@meddleware/token-deployer-ui 0.0.9 → 0.0.11

package/LICENSE

@@ -1,121 +1,14 @@
-Creative Commons Legal Code
+BSD Zero Clause License
 
-CC0 1.0 Universal
+Copyright (c) 2026 MeddleWare
 
-    CREATIVE COMMONS CORPORATION IS NOT A LAW FIRM AND DOES NOT PROVIDE
-    LEGAL SERVICES. DISTRIBUTION OF THIS DOCUMENT DOES NOT CREATE AN
-    ATTORNEY-CLIENT RELATIONSHIP. CREATIVE COMMONS PROVIDES THIS
-    INFORMATION ON AN "AS-IS" BASIS. CREATIVE COMMONS MAKES NO WARRANTIES
-    REGARDING THE USE OF THIS DOCUMENT OR THE INFORMATION OR WORKS
-    PROVIDED HEREUNDER, AND DISCLAIMS LIABILITY FOR DAMAGES RESULTING FROM
-    THE USE OF THIS DOCUMENT OR THE INFORMATION OR WORKS PROVIDED
-    HEREUNDER.
+Permission to use, copy, modify, and/or distribute this software for any
+purpose with or without fee is hereby granted.
 
-Statement of Purpose
-
-The laws of most jurisdictions throughout the world automatically confer
-exclusive Copyright and Related Rights (defined below) upon the creator
-and subsequent owner(s) (each and all, an "owner") of an original work of
-authorship and/or a database (each, a "Work").
-
-Certain owners wish to permanently relinquish those rights to a Work for
-the purpose of contributing to a commons of creative, cultural and
-scientific works ("Commons") that the public can reliably and without fear
-of later claims of infringement build upon, modify, incorporate in other
-works, reuse and redistribute as freely as possible in any form whatsoever
-and for any purposes, including without limitation commercial purposes.
-These owners may contribute to the Commons to promote the ideal of a free
-culture and the further production of creative, cultural and scientific
-works, or to gain reputation or greater distribution for their Work in
-part through the use and efforts of others.
-
-For these and/or other purposes and motivations, and without any
-expectation of additional consideration or compensation, the person
-associating CC0 with a Work (the "Affirmer"), to the extent that he or she
-is an owner of Copyright and Related Rights in the Work, voluntarily
-elects to apply CC0 to the Work and publicly distribute the Work under its
-terms, with knowledge of his or her Copyright and Related Rights in the
-Work and the meaning and intended legal effect of CC0 on those rights.
-
-1. Copyright and Related Rights. A Work made available under CC0 may be
-protected by copyright and related or neighboring rights ("Copyright and
-Related Rights"). Copyright and Related Rights include, but are not
-limited to, the following:
-
-  i. the right to reproduce, adapt, distribute, perform, display,
-     communicate, and translate a Work;
- ii. moral rights retained by the original author(s) and/or performer(s);
-iii. publicity and privacy rights pertaining to a person's image or
-     likeness depicted in a Work;
- iv. rights protecting against unfair competition in regards to a Work,
-     subject to the limitations in paragraph 4(a), below;
-  v. rights protecting the extraction, dissemination, use and reuse of data
-     in a Work;
- vi. database rights (such as those arising under Directive 96/9/EC of the
-     European Parliament and of the Council of 11 March 1996 on the legal
-     protection of databases, and under any national implementation
-     thereof, including any amended or successor version of such
-     directive); and
-vii. other similar, equivalent or corresponding rights throughout the
-     world based on applicable law or treaty, and any national
-     implementations thereof.
-
-2. Waiver. To the greatest extent permitted by, but not in contravention
-of, applicable law, Affirmer hereby overtly, fully, permanently,
-irrevocably and unconditionally waives, abandons, and surrenders all of
-Affirmer's Copyright and Related Rights and associated claims and causes
-of action, whether now known or unknown (including existing as well as
-future claims and causes of action), in the Work (i) in all territories
-worldwide, (ii) for the maximum duration provided by applicable law or
-treaty (including future time extensions), (iii) in any current or future
-medium and for any number of copies, and (iv) for any purpose whatsoever,
-including without limitation commercial, advertising or promotional
-purposes (the "Waiver"). Affirmer makes the Waiver for the benefit of each
-member of the public at large and to the detriment of Affirmer's heirs and
-successors, fully intending that such Waiver shall not be subject to
-revocation, rescission, cancellation, termination, or any other legal or
-equitable action to disrupt the quiet enjoyment of the Work by the public
-as contemplated by Affirmer's express Statement of Purpose.
-
-3. Public License Fallback. Should any part of the Waiver for any reason
-be judged legally invalid or ineffective under applicable law, then the
-Waiver shall be preserved to the maximum extent permitted taking into
-account Affirmer's express Statement of Purpose. In addition, to the
-extent the Waiver is so judged Affirmer hereby grants to each affected
-person a royalty-free, non transferable, non sublicensable, non exclusive,
-irrevocable and unconditional license to exercise Affirmer's Copyright and
-Related Rights in the Work (i) in all territories worldwide, (ii) for the
-maximum duration provided by applicable law or treaty (including future
-time extensions), (iii) in any current or future medium and for any number
-of copies, and (iv) for any purpose whatsoever, including without
-limitation commercial, advertising or promotional purposes (the
-"License"). The License shall be deemed effective as of the date CC0 was
-applied by Affirmer to the Work. Should any part of the License for any
-reason be judged legally invalid or ineffective under applicable law, such
-partial invalidity or ineffectiveness shall not invalidate the remainder
-of the License, and in such case Affirmer hereby affirms that he or she
-will not (i) exercise any of his or her remaining Copyright and Related
-Rights in the Work or (ii) assert any associated claims and causes of
-action with respect to the Work, in either case contrary to Affirmer's
-express Statement of Purpose.
-
-4. Limitations and Disclaimers.
-
- a. No trademark or patent rights held by Affirmer are waived, abandoned,
-    surrendered, licensed or otherwise affected by this document.
- b. Affirmer offers the Work as-is and makes no representations or
-    warranties of any kind concerning the Work, express, implied,
-    statutory or otherwise, including without limitation warranties of
-    title, merchantability, fitness for a particular purpose, non
-    infringement, or the absence of latent or other defects, accuracy, or
-    the present or absence of errors, whether or not discoverable, all to
-    the greatest extent permissible under applicable law.
- c. Affirmer disclaims responsibility for clearing rights of other persons
-    that may apply to the Work or any use thereof, including without
-    limitation any person's Copyright and Related Rights in the Work.
-    Further, Affirmer disclaims responsibility for obtaining any necessary
-    consents, permissions or other rights required for any use of the
-    Work.
- d. Affirmer understands and acknowledges that Creative Commons is not a
-    party to this document and has no duty or obligation with respect to
-    this CC0 or use of the Work.
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+PERFORMANCE OF THIS SOFTWARE.

package/README.md

@@ -22,7 +22,8 @@ and can optionally push it to a new GitHub repo in their own account.
    ([src/lib/generatePackage.ts](src/lib/generatePackage.ts)) that is **byte-identical**
    to the CLI generator's output, so the on-chain package is source-verifiable.
 5. Licenses are fetched live from SPDX ([src/lib/licenses.ts](src/lib/licenses.ts)); an
-   optional icon upload goes to Walrus ([src/lib/walrus.ts](src/lib/walrus.ts)); and an
+   optional icon upload goes to Walrus (`@meddleware/walrus-client/flow`, from
+   [src/components/IconPicker.vue](src/components/IconPicker.vue)); and an
    optional GitHub push uses the user's own token ([src/lib/github.ts](src/lib/github.ts)).
 
 ## Security & trust model
@@ -68,9 +69,9 @@ host dashboard. See [.env.example](.env.example) for the full list.
 | --- | --- | --- |
 | `VITE_FEE_TREASURY_TESTNET` / `_MAINNET` | Operator treasury that receives the fee. **A production build fails if either is the zero address** (bypass with `VITE_ALLOW_UNSET_TREASURY=1`). | committed operator address |
 | `VITE_FEE_MIST` | Flat fee split from the user's gas coin. | `1000000000` (1 SUI) |
-| `VITE_RPC_TESTNET` / `_MAINNET` | JSON-RPC endpoint (set a paid RPC for production). | public endpoints |
+| `VITE_RPC_TESTNET` / `_MAINNET` | gRPC fullnode endpoint (set a paid RPC for production). JSON-RPC-only endpoints do not work. | public fullnodes |
 | `VITE_PUBLISH_GAS_BUDGET` | Publish gas budget (MIST). | `500000000` |
-| `VITE_PUBLIC_URL` | Site origin for canonical/OG/JSON-LD URLs. | `https://tokens.meddleware.co.uk` |
+| `VITE_PUBLIC_URL` | Site origin (no trailing slash) for the canonical URL and Open Graph tags in `index.html`. | `https://sui-token-deployer.meddleware.co.uk` (`.env.production`) |
 | `VITE_WALRUS_RELAY_TESTNET` / `_MAINNET` | Your own upload relay (to collect the tip). Unset → public Mysten relay (earns nothing). | public relay |
 | `VITE_WALRUS_MAX_TIP_MIST` | Client-side max relay tip. **Must exceed your relay's tip** or uploads fail. | `50000000` (0.05 SUI) |
 | `VITE_ICON_MAX_BYTES` / `VITE_ICON_ALLOWED_TYPES` | Client icon size/type gate (UX only). | `102400` / PNG,JPEG,WebP,SVG |
@@ -163,14 +164,16 @@ Two tests enforce this invariant in CI so it can never silently drift:
 - `scripts/e2e-deploy.mjs` — the **network-parametrized real-chain deploy e2e** (headless
   browser + injected wallet): drives the full UI, does a REAL publish, waits for real
   confirmation, checks the result panel, downloads the source zip, and verifies coin type +
-  operator fee on-chain. Covers exactly what the mocked Cypress suite cannot. `scripts/e2e-browser.mjs`
+  operator fee on-chain. Covers exactly what the mocked Playwright suite cannot. `scripts/e2e-browser.mjs`
   is a thin localnet wrapper over it.
-- `scripts/e2e-walrus-browser.mjs` — the Walrus icon uploader end-to-end on testnet
-  with an injected wallet.
+- `scripts/e2e-walrus-browser.mjs` (`npm run e2e:walrus`) — the Walrus icon uploader end-to-end on
+  testnet with an injected wallet (`SUI_PRIV` with SUI + WAL); `E2E_RELAY=operator` exercises the
+  NFT-gated relay (pass purchase, consume, signed proof). Manual only — it spends real funds.
 
 ## Real-chain e2e / launch runbook
 
-The Playwright mocked suite (`npm run test:e2e`) mocks all RPC via `VITE_E2E=1`, so it can prove
+The Playwright mocked suite (`npm run test:e2e`) mocks all RPC in a dedicated e2e build
+(`npm run build:e2e`, `--mode e2e`; production builds refuse `VITE_E2E`), so it can prove
 the form/wallet/publish UI but **not** on-chain confirmation, the result panel, or the source
 download. The real-chain harness fills that gap. It is **manual** — never wired into automatic CI — because testnet/mainnet runs
 publish a real token and spend real SUI.
@@ -192,7 +195,7 @@ testnet mode with the RPC pointed at the local node).
 | `SUI_PRIV` | bech32 `suiprivkey1…` for a **funded** deployer key. Export the CLI key: `sui keytool export --key-identity <addr>`. Never faucet-funded on a real network. |
 | `VITE_FEE_TREASURY_TESTNET` / `_MAINNET` | Operator treasury baked into the build (already set in `.env.production`). The build fails if it is the zero address. |
 | `E2E_FEE_ADDR` | The treasury to watch for the fee-delta assertion — set it equal to the built treasury. If unset, the fee check is skipped (the app still charges the fee). |
-| `VITE_RPC_TESTNET` / `_MAINNET` and `E2E_RPC` | JSON-RPC endpoint for the build (browser) and the node-side verifier. Use a JSON-RPC-capable endpoint — the official testnet fullnode is gRPC-only. |
+| `VITE_RPC_TESTNET` / `_MAINNET` and `E2E_RPC` | gRPC endpoint for the build (browser) and the node-side verifier. Defaults to the public fullnodes. |
 | `E2E_MAINNET_CONFIRM=1` | **Mainnet only.** Without it the mainnet runner aborts cleanly (fail-safe default) so it can never publish by accident. |
 
 A full fee-charging run needs the key to hold **≥ gas + fee** (~0.5 SUI gas + 1 SUI fee = ~1.5 SUI).
@@ -203,8 +206,6 @@ Example (testnet):
 
 ```bash
 export SUI_PRIV="$(sui keytool export --key-identity 0xYOURADDR --json | jq -r .exportedPrivateKey)"
-VITE_RPC_TESTNET=https://sui-testnet-rpc.publicnode.com \
-E2E_RPC=https://sui-testnet-rpc.publicnode.com \
 VITE_FEE_TREASURY_TESTNET=0xYOURTREASURY \
 E2E_FEE_ADDR=0xYOURTREASURY \
 npm run e2e:testnet

package/package.json

@@ -1,12 +1,20 @@
 {
   "name": "@meddleware/token-deployer-ui",
-  "version": "0.0.9",
+  "version": "0.0.11",
   "type": "module",
+  "license": "0BSD",
   "exports": {
     ".": {
       "default": "./src/index.ts"
     }
   },
+  "files": [
+    "src",
+    "!src/__tests__",
+    "env.d.ts",
+    "README.md",
+    "LICENSE"
+  ],
   "publishConfig": {
     "access": "public"
   },
@@ -18,13 +26,15 @@
     "test:unit": "vitest",
     "test": "vitest run",
     "test:watch": "vitest",
-    "build:e2e": "VITE_E2E=1 vite build",
+    "build:e2e": "VITE_E2E=1 vite build --mode e2e",
+    "check:bundle": "node scripts/check-prod-bundle.mjs",
     "test:e2e": "playwright test",
     "test:e2e:ui": "playwright test --ui",
     "e2e:install": "playwright install --with-deps chromium firefox",
     "e2e:localnet": "VITE_RPC_TESTNET=${VITE_RPC_TESTNET:-http://127.0.0.1:9000} VITE_FEE_TREASURY_TESTNET=${VITE_FEE_TREASURY_TESTNET:-0xfee0000000000000000000000000000000000000000000000000000000000000} vite build && start-server-and-test preview http://localhost:4173 'E2E_NETWORK=localnet node scripts/e2e-deploy.mjs'",
     "e2e:testnet": "vite build && start-server-and-test preview http://localhost:4173 'E2E_NETWORK=testnet node scripts/e2e-deploy.mjs'",
     "e2e:mainnet": "vite build && start-server-and-test preview http://localhost:4173 'E2E_NETWORK=mainnet node scripts/e2e-deploy.mjs'",
+    "e2e:walrus": "vite build && start-server-and-test preview http://localhost:4173 'node scripts/e2e-walrus-browser.mjs'",
     "lint": "npm run lint:css && npm run lint:js && npm run lint:html",
     "format": "oxfmt src/",
     "docs": "typedoc",
@@ -39,16 +49,18 @@
   "dependencies": {
     "@meddleware/design-tokens": "^0.1.7",
     "@meddleware/ui": "^0.1.28",
-    "@meddleware/wallet-adapter": "^0.0.9",
-    "@meddleware/walrus-relay": "^0.1.18",
-    "@mysten/bcs": "~2.1.0",
-    "@mysten/move-bytecode-template": "~0.4.0",
-    "@mysten/sui": "^2.33.0",
-    "@mysten/walrus": "~1.2.0",
+    "@meddleware/wallet-adapter": "^0.0.12",
+    "@meddleware/walrus-client": "^0.0.21",
+    "@meddleware/walrus-relay": "^0.1.20",
+    "@mysten/bcs": "~2.1.2",
+    "@mysten/move-bytecode-template": "~0.4.1",
+    "@mysten/sui": "^2.33.1",
+    "@mysten/walrus": "~1.2.32",
     "fflate": "^0.8.3",
     "vue": "^3.5.0"
   },
   "devDependencies": {
+    "@meddleware/access-gate-client": "^0.0.1",
     "@playwright/test": "^1.56.0",
     "@types/node": "~24.12.2",
     "@vitejs/plugin-vue": "^6.0.8",
@@ -76,12 +88,12 @@
     "typescript": "~6.0.0",
     "vite": "^8.1.5",
     "vite-plugin-vue-devtools": "^8.1.5",
-    "vitest": "^4.1.10",
+    "vitest": "~5.0.2",
     "vue-eslint-parser": "^10.4.1",
     "vue-tsc": "~3.3.0"
   },
   "optionalDependencies": {
-    "@meddleware/sui-token-template": "^1.0.4"
+    "@meddleware/sui-token-template": "^1.0.5"
   },
   "engines": {
     "node": "^22.18.0 || >=24.12.0"

package/src/App.vue

@@ -8,7 +8,7 @@ const { mode: colorMode, set: setColorMode } = useColorMode('system')
 
 <template>
   <a class="skip-link" href="#main-content">Skip to main content</a>
-  <main id="main-content">
+  <main id="main-content" class="mw-token-deployer">
     <header class="page-header">
       <ColorModeControl
         class="theme-toggle"

package/src/component-styles.css

@@ -1,9 +1,11 @@
 /* Component utility styles for TokenDeployerView and its sub-components.
    Imported by index.ts so these are available in both standalone and library (dashboard) mode.
+   Every rule is scoped under `:where(.mw-token-deployer)` so the library injects nothing global
+   into an embedding host, while `:where()` keeps the original (element-level) specificity.
    Relies on design-token CSS variables (--bg, --surface, --border, etc.) provided by the
    consumer — either @meddleware/design-tokens (standalone) or the dashboard's own import. */
 
-.card {
+:where(.mw-token-deployer) .card {
   background: var(--surface);
   border: 1px solid var(--border);
   border-radius: var(--radius);
@@ -12,20 +14,20 @@
   border-top: 2px solid var(--border);
 }
 
-label {
+:where(.mw-token-deployer) label {
   display: block;
   font-weight: 600;
   margin: 0.9rem 0 0.3rem;
 }
-.hint {
+:where(.mw-token-deployer) .hint {
   color: var(--muted);
   font-weight: 400;
   font-size: 0.9rem;
 }
 
-input,
-select,
-textarea {
+:where(.mw-token-deployer) input,
+:where(.mw-token-deployer) select,
+:where(.mw-token-deployer) textarea {
   width: 100%;
   padding: 0.6rem 0.7rem;
   font: inherit;
@@ -34,24 +36,24 @@ textarea {
   border: 1px solid var(--border);
   border-radius: 8px;
 }
-textarea {
+:where(.mw-token-deployer) textarea {
   min-height: 4rem;
   resize: vertical;
 }
 
-input[aria-invalid='true'],
-select[aria-invalid='true'],
-textarea[aria-invalid='true'] {
+:where(.mw-token-deployer) input[aria-invalid='true'],
+:where(.mw-token-deployer) select[aria-invalid='true'],
+:where(.mw-token-deployer) textarea[aria-invalid='true'] {
   border-color: var(--danger);
 }
 
-.field-error {
+:where(.mw-token-deployer) .field-error {
   color: var(--danger);
   font-size: 0.88rem;
   margin-top: 0.3rem;
 }
 
-button {
+:where(.mw-token-deployer) button {
   font: inherit;
   font-weight: 600;
   padding: 0.6rem 1rem;
@@ -61,54 +63,54 @@ button {
   color: var(--text);
   cursor: pointer;
 }
-button.primary {
+:where(.mw-token-deployer) button.primary {
   background: var(--accent);
   color: var(--accent-contrast);
   border-color: transparent;
 }
-button:disabled {
+:where(.mw-token-deployer) button:disabled {
   opacity: 0.55;
   cursor: not-allowed;
 }
 
-.row {
+:where(.mw-token-deployer) .row {
   display: flex;
   gap: 0.75rem;
   flex-wrap: wrap;
   align-items: center;
 }
 /* A row of form/navigation actions below a block of content. */
-.actions {
+:where(.mw-token-deployer) .actions {
   margin-top: 1rem;
 }
-.grid2 {
+:where(.mw-token-deployer) .grid2 {
   display: grid;
   grid-template-columns: 1fr;
   gap: 0 1rem;
 }
 @media (width >= 520px) {
-  .grid2 {
+  :where(.mw-token-deployer) .grid2 {
     grid-template-columns: 1fr 1fr;
   }
 }
 
-fieldset {
+:where(.mw-token-deployer) fieldset {
   background: var(--lift);
   border: 1px solid var(--border);
   border-radius: 8px;
   padding: 0.5rem 1rem 1rem;
   margin: 1rem 0;
 }
-legend {
+:where(.mw-token-deployer) legend {
   font-weight: 700;
   padding: 0 0.4rem;
 }
 
-details {
+:where(.mw-token-deployer) details {
   margin: 1rem 0;
 }
 
-details > summary {
+:where(.mw-token-deployer) details > summary {
   color: var(--accent);
   font-weight: 700;
   margin: 0.5rem 0;
@@ -119,28 +121,28 @@ details > summary {
   transition: border-color 0.2s ease;
 }
 
-details > summary:hover {
+:where(.mw-token-deployer) details > summary:hover {
   border-color: var(--border);
 }
 
-details[open] > summary {
+:where(.mw-token-deployer) details[open] > summary {
   border-color: var(--border);
   margin-bottom: 1rem;
 }
 
-details > fieldset {
+:where(.mw-token-deployer) details > fieldset {
   margin-top: 0;
 }
 
-.permanent {
+:where(.mw-token-deployer) .permanent {
   color: var(--danger);
   font-weight: 600;
 }
-.mono {
+:where(.mw-token-deployer) .mono {
   font-family: ui-monospace, SFMono-Regular, Menlo, monospace;
   word-break: break-all;
 }
-.badge {
+:where(.mw-token-deployer) .badge {
   display: inline-block;
   font-size: 0.8rem;
   padding: 0.15rem 0.5rem;
@@ -148,44 +150,24 @@ details > fieldset {
   background: var(--border);
 }
 
-.skip-link {
-  position: absolute;
-  left: 0.5rem;
-  top: -3rem;
-  z-index: 100;
-  background: var(--accent);
-  color: #fff;
-  padding: 0.5rem 0.9rem;
-  border-radius: 6px;
-  text-decoration: none;
-  transition: top 0.15s ease;
-}
-.skip-link:focus {
-  top: 0.5rem;
-}
-@media (prefers-reduced-motion: reduce) {
-  .skip-link {
-    transition: none;
-  }
-}
 
-.steps {
+:where(.mw-token-deployer) .steps {
   list-style: none;
   padding: 0;
 }
-.steps li {
+:where(.mw-token-deployer) .steps li {
   padding: 0.35rem 0;
   color: var(--muted);
 }
-.steps li[data-state='active'] {
+:where(.mw-token-deployer) .steps li[data-state='active'] {
   color: var(--text);
   font-weight: 600;
 }
-.steps li[data-state='done'] {
+:where(.mw-token-deployer) .steps li[data-state='done'] {
   color: var(--ok);
 }
 
-.spinner {
+:where(.mw-token-deployer) .spinner {
   width: 1em;
   height: 1em;
   border: 2px solid currentColor;
@@ -201,21 +183,21 @@ details > fieldset {
   }
 }
 @media (prefers-reduced-motion: reduce) {
-  .spinner {
+  :where(.mw-token-deployer) .spinner {
     animation: none;
   }
-  * {
+  :where(.mw-token-deployer) * {
     scroll-behavior: auto;
   }
 }
 
-.wallet-list {
+:where(.mw-token-deployer) .wallet-list {
   display: flex;
   flex-direction: column;
   gap: 0.5rem;
   margin-top: 1rem;
 }
-.wallet-list button {
+:where(.mw-token-deployer) .wallet-list button {
   display: flex;
   align-items: center;
   gap: 0.6rem;

package/src/components/GithubPush.vue

@@ -1,7 +1,7 @@
 <script setup lang="ts">
 import { ref } from 'vue'
 import type { PublishResult, TokenConfig } from '../lib/types.js'
-import { UiNotice } from '@meddleware/ui'
+import { UiNotice, safeHref } from '@meddleware/ui'
 import { buildPackageFiles } from '../lib/generatePackage.js'
 import { fetchLicenseText } from '../lib/licenses.js'
 import { createRepoAndPush } from '../lib/github.js'
@@ -92,7 +92,7 @@ async function push(): Promise<void> {
 
       <UiNotice v-if="error" type="error">{{ error }}</UiNotice>
       <UiNotice v-if="doneUrl" type="ok">
-        Pushed: <a :href="doneUrl" target="_blank" rel="noopener noreferrer">{{ doneUrl }}</a>
+        Pushed: <a :href="safeHref(doneUrl)" target="_blank" rel="noopener noreferrer">{{ doneUrl }}</a>
       </UiNotice>
     </div>
   </div>