fix: harden release script with clean build and verification

[adnaan]

Summary

• Problem: v0.8.8 was published to npm with stale build artifacts — the shouldSkipUpdate fix from PR fix: skip patching focused form elements during DOM update #32 was missing from all dist/ files in the published package
• Root cause: build_and_test() ran npm run build on top of existing dist/ without cleaning first, and no verification caught the stale artifacts
• Fix: Adds clean-before-build and post-build verification to scripts/release.sh

Changes to scripts/release.sh:

• build_and_test() now runs npm run clean before npm run build
• New verify_build() function: checks dist files exist and are non-empty, smoke tests the module export, validates version consistency
• New verify_package_contents() function: runs npm pack --dry-run to verify the tarball includes required files
• Both verification functions wired into the main release flow between build and commit

Test plan

• bash -n scripts/release.sh — syntax check passes
• npm test — all 278 tests pass
• npm run clean && npm run build — verified shouldSkipUpdate present in all dist/ files
• After merge: run ./scripts/release.sh to publish v0.8.9 with correct artifacts

🤖 Generated with Claude Code

[claude]

Good fix for the stale artifact problem. One bug to address before merging:

Missing error handling on npm run clean — In build_and_test(), the new npm run clean call has no || { ...; exit 1 } guard, unlike npm run build immediately below it. If clean fails (e.g. the script is missing from package.json), the release continues on stale artifacts — exactly the problem this PR is trying to prevent.

# Should be:
npm run clean || {
    log_error "Clean failed, aborting release"
    exit 1
}

Minor: verify_package_contents uses grep -q "$f" without anchoring, so dist/livetemplate-client.js.map would satisfy the check for dist/livetemplate-client.js. Not a real risk with these specific filenames, but worth noting.

The verify_build and verify_package_contents additions are solid — good defense against a repeat of the v0.8.8 incident.

[Copilot]

Pull request overview

This PR hardens scripts/release.sh to prevent publishing stale dist/ artifacts to npm by enforcing a clean build and adding post-build/package verification steps.

Changes:

• Run npm run clean before npm run build in build_and_test().
• Add verify_build() to validate required dist/ outputs, smoke-test the built module export, and confirm version consistency.
• Add verify_package_contents() to ensure npm pack --dry-run includes required build artifacts before tagging/publishing.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The grep -q "$f" check can produce false positives (e.g., dist/livetemplate-client.js will also match dist/livetemplate-client.js.map). This undermines the verification goal—consider matching the exact filename at end-of-line, using fixed-string matching, or parsing npm pack --dry-run --json output to reliably assert required files are included.

[Copilot]

npm run clean is not wrapped with the same error handling as tests/build. With set -e, a clean failure will abort the script without a clear log_error message; consider adding an explicit failure handler (similar to the npm test / npm run build blocks) so the release output is actionable.

Suggested change

	npm run clean
	npm run clean || {
	log_error "Clean failed, aborting release"
	exit 1
	}

[claude]

Review: looks good overall, one potential bug to check

The clean-before-build and post-build verification approach is the right fix for the stale artifact problem.

Potential bug in verify_package_contents:

if ! echo "$pack_output" | grep -qF "/"; then

The grep pattern has a leading / (e.g. /dist/livetemplate-client.js), but npm pack --dry-run output typically lists paths without a leading slash:

npm notice 15.2kB  dist/livetemplate-client.js

This means the check will never match and will always fail, making verify_package_contents a hard blocker on every release run. Drop the leading /:

if ! echo "$pack_output" | grep -qF "$f"; then

Everything else looks solid:

• Clean step placement (before build, abort on failure) is correct
• verify_build artifact checks (-s for non-empty), smoke test, and version consistency check are all sensible
• jq -r '.version' package.json for version check is more reliable than grep

Suggest fixing the grep pattern before merging.

[claude]

Review

Good fix for the stale artifact problem. A few actionable items:

Bug: Smoke test may fail for ESM output

If package.json has "type": "module", the require() call in verify_build() will throw. Worth verifying the dist output is CJS before the v0.8.9 release run, or switching to --input-type=commonjs.

Minor: npm run clean is a hard failure

If clean is not defined in package.json scripts, the release aborts before building. Worth confirming this script is always present, or softening to a warning.

npm pack --dry-run output parsing is fragile

npm v6 and v7+ format this output differently. Since verify_build() already checks files exist on disk, verify_package_contents() only adds value for catching .npmignore/files misconfig. If that is the intent, inspecting an actual tarball (npm pack without --dry-run) is more reliable.