#!/usr/bin/env bash
set -euo pipefail

PROJECT_ROOT="$(cd "$(dirname "$0")/.." && pwd)"
OUTPUT="${1:-$PROJECT_ROOT/artifacts/polyform-source.tar.gz}"

mkdir -p "$(dirname "$OUTPUT")"
tar -C "$PROJECT_ROOT" -czf "$OUTPUT" \
    --exclude=.git \
    --exclude=.polyform \
    --exclude=target \
    --exclude=artifacts \
    --exclude=dashboard/node_modules \
    --exclude=dashboard/dist \
    --exclude=backend/.venv \
    --exclude=backend/.pytest_cache \
    --exclude='**/__pycache__' \
    --exclude=.DS_Store \
    .

if tar -tzf "$OUTPUT" | grep -Eq '(^|/)\.polyform(/|$)|signing-key\.json'; then
    printf 'Refusing to publish an archive containing private Polyform state.\n' >&2
    exit 1
fi

printf 'Safe source archive written to %s\n' "$OUTPUT"
