#!/usr/bin/env node
// tools/scripts/lint-better-auth-schema-sync.mjs
//
// Source: 04-CONTEXT.md D-08/D-25 — drift guard.
// Regenerates packages/db/src/auth-tables.ts to a tmp path, byte-compares
// against the committed copy, exits 1 on diff. Runs as a step in
// scripts/verify-phase-4.mjs so any silent drift between the codegen
// config (auth.ts at workspace root) and the committed auth-tables.ts
// surfaces in CI.

import { spawnSync } from 'node:child_process';
import { readFileSync, mkdtempSync } from 'node:fs';
import { tmpdir } from 'node:os';
import { join } from 'node:path';

const tmp = mkdtempSync(join(tmpdir(), 'rebno-auth-'));
const tmpOut = join(tmp, 'auth-tables.ts');

const r = spawnSync(
  'pnpm',
  ['exec', 'better-auth', 'generate', '--output', tmpOut, '-y'],
  {
    encoding: 'utf-8',
    shell: process.platform === 'win32',
  },
);

if (r.status !== 0) {
  process.stderr.write(`better-auth generate failed:\n${r.stderr}\n${r.stdout}\n`);
  process.exit(1);
}

const fresh = readFileSync(tmpOut, 'utf-8');
const committed = readFileSync('packages/db/src/auth-tables.ts', 'utf-8');

if (fresh !== committed) {
  process.stderr.write(
    'packages/db/src/auth-tables.ts drift. Run `pnpm db:auth:gen` and commit the result.\n',
  );
  process.exit(1);
}

console.log('lint-better-auth-schema-sync: OK');
process.exit(0);