fix(cli): the scaffolded pnpm-workspace.yaml records the retired @better-auth/scim>better-call rule instead of advertising it

.changeset/17093-scaffold-scim-retirement-note.md

@@ -0,0 +1,26 @@
+---
+'@objectstack/cli': patch
+'create-objectstack': patch
+---
+
+The scaffolded `pnpm-workspace.yaml` records the retired `@better-auth/scim>better-call` peer rule instead of advertising it as live
+
+`objectstack init` wrote a paragraph into every project it scaffolds explaining
+an `@better-auth/scim>better-call` suppression that is not in the map it
+annotates — the entry retired with objectstack#3653, and `init.test.ts` pins its
+absence. All three of its claims were false on today's tree as well:
+`@better-auth/scim` is not "held at a release candidate deliberately" (it is
+pinned at exact stable `1.7.3`), and stable `@better-auth/scim@1.7.3` declares
+`peerDependencies["better-call"]` as the exact string `1.4.0` — the single copy
+`better-auth@1.7.3` itself depends on — so the `1.3.7` skew the paragraph
+described does not exist.
+
+It now records the retirement, in the shape `create-objectstack`'s bundled
+`blank` template already used, and dates the measurement the way the
+neighbouring `better-sqlite3` paragraph in the same block does. Both scaffold
+paths previously named `1.7.1` as the current pin; both now name the measured
+`1.7.3`, so the two paths tell a user the same thing.
+
+Comments only — no declaration moves. The rendered `allowedVersions` map is
+byte-identical before and after, so no resolution, lockfile or suppression
+changes.

packages/cli/src/commands/init.ts

@@ -139,9 +139,11 @@ export const SCAFFOLD_BUILT_DEPENDENCIES = ['better-sqlite3', 'esbuild'];
  *
  *  - RETIRED (#3653): `@better-auth/scim>better-call` — the rc.1-era scim pin
  *    peered an exact `better-call@1.3.7` against the host's 1.4.0, and this
- *    map declared that skew away. Stable `@better-auth/scim@1.7.1` (the pin
- *    since #3653 landed) peers `better-call@1.4.0`, so the skew is genuinely
- *    gone and the entry retired WITH the pin move, as its ratchet demanded.
+ *    map declared that skew away. Stable scim peers `better-call@1.4.0`, so
+ *    the skew is genuinely gone and the entry retired WITH the pin move, as
+ *    its ratchet demanded. Measured on 1.7.1 when #3653 landed; re-read
+ *    2026-09-12 on `1.7.3`, the pin today, off the installed manifest —
+ *    `peerDependencies['better-call']` is the exact string `1.4.0`.
  *
  *  - `<four>@better-auth/utils` — `@better-auth/core`, `/oauth-provider`,
  *    `/scim` and `/sso` each peer an EXACT `@better-auth/utils@0.4.2`, while a
@@ -194,8 +196,9 @@ export const SCAFFOLD_BUILT_DEPENDENCIES = ['better-sqlite3', 'esbuild'];
 export const SCAFFOLD_ALLOWED_PEER_VERSIONS: Record<string, string> = {
   'better-auth>better-sqlite3': '13',
   // '@better-auth/scim>better-call' retired with the scim rc pin (#3653) —
-  // stable 1.7.1 peers better-call@1.4.0 exactly, the copy every install
-  // already resolves. init.test.ts pins its ABSENCE now.
+  // stable scim peers better-call@1.4.0 exactly (re-read 2026-09-12 on the
+  // 1.7.3 pin), the copy every install already resolves. init.test.ts pins
+  // its ABSENCE now.
   '@better-auth/core>@better-auth/utils': '0.5.0',
   '@better-auth/oauth-provider>@better-auth/utils': '0.5.0',
   '@better-auth/scim>@better-auth/utils': '0.5.0',
@@ -514,10 +517,12 @@ export function renderPnpmWorkspaceYaml(
       '#   range is stale; pinning back to 12 would just install a second,',
       '#   unused native copy.',
       '#',
-      '#   @better-auth/scim (held at a release candidate deliberately) peers an',
-      '#   exact better-call 1.3.7, while better-auth itself depends on 1.4.0. A',
-      '#   better-auth plugin has to share the host\'s better-call instance, so',
-      '#   the single 1.4.0 copy is the correct resolution.',
+      '#   (The \'@better-auth/scim>better-call\' entry that used to sit here is',
+      '#   retired. The rc-era scim pin peered an exact better-call 1.3.7 against',
+      '#   better-auth\'s own 1.4.0 and this map declared that skew away; the pin',
+      '#   is a stable release now, and @better-auth/scim 1.7.3 peers an exact',
+      '#   better-call 1.4.0 — the one copy better-auth depends on. Re-measured',
+      '#   2026-09-12 off the installed manifest: the skew is gone.)',
       '#',
       '#   @better-auth/core, /oauth-provider, /scim and /sso each peer an exact',
       '#   @better-auth/utils 0.4.2, while better-call (better-auth\'s own HTTP',

packages/create-objectstack/src/templates/blank/pnpm-workspace.yaml

@@ -50,8 +50,10 @@ allowBuilds:
 #   would clear the report only by installing a second, unused native copy.
 #
 #   (The '@better-auth/scim>better-call' entry that used to sit here retired
-#   with the scim release-candidate pin — stable @better-auth/scim 1.7.1 peers
-#   better-call 1.4.0 exactly, so the skew it declared away is gone.)
+#   with the scim release-candidate pin — stable @better-auth/scim 1.7.3 peers
+#   better-call 1.4.0 exactly, so the skew it declared away is gone. First
+#   measured on 1.7.1 when the entry retired; re-read 2026-09-12 on the 1.7.3
+#   pin, off the installed manifest.)
 #
 #   @better-auth/core, @better-auth/oauth-provider, @better-auth/scim and
 #   @better-auth/sso each peer an exact @better-auth/utils 0.4.2, while the