refactor(plugin-auth): remove the inert AUTH_SCIM_PROVIDER_SCHEMA export (#12008)

`AUTH_SCIM_PROVIDER_SCHEMA` was a publicly exported `scimProvider` column
mapping with zero consumers -- exactly one repo-wide hit, its own declaration
-- and inert by construction: `@better-auth/scim` hardcodes its model and
exposes no `schema` option (still true of the installed
`@better-auth/scim@1.7.0-rc.1`, whose `SCIMOptions` declares no `schema` /
`modelName` / `fields` member), so there was nowhere to hand it.

Removed under ADR-0049 enforce-or-remove: it was a second source of truth for
the four SCIM column names, where the load-bearing one is the adapter layer
(`AUTH_MODEL_TO_PROTOCOL` + camelCase-to-snake_case field resolution in
`objectql-adapter.ts`) over the `sys_scim_provider` platform object. A dead
copy cannot fail when it drifts, and the next reader cannot tell which of the
two is authoritative. A NOTE in its place records why no mapping exists and
what owns the names instead, following the sibling sso NOTE in the same file.

Fixes #11777


Claude-Session: https://claude.ai/code/session_01APWX2AwT3a4xDcjPCe8bk4

Co-authored-by: Claude <noreply@anthropic.com>

Author: claude[bot]

.changeset/retire-auth-scim-provider-schema.md

@@ -0,0 +1,13 @@
+---
+'@objectstack/plugin-auth': minor
+---
+
+**BREAKING (public export removed):** `AUTH_SCIM_PROVIDER_SCHEMA` no longer exists. It was a `scimProvider` column mapping exported from `@objectstack/plugin-auth` (via `export * from './auth-schema-config.js'`) that nothing ever read — one repo-wide hit, its own declaration — and that nothing ever could: `@better-auth/scim` hardcodes its model and exposes no `schema` option, still true of the installed `@better-auth/scim@1.7.0-rc.1`, whose `SCIMOptions` declares no `schema`, `modelName` or `fields` member at all. Its sibling constants in the same file are genuinely passed to their plugins; this one had nowhere to go, by construction and by its own doc comment.
+
+Removed under ADR-0049 enforce-or-remove, because it was a **second source of truth** for the same four column names. The load-bearing one is the adapter layer — `AUTH_MODEL_TO_PROTOCOL` plus the mechanical camelCase-to-snake_case field resolution in `objectql-adapter.ts`, over the `sys_scim_provider` platform object that declares the columns — and it is pinned by the dedicated sso/scim block in `better-auth-schema-parity.test.ts`. A dead copy is worse than none: nothing fails when it drifts from the live names, and the next reader cannot tell which of the two is authoritative. A comment in its place records why no such mapping exists and what owns the names instead, so it is not re-added.
+
+Behaviour is unchanged. No SCIM column name, platform object, adapter mapping or wire shape moves.
+
+Breaking ships as `minor` per the launch-window convention (`scripts/check-changeset-no-major.mjs`).
+
+<!-- adr-0087: not-required (no-migration-prescription) A dead public constant is deleted; nothing consumed it in this repo, in the sibling repos or in the org (measured on origin/main and by org-wide code search, with a positive control on a live symbol in the same file), so no caller has code to rewrite. It is not a metadata surface: no Zod schema, no `packages/spec` declaration, no authorable key and no stored representation, so `objectstack migrate meta` has nothing to visit and there is no tombstone to mint. The column names it duplicated are unchanged and keep their real declaration on the `sys_scim_provider` platform object; an external importer, if one exists, is told by the compiler at the import line, which is more precise than a ledger entry. Nothing to migrate, so no migration is prescribed. -->

packages/plugins/plugin-auth/src/auth-schema-config.ts

@@ -980,37 +980,23 @@ export const AUTH_SSO_PROVIDER_SCHEMA = {
 // SCIM plugin – scimProvider table (@better-auth/scim)
 // ---------------------------------------------------------------------------
 
-/**
- * `@better-auth/scim` plugin `scimProvider` model mapping.
- *
- * Each row is a SCIM connection: a bearer token an external IdP (Okta / Entra)
- * uses to auto-provision / deprovision THIS environment's users — the env is
- * the SCIM Service Provider (ADR-0071). This plugin hardcodes its model and
- * exposes NO `schema` option — still true of the installed
- * `@better-auth/scim@1.7.0-rc.1` (`SCIMOptions` declares no `schema` /
- * `modelName` / `fields` member at all; measured 2026-08-19). It is no longer
- * true of `@better-auth/sso@1.7.1`, which this doc used to lean on for the
- * comparison and which now accepts one (#8224). So for scim — and for scim
- * alone — the ADAPTER layer (AUTH_MODEL_TO_PROTOCOL + field resolution in
- * objectql-adapter.ts) is the only available route: the mapping cannot be
- * handed to the plugin.
- *
- * | camelCase (better-auth) | snake_case (ObjectStack) |
- * |:------------------------|:-------------------------|
- * | providerId              | provider_id              |
- * | scimToken               | scim_token               |
- * | organizationId          | organization_id          |
- * | userId                  | user_id                  |
- */
-export const AUTH_SCIM_PROVIDER_SCHEMA = {
-  modelName: 'sys_scim_provider',
-  fields: {
-    providerId: 'provider_id',
-    scimToken: 'scim_token',
-    organizationId: 'organization_id',
-    userId: 'user_id',
-  },
-} as const;
+// NOTE: there is intentionally no `scimProvider` mapping constant here, and no
+// `buildScimPluginSchema()`. `@better-auth/scim` hardcodes its model and exposes
+// NO `schema` option — still true of the installed `@better-auth/scim@1.7.0-rc.1`
+// (`SCIMOptions` declares no `schema` / `modelName` / `fields` member at all;
+// measured 2026-08-19), so there is nowhere to hand one. This is no longer true
+// of `@better-auth/sso@1.7.1`, which now accepts one (#8224) — for scim, and for
+// scim alone, the ADAPTER layer is the only available route.
+//
+// `sys_scim_provider`'s column names are therefore owned by that adapter layer
+// alone: AUTH_MODEL_TO_PROTOCOL + the camelCase → snake_case field resolution in
+// objectql-adapter.ts, pinned by the sso/scim block in
+// better-auth-schema-parity.test.ts. A copy of those names here would be a
+// SECOND declaration of one contract that nothing reads and nothing enforces —
+// it could drift from the live one with every gate green, and the next reader
+// could not tell which was authoritative (ADR-0049 enforce-or-remove). Do not
+// re-add one unless the plugin grows a `schema` option AND it is passed there.
+// See ADR-0071.
 
 // ---------------------------------------------------------------------------
 // Helper: build device-authorization plugin schema option