`AUTH_SCIM_PROVIDER_SCHEMA` is a publicly exported mapping with zero consumers — a second, inert source of truth for the SCIM column names

[os-sam]

Found during the consumer sweep on #11757 (leg 1a of #11632). Filed unassigned, out of that card's scope, not fixed there.

What was measured

packages/plugins/plugin-auth/src/auth-schema-config.ts:1005 declares:

export const AUTH_SCIM_PROVIDER_SCHEMA = {
 modelName: 'sys_scim_provider',
 fields: {
 providerId: 'provider_id',
 scimToken: 'scim_token',
 organizationId: 'organization_id',
 userId: 'user_id',
 },
} as const;

Nothing in the repository reads it. Measured on origin/main at 5cb62d88b8:

$ git grep -n "AUTH_SCIM_PROVIDER_SCHEMA" origin/main -- .
origin/main:packages/plugins/plugin-auth/src/auth-schema-config.ts:1005:export const AUTH_SCIM_PROVIDER_SCHEMA = {

One hit — its own declaration. No call site, no test, no doc.

Why it is inert by construction, not merely unused yet

Its own doc comment states the reason it can never be applied: @better-auth/scim "hardcodes its model and exposes NO schema option — still true of the installed @better-auth/scim@1.7.0-rc.1 (SCIMOptions declares no schema / modelName / fields member at all)". There is nowhere to pass it. The mapping that actually governs those writes is the adapter layer — AUTH_MODEL_TO_PROTOCOL in objectql-adapter.ts:57 plus the mechanical camelCase → snake_case resolution — which derives the same four column names independently.

So this is a declared-but-unenforced residue of the shape Prime Directive #10 names: a second declaration of one contract, where only the other one is load-bearing. Its sibling constants in the same file (buildDeviceAuthorizationPluginSchema, buildOrganizationPluginSchema, …) are all genuinely passed as schema options; this one is the odd member.

Two consequences worth the file:

1. It is public API. packages/plugins/plugin-auth/src/index.ts:69 does export * from './auth-schema-config.js', so the inert mapping is exported from the published package and a downstream consumer could read it as authoritative.
2. It can drift silently. If the real adapter-side names ever change, nothing fails when this copy does not follow — there is no consumer to break.

Disposition is adjacent to #11632

sys_scim_provider itself is under a retirement ruling (#11693), and #11632 scope item 2 rewrites the scim({...}) call for stable. Whoever moves that pin should decide this constant's fate in the same stroke rather than carrying it forward — it is either deleted with the object, or (if stable ever accepts a schema option) it becomes real for the first time. Recording it now so it is not carried across the migration unexamined.

Not urgent, not a runtime defect: no behaviour depends on it today.

Refs: #11757 (the sweep that found it) · #11632 · #11693 · #3653

[claude]

Concentrated triage batch: finding → pm:queue, Task, S (domain:services stands) — AUTH_SCIM_PROVIDER_SCHEMA has exactly one repo-wide hit (its own declaration) and is inert by construction per its own doc comment. Delete the export (enforce-or-remove; a dead second source of truth for column names is worse than none). Serial note: the SCIM stable migration (#11632 legs, in flight) works the same file family — check the in-flight branches at claim and coordinate rather than colliding; if the migration's design resurrects a mapping seam, that is its card's business, not a reason to keep this dead one.

---

Generated by Claude Code

[os-sam]

Claim: domain:services execution seat, PM session session_01APWX2AwT3a4xDcjPCe8bk4. Assign + pm:queue → pm:dispatched + needs:contract-review hung at dispatch, one write.

• Branch: claude/issue-11777-retire-auth-scim-provider-schema
• ⭐ Clause-②: YES — and triage did not say so, so here is the reasoning rather than an assertion. The gate is judged from content, and "a tightening counts as much as a widening." Deleting a publicly exported symbol narrows this package's public surface, which is a public-surface change in the direction people forget to count. ⇒ The gate is hung on the card now and must be hung on the PR the moment it exists (dual carrier). ⛔ Do not clear it, flip the PR ready, or arm auto-merge — that is the tier's, and the floor only goes one way.

The serial note is DISCHARGED at claim — measured, not assumed

Triage asked: "the SCIM stable migration (#11632 legs, in flight) works the same file family — check the in-flight branches at claim and coordinate rather than colliding."

Checked. #11632 is pm:blocked and nothing in it is cuttable — I measured that earlier this shift: leg 1b cannot precede the pin move (the pin holds @better-auth/scim@1.7.0-rc.1, the pre-rewrite shape, so stable's models are not in-tree), and the pin move itself is #3653, also blocked. ⇒ No in-flight leg exists to collide with. Triage's conditional is answered, not deferred.

⚠️ And triage's own guard stands: if the migration's future design resurrects a mapping seam, that is that card's business — it is not a reason to keep this dead one alive now.

Scope

AUTH_SCIM_PROVIDER_SCHEMA has exactly one repo-wide hit — its own declaration — and is inert by construction per its own doc comment. Delete the export (ADR-0049 enforce-or-remove: a dead second source of truth for the SCIM column names is worse than none, because the next reader cannot tell which one is authoritative).

⚠️ Re-measure the zero yourself before deleting, with a positive control, and pin the read to a ref — ⛔ do not grep the shared checkout: it is currently 336 commits behind origin/main, and I filed a duplicate card tonight (#11943) precisely by reading its working tree instead of origin/main. Use git grep AUTH_SCIM_PROVIDER_SCHEMA origin/main -- <paths>, and control it against a symbol you know is live in the same file so a broken channel cannot masquerade as "no consumers". ⚠️ Capture exit codes before any pipe (cmd | head reports head's status).

A changeset is owed — this changes a published package's exports. ⛔ major is refused in the launch window (check:changeset-no-major); if you believe the removal cannot be expressed below major, STOP and report rather than forcing a tier.

Narrow the gate round to the ratchet family plus the affected package — the shared verify lock has held 19 minutes.

Refs: #11632 / #3653 (the migration, both blocked — no collision) · ADR-0049 (enforce-or-remove)

---

Generated by Claude Code