@better-auth/infra 0.3.6 → 0.4.0

package/dist/index.mjs

@@ -1,15 +1,15 @@
-import { i as INFRA_USER_AGENT, n as INFRA_API_URL, o as PLUGIN_VERSION, r as INFRA_KV_URL } from "./constants-CQiIiY9L.mjs";
-import { a as createAPI, o as createKV, r as hmacSha256Hex } from "./crypto-Deqoay7H.mjs";
+import { i as INFRA_USER_AGENT, n as INFRA_API_URL, o as PLUGIN_VERSION, r as INFRA_KV_URL } from "./constants-CcJHk5SE.mjs";
+import { a as createAPI, n as hash$1, o as createKV, r as hmacSha256Hex } from "./crypto-CAdWFWEz.mjs";
 import { EMAIL_TEMPLATES, createEmailSender, sendBulkEmails, sendEmail } from "./email.mjs";
-import { getCurrentAuthContext } from "@better-auth/core/context";
+import { getCurrentAdapter, getCurrentAuthContext, getCurrentDBAdapterAsyncLocalStorage, runWithTransaction } from "@better-auth/core/context";
 import { APIError, generateId, getAuthTables, logger } from "better-auth";
 import { env } from "@better-auth/core/env";
 import { APIError as APIError$1, createAuthEndpoint, createAuthMiddleware, requestPasswordReset, sendVerificationEmailFn, sessionMiddleware } from "better-auth/api";
+import { deleteSessionCookie, setSessionCookie } from "better-auth/cookies";
 import { createFetch } from "@better-fetch/fetch";
 import { isValidPhoneNumber, parsePhoneNumberFromString } from "libphonenumber-js";
-import { createLocalJWKSet, jwtVerify } from "jose";
 import z$1, { z } from "zod";
-import { deleteSessionCookie, setSessionCookie } from "better-auth/cookies";
+import { createLocalJWKSet, jwtVerify } from "jose";
 import { generateRandomString, symmetricEncrypt } from "better-auth/crypto";
 import { createOTP } from "@better-auth/utils/otp";
 //#region src/options.ts
@@ -18,25 +18,38 @@ function resolveConnectionOptions(options) {
 		apiUrl: options?.apiUrl || INFRA_API_URL,
 		kvUrl: options?.kvUrl || INFRA_KV_URL,
 		apiKey: options?.apiKey || env.BETTER_AUTH_API_KEY || "",
-		apiTimeout: options?.apiTimeout ?? 3e3,
-		kvTimeout: options?.kvTimeout ?? 1e3
+		apiOptions: { timeout: options?.apiOptions?.timeout ?? options?.apiTimeout ?? 3e3 },
+		kvOptions: {
+			timeout: options?.kvOptions?.timeout ?? options?.kvTimeout ?? 1e3,
+			retry: {
+				attempts: options?.kvOptions?.retry?.attempts ?? 2,
+				baseDelay: options?.kvOptions?.retry?.baseDelay ?? 400,
+				maxDelay: options?.kvOptions?.retry?.maxDelay ?? 600
+			}
+		}
 	};
 }
 function resolveDashOptions(options) {
-	const activityUpdateInterval = options?.activityTracking?.updateInterval ?? 3e5;
 	return {
 		...resolveConnectionOptions(options),
-		...options,
 		activityTracking: {
 			...options?.activityTracking,
-			updateInterval: activityUpdateInterval
+			updateInterval: options?.activityTracking?.updateInterval ?? 3e5
+		},
+		managedDirectorySync: {
+			enabled: options?.managedDirectorySync?.enabled ?? false,
+			ssoPairing: options?.managedDirectorySync?.ssoPairing ?? true,
+			membershipProjection: {
+				enabled: options?.managedDirectorySync?.membershipProjection?.enabled ?? true,
+				role: options?.managedDirectorySync?.membershipProjection?.role ?? "member"
+			}
 		}
 	};
 }
 function resolveSentinelOptions(options) {
 	return {
 		...resolveConnectionOptions(options),
-		...options
+		security: options?.security
 	};
 }
 //#endregion
@@ -149,7 +162,12 @@ const USER_EVENT_TYPES = {
 //#endregion
 //#region src/events/core/adapter.ts
 function resolveUserFromContext(userId, ctx) {
-	for (const candidate of [ctx.context.session?.user, ctx.context.newSession?.user]) if (candidate?.id === userId) return {
+	const returnedUser = ctx.context.returned?.user;
+	for (const candidate of [
+		ctx.context.session?.user,
+		ctx.context.newSession?.user,
+		returnedUser
+	]) if (candidate?.id === userId) return {
 		id: candidate.id,
 		name: candidate.name,
 		email: candidate.email ?? null,
@@ -341,8 +359,80 @@ const getLoginMethod = (ctx) => {
 	return null;
 };
 //#endregion
+//#region src/compat/account.ts
+/**
+* Mirrors better-auth 1.7+ `createLocalAccountIssuer` so infra can
+* typecheck against older core packages while emitting the same issuer strings.
+*/
+function createLocalAccountIssuer(providerId) {
+	return `local:${encodeURIComponent(providerId)}`;
+}
+/**
+* Mirrors better-auth 1.7+ `createOAuthAccountIssuer`.
+*/
+function createOAuthAccountIssuer(providerId) {
+	return `local:oauth:${encodeURIComponent(providerId)}`;
+}
+/** True when the installed better-auth build scopes accounts by issuer. */
+function supportsIssuerScopedAccounts(adapter) {
+	return typeof adapter.findAccountByKey === "function";
+}
+/** Creates a credential account across pre/post issuer-scoped account schemas. */
+async function createCredentialAccountCompat(adapter, params) {
+	if (supportsIssuerScopedAccounts(adapter)) {
+		await adapter.createAccount({
+			userId: params.userId,
+			providerId: "credential",
+			accountId: params.userId,
+			issuer: createLocalAccountIssuer("credential"),
+			password: params.password
+		});
+		return;
+	}
+	await adapter.createAccount({
+		userId: params.userId,
+		providerId: "credential",
+		accountId: params.userId,
+		password: params.password
+	});
+}
+/** Finds an unlink target by provider and local account row id. */
+function resolveAccountForUnlink(accounts, selector) {
+	return accounts.find((account) => account.providerId === selector.providerId && account.id === selector.accountId);
+}
+//#endregion
 //#region src/events/core/oauth-callback-user.ts
 const OAUTH_CALLBACK_USER = Symbol.for("dash.oauthCallbackUser");
+function normalizeProviderSubject(subject) {
+	if (!subject || subject === "undefined" || subject === "null") return;
+	return subject;
+}
+async function resolveAccountKey(provider, tokens, profile) {
+	const keyedProvider = provider;
+	const context = {
+		tokens,
+		profile
+	};
+	try {
+		let rawSubject;
+		if (keyedProvider.accountSubject) rawSubject = String(await keyedProvider.accountSubject(context));
+		else {
+			const { id, sub } = profile;
+			const value = id ?? sub;
+			rawSubject = value == null ? void 0 : String(value);
+		}
+		const accountId = rawSubject ? normalizeProviderSubject(rawSubject) : void 0;
+		if (!accountId) return void 0;
+		const issuer = typeof keyedProvider.accountIssuer === "function" ? await keyedProvider.accountIssuer(context) : keyedProvider.accountIssuer ?? createOAuthAccountIssuer(provider.id);
+		if (!issuer) return void 0;
+		return {
+			issuer,
+			accountId
+		};
+	} catch {
+		return;
+	}
+}
 /**
 * Stash OAuth profile on the request context when better-auth calls getUserInfo
 * during the callback, before the authorization code is consumed.
@@ -355,19 +445,36 @@ function instrumentSocialProviders(providers) {
 			const user = result?.user;
 			if (user) try {
 				const endpointCtx = await getCurrentAuthContext();
-				endpointCtx.context[OAUTH_CALLBACK_USER] = user;
+				const adapter = endpointCtx.context.internalAdapter;
+				const accountKey = result.data && typeof adapter.findAccountOwnerByKey === "function" ? await resolveAccountKey(provider, token, result.data) : void 0;
+				endpointCtx.context[OAUTH_CALLBACK_USER] = {
+					user,
+					accountKey
+				};
 			} catch {}
 			return result;
 		};
 	}
 }
 async function resolveOAuthUser(providerId, ctx) {
-	const oauthUser = ctx.context[OAUTH_CALLBACK_USER];
-	if (!oauthUser) return null;
+	const stashed = ctx.context[OAUTH_CALLBACK_USER];
+	if (!stashed) return null;
+	const { user: oauthUser, accountKey } = stashed;
 	const email = oauthUser.email?.toLowerCase();
+	const adapter = ctx.context.internalAdapter;
+	if (accountKey && typeof adapter.findAccountOwnerByKey === "function") try {
+		const owned = await adapter.findAccountOwnerByKey(accountKey);
+		if (owned?.kind === "owned") return {
+			id: owned.user.id,
+			email: owned.user.email,
+			name: owned.user.name
+		};
+	} catch (error) {
+		logger.debug("[Dash] Failed to find OAuth user by account key:", error);
+	}
 	const accountId = oauthUser.id !== void 0 && oauthUser.id !== null ? String(oauthUser.id) : void 0;
-	if (email && accountId) try {
-		const result = await ctx.context.internalAdapter.findOAuthUser(email, accountId, providerId);
+	if (email && accountId && typeof adapter.findOAuthUser === "function") try {
+		const result = await adapter.findOAuthUser(email, accountId, providerId);
 		if (result?.user) return {
 			id: result.user.id,
 			email: result.user.email,
@@ -941,7 +1048,7 @@ function resolveClientIpFromHeaders(headers, ipAddressHeaders) {
 /**
 * Identification Service
 *
-* Fetches identification data from the durable-kv service
+* Fetches identification data from the identify API
 * when a request includes an X-Request-Id header.
 */
 const IDENTIFICATION_COOKIE_NAME = "__infra-rid";
@@ -957,31 +1064,38 @@ function cleanupCache() {
 function maybeCleanup() {
 	if (Date.now() - lastCleanup > CACHE_TTL_MS || identificationCache.size > CACHE_MAX_SIZE) cleanupCache();
 }
-/** Retries 404 races with exponential backoff (≤1s total wait across retries). */
-const IDENTIFY_GET_RETRY = {
-	type: "exponential",
+const DEFAULT_KV_RETRY = {
 	attempts: 2,
 	baseDelay: 400,
-	maxDelay: 600,
-	shouldRetry(response) {
-		if (response === null) return true;
-		return response.status === 404;
-	}
+	maxDelay: 600
 };
-function identifyGetRetryDelay(attempt) {
-	return Math.min(600, 400 * 2 ** attempt);
+function resolveIdentifyGetRetry(retry) {
+	return {
+		type: "exponential",
+		attempts: retry.attempts,
+		baseDelay: retry.baseDelay,
+		maxDelay: retry.maxDelay,
+		shouldRetry(response) {
+			if (response === null) return true;
+			return response.status === 404;
+		}
+	};
+}
+function identifyGetRetryDelay(retry, attempt) {
+	return Math.min(retry.maxDelay, retry.baseDelay * 2 ** attempt);
 }
 /**
-* Fetch identification data from durable-kv by requestId
+* Fetch identification data from the identify API by requestId
 */
-async function getIdentification(requestId, $kv) {
+async function getIdentification(requestId, $kv, retryOptions = DEFAULT_KV_RETRY) {
 	maybeCleanup();
 	const cached = identificationCache.get(requestId);
 	if (cached && Date.now() - cached.timestamp < CACHE_TTL_MS) return cached.data;
+	const retry = resolveIdentifyGetRetry(retryOptions);
 	for (let networkAttempt = 0;; networkAttempt++) try {
 		const { data, error } = await $kv(`/identify/${requestId}`, {
 			method: "GET",
-			retry: IDENTIFY_GET_RETRY
+			retry
 		});
 		if (data && !error) {
 			identificationCache.set(requestId, {
@@ -996,11 +1110,11 @@ async function getIdentification(requestId, $kv) {
 		});
 		return null;
 	} catch (error) {
-		if (networkAttempt >= IDENTIFY_GET_RETRY.attempts) {
+		if (networkAttempt >= retry.attempts) {
 			logger.error("[Dash] Failed to fetch identification:", error);
 			return null;
 		}
-		await new Promise((resolve) => setTimeout(resolve, identifyGetRetryDelay(networkAttempt)));
+		await new Promise((resolve) => setTimeout(resolve, identifyGetRetryDelay(retryOptions, networkAttempt)));
 	}
 }
 /**
@@ -1046,6 +1160,7 @@ function resolveUntrustedVisitorId(visitorId, ip, headerVisitorId) {
 * @param $kv — KV client from {@link createKV} for the same plugin options (one instance per plugin).
 */
 function createIdentificationMiddleware($kv, options) {
+	const retry = options?.retry ?? DEFAULT_KV_RETRY;
 	return createAuthMiddleware(async (ctx) => {
 		const skipIdentification = options?.skipIdentification?.(ctx) ?? false;
 		let headerVisitorId = null;
@@ -1058,7 +1173,7 @@ function createIdentificationMiddleware($kv, options) {
 		ctx.context.requestId = requestId;
 		if (skipIdentification) ctx.context.identification = null;
 		else if (requestId) {
-			if (ctx.context.identification === void 0) ctx.context.identification = await getIdentification(requestId, $kv) ?? null;
+			if (ctx.context.identification === void 0) ctx.context.identification = await getIdentification(requestId, $kv, retry) ?? null;
 		} else ctx.context.identification = null;
 		const identification = ctx.context.identification;
 		const visitorId = resolveSecurityVisitorId(headerVisitorId, identification);
@@ -2188,9 +2303,24 @@ const sentinel = (options) => {
 	const opts = resolveSentinelOptions(options);
 	const $api = createAPI(opts);
 	const $apiThrowing = createAPI(opts, { throw: true });
-	const $kv = createKV(opts);
+	const $kv = createKV({
+		kvUrl: opts.kvUrl,
+		apiKey: opts.apiKey,
+		timeout: opts.kvOptions.timeout
+	});
 	const { tracker } = initTrackEvents($api);
 	const { trackEvent } = tracker;
+	const STALE_ACCOUNT_BLOCK_ERROR = {
+		message: "This account has been inactive for an extended period. Please contact support to reactivate.",
+		code: "STALE_ACCOUNT"
+	};
+	function isStaleAccountError(returned) {
+		if (!(returned instanceof Error)) return false;
+		const err = returned;
+		if (err.code === STALE_ACCOUNT_BLOCK_ERROR.code) return true;
+		return typeof err.body === "object" && err.body !== null && "code" in err.body && err.body.code === STALE_ACCOUNT_BLOCK_ERROR.code;
+	}
+	let activityTrackingEnabled = false;
 	if (!opts.apiKey) logger.warn("[Sentinel] Missing BETTER_AUTH_API_KEY. Security checks may fall back to allow mode when the Infra API rejects requests.");
 	const securityService = createSecurityClient(opts, $apiThrowing, opts.security || {}, (event) => {
 		trackEvent({
@@ -2220,7 +2350,7 @@ const sentinel = (options) => {
 	return {
 		id: "sentinel",
 		init(ctx) {
-			const activityTrackingEnabled = (ctx.getPlugin("dash")?.options)?.activityTracking?.enabled === true;
+			activityTrackingEnabled = (ctx.getPlugin("dash")?.options)?.activityTracking?.enabled === true;
 			return { options: {
 				emailValidation: opts.security?.emailValidation,
 				emailNormalization: opts.security?.emailNormalization,
@@ -2324,35 +2454,6 @@ const sentinel = (options) => {
 							if (visitorId) {
 								if (await securityService.checkUnknownDevice(session.userId, visitorId) && user?.email) await ctx.context.runInBackgroundOrAwait(securityService.notifyUnknownDevice(session.userId, user.email, identification));
 							}
-							if (opts.security?.staleUsers?.enabled && user) {
-								recordCheck(ctx, "stale_users");
-								const lastActiveAtForStale = activityTrackingEnabled ? user.lastActiveAt ?? null : null;
-								const staleCheck = await securityService.checkStaleUser(session.userId, lastActiveAtForStale);
-								if (staleCheck.isStale) {
-									const staleOpts = opts.security.staleUsers;
-									const notificationPromises = [];
-									if (staleCheck.notifyUser && user.email) notificationPromises.push(securityService.notifyStaleAccountUser(user.email, user.name || null, staleCheck.daysSinceLastActive || 0, identification));
-									if (staleCheck.notifyAdmin && staleOpts.adminEmail) notificationPromises.push(securityService.notifyStaleAccountAdmin(staleOpts.adminEmail, session.userId, user.email || "unknown", user.name || null, staleCheck.daysSinceLastActive || 0, identification));
-									if (notificationPromises.length > 0) Promise.all(notificationPromises).catch((error) => {
-										logger.error("[Sentinel] Failed to send stale account notifications:", error);
-									});
-									if (staleCheck.action === "block") {
-										setOutcome(ctx, "blocked", "stale_users", {
-											userId: session.userId,
-											daysSinceLastActive: staleCheck.daysSinceLastActive,
-											staleDays: staleCheck.staleDays,
-											lastActiveAt: staleCheck.lastActiveAt,
-											notifyUser: staleCheck.notifyUser,
-											notifyAdmin: staleCheck.notifyAdmin
-										});
-										emitEvaluation(ctx, trackEvent);
-										throw new APIError("FORBIDDEN", {
-											message: "This account has been inactive for an extended period. Please contact support to reactivate.",
-											code: "STALE_ACCOUNT"
-										});
-									}
-								}
-							}
 							if (opts.security?.impossibleTravel?.enabled && identification?.location) await ctx.context.runInBackgroundOrAwait(securityService.storeLastLocation(session.userId, identification.location, identification.ip));
 						}
 					} }
@@ -2363,7 +2464,10 @@ const sentinel = (options) => {
 			before: [
 				{
 					matcher: (ctx) => ctx.request?.method !== "GET",
-					handler: createIdentificationMiddleware($kv, { skipIdentification: (ctx) => isDashRoute(ctx.path) })
+					handler: createIdentificationMiddleware($kv, {
+						skipIdentification: (ctx) => isDashRoute(ctx.path),
+						retry: opts.kvOptions.retry
+					})
 				},
 				...emailHooks.before,
 				...phoneValidationHooks.before,
@@ -2462,6 +2566,52 @@ const sentinel = (options) => {
 				}
 			],
 			after: [{
+				matcher: (ctx) => !!opts.security?.staleUsers?.enabled && !isDashRoute(ctx.path),
+				handler: createAuthMiddleware(async (ctx) => {
+					if (ctx.context.returned instanceof Error) return;
+					const created = ctx.context.newSession;
+					const userId = created?.user?.id ?? created?.session?.userId;
+					const sessionToken = created?.session?.token;
+					if (!userId || !sessionToken) return;
+					let user = created?.user ?? null;
+					try {
+						user = await getUserById(userId, ctx, { includeLastActiveAt: activityTrackingEnabled }) ?? user;
+					} catch (error) {
+						logger.warn("[Sentinel] Failed to fetch user for stale-account check:", error);
+						if (!user) return;
+					}
+					if (!user) return;
+					recordCheck(ctx, "stale_users");
+					const staleCheck = await securityService.checkStaleUser(userId, activityTrackingEnabled ? user.lastActiveAt ?? null : null);
+					if (!staleCheck.isStale) return;
+					const identification = ctx.context.identification;
+					const staleOpts = opts.security?.staleUsers;
+					const notificationPromises = [];
+					if (staleCheck.notifyUser && user.email) notificationPromises.push(securityService.notifyStaleAccountUser(user.email, user.name || null, staleCheck.daysSinceLastActive || 0, identification));
+					if (staleCheck.notifyAdmin && staleOpts?.adminEmail) notificationPromises.push(securityService.notifyStaleAccountAdmin(staleOpts.adminEmail, userId, user.email || "unknown", user.name || null, staleCheck.daysSinceLastActive || 0, identification));
+					if (notificationPromises.length > 0) Promise.all(notificationPromises).catch((error) => {
+						logger.error("[Sentinel] Failed to send stale account notifications:", error);
+					});
+					if (staleCheck.action !== "block") return;
+					setOutcome(ctx, "blocked", "stale_users", {
+						userId,
+						daysSinceLastActive: staleCheck.daysSinceLastActive,
+						staleDays: staleCheck.staleDays,
+						lastActiveAt: staleCheck.lastActiveAt,
+						notifyUser: staleCheck.notifyUser,
+						notifyAdmin: staleCheck.notifyAdmin
+					});
+					emitEvaluation(ctx, trackEvent);
+					try {
+						await ctx.context.internalAdapter.deleteSession(sessionToken);
+					} catch (error) {
+						logger.warn("[Sentinel] Failed to delete stale-blocked session:", error);
+					}
+					deleteSessionCookie(ctx);
+					ctx.context.setNewSession(null);
+					throw new APIError("FORBIDDEN", STALE_ACCOUNT_BLOCK_ERROR);
+				})
+			}, {
 				matcher: (ctx) => ctx.request?.method !== "GET" && !isDashRoute(ctx.path),
 				handler: createAuthMiddleware(async (ctx) => {
 					const untrustedVisitorId = ctx.context.untrustedVisitorId;
@@ -2477,14 +2627,427 @@ const sentinel = (options) => {
 						identifier: loginId,
 						userAgent: ctx.headers?.get?.("user-agent") || ""
 					});
-					if (isPasswordSignInRoute && ctx.context.returned instanceof Error && loginId && body?.password && untrustedVisitorId) await ctx.context.runInBackgroundOrAwait(securityService.trackFailedAttempt(loginId, untrustedVisitorId, body.password, ip, ctx.context.requestId ?? null));
-					if (isPasswordSignInRoute && !(ctx.context.returned instanceof Error) && loginId) await ctx.context.runInBackgroundOrAwait(securityService.clearFailedAttempts(loginId));
+					const returned = ctx.context.returned;
+					const staleBlocked = isStaleAccountError(returned);
+					if (isPasswordSignInRoute && returned instanceof Error && !staleBlocked && loginId && body?.password && untrustedVisitorId) await ctx.context.runInBackgroundOrAwait(securityService.trackFailedAttempt(loginId, untrustedVisitorId, body.password, ip, ctx.context.requestId ?? null));
+					if (isPasswordSignInRoute && (!(returned instanceof Error) || staleBlocked) && loginId) await ctx.context.runInBackgroundOrAwait(securityService.clearFailedAttempts(loginId));
 				})
 			}]
 		}
 	};
 };
 //#endregion
+//#region src/directory-sync/membership-projection.ts
+async function createMembershipKey(provisioningDomainId, userId) {
+	return `directory-sync-membership:${await hash$1(JSON.stringify([provisioningDomainId, userId]))}`;
+}
+async function findDirectory(input, context) {
+	const row = await context.database.findOne({
+		model: "directorySyncConnection",
+		where: [{
+			field: "provisioningDomainId",
+			value: input.provisioningDomainId
+		}]
+	});
+	if (!row || row.status !== "active" && row.status !== "decommissioning" && row.status !== "decommissioned" || !row.connectionId) return null;
+	return row;
+}
+async function findMembership(context, organizationId, userId) {
+	const memberships = await context.database.findMany({
+		model: "member",
+		where: [{
+			field: "organizationId",
+			value: organizationId
+		}, {
+			field: "userId",
+			value: userId
+		}]
+	});
+	if (memberships.length > 1) throw new Error("Directory sync membership projection requires a unique organization and user membership");
+	return memberships.at(0) ?? null;
+}
+async function findProvenance(context, membershipKey) {
+	return await context.database.findOne({
+		model: "directorySyncMembershipProvenance",
+		where: [{
+			field: "membershipKey",
+			value: membershipKey
+		}]
+	});
+}
+async function createProvenance(context, input) {
+	const now = /* @__PURE__ */ new Date();
+	await context.database.create({
+		model: "directorySyncMembershipProvenance",
+		data: {
+			...input,
+			createdAt: now,
+			updatedAt: now
+		}
+	});
+}
+function createOrganizationMembershipProjection(options) {
+	if (!options.role.trim()) throw new Error("Directory sync membership role must not be empty");
+	return async (input, context) => {
+		const directory = await findDirectory(input, context);
+		if (!directory?.connectionId) return;
+		const membershipKey = await createMembershipKey(input.provisioningDomainId, input.userId);
+		const [membership, provenance] = await Promise.all([findMembership(context, directory.organizationId, input.userId), findProvenance(context, membershipKey)]);
+		if (provenance && (provenance.ownership !== "created" && provenance.ownership !== "observed" || provenance.provisioningDomainId !== input.provisioningDomainId || provenance.organizationId !== directory.organizationId || provenance.userId !== input.userId)) throw new Error("Directory sync membership provenance does not match its provisioning domain");
+		if (!input.active) {
+			if (!provenance) return;
+			if (provenance.ownership === "created" && membership?.id === provenance.memberId && membership.organizationId === provenance.organizationId && membership.userId === provenance.userId) await context.database.delete({
+				model: "member",
+				where: [
+					{
+						field: "id",
+						value: provenance.memberId
+					},
+					{
+						field: "organizationId",
+						value: provenance.organizationId
+					},
+					{
+						field: "userId",
+						value: provenance.userId
+					}
+				]
+			});
+			await context.database.delete({
+				model: "directorySyncMembershipProvenance",
+				where: [{
+					field: "id",
+					value: provenance.id
+				}, {
+					field: "membershipKey",
+					value: membershipKey
+				}]
+			});
+			return;
+		}
+		if (membership) {
+			if (provenance?.memberId === membership.id) return;
+			if (provenance) await context.database.delete({
+				model: "directorySyncMembershipProvenance",
+				where: [{
+					field: "id",
+					value: provenance.id
+				}, {
+					field: "membershipKey",
+					value: membershipKey
+				}]
+			});
+			await createProvenance(context, {
+				membershipKey,
+				organizationId: directory.organizationId,
+				userId: input.userId,
+				memberId: membership.id,
+				ownership: "observed",
+				provisioningDomainId: input.provisioningDomainId
+			});
+			return;
+		}
+		if (provenance) await context.database.delete({
+			model: "directorySyncMembershipProvenance",
+			where: [{
+				field: "id",
+				value: provenance.id
+			}, {
+				field: "membershipKey",
+				value: membershipKey
+			}]
+		});
+		const now = /* @__PURE__ */ new Date();
+		const createdMembership = await context.database.create({
+			model: "member",
+			data: {
+				organizationId: directory.organizationId,
+				userId: input.userId,
+				role: options.role,
+				createdAt: now
+			}
+		});
+		await createProvenance(context, {
+			membershipKey,
+			organizationId: directory.organizationId,
+			userId: input.userId,
+			memberId: createdMembership.id,
+			ownership: "created",
+			provisioningDomainId: input.provisioningDomainId
+		});
+	};
+}
+//#endregion
+//#region src/routes/directory-sync/contract.ts
+const DIRECTORY_SYNC_PURPOSE = "directory-sync-management";
+const ALL_SCIM_SCOPES = [
+	"scim.users.read",
+	"scim.users.write",
+	"scim.groups.read",
+	"scim.groups.write"
+];
+const scimScopeSchema = z$1.enum(ALL_SCIM_SCOPES);
+const credentialPolicySchema = {
+	scopes: z$1.array(scimScopeSchema).min(1).optional(),
+	expiresAt: z$1.coerce.date().optional()
+};
+const directorySyncSSOPairingSchema = z$1.discriminatedUnion("protocol", [z$1.object({
+	ssoProviderId: z$1.string().trim().min(1).max(255),
+	protocol: z$1.literal("oidc"),
+	externalIdSource: z$1.discriminatedUnion("kind", [z$1.object({ kind: z$1.literal("subject") }), z$1.object({
+		kind: z$1.literal("verifiedIdTokenClaim"),
+		name: z$1.string().trim().min(1).max(255)
+	})])
+}), z$1.object({
+	ssoProviderId: z$1.string().trim().min(1).max(255),
+	protocol: z$1.literal("saml"),
+	externalIdSource: z$1.discriminatedUnion("kind", [z$1.object({ kind: z$1.literal("nameId") }), z$1.object({
+		kind: z$1.literal("attribute"),
+		name: z$1.string().trim().min(1).max(255)
+	})])
+})]);
+const createDirectoryBodySchema = z$1.object({
+	providerId: z$1.string().trim().min(1).max(255),
+	pairing: directorySyncSSOPairingSchema.optional(),
+	...credentialPolicySchema
+});
+const rotateCredentialBodySchema = z$1.object(credentialPolicySchema);
+const emptyBodySchema = z$1.object({});
+function setCredentialResponseSecurityHeaders(ctx) {
+	ctx.setHeader("Cache-Control", "no-store, max-age=0");
+	ctx.setHeader("Pragma", "no-cache");
+	ctx.setHeader("Referrer-Policy", "no-referrer");
+}
+//#endregion
+//#region src/directory-sync/pairing.ts
+let samlPolicyModule;
+function loadSAMLPolicy() {
+	samlPolicyModule ??= import("./saml-policy-BTVLoTyS.mjs");
+	return samlPolicyModule;
+}
+function isRecord$1(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function parseConfiguration(value) {
+	if (isRecord$1(value)) return value;
+	if (typeof value !== "string") return null;
+	try {
+		const parsed = JSON.parse(value);
+		return isRecord$1(parsed) ? parsed : null;
+	} catch {
+		return null;
+	}
+}
+function parseDirectorySyncSSOPairing(value) {
+	if (!value) return null;
+	let parsed;
+	try {
+		parsed = JSON.parse(value);
+	} catch {
+		return null;
+	}
+	const result = directorySyncSSOPairingSchema.safeParse(parsed);
+	return result.success ? result.data : null;
+}
+async function createActiveSSOProviderKey(ssoProviderRecordId) {
+	return `directory-sync-sso-active:${await hash$1(ssoProviderRecordId)}`;
+}
+function createInactiveSSOProviderKey(aliasKey) {
+	return `directory-sync-sso-inactive:${aliasKey}`;
+}
+function createTerminalSSOProviderKey(aliasKey) {
+	return `directory-sync-sso-terminal:${aliasKey}`;
+}
+async function resolveDirectorySyncSSOPairing(ctx, organizationId, pairing) {
+	const exactProvider = await ctx.context.adapter.update({
+		model: "ssoProvider",
+		where: [{
+			field: "providerId",
+			value: pairing.ssoProviderId
+		}, {
+			field: "organizationId",
+			value: organizationId
+		}],
+		update: { providerId: pairing.ssoProviderId }
+	});
+	if (!exactProvider || exactProvider.providerId !== pairing.ssoProviderId || exactProvider.organizationId !== organizationId) throw ctx.error("BAD_REQUEST", { message: "The selected SSO provider is not available" });
+	const oidcConfiguration = parseConfiguration(exactProvider.oidcConfig);
+	const samlConfiguration = parseConfiguration(exactProvider.samlConfig);
+	if (pairing.protocol === "oidc") {
+		if (!oidcConfiguration || samlConfiguration) throw ctx.error("BAD_REQUEST", { message: "The selected SSO provider is not an OIDC provider" });
+	} else {
+		if (!samlConfiguration || oidcConfiguration) throw ctx.error("BAD_REQUEST", { message: "The selected SSO provider is not a SAML provider" });
+		const samlPolicy = await loadSAMLPolicy();
+		let wantAssertionsSigned = false;
+		try {
+			wantAssertionsSigned = await samlPolicy.requiresSignedSAMLAssertions({
+				spMetadata: isRecord$1(samlConfiguration.spMetadata) ? { metadata: typeof samlConfiguration.spMetadata.metadata === "string" ? samlConfiguration.spMetadata.metadata : void 0 } : void 0,
+				wantAssertionsSigned: samlConfiguration.wantAssertionsSigned === true
+			});
+		} catch {
+			throw ctx.error("BAD_REQUEST", { message: "The selected SAML provider metadata is invalid" });
+		}
+		if (!wantAssertionsSigned) throw ctx.error("BAD_REQUEST", { message: "Paired SAML providers must require cryptographically signed assertions" });
+	}
+	return {
+		pairing,
+		ssoProviderId: exactProvider.providerId,
+		ssoProviderRecordId: exactProvider.id,
+		activeSsoProviderKey: await createActiveSSOProviderKey(exactProvider.id)
+	};
+}
+function serializePairingRow(row) {
+	return parseDirectorySyncSSOPairing(row.serializedSsoPairing);
+}
+async function guardDirectorySyncSSOProviderMutation(input, context) {
+	if (input.providerReference.source.type !== "persisted" || input.providerReference.source.recordId !== input.provider.id) throw new Error("SSO provider mutation reference is not exact");
+	if (await context.database.findOne({
+		model: "directorySyncConnection",
+		where: [
+			{
+				field: "ssoProviderRecordId",
+				value: input.provider.id
+			},
+			{
+				field: "ssoProviderId",
+				value: input.provider.providerId
+			},
+			{
+				field: "organizationId",
+				value: input.provider.organizationId
+			},
+			{
+				field: "pairingEnforced",
+				value: true
+			}
+		]
+	})) {
+		if (input.action === "update" && "isAuthenticationBoundaryChange" in input && input.isAuthenticationBoundaryChange === false) return;
+		throw new Error("SSO provider is paired with directory sync");
+	}
+}
+//#endregion
+//#region src/directory-sync/sso-user-resolution.ts
+const GENERIC_REJECTION = {
+	action: "reject",
+	code: "DIRECTORY_SYNC_AUTHENTICATION_FAILED",
+	message: "Unable to sign in with this SSO connection"
+};
+let scimCatalogModule;
+function loadSCIMCatalog() {
+	scimCatalogModule ??= import("@better-auth/scim");
+	return scimCatalogModule;
+}
+function readStringExternalId(value) {
+	if (typeof value === "string" && value.length > 0) return value;
+	return null;
+}
+function readSAMLExternalId(value) {
+	const scalar = readStringExternalId(value);
+	if (scalar) return scalar;
+	if (Array.isArray(value) && value.length === 1 && typeof value[0] === "string" && value[0].length > 0) return value[0];
+	return null;
+}
+function readExternalId(input, pairing) {
+	if (input.protocol !== pairing.protocol) return null;
+	if (pairing.protocol === "oidc" && input.protocol === "oidc") return readStringExternalId(pairing.externalIdSource.kind === "subject" ? input.accountKey.accountId : input.verifiedIdTokenClaims[pairing.externalIdSource.name]);
+	if (pairing.protocol === "saml" && input.protocol === "saml") return readSAMLExternalId(pairing.externalIdSource.kind === "nameId" ? input.accountKey.accountId : input.providerAttributes[pairing.externalIdSource.name]);
+	return null;
+}
+async function resolveOrganizationDirectorySyncUser(input, context) {
+	if (input.providerReference.source.type !== "persisted") return { action: "continue" };
+	const directories = await context.database.findMany({
+		model: "directorySyncConnection",
+		where: [
+			{
+				field: "ssoProviderRecordId",
+				value: input.providerReference.source.recordId
+			},
+			{
+				field: "ssoProviderId",
+				value: input.providerId
+			},
+			{
+				field: "pairingEnforced",
+				value: true
+			}
+		]
+	});
+	if (directories.length === 0) return { action: "continue" };
+	if (directories.length !== 1) return GENERIC_REJECTION;
+	const directory = directories[0];
+	if (directory?.status !== "active") return GENERIC_REJECTION;
+	if (directory.activeSsoProviderKey !== await createActiveSSOProviderKey(input.providerReference.source.recordId)) return GENERIC_REJECTION;
+	const pairing = parseDirectorySyncSSOPairing(directory.serializedSsoPairing);
+	if (!pairing || pairing.ssoProviderId !== input.providerId || pairing.protocol !== input.protocol || !directory.connectionId) return GENERIC_REJECTION;
+	const externalId = readExternalId(input, pairing);
+	if (!externalId) return GENERIC_REJECTION;
+	try {
+		const catalog = await loadSCIMCatalog();
+		if (typeof catalog.acquireActiveSCIMUserLink !== "function") return GENERIC_REJECTION;
+		const link = await catalog.acquireActiveSCIMUserLink({
+			connectionId: directory.connectionId,
+			externalId
+		}, { database: context.database });
+		if (!link) return GENERIC_REJECTION;
+		return {
+			action: "link",
+			userId: link.userId,
+			profile: "preserve"
+		};
+	} catch {
+		return GENERIC_REJECTION;
+	}
+}
+//#endregion
+//#region src/directory-sync/instrument.ts
+/**
+* When managed directory sync is enabled, optionally install SSO/SCIM
+* callbacks on sibling plugins (same pattern as organization hook
+* instrumentation).
+*/
+function instrumentDirectorySyncIntegration(ctx, options) {
+	if (!options.ssoPairing && !options.membershipProjection.enabled) {
+		logger.debug("[Dash] Managed directory sync instrumentation skipped (ssoPairing and membershipProjection are both disabled)");
+		return;
+	}
+	const ssoPlugin = ctx.getPlugin("sso");
+	const scimPlugin = ctx.getPlugin("scim");
+	if (!ssoPlugin && !scimPlugin) {
+		logger.debug("[Dash] Managed directory sync enabled but SSO/SCIM plugins are not active. Skipping integration instrumentation");
+		return;
+	}
+	if (options.ssoPairing) if (ssoPlugin) if (!ssoPlugin.options) logger.error("[Dash] Managed directory sync ssoPairing requires sso({ ... }) (at least sso({})) so pairing callbacks can be installed on the shared options object.");
+	else {
+		const ssoOptions = ssoPlugin.options;
+		const previousResolveUser = ssoOptions.resolveUser;
+		ssoOptions.resolveUser = async (input, context) => {
+			const result = await resolveOrganizationDirectorySyncUser(input, context);
+			if (result.action !== "continue") return result;
+			if (previousResolveUser) return previousResolveUser(input, context);
+			return { action: "continue" };
+		};
+		const previousGuard = ssoOptions.guardProviderMutation;
+		ssoOptions.guardProviderMutation = async (input, context) => {
+			await guardDirectorySyncSSOProviderMutation(input, context);
+			if (previousGuard) await previousGuard(input, context);
+		};
+	}
+	else logger.debug("[Dash] Managed directory sync ssoPairing enabled but SSO plugin is not active. Skipping SSO pairing instrumentation");
+	if (options.membershipProjection.enabled) if (scimPlugin) if (!scimPlugin.options) logger.error("[Dash] Managed directory sync membershipProjection requires scim({ ... }) with an options object so membership projection can be installed.");
+	else {
+		const scimOptions = scimPlugin.options;
+		const projection = scimOptions.projection ??= {};
+		const previousReconcileUser = projection.reconcileUser;
+		const reconcileUser = createOrganizationMembershipProjection({ role: options.membershipProjection.role });
+		projection.reconcileUser = async (input, context) => {
+			await reconcileUser(input, context);
+			if (previousReconcileUser) await previousReconcileUser(input, context);
+		};
+	}
+	else logger.debug("[Dash] Managed directory sync membershipProjection enabled but SCIM plugin is not active. Skipping membership projection instrumentation");
+}
+//#endregion
 //#region src/events/organization/events-invitation.ts
 const initInvitationEvents = (tracker) => {
 	const { trackEvent } = tracker;
@@ -2840,61 +3403,58 @@ const initTeamEvents = (tracker) => {
 };
 //#endregion
 //#region ../utils/dist/redact.mjs
-const EXACT_SENSITIVE_STRING_KEYS_LOWER = new Set([...new Set([
-	"accessToken",
-	"apiKey",
-	"apiSecret",
-	"authorization",
-	"authToken",
-	"bearerToken",
-	"backupCodes",
-	"clientSecret",
-	"consumerSecret",
-	"credentialID",
-	"deviceCode",
-	"encPrivateKey",
-	"encPrivateKeyPass",
-	"encryptionKey",
-	"encryptionSecret",
-	"forwardHeaders",
-	"idToken",
-	"oidcConfig",
-	"pass",
-	"passwd",
-	"password",
-	"privateKey",
-	"privateKeyPass",
-	"pwd",
-	"refreshToken",
-	"samlConfig",
-	"secret",
-	"secretAccessKey",
-	"secretKey",
-	"signingSecret",
-	"stripeWebhookSecret",
-	"userCode",
-	"webhookSecret"
-])].map((k) => k.toLowerCase()));
-/**
-* Case-insensitive suffixes for unknown property names.
-*/
-const SENSITIVE_KEY_SUFFIXES_LOWER = [
-	"accesskey",
-	"secret",
-	"password",
-	"passphrase",
-	"privatekey",
-	"keypass",
-	"apikey",
-	"token",
-	"signingkey",
-	"credentials",
-	"authheader"
-];
-/**
-* Embedded secret substrings checked against the normalized (compact, lowercased) key.
-*/
-const SENSITIVE_KEY_SUBSTRINGS_LOWER = ["secretaccess", "accesskeysecret"];
+/** Built-in sensitive key patterns for consumers that want the defaults. */
+const SENSITIVE_KEY_PATTERNS = {
+	keys: [
+		"accessToken",
+		"apiKey",
+		"apiSecret",
+		"authorization",
+		"authToken",
+		"bearerToken",
+		"backupCodes",
+		"clientSecret",
+		"consumerSecret",
+		"credentialID",
+		"deviceCode",
+		"encPrivateKey",
+		"encPrivateKeyPass",
+		"encryptionKey",
+		"encryptionSecret",
+		"forwardHeaders",
+		"idToken",
+		"oidcConfig",
+		"pass",
+		"passwd",
+		"password",
+		"privateKey",
+		"privateKeyPass",
+		"pwd",
+		"refreshToken",
+		"samlConfig",
+		"secret",
+		"secretAccessKey",
+		"secretKey",
+		"signingSecret",
+		"stripeWebhookSecret",
+		"userCode",
+		"webhookSecret"
+	],
+	suffixes: [
+		"accesskey",
+		"secret",
+		"password",
+		"passphrase",
+		"privatekey",
+		"keypass",
+		"apikey",
+		"token",
+		"signingkey",
+		"credentials",
+		"authheader"
+	],
+	substrings: ["secretaccess", "accesskeysecret"]
+};
 const REDACTED_SIMPLE_STRING = "[REDACTED]";
 function snakeCaseToCamelCase(key) {
 	return key.replace(/_([a-zA-Z])/g, (_, ch) => ch.toUpperCase());
@@ -2906,8 +3466,20 @@ function keyVariantsForMatching(key) {
 	if (trimmed.includes("_")) out.add(snakeCaseToCamelCase(trimmed));
 	return [...out];
 }
-/** Whether a property name should have string values redacted in `redact()`. */
-function isSensitiveStringKey(key) {
+function normalizePatterns(patterns) {
+	const keysLower = /* @__PURE__ */ new Set();
+	for (const key of patterns?.keys ?? []) keysLower.add(key.toLowerCase());
+	return {
+		keysLower,
+		suffixesLower: [...patterns?.suffixes ?? []].map((s) => s.toLowerCase()),
+		substringsLower: [...patterns?.substrings ?? []].map((s) => s.toLowerCase())
+	};
+}
+function hasAnyPatterns(patterns) {
+	return patterns.keysLower.size > 0 || patterns.suffixesLower.length > 0 || patterns.substringsLower.length > 0;
+}
+function matchesNormalizedPatterns(key, patterns) {
+	if (!hasAnyPatterns(patterns)) return false;
 	const variants = keyVariantsForMatching(key);
 	const compactLower = key.replace(/[\s._-]/g, "").toLowerCase();
 	const forms = new Set([compactLower]);
@@ -2917,9 +3489,9 @@ function isSensitiveStringKey(key) {
 	}
 	for (const form of forms) {
 		const fl = form.toLowerCase();
-		if (EXACT_SENSITIVE_STRING_KEYS_LOWER.has(fl)) return true;
-		for (const suffix of SENSITIVE_KEY_SUFFIXES_LOWER) if (fl.endsWith(suffix)) return true;
-		for (const substring of SENSITIVE_KEY_SUBSTRINGS_LOWER) if (compactLower.includes(substring)) return true;
+		if (patterns.keysLower.has(fl)) return true;
+		for (const suffix of patterns.suffixesLower) if (fl.endsWith(suffix)) return true;
+		for (const substring of patterns.substringsLower) if (compactLower.includes(substring)) return true;
 	}
 	return false;
 }
@@ -2931,7 +3503,7 @@ function isPlainSerializable(value) {
 	if (constructor && constructor.name !== "Object" && constructor.name !== "Array") return false;
 	return true;
 }
-function redactInner(value, visiting, options) {
+function redactInner(value, visiting, options, patterns) {
 	if (value === null || value === void 0) return value;
 	if (typeof value === "function") return void 0;
 	if (typeof value !== "object") return value;
@@ -2939,17 +3511,17 @@ function redactInner(value, visiting, options) {
 	if (visiting.has(obj)) return void 0;
 	visiting.add(obj);
 	try {
-		if (Array.isArray(value)) return value.map((item) => redactInner(item, visiting, options)).filter((item) => item !== void 0);
+		if (Array.isArray(value)) return value.map((item) => redactInner(item, visiting, options, patterns)).filter((item) => item !== void 0);
 		const result = {};
 		for (const [key, val] of Object.entries(value)) {
 			if (options?.excludeKeys?.has(key)) continue;
 			if (typeof val === "function") continue;
-			if (typeof val === "string" && isSensitiveStringKey(key)) {
+			if (typeof val === "string" && matchesNormalizedPatterns(key, patterns) && !options?.ignoreKeys?.has(key)) {
 				result[key] = REDACTED_SIMPLE_STRING;
 				continue;
 			}
 			if (options?.skipNonPlainSerializable && val !== null && typeof val === "object" && !isPlainSerializable(val)) continue;
-			const redacted = redactInner(val, visiting, options);
+			const redacted = redactInner(val, visiting, options, patterns);
 			if (redacted !== void 0) result[key] = redacted;
 		}
 		return result;
@@ -2957,9 +3529,55 @@ function redactInner(value, visiting, options) {
 		visiting.delete(obj);
 	}
 }
-/** Recursively redact sensitive string values in a JSON-like object tree. */
+/**
+* Recursively walk a JSON-like object tree.
+*
+* String values are redacted only when `patterns` is provided. With no patterns,
+* this only applies structural options (`excludeKeys`,
+* `skipNonPlainSerializable`, dropping functions).
+*/
 function redact(value, options) {
-	return redactInner(value, /* @__PURE__ */ new WeakSet(), options);
+	const patterns = normalizePatterns(options?.patterns);
+	return redactInner(value, /* @__PURE__ */ new WeakSet(), options, patterns);
+}
+const DASH_PLUGIN_OPTIONS_EXCLUDE_KEYS = { stripe: new Set(["stripeClient"]) };
+/** Storage-strategy enums that match sensitive key suffixes but are not secrets. */
+const DASH_PLUGIN_OPTIONS_IGNORE_KEYS = new Set([
+	"storeApiKey",
+	"storeClientSecret",
+	"storeSCIMToken",
+	"storeToken"
+]);
+function redactDashPluginOptions(pluginId, options, redactOptions) {
+	return redact(options, {
+		patterns: SENSITIVE_KEY_PATTERNS,
+		...redactOptions,
+		excludeKeys: DASH_PLUGIN_OPTIONS_EXCLUDE_KEYS[pluginId],
+		ignoreKeys: DASH_PLUGIN_OPTIONS_IGNORE_KEYS
+	});
+}
+/**
+* Redact a dash settings payload: `emailAndPassword` and each plugin's `options`.
+*/
+function redactDashSettings(data, redactOptions) {
+	if (data === null || typeof data !== "object") return data;
+	const d = data;
+	const next = { ...d };
+	if ("emailAndPassword" in d) next.emailAndPassword = redact(d.emailAndPassword, {
+		patterns: SENSITIVE_KEY_PATTERNS,
+		...redactOptions
+	});
+	const plugins = d.plugins;
+	if (Array.isArray(plugins)) next.plugins = plugins.map((plugin) => {
+		if (plugin === null || typeof plugin !== "object") return plugin;
+		const p = plugin;
+		const id = typeof p.id === "string" ? p.id : "";
+		return {
+			...p,
+			options: redactDashPluginOptions(id, p.options, redactOptions)
+		};
+	});
+	return next;
 }
 //#endregion
 //#region ../utils/dist/crypto/index.mjs
@@ -3128,13 +3746,61 @@ const jwtValidateMiddleware = (options) => {
 	});
 };
 //#endregion
-//#region src/lib/redact-plugin-options.ts
-const PLUGIN_OPTIONS_EXCLUDE_KEYS = { stripe: new Set(["stripeClient"]) };
-function redactPluginOptions(pluginId, options, optionsConfig) {
-	return redact(options, {
-		...optionsConfig,
-		excludeKeys: PLUGIN_OPTIONS_EXCLUDE_KEYS[pluginId]
-	});
+//#region ../utils/dist/semver.mjs
+/**
+* Parses a semver string into components.
+* Accepts `major.minor`, `major.minor.patch`, and optional prerelease (`-rc.2`).
+* Returns `null` when the input is missing or not a valid semver prefix.
+*/
+function parseSemver(version) {
+	if (!version) return null;
+	const match = version.trim().match(/^(\d+)\.(\d+)(?:\.(\d+))?(?:-([0-9A-Za-z.-]+))?/);
+	if (!match) return null;
+	return {
+		major: Number(match[1]),
+		minor: Number(match[2]),
+		patch: Number(match[3] ?? 0),
+		prerelease: match[4]
+	};
+}
+function resolve(version) {
+	if (typeof version === "string" || version == null) return parseSemver(version);
+	return version;
+}
+/**
+* True when `version`'s core identity (`major.minor.patch`) is ≥ `target`.
+* Prerelease on `version` is ignored (e.g. `1.7.0-rc.1` ≥ `1.7.0`).
+* `target` may be `major.minor` or `major.minor.patch` (missing patch → 0).
+*/
+function isSemverAtLeast(version, target) {
+	const parsed = resolve(version);
+	const targetParsed = parseSemver(target);
+	if (!parsed || !targetParsed) return false;
+	if (parsed.major !== targetParsed.major) return parsed.major > targetParsed.major;
+	if (parsed.minor !== targetParsed.minor) return parsed.minor > targetParsed.minor;
+	return parsed.patch >= targetParsed.patch;
+}
+//#endregion
+//#region src/semver.ts
+/** Compare semver strings (e.g. "1.7.0-beta.8" against "1.7" or "1.7.0"). */
+function isVersionAtLeast(version, target) {
+	return isSemverAtLeast(version, target);
+}
+/**
+* True for better-auth 1.7+ (including 1.8+).
+* Marks the cutover for issuer-scoped accounts, protocol-defined SSO subjects,
+* `advanced.database.joins`, and post-legacy SCIM connections.
+* Keep in sync with `apps/web/lib/better-auth-compat.ts`.
+*/
+function isBetterAuth17OrLater(version) {
+	const parsed = parseSemver(version);
+	if (!parsed) return false;
+	if (isSemverAtLeast(parsed, "1.8.0")) return true;
+	if (!isSemverAtLeast(parsed, "1.7.0")) return false;
+	if (!parsed.prerelease || parsed.patch > 0) return true;
+	const prereleaseMatch = parsed.prerelease.match(/^rc\.(\d+)/);
+	if (prereleaseMatch) return Number(prereleaseMatch[1]) >= 4;
+	return false;
 }
 //#endregion
 //#region src/routes/auth/config.ts
@@ -3150,16 +3816,16 @@ const getConfig = (options) => {
 	}, async (ctx) => {
 		const advancedOptions = ctx.context.options.advanced;
 		const organizationPlugin = ctx.context.getPlugin("organization");
-		return {
+		return redactDashSettings({
 			version: ctx.context.version || null,
 			socialProviders: Object.keys(ctx.context.options.socialProviders || {}),
-			emailAndPassword: redact(ctx.context.options.emailAndPassword, { skipNonPlainSerializable: true }),
+			emailAndPassword: ctx.context.options.emailAndPassword,
 			plugins: ctx.context.options.plugins?.map((plugin) => {
 				const base = {
 					id: plugin.id,
 					schema: plugin.schema,
 					version: plugin.version,
-					options: redactPluginOptions(plugin.id, plugin.options, { skipNonPlainSerializable: true })
+					options: plugin.options
 				};
 				if (plugin.id === "dash" && !plugin.version) return {
 					...base,
@@ -3262,9 +3928,14 @@ const getConfig = (options) => {
 					secure: typeof ctx.context.options.advanced?.defaultCookieAttributes?.secure !== "undefined" ? ctx.context.options.advanced?.defaultCookieAttributes?.secure : null
 				} : null,
 				appName: ctx.context.options.appName || null,
-				hasJoinsEnabled: ctx.context.options.experimental?.joins === true
+				hasJoinsEnabled: (() => {
+					const advancedJoins = (ctx.context.options.advanced?.database)?.joins === true;
+					if (isBetterAuth17OrLater(ctx.context.version)) return advancedJoins;
+					return advancedJoins || ctx.context.options.experimental?.joins === true;
+				})(),
+				hasErrorURLConfigured: !!ctx.context.options.onAPIError?.errorURL
 			}
-		};
+		}, { skipNonPlainSerializable: true });
 	});
 };
 //#endregion
@@ -3279,58 +3950,948 @@ const getValidate = (options) => {
 	}, async () => {
 		return { valid: true };
 	});
-};
-//#endregion
-//#region src/semver.ts
-function parseVersion(version) {
-	if (!version) return null;
-	const match = version.trim().match(/^(\d+)\.(\d+)\.(\d+)/);
-	if (!match) return null;
-	return [
-		Number(match[1]),
-		Number(match[2]),
-		Number(match[3])
-	];
+};
+//#endregion
+//#region src/routes/organization-guards.ts
+/** Returns true if organization plugin is enabled. */
+function isOrganizationEnabled(ctx) {
+	return !!ctx.context.getPlugin("organization");
+}
+/** Returns the organization plugin, throws if not enabled. Use for write endpoints. */
+function requireOrganizationPlugin(ctx) {
+	const plugin = ctx.context.getPlugin("organization");
+	if (!plugin) throw ctx.error("BAD_REQUEST", { message: "Organization plugin not enabled" });
+	return plugin;
+}
+/** Returns true if organization plugin and teams feature are enabled. */
+function isTeamsEnabled(ctx) {
+	return !!ctx.context.getPlugin("organization")?.options?.teams?.enabled;
+}
+/**
+* Validates that the organization plugin is enabled and teams feature is enabled.
+*
+* @returns The organization options for use in team logic (maximumTeams, hooks, etc.)
+*/
+function requireTeamsEnabled(ctx) {
+	const orgOptions = requireOrganizationPlugin(ctx).options || {};
+	if (!orgOptions?.teams?.enabled) throw ctx.error("BAD_REQUEST", { message: "Teams are not enabled" });
+	return orgOptions;
+}
+//#endregion
+//#region src/routes/directory-sync/managed-catalog.ts
+function getRequestHeaders(ctx) {
+	return ctx.request?.headers ?? new Headers();
+}
+function getManagedEndpoints(ctx) {
+	const plugin = ctx.context.getPlugin("scim");
+	if (!plugin?.endpoints) throw ctx.error("BAD_REQUEST", { message: "SCIM managed connections are unavailable. Install a Better Auth release that includes the managed SCIM catalog and configure managedConnections." });
+	return plugin.endpoints;
+}
+function requireManagedEndpoint(ctx, endpoint, name) {
+	if (!endpoint) throw ctx.error("BAD_REQUEST", { message: `SCIM managed connection operation "${name}" is unavailable. Publish and install the required Better Auth SCIM release.` });
+	return endpoint;
+}
+function assertManagedConnectionLifecycleConfigured(ctx) {
+	const endpoints = getManagedEndpoints(ctx);
+	requireManagedEndpoint(ctx, endpoints.createSCIMManagedConnection, "create");
+	requireManagedEndpoint(ctx, endpoints.listSCIMManagedConnections, "list");
+	requireManagedEndpoint(ctx, endpoints.getSCIMManagedConnection, "get");
+	requireManagedEndpoint(ctx, endpoints.rotateSCIMManagedCredential, "rotate");
+	requireManagedEndpoint(ctx, endpoints.revokeSCIMManagedCredential, "revoke");
+	requireManagedEndpoint(ctx, endpoints.decommissionSCIMManagedConnection, "decommission");
+	return endpoints;
+}
+async function getManagedState(ctx, connection) {
+	if (!connection.connectionId) return;
+	return await requireManagedEndpoint(ctx, getManagedEndpoints(ctx).getSCIMManagedConnection, "get")({
+		body: {
+			connectionId: connection.connectionId,
+			provisioningDomainId: connection.provisioningDomainId
+		},
+		context: ctx.context,
+		headers: getRequestHeaders(ctx)
+	});
+}
+//#endregion
+//#region src/routes/directory-sync/mode.ts
+function getSCIMPlugin(ctx) {
+	return ctx.context.getPlugin("scim");
+}
+function getDashPluginOptions(ctx) {
+	return ctx.context.getPlugin("dash")?.options;
+}
+/** True when dash was configured with `managedDirectorySync: { enabled: true }`. */
+function isManagedDirectorySyncEnabled(ctx) {
+	return getDashPluginOptions(ctx)?.managedDirectorySync?.enabled === true;
+}
+function usesLegacyScimDirectorySync(scimPlugin) {
+	return typeof scimPlugin?.endpoints.generateSCIMToken === "function";
+}
+/** True when the SCIM plugin exposes the 1.7+ managed connection endpoints. */
+function hasManagedScimSurface(scimPlugin) {
+	return typeof scimPlugin?.endpoints.createSCIMManagedConnection === "function" && typeof scimPlugin?.endpoints.listSCIMManagedConnections === "function";
+}
+function usesManagedScimDirectorySync(scimPlugin) {
+	return hasManagedScimSurface(scimPlugin) && scimPlugin?.options?.managedConnections != null;
+}
+/**
+* Resolve which directory-sync experience the dashboard should use.
+* Managed mode also requires dash `managedDirectorySync.enabled`.
+* Legacy SCIM mode ignores that option.
+*/
+function resolveDirectorySyncMode(scimPlugin, managedDirectorySyncEnabled = false) {
+	if (!scimPlugin) return "unavailable";
+	if (hasManagedScimSurface(scimPlugin)) return usesManagedScimDirectorySync(scimPlugin) && managedDirectorySyncEnabled ? "managed" : "unavailable";
+	if (usesLegacyScimDirectorySync(scimPlugin)) {
+		const ownership = scimPlugin.options?.providerOwnership;
+		if (ownership != null && ownership.enabled !== true) return "unavailable";
+		return "legacy";
+	}
+	return "unavailable";
+}
+function assertManagedDirectorySyncEnabled(ctx) {
+	if (isManagedDirectorySyncEnabled(ctx)) return;
+	throw ctx.error("BAD_REQUEST", { message: "Managed directory sync is disabled. Enable dash({ managedDirectorySync: { enabled: true } }) and migrate the directory sync schema. Legacy SCIM directory sync does not use this option." });
+}
+//#endregion
+//#region src/routes/directory-sync/route-contract.ts
+const DIRECTORY_SYNC_CREDENTIAL_LIFETIME_MS = 365 * 24 * 60 * 60 * 1e3;
+const directorySyncClaimsSchema = z$1.object({
+	purpose: z$1.literal(DIRECTORY_SYNC_PURPOSE),
+	organizationId: z$1.string().trim().min(1),
+	actorId: z$1.string().trim().min(1),
+	setupOperationId: z$1.string().trim().min(16).max(255).optional()
+});
+function getScimEndpoint$1(baseUrl) {
+	return `${baseUrl}/scim/v2`;
+}
+function assertDirectorySyncClaims(ctx, organizationId) {
+	const claims = ctx.context.payload;
+	if (claims.purpose !== "directory-sync-management" || claims.organizationId !== organizationId || !claims.actorId) throw ctx.error("UNAUTHORIZED", { message: "Invalid directory sync management authorization" });
+	return claims;
+}
+function assertDirectorySyncManagementClaims(ctx, organizationId) {
+	const claims = assertDirectorySyncClaims(ctx, organizationId);
+	if (claims.setupOperationId) throw ctx.error("FORBIDDEN", { message: "Directory sync setup authorization cannot perform management operations" });
+	const { setupOperationId: _, ...managementClaims } = claims;
+	return managementClaims;
+}
+async function assertTargetOrganizationExists(ctx, organizationId) {
+	if (!await ctx.context.adapter.findOne({
+		model: "organization",
+		where: [{
+			field: "id",
+			value: organizationId
+		}],
+		select: ["id"]
+	})) throw ctx.error("NOT_FOUND", { message: "Target organization not found" });
+}
+function resolveCredentialPolicy(input) {
+	const expiresAt = input.expiresAt ?? new Date(Date.now() + DIRECTORY_SYNC_CREDENTIAL_LIFETIME_MS);
+	if (expiresAt.getTime() <= Date.now()) throw new APIError$1("BAD_REQUEST", { message: "Directory sync credential expiry must be in the future" });
+	const scopes = input.scopes ?? ALL_SCIM_SCOPES;
+	if (new Set(scopes).size !== scopes.length) throw new APIError$1("BAD_REQUEST", { message: "Directory sync credential scopes must be unique" });
+	return {
+		scopes,
+		expiresAt
+	};
+}
+function serializeDate(value) {
+	return value instanceof Date ? value.toISOString() : value;
+}
+function serializeNullableDate(value) {
+	return value == null ? null : serializeDate(value);
+}
+function serializeCredential(credential) {
+	return {
+		credentialId: credential.credentialId,
+		status: credential.status,
+		scopes: credential.scopes,
+		expiresAt: serializeDate(credential.expiresAt),
+		createdAt: serializeDate(credential.createdAt),
+		createdBy: credential.createdBy,
+		lastUsedAt: serializeNullableDate(credential.lastUsedAt),
+		revokedAt: serializeNullableDate(credential.revokedAt),
+		revokedBy: credential.revokedBy
+	};
+}
+function serializeDirectory(row, scimEndpoint, state) {
+	return {
+		connectionId: row.connectionId ?? null,
+		organizationId: row.organizationId,
+		providerId: row.providerId,
+		provisioningDomainId: row.provisioningDomainId,
+		status: row.status,
+		scimEndpoint,
+		credentials: state?.credentials.map(serializeCredential) ?? [],
+		createdAt: serializeDate(row.createdAt),
+		updatedAt: serializeDate(row.updatedAt),
+		pairing: serializePairingRow(row),
+		pairingEnforced: row.pairingEnforced === true,
+		unpairedAt: serializeNullableDate(row.unpairedAt ?? null),
+		unpairedBy: row.unpairedBy ?? null,
+		decommissionedAt: serializeNullableDate(row.decommissionedAt ?? null)
+	};
+}
+//#endregion
+//#region src/routes/directory-sync/transaction.ts
+/**
+* `better-auth` and `@better-auth/core` can resolve to distinct physical
+* copies of the same version. Endpoint adapters are typed from the former;
+* `runWithTransaction` / `getCurrentAdapter` are typed from the latter.
+*/
+function runWithTransaction$1(adapter, fn) {
+	return runWithTransaction(adapter, fn);
+}
+function getCurrentAdapter$1(adapter) {
+	return getCurrentAdapter(adapter);
+}
+//#endregion
+//#region src/routes/directory-sync/reservation.ts
+function withTransactionAdapter(ctx, adapter) {
+	return {
+		...ctx,
+		context: {
+			...ctx.context,
+			adapter
+		}
+	};
+}
+async function createAliasKey(organizationId, providerId) {
+	return `directory-sync-alias:${await hash$1(JSON.stringify([organizationId, providerId]))}`;
+}
+async function createProvisioningDomainId(organizationId, providerId) {
+	return `dash_scim_domain_${await hash$1(JSON.stringify({
+		purpose: DIRECTORY_SYNC_PURPOSE,
+		organizationId,
+		providerId
+	}))}`;
+}
+async function createActiveOrganizationKey(organizationId) {
+	return `directory-sync-active:${await hash$1(organizationId)}`;
+}
+function createInactiveOrganizationKey(aliasKey) {
+	return `directory-sync-inactive:${aliasKey}`;
+}
+function createCreationRequestId() {
+	return generateRandomString(32, "a-z", "A-Z", "0-9", "-_");
+}
+function isUniqueConstraintError(error) {
+	return error instanceof Error && /unique|duplicate|constraint|P2002/i.test(error.message);
+}
+async function assertManagedDirectoryTransactionsConfigured(ctx) {
+	if (typeof ctx.context.adapter.options?.adapterConfig.transaction !== "function") throw ctx.error("NOT_IMPLEMENTED", {
+		code: "DIRECTORY_SYNC_REQUIRES_NATIVE_TRANSACTIONS",
+		message: "Managed directory sync requires a database adapter with native transaction support"
+	});
+	try {
+		await getCurrentDBAdapterAsyncLocalStorage();
+	} catch {
+		throw ctx.error("NOT_IMPLEMENTED", {
+			code: "DIRECTORY_SYNC_REQUIRES_ASYNC_CONTEXT",
+			message: "Managed directory sync requires database transaction async context support"
+		});
+	}
+}
+async function assertDirectorySyncSSOIntegrationConfigured(ctx) {
+	const ssoPlugin = ctx.context.getPlugin("sso");
+	if (typeof ssoPlugin?.options?.resolveUser !== "function" || typeof ssoPlugin.options.guardProviderMutation !== "function") throw ctx.error("BAD_REQUEST", { message: "Paired directory sync requires SSO resolveUser and guardProviderMutation callbacks. Enable dash({ managedDirectorySync: { enabled: true, ssoPairing: true } }) and pass sso({}) (or richer SSO options) so dash can install them." });
+	await assertManagedDirectoryTransactionsConfigured(ctx);
+}
+async function findDirectorySyncConnection(ctx, organizationId, providerId) {
+	return await (await getCurrentAdapter$1(ctx.context.adapter)).findOne({
+		model: "directorySyncConnection",
+		where: [{
+			field: "organizationId",
+			value: organizationId
+		}, {
+			field: "providerId",
+			value: providerId
+		}]
+	});
+}
+async function getDirectorySyncConnection(ctx, organizationId, providerId) {
+	const row = await findDirectorySyncConnection(ctx, organizationId, providerId);
+	if (!row) throw ctx.error("NOT_FOUND", { message: "Directory sync connection not found" });
+	return row;
+}
+function isExactManagedConnection(issued, input) {
+	return issued.connection.creationRequestId === input.creationRequestId && issued.connection.provisioningDomainId === input.provisioningDomainId;
+}
+async function lockExactPairedSSOProvider(adapter, row) {
+	if (!row.pairingEnforced) return;
+	if (!row.ssoProviderRecordId || !row.ssoProviderId) throw new Error("Enforced directory sync pairing is incomplete");
+	if (!await adapter.update({
+		model: "ssoProvider",
+		where: [
+			{
+				field: "id",
+				value: row.ssoProviderRecordId
+			},
+			{
+				field: "providerId",
+				value: row.ssoProviderId
+			},
+			{
+				field: "organizationId",
+				value: row.organizationId
+			}
+		],
+		update: { providerId: row.ssoProviderId }
+	})) throw new Error("Paired SSO provider changed during directory sync");
+}
+async function recoverManagedDirectoryConnection(ctx, row, input, policy) {
+	if (row.organizationId !== input.organizationId || row.providerId !== input.providerId || row.creationRequestId !== input.creationRequestId || row.status !== "active" || !row.connectionId) throw ctx.error("CONFLICT", { message: "This directory sync alias belongs to a different setup operation" });
+	const connectionId = row.connectionId;
+	const serializedPairing = input.pairing ? JSON.stringify(input.pairing) : null;
+	if ((row.serializedSsoPairing ?? null) !== serializedPairing) throw ctx.error("CONFLICT", { message: "Directory sync setup recovery must use the original SSO pairing" });
+	const endpoints = getManagedEndpoints(ctx);
+	const getManagedConnection = requireManagedEndpoint(ctx, endpoints.getSCIMManagedConnection, "get");
+	const revokeManagedCredential = requireManagedEndpoint(ctx, endpoints.revokeSCIMManagedCredential, "revoke");
+	const rotateManagedCredential = requireManagedEndpoint(ctx, endpoints.rotateSCIMManagedCredential, "rotate");
+	return await runWithTransaction$1(ctx.context.adapter, async () => {
+		const database = await getCurrentAdapter$1(ctx.context.adapter);
+		await lockExactPairedSSOProvider(database, row);
+		const locked = await database.update({
+			model: "directorySyncConnection",
+			where: [
+				{
+					field: "id",
+					value: row.id
+				},
+				{
+					field: "status",
+					value: "active"
+				},
+				{
+					field: "revision",
+					value: row.revision
+				},
+				{
+					field: "connectionId",
+					value: connectionId
+				},
+				{
+					field: "creationRequestId",
+					value: input.creationRequestId
+				}
+			],
+			update: {
+				revision: row.revision + 1,
+				updatedAt: /* @__PURE__ */ new Date(),
+				lastActorId: input.actorId,
+				lastError: null
+			}
+		});
+		if (!locked) throw ctx.error("CONFLICT", { message: "Directory sync connection changed before setup recovery started" });
+		const state = await getManagedConnection({
+			body: {
+				connectionId,
+				provisioningDomainId: row.provisioningDomainId
+			},
+			context: ctx.context,
+			headers: getRequestHeaders(ctx)
+		});
+		if (state.connection.connectionId !== connectionId || state.connection.creationRequestId !== input.creationRequestId || state.connection.provisioningDomainId !== row.provisioningDomainId || state.connection.status !== "active") throw ctx.error("CONFLICT", { message: "Managed connection ownership changed before setup recovery" });
+		for (const credential of state.credentials) {
+			if (credential.status !== "active") continue;
+			await revokeManagedCredential({
+				body: {
+					connectionId,
+					provisioningDomainId: row.provisioningDomainId,
+					credentialId: credential.credentialId,
+					actorId: input.actorId
+				},
+				context: ctx.context,
+				headers: getRequestHeaders(ctx)
+			});
+		}
+		const issued = await rotateManagedCredential({
+			body: {
+				connectionId,
+				provisioningDomainId: row.provisioningDomainId,
+				actorId: input.actorId,
+				...policy
+			},
+			context: ctx.context,
+			headers: getRequestHeaders(ctx)
+		});
+		if (issued.connection.connectionId !== connectionId || issued.connection.creationRequestId !== input.creationRequestId || issued.connection.provisioningDomainId !== row.provisioningDomainId) throw ctx.error("CONFLICT", { message: "Managed connection recovery returned mismatched ownership correlation" });
+		return {
+			row: locked,
+			issued
+		};
+	});
+}
+async function createManagedDirectoryConnection(ctx, input, policy) {
+	await assertManagedDirectoryTransactionsConfigured(ctx);
+	if (input.pairing) await assertDirectorySyncSSOIntegrationConfigured(ctx);
+	if (input.pairing?.protocol === "saml") try {
+		await loadSAMLPolicy();
+	} catch {
+		throw ctx.error("NOT_IMPLEMENTED", {
+			code: "DIRECTORY_SYNC_SAML_POLICY_UNAVAILABLE",
+			message: "SAML pairing requires a compatible SSO package with service provider metadata policy support"
+		});
+	}
+	const aliasKey = await createAliasKey(input.organizationId, input.providerId);
+	const provisioningDomainId = await createProvisioningDomainId(input.organizationId, input.providerId);
+	const activeOrganizationKey = await createActiveOrganizationKey(input.organizationId);
+	const creationRequestId = input.creationRequestId ?? createCreationRequestId();
+	const createManagedConnection = requireManagedEndpoint(ctx, getManagedEndpoints(ctx).createSCIMManagedConnection, "create");
+	try {
+		return await runWithTransaction$1(ctx.context.adapter, async () => {
+			const database = await getCurrentAdapter$1(ctx.context.adapter);
+			const transactionContext = withTransactionAdapter(ctx, database);
+			const pairing = input.pairing ? await resolveDirectorySyncSSOPairing(transactionContext, input.organizationId, input.pairing) : null;
+			const now = /* @__PURE__ */ new Date();
+			const row = await database.create({
+				model: "directorySyncConnection",
+				data: {
+					organizationId: input.organizationId,
+					providerId: input.providerId,
+					aliasKey,
+					provisioningDomainId,
+					activeOrganizationKey,
+					creationRequestId,
+					status: "active",
+					revision: 0,
+					createdAt: now,
+					createdByActorId: input.actorId,
+					updatedAt: now,
+					lastActorId: input.actorId,
+					activeSsoProviderKey: pairing?.activeSsoProviderKey ?? createInactiveSSOProviderKey(aliasKey),
+					pairingEnforced: pairing != null,
+					...pairing ? {
+						ssoProviderId: pairing.ssoProviderId,
+						ssoProviderRecordId: pairing.ssoProviderRecordId,
+						serializedSsoPairing: JSON.stringify(pairing.pairing)
+					} : {}
+				}
+			});
+			const issued = await createManagedConnection({
+				body: {
+					creationRequestId,
+					provisioningDomainId,
+					actorId: input.actorId,
+					...policy
+				},
+				context: ctx.context,
+				headers: getRequestHeaders(ctx)
+			});
+			if (!isExactManagedConnection(issued, {
+				creationRequestId,
+				provisioningDomainId
+			})) throw ctx.error("CONFLICT", { message: "Managed connection creation returned mismatched ownership correlation" });
+			await lockExactPairedSSOProvider(database, row);
+			const bound = await database.update({
+				model: "directorySyncConnection",
+				where: [
+					{
+						field: "id",
+						value: row.id
+					},
+					{
+						field: "status",
+						value: "active"
+					},
+					{
+						field: "revision",
+						value: 0
+					},
+					{
+						field: "connectionId",
+						value: null
+					}
+				],
+				update: {
+					connectionId: issued.connection.connectionId,
+					revision: 1,
+					updatedAt: /* @__PURE__ */ new Date()
+				}
+			});
+			if (!bound) throw ctx.error("CONFLICT", { message: "Directory sync connection changed before catalog binding completed" });
+			await supersedeTerminalDirectorySyncPairings(transactionContext, bound);
+			return {
+				row: bound,
+				issued
+			};
+		});
+	} catch (error) {
+		if (isUniqueConstraintError(error)) {
+			const aliasConflict = await ctx.context.adapter.findOne({
+				model: "directorySyncConnection",
+				where: [{
+					field: "aliasKey",
+					value: aliasKey
+				}]
+			});
+			if (aliasConflict) {
+				if (input.creationRequestId && aliasConflict.creationRequestId === input.creationRequestId && aliasConflict.organizationId === input.organizationId && aliasConflict.providerId === input.providerId && aliasConflict.provisioningDomainId === provisioningDomainId) return await recoverManagedDirectoryConnection(ctx, aliasConflict, {
+					...input,
+					creationRequestId: input.creationRequestId
+				}, policy);
+				throw ctx.error("CONFLICT", { message: "This organization already has a directory sync connection for the requested provider" });
+			}
+			if (await ctx.context.adapter.findOne({
+				model: "directorySyncConnection",
+				where: [{
+					field: "activeOrganizationKey",
+					value: activeOrganizationKey
+				}]
+			})) throw ctx.error("CONFLICT", { message: "This organization already has an active directory sync connection" });
+			throw error;
+		}
+		throw error;
+	}
+}
+function createTerminalOrganizationKey(aliasKey) {
+	return createInactiveOrganizationKey(aliasKey);
+}
+function createTerminalPairingKey(aliasKey) {
+	return createTerminalSSOProviderKey(aliasKey);
+}
+async function supersedeTerminalDirectorySyncPairings(ctx, activeRow) {
+	if (!activeRow.ssoProviderRecordId || !activeRow.pairingEnforced) return;
+	const terminalRows = await ctx.context.adapter.findMany({
+		model: "directorySyncConnection",
+		where: [{
+			field: "ssoProviderRecordId",
+			value: activeRow.ssoProviderRecordId
+		}, {
+			field: "pairingEnforced",
+			value: true
+		}]
+	});
+	const now = /* @__PURE__ */ new Date();
+	for (const row of terminalRows) {
+		if (row.id === activeRow.id || row.status !== "decommissioned") continue;
+		if (!await ctx.context.adapter.update({
+			model: "directorySyncConnection",
+			where: [
+				{
+					field: "id",
+					value: row.id
+				},
+				{
+					field: "status",
+					value: "decommissioned"
+				},
+				{
+					field: "revision",
+					value: row.revision
+				},
+				{
+					field: "pairingEnforced",
+					value: true
+				}
+			],
+			update: {
+				pairingEnforced: false,
+				revision: row.revision + 1,
+				unpairedAt: now,
+				unpairedBy: activeRow.lastActorId,
+				updatedAt: now,
+				lastActorId: activeRow.lastActorId
+			}
+		})) throw ctx.error("CONFLICT", { message: "Directory sync SSO pairing changed before replacement activation" });
+	}
+}
+async function startDirectorySyncDecommission(ctx, row, actorId) {
+	if (row.status !== "active") return row;
+	await assertManagedDirectoryTransactionsConfigured(ctx);
+	return await runWithTransaction$1(ctx.context.adapter, async () => {
+		const database = await getCurrentAdapter$1(ctx.context.adapter);
+		await lockExactPairedSSOProvider(database, row);
+		const updated = await database.update({
+			model: "directorySyncConnection",
+			where: [
+				{
+					field: "id",
+					value: row.id
+				},
+				{
+					field: "status",
+					value: "active"
+				},
+				{
+					field: "revision",
+					value: row.revision
+				}
+			],
+			update: {
+				status: "decommissioning",
+				revision: row.revision + 1,
+				decommissionStartedAt: /* @__PURE__ */ new Date(),
+				updatedAt: /* @__PURE__ */ new Date(),
+				lastActorId: actorId
+			}
+		});
+		if (!updated) throw ctx.error("CONFLICT", { message: "Directory sync connection changed while decommissioning started" });
+		return updated;
+	});
 }
-/** Compare semver strings (e.g. "1.7.0-beta.8" against "1.7" or "1.7.0"). */
-function isVersionAtLeast(version, target) {
-	const parsed = parseVersion(version);
-	if (!parsed) return false;
-	const targetParts = target.split(".").map(Number);
-	const major = targetParts[0] ?? 0;
-	const minor = targetParts[1] ?? 0;
-	const patch = targetParts[2] ?? 0;
-	const [vMajor, vMinor, vPatch] = parsed;
-	if (vMajor !== major) return vMajor > major;
-	if (vMinor !== minor) return vMinor > minor;
-	return vPatch >= patch;
+async function unpairTerminalDirectorySyncConnection(ctx, row, actorId) {
+	if (row.status !== "decommissioned") throw ctx.error("CONFLICT", { message: "Directory sync can only be unpaired after it has decommissioned" });
+	if (!row.pairingEnforced) return row;
+	await assertManagedDirectoryTransactionsConfigured(ctx);
+	return await runWithTransaction$1(ctx.context.adapter, async () => {
+		const database = await getCurrentAdapter$1(ctx.context.adapter);
+		await lockExactPairedSSOProvider(database, row);
+		const now = /* @__PURE__ */ new Date();
+		const updated = await database.update({
+			model: "directorySyncConnection",
+			where: [
+				{
+					field: "id",
+					value: row.id
+				},
+				{
+					field: "status",
+					value: "decommissioned"
+				},
+				{
+					field: "revision",
+					value: row.revision
+				},
+				{
+					field: "pairingEnforced",
+					value: true
+				}
+			],
+			update: {
+				activeSsoProviderKey: createTerminalSSOProviderKey(row.aliasKey),
+				pairingEnforced: false,
+				revision: row.revision + 1,
+				unpairedAt: now,
+				unpairedBy: actorId,
+				updatedAt: now,
+				lastActorId: actorId
+			}
+		});
+		if (!updated) throw ctx.error("CONFLICT", { message: "Directory sync SSO pairing changed before it was unpaired" });
+		return updated;
+	});
 }
 //#endregion
-//#region src/routes/organization-guards.ts
-/** Returns true if organization plugin is enabled. */
-function isOrganizationEnabled(ctx) {
-	return !!ctx.context.getPlugin("organization");
-}
-/** Returns the organization plugin, throws if not enabled. Use for write endpoints. */
-function requireOrganizationPlugin(ctx) {
-	const plugin = ctx.context.getPlugin("organization");
-	if (!plugin) throw ctx.error("BAD_REQUEST", { message: "Organization plugin not enabled" });
-	return plugin;
-}
-/** Returns true if organization plugin and teams feature are enabled. */
-function isTeamsEnabled(ctx) {
-	return !!ctx.context.getPlugin("organization")?.options?.teams?.enabled;
+//#region src/routes/directory-sync/managed-directories.ts
+/** Shared list handler for mode-dispatch on GET /:id/directories. */
+async function listOrganizationDirectoriesManagedHandler(ctx) {
+	requireOrganizationPlugin(ctx);
+	assertManagedDirectorySyncEnabled(ctx);
+	const organizationId = tryDecode(ctx.params?.id ?? "");
+	assertDirectorySyncManagementClaims(ctx, organizationId);
+	await assertTargetOrganizationExists(ctx, organizationId);
+	const rows = await ctx.context.adapter.findMany({
+		model: "directorySyncConnection",
+		where: [{
+			field: "organizationId",
+			value: organizationId
+		}],
+		sortBy: {
+			field: "createdAt",
+			direction: "desc"
+		}
+	});
+	return await Promise.all(rows.map(async (row) => serializeDirectory(row, getScimEndpoint$1(ctx.context.baseURL), await getManagedState(ctx, row))));
 }
-/**
-* Validates that the organization plugin is enabled and teams feature is enabled.
-*
-* @returns The organization options for use in team logic (maximumTeams, hooks, etc.)
-*/
-function requireTeamsEnabled(ctx) {
-	const orgOptions = requireOrganizationPlugin(ctx).options || {};
-	if (!orgOptions?.teams?.enabled) throw ctx.error("BAD_REQUEST", { message: "Teams are not enabled" });
-	return orgOptions;
+const getOrganizationDirectory = (options) => createAuthEndpoint("/dash/organization/:id/directories/:providerId", {
+	method: "GET",
+	use: [jwtMiddleware(options, directorySyncClaimsSchema)]
+}, async (ctx) => {
+	requireOrganizationPlugin(ctx);
+	assertManagedDirectorySyncEnabled(ctx);
+	const organizationId = tryDecode(ctx.params.id);
+	assertDirectorySyncManagementClaims(ctx, organizationId);
+	await assertTargetOrganizationExists(ctx, organizationId);
+	const row = await getDirectorySyncConnection(ctx, organizationId, tryDecode(ctx.params.providerId));
+	return serializeDirectory(row, getScimEndpoint$1(ctx.context.baseURL), await getManagedState(ctx, row));
+});
+const createOrganizationDirectory = (options) => createAuthEndpoint("/dash/organization/:id/directories", {
+	method: "POST",
+	use: [jwtMiddleware(options, directorySyncClaimsSchema)],
+	body: createDirectoryBodySchema,
+	metadata: { noStore: true }
+}, async (ctx) => {
+	requireOrganizationPlugin(ctx);
+	assertManagedDirectorySyncEnabled(ctx);
+	const organizationId = tryDecode(ctx.params.id);
+	const claims = assertDirectorySyncClaims(ctx, organizationId);
+	await assertTargetOrganizationExists(ctx, organizationId);
+	const policy = resolveCredentialPolicy(ctx.body);
+	assertManagedConnectionLifecycleConfigured(ctx);
+	const { row, issued } = await createManagedDirectoryConnection(ctx, {
+		organizationId,
+		providerId: ctx.body.providerId,
+		actorId: claims.actorId,
+		...claims.setupOperationId ? { creationRequestId: claims.setupOperationId } : {},
+		...ctx.body.pairing ? { pairing: ctx.body.pairing } : {}
+	}, policy);
+	setCredentialResponseSecurityHeaders(ctx);
+	return {
+		...serializeDirectory(row, getScimEndpoint$1(ctx.context.baseURL), {
+			connection: issued.connection,
+			credentials: [issued.credential]
+		}),
+		connectionId: issued.connection.connectionId,
+		credential: serializeCredential(issued.credential),
+		scimToken: issued.token
+	};
+});
+const rotateDirectoryCredential = (options) => createAuthEndpoint("/dash/organization/:id/directories/:providerId/credentials/rotate", {
+	method: "POST",
+	use: [jwtMiddleware(options, directorySyncClaimsSchema)],
+	body: rotateCredentialBodySchema,
+	metadata: { noStore: true }
+}, async (ctx) => {
+	requireOrganizationPlugin(ctx);
+	assertManagedDirectorySyncEnabled(ctx);
+	const organizationId = tryDecode(ctx.params.id);
+	const claims = assertDirectorySyncManagementClaims(ctx, organizationId);
+	await assertTargetOrganizationExists(ctx, organizationId);
+	const policy = resolveCredentialPolicy(ctx.body);
+	await assertManagedDirectoryTransactionsConfigured(ctx);
+	const providerId = tryDecode(ctx.params.providerId);
+	const endpoint = requireManagedEndpoint(ctx, getManagedEndpoints(ctx).rotateSCIMManagedCredential, "rotate");
+	const { connectionId, issued } = await runWithTransaction$1(ctx.context.adapter, async () => {
+		const database = await getCurrentAdapter$1(ctx.context.adapter);
+		const row = await getDirectorySyncConnection(ctx, organizationId, providerId);
+		if (row.status !== "active" || !row.connectionId) throw ctx.error("CONFLICT", { message: "Directory sync connection is not active" });
+		if (!await database.update({
+			model: "directorySyncConnection",
+			where: [
+				{
+					field: "id",
+					value: row.id
+				},
+				{
+					field: "status",
+					value: "active"
+				},
+				{
+					field: "revision",
+					value: row.revision
+				},
+				{
+					field: "connectionId",
+					value: row.connectionId
+				}
+			],
+			update: {
+				revision: row.revision + 1,
+				updatedAt: /* @__PURE__ */ new Date(),
+				lastActorId: claims.actorId,
+				lastError: null
+			}
+		})) throw ctx.error("CONFLICT", { message: "Directory sync connection changed before credential rotation started" });
+		const issued = await endpoint({
+			body: {
+				connectionId: row.connectionId,
+				provisioningDomainId: row.provisioningDomainId,
+				actorId: claims.actorId,
+				...policy
+			},
+			context: ctx.context,
+			headers: getRequestHeaders(ctx)
+		});
+		return {
+			connectionId: row.connectionId,
+			issued
+		};
+	});
+	setCredentialResponseSecurityHeaders(ctx);
+	return {
+		connectionId,
+		credential: serializeCredential(issued.credential),
+		scimToken: issued.token,
+		scimEndpoint: getScimEndpoint$1(ctx.context.baseURL)
+	};
+});
+const revokeDirectoryCredential = (options) => createAuthEndpoint("/dash/organization/:id/directories/:providerId/credentials/:credentialId/revoke", {
+	method: "POST",
+	use: [jwtMiddleware(options, directorySyncClaimsSchema)],
+	body: emptyBodySchema
+}, async (ctx) => {
+	requireOrganizationPlugin(ctx);
+	assertManagedDirectorySyncEnabled(ctx);
+	const organizationId = tryDecode(ctx.params.id);
+	const claims = assertDirectorySyncManagementClaims(ctx, organizationId);
+	await assertTargetOrganizationExists(ctx, organizationId);
+	await assertManagedDirectoryTransactionsConfigured(ctx);
+	const providerId = tryDecode(ctx.params.providerId);
+	const credentialId = tryDecode(ctx.params.credentialId);
+	const endpoint = requireManagedEndpoint(ctx, getManagedEndpoints(ctx).revokeSCIMManagedCredential, "revoke");
+	const { state, updated } = await runWithTransaction$1(ctx.context.adapter, async () => {
+		const database = await getCurrentAdapter$1(ctx.context.adapter);
+		const row = await getDirectorySyncConnection(ctx, organizationId, providerId);
+		if (row.status !== "active" || !row.connectionId) throw ctx.error("CONFLICT", { message: "Directory sync connection is not active" });
+		const updated = await database.update({
+			model: "directorySyncConnection",
+			where: [
+				{
+					field: "id",
+					value: row.id
+				},
+				{
+					field: "status",
+					value: "active"
+				},
+				{
+					field: "revision",
+					value: row.revision
+				},
+				{
+					field: "connectionId",
+					value: row.connectionId
+				}
+			],
+			update: {
+				revision: row.revision + 1,
+				updatedAt: /* @__PURE__ */ new Date(),
+				lastActorId: claims.actorId,
+				lastError: null
+			}
+		});
+		if (!updated) throw ctx.error("CONFLICT", { message: "Directory sync connection changed before credential revocation started" });
+		return {
+			state: await endpoint({
+				body: {
+					connectionId: row.connectionId,
+					provisioningDomainId: row.provisioningDomainId,
+					credentialId,
+					actorId: claims.actorId
+				},
+				context: ctx.context,
+				headers: getRequestHeaders(ctx)
+			}),
+			updated
+		};
+	});
+	return serializeDirectory(updated, getScimEndpoint$1(ctx.context.baseURL), state);
+});
+const DIRECTORY_EVENTS_DEFAULT_LIMIT = 10;
+const DIRECTORY_PAGE_MAX_LIMIT = 100;
+const DIRECTORY_EVENTS_DEFAULT_SORT_DIRECTION = "desc";
+const directoryEventsQuerySchema = z$1.object({
+	limit: z$1.number().or(z$1.string().transform(Number)).optional(),
+	offset: z$1.number().or(z$1.string().transform(Number)).optional(),
+	sortDirection: z$1.enum(["asc", "desc"]).optional()
+}).optional();
+function resolveDirectoryEventsPage(query) {
+	const requestedLimit = query?.limit;
+	const limit = Number.isFinite(requestedLimit) ? Math.min(Math.max(1, Math.floor(requestedLimit)), DIRECTORY_PAGE_MAX_LIMIT) : DIRECTORY_EVENTS_DEFAULT_LIMIT;
+	const requestedOffset = query?.offset;
+	return {
+		limit,
+		offset: Number.isFinite(requestedOffset) ? Math.max(0, Math.floor(requestedOffset)) : 0,
+		sortDirection: query?.sortDirection ?? DIRECTORY_EVENTS_DEFAULT_SORT_DIRECTION
+	};
 }
+const listDirectoryEvents = (options) => createAuthEndpoint("/dash/organization/:id/directories/:providerId/events", {
+	method: "GET",
+	use: [jwtMiddleware(options, directorySyncClaimsSchema)],
+	query: directoryEventsQuerySchema
+}, async (ctx) => {
+	requireOrganizationPlugin(ctx);
+	assertManagedDirectorySyncEnabled(ctx);
+	const organizationId = tryDecode(ctx.params.id);
+	assertDirectorySyncManagementClaims(ctx, organizationId);
+	await assertTargetOrganizationExists(ctx, organizationId);
+	const { limit, offset, sortDirection } = resolveDirectoryEventsPage(ctx.query);
+	const row = await getDirectorySyncConnection(ctx, organizationId, tryDecode(ctx.params.providerId));
+	if (!row.connectionId) return {
+		events: [],
+		total: 0,
+		limit,
+		offset
+	};
+	const result = await requireManagedEndpoint(ctx, getManagedEndpoints(ctx).listSCIMManagedConnectionEvents, "events")({
+		body: {
+			connectionId: row.connectionId,
+			provisioningDomainId: row.provisioningDomainId,
+			limit,
+			offset,
+			sortDirection
+		},
+		context: ctx.context,
+		headers: getRequestHeaders(ctx)
+	});
+	const events = result.events.map((event) => ({
+		...event,
+		createdAt: event.createdAt instanceof Date ? event.createdAt.toISOString() : event.createdAt
+	}));
+	if (typeof result.total === "number" && typeof result.limit === "number" && typeof result.offset === "number") return {
+		events,
+		total: result.total,
+		limit: result.limit,
+		offset: result.offset
+	};
+	const sorted = [...events].sort((a, b) => sortDirection === "asc" ? a.sequence - b.sequence : b.sequence - a.sequence);
+	return {
+		events: sorted.slice(offset, offset + limit),
+		total: sorted.length,
+		limit,
+		offset
+	};
+});
+const decommissionOrganizationDirectory = (options) => createAuthEndpoint("/dash/organization/:id/directories/:providerId/decommission", {
+	method: "POST",
+	use: [jwtMiddleware(options, directorySyncClaimsSchema)],
+	body: emptyBodySchema
+}, async (ctx) => {
+	requireOrganizationPlugin(ctx);
+	assertManagedDirectorySyncEnabled(ctx);
+	const organizationId = tryDecode(ctx.params.id);
+	const claims = assertDirectorySyncManagementClaims(ctx, organizationId);
+	await assertTargetOrganizationExists(ctx, organizationId);
+	let row = await getDirectorySyncConnection(ctx, organizationId, tryDecode(ctx.params.providerId));
+	if (row.status === "decommissioned") return serializeDirectory(row, getScimEndpoint$1(ctx.context.baseURL), await getManagedState(ctx, row));
+	if (!row.connectionId) throw ctx.error("CONFLICT", { message: "Directory sync connection has an invalid catalog binding" });
+	const connectionId = row.connectionId;
+	if (row.status === "active") row = await startDirectorySyncDecommission(ctx, row, claims.actorId);
+	if (row.status !== "decommissioning") throw ctx.error("CONFLICT", { message: "Directory sync connection cannot be decommissioned" });
+	const state = await requireManagedEndpoint(ctx, getManagedEndpoints(ctx).decommissionSCIMManagedConnection, "decommission")({
+		body: {
+			connectionId,
+			provisioningDomainId: row.provisioningDomainId,
+			actorId: claims.actorId
+		},
+		context: ctx.context,
+		headers: getRequestHeaders(ctx)
+	});
+	if (state.connection.status === "decommissioned" || state.decommission.status === "complete") row = await ctx.context.adapter.update({
+		model: "directorySyncConnection",
+		where: [{
+			field: "id",
+			value: row.id
+		}, {
+			field: "status",
+			value: "decommissioning"
+		}],
+		update: {
+			activeOrganizationKey: createTerminalOrganizationKey(row.aliasKey),
+			activeSsoProviderKey: createTerminalPairingKey(row.aliasKey),
+			status: "decommissioned",
+			decommissionedAt: /* @__PURE__ */ new Date(),
+			updatedAt: /* @__PURE__ */ new Date(),
+			lastActorId: claims.actorId
+		}
+	}) ?? row;
+	return serializeDirectory(row, getScimEndpoint$1(ctx.context.baseURL), state);
+});
+const unpairOrganizationDirectory = (options) => createAuthEndpoint("/dash/organization/:id/directories/:providerId/unpair", {
+	method: "POST",
+	use: [jwtMiddleware(options, directorySyncClaimsSchema)],
+	body: emptyBodySchema
+}, async (ctx) => {
+	requireOrganizationPlugin(ctx);
+	assertManagedDirectorySyncEnabled(ctx);
+	const organizationId = tryDecode(ctx.params.id);
+	const claims = assertDirectorySyncManagementClaims(ctx, organizationId);
+	await assertTargetOrganizationExists(ctx, organizationId);
+	const updated = await unpairTerminalDirectorySyncConnection(ctx, await getDirectorySyncConnection(ctx, organizationId, tryDecode(ctx.params.providerId)), claims.actorId);
+	return serializeDirectory(updated, getScimEndpoint$1(ctx.context.baseURL), await getManagedState(ctx, updated));
+});
 //#endregion
 //#region src/routes/directory-sync/session.ts
 async function buildSyntheticSession(ctx, ownerUserId) {
@@ -3414,13 +4975,12 @@ async function scimProviderExists(ctx, organizationId, providerId) {
 function getScimEndpoint(baseUrl) {
 	return `${baseUrl}/scim/v2`;
 }
-function getSCIMPlugin(ctx) {
-	return ctx.context.getPlugin("scim");
+function resolveMode(ctx) {
+	return resolveDirectorySyncMode(getSCIMPlugin(ctx), isManagedDirectorySyncEnabled(ctx));
 }
-function isScimDirectorySyncEnabled(scimPlugin, authVersion) {
-	if (!scimPlugin) return false;
-	if (isVersionAtLeast(authVersion, "1.7.0")) return true;
-	return scimPlugin.options?.providerOwnership?.enabled === true;
+/** Legacy provider-ownership APIs. Never true when the 1.7+ managed surface exists. */
+function isLegacyDirectorySyncEnabled(ctx) {
+	return resolveMode(ctx) === "legacy";
 }
 const DIRECTORY_SYNC_DUPLICATE_MESSAGE = "A directory sync connection with this provider ID already exists. Remove the existing connection or choose a different provider ID.";
 function isDuplicateDirectorySyncError(e) {
@@ -3433,14 +4993,15 @@ const listOrganizationDirectories = (options) => {
 		method: "GET",
 		use: [jwtMiddleware(options)]
 	}, async (ctx) => {
+		if (resolveMode(ctx) === "managed") return listOrganizationDirectoriesManagedHandler(ctx);
 		if (!isOrganizationEnabled(ctx)) {
 			ctx.context.logger.warn("[Dash] Organization plugin not enabled, returning empty directories list");
 			return [];
 		}
 		const organizationId = tryDecode(ctx.params.id);
 		const scimPlugin = getSCIMPlugin(ctx);
-		if (!scimPlugin?.endpoints.listSCIMProviderConnections || !isScimDirectorySyncEnabled(scimPlugin, ctx.context.version)) {
-			ctx.context.logger.warn("[Dash] SCIM plugin not available or provider ownership disabled, returning empty directories list", { organizationId });
+		if (!isLegacyDirectorySyncEnabled(ctx) || !scimPlugin?.endpoints.listSCIMProviderConnections) {
+			ctx.context.logger.warn("[Dash] Legacy SCIM directory sync is unavailable, returning empty directories list", { organizationId });
 			return [];
 		}
 		const managerUserId = await resolveScimManagementUserId(ctx, organizationId);
@@ -3464,7 +5025,7 @@ const listOrganizationDirectories = (options) => {
 		}
 	});
 };
-const createOrganizationDirectory = (options) => {
+const createOrganizationDirectoryLegacy = (options) => {
 	return createAuthEndpoint("/dash/organization/directory/create", {
 		method: "POST",
 		use: [jwtMiddleware(options, z$1.object({ organizationId: z$1.string() }))],
@@ -3476,7 +5037,7 @@ const createOrganizationDirectory = (options) => {
 		requireOrganizationPlugin(ctx);
 		const { organizationId } = ctx.context.payload;
 		const scimPlugin = getSCIMPlugin(ctx);
-		if (!scimPlugin?.endpoints.generateSCIMToken || !isScimDirectorySyncEnabled(scimPlugin, ctx.context.version)) throw ctx.error("BAD_REQUEST", { message: "SCIM plugin is not enabled or does not support this feature" });
+		if (!isLegacyDirectorySyncEnabled(ctx) || !scimPlugin?.endpoints.generateSCIMToken) throw ctx.error("BAD_REQUEST", { message: "SCIM plugin is not enabled or does not support this feature" });
 		const { providerId, ownerUserId } = ctx.body;
 		if (await scimProviderExists(ctx, organizationId, providerId)) throw ctx.error("BAD_REQUEST", { message: DIRECTORY_SYNC_DUPLICATE_MESSAGE });
 		let scimToken;
@@ -3504,7 +5065,7 @@ const createOrganizationDirectory = (options) => {
 		};
 	});
 };
-const deleteOrganizationDirectory = (options) => {
+const deleteOrganizationDirectoryLegacy = (options) => {
 	return createAuthEndpoint("/dash/organization/directory/delete", {
 		method: "POST",
 		use: [jwtMiddleware(options, z$1.object({ organizationId: z$1.string() }))],
@@ -3512,7 +5073,7 @@ const deleteOrganizationDirectory = (options) => {
 	}, async (ctx) => {
 		requireOrganizationPlugin(ctx);
 		const scimPlugin = getSCIMPlugin(ctx);
-		if (!scimPlugin?.endpoints.deleteSCIMProviderConnection || !isScimDirectorySyncEnabled(scimPlugin, ctx.context.version)) throw ctx.error("BAD_REQUEST", { message: "SCIM plugin is not enabled or does not support this feature" });
+		if (!isLegacyDirectorySyncEnabled(ctx) || !scimPlugin?.endpoints.deleteSCIMProviderConnection) throw ctx.error("BAD_REQUEST", { message: "SCIM plugin is not enabled or does not support this feature" });
 		const { organizationId } = ctx.context.payload;
 		const { providerId } = ctx.body;
 		const managerUserId = await resolveScimManagementUserId(ctx, organizationId, providerId);
@@ -3528,7 +5089,7 @@ const deleteOrganizationDirectory = (options) => {
 		return { success: true };
 	});
 };
-const regenerateDirectoryToken = (options) => {
+const regenerateDirectoryTokenLegacy = (options) => {
 	return createAuthEndpoint("/dash/organization/directory/regenerate-token", {
 		method: "POST",
 		use: [jwtMiddleware(options, z$1.object({ organizationId: z$1.string() }))],
@@ -3536,7 +5097,7 @@ const regenerateDirectoryToken = (options) => {
 	}, async (ctx) => {
 		requireOrganizationPlugin(ctx);
 		const scimPlugin = getSCIMPlugin(ctx);
-		if (!scimPlugin?.endpoints.generateSCIMToken || !isScimDirectorySyncEnabled(scimPlugin, ctx.context.version)) throw ctx.error("BAD_REQUEST", { message: "SCIM plugin is not enabled or does not support this feature" });
+		if (!isLegacyDirectorySyncEnabled(ctx) || !scimPlugin?.endpoints.generateSCIMToken) throw ctx.error("BAD_REQUEST", { message: "SCIM plugin is not enabled or does not support this feature" });
 		const { organizationId } = ctx.context.payload;
 		const { providerId } = ctx.body;
 		const managerUserId = await resolveScimManagementUserId(ctx, organizationId, providerId);
@@ -4124,10 +5685,8 @@ async function executePlatformInvitationCompletion(ctx, $api, invitation, args)
 	};
 	const adapter = ctx.context.internalAdapter;
 	const user = isVersionAtLeast(ctx.context.version, "1.7.0") ? await adapter.createUser(userPayload, { method: "admin" }) : await adapter.createUser(userPayload);
-	if (password) await ctx.context.internalAdapter.createAccount({
+	if (password) await createCredentialAccountCompat(ctx.context.internalAdapter, {
 		userId: user.id,
-		providerId: "credential",
-		accountId: user.id,
 		password: await ctx.context.password.hash(password)
 	});
 	const { error: markError } = await $api("/api/internal/invitations/mark-accepted", {
@@ -6232,6 +7791,40 @@ function validateSAMLMetadataAlgorithms(metadataXml) {
 	return warnings;
 }
 //#endregion
+//#region src/routes/sso/verify-domain-error.ts
+const DOMAIN_ALREADY_VERIFIED = {
+	verified: true,
+	message: "Domain has already been verified"
+};
+const PROVIDER_CHANGED = {
+	verified: false,
+	message: "SSO provider changed while domain verification was in progress. Reload the provider and try again."
+};
+const DNS_RECORD_MISSING = {
+	verified: false,
+	message: "Unable to verify domain ownership. The TXT record was not found. It may take up to 48 hours for DNS changes to propagate."
+};
+function isRecord(value) {
+	return typeof value === "object" && value !== null;
+}
+function getApiErrorCode(error) {
+	const withExtras = error;
+	if (typeof withExtras.code === "string") return withExtras.code;
+	if (isRecord(withExtras.body) && typeof withExtras.body.code === "string") return withExtras.body.code;
+}
+/**
+* Maps SSO plugin `verifyDomain` API errors to dash responses.
+* Returns `null` when the caller should rethrow.
+*/
+function mapSsoVerifyDomainApiError(error) {
+	if (error.status === "CONFLICT") {
+		if (getApiErrorCode(error) === "SSO_PROVIDER_CHANGED") return PROVIDER_CHANGED;
+		return DOMAIN_ALREADY_VERIFIED;
+	}
+	if (error.status === "BAD_GATEWAY") return DNS_RECORD_MISSING;
+	return null;
+}
+//#endregion
 //#region src/routes/sso/index.ts
 function requireOrganizationAccess(ctx) {
 	const orgIdFromUrl = tryDecode(ctx.params.id);
@@ -6247,6 +7840,7 @@ const samlConfigSchema = z$1.object({
 	cert: z$1.string().optional(),
 	entityId: z$1.string().optional(),
 	mapping: z$1.object({
+		/** @deprecated Removed in better-auth 1.7+; SAML subject is NameID. */
 		id: z$1.string().optional(),
 		email: z$1.string().optional(),
 		emailVerified: z$1.string().optional(),
@@ -6268,6 +7862,7 @@ const oidcConfigSchema = z$1.object({
 	userInfoEndpoint: z$1.string().optional(),
 	tokenEndpointAuthentication: z$1.enum(["client_secret_post", "client_secret_basic"]).optional(),
 	mapping: z$1.object({
+		/** @deprecated Removed in better-auth 1.7+; OIDC subject is `sub`. */
 		id: z$1.string().optional(),
 		email: z$1.string().optional(),
 		emailVerified: z$1.string().optional(),
@@ -6293,20 +7888,24 @@ async function resolveSAMLConfig(samlConfig, providerId, baseURL, ctx) {
 			ctx.context.logger.warn("[Dash] SAML IdP metadata uses deprecated algorithms:", providerId, warnings);
 		}
 	}
+	const m = samlConfig.mapping;
+	const resolvedEntryPoint = samlConfig.entryPoint?.trim() || (idpMetadataXml ? extractEntryPointFromSAMLMetadata(idpMetadataXml) : void 0);
+	const saml17OrNewer = isVersionAtLeast(ctx.context.version, "1.7.0");
+	const ba17OrLater = isBetterAuth17OrLater(ctx.context.version);
+	if (saml17OrNewer && !resolvedEntryPoint) throw ctx.error("BAD_REQUEST", { message: "SAML entry point URL is required; provide entryPoint or IdP metadata with SingleSignOnService Location" });
+	if (ba17OrLater && !idpMetadataXml && !samlConfig.entityId?.trim()) throw ctx.error("BAD_REQUEST", { message: "IdP entity ID is required when IdP metadata XML is not provided" });
+	const spIssuer = `${baseURL}/sso/saml2/sp/metadata?providerId=${providerId}`;
 	const idpMetadata = idpMetadataXml ? { metadata: idpMetadataXml } : {
+		...ba17OrLater ? { entityID: samlConfig.entityId } : {},
 		...samlConfig.entryPoint ? { singleSignOnService: [{
 			Binding: "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect",
 			Location: samlConfig.entryPoint
 		}] } : {},
 		...samlConfig.cert ? { cert: samlConfig.cert } : {}
 	};
-	const m = samlConfig.mapping;
-	const resolvedEntryPoint = samlConfig.entryPoint?.trim() || (idpMetadataXml ? extractEntryPointFromSAMLMetadata(idpMetadataXml) : void 0);
-	const saml17OrNewer = isVersionAtLeast(ctx.context.version, "1.7.0");
-	if (saml17OrNewer && !resolvedEntryPoint) throw ctx.error("BAD_REQUEST", { message: "SAML entry point URL is required; provide entryPoint or IdP metadata with SingleSignOnService Location" });
 	return {
 		config: {
-			issuer: samlConfig.entityId ?? `${baseURL}/sso/saml2/sp/metadata?providerId=${providerId}`,
+			issuer: ba17OrLater && !idpMetadataXml ? spIssuer : samlConfig.entityId ?? spIssuer,
 			idpMetadata,
 			...saml17OrNewer ? {
 				entryPoint: resolvedEntryPoint,
@@ -6318,7 +7917,7 @@ async function resolveSAMLConfig(samlConfig, providerId, baseURL, ctx) {
 				cert: samlConfig.cert ?? ""
 			},
 			...m ? { mapping: {
-				id: m.id ?? "nameID",
+				...!ba17OrLater ? { id: m.id ?? "nameID" } : {},
 				email: m.email ?? "email",
 				name: m.name ?? "name",
 				emailVerified: m.emailVerified,
@@ -6334,6 +7933,7 @@ async function resolveOIDCConfig(oidcConfig, _domain, ctx) {
 	if (!oidcConfig.issuer || !oidcConfig.authorizationEndpoint || !oidcConfig.tokenEndpoint || !oidcConfig.jwksEndpoint) throw ctx.error("BAD_REQUEST", { message: "OIDC discovery must be resolved before submitting; provide issuer, authorizationEndpoint, tokenEndpoint, and jwksEndpoint" });
 	const om = oidcConfig.mapping;
 	const discoveryEndpoint = oidcConfig.discoveryEndpoint ?? oidcConfig.discoveryUrl ?? oidcConfig.issuer;
+	const ba17OrLater = isBetterAuth17OrLater(ctx.context.version);
 	return {
 		config: {
 			clientId: oidcConfig.clientId,
@@ -6347,7 +7947,7 @@ async function resolveOIDCConfig(oidcConfig, _domain, ctx) {
 			tokenEndpointAuthentication: oidcConfig.tokenEndpointAuthentication,
 			pkce: true,
 			...om ? { mapping: {
-				id: om.id ?? "sub",
+				...!ba17OrLater ? { id: om.id ?? "sub" } : {},
 				email: om.email ?? "email",
 				name: om.name ?? "name",
 				emailVerified: om.emailVerified,
@@ -6414,7 +8014,7 @@ const createSsoProvider = (options) => {
 		};
 		if (protocol === "SAML" && samlConfig) {
 			const samlResult = await resolveSAMLConfig(samlConfig, providerId, ctx.context.baseURL, ctx);
-			registerBody.issuer = samlResult.config.issuer ?? (samlConfig.entityId || `${ctx.context.baseURL}/sso/saml2/sp/metadata?providerId=${providerId}`);
+			registerBody.issuer = samlResult.config.issuer;
 			registerBody.samlConfig = samlResult.config;
 		}
 		if (protocol === "OIDC" && oidcConfig) {
@@ -6433,15 +8033,17 @@ const createSsoProvider = (options) => {
 			});
 			let verificationToken = null;
 			if ("domainVerificationToken" in result && typeof result.domainVerificationToken === "string") verificationToken = result.domainVerificationToken;
+			const tokenPrefix = ssoPlugin.options?.domainVerification?.tokenPrefix || "better-auth-token";
+			const resolvedProviderId = result.providerId || providerId;
 			return {
 				success: true,
 				provider: {
 					id: result.providerId,
-					providerId: result.providerId || providerId,
+					providerId: resolvedProviderId,
 					domain: result.domain || domain
 				},
 				domainVerification: {
-					txtRecordName: `better-auth-token-${providerId}`,
+					txtRecordName: `_${tokenPrefix}-${resolvedProviderId}`,
 					verificationToken
 				}
 			};
@@ -6485,7 +8087,7 @@ const updateSsoProvider = (options) => {
 		if (domain && domain !== existingProvider.domain) updateBody.domain = domain;
 		if (protocol === "SAML" && samlConfig) {
 			const samlResult = await resolveSAMLConfig(samlConfig, providerId, ctx.context.baseURL, ctx);
-			updateBody.issuer = samlResult.config.issuer ?? (samlConfig.entityId || `${ctx.context.baseURL}/sso/saml2/sp/metadata?providerId=${providerId}`);
+			updateBody.issuer = samlResult.config.issuer;
 			updateBody.samlConfig = samlResult.config;
 		}
 		if (protocol === "OIDC" && oidcConfig) {
@@ -6560,7 +8162,7 @@ const requestSsoVerificationToken = (options) => {
 			}]
 		});
 		if (!provider) throw ctx.error("NOT_FOUND", { message: "SSO provider not found" });
-		const txtRecordName = `${ssoPlugin.options?.domainVerification?.tokenPrefix || "better-auth-token"}-${provider.providerId}`;
+		const txtRecordName = `_${ssoPlugin.options?.domainVerification?.tokenPrefix || "better-auth-token"}-${provider.providerId}`;
 		try {
 			const result = await endpoints.requestDomainVerification({
 				body: { providerId },
@@ -6622,14 +8224,8 @@ const verifySsoProviderDomain = (options) => {
 			};
 		} catch (e) {
 			if (e instanceof APIError$1) {
-				if (e.status === "CONFLICT") return {
-					verified: true,
-					message: "Domain has already been verified"
-				};
-				if (e.status === "BAD_GATEWAY") return {
-					verified: false,
-					message: "Unable to verify domain ownership. The TXT record was not found. It may take up to 48 hours for DNS changes to propagate."
-				};
+				const mapped = mapSsoVerifyDomainApiError(e);
+				if (mapped) return mapped;
 				throw e;
 			}
 			throw ctx.error("BAD_REQUEST", { message: e instanceof Error ? e.message : "Failed to verify domain" });
@@ -7401,10 +8997,8 @@ const createUser = (options) => {
 		};
 		const adapter = ctx.context.internalAdapter;
 		const user = isVersionAtLeast(ctx.context.version, "1.7.0") ? await adapter.createUser(userPayload, { method: "admin" }) : await adapter.createUser(userPayload);
-		if (password) await ctx.context.internalAdapter.createAccount({
+		if (password) await createCredentialAccountCompat(ctx.context.internalAdapter, {
 			userId: user.id,
-			providerId: "credential",
-			accountId: user.id,
 			password: await ctx.context.password.hash(password)
 		});
 		if (body.sendVerificationEmail && !emailVerified) {
@@ -7469,10 +9063,8 @@ const setPassword = (options) => {
 			password: hashed,
 			updatedAt: /* @__PURE__ */ new Date()
 		});
-		else await ctx.context.internalAdapter.createAccount({
+		else await createCredentialAccountCompat(ctx.context.internalAdapter, {
 			userId,
-			providerId: "credential",
-			accountId: userId,
 			password: hashed
 		});
 		return { success: true };
@@ -7484,7 +9076,7 @@ const unlinkAccount = (options) => {
 		use: [jwtMiddleware(options, z$1.object({ userId: z$1.string() }))],
 		body: z$1.object({
 			providerId: z$1.string(),
-			accountId: z$1.string().optional()
+			accountId: z$1.string()
 		})
 	}, async (ctx) => {
 		const { userId } = ctx.context.payload;
@@ -7493,7 +9085,10 @@ const unlinkAccount = (options) => {
 		const accounts = await ctx.context.internalAdapter.findAccounts(userId);
 		const allowUnlinkingAll = ctx.context.options.account?.accountLinking?.allowUnlinkingAll ?? false;
 		if (accounts.length === 1 && !allowUnlinkingAll) throw new APIError("BAD_REQUEST", { message: "Cannot unlink the last account. This would lock the user out." });
-		const accountToUnlink = accounts.find((account) => accountId ? account.accountId === accountId && account.providerId === providerId : account.providerId === providerId);
+		const accountToUnlink = resolveAccountForUnlink(accounts, {
+			providerId,
+			accountId
+		});
 		if (!accountToUnlink) throw new APIError("NOT_FOUND", { message: "Account not found" });
 		await ctx.context.internalAdapter.deleteAccount(accountToUnlink.id);
 		return { success: true };
@@ -8411,7 +10006,7 @@ function createSMSSender(config) {
 			"user-agent": INFRA_USER_AGENT,
 			Authorization: `Bearer ${apiKey}`
 		},
-		timeout: config?.apiTimeout ?? 3e3
+		timeout: config?.apiOptions?.timeout ?? config?.apiTimeout ?? 3e3
 	});
 	/**
 	* Send an SMS with OTP code
@@ -8490,6 +10085,18 @@ async function sendSMS(options, config) {
 }
 //#endregion
 //#region src/index.ts
+/**
+* Stashed when session.create after runs before newSession/returned user is
+* available (1.7+ / better-auth#10473). Avoids a fallback user DB lookup by
+* flushing tracking once the endpoint after hook can resolve the user.
+*/
+const PENDING_SESSION_TRACKING = Symbol.for("dash.pendingSessionTracking");
+function getPendingSessionTracking(ctx) {
+	return ctx.context[PENDING_SESSION_TRACKING];
+}
+function setPendingSessionTracking(ctx, pending) {
+	ctx.context[PENDING_SESSION_TRACKING] = pending;
+}
 async function getRequestLocation() {
 	try {
 		return (await getCurrentAuthContext()).context.location;
@@ -8505,7 +10112,11 @@ const dash = (options) => {
 		...opts,
 		$api
 	};
-	const $kv = createKV(opts);
+	const $kv = createKV({
+		kvUrl: opts.kvUrl,
+		apiKey: opts.apiKey,
+		timeout: opts.kvOptions.timeout
+	});
 	const activityUpdateInterval = opts.activityTracking?.updateInterval ?? 3e5;
 	const scheduleLastActiveUpdate = async (ctx, userId) => {
 		await ctx.context.runInBackgroundOrAwait(ctx.context.adapter.updateMany({
@@ -8522,6 +10133,21 @@ const dash = (options) => {
 	const { tracker } = initTrackEvents($api);
 	const { trackUserSignedUp, trackUserProfileUpdated, trackUserProfileImageUpdated, trackUserEmailVerified, trackUserBanned, trackUserUnBanned, trackUserDeleted } = initUserEvents(tracker);
 	const { trackEmailVerificationSent, trackEmailSignInAttempt, trackUserSignedIn, trackUserSignedOut, trackSessionCreated, trackSocialSignInAttempt, trackSocialSignInRedirectionAttempt, trackUserImpersonated, trackUserImpersonationStop, trackSessionRevoked, trackSessionRevokedAll } = initSessionEvents(tracker);
+	const trackSessionLifecycle = (enrichedSession, userId, ctx, location, eventUser, trackSignIn, impersonatedBy) => {
+		let trigger = null;
+		if (trackSignIn) {
+			trigger = getTriggerInfo(ctx, userId, enrichedSession);
+			trackUserSignedIn(enrichedSession, trigger, ctx, location, eventUser);
+		} else trigger = getTriggerInfo(ctx, userId);
+		trackSessionCreated(enrichedSession, trigger, ctx, location, eventUser);
+		if (impersonatedBy) {
+			trigger = {
+				...trigger,
+				triggeredBy: impersonatedBy
+			};
+			trackUserImpersonated(enrichedSession, trigger, ctx, location, eventUser, resolveUserFromContext(impersonatedBy, ctx));
+		}
+	};
 	const { trackAccountLinking, trackAccountUnlink, trackAccountPasswordChange } = initAccountEvents(tracker);
 	const { trackPasswordResetRequest, trackPasswordResetRequestCompletion } = initVerificationEvents(tracker);
 	const { trackOrganizationCreated, trackOrganizationUpdated } = initOrganizationEvents(tracker);
@@ -8625,6 +10251,14 @@ const dash = (options) => {
 				};
 				instrumentOrganizationHooks(organizationPlugin.options = organizationPlugin.options ?? {});
 			} else logger.debug("[Dash] Organization plugin not active. Skipping instrumentation");
+			const managedDirectorySync = opts.managedDirectorySync;
+			if (managedDirectorySync?.enabled) instrumentDirectorySyncIntegration(ctx, {
+				ssoPairing: managedDirectorySync.ssoPairing ?? true,
+				membershipProjection: {
+					enabled: managedDirectorySync.membershipProjection?.enabled ?? true,
+					role: managedDirectorySync.membershipProjection?.role ?? "member"
+				}
+			});
 			return { options: {
 				databaseHooks: {
 					user: {
@@ -8686,25 +10320,25 @@ const dash = (options) => {
 									countryCode: location?.countryCode
 								};
 								const eventUser = resolveUserFromContext(session.userId, ctx);
-								let trigger = null;
-								if (matchesAnyRoute(ctx.path, [
+								const trackSignIn = matchesAnyRoute(ctx.path, [
 									routes.SIGN_IN,
 									routes.SIGN_UP,
 									routes.SIGN_IN_SOCIAL_CALLBACK,
 									routes.SIGN_IN_OAUTH_CALLBACK
-								])) {
-									trigger = getTriggerInfo(ctx, session.userId, enrichedSession);
-									trackUserSignedIn(enrichedSession, trigger, ctx, location, eventUser);
-								} else trigger = getTriggerInfo(ctx, session.userId);
-								trackSessionCreated(enrichedSession, trigger, ctx, location, eventUser);
-								if ("impersonatedBy" in session && session.impersonatedBy) {
-									trigger = {
-										...trigger,
-										triggeredBy: session.impersonatedBy
-									};
-									const knownImpersonator = resolveUserFromContext(session.impersonatedBy, ctx);
-									trackUserImpersonated(enrichedSession, trigger, ctx, location, eventUser, knownImpersonator);
+								]);
+								const impersonatedBy = "impersonatedBy" in session && session.impersonatedBy ? session.impersonatedBy : void 0;
+								if (!eventUser) {
+									setPendingSessionTracking(ctx, {
+										enrichedSession,
+										location,
+										userId: session.userId,
+										trackSignIn,
+										impersonatedBy
+									});
+									if (opts.activityTracking?.enabled) await scheduleLastActiveUpdate(ctx, session.userId);
+									return;
 								}
+								trackSessionLifecycle(enrichedSession, session.userId, ctx, location, eventUser, trackSignIn, impersonatedBy);
 								if (opts.activityTracking?.enabled) await scheduleLastActiveUpdate(ctx, session.userId);
 							}
 						},
@@ -8803,53 +10437,67 @@ const dash = (options) => {
 						routes.DASH_COMPLETE_INVITATION_SOCIAL
 					]);
 				},
-				handler: createIdentificationMiddleware($kv, { skipIdentification: (ctx) => isDashRoute(ctx.path) })
+				handler: createIdentificationMiddleware($kv, {
+					skipIdentification: (ctx) => isDashRoute(ctx.path),
+					retry: opts.kvOptions.retry
+				})
 			}],
-			after: [{
-				matcher: (ctx) => {
-					if (ctx.request?.method !== "GET") return true;
-					return matchesAnyRoute(ctx.path, [
-						routes.SIGN_IN_SOCIAL_CALLBACK,
-						routes.SIGN_IN_OAUTH_CALLBACK,
-						routes.DASH_IMPERSONATE_USER
-					]);
+			after: [
+				{
+					matcher: (ctx) => !!getPendingSessionTracking(ctx),
+					handler: createAuthMiddleware(async (ctx) => {
+						const pending = getPendingSessionTracking(ctx);
+						if (!pending) return;
+						trackSessionLifecycle(pending.enrichedSession, pending.userId, ctx, pending.location, resolveUserFromContext(pending.userId, ctx), pending.trackSignIn, pending.impersonatedBy);
+					})
 				},
-				handler: createAuthMiddleware(async (_ctx) => {
-					const ctx = _ctx;
-					const trigger = getTriggerInfo(ctx, ctx.context.session?.user.id ?? "unknown");
-					if (matchesAnyRoute(ctx.path, [routes.SEND_VERIFICATION_EMAIL, routes.DASH_SEND_VERIFICATION_EMAIL]) && ctx.context.session && !(ctx.context.returned instanceof Error)) trackEmailVerificationSent(ctx.context.session.session, ctx.context.session.user, trigger, ctx.context.location);
-					const body = ctx.body;
-					if (matchesAnyRoute(ctx.path, [routes.SIGN_IN_EMAIL, routes.SIGN_IN_EMAIL_OTP]) && ctx.context.returned instanceof Error && body?.email) trackEmailSignInAttempt(ctx, trigger, ctx.context.location);
-					if (matchesAnyRoute(ctx.path, [routes.SIGN_IN_SOCIAL]) && ctx.context.returned instanceof Error && ctx.body.provider && ctx.body.idToken) trackSocialSignInAttempt(ctx, trigger, ctx.context.location);
-					if (matchesAnyRoute(ctx.path, [routes.SIGN_IN_SOCIAL_CALLBACK, routes.SIGN_IN_OAUTH_CALLBACK]) && ctx.request?.method === "GET" && !ctx.context.newSession) trackSocialSignInRedirectionAttempt(ctx, trigger, ctx.context.location);
-					const headerRequestId = ctx.request?.headers.get("X-Request-Id");
-					if (headerRequestId) ctx.setCookie(IDENTIFICATION_COOKIE_NAME, headerRequestId, {
-						maxAge: 600,
-						sameSite: "lax",
-						httpOnly: true,
-						path: "/"
-					});
-					else if (ctx.context.requestId) ctx.setCookie(IDENTIFICATION_COOKIE_NAME, "", {
-						maxAge: 0,
-						path: "/"
-					});
-				})
-			}, {
-				handler: createAuthMiddleware(async (ctx) => {
-					if (!opts.activityTracking?.enabled) return;
-					if (activityUpdateInterval === 0) return;
-					const session = ctx.context.session || ctx.context.newSession;
-					if (!session?.user?.id) return;
-					const userId = session.user.id;
-					const now = Date.now();
-					const lastUpdate = session.user.lastActiveAt;
-					if (lastUpdate) {
-						if (now - new Date(lastUpdate).getTime() < activityUpdateInterval) return;
-					}
-					await scheduleLastActiveUpdate(ctx, userId);
-				}),
-				matcher: (ctx) => ctx.request?.method !== "GET"
-			}]
+				{
+					matcher: (ctx) => {
+						if (ctx.request?.method !== "GET") return true;
+						return matchesAnyRoute(ctx.path, [
+							routes.SIGN_IN_SOCIAL_CALLBACK,
+							routes.SIGN_IN_OAUTH_CALLBACK,
+							routes.DASH_IMPERSONATE_USER
+						]);
+					},
+					handler: createAuthMiddleware(async (_ctx) => {
+						const ctx = _ctx;
+						const trigger = getTriggerInfo(ctx, ctx.context.session?.user.id ?? "unknown");
+						if (matchesAnyRoute(ctx.path, [routes.SEND_VERIFICATION_EMAIL, routes.DASH_SEND_VERIFICATION_EMAIL]) && ctx.context.session && !(ctx.context.returned instanceof Error)) trackEmailVerificationSent(ctx.context.session.session, ctx.context.session.user, trigger, ctx.context.location);
+						const body = ctx.body;
+						if (matchesAnyRoute(ctx.path, [routes.SIGN_IN_EMAIL, routes.SIGN_IN_EMAIL_OTP]) && ctx.context.returned instanceof Error && body?.email) trackEmailSignInAttempt(ctx, trigger, ctx.context.location);
+						if (matchesAnyRoute(ctx.path, [routes.SIGN_IN_SOCIAL]) && ctx.context.returned instanceof Error && ctx.body.provider && ctx.body.idToken) trackSocialSignInAttempt(ctx, trigger, ctx.context.location);
+						if (matchesAnyRoute(ctx.path, [routes.SIGN_IN_SOCIAL_CALLBACK, routes.SIGN_IN_OAUTH_CALLBACK]) && ctx.request?.method === "GET" && !ctx.context.newSession) trackSocialSignInRedirectionAttempt(ctx, trigger, ctx.context.location);
+						const headerRequestId = ctx.request?.headers.get("X-Request-Id");
+						if (headerRequestId) ctx.setCookie(IDENTIFICATION_COOKIE_NAME, headerRequestId, {
+							maxAge: 600,
+							sameSite: "lax",
+							httpOnly: true,
+							path: "/"
+						});
+						else if (ctx.context.requestId) ctx.setCookie(IDENTIFICATION_COOKIE_NAME, "", {
+							maxAge: 0,
+							path: "/"
+						});
+					})
+				},
+				{
+					handler: createAuthMiddleware(async (ctx) => {
+						if (!opts.activityTracking?.enabled) return;
+						if (activityUpdateInterval === 0) return;
+						const session = ctx.context.session || ctx.context.newSession;
+						if (!session?.user?.id) return;
+						const userId = session.user.id;
+						const now = Date.now();
+						const lastUpdate = session.user.lastActiveAt;
+						if (lastUpdate) {
+							if (now - new Date(lastUpdate).getTime() < activityUpdateInterval) return;
+						}
+						await scheduleLastActiveUpdate(ctx, userId);
+					}),
+					matcher: (ctx) => ctx.request?.method !== "GET"
+				}
+			]
 		},
 		endpoints: {
 			getDashConfig: getConfig(settings),
@@ -8924,15 +10572,178 @@ const dash = (options) => {
 			dashCompleteInvitationSocial: completeInvitationSocial(settings),
 			dashCheckUserExists: checkUserExists(settings),
 			listDashOrganizationDirectories: listOrganizationDirectories(settings),
-			createDashOrganizationDirectory: createOrganizationDirectory(settings),
-			deleteDashOrganizationDirectory: deleteOrganizationDirectory(settings),
-			regenerateDashDirectoryToken: regenerateDirectoryToken(settings),
+			createDashOrganizationDirectory: createOrganizationDirectoryLegacy(settings),
+			deleteDashOrganizationDirectory: deleteOrganizationDirectoryLegacy(settings),
+			regenerateDashDirectoryToken: regenerateDirectoryTokenLegacy(settings),
+			getDashManagedOrganizationDirectory: getOrganizationDirectory(settings),
+			createDashManagedOrganizationDirectory: createOrganizationDirectory(settings),
+			rotateDashManagedDirectoryCredential: rotateDirectoryCredential(settings),
+			revokeDashManagedDirectoryCredential: revokeDirectoryCredential(settings),
+			listDashManagedDirectoryEvents: listDirectoryEvents(settings),
+			decommissionDashManagedOrganizationDirectory: decommissionOrganizationDirectory(settings),
+			unpairDashManagedOrganizationDirectory: unpairOrganizationDirectory(settings),
 			dashExecuteAdapter: executeAdapter(settings)
 		},
-		schema: opts.activityTracking?.enabled ? { user: { fields: { lastActiveAt: {
-			type: "date",
-			required: false
-		} } } } : {}
+		schema: {
+			...opts.activityTracking?.enabled ? { user: { fields: { lastActiveAt: {
+				type: "date",
+				required: false
+			} } } } : {},
+			...opts.managedDirectorySync?.enabled ? {
+				directorySyncConnection: { fields: {
+					organizationId: {
+						type: "string",
+						required: true,
+						index: true
+					},
+					providerId: {
+						type: "string",
+						required: true
+					},
+					aliasKey: {
+						type: "string",
+						required: true,
+						unique: true,
+						returned: false
+					},
+					provisioningDomainId: {
+						type: "string",
+						required: true,
+						unique: true
+					},
+					activeOrganizationKey: {
+						type: "string",
+						required: true,
+						unique: true,
+						returned: false
+					},
+					connectionId: {
+						type: "string",
+						required: false,
+						unique: true
+					},
+					creationRequestId: {
+						type: "string",
+						required: true,
+						unique: true,
+						returned: false
+					},
+					status: {
+						type: "string",
+						required: true
+					},
+					revision: {
+						type: "number",
+						required: true,
+						defaultValue: 0,
+						returned: false
+					},
+					createdAt: {
+						type: "date",
+						required: true
+					},
+					createdByActorId: {
+						type: "string",
+						required: true
+					},
+					updatedAt: {
+						type: "date",
+						required: true
+					},
+					lastActorId: {
+						type: "string",
+						required: true
+					},
+					ssoProviderId: {
+						type: "string",
+						required: false
+					},
+					ssoProviderRecordId: {
+						type: "string",
+						required: false,
+						index: true
+					},
+					activeSsoProviderKey: {
+						type: "string",
+						required: true,
+						unique: true,
+						returned: false
+					},
+					serializedSsoPairing: {
+						type: "string",
+						required: false,
+						returned: false
+					},
+					pairingEnforced: {
+						type: "boolean",
+						required: true,
+						defaultValue: false
+					},
+					unpairedAt: {
+						type: "date",
+						required: false
+					},
+					unpairedBy: {
+						type: "string",
+						required: false
+					},
+					decommissionStartedAt: {
+						type: "date",
+						required: false
+					},
+					decommissionedAt: {
+						type: "date",
+						required: false
+					},
+					lastError: {
+						type: "string",
+						required: false,
+						returned: false
+					}
+				} },
+				directorySyncMembershipProvenance: { fields: {
+					membershipKey: {
+						type: "string",
+						required: true,
+						unique: true,
+						returned: false
+					},
+					organizationId: {
+						type: "string",
+						required: true,
+						index: true
+					},
+					userId: {
+						type: "string",
+						required: true,
+						index: true
+					},
+					memberId: {
+						type: "string",
+						required: true,
+						unique: true
+					},
+					ownership: {
+						type: "string",
+						required: true,
+						returned: false
+					},
+					provisioningDomainId: {
+						type: "string",
+						required: true,
+						index: true
+					},
+					createdAt: {
+						type: "date",
+						required: true
+					},
+					updatedAt: {
+						type: "date",
+						required: true
+					}
+				} }
+			} : {}
+		}
 	};
 };
 //#endregion