feat(auth,platform-objects,spec): migrate @better-auth/scim to stable 1.7.1 — provision the seven models, app-owned bearer verification (#3653)

Part of #3653 (leg 2' of epic #11632). The pin resolves to 1.7.1 EXACTLY
(not ^1.7.1, which resolves to 1.7.2 whose better-auth/core ^1.7.2 peers
only the workspace overrides' silencing would 'satisfy'; floating is its
own follow-up card).

- pnpm-workspace.yaml + plugin-auth: exact 1.7.1 pin, stale rc-hold
  comment blocks rewritten to the landed state.
- packages/platform-objects/src/identity/: the seven stable models
  provisioned as platform objects (scimConnectionBinding, scimGroup,
  scimGroupMember, scimIdentityTombstone, scimProjectionGrant,
  scimSubject, scimUser) plus sys_scim_connection_credential, the
  ObjectStack-owned credential store for the app-owned verifyBearerToken
  route (stable upstream stores no credential at all). Translation
  bundles regenerated with pnpm i18n:extract only.
- packages/spec platform-object-names.ts: eight additive registry names
  (the measured-unsplittable spec edit; sys_scim_provider stays — its
  retirement is #11757's).
- plugin-security BETTER_AUTH_MANAGED_OBJECTS: the seven library-managed
  names, forced additively by the bidirectional drift pin
  (default-permission-sets.test.ts) the moment the objects declare
  managedBy: 'better-auth'.
- plugin-auth scim-connection-service.ts: mint + digest + verify owned
  outright; at rest only HMAC-SHA-256(secret, domain-separated bearer),
  base64url — at parity or better than the rc.1 unsalted SHA-256.
- auth-manager.ts: stable constructor shape — connections: [] plus
  authentication.verifyBearerToken resolving the connection from a
  sys_scim_connection_credential row at request time; auth secret
  resolved once (memoized) so digests and better-auth share key material.
- objectql-adapter.ts: seven AUTH_MODEL_TO_PROTOCOL bridge entries, and
  NATIVE adapter transactions over engine.transaction({ require: true })
  — stable scim refuses the sequential fallback by assertion.
- better-auth-schema-parity.test.ts: KNOWN_UNMAPPED_MODELS shrinks to
  the empty set (exact-set assertion kept, both directions).
- credential-at-rest-posture.test.ts: restructured honestly — the
  upstream-cleartext control arm is no longer measurable (upstream
  stores nothing); its successor pins that vacating fact plus the keyed
  digest relationship, negatives for the unkeyed/wrong-key/undomained
  shapes, and live 200/401 rejection paths incl. revocation and expiry.

Co-authored-by: Claude <noreply@anthropic.com>

Author: claude

packages/platform-objects/scripts/i18n-extract.config.ts

@@ -104,6 +104,14 @@ import {
   SysJwks,
   SysSsoProvider,
   SysScimProvider,
+  SysScimConnectionBinding,
+  SysScimConnectionCredential,
+  SysScimGroup,
+  SysScimGroupMember,
+  SysScimIdentityTombstone,
+  SysScimProjectionGrant,
+  SysScimSubject,
+  SysScimUser,
 } from '../src/identity/index.js';
 
 // ── Security ──────────────────────────────────────────────────────────────
@@ -241,6 +249,16 @@ const config: ObjectStackDefinition = defineStack({
     SysJwks,
     SysSsoProvider,
     SysScimProvider,
+    // Stable @better-auth/scim 1.7.x model set + the ObjectStack-owned
+    // credential store (#3653). SysScimProvider above retires under #11757.
+    SysScimConnectionBinding,
+    SysScimConnectionCredential,
+    SysScimGroup,
+    SysScimGroupMember,
+    SysScimIdentityTombstone,
+    SysScimProjectionGrant,
+    SysScimSubject,
+    SysScimUser,
 
     // Security: RBAC moved to @objectstack/plugin-security, sharing to
     // @objectstack/plugin-sharing (ADR-0029 K2 / D8).

packages/platform-objects/src/apps/translations/bundle-ownership.test.ts

@@ -26,6 +26,11 @@ const OWNED_OBJECTS = new Set([
   'sys_oauth_client_resource', 'sys_oauth_client_assertion', 'sys_jwks',
   // identity — external SSO / SCIM providers (admin-facing, better-auth-managed)
   'sys_sso_provider', 'sys_scim_provider',
+  // identity — stable @better-auth/scim 1.7.x model set + the ObjectStack-owned
+  // credential store (#3653; sys_scim_provider above retires under #11757)
+  'sys_scim_connection_binding', 'sys_scim_connection_credential', 'sys_scim_group',
+  'sys_scim_group_member', 'sys_scim_identity_tombstone', 'sys_scim_projection_grant',
+  'sys_scim_subject', 'sys_scim_user',
   // audit / messaging-adjacent (still owned here)
   'sys_notification', 'sys_attachment', 'sys_email', 'sys_email_template',
   'sys_saved_report', 'sys_report_schedule', 'sys_job', 'sys_job_run', 'sys_job_queue',