@meddleware/walrus-storage-ui 0.1.66 → 0.1.67

package/CHANGELOG.md

@@ -4,6 +4,16 @@ All notable changes to `@meddleware/walrus-ui` are documented here.
 Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); versioning follows
 [Semantic Versioning](https://semver.org/). Before 0.2.0, breaking changes ship as patch releases.
 
+## [0.1.67] - 2026-11-05
+
+### Security
+
+- CI and the image build scan the production bundle for the e2e harness (`check-prod-bundle` from `@meddleware/frontend-config`), CI proves a production build with `VITE_E2E=1` is refused, and `src/e2e*.ts` is no longer in the published package.
+
+### Changed
+
+- Dependency alignment: `@meddleware/ui` ^0.1.38 (form-field edge contrast, sticky-offset and focus-not-obscured fixes), `@meddleware/design-tokens` ^0.1.13, `@meddleware/web-utils` ^0.0.2 and `@meddleware/frontend-config` ^0.0.2 (the shared sweep now also checks that focus is not hidden behind fixed content).
+
 ## [0.1.66] - 2026-10-31
 
 - Gated upload composable, blob table split, accessibility gates

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@meddleware/walrus-storage-ui",
-  "version": "0.1.66",
+  "version": "0.1.67",
   "homepage": "https://docs.meddleware.co.uk/blockchain/sui/walrus-storage/",
   "description": "Standalone Vue 3 SPA for uploading blobs to Walrus decentralised storage and managing owned blobs — wallet-connected, NFT-gated relay support.",
   "author": "Meddleware <dev@meddleware.co.uk>",
@@ -26,7 +26,8 @@
     "index.html",
     "vite.config.ts",
     "tsconfig.json",
-    "CHANGELOG.md"
+    "CHANGELOG.md",
+    "!src/e2e*.ts"
   ],
   "scripts": {
     "dev": "vite",
@@ -44,17 +45,18 @@
     "licenses": "node scripts/third-party-licenses.mjs",
     "check:licenses": "node scripts/third-party-licenses.mjs --check",
     "shots": "SHOTS=1 playwright test",
-    "lhci": "npm run build && lhci autorun"
+    "lhci": "npm run build && lhci autorun",
+    "check:bundle": "check-prod-bundle dist"
   },
   "publishConfig": {
     "access": "public"
   },
   "dependencies": {
-    "@meddleware/design-tokens": "^0.1.12",
-    "@meddleware/ui": "^0.1.37",
+    "@meddleware/design-tokens": "^0.1.13",
+    "@meddleware/ui": "^0.1.38",
     "@meddleware/walrus-storage-client": "^0.0.34",
-    "@meddleware/walrus-storage-kit": "^0.1.36",
-    "@meddleware/web-utils": "^0.0.1",
+    "@meddleware/walrus-storage-kit": "^0.1.37",
+    "@meddleware/web-utils": "^0.0.2",
     "@mysten/sui": "^2.33.2",
     "@mysten/walrus": "~1.2.32",
     "@mysten/walrus-wasm": "~0.3.1",
@@ -66,8 +68,8 @@
   "devDependencies": {
     "@lhci/cli": "^0.15.1",
     "@meddleware/access-gate-client": "^0.0.13",
-    "@meddleware/frontend-config": "^0.0.1",
-    "@meddleware/wallet-adapter": "^0.0.20",
+    "@meddleware/frontend-config": "^0.0.2",
+    "@meddleware/wallet-adapter": "^0.0.21",
     "@playwright/test": "~1.64.1",
     "@types/node": "~26.6.5",
     "@vitejs/plugin-vue": "^6.0.8",

package/src/e2e-data.ts

@@ -1,11 +0,0 @@
-// What the end-to-end build's prepared blob list is made of, apart from the code that installs it (`e2e.ts` pulls in the mock wallet, which
-// a Playwright spec, running in Node, cannot load): the specs import these to look for the right rows.
-export const E2E_EPOCH = 560
-
-/** Blob ids as the aggregator spells them (URL-safe base64, 43 characters). */
-export const E2E_BLOBS = {
-  duplicated: 'Qm9yZWRPZkR1cGxpY2F0ZXNfQm9yZWRPZkR1cGxpY2F0ZXM',
-  steady: 'U3RlYWR5U3RhdGVTdG9yYWdlX1N0ZWFkeVN0YXRlU3RvcmE',
-  pending: 'UGVuZGluZ0NlcnRpZmljYXRpb25fUGVuZGluZ0NlcnRpZmk',
-  maxed: 'TWF4aW11bUxpZmV0aW1lX01heGltdW1MaWZldGltZV9NYXg',
-} as const

package/src/e2e.ts

@@ -1,46 +0,0 @@
-// End-to-end build only (`vite build --mode e2e`; main.ts loads this when MODE is `e2e` and VITE_E2E is `1`, both static, so every other
-// build drops it). A mock wallet is registered like an extension, and the owned-blob list is filled in advance (a session cache the app
-// reads through `useOwnedBlobs`), so the connected screens can be shown and checked without a network or a funded key. The upload itself
-// needs a relay and storage nodes: it is exercised by the localnet spec, not here.
-import { MOCK_ADDRESS, installE2eWallet } from '@meddleware/wallet-adapter/testing'
-import { browserStorage, pendingCertifyKey, savePendingCertify } from '@meddleware/walrus-storage-client/flow'
-import type { OwnedBlob } from '@meddleware/walrus-storage-client'
-import { useOwnedBlobs } from './composables/useOwnedBlobs.js'
-import { E2E_BLOBS, E2E_EPOCH } from './e2e-data.js'
-
-const hex = (byte: string) => `0x${byte.repeat(32)}`
-
-const blob = (n: number, blobId: string, over: Partial<OwnedBlob>): OwnedBlob => ({
-  objectId: hex(n.toString(16).padStart(2, '0')),
-  blobId,
-  size: 48 * 1024,
-  startEpoch: 540,
-  endEpoch: 600,
-  certified: true,
-  deletable: false,
-  ...over,
-})
-
-export function installE2e(): void {
-  installE2eWallet()
-  const owned = [
-    // Re-uploads of the same content collapse into one row with two copies; the nearer one is about to expire.
-    blob(1, E2E_BLOBS.duplicated, { endEpoch: 565 }),
-    blob(2, E2E_BLOBS.duplicated, { endEpoch: 566, size: 48 * 1024 }),
-    blob(3, E2E_BLOBS.steady, { endEpoch: 600, size: 3 * 1024 * 1024 }),
-    // Uploaded but not certified, with the certificate still stored: Certify is offered.
-    blob(4, E2E_BLOBS.pending, { endEpoch: 580, certified: false, deletable: true }),
-    // Already as far ahead as the chain allows: nothing to extend.
-    blob(5, E2E_BLOBS.maxed, { endEpoch: 613, size: 512 }),
-  ]
-  savePendingCertify(browserStorage(), pendingCertifyKey('testnet', MOCK_ADDRESS), {
-    blobId: E2E_BLOBS.pending,
-    blobObjectId: owned[3].objectId,
-    certificate: 'ZTJlLWNlcnRpZmljYXRl',
-    deletable: true,
-  })
-  const state = useOwnedBlobs()
-  state.blobs.value = owned.sort((a, b) => a.endEpoch - b.endEpoch)
-  state.currentEpoch.value = E2E_EPOCH
-  state.loadedFor.value = `testnet|${MOCK_ADDRESS}`
-}