@meddleware/token-deployer-ui 0.0.8 → 0.0.10

package/.env.example

@@ -16,12 +16,11 @@ VITE_FEE_MIST=1000000000
 VITE_FEE_TREASURY_TESTNET=0xe6b2810abfc5a6f37a375f73e3ba76cfc37584196e453255ad3c9ca2f0ede0ed
 VITE_FEE_TREASURY_MAINNET=0xe6b2810abfc5a6f37a375f73e3ba76cfc37584196e453255ad3c9ca2f0ede0ed
 
-# Optional RPC overrides. Set a paid/private endpoint for production to avoid public
-# rate limits. NOTE: the official testnet fullnode (fullnode.testnet.sui.io) is gRPC-only
-# and 404s for JSON-RPC — use a JSON-RPC-capable endpoint for testnet (the app defaults to
-# https://sui-testnet-rpc.publicnode.com). The same VITE_RPC_TESTNET is what the real-chain
-# e2e (npm run e2e:testnet) builds against; point E2E_RPC at the same endpoint.
-# VITE_RPC_TESTNET=https://sui-testnet-rpc.publicnode.com
+# Optional gRPC fullnode overrides. Set a paid/private endpoint for production to avoid
+# public rate limits. These must be gRPC(-web) endpoints — public fullnodes have deprecated
+# JSON-RPC. The same VITE_RPC_TESTNET is what the real-chain e2e (npm run e2e:testnet)
+# builds against; point E2E_RPC at the same endpoint.
+# VITE_RPC_TESTNET=https://fullnode.testnet.sui.io:443
 # VITE_RPC_MAINNET=https://fullnode.mainnet.sui.io:443
 
 # Optional publish gas budget (MIST).
@@ -35,10 +34,8 @@ VITE_FEE_TREASURY_MAINNET=0xe6b2810abfc5a6f37a375f73e3ba76cfc37584196e453255ad3c
 # VITE_WALRUS_RELAY_TESTNET=https://sui-walrus-relay-testnet.meddleware.co.uk
 # VITE_WALRUS_RELAY_MAINNET=https://sui-walrus-relay.meddleware.co.uk
 
-# gRPC fullnode for the Walrus icon-upload client (a SuiGrpcClient). This is a
-# *gRPC* endpoint and is SEPARATE from VITE_RPC_* (the JSON-RPC deploy endpoints) —
-# the two protocols are not interchangeable. Defaults to the public gRPC fullnodes
-# (rate-limited); set your own for production to avoid limits.
+# Optional separate gRPC fullnode for the Walrus icon-upload client. Defaults to
+# VITE_RPC_* (also gRPC); set only if Walrus traffic should use a different node.
 # VITE_WALRUS_RPC_TESTNET=https://fullnode.testnet.sui.io:443
 # VITE_WALRUS_RPC_MAINNET=https://fullnode.mainnet.sui.io:443
 
@@ -72,4 +69,4 @@ VITE_FEE_TREASURY_MAINNET=0xe6b2810abfc5a6f37a375f73e3ba76cfc37584196e453255ad3c
 # Public site origin for canonical/OpenGraph/JSON-LD URLs (index.html). Committed
 # defaults live in .env.production / .env.development; a staging deploy should set
 # this so it never claims the production URL.
-# VITE_PUBLIC_URL=https://tokens.meddleware.co.uk
+# VITE_PUBLIC_URL=https://sui-token-deployer.meddleware.co.uk

package/.github/workflows/e2e-realchain.yml

@@ -8,7 +8,7 @@
 # Secrets required (repository or environment secrets):
 #   SUI_PRIV_TESTNET / SUI_PRIV_MAINNET  — bech32 suiprivkey1… for a funded deployer key.
 #   FEE_TREASURY_TESTNET / FEE_TREASURY_MAINNET — operator treasury address (fee recipient).
-#   RPC_TESTNET / RPC_MAINNET (optional) — JSON-RPC endpoint override (public testnet is gRPC-only).
+#   RPC_TESTNET / RPC_MAINNET (optional) — gRPC endpoint override (defaults to the public fullnodes).
 
 name: token-deployer real-chain e2e
 

package/.github/workflows/node-ci.yml

@@ -27,6 +27,15 @@ jobs:
       - name: Type-check
         run: npm run type-check
 
+      - name: Lint CSS (stylelint)
+        run: npm run lint:css --if-present
+
+      - name: Lint JS (eslint + vuejs-a11y)
+        run: npm run lint:js --if-present
+
+      - name: Lint HTML (html-validate)
+        run: npm run lint:html --if-present
+
       - name: Unit tests
         run: npm test
 

package/.github/workflows/npm-publish.yml

@@ -62,8 +62,22 @@ jobs:
             exit 0
           fi
           VERSION=$(node -p "require('./package.json').version")
-          if npm view "@meddleware/token-deployer-ui@${VERSION}" version >/dev/null 2>&1; then
+          NAME=$(node -p "require('./package.json').name")
+          ENC=$(printf '%s' "$NAME" | sed 's#/#%2f#')
+          # Check the registry directly — `npm view` can transiently miss a freshly
+          # first-published version and then attempt a re-publish. A 200 means it's live.
+          if [ "$(curl -s -o /dev/null -w '%{http_code}' "https://registry.npmjs.org/${ENC}/${VERSION}")" = "200" ]; then
             echo "::notice::v${VERSION} already published to npmjs — skipping."
           else
-            npm publish
+            # Publish, but treat a "version already exists" error as success so a
+            # manually-published version (or a registry race) leaves the job green.
+            set +e; OUT=$(npm publish 2>&1); RC=$?; set -e
+            printf '%s\n' "$OUT"
+            if [ "$RC" -ne 0 ]; then
+              if printf '%s' "$OUT" | grep -qiE 'cannot publish over|previously published|EPUBLISHCONFLICT'; then
+                echo "::notice::v${VERSION} already published — treating as success."
+              else
+                exit "$RC"
+              fi
+            fi
           fi

package/.htmlvalidate.mjs

@@ -0,0 +1,30 @@
+// html-validate over the Vue SFC templates (via html-validate-vue): checks element nesting and
+// content models (e.g. no <p> inside <ul>, no button inside a label) on top of the eslint a11y gate.
+export default {
+  plugins: ['html-validate-vue'],
+  extends: ['html-validate:recommended', 'html-validate-vue:recommended'],
+  elements: [
+    'html5',
+    // @meddleware/ui components that render a single native element, described to the validator so
+    // content models / form rules see through them (keys are lowercased tag names).
+    {
+      uibutton: { inherit: 'button' },
+      uitoolbarbutton: { inherit: 'button' },
+      uiselect: { inherit: 'select' },
+      uinotice: { inherit: 'p' },
+    },
+  ],
+  transform: {
+    '^.*\\.vue$': 'html-validate-vue',
+  },
+  rules: {
+    // Vue components are written in PascalCase (<UiStatusDot>, <KeepAlive>).
+    'element-case': ['error', { style: ['lowercase', 'pascalcase'] }],
+    'element-name': ['error', { pattern: '^(?:[a-z][a-z0-9\\-._]*-[a-z0-9\\-._]*|[A-Z][A-Za-z0-9]*)$' }],
+    // role="list" on styled lists is a deliberate Safari/VoiceOver workaround: WebKit drops list
+    // semantics when list-style is removed, so the explicit role must stay (matches the eslint
+    // vuejs-accessibility/no-redundant-roles override).
+    'no-redundant-role': 'off',
+    'prefer-native-element': ['error', { exclude: ['list'] }],
+  },
+}

package/CLAUDE.md

@@ -27,11 +27,18 @@ The pattern mirrors `@meddleware/walrus-ui`, `@meddleware/seal-ui`, and
 must **not** render its own wallet bar, header, or footer when embedded.
 
 **Deploy executor note:** The wallet-adapter `Executor` only returns `{ digest }` — insufficient
-for the deploy flow, which requires `objectChanges` to extract the packageId, coin type,
-TreasuryCap, and MetadataCap. `src/lib/deployExecutor.ts` uses the wallet-adapter singleton for
-wallet connection state, but builds its own `SuiJsonRpcClient` (`@mysten/sui/jsonRpc`) to execute
-with `showEffects + showObjectChanges`. This is intentional — do not replace it with the
-wallet-adapter `buildExecutor`.
+for the deploy flow, which requires the created objects to extract the packageId, coin type,
+TreasuryCap, MetadataCap and the Currency ref. `src/lib/deployExecutor.ts` uses the wallet-adapter
+singleton for wallet connection state, but executes through the app's own `SuiGrpcClient`
+(`getReadClient`) with `include: { effects, objectTypes }`, and `toSuiTxResult` (`src/lib/deploy.ts`)
+maps `effects.changedObjects` onto the `objectChanges` shape `extractPublishResult` reads. This is
+intentional — do not replace it with the wallet-adapter `buildExecutor`.
+
+**gRPC only.** Public fullnodes have deprecated JSON-RPC; every chain call (app and `scripts/`)
+goes through `SuiGrpcClient`, and `VITE_RPC_*` / `E2E_RPC` must be gRPC(-web) endpoints. Do not
+reintroduce `@mysten/sui/jsonRpc`. gRPC may render framework addresses in long form
+(`0x000…02::coin::…`) — match types tolerantly. E2E builds (`VITE_E2E=1`) inject a stub client via
+`setReadClient` because gRPC-web responses cannot be faked at the `fetch` layer.
 
 ## Architecture (the money/parity paths matter most)
 
@@ -49,7 +56,7 @@ wallet-adapter `buildExecutor`.
 - **Orchestration** — [src/lib/deploy.ts](src/lib/deploy.ts) sequences patch →
   publish → wait → (finalize) via an injectable `Executor` (so it is unit-testable;
   the real one is built from the wallet in
-  [src/composables/useWallet.ts](src/composables/useWallet.ts)).
+  [src/lib/deployExecutor.ts](src/lib/deployExecutor.ts)).
 - **Package generation** — [src/lib/generatePackage.ts](src/lib/generatePackage.ts)
   substitutes the same inputs into the canonical template text
   ([src/template-src/files.json](src/template-src/files.json)) and zips it.
@@ -105,7 +112,7 @@ the relay source `crates/walrus-upload-relay`.)
 - **NFT / usage-ticket per-wallet gating is IMPLEMENTED (2026-08-05)** via the standalone
   `nft-gate` project: an `nft-gate` gateway fronts the operator relay and admits only
   holders of an `access_gate` NFT. The app gates the operator-relay option on ownership
-  (`useAccessGate` → `getOwnedObjects`), offers a permissionless purchase CTA, and attaches
+  (`useAccessGate` → `listOwnedObjects`), offers a permissionless purchase CTA, and attaches
   a wallet-signed access proof (`sui:signPersonalMessage` → `uploadRelayAuthToken`) when the
   operator relay is used. Unset `VITE_ACCESS_GATE_*` → no gating (unchanged behaviour). The
   tip and the NFT are **independent levers** (tip = per-upload cost; NFT = access/abuse).

package/Dockerfile

@@ -18,7 +18,7 @@
 #   VITE_WALRUS_RELAY_MAINNET           — operator relay URL for mainnet (optional)
 #   VITE_WALRUS_RPC_TESTNET             — gRPC fullnode for Walrus testnet (optional)
 #   VITE_WALRUS_RPC_MAINNET             — gRPC fullnode for Walrus mainnet (optional)
-#   VITE_RPC_TESTNET / VITE_RPC_MAINNET — override JSON-RPC fullnode URLs (optional)
+#   VITE_RPC_TESTNET / VITE_RPC_MAINNET — override gRPC fullnode URLs (optional)
 #   VITE_ACCESS_GATE_ID_{NET}           — operator's Gate shared object ID (optional)
 #   VITE_ACCESS_GATE_NFT_TYPE_{NET}     — access NFT type (optional)
 #   VITE_ACCESS_GATE_SOULBOUND_{NET}    — "true" if soulbound (optional)

package/LICENSE

@@ -1,121 +1,14 @@
-Creative Commons Legal Code
+BSD Zero Clause License
 
-CC0 1.0 Universal
+Copyright (c) 2026 MeddleWare
 
-    CREATIVE COMMONS CORPORATION IS NOT A LAW FIRM AND DOES NOT PROVIDE
-    LEGAL SERVICES. DISTRIBUTION OF THIS DOCUMENT DOES NOT CREATE AN
-    ATTORNEY-CLIENT RELATIONSHIP. CREATIVE COMMONS PROVIDES THIS
-    INFORMATION ON AN "AS-IS" BASIS. CREATIVE COMMONS MAKES NO WARRANTIES
-    REGARDING THE USE OF THIS DOCUMENT OR THE INFORMATION OR WORKS
-    PROVIDED HEREUNDER, AND DISCLAIMS LIABILITY FOR DAMAGES RESULTING FROM
-    THE USE OF THIS DOCUMENT OR THE INFORMATION OR WORKS PROVIDED
-    HEREUNDER.
+Permission to use, copy, modify, and/or distribute this software for any
+purpose with or without fee is hereby granted.
 
-Statement of Purpose
-
-The laws of most jurisdictions throughout the world automatically confer
-exclusive Copyright and Related Rights (defined below) upon the creator
-and subsequent owner(s) (each and all, an "owner") of an original work of
-authorship and/or a database (each, a "Work").
-
-Certain owners wish to permanently relinquish those rights to a Work for
-the purpose of contributing to a commons of creative, cultural and
-scientific works ("Commons") that the public can reliably and without fear
-of later claims of infringement build upon, modify, incorporate in other
-works, reuse and redistribute as freely as possible in any form whatsoever
-and for any purposes, including without limitation commercial purposes.
-These owners may contribute to the Commons to promote the ideal of a free
-culture and the further production of creative, cultural and scientific
-works, or to gain reputation or greater distribution for their Work in
-part through the use and efforts of others.
-
-For these and/or other purposes and motivations, and without any
-expectation of additional consideration or compensation, the person
-associating CC0 with a Work (the "Affirmer"), to the extent that he or she
-is an owner of Copyright and Related Rights in the Work, voluntarily
-elects to apply CC0 to the Work and publicly distribute the Work under its
-terms, with knowledge of his or her Copyright and Related Rights in the
-Work and the meaning and intended legal effect of CC0 on those rights.
-
-1. Copyright and Related Rights. A Work made available under CC0 may be
-protected by copyright and related or neighboring rights ("Copyright and
-Related Rights"). Copyright and Related Rights include, but are not
-limited to, the following:
-
-  i. the right to reproduce, adapt, distribute, perform, display,
-     communicate, and translate a Work;
- ii. moral rights retained by the original author(s) and/or performer(s);
-iii. publicity and privacy rights pertaining to a person's image or
-     likeness depicted in a Work;
- iv. rights protecting against unfair competition in regards to a Work,
-     subject to the limitations in paragraph 4(a), below;
-  v. rights protecting the extraction, dissemination, use and reuse of data
-     in a Work;
- vi. database rights (such as those arising under Directive 96/9/EC of the
-     European Parliament and of the Council of 11 March 1996 on the legal
-     protection of databases, and under any national implementation
-     thereof, including any amended or successor version of such
-     directive); and
-vii. other similar, equivalent or corresponding rights throughout the
-     world based on applicable law or treaty, and any national
-     implementations thereof.
-
-2. Waiver. To the greatest extent permitted by, but not in contravention
-of, applicable law, Affirmer hereby overtly, fully, permanently,
-irrevocably and unconditionally waives, abandons, and surrenders all of
-Affirmer's Copyright and Related Rights and associated claims and causes
-of action, whether now known or unknown (including existing as well as
-future claims and causes of action), in the Work (i) in all territories
-worldwide, (ii) for the maximum duration provided by applicable law or
-treaty (including future time extensions), (iii) in any current or future
-medium and for any number of copies, and (iv) for any purpose whatsoever,
-including without limitation commercial, advertising or promotional
-purposes (the "Waiver"). Affirmer makes the Waiver for the benefit of each
-member of the public at large and to the detriment of Affirmer's heirs and
-successors, fully intending that such Waiver shall not be subject to
-revocation, rescission, cancellation, termination, or any other legal or
-equitable action to disrupt the quiet enjoyment of the Work by the public
-as contemplated by Affirmer's express Statement of Purpose.
-
-3. Public License Fallback. Should any part of the Waiver for any reason
-be judged legally invalid or ineffective under applicable law, then the
-Waiver shall be preserved to the maximum extent permitted taking into
-account Affirmer's express Statement of Purpose. In addition, to the
-extent the Waiver is so judged Affirmer hereby grants to each affected
-person a royalty-free, non transferable, non sublicensable, non exclusive,
-irrevocable and unconditional license to exercise Affirmer's Copyright and
-Related Rights in the Work (i) in all territories worldwide, (ii) for the
-maximum duration provided by applicable law or treaty (including future
-time extensions), (iii) in any current or future medium and for any number
-of copies, and (iv) for any purpose whatsoever, including without
-limitation commercial, advertising or promotional purposes (the
-"License"). The License shall be deemed effective as of the date CC0 was
-applied by Affirmer to the Work. Should any part of the License for any
-reason be judged legally invalid or ineffective under applicable law, such
-partial invalidity or ineffectiveness shall not invalidate the remainder
-of the License, and in such case Affirmer hereby affirms that he or she
-will not (i) exercise any of his or her remaining Copyright and Related
-Rights in the Work or (ii) assert any associated claims and causes of
-action with respect to the Work, in either case contrary to Affirmer's
-express Statement of Purpose.
-
-4. Limitations and Disclaimers.
-
- a. No trademark or patent rights held by Affirmer are waived, abandoned,
-    surrendered, licensed or otherwise affected by this document.
- b. Affirmer offers the Work as-is and makes no representations or
-    warranties of any kind concerning the Work, express, implied,
-    statutory or otherwise, including without limitation warranties of
-    title, merchantability, fitness for a particular purpose, non
-    infringement, or the absence of latent or other defects, accuracy, or
-    the present or absence of errors, whether or not discoverable, all to
-    the greatest extent permissible under applicable law.
- c. Affirmer disclaims responsibility for clearing rights of other persons
-    that may apply to the Work or any use thereof, including without
-    limitation any person's Copyright and Related Rights in the Work.
-    Further, Affirmer disclaims responsibility for obtaining any necessary
-    consents, permissions or other rights required for any use of the
-    Work.
- d. Affirmer understands and acknowledges that Creative Commons is not a
-    party to this document and has no duty or obligation with respect to
-    this CC0 or use of the Work.
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+PERFORMANCE OF THIS SOFTWARE.

package/README.md

@@ -68,9 +68,9 @@ host dashboard. See [.env.example](.env.example) for the full list.
 | --- | --- | --- |
 | `VITE_FEE_TREASURY_TESTNET` / `_MAINNET` | Operator treasury that receives the fee. **A production build fails if either is the zero address** (bypass with `VITE_ALLOW_UNSET_TREASURY=1`). | committed operator address |
 | `VITE_FEE_MIST` | Flat fee split from the user's gas coin. | `1000000000` (1 SUI) |
-| `VITE_RPC_TESTNET` / `_MAINNET` | JSON-RPC endpoint (set a paid RPC for production). | public endpoints |
+| `VITE_RPC_TESTNET` / `_MAINNET` | gRPC fullnode endpoint (set a paid RPC for production). JSON-RPC-only endpoints do not work. | public fullnodes |
 | `VITE_PUBLISH_GAS_BUDGET` | Publish gas budget (MIST). | `500000000` |
-| `VITE_PUBLIC_URL` | Site origin for canonical/OG/JSON-LD URLs. | `https://tokens.meddleware.co.uk` |
+| `VITE_PUBLIC_URL` | Site origin (no trailing slash) for the canonical URL and Open Graph tags in `index.html`. | `https://sui-token-deployer.meddleware.co.uk` (`.env.production`) |
 | `VITE_WALRUS_RELAY_TESTNET` / `_MAINNET` | Your own upload relay (to collect the tip). Unset → public Mysten relay (earns nothing). | public relay |
 | `VITE_WALRUS_MAX_TIP_MIST` | Client-side max relay tip. **Must exceed your relay's tip** or uploads fail. | `50000000` (0.05 SUI) |
 | `VITE_ICON_MAX_BYTES` / `VITE_ICON_ALLOWED_TYPES` | Client icon size/type gate (UX only). | `102400` / PNG,JPEG,WebP,SVG |
@@ -192,7 +192,7 @@ testnet mode with the RPC pointed at the local node).
 | `SUI_PRIV` | bech32 `suiprivkey1…` for a **funded** deployer key. Export the CLI key: `sui keytool export --key-identity <addr>`. Never faucet-funded on a real network. |
 | `VITE_FEE_TREASURY_TESTNET` / `_MAINNET` | Operator treasury baked into the build (already set in `.env.production`). The build fails if it is the zero address. |
 | `E2E_FEE_ADDR` | The treasury to watch for the fee-delta assertion — set it equal to the built treasury. If unset, the fee check is skipped (the app still charges the fee). |
-| `VITE_RPC_TESTNET` / `_MAINNET` and `E2E_RPC` | JSON-RPC endpoint for the build (browser) and the node-side verifier. Use a JSON-RPC-capable endpoint — the official testnet fullnode is gRPC-only. |
+| `VITE_RPC_TESTNET` / `_MAINNET` and `E2E_RPC` | gRPC endpoint for the build (browser) and the node-side verifier. Defaults to the public fullnodes. |
 | `E2E_MAINNET_CONFIRM=1` | **Mainnet only.** Without it the mainnet runner aborts cleanly (fail-safe default) so it can never publish by accident. |
 
 A full fee-charging run needs the key to hold **≥ gas + fee** (~0.5 SUI gas + 1 SUI fee = ~1.5 SUI).
@@ -203,8 +203,6 @@ Example (testnet):
 
 ```bash
 export SUI_PRIV="$(sui keytool export --key-identity 0xYOURADDR --json | jq -r .exportedPrivateKey)"
-VITE_RPC_TESTNET=https://sui-testnet-rpc.publicnode.com \
-E2E_RPC=https://sui-testnet-rpc.publicnode.com \
 VITE_FEE_TREASURY_TESTNET=0xYOURTREASURY \
 E2E_FEE_ADDR=0xYOURTREASURY \
 npm run e2e:testnet

package/eslint.config.ts

@@ -0,0 +1,63 @@
+import { globalIgnores } from 'eslint/config'
+import { defineConfigWithVueTs, vueTsConfigs } from '@vue/eslint-config-typescript'
+import pluginVue from 'eslint-plugin-vue'
+import pluginA11y from 'eslint-plugin-vuejs-accessibility'
+
+// Flat ESLint config: layers vue-a11y (WAI-ARIA linting for templates) on top of
+// the standard Vue + TypeScript recommended rules, so accessibility regressions
+// are caught in CI.
+export default defineConfigWithVueTs(
+  {
+    name: 'token-deployer-ui/files-to-lint',
+    files: ['**/*.{vue,ts,mts,tsx}'],
+  },
+
+  globalIgnores(['**/dist/**', '**/coverage/**', '**/*.d.ts', 'docs/api/**']),
+
+  ...pluginVue.configs['flat/essential'],
+  ...pluginA11y.configs['flat/recommended'],
+  vueTsConfigs.recommended,
+
+  {
+    name: 'token-deployer-ui/overrides',
+    rules: {
+      // Accept both valid label-association patterns: a label wrapping its
+      // control (nesting) or a label[for] pointing at a control[id]. UiSelect renders a native
+      // <select>, so a label nesting it is labelling a control.
+      'vuejs-accessibility/label-has-for': [
+        'error',
+        { required: { some: ['nesting', 'id'] }, controlComponents: ['UiSelect'] },
+      ],
+      // UiFormField renders the <label for> for the control in its default slot.
+      'vuejs-accessibility/form-control-has-label': ['error', { labelComponents: ['UiFormField'] }],
+      // role="list" on styled lists is a deliberate Safari/VoiceOver workaround: WebKit drops
+      // list semantics when list-style is removed, so the explicit role stays.
+      'vuejs-accessibility/no-redundant-roles': 'off',
+      // Underscore-prefixed args/vars are an intentional "unused" marker.
+      '@typescript-eslint/no-unused-vars': [
+        'error',
+        { argsIgnorePattern: '^_', varsIgnorePattern: '^_' },
+      ],
+    },
+  },
+
+  {
+    // Tests use deliberately loose typing for mocks/stubs.
+    name: 'token-deployer-ui/test-overrides',
+    files: ['**/*.{test,spec}.{ts,tsx}', 'tests/**', 'e2e/**'],
+    rules: {
+      '@typescript-eslint/no-explicit-any': 'off',
+    },
+  },
+
+  {
+    // ConfigForm intentionally edits a parent-owned reactive FormModel in place
+    // (the parent passes `:form` and reads the same object back). Converting to
+    // defineModel is deferred; the in-place mutation is the current contract.
+    name: 'token-deployer-ui/config-form',
+    files: ['src/components/ConfigForm.vue'],
+    rules: {
+      'vue/no-mutating-props': 'off',
+    },
+  },
+)

package/index.html

@@ -2,9 +2,18 @@
 <html lang="en">
   <head>
     <meta charset="UTF-8">
-    <link rel="icon" href="/favicon.ico">
+    <link rel="icon" href="/favicon.svg" type="image/svg+xml">
+    <link rel="icon" href="/favicon.ico" sizes="any">
     <meta name="viewport" content="width=device-width, initial-scale=1.0">
-    <title>Vite App</title>
+    <title>Token Deployer · MeddleWare</title>
+    <meta name="description" content="Create your own Sui coin in the browser — your wallet signs and pays gas, nothing is compiled or signed on a server, and you keep the full, verifiable source package.">
+    <link rel="canonical" href="%VITE_PUBLIC_URL%/">
+    <meta property="og:type" content="website">
+    <meta property="og:title" content="Token Deployer · MeddleWare">
+    <meta property="og:description" content="Create your own Sui coin in the browser — no server, no custody, full source included.">
+    <meta property="og:url" content="%VITE_PUBLIC_URL%/">
+    <meta property="og:image" content="%VITE_PUBLIC_URL%/og-image.png">
+    <meta name="twitter:card" content="summary_large_image">
   </head>
   <body>
     <div id="app"></div>

package/package.json

@@ -1,7 +1,8 @@
 {
   "name": "@meddleware/token-deployer-ui",
-  "version": "0.0.8",
+  "version": "0.0.10",
   "type": "module",
+  "license": "0BSD",
   "exports": {
     ".": {
       "default": "./src/index.ts"
@@ -25,22 +26,25 @@
     "e2e:localnet": "VITE_RPC_TESTNET=${VITE_RPC_TESTNET:-http://127.0.0.1:9000} VITE_FEE_TREASURY_TESTNET=${VITE_FEE_TREASURY_TESTNET:-0xfee0000000000000000000000000000000000000000000000000000000000000} vite build && start-server-and-test preview http://localhost:4173 'E2E_NETWORK=localnet node scripts/e2e-deploy.mjs'",
     "e2e:testnet": "vite build && start-server-and-test preview http://localhost:4173 'E2E_NETWORK=testnet node scripts/e2e-deploy.mjs'",
     "e2e:mainnet": "vite build && start-server-and-test preview http://localhost:4173 'E2E_NETWORK=mainnet node scripts/e2e-deploy.mjs'",
-    "lint": "oxlint . --fix",
+    "lint": "npm run lint:css && npm run lint:js && npm run lint:html",
     "format": "oxfmt src/",
     "docs": "typedoc",
     "regen:template": "bash scripts/regen-template.sh",
     "sync:template": "bash scripts/sync-template-src.sh",
     "gen:og-image": "node scripts/gen-og-image.mjs",
-    "verify:template": "node scripts/verify-bytecode.mjs && vitest run tests/templateArtifact.test.ts tests/templateParity.test.ts"
+    "verify:template": "node scripts/verify-bytecode.mjs && vitest run tests/templateArtifact.test.ts tests/templateParity.test.ts",
+    "lint:css": "stylelint \"src/**/*.{css,vue}\"",
+    "lint:js": "eslint .",
+    "lint:html": "html-validate \"src/**/*.vue\""
   },
   "dependencies": {
-    "@meddleware/design-tokens": "^0.1.6",
-    "@meddleware/ui": "^0.1.27",
-    "@meddleware/wallet-adapter": "^0.0.8",
-    "@meddleware/walrus-relay": "^0.1.17",
+    "@meddleware/design-tokens": "^0.1.7",
+    "@meddleware/ui": "^0.1.28",
+    "@meddleware/wallet-adapter": "^0.0.10",
+    "@meddleware/walrus-relay": "^0.1.19",
     "@mysten/bcs": "~2.1.0",
     "@mysten/move-bytecode-template": "~0.4.0",
-    "@mysten/sui": "^2.31.0",
+    "@mysten/sui": "^2.33.1",
     "@mysten/walrus": "~1.2.0",
     "fflate": "^0.8.3",
     "vue": "^3.5.0"
@@ -51,23 +55,41 @@
     "@vitejs/plugin-vue": "^6.0.8",
     "@vitejs/plugin-vue-jsx": "^5.1.6",
     "@vitest/eslint-plugin": "^1.6.23",
+    "@vue/eslint-config-typescript": "^14.9.0",
     "@vue/test-utils": "^2.4.0",
+    "autoprefixer": "^10.4.20",
+    "eslint": "^10.11.0",
+    "eslint-plugin-vue": "^10.11.1",
+    "eslint-plugin-vuejs-accessibility": "^2.6.0",
+    "html-validate": "^11.16.1",
+    "html-validate-vue": "^9.3.1",
+    "jiti": "^2.7.0",
     "jsdom": "^29.1.1",
     "oxfmt": "^0.59.0",
     "oxlint": "~1.76.0",
     "playwright": "^1.62.0",
+    "postcss": "^8.4.49",
+    "postcss-html": "^2.0.0",
     "start-server-and-test": "^3.0.11",
+    "stylelint": "^17.15.0",
+    "stylelint-config-standard": "^40.0.0",
     "typedoc": "^0.28.20",
     "typescript": "~6.0.0",
     "vite": "^8.1.5",
     "vite-plugin-vue-devtools": "^8.1.5",
     "vitest": "^4.1.10",
+    "vue-eslint-parser": "^10.4.1",
     "vue-tsc": "~3.3.0"
   },
   "optionalDependencies": {
-    "@meddleware/sui-token-template": "^1.0.1"
+    "@meddleware/sui-token-template": "^1.0.5"
   },
   "engines": {
     "node": "^22.18.0 || >=24.12.0"
-  }
+  },
+  "browserslist": [
+    "> 0.5%",
+    "last 2 versions",
+    "not dead"
+  ]
 }

package/postcss.config.js

@@ -0,0 +1,8 @@
+// Autoprefixer runs over the library's shipped CSS (base.css) during `vite build`,
+// using the `browserslist` field in package.json as the target. Consumers therefore
+// receive vendor-prefixed component CSS without needing their own prefixing step.
+import autoprefixer from 'autoprefixer'
+
+export default {
+  plugins: [autoprefixer()],
+}

package/public/robots.txt

@@ -1,3 +1,3 @@
 User-agent: *
 Allow: /
-Sitemap: https://tokens.meddleware.co.uk/sitemap.xml
+Sitemap: https://sui-token-deployer.meddleware.co.uk/sitemap.xml

package/public/sitemap.xml

@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">
   <url>
-    <loc>https://tokens.meddleware.co.uk/</loc>
+    <loc>https://sui-token-deployer.meddleware.co.uk/</loc>
     <changefreq>monthly</changefreq>
     <priority>1.0</priority>
   </url>