From df98a602f96768d98b2366fd2987816a804a1c46 Mon Sep 17 00:00:00 2001
From: Wickedness <y2keui@nate.com>
Date: Sun, 5 Jul 2026 17:29:33 +0900
Subject: [PATCH] Verify public debug API disabled

---
 scripts/verify-public-deploy.mjs | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/scripts/verify-public-deploy.mjs b/scripts/verify-public-deploy.mjs
index b2b21eb..a6658ac 100644
--- a/scripts/verify-public-deploy.mjs
+++ b/scripts/verify-public-deploy.mjs
@@ -43,6 +43,7 @@ try {
     return {
       title: document.title,
       canvasCount: document.querySelectorAll('canvas').length,
+      debugApiPresent: Boolean(window.__HEROS_DEBUG__),
       canvas: canvas
         ? {
             width: canvas.width,
@@ -88,6 +89,7 @@ try {
 
   assert(state.title?.trim().length > 0, `Expected deployed page title: ${JSON.stringify(state)}`);
   assert(state.canvasCount === 1, `Expected exactly one game canvas: ${JSON.stringify(state)}`);
+  assert(state.debugApiPresent === false, `Expected public deploy to keep debug API disabled: ${JSON.stringify(state)}`);
   assert(state.canvas?.width >= 960 && state.canvas?.height >= 540, `Expected desktop-size game canvas: ${JSON.stringify(state)}`);
   assert(state.canvas?.pixelProbe?.readable === true, `Expected readable canvas pixels: ${JSON.stringify(state)}`);
   assert(state.canvas.pixelProbe.sampleCount >= 500, `Expected enough canvas pixel samples: ${JSON.stringify(state)}`);