@better-auth/infra 0.3.6 → 0.4.0

package/dist/index.d.mts

@@ -1,567 +1,11 @@
+import { C as ImpossibleTravelResult, D as SecurityVerdict, E as SecurityOptions, O as StaleUserResult, S as CredentialStuffingResult, T as SecurityEventType, _ as LocationDataContext, a as DashOptionsInternal, b as sentinel, c as EndpointOptions, d as InfraPluginConnectionOptionsInternal, f as KvOptions, g as LocationData, h as KvRetryOptionsResolved, i as DashOptions, k as ThresholdConfig, l as InfraEndpointContext, m as KvRetryOptions, n as ApiOptions, o as DashOptionsResolved, p as KvOptionsResolved, r as ApiOptionsResolved, s as Endpoint, t as APIError, u as InfraPluginConnectionOptions, v as SentinelOptions, w as SecurityEvent, x as CompromisedPasswordResult, y as SentinelOptionsInternal } from "./types-B673lCib.mjs";
 import { EMAIL_TEMPLATES, EmailConfig, EmailTemplateId, EmailTemplateVariables, SendBulkEmailsOptions, SendBulkEmailsResult, SendEmailOptions, SendEmailResult, createEmailSender, sendBulkEmails, sendEmail } from "./email.mjs";
-import { Account, AuthContext, BetterAuthPlugin, GenericEndpointContext, Session, User } from "better-auth";
-import { createFetch } from "@better-fetch/fetch";
+import { Account, AuthContext, GenericEndpointContext, Session, User } from "better-auth";
 import z$1 from "zod";
-import { APIError, Endpoint, EndpointOptions } from "better-call";
 import { DBFieldAttribute } from "better-auth/db";
 import { Invitation, Member, Organization, Team, TeamMember } from "better-auth/plugins";
 export type * from "better-call";
 
-//#region src/identification.d.ts
-interface IPLocation {
-  lat: number;
-  lng: number;
-  city: string | null;
-  region: string | null;
-  postalCode: string | null;
-  country: {
-    code: string;
-    name: string;
-  } | null;
-  timezone: string | null;
-}
-interface Identification {
-  visitorId: string;
-  requestId: string;
-  timestamp: number;
-  url: string;
-  ip: string | null;
-  location: IPLocation | null;
-  browser: {
-    name: string | null;
-    version: string | null;
-    os: string | null;
-    osVersion: string | null;
-    device: string | null;
-    userAgent: string | null;
-  };
-  confidence: number;
-  incognito: boolean;
-  bot: "notDetected" | "detected" | "unknown";
-}
-//#endregion
-//#region src/sentinel/security.d.ts
-type SecurityAction = "log" | "block" | "challenge";
-interface ThresholdConfig {
-  challenge?: number;
-  block?: number;
-}
-interface SecurityOptions {
-  unknownDeviceNotification?: boolean;
-  credentialStuffing?: {
-    enabled: boolean;
-    thresholds?: ThresholdConfig;
-    windowSeconds?: number;
-    cooldownSeconds?: number;
-  };
-  impossibleTravel?: {
-    enabled: boolean;
-    maxSpeedKmh?: number;
-    action?: SecurityAction;
-  };
-  geoBlocking?: {
-    allowList?: string[];
-    denyList?: string[];
-    action?: "block" | "challenge";
-  };
-  botBlocking?: boolean | {
-    action: SecurityAction;
-  };
-  suspiciousIpBlocking?: boolean | {
-    action: SecurityAction;
-  };
-  velocity?: {
-    enabled: boolean;
-    thresholds?: ThresholdConfig;
-    maxSignupsPerVisitor?: number;
-    maxPasswordResetsPerIp?: number;
-    maxSignInsPerIp?: number;
-    windowSeconds?: number;
-    action?: SecurityAction;
-  };
-  freeTrialAbuse?: {
-    enabled: boolean;
-    thresholds?: ThresholdConfig;
-    maxAccountsPerVisitor?: number;
-    action?: SecurityAction;
-  };
-  compromisedPassword?: {
-    enabled: boolean;
-    action?: SecurityAction;
-    minBreachCount?: number;
-  };
-  emailValidation?: {
-    enabled?: boolean;
-    strictness?: "low" | "medium" | "high";
-    action?: SecurityAction;
-    domainAllowlist?: string[];
-  };
-  emailNormalization?: {
-    enabled?: boolean;
-  };
-  staleUsers?: {
-    enabled: boolean;
-    staleDays?: number;
-    action?: SecurityAction;
-    notifyUser?: boolean;
-    notifyAdmin?: boolean;
-    adminEmail?: string;
-  };
-  challengeDifficulty?: number;
-}
-interface SecurityVerdict {
-  action: "allow" | "challenge" | "block";
-  challenge?: string;
-  reason?: string;
-  details?: Record<string, unknown>;
-  /** Set when the request included a valid, consumed PoW solution. */
-  powVerified?: boolean;
-}
-interface CredentialStuffingResult {
-  blocked: boolean;
-  challenged?: boolean;
-  challenge?: string;
-  reason?: string;
-  details?: Record<string, unknown>;
-}
-interface ImpossibleTravelResult {
-  isImpossible: boolean;
-  action?: "allow" | "challenge" | "block";
-  challenged?: boolean;
-  challenge?: string;
-  powVerified?: boolean;
-  distance?: number;
-  timeElapsedHours?: number;
-  speedRequired?: number;
-  from?: {
-    city: string | null;
-    country: string | null;
-  } | null;
-  to?: {
-    city: string | null;
-    country: string | null;
-  } | null;
-}
-interface CompromisedPasswordResult {
-  compromised: boolean;
-  breachCount?: number;
-  action?: SecurityAction;
-}
-interface StaleUserResult {
-  isStale: boolean;
-  daysSinceLastActive?: number;
-  staleDays?: number;
-  lastActiveAt?: string | null;
-  action?: SecurityAction;
-  notifyUser?: boolean;
-  notifyAdmin?: boolean;
-}
-interface SecurityEvent {
-  type: SecurityEventType;
-  timestamp: number;
-  userId: string | null;
-  visitorId: string | null;
-  ip: string | null;
-  country: string | null;
-  details: Record<string, unknown>;
-  action: "logged" | "blocked" | "challenged";
-}
-type SecurityEventType = "unknown_device" | "credential_stuffing" | "impossible_travel" | "geo_blocked" | "bot_blocked" | "suspicious_ip_detected" | "velocity_exceeded" | "free_trial_abuse" | "compromised_password" | "stale_account_reactivation";
-//#endregion
-//#region src/sentinel/sentinel.d.ts
-declare const sentinel: (options?: SentinelOptions) => {
-  id: "sentinel";
-  init(ctx: import("better-auth").AuthContext): {
-    options: {
-      emailValidation: {
-        enabled?: boolean;
-        strictness?: "low" | "medium" | "high";
-        action?: SecurityAction;
-        domainAllowlist?: string[];
-      } | undefined;
-      emailNormalization: {
-        enabled?: boolean;
-      } | undefined;
-      databaseHooks: {
-        user: {
-          create: {
-            before(user: {
-              id: string;
-              createdAt: Date;
-              updatedAt: Date;
-              email: string;
-              emailVerified: boolean;
-              name: string;
-              image?: string | null | undefined;
-            } & Record<string, unknown>, ctx: import("better-auth").GenericEndpointContext | null): Promise<{
-              data: {
-                email: string;
-                id: string;
-                createdAt: Date;
-                updatedAt: Date;
-                emailVerified: boolean;
-                name: string;
-                image?: string | null | undefined;
-              };
-            } | undefined>;
-            after(user: {
-              id: string;
-              createdAt: Date;
-              updatedAt: Date;
-              email: string;
-              emailVerified: boolean;
-              name: string;
-              image?: string | null | undefined;
-            } & Record<string, unknown>, ctx: import("better-auth").GenericEndpointContext | null): Promise<void>;
-          };
-          update: {
-            before(user: Partial<{
-              id: string;
-              createdAt: Date;
-              updatedAt: Date;
-              email: string;
-              emailVerified: boolean;
-              name: string;
-              image?: string | null | undefined;
-            }> & Record<string, unknown>, ctx: import("better-auth").GenericEndpointContext | null): Promise<{
-              data: {
-                email: string;
-                id?: string | undefined;
-                createdAt?: Date | undefined;
-                updatedAt?: Date | undefined;
-                emailVerified?: boolean | undefined;
-                name?: string | undefined;
-                image?: string | null | undefined;
-              };
-            } | undefined>;
-          };
-        };
-        session: {
-          create: {
-            before(session: {
-              id: string;
-              createdAt: Date;
-              updatedAt: Date;
-              userId: string;
-              expiresAt: Date;
-              token: string;
-              ipAddress?: string | null | undefined;
-              userAgent?: string | null | undefined;
-            } & Record<string, unknown>, ctx: import("better-auth").GenericEndpointContext | null): Promise<void>;
-            after(session: {
-              id: string;
-              createdAt: Date;
-              updatedAt: Date;
-              userId: string;
-              expiresAt: Date;
-              token: string;
-              ipAddress?: string | null | undefined;
-              userAgent?: string | null | undefined;
-            } & Record<string, unknown>, ctx: import("better-auth").GenericEndpointContext | null): Promise<void>;
-          };
-        };
-      };
-    };
-  };
-  hooks: {
-    before: ({
-      matcher: (context: Pick<import("better-auth").HookEndpointContext, "path">) => boolean;
-      handler: (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
-        context: {
-          method: "GET" | "POST" | "PUT" | "DELETE" | "PATCH";
-          path: string;
-          body: any;
-          query: Record<string, any> | undefined;
-          params: Record<string, any> & string;
-          request: Request | undefined;
-          headers: Headers | undefined;
-          setHeader: ((key: string, value: string) => void) & ((key: string, value: string) => void);
-          setStatus: (status: import("better-call").Status) => void;
-          getHeader: ((key: string) => string | null) & ((key: string) => string | null);
-          getCookie: (key: string, prefix?: import("better-call").CookiePrefixOptions) => string | null;
-          getSignedCookie: (key: string, secret: string, prefix?: import("better-call").CookiePrefixOptions) => Promise<string | null | false>;
-          setCookie: (key: string, value: string, options?: import("better-call").CookieOptions) => string;
-          setSignedCookie: (key: string, value: string, secret: string, options?: import("better-call").CookieOptions) => Promise<string>;
-          responseHeaders: Headers;
-          json: (<R extends Record<string, any> | null>(json: R, routerResponse?: {
-            status?: number;
-            headers?: Record<string, string>;
-            response?: Response;
-            body?: Record<string, string>;
-          } | Response) => Promise<R>) & (<R extends Record<string, any> | null>(json: R, routerResponse?: {
-            status?: number;
-            headers?: Record<string, string>;
-            response?: Response;
-          } | Response) => Promise<R>);
-          context: {
-            [x: string]: any;
-          } & {
-            returned?: unknown | undefined;
-            responseHeaders?: Headers | undefined;
-            getPlugin: <ID extends import("better-auth").BetterAuthPluginRegistryIdentifier | import("better-auth").LiteralString, PluginOptions extends never>(pluginId: ID) => (ID extends keyof import("better-auth").BetterAuthPluginRegistry<unknown, unknown> ? import("better-auth").BetterAuthPluginRegistry<import("better-auth").BetterAuthOptions, PluginOptions>[ID] extends {
-              creator: infer C;
-            } ? C extends ((...args: any[]) => infer R) ? R : never : never : BetterAuthPlugin) | null;
-            hasPlugin: <ID extends import("better-auth").BetterAuthPluginRegistryIdentifier | import("better-auth").LiteralString>(pluginId: ID) => ID extends never ? true : boolean;
-            appName: string;
-            baseURL: string;
-            version: string;
-            options: import("better-auth").BetterAuthOptions;
-            trustedOrigins: string[];
-            trustedProviders: string[];
-            isTrustedOrigin: (url: string, settings?: {
-              allowRelativePaths: boolean;
-            }) => boolean;
-            oauthConfig: {
-              skipStateCookieCheck?: boolean | undefined;
-              storeStateStrategy: "database" | "cookie";
-            };
-            newSession: {
-              session: {
-                id: string;
-                createdAt: Date;
-                updatedAt: Date;
-                userId: string;
-                expiresAt: Date;
-                token: string;
-                ipAddress?: string | null | undefined;
-                userAgent?: string | null | undefined;
-              } & Record<string, any>;
-              user: {
-                id: string;
-                createdAt: Date;
-                updatedAt: Date;
-                email: string;
-                emailVerified: boolean;
-                name: string;
-                image?: string | null | undefined;
-              } & Record<string, any>;
-            } | null;
-            session: {
-              session: {
-                id: string;
-                createdAt: Date;
-                updatedAt: Date;
-                userId: string;
-                expiresAt: Date;
-                token: string;
-                ipAddress?: string | null | undefined;
-                userAgent?: string | null | undefined;
-              } & Record<string, any>;
-              user: {
-                id: string;
-                createdAt: Date;
-                updatedAt: Date;
-                email: string;
-                emailVerified: boolean;
-                name: string;
-                image?: string | null | undefined;
-              } & Record<string, any>;
-            } | null;
-            setNewSession: (session: {
-              session: {
-                id: string;
-                createdAt: Date;
-                updatedAt: Date;
-                userId: string;
-                expiresAt: Date;
-                token: string;
-                ipAddress?: string | null | undefined;
-                userAgent?: string | null | undefined;
-              } & Record<string, any>;
-              user: {
-                id: string;
-                createdAt: Date;
-                updatedAt: Date;
-                email: string;
-                emailVerified: boolean;
-                name: string;
-                image?: string | null | undefined;
-              } & Record<string, any>;
-            } | null) => void;
-            socialProviders: import("better-auth").OAuthProvider[];
-            authCookies: import("better-auth").BetterAuthCookies;
-            logger: ReturnType<(options?: import("better-auth").Logger | undefined) => import("better-auth").InternalLogger>;
-            rateLimit: {
-              enabled: boolean;
-              window: number;
-              max: number;
-              storage: "memory" | "database" | "secondary-storage";
-            } & Omit<import("better-auth").BetterAuthRateLimitOptions, "enabled" | "window" | "max" | "storage">;
-            adapter: import("better-auth").DBAdapter<import("better-auth").BetterAuthOptions>;
-            internalAdapter: import("better-auth").InternalAdapter<import("better-auth").BetterAuthOptions>;
-            createAuthCookie: (cookieName: string, overrideAttributes?: Partial<import("better-call").CookieOptions> | undefined) => import("better-auth").BetterAuthCookie;
-            secret: string;
-            secretConfig: string | import("better-auth").SecretConfig;
-            sessionConfig: {
-              updateAge: number;
-              expiresIn: number;
-              freshAge: number;
-              cookieRefreshCache: false | {
-                enabled: true;
-                updateAge: number;
-              };
-            };
-            generateId: (options: {
-              model: import("better-auth").ModelNames;
-              size?: number | undefined;
-            }) => string | false;
-            secondaryStorage: import("better-auth").SecondaryStorage | undefined;
-            password: {
-              hash: (password: string) => Promise<string>;
-              verify: (data: {
-                password: string;
-                hash: string;
-              }) => Promise<boolean>;
-              config: {
-                minPasswordLength: number;
-                maxPasswordLength: number;
-              };
-              checkPassword: (userId: string, ctx: import("better-auth").GenericEndpointContext<import("better-auth").BetterAuthOptions>) => Promise<boolean>;
-            };
-            tables: import("better-auth").BetterAuthDBSchema;
-            runMigrations: () => Promise<void>;
-            publishTelemetry: (event: {
-              type: string;
-              anonymousId?: string | undefined;
-              payload: Record<string, any>;
-            }) => Promise<void>;
-            skipOriginCheck: boolean | string[];
-            skipCSRFCheck: boolean;
-            runInBackground: (promise: Promise<unknown>) => void;
-            runInBackgroundOrAwait: (promise: Promise<unknown> | void) => import("better-auth").Awaitable<unknown>;
-          };
-          redirect: (url: string) => import("better-call").APIError;
-          error: (status: ("OK" | "CREATED" | "ACCEPTED" | "NO_CONTENT" | "MULTIPLE_CHOICES" | "MOVED_PERMANENTLY" | "FOUND" | "SEE_OTHER" | "NOT_MODIFIED" | "TEMPORARY_REDIRECT" | "BAD_REQUEST" | "UNAUTHORIZED" | "PAYMENT_REQUIRED" | "FORBIDDEN" | "NOT_FOUND" | "METHOD_NOT_ALLOWED" | "NOT_ACCEPTABLE" | "PROXY_AUTHENTICATION_REQUIRED" | "REQUEST_TIMEOUT" | "CONFLICT" | "GONE" | "LENGTH_REQUIRED" | "PRECONDITION_FAILED" | "PAYLOAD_TOO_LARGE" | "URI_TOO_LONG" | "UNSUPPORTED_MEDIA_TYPE" | "RANGE_NOT_SATISFIABLE" | "EXPECTATION_FAILED" | "I'M_A_TEAPOT" | "MISDIRECTED_REQUEST" | "UNPROCESSABLE_ENTITY" | "LOCKED" | "FAILED_DEPENDENCY" | "TOO_EARLY" | "UPGRADE_REQUIRED" | "PRECONDITION_REQUIRED" | "TOO_MANY_REQUESTS" | "REQUEST_HEADER_FIELDS_TOO_LARGE" | "UNAVAILABLE_FOR_LEGAL_REASONS" | "INTERNAL_SERVER_ERROR" | "NOT_IMPLEMENTED" | "BAD_GATEWAY" | "SERVICE_UNAVAILABLE" | "GATEWAY_TIMEOUT" | "HTTP_VERSION_NOT_SUPPORTED" | "VARIANT_ALSO_NEGOTIATES" | "INSUFFICIENT_STORAGE" | "LOOP_DETECTED" | "NOT_EXTENDED" | "NETWORK_AUTHENTICATION_REQUIRED") | import("better-call").Status, body?: {
-            message?: string;
-            code?: string;
-          } & Record<string, any>, headers?: HeadersInit) => import("better-call").APIError;
-        };
-      } | undefined>;
-    } | {
-      matcher: (ctx: import("better-auth").HookEndpointContext) => boolean;
-      handler: (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<void>;
-    })[];
-    after: {
-      matcher: (ctx: import("better-auth").HookEndpointContext) => boolean;
-      handler: (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<void>;
-    }[];
-  };
-};
-//#endregion
-//#region src/types.d.ts
-/**
- * Shared connection options used by infra plugins.
- */
-interface InfraPluginConnectionOptions {
-  /**
-   * The URL of the Better Auth Dash API
-   * @default "https://dash.better-auth.com"
-   */
-  apiUrl?: string;
-  /**
-   * The URL of the KV storage service
-   * @default "https://kv.better-auth.com"
-   */
-  kvUrl?: string;
-  /**
-   * Your Better Auth Dash API key
-   * @default process.env.BETTER_AUTH_API_KEY
-   */
-  apiKey?: string;
-  /**
-   * Timeout for Dash API HTTP requests (milliseconds).
-   * @default 3000
-   */
-  apiTimeout?: number;
-  /**
-   * Timeout for KV HTTP requests (milliseconds).
-   * @default 1000
-   */
-  kvTimeout?: number;
-}
-/**
- * Configuration options for the dash plugin.
- */
-interface DashOptions extends InfraPluginConnectionOptions {
-  /**
-   * User activity tracking configuration
-   */
-  activityTracking?: {
-    /**
-     * Whether to enable user activity tracking
-     *
-     * This requires a database schema change to the user table.
-     * @default false
-     */
-    enabled?: boolean;
-    /**
-     * Interval in milliseconds to update lastActiveAt for active users
-     * Set to 0 to disable interval-based tracking
-     * @default 300000 (5 minutes)
-     */
-    updateInterval?: number;
-  };
-}
-/**
- * Configuration options for the sentinel plugin.
- */
-interface SentinelOptions extends InfraPluginConnectionOptions {
-  /**
-   * Security features configuration
-   */
-  security?: SecurityOptions;
-}
-/**
- * Internal connection options with required fields resolved.
- */
-interface InfraPluginConnectionOptionsInternal extends InfraPluginConnectionOptions {
-  apiUrl: string;
-  kvUrl: string;
-  apiKey: string;
-  apiTimeout: number;
-  kvTimeout: number;
-}
-/**
- * Internal options with required fields resolved
- */
-interface DashOptionsInternal extends Omit<DashOptions, keyof InfraPluginConnectionOptions>, InfraPluginConnectionOptionsInternal {
-  /**
-   * Shared Dash HTTP client from {@link createAPI}; injected by {@link dash} when wiring endpoints.
-   *
-   * @internal
-   */
-  $api: ReturnType<typeof import("@better-fetch/fetch").createFetch>;
-}
-/**
- * Resolved dash options from {@link resolveDashOptions} / plugin-stored config; excludes injected `$api`.
- */
-type DashOptionsResolved = Omit<DashOptionsInternal, "$api">;
-/**
- * Internal sentinel options with required fields resolved.
- */
-interface SentinelOptionsInternal extends Omit<SentinelOptions, keyof InfraPluginConnectionOptions>, InfraPluginConnectionOptionsInternal {}
-/**
- * Location/geo data used across events, audit logs, and request context.
- */
-interface LocationData {
-  ipAddress?: string | null;
-  city?: string | null;
-  country?: string | null;
-  countryCode?: string | null;
-}
-/** @deprecated Use LocationData instead */
-type LocationDataContext = LocationData;
-type InfraEndpointContext = (GenericEndpointContext & {
-  context: {
-    identification?: Identification | null | undefined;
-    visitorId: string | null;
-    requestId: string | null;
-    ip: string | null;
-    untrustedVisitorId: string | null;
-    location: LocationData | undefined;
-  };
-}) | undefined;
-//#endregion
 //#region src/pow.d.ts
 /**
  * Proof of Work Challenge System - Client Side
@@ -650,9 +94,20 @@ interface SendSMSResult {
 interface SMSConfig {
   apiKey?: string;
   apiUrl?: string;
+  /**
+   * Dash API HTTP client options.
+   */
+  apiOptions?: {
+    /**
+     * Timeout for Dash SMS API HTTP requests (milliseconds).
+     * @default 3000
+     */
+    timeout?: number;
+  };
   /**
    * Timeout for Dash SMS API HTTP requests (milliseconds).
    * @default 3000
+   * @deprecated Use `apiOptions.timeout` instead.
    */
   apiTimeout?: number;
 }
@@ -778,23 +233,112 @@ interface DashIdRow {
 }
 //#endregion
 //#region src/routes/directory-sync/types.d.ts
+/**
+ * SCIM authorization scope supported by the managed directory workflow.
+ *
+ * Redeclared rather than imported from `@better-auth/scim`: this type is part
+ * of the root package's public surface, and `@better-auth/scim` is an
+ * optional peer the root entry must never reference (see
+ * smoke/directory-sync-root-types).
+ */
+type DashSCIMScope = "scim.users.read" | "scim.users.write" | "scim.groups.read" | "scim.groups.write";
+/** Public lifecycle state of a managed SCIM credential. */
+type DashSCIMManagedCredentialStatus = "active" | "revoked" | "expired" | "decommissioned";
+/** Public managed-catalog event emitted by the SCIM plugin. */
+type DashSCIMManagedConnectionEventType = "connection.created" | "credential.issued" | "credential.rotated" | "credential.revoked" | "connection.decommissioning" | "connection.decommissioned";
+/** Lifecycle state for one Infrastructure-owned directory-sync alias. */
+type DirectorySyncConnectionStatus = "active" | "decommissioning" | "decommissioned";
+type DirectorySyncMode = "legacy" | "managed" | "unavailable";
 type SCIMPlugin = ReturnType<typeof import("@better-auth/scim").scim>;
+/** Public credential metadata. Raw bearer tokens are never included here. */
+interface DashDirectoryCredential {
+  credentialId: string;
+  status: DashSCIMManagedCredentialStatus;
+  scopes: readonly DashSCIMScope[];
+  expiresAt: string;
+  createdAt: string;
+  createdBy: string;
+  lastUsedAt: string | null;
+  revokedAt: string | null;
+  revokedBy: string | null;
+}
+/** One bounded framework-managed SCIM audit event. */
+interface DashDirectoryEvent {
+  sequence: number;
+  type: DashSCIMManagedConnectionEventType;
+  actorId: string;
+  credentialId: string | null;
+  createdAt: string;
+}
+/** Atomic SSO provider and verified identity source paired to a directory. */
+type DashDirectorySyncSSOPairing = {
+  ssoProviderId: string;
+  protocol: "oidc";
+  externalIdSource: {
+    kind: "subject";
+  } | {
+    kind: "verifiedIdTokenClaim";
+    name: string;
+  };
+} | {
+  ssoProviderId: string;
+  protocol: "saml";
+  externalIdSource: {
+    kind: "nameId";
+  } | {
+    kind: "attribute";
+    name: string;
+  };
+};
+/** Infra alias plus the corresponding framework-managed SCIM state. */
 interface DirectorySyncConnection {
+  connectionId: string | null;
   organizationId: string;
   providerId: string;
+  provisioningDomainId: string;
+  status: DirectorySyncConnectionStatus;
+  scimEndpoint: string;
+  credentials: DashDirectoryCredential[];
+  createdAt: string;
+  updatedAt: string;
+  pairing: DashDirectorySyncSSOPairing | null;
+  pairingEnforced: boolean;
+  unpairedAt: string | null;
+  unpairedBy: string | null;
+  decommissionedAt: string | null;
+}
+type DashDirectoryItem = DirectorySyncConnection;
+/** Create returns a raw bearer token exactly once. */
+interface DashDirectoryCreateResponse extends DirectorySyncConnection {
+  connectionId: string;
+  credential: DashDirectoryCredential;
+  scimToken: string;
+}
+/** Rotation returns only the newly issued raw bearer token. */
+interface DashDirectoryRotateCredentialResponse {
+  connectionId: string;
+  credential: DashDirectoryCredential;
+  scimToken: string;
   scimEndpoint: string;
 }
-interface DashDirectoryCreateResponse {
+interface DashDirectoryEventsResponse {
+  events: DashDirectoryEvent[];
+  total: number;
+  limit: number;
+  offset: number;
+}
+/** Legacy (pre-1.7) directory sync connection listed for an organization. */
+interface LegacyDashDirectoryItem {
   organizationId: string;
   providerId: string;
   scimEndpoint: string;
-  scimToken: string;
 }
-interface DashDirectoryItem {
-  id?: string;
-  providerId: string;
+/** Legacy create returns a one-time SCIM token. */
+interface LegacyDashDirectoryCreateResponse {
   organizationId: string;
+  providerId: string;
   scimEndpoint: string;
+  scimToken: string;
 }
 interface DashDirectoryDeleteResponse {
   success: boolean;
@@ -1848,7 +1392,7 @@ declare const dash: <O extends DashOptions>(options?: O) => {
       }>)[];
       body: import("zod").ZodObject<{
         providerId: import("zod").ZodString;
-        accountId: import("zod").ZodOptional<import("zod").ZodString>;
+        accountId: import("zod").ZodString;
       }, import("zod/v4/core").$strip>;
     }, DashSuccessResponse>;
     dashRevokeSession: import("better-call").StrictEndpoint<"/dash/sessions/revoke", {
@@ -2462,7 +2006,7 @@ declare const dash: <O extends DashOptions>(options?: O) => {
       use: ((inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
         payload: Record<string, unknown>;
       }>)[];
-    }, DashDirectoryItem[]>;
+    }, DirectorySyncConnection[] | LegacyDashDirectoryItem[]>;
     createDashOrganizationDirectory: import("better-call").StrictEndpoint<"/dash/organization/directory/create", {
       method: "POST";
       use: ((inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
@@ -2474,7 +2018,7 @@ declare const dash: <O extends DashOptions>(options?: O) => {
         providerId: import("zod").ZodString;
         ownerUserId: import("zod").ZodString;
       }, import("zod/v4/core").$strip>;
-    }, DashDirectoryCreateResponse>;
+    }, LegacyDashDirectoryCreateResponse>;
     deleteDashOrganizationDirectory: import("better-call").StrictEndpoint<"/dash/organization/directory/delete", {
       method: "POST";
       use: ((inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
@@ -2497,6 +2041,138 @@ declare const dash: <O extends DashOptions>(options?: O) => {
         providerId: import("zod").ZodString;
       }, import("zod/v4/core").$strip>;
     }, DashDirectoryRegenerateTokenResponse>;
+    getDashManagedOrganizationDirectory: import("better-call").StrictEndpoint<"/dash/organization/:id/directories/:providerId", {
+      method: "GET";
+      use: ((inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
+        payload: {
+          purpose: "directory-sync-management";
+          organizationId: string;
+          actorId: string;
+          setupOperationId?: string | undefined;
+        };
+      }>)[];
+    }, DirectorySyncConnection>;
+    createDashManagedOrganizationDirectory: import("better-call").StrictEndpoint<"/dash/organization/:id/directories", {
+      method: "POST";
+      use: ((inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
+        payload: {
+          purpose: "directory-sync-management";
+          organizationId: string;
+          actorId: string;
+          setupOperationId?: string | undefined;
+        };
+      }>)[];
+      body: import("zod").ZodObject<{
+        scopes: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodEnum<{
+          "scim.users.read": "scim.users.read";
+          "scim.users.write": "scim.users.write";
+          "scim.groups.read": "scim.groups.read";
+          "scim.groups.write": "scim.groups.write";
+        }>>>;
+        expiresAt: import("zod").ZodOptional<import("zod").ZodCoercedDate<unknown>>;
+        providerId: import("zod").ZodString;
+        pairing: import("zod").ZodOptional<import("zod").ZodDiscriminatedUnion<[import("zod").ZodObject<{
+          ssoProviderId: import("zod").ZodString;
+          protocol: import("zod").ZodLiteral<"oidc">;
+          externalIdSource: import("zod").ZodDiscriminatedUnion<[import("zod").ZodObject<{
+            kind: import("zod").ZodLiteral<"subject">;
+          }, import("zod/v4/core").$strip>, import("zod").ZodObject<{
+            kind: import("zod").ZodLiteral<"verifiedIdTokenClaim">;
+            name: import("zod").ZodString;
+          }, import("zod/v4/core").$strip>], "kind">;
+        }, import("zod/v4/core").$strip>, import("zod").ZodObject<{
+          ssoProviderId: import("zod").ZodString;
+          protocol: import("zod").ZodLiteral<"saml">;
+          externalIdSource: import("zod").ZodDiscriminatedUnion<[import("zod").ZodObject<{
+            kind: import("zod").ZodLiteral<"nameId">;
+          }, import("zod/v4/core").$strip>, import("zod").ZodObject<{
+            kind: import("zod").ZodLiteral<"attribute">;
+            name: import("zod").ZodString;
+          }, import("zod/v4/core").$strip>], "kind">;
+        }, import("zod/v4/core").$strip>], "protocol">>;
+      }, import("zod/v4/core").$strip>;
+      metadata: {
+        noStore: boolean;
+      };
+    }, DashDirectoryCreateResponse>;
+    rotateDashManagedDirectoryCredential: import("better-call").StrictEndpoint<"/dash/organization/:id/directories/:providerId/credentials/rotate", {
+      method: "POST";
+      use: ((inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
+        payload: {
+          purpose: "directory-sync-management";
+          organizationId: string;
+          actorId: string;
+          setupOperationId?: string | undefined;
+        };
+      }>)[];
+      body: import("zod").ZodObject<{
+        scopes: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodEnum<{
+          "scim.users.read": "scim.users.read";
+          "scim.users.write": "scim.users.write";
+          "scim.groups.read": "scim.groups.read";
+          "scim.groups.write": "scim.groups.write";
+        }>>>;
+        expiresAt: import("zod").ZodOptional<import("zod").ZodCoercedDate<unknown>>;
+      }, import("zod/v4/core").$strip>;
+      metadata: {
+        noStore: boolean;
+      };
+    }, DashDirectoryRotateCredentialResponse>;
+    revokeDashManagedDirectoryCredential: import("better-call").StrictEndpoint<"/dash/organization/:id/directories/:providerId/credentials/:credentialId/revoke", {
+      method: "POST";
+      use: ((inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
+        payload: {
+          purpose: "directory-sync-management";
+          organizationId: string;
+          actorId: string;
+          setupOperationId?: string | undefined;
+        };
+      }>)[];
+      body: import("zod").ZodObject<{}, import("zod/v4/core").$strip>;
+    }, DirectorySyncConnection>;
+    listDashManagedDirectoryEvents: import("better-call").StrictEndpoint<"/dash/organization/:id/directories/:providerId/events", {
+      method: "GET";
+      use: ((inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
+        payload: {
+          purpose: "directory-sync-management";
+          organizationId: string;
+          actorId: string;
+          setupOperationId?: string | undefined;
+        };
+      }>)[];
+      query: import("zod").ZodOptional<import("zod").ZodObject<{
+        limit: import("zod").ZodOptional<import("zod").ZodUnion<[import("zod").ZodNumber, import("zod").ZodPipe<import("zod").ZodString, import("zod").ZodTransform<number, string>>]>>;
+        offset: import("zod").ZodOptional<import("zod").ZodUnion<[import("zod").ZodNumber, import("zod").ZodPipe<import("zod").ZodString, import("zod").ZodTransform<number, string>>]>>;
+        sortDirection: import("zod").ZodOptional<import("zod").ZodEnum<{
+          asc: "asc";
+          desc: "desc";
+        }>>;
+      }, import("zod/v4/core").$strip>>;
+    }, DashDirectoryEventsResponse>;
+    decommissionDashManagedOrganizationDirectory: import("better-call").StrictEndpoint<"/dash/organization/:id/directories/:providerId/decommission", {
+      method: "POST";
+      use: ((inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
+        payload: {
+          purpose: "directory-sync-management";
+          organizationId: string;
+          actorId: string;
+          setupOperationId?: string | undefined;
+        };
+      }>)[];
+      body: import("zod").ZodObject<{}, import("zod/v4/core").$strip>;
+    }, DirectorySyncConnection>;
+    unpairDashManagedOrganizationDirectory: import("better-call").StrictEndpoint<"/dash/organization/:id/directories/:providerId/unpair", {
+      method: "POST";
+      use: ((inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
+        payload: {
+          purpose: "directory-sync-management";
+          organizationId: string;
+          actorId: string;
+          setupOperationId?: string | undefined;
+        };
+      }>)[];
+      body: import("zod").ZodObject<{}, import("zod/v4/core").$strip>;
+    }, DirectorySyncConnection>;
     dashExecuteAdapter: import("better-call").StrictEndpoint<"/dash/execute-adapter", {
       method: "POST";
       use: ((inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
@@ -2614,7 +2290,7 @@ declare const dash: <O extends DashOptions>(options?: O) => {
       }, import("zod/v4/core").$strip>], "action">;
     }, DashExecuteAdapterResponse>;
   };
-  schema: O extends {
+  schema: (O extends {
     activityTracking: {
       enabled: true;
     };
@@ -2627,7 +2303,18 @@ declare const dash: <O extends DashOptions>(options?: O) => {
         };
       };
     };
-  } : {};
+  } : {}) & (O extends {
+    managedDirectorySync: {
+      enabled: true;
+    };
+  } ? {
+    directorySyncConnection: {
+      fields: Record<string, DBFieldAttribute>;
+    };
+    directorySyncMembershipProvenance: {
+      fields: Record<string, DBFieldAttribute>;
+    };
+  } : {});
 };
 //#endregion
-export { type APIError, CHALLENGE_TTL, type CompromisedPasswordResult, type CredentialStuffingResult, type DBField, DEFAULT_DIFFICULTY, type DashAddTeamMemberResponse, type DashBanManyResponse, type DashCheckUserByEmailResponse, type DashCheckUserExistsResponse, type DashCompleteInvitationResponse, type DashConfigResponse, type DashCreateOrganizationBody, type DashCreateOrganizationResponse, type DashCreateTeamResponse, type DashCreateUserResponse, type DashDeleteManyUsersResponse, type DashDirectoryCreateResponse, type DashDirectoryDeleteResponse, type DashDirectoryItem, type DashDirectoryRegenerateTokenResponse, type DashExecuteAdapterCountResponse, type DashExecuteAdapterFindManyResponse, type DashExecuteAdapterFindOneResponse, type DashExecuteAdapterMutationResponse, type DashExecuteAdapterResponse, type DashExportOrganizationsResponse, type DashIdRow, type DashInviteMemberResponse, type DashMaybeSuccessResponse, type DashOptions, type DashOptionsInternal, type DashOptionsResolved, type DashOrganizationAddMemberResponse, type DashOrganizationDeleteManyResponse, type DashOrganizationDetailResponse, type DashOrganizationInvitationItem, type DashOrganizationInvitationListResponse, type DashOrganizationInvitationStatusItem, type DashOrganizationListResponse, type DashOrganizationMember, type DashOrganizationMemberListItem, type DashOrganizationMemberListResponse, type DashOrganizationMemberUser, type DashOrganizationOptionsResponse, type DashOrganizationTeamItem, type DashOrganizationTeamListResponse, type DashOrganizationUpdateMemberRoleResponse, type DashOrganizationUpdateResponse, type DashSendManyVerificationEmailsResponse, type DashSessionRevokeManyResponse, type DashSsoCreateProviderResponse, type DashSsoDeleteResponse, type DashSsoMarkDomainVerifiedResponse, type DashSsoProviderItem, type DashSsoProviderSummary, type DashSsoUpdateProviderResponse, type DashSsoVerificationTokenResponse, type DashSsoVerifyDomainResponse, type DashSuccessResponse, type DashTeam, type DashTeamMember, type DashTeamMemberListResponse, type DashTwoFactorBackupCodesResponse, type DashTwoFactorEnableResponse, type DashTwoFactorStatus, type DashTwoFactorTotpViewResponse, type DashUpdateTeamResponse, type DashUpdateUserResponse, type DashUserDetailsResponse, type DashUserGraphDataResponse, type DashUserListResponse, type DashUserOrganizationsResponse, type DashUserRetentionDataResponse, type DashUserStatsActivePeriod, type DashUserStatsResponse, type DashUserStatsSignUpPeriod, type DashValidateResponse, type DirectorySyncConnection, EMAIL_TEMPLATES, type EmailConfig, type EmailTemplateId, type EmailTemplateVariables, type Endpoint, type EndpointOptions, type EventLocation, type EventTypesResponse, type ImpossibleTravelResult, type InfraEndpointContext, type InfraPluginConnectionOptions, type InfraPluginConnectionOptionsInternal, type LocationData, type LocationDataContext, type ORGANIZATION_USER_PREVIEW_SELECT, type OrganizationUserPreview, type PoWChallenge, type PoWSolution, type SCIMPlugin, type SMSConfig, type SMSTemplateId, type SMSTemplateVariables, SMS_TEMPLATES, type SecurityEvent, type SecurityEventType, type SecurityOptions, type SecurityVerdict, type SendBulkEmailsOptions, type SendBulkEmailsResult, type SendEmailOptions, type SendEmailResult, type SendSMSOptions, type SendSMSResult, type SentinelOptions, type SentinelOptionsInternal, type StaleUserResult, type ThresholdConfig, USER_EVENT_TYPES, type UserEvent, type UserEventType, type UserEventsResponse, createEmailSender, createSMSSender, dash, decodePoWChallenge, encodePoWSolution, normalizeEmail, sendBulkEmails, sendEmail, sendSMS, sentinel, solvePoWChallenge, verifyPoWSolution };
+export { type APIError, type ApiOptions, type ApiOptionsResolved, CHALLENGE_TTL, type CompromisedPasswordResult, type CredentialStuffingResult, type DBField, DEFAULT_DIFFICULTY, type DashAddTeamMemberResponse, type DashBanManyResponse, type DashCheckUserByEmailResponse, type DashCheckUserExistsResponse, type DashCompleteInvitationResponse, type DashConfigResponse, type DashCreateOrganizationBody, type DashCreateOrganizationResponse, type DashCreateTeamResponse, type DashCreateUserResponse, type DashDeleteManyUsersResponse, type DashDirectoryCreateResponse, type DashDirectoryCredential, type DashDirectoryDeleteResponse, type DashDirectoryEvent, type DashDirectoryEventsResponse, type DashDirectoryItem, type DashDirectoryRegenerateTokenResponse, type DashDirectoryRotateCredentialResponse, type DashDirectorySyncSSOPairing, type DashExecuteAdapterCountResponse, type DashExecuteAdapterFindManyResponse, type DashExecuteAdapterFindOneResponse, type DashExecuteAdapterMutationResponse, type DashExecuteAdapterResponse, type DashExportOrganizationsResponse, type DashIdRow, type DashInviteMemberResponse, type DashMaybeSuccessResponse, type DashOptions, type DashOptionsInternal, type DashOptionsResolved, type DashOrganizationAddMemberResponse, type DashOrganizationDeleteManyResponse, type DashOrganizationDetailResponse, type DashOrganizationInvitationItem, type DashOrganizationInvitationListResponse, type DashOrganizationInvitationStatusItem, type DashOrganizationListResponse, type DashOrganizationMember, type DashOrganizationMemberListItem, type DashOrganizationMemberListResponse, type DashOrganizationMemberUser, type DashOrganizationOptionsResponse, type DashOrganizationTeamItem, type DashOrganizationTeamListResponse, type DashOrganizationUpdateMemberRoleResponse, type DashOrganizationUpdateResponse, type DashSCIMManagedConnectionEventType, type DashSCIMManagedCredentialStatus, type DashSCIMScope, type DashSendManyVerificationEmailsResponse, type DashSessionRevokeManyResponse, type DashSsoCreateProviderResponse, type DashSsoDeleteResponse, type DashSsoMarkDomainVerifiedResponse, type DashSsoProviderItem, type DashSsoProviderSummary, type DashSsoUpdateProviderResponse, type DashSsoVerificationTokenResponse, type DashSsoVerifyDomainResponse, type DashSuccessResponse, type DashTeam, type DashTeamMember, type DashTeamMemberListResponse, type DashTwoFactorBackupCodesResponse, type DashTwoFactorEnableResponse, type DashTwoFactorStatus, type DashTwoFactorTotpViewResponse, type DashUpdateTeamResponse, type DashUpdateUserResponse, type DashUserDetailsResponse, type DashUserGraphDataResponse, type DashUserListResponse, type DashUserOrganizationsResponse, type DashUserRetentionDataResponse, type DashUserStatsActivePeriod, type DashUserStatsResponse, type DashUserStatsSignUpPeriod, type DashValidateResponse, type DirectorySyncConnection, type DirectorySyncConnectionStatus, type DirectorySyncMode, EMAIL_TEMPLATES, type EmailConfig, type EmailTemplateId, type EmailTemplateVariables, type Endpoint, type EndpointOptions, type EventLocation, type EventTypesResponse, type ImpossibleTravelResult, type InfraEndpointContext, type InfraPluginConnectionOptions, type InfraPluginConnectionOptionsInternal, type KvOptions, type KvOptionsResolved, type KvRetryOptions, type KvRetryOptionsResolved, type LegacyDashDirectoryCreateResponse, type LegacyDashDirectoryItem, type LocationData, type LocationDataContext, type ORGANIZATION_USER_PREVIEW_SELECT, type OrganizationUserPreview, type PoWChallenge, type PoWSolution, type SCIMPlugin, type SMSConfig, type SMSTemplateId, type SMSTemplateVariables, SMS_TEMPLATES, type SecurityEvent, type SecurityEventType, type SecurityOptions, type SecurityVerdict, type SendBulkEmailsOptions, type SendBulkEmailsResult, type SendEmailOptions, type SendEmailResult, type SendSMSOptions, type SendSMSResult, type SentinelOptions, type SentinelOptionsInternal, type StaleUserResult, type ThresholdConfig, USER_EVENT_TYPES, type UserEvent, type UserEventType, type UserEventsResponse, createEmailSender, createSMSSender, dash, decodePoWChallenge, encodePoWSolution, normalizeEmail, sendBulkEmails, sendEmail, sendSMS, sentinel, solvePoWChallenge, verifyPoWSolution };