cli: every command in a scaffolded project prints a Node SyntaxError warning — `@better-auth/core/db` does not export `createLocalAccountIssuer`

[os-sam]

domain:* / type / priority are triage's.

Found while measuring objectstack lint against a real scaffold for #16330 — not from a sweep. Nothing failed; this is noise on the happy path, which is why nothing has caught it.

Measured

Scaffolded from the repo-built scaffolder at origin/main 3e270d4e, then npm install --no-fund --no-audit against the registry, which resolved @objectstack/cli and @objectstack/spec at 17.3.0. Every CLI command in that project opens with:

(node:5726) Warning: SyntaxError
module: @oclif/core@4.14.0
task: findCommand (verify)
plugin: @objectstack/cli
root: .../node_modules/@objectstack/cli
message: The requested module '@better-auth/core/db' does not provide an export named 'createLocalAccountIssuer'
See more details with DEBUG=*
(Use `node --trace-warnings ...` to show where the warning was created)

Reproduced on both commands run: npm run validate (exit 0) and npm run lint (exit 0). It is emitted before any of the command's own output, so it is the first thing a newcomer sees after pnpm validate — the command the template README and the generated AGENTS.md both tell them to run after every metadata edit.

Where it comes from

packages/plugins/plugin-auth/src/backfill-account-issuer.ts imports createLocalAccountIssuer from @better-auth/core/db. The better-auth version the tree resolves does not export that name, so oclif's findCommand walk hits a SyntaxError while loading the verify command and downgrades it to a process warning.

Adjacent evidence that this family of skew is already known and tracked, but that this instance is not: pnpm install in this monorepo reports ioredis-mock 8.13.1 -> unmet peer ioredis@^5: found 6.0.0, and template-consistency.test.ts carries a whole blank template peer-skew declarations block pinning several @better-auth/* peer entries in pnpm-workspace.yaml. There is no declaration covering this export.

Why it is worth a card despite exiting 0

1. It is not an ObjectStack diagnostic, so the reader cannot act on it and cannot tell whether their metadata is implicated.
2. A stderr warning that is always present is a warning nobody reads — including the run where it is replaced by a real one.
3. Whatever backfill-account-issuer.ts does with createLocalAccountIssuer is not happening, on the published package, silently. Whether that matters is the first thing to establish here: a broken import that only produces a warning is either dead code or a missing behaviour, and the two have opposite fixes.
4. It lands on os verify specifically, so a command in the shipped CLI does not load at all in a scaffolded project.

Suggested first step

Establish (3) before (1): does verify work in a scaffolded project today? Then either pin the @better-auth/core version that exports the name, adjust the import to what the resolved version provides, or remove the backfill if it is dead.

Not in this card

#16330 and #16350 are separate cards and are not addressed here. No change to the lint or validate rule sets.