test(plugin-auth): register the production object set in the two SCIM harnesses - #14751

Fixes #14615

Both SCIM harnesses re-spelled plugin-auth's object set by hand and omitted every
OAuth object. They now import authIdentityObjects from the plugin's own manifest
instead — the same array auth-plugin.ts registers at runtime and
objectstack.config.ts declares at compile time — so a harness cannot drift from a
real deployment by construction. Test-only diff; two files.

What actually emits the line, measured

The card attributes the ERROR to POST /sign-in/email. That is not the trigger.
The vendor's own source is unambiguous — @better-auth/oauth-provider 1.7.2,
dist/authorize-BmTe2VYG.mjs, prepareBackchannelLogoutPlan is installed as a
databaseHooks.session.delete.before hook (line 4419), not a sign-in hook. It
reads exactly two models, both keyed on sessionId:

const [accessTokens, refreshTokens] = await Promise.all([
  adapter.findMany({ model: "oauthAccessToken",  where }),
  adapter.findMany({ model: "oauthRefreshToken", where }),
]);
const affectedClientIds = new Set();
...
if (affectedClientIds.size === 0) return null;      // returns BEFORE reading oauthClient

So the reads that demanded a registration are sys_oauth_access_token and
sys_oauth_refresh_token, and they are demanded by session revocation, not by
sign-in. oauthClient (sys_oauth_application) is reached only when a token row was
found, which never happens in a harness whose tables are empty, and oauthConsent
(sys_oauth_consent) is not read by this seam at all. That is why the fix is not
"the four OAuth objects from the posture test": two of those four are not demanded by
any read here, and importing the production set is both narrower in intent and wider
in coverage than hand-picking either number.

Before / after — same command, quoted

pnpm --filter @objectstack/plugin-auth exec vitest run --maxWorkers=2 src/SUITE.test.ts

The 2 ERROR lines that remain in scim-transaction-scope are that suite's own
deliberately injected failure ([#14522 test] injected failure on insert sys_scim_user),
unchanged in both phases. A diff of the ERROR lines before vs after found no line
present only in the after phase in either suite: registering the production set
introduced no new noise.

Whole package, on the merged tree: Test Files 91 passed (91) / Tests 1862 passed (1862),
and 0 occurrences of the line package-wide.

Two of the card's premises did not survive measurement

Reported here rather than quietly worked around.

1. scim-transaction-scope.test.ts never emitted the line. Its before count is 0,
   not because its object list differs — it was byte-identical to the other suite's —
   but because it never deletes a session. Its sign-in in case (c) is not a trigger.
   Its gap was latent, and the change to it is prophylactic with a measured delta
   of 0 to 0. It is in this PR because it is the same harness shape in the card's
   declared surface, and it is now un-driftable rather than accidentally quiet.
2. The control is not evidence. The card's whole basis for the remedy was that
   credential-at-rest-posture.test.ts registers the OAuth objects and does not emit
   the line. It does not emit the line, but it drives no auth request at all — no
   sign-in, no sign-out, no revocation — so its 0 is not attributable to its
   registration list. The causal evidence for this fix is the vendor source above plus
   the direct 2 to 0 measurement, not the control.

Registering from the manifest rather than from AUTH_OBJECTS

The card named the posture test's AUTH_OBJECTS as the reference. This PR follows the
triage's direction on the card instead (#14615 comment of 2026-09-02): that list is
itself a hand-copied second spelling of authIdentityObjects, and adding four names to
two more hand-lists would give the repo four copies of one truth — while the card's own
strongest observation is that this gap "already was [copied], twice". Importing the
production array is the only version that stops the next copy. AUTH_OBJECTS in the
posture test is deliberately not touched here.

Scope

• No changeset: test-only, publishes nothing (plugin-auth's files is
  ["dist","README.md","CHANGELOG.md"]). This is pr-automation.yml's route 2,
  "tests-only ... apply the skip-changeset label", which is the label's own preferred
  case. Label applied.
• No product source touched. auth-manager.ts is held by PR fix(plugin-auth): bind the dev-admin seed's operator-provisioning ticket to more than the seed address (#14373) #14730 and is not in this
  diff; the back-channel planner is the vendor's and was not modified. The card's second
  remedy direction — discriminating an absent table as a benign read — is not
  addressed here and remains a product decision, exactly as the triage ruled.
• Export surface unchanged: git diff -U0 origin/main...HEAD | grep -E '^[+-].*export'
  returns nothing.

Left alone deliberately

Four more AuthManager harnesses in plugin-auth still hand-write the object list
without the OAuth objects, and are ⛔ not touched here (the population, counted:
7 harnesses construct an AuthManager and register objects — 2 now import the
manifest, 1 hand-list carries the OAuth objects, 4 hand-lists do not):

• audience-bootstrap-seam.test.ts
• dev-admin-seed-credential-gate.test.ts
• sso-register-platform-admin-gate.test.ts
• walled-owner-operator-stamp.test.ts

None of them emits the line today — the package-wide count above is 0 — because none
deletes a session. They are latent copies of the same shape, for a separate card.

🤖 Generated with Claude Code

https://claude.ai/code/session_01AUF1NoViznQK32gqpK8wS8

Generated by Claude Code