diff --git a/.changeset/17093-scaffold-scim-retirement-note.md b/.changeset/17093-scaffold-scim-retirement-note.md new file mode 100644 index 0000000000..e5a729e2e2 --- /dev/null +++ b/.changeset/17093-scaffold-scim-retirement-note.md @@ -0,0 +1,26 @@ +--- +'@objectstack/cli': patch +'create-objectstack': patch +--- + +The scaffolded `pnpm-workspace.yaml` records the retired `@better-auth/scim>better-call` peer rule instead of advertising it as live + +`objectstack init` wrote a paragraph into every project it scaffolds explaining +an `@better-auth/scim>better-call` suppression that is not in the map it +annotates — the entry retired with objectstack#3653, and `init.test.ts` pins its +absence. All three of its claims were false on today's tree as well: +`@better-auth/scim` is not "held at a release candidate deliberately" (it is +pinned at exact stable `1.7.3`), and stable `@better-auth/scim@1.7.3` declares +`peerDependencies["better-call"]` as the exact string `1.4.0` — the single copy +`better-auth@1.7.3` itself depends on — so the `1.3.7` skew the paragraph +described does not exist. + +It now records the retirement, in the shape `create-objectstack`'s bundled +`blank` template already used, and dates the measurement the way the +neighbouring `better-sqlite3` paragraph in the same block does. Both scaffold +paths previously named `1.7.1` as the current pin; both now name the measured +`1.7.3`, so the two paths tell a user the same thing. + +Comments only — no declaration moves. The rendered `allowedVersions` map is +byte-identical before and after, so no resolution, lockfile or suppression +changes. diff --git a/packages/cli/src/commands/init.ts b/packages/cli/src/commands/init.ts index abccede21e..b396475b5f 100644 --- a/packages/cli/src/commands/init.ts +++ b/packages/cli/src/commands/init.ts @@ -139,9 +139,11 @@ export const SCAFFOLD_BUILT_DEPENDENCIES = ['better-sqlite3', 'esbuild']; * * - RETIRED (#3653): `@better-auth/scim>better-call` — the rc.1-era scim pin * peered an exact `better-call@1.3.7` against the host's 1.4.0, and this - * map declared that skew away. Stable `@better-auth/scim@1.7.1` (the pin - * since #3653 landed) peers `better-call@1.4.0`, so the skew is genuinely - * gone and the entry retired WITH the pin move, as its ratchet demanded. + * map declared that skew away. Stable scim peers `better-call@1.4.0`, so + * the skew is genuinely gone and the entry retired WITH the pin move, as + * its ratchet demanded. Measured on 1.7.1 when #3653 landed; re-read + * 2026-09-12 on `1.7.3`, the pin today, off the installed manifest — + * `peerDependencies['better-call']` is the exact string `1.4.0`. * * - `@better-auth/utils` — `@better-auth/core`, `/oauth-provider`, * `/scim` and `/sso` each peer an EXACT `@better-auth/utils@0.4.2`, while a @@ -194,8 +196,9 @@ export const SCAFFOLD_BUILT_DEPENDENCIES = ['better-sqlite3', 'esbuild']; export const SCAFFOLD_ALLOWED_PEER_VERSIONS: Record = { 'better-auth>better-sqlite3': '13', // '@better-auth/scim>better-call' retired with the scim rc pin (#3653) — - // stable 1.7.1 peers better-call@1.4.0 exactly, the copy every install - // already resolves. init.test.ts pins its ABSENCE now. + // stable scim peers better-call@1.4.0 exactly (re-read 2026-09-12 on the + // 1.7.3 pin), the copy every install already resolves. init.test.ts pins + // its ABSENCE now. '@better-auth/core>@better-auth/utils': '0.5.0', '@better-auth/oauth-provider>@better-auth/utils': '0.5.0', '@better-auth/scim>@better-auth/utils': '0.5.0', @@ -514,10 +517,12 @@ export function renderPnpmWorkspaceYaml( '# range is stale; pinning back to 12 would just install a second,', '# unused native copy.', '#', - '# @better-auth/scim (held at a release candidate deliberately) peers an', - '# exact better-call 1.3.7, while better-auth itself depends on 1.4.0. A', - '# better-auth plugin has to share the host\'s better-call instance, so', - '# the single 1.4.0 copy is the correct resolution.', + '# (The \'@better-auth/scim>better-call\' entry that used to sit here is', + '# retired. The rc-era scim pin peered an exact better-call 1.3.7 against', + '# better-auth\'s own 1.4.0 and this map declared that skew away; the pin', + '# is a stable release now, and @better-auth/scim 1.7.3 peers an exact', + '# better-call 1.4.0 — the one copy better-auth depends on. Re-measured', + '# 2026-09-12 off the installed manifest: the skew is gone.)', '#', '# @better-auth/core, /oauth-provider, /scim and /sso each peer an exact', '# @better-auth/utils 0.4.2, while better-call (better-auth\'s own HTTP', diff --git a/packages/create-objectstack/src/templates/blank/pnpm-workspace.yaml b/packages/create-objectstack/src/templates/blank/pnpm-workspace.yaml index da540ae634..ef9209b74d 100644 --- a/packages/create-objectstack/src/templates/blank/pnpm-workspace.yaml +++ b/packages/create-objectstack/src/templates/blank/pnpm-workspace.yaml @@ -50,8 +50,10 @@ allowBuilds: # would clear the report only by installing a second, unused native copy. # # (The '@better-auth/scim>better-call' entry that used to sit here retired -# with the scim release-candidate pin — stable @better-auth/scim 1.7.1 peers -# better-call 1.4.0 exactly, so the skew it declared away is gone.) +# with the scim release-candidate pin — stable @better-auth/scim 1.7.3 peers +# better-call 1.4.0 exactly, so the skew it declared away is gone. First +# measured on 1.7.1 when the entry retired; re-read 2026-09-12 on the 1.7.3 +# pin, off the installed manifest.) # # @better-auth/core, @better-auth/oauth-provider, @better-auth/scim and # @better-auth/sso each peer an exact @better-auth/utils 0.4.2, while the