#!/usr/bin/env bash
# The committed dist/ must be exactly what a fresh build of src/ produces —
# a stale dist would ship behavior the sources don't show.
set -euo pipefail
cd "$(dirname "$0")/.."

# a stale in-tree shadow cache can mask clean-clone divergence
rm -rf .shadow-cljs

npm run --silent build >/dev/null
if [ -n "$(git status --porcelain dist)" ]; then
  echo "ABORT: dist/ is stale — commit the rebuilt output first:" >&2
  git status --porcelain dist >&2
  exit 1
fi
# macOS home-dir prefix, built from pieces: the published bytes of this
# script must never contain the pattern the idpat leak scan hunts for
LEAKPAT='/Use''rs/'
if grep -rF "$LEAKPAT" dist; then
  echo "ABORT: local filesystem path embedded in dist/" >&2
  exit 1
fi
echo "check-dist: OK (committed dist matches a fresh build, no local paths)"