyTokens(getReadClient(props.network), props.owner)
   } catch (e) {
     error.value = e instanceof Error ? e.message : String(e)
     tokens.value = []
@@ -64,8 +62,8 @@ defineExpose({ reload: load })
           <dd>
             <CopyableAddress :address="t.packageId" label="Copy package id">
               <ExplorerLink
-                v-if="objectHref(t.packageId)"
-                :href="objectHref(t.packageId)!"
+                v-if="explorerNetwork"
+                :href="suiExplorerUrl('object', t.packageId, explorerNetwork)"
                 :value="t.packageId"
               />
             </CopyableAddress>
@@ -74,8 +72,8 @@ defineExpose({ reload: load })
           <dd>
             <CopyableAddress :address="t.treasuryCapId" label="Copy treasury cap id">
               <ExplorerLink
-                v-if="objectHref(t.treasuryCapId)"
-                :href="objectHref(t.treasuryCapId)!"
+                v-if="explorerNetwork"
+                :href="suiExplorerUrl('object', t.treasuryCapId, explorerNetwork)"
                 :value="t.treasuryCapId"
               />
             </CopyableAddress>

package/src/components/ResultPanel.vue

@@ -1,8 +1,8 @@
 <script setup lang="ts">
 import { computed, ref } from 'vue'
-import type { PublishResult, TokenConfig } from '../lib/types.js'
+import type { PublishResult, TokenConfig } from '@meddleware/sui-token-client'
 import { explorerObjectUrl } from '../config.js'
-import { generatePackageZip } from '../lib/generatePackage.js'
+import { generatePackageZip } from '@meddleware/sui-token-client/package'
 import { fetchLicenseText } from '../lib/licenses.js'
 import GithubPush from './GithubPush.vue'
 import { UiNotice, safeHref } from '@meddleware/ui'

package/src/components/ReviewPanel.vue

@@ -1,5 +1,5 @@
 <script setup lang="ts">
-import type { TokenConfig, Network } from '../lib/types.js'
+import type { TokenConfig, TokenNetwork as Network } from '@meddleware/sui-token-client'
 import { FEE_MIST, FEE_TREASURY, isFeeConfigured } from '../config.js'
 import { UiNotice } from '@meddleware/ui'
 

package/src/components/TokenDeployerView.vue

@@ -19,12 +19,12 @@ import {
 import { emptyForm, toTokenConfig } from '../lib/form.js'
 import { validateForm } from '../lib/validation.js'
 import type { FormErrors } from '../lib/validation.js'
-import { deployToken } from '../lib/deploy.js'
-import type { DeployStep } from '../lib/deploy.js'
+import { deployToken } from '@meddleware/sui-token-client/deploy'
+import type { DeployStep } from '@meddleware/sui-token-client/deploy'
 import { buildDeployExecutor } from '../lib/deployExecutor.js'
 import { FEE_MIST, FEE_TREASURY, PUBLISH_GAS_BUDGET, isFeeConfigured } from '../config.js'
 import { extractErrorMessage } from '../lib/errors.js'
-import type { Network, PublishResult } from '../lib/types.js'
+import type { TokenNetwork as Network, PublishResult } from '@meddleware/sui-token-client'
 
 type Step = 'identity' | 'token' | 'settings' | 'review' | 'deploying' | 'done'
 

package/src/components/WalletBar.vue

@@ -2,7 +2,7 @@
 import { computed, ref, watch } from 'vue'
 import { useWallet, useNetwork } from '@meddleware/wallet-adapter'
 import { SELECTABLE_NETWORKS } from '../config.js'
-import type { Network } from '../lib/types.js'
+import type { TokenNetwork as Network } from '@meddleware/sui-token-client'
 
 /** Wallet-supplied icons are untrusted: render only inline images or https URLs. */
 function safeIcon(icon: string | undefined): string | undefined {

package/src/components/WalrusBlobBrowser.vue

@@ -1,11 +1,11 @@
 <script setup lang="ts">
 import { ref, watch } from 'vue'
 import { useWallet } from '@meddleware/wallet-adapter'
-import { getReadClient } from '../lib/readClient.js'
+import { getReadClient } from '../wallet.js'
 import type { OwnedBlob } from '@meddleware/walrus-client'
 import { WALRUS_RPC_URLS, type WalrusNetwork } from '../config.js'
-import type { Network } from '../lib/types.js'
-import { UiNotice } from '@meddleware/ui'
+import type { TokenNetwork as Network } from '@meddleware/sui-token-client'
+import { UiNotice, safeHref } from '@meddleware/ui'
 
 const props = defineProps<{ network: WalrusNetwork; connected: boolean }>()
 const emit = defineEmits<{ (e: 'select', url: string): void }>()
@@ -104,7 +104,7 @@ function selectBlob(item: BlobItem): void {
           @click="selectBlob(b)"
         >
           <img
-            :src="b.url"
+            :src="safeHref(b.url)"
             :alt="`Blob ${b.blobId.slice(0, 8)}…`"
             loading="lazy"
             @error="(e) => (e.target as HTMLElement).parentElement?.classList.add('no-img')"

package/src/config.ts

@@ -1,7 +1,7 @@
 // Deployment-wide configuration. Operator values (fee + treasury) are read from
 // Vite env vars so they can be set at build/deploy time without code changes.
 // See .env.example.
-import type { Network } from './lib/types.js'
+import type { TokenNetwork as Network } from '@meddleware/sui-token-client'
 import { relayGateConfig, type RelayGateConfig } from '@meddleware/walrus-relay'
 
 const env = (import.meta as unknown as { env?: Record<string, string | undefined> }).env ?? {}

package/src/index.ts

@@ -1,2 +1,4 @@
 import './component-styles.css'
+// The embedded component deploys too: point the template patcher at the wasm asset.
+import './templateWasm.js'
 export { default as TokenDeployerView } from './components/TokenDeployerView.vue'

package/src/lib/deployExecutor.ts

@@ -5,10 +5,9 @@
 
 import { buildExecutor } from '@meddleware/wallet-adapter'
 import type { Transaction } from '@mysten/sui/transactions'
-import { toSuiTxResult } from './deploy.js'
-import type { SuiTxResult, Executor } from './deploy.js'
-import type { Network } from './types.js'
-import { getReadClient } from './readClient.js'
+import { toSuiTxResult, type Executor, type SuiTxResult } from '@meddleware/sui-token-client/deploy'
+import type { TokenNetwork as Network } from '@meddleware/sui-token-client'
+import { getReadClient } from '../wallet.js'
 import { RPC_URLS } from '../config.js'
 
 /**

package/src/lib/form.ts

@@ -1,7 +1,7 @@
 // The reactive form model (all text inputs are strings) and its conversion into
 // the strongly-typed TokenConfig used by the deploy + generate pipelines.
 
-import type { MetadataPolicy, PackagePolicy, SupplyPolicy, TokenConfig } from './types.js'
+import type { MetadataPolicy, PackagePolicy, SupplyPolicy, TokenConfig } from '@meddleware/sui-token-client'
 import { deriveStructName, parseSupply } from './validation.js'
 import { DEFAULT_LICENSE_ID } from './licenses.js'
 

package/src/lib/validation.ts

@@ -1,103 +1,22 @@
-// Pure form validation. Kept separate from Vue so it is unit-testable and can be
-// reused by the review step. Rules protect both the on-chain publish and the
-// validity of the generated Move source.
+// The form layer: turns the token rules from @meddleware/sui-token-client into per-field messages for
+// the UI. The rules themselves (identifiers, safe text, icon schemes, decimals, supply bounds) live
+// in the client, which also enforces them with assertTokenConfig before any deploy or generation.
+
+import {
+  MAX_U64,
+  SAFE_TEXT,
+  TOKEN_LIMITS,
+  hasAllowedIconScheme,
+  isValidDecimals,
+  parseSupply,
+  validateIdentifier,
+  type TokenConfig,
+} from '@meddleware/sui-token-client'
+
+export { deriveStructName, parseSupply } from '@meddleware/sui-token-client'
 
-import type { TokenConfig } from './types.js'
-
-/** Max supply Sui `coin::mint` accepts (u64). */
-export const MAX_U64 = 18_446_744_073_709_551_615n
-
-/** Sui OTW rule: the witness struct is the module name, uppercased. */
-export function deriveStructName(moduleName: string): string {
-  return moduleName.toUpperCase()
-}
-
-/** Move identifier shape: lowercase start, then lowercase/digits/underscores. */
-export const MOVE_IDENT = /^[a-z][a-z0-9_]*$/
-/**
- * Printable ASCII excluding the double-quote and backslash, so values embed
- * safely inside a Move `b"..."` byte-string literal in the downloadable source.
- */
-export const SAFE_TEXT = /^[\x20-\x21\x23-\x5b\x5d-\x7e]*$/
 const SUI_ADDRESS = /^0x[0-9a-fA-F]{64}$/
 
-/** Upper bound on package/module identifiers — bounds bytecode/const-pool size. */
-export const MAX_IDENT_LEN = 64
-
-/**
- * Schemes permitted for the on-chain `icon_url` metadata. `https:` covers a Walrus
- * aggregator URL and any hosted image; `ipfs:` covers decentralised pins. This is a
- * defence-in-depth **content** guard layered *on top of* downstream wallet/explorer URL
- * sanitisation (not a replacement for it): it stops `javascript:`, `data:`, and insecure
- * `http:` from ever being baked into the generated coin metadata, while renderers remain
- * responsible for their own sanitisation. Empty (no icon) is allowed by the caller.
- */
-export const ICON_URL_ALLOWED_SCHEMES = ['https://', 'ipfs://'] as const
-
-/** True if `url` begins with an allowed icon scheme (case-insensitive). */
-export function hasAllowedIconScheme(url: string): boolean {
-  const u = url.trim().toLowerCase()
-  return ICON_URL_ALLOWED_SCHEMES.some((s) => u.startsWith(s))
-}
-
-/**
- * Move reserved words. A package or module named after one of these compiles
- * incorrectly or fails, so they are rejected up front. Lowercase-compared, which
- * also covers the derived (uppercased) OTW struct name.
- */
-export const MOVE_RESERVED_WORDS: ReadonlySet<string> = new Set([
-  'abort',
-  'acquires',
-  'as',
-  'break',
-  'const',
-  'continue',
-  'copy',
-  'else',
-  'entry',
-  'enum',
-  'false',
-  'for',
-  'friend',
-  'fun',
-  'has',
-  'if',
-  'in',
-  'invariant',
-  'let',
-  'loop',
-  'macro',
-  'match',
-  'module',
-  'move',
-  'mut',
-  'native',
-  'package',
-  'phantom',
-  'public',
-  'return',
-  'script',
-  'spec',
-  'struct',
-  'true',
-  'type',
-  'use',
-  'while',
-  'key',
-  'store',
-  'drop',
-])
-
-/** Validate one Move identifier field; returns an error message or null. */
-export function validateIdentifier(value: string): string | null {
-  if (!value) return 'Required'
-  if (value.length > MAX_IDENT_LEN) return `${MAX_IDENT_LEN} characters maximum`
-  if (!/^[a-z]/.test(value)) return 'Must start with a lowercase letter'
-  if (!MOVE_IDENT.test(value)) return 'Lowercase letters, digits and underscores only'
-  if (MOVE_RESERVED_WORDS.has(value)) return `"${value}" is a reserved keyword`
-  return null
-}
-
 export type FormErrors = Partial<Record<keyof TokenConfig, string>>
 
 export interface ValidatableForm {
@@ -112,7 +31,14 @@ export interface ValidatableForm {
   recipient: string
 }
 
-/** Validate the user-entered fields. Returns a map of field -> message. */
+function textError(value: string, max: number, required: boolean): string | undefined {
+  if (required && !value.trim()) return 'Required'
+  if (value.length > max) return `Maximum ${max} characters`
+  if (!SAFE_TEXT.test(value)) return 'Double quotes and backslashes are not supported'
+  return undefined
+}
+
+/** Validate the user-entered fields. Returns a map of field → message. */
 export function validateForm(form: ValidatableForm): FormErrors {
   const errors: FormErrors = {}
 
@@ -121,39 +47,28 @@ export function validateForm(form: ValidatableForm): FormErrors {
   const moduleNameError = validateIdentifier(form.moduleName)
   if (moduleNameError) errors.moduleName = moduleNameError
 
-  if (!form.symbol.trim()) errors.symbol = 'Required'
-  else if (form.symbol.length > 32) errors.symbol = 'Maximum 32 characters'
-  else if (!SAFE_TEXT.test(form.symbol))
-    errors.symbol = 'Double quotes and backslashes are not supported'
-
-  if (!form.name.trim()) errors.name = 'Required'
-  else if (form.name.length > 64) errors.name = 'Maximum 64 characters'
-  else if (!SAFE_TEXT.test(form.name))
-    errors.name = 'Double quotes and backslashes are not supported'
-
-  if (form.description.length > 256) errors.description = 'Maximum 256 characters'
-  else if (!SAFE_TEXT.test(form.description))
-    errors.description = 'Double quotes and backslashes are not supported'
-
+  const symbol = textError(form.symbol, TOKEN_LIMITS.symbol, true)
+  if (symbol) errors.symbol = symbol
+  const name = textError(form.name, TOKEN_LIMITS.name, true)
+  if (name) errors.name = name
+  const description = textError(form.description, TOKEN_LIMITS.description, false)
+  if (description) errors.description = description
   if (form.iconUrl) {
-    if (form.iconUrl.length > 512) errors.iconUrl = 'Maximum 512 characters'
-    else if (!SAFE_TEXT.test(form.iconUrl))
-      errors.iconUrl = 'Double quotes and backslashes are not supported'
+    const icon = textError(form.iconUrl, TOKEN_LIMITS.iconUrl, false)
+    if (icon) errors.iconUrl = icon
     else if (!hasAllowedIconScheme(form.iconUrl)) errors.iconUrl = 'Use an https:// or ipfs:// URL'
   }
 
   const decimals = Number(form.decimals)
   if (!Number.isInteger(decimals)) errors.decimals = 'Enter a whole number'
-  else if (decimals < 0) errors.decimals = 'Must be 0 or greater'
-  else if (decimals > 18) errors.decimals = 'Maximum is 18 (9 is typical on Sui)'
+  else if (decimals < TOKEN_LIMITS.decimals.min) errors.decimals = `Must be ${TOKEN_LIMITS.decimals.min} or greater`
+  else if (decimals > TOKEN_LIMITS.decimals.max) errors.decimals = `Maximum is ${TOKEN_LIMITS.decimals.max} (9 is typical on Sui)`
 
   const supply = parseSupply(form.initialSupply)
   if (supply === null) {
     errors.initialSupply = 'Enter a whole number, or leave blank for none'
-  } else if (Number.isInteger(decimals) && decimals >= 0 && decimals <= 18) {
-    if (supply * 10n ** BigInt(decimals) > MAX_U64) {
-      errors.initialSupply = 'Supply exceeds the maximum for this decimal precision'
-    }
+  } else if (isValidDecimals(decimals) && supply * 10n ** BigInt(decimals) > MAX_U64) {
+    errors.initialSupply = 'Supply exceeds the maximum for this decimal precision'
   }
 
   if (form.recipient && !SUI_ADDRESS.test(form.recipient)) {
@@ -163,14 +78,6 @@ export function validateForm(form: ValidatableForm): FormErrors {
   return errors
 }
 
-/** Parse the supply text into a non-negative bigint, or null if invalid. */
-export function parseSupply(input: string): bigint | null {
-  const s = input.trim()
-  if (s === '') return 0n
-  if (!/^\d+$/.test(s)) return null
-  return BigInt(s)
-}
-
 export function isValid(errors: FormErrors): boolean {
   return Object.keys(errors).length === 0
 }

package/src/main.ts

@@ -5,10 +5,10 @@ import { createApp } from 'vue'
 import App from './App.vue'
 import './styles.css'
 import './component-styles.css'
-import { configureWasm } from './lib/template.js'
-// Static: readClient is already in the main chunk (IconPicker, WalrusBlobBrowser and listMyTokens
+import './templateWasm.js'
+// Static: the read client is already in the main chunk (IconPicker, WalrusBlobBrowser and MyTokens
 // import it), so a dynamic import in the E2E block below could not split it out anyway.
-import { setReadClient } from './lib/readClient.js'
+import { setReadClient } from './wallet.js'
 import type { SuiGrpcClient } from '@mysten/sui/grpc'
 import { useColorMode, useSeason } from '@meddleware/ui'
 
@@ -19,13 +19,6 @@ useColorMode('system')
 // Enable seasonal theming (sets data-season on <html>; seasons.css is imported above).
 useSeason()
 
-// Vite serves the wasm as an asset URL; wasm-bindgen's init loads it on demand.
-import wasmUrl from '@mysten/move-bytecode-template/web/move_bytecode_template_bg.wasm?url'
-
-// Register the URL only; the 343 kB wasm is fetched lazily at first deploy so it
-// doesn't block initial page load.
-configureWasm(wasmUrl)
-
 // E2E-only: stub the Sui client, register a mock wallet and expose getSuiClient for headless tests.
 // Wrapped in async IIFE to ensure wallet is registered BEFORE app mounts (timing critical).
 // Only the `e2e` build mode may set VITE_E2E (vite.config.ts refuses otherwise); both are static,

package/src/templateWasm.ts

@@ -0,0 +1,8 @@
+// Point @meddleware/sui-token-client's template patcher at the bytecode wasm as a Vite asset URL.
+// Imported by both entries (the standalone app's main.ts and the library entry the dashboard
+// embeds), so a deploy works wherever the component runs. The ~343 kB wasm is fetched only at the
+// first deploy.
+import wasmUrl from '@mysten/move-bytecode-template/web/move_bytecode_template_bg.wasm?url'
+import { configureTemplateWasm } from '@meddleware/sui-token-client/template'
+
+configureTemplateWasm(wasmUrl)

package/src/wallet.ts

@@ -0,0 +1,19 @@
+// The app's Sui read client per network: the wallet-adapter's shared, memoised gRPC client for the
+// configured RPC URL (public fullnodes have dropped JSON-RPC). E2E builds replace it with a stub via
+// `setReadClient`, because gRPC-web responses are binary and cannot be faked at the fetch layer.
+import type { SuiGrpcClient } from '@mysten/sui/grpc'
+import { getSuiClient } from '@meddleware/wallet-adapter'
+import type { TokenNetwork } from '@meddleware/sui-token-client'
+import { RPC_URLS } from './config.js'
+
+const overrides = new Map<TokenNetwork, SuiGrpcClient>()
+
+/** The read client for `network` (an E2E stub when one is set). */
+export function getReadClient(network: TokenNetwork): SuiGrpcClient {
+  return overrides.get(network) ?? getSuiClient(network, RPC_URLS[network])
+}
+
+/** Replace the client for `network` (E2E builds only). */
+export function setReadClient(network: TokenNetwork, client: SuiGrpcClient): void {
+  overrides.set(network, client)
+}