#!/usr/bin/env node

'use strict';

const fs = require('fs');
const path = require('path');

function fail(message) {
  process.stderr.write(`cielara: refusing to publish: ${message}\n`);
  process.stderr.write('Use .github/workflows/release.yml so the package is production-locked before publishing.\n');
  process.exit(1);
}

const root = path.resolve(__dirname, '..');
const licensePath = path.join(root, 'lib', 'license.js');
const license = fs.readFileSync(licensePath, 'utf8');

if (!license.includes('const DEV_BUILD = false;')) {
  fail('lib/license.js still has dev-mode licensing enabled.');
}

const keyMatch = license.match(/\{ kid: 'v1', publicKeyBase64url: '([^']+)' \}/);
if (!keyMatch) {
  fail('lib/license.js does not contain an embedded v1 portal public key.');
}

if (!/^[A-Za-z0-9_-]{43}$/.test(keyMatch[1])) {
  fail('embedded v1 portal public key is not a 32-byte base64url Ed25519 key.');
}
