@better-auth/infra 0.3.7 → 0.4.1

package/dist/index.mjs

@@ -1,15 +1,15 @@
-import { i as INFRA_USER_AGENT, n as INFRA_API_URL, o as PLUGIN_VERSION, r as INFRA_KV_URL } from "./constants-AfApXLhx.mjs";
-import { a as createAPI, o as createKV, r as hmacSha256Hex } from "./crypto--3ycICW4.mjs";
+import { i as INFRA_USER_AGENT, n as INFRA_API_URL, o as PLUGIN_VERSION, r as INFRA_KV_URL } from "./constants-CtvGRrlI.mjs";
+import { a as createAPI, n as hash$1, o as createKV, r as hmacSha256Hex } from "./crypto-CV91nSbp.mjs";
 import { EMAIL_TEMPLATES, createEmailSender, sendBulkEmails, sendEmail } from "./email.mjs";
-import { getCurrentAuthContext } from "@better-auth/core/context";
+import { getCurrentAdapter, getCurrentAuthContext, getCurrentDBAdapterAsyncLocalStorage, runWithTransaction } from "@better-auth/core/context";
 import { APIError, generateId, getAuthTables, logger } from "better-auth";
 import { env } from "@better-auth/core/env";
 import { APIError as APIError$1, createAuthEndpoint, createAuthMiddleware, requestPasswordReset, sendVerificationEmailFn, sessionMiddleware } from "better-auth/api";
+import { deleteSessionCookie, setSessionCookie } from "better-auth/cookies";
 import { createFetch } from "@better-fetch/fetch";
 import { isValidPhoneNumber, parsePhoneNumberFromString } from "libphonenumber-js";
+import z, { z as z$1 } from "zod";
 import { createLocalJWKSet, jwtVerify } from "jose";
-import z$1, { z } from "zod";
-import { deleteSessionCookie, setSessionCookie } from "better-auth/cookies";
 import { generateRandomString, symmetricEncrypt } from "better-auth/crypto";
 import { createOTP } from "@better-auth/utils/otp";
 //#region src/options.ts
@@ -18,25 +18,38 @@ function resolveConnectionOptions(options) {
 		apiUrl: options?.apiUrl || INFRA_API_URL,
 		kvUrl: options?.kvUrl || INFRA_KV_URL,
 		apiKey: options?.apiKey || env.BETTER_AUTH_API_KEY || "",
-		apiTimeout: options?.apiTimeout ?? 3e3,
-		kvTimeout: options?.kvTimeout ?? 1e3
+		apiOptions: { timeout: options?.apiOptions?.timeout ?? options?.apiTimeout ?? 3e3 },
+		kvOptions: {
+			timeout: options?.kvOptions?.timeout ?? options?.kvTimeout ?? 1e3,
+			retry: {
+				attempts: options?.kvOptions?.retry?.attempts ?? 2,
+				baseDelay: options?.kvOptions?.retry?.baseDelay ?? 400,
+				maxDelay: options?.kvOptions?.retry?.maxDelay ?? 600
+			}
+		}
 	};
 }
 function resolveDashOptions(options) {
-	const activityUpdateInterval = options?.activityTracking?.updateInterval ?? 3e5;
 	return {
 		...resolveConnectionOptions(options),
-		...options,
 		activityTracking: {
 			...options?.activityTracking,
-			updateInterval: activityUpdateInterval
+			updateInterval: options?.activityTracking?.updateInterval ?? 3e5
+		},
+		managedDirectorySync: {
+			enabled: options?.managedDirectorySync?.enabled ?? false,
+			ssoPairing: options?.managedDirectorySync?.ssoPairing ?? true,
+			membershipProjection: {
+				enabled: options?.managedDirectorySync?.membershipProjection?.enabled ?? true,
+				role: options?.managedDirectorySync?.membershipProjection?.role ?? "member"
+			}
 		}
 	};
 }
 function resolveSentinelOptions(options) {
 	return {
 		...resolveConnectionOptions(options),
-		...options
+		security: options?.security
 	};
 }
 //#endregion
@@ -149,7 +162,12 @@ const USER_EVENT_TYPES = {
 //#endregion
 //#region src/events/core/adapter.ts
 function resolveUserFromContext(userId, ctx) {
-	for (const candidate of [ctx.context.session?.user, ctx.context.newSession?.user]) if (candidate?.id === userId) return {
+	const returnedUser = ctx.context.returned?.user;
+	for (const candidate of [
+		ctx.context.session?.user,
+		ctx.context.newSession?.user,
+		returnedUser
+	]) if (candidate?.id === userId) return {
 		id: candidate.id,
 		name: candidate.name,
 		email: candidate.email ?? null,
@@ -295,7 +313,8 @@ function tryDecode(value) {
 const stripQuery = (value) => value.split("?")[0] || value;
 const escapeRegex = (value) => value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 const routeToRegex = (route) => {
-	const pattern = escapeRegex(stripQuery(route)).replace(/\/:([^/]+)/g, "/[^/]+");
+	const normalized = stripQuery(route);
+	const pattern = escapeRegex(normalized).replace(/\/:([^/]+)/g, "/[^/]+");
 	return new RegExp(`^${pattern}(?:$|[/?])`);
 };
 const matchesAnyRoute = (path, routes) => {
@@ -341,8 +360,80 @@ const getLoginMethod = (ctx) => {
 	return null;
 };
 //#endregion
+//#region src/compat/account.ts
+/**
+* Mirrors better-auth 1.7+ `createLocalAccountIssuer` so infra can
+* typecheck against older core packages while emitting the same issuer strings.
+*/
+function createLocalAccountIssuer(providerId) {
+	return `local:${encodeURIComponent(providerId)}`;
+}
+/**
+* Mirrors better-auth 1.7+ `createOAuthAccountIssuer`.
+*/
+function createOAuthAccountIssuer(providerId) {
+	return `local:oauth:${encodeURIComponent(providerId)}`;
+}
+/** True when the installed better-auth build scopes accounts by issuer. */
+function supportsIssuerScopedAccounts(adapter) {
+	return typeof adapter.findAccountByKey === "function";
+}
+/** Creates a credential account across pre/post issuer-scoped account schemas. */
+async function createCredentialAccountCompat(adapter, params) {
+	if (supportsIssuerScopedAccounts(adapter)) {
+		await adapter.createAccount({
+			userId: params.userId,
+			providerId: "credential",
+			accountId: params.userId,
+			issuer: createLocalAccountIssuer("credential"),
+			password: params.password
+		});
+		return;
+	}
+	await adapter.createAccount({
+		userId: params.userId,
+		providerId: "credential",
+		accountId: params.userId,
+		password: params.password
+	});
+}
+/** Finds an unlink target by provider and local account row id. */
+function resolveAccountForUnlink(accounts, selector) {
+	return accounts.find((account) => account.providerId === selector.providerId && account.id === selector.accountId);
+}
+//#endregion
 //#region src/events/core/oauth-callback-user.ts
 const OAUTH_CALLBACK_USER = Symbol.for("dash.oauthCallbackUser");
+function normalizeProviderSubject(subject) {
+	if (!subject || subject === "undefined" || subject === "null") return;
+	return subject;
+}
+async function resolveAccountKey(provider, tokens, profile) {
+	const keyedProvider = provider;
+	const context = {
+		tokens,
+		profile
+	};
+	try {
+		let rawSubject;
+		if (keyedProvider.accountSubject) rawSubject = String(await keyedProvider.accountSubject(context));
+		else {
+			const { id, sub } = profile;
+			const value = id ?? sub;
+			rawSubject = value == null ? void 0 : String(value);
+		}
+		const accountId = rawSubject ? normalizeProviderSubject(rawSubject) : void 0;
+		if (!accountId) return void 0;
+		const issuer = typeof keyedProvider.accountIssuer === "function" ? await keyedProvider.accountIssuer(context) : keyedProvider.accountIssuer ?? createOAuthAccountIssuer(provider.id);
+		if (!issuer) return void 0;
+		return {
+			issuer,
+			accountId
+		};
+	} catch {
+		return;
+	}
+}
 /**
 * Stash OAuth profile on the request context when better-auth calls getUserInfo
 * during the callback, before the authorization code is consumed.
@@ -355,19 +446,36 @@ function instrumentSocialProviders(providers) {
 			const user = result?.user;
 			if (user) try {
 				const endpointCtx = await getCurrentAuthContext();
-				endpointCtx.context[OAUTH_CALLBACK_USER] = user;
+				const adapter = endpointCtx.context.internalAdapter;
+				const accountKey = result.data && typeof adapter.findAccountOwnerByKey === "function" ? await resolveAccountKey(provider, token, result.data) : void 0;
+				endpointCtx.context[OAUTH_CALLBACK_USER] = {
+					user,
+					accountKey
+				};
 			} catch {}
 			return result;
 		};
 	}
 }
 async function resolveOAuthUser(providerId, ctx) {
-	const oauthUser = ctx.context[OAUTH_CALLBACK_USER];
-	if (!oauthUser) return null;
+	const stashed = ctx.context[OAUTH_CALLBACK_USER];
+	if (!stashed) return null;
+	const { user: oauthUser, accountKey } = stashed;
 	const email = oauthUser.email?.toLowerCase();
+	const adapter = ctx.context.internalAdapter;
+	if (accountKey && typeof adapter.findAccountOwnerByKey === "function") try {
+		const owned = await adapter.findAccountOwnerByKey(accountKey);
+		if (owned?.kind === "owned") return {
+			id: owned.user.id,
+			email: owned.user.email,
+			name: owned.user.name
+		};
+	} catch (error) {
+		logger.debug("[Dash] Failed to find OAuth user by account key:", error);
+	}
 	const accountId = oauthUser.id !== void 0 && oauthUser.id !== null ? String(oauthUser.id) : void 0;
-	if (email && accountId) try {
-		const result = await ctx.context.internalAdapter.findOAuthUser(email, accountId, providerId);
+	if (email && accountId && typeof adapter.findOAuthUser === "function") try {
+		const result = await adapter.findOAuthUser(email, accountId, providerId);
 		if (result?.user) return {
 			id: result.user.id,
 			email: result.user.email,
@@ -941,7 +1049,7 @@ function resolveClientIpFromHeaders(headers, ipAddressHeaders) {
 /**
 * Identification Service
 *
-* Fetches identification data from the durable-kv service
+* Fetches identification data from the identify API
 * when a request includes an X-Request-Id header.
 */
 const IDENTIFICATION_COOKIE_NAME = "__infra-rid";
@@ -957,31 +1065,38 @@ function cleanupCache() {
 function maybeCleanup() {
 	if (Date.now() - lastCleanup > CACHE_TTL_MS || identificationCache.size > CACHE_MAX_SIZE) cleanupCache();
 }
-/** Retries 404 races with exponential backoff (≤1s total wait across retries). */
-const IDENTIFY_GET_RETRY = {
-	type: "exponential",
+const DEFAULT_KV_RETRY = {
 	attempts: 2,
 	baseDelay: 400,
-	maxDelay: 600,
-	shouldRetry(response) {
-		if (response === null) return true;
-		return response.status === 404;
-	}
+	maxDelay: 600
 };
-function identifyGetRetryDelay(attempt) {
-	return Math.min(600, 400 * 2 ** attempt);
+function resolveIdentifyGetRetry(retry) {
+	return {
+		type: "exponential",
+		attempts: retry.attempts,
+		baseDelay: retry.baseDelay,
+		maxDelay: retry.maxDelay,
+		shouldRetry(response) {
+			if (response === null) return true;
+			return response.status === 404;
+		}
+	};
+}
+function identifyGetRetryDelay(retry, attempt) {
+	return Math.min(retry.maxDelay, retry.baseDelay * 2 ** attempt);
 }
 /**
-* Fetch identification data from durable-kv by requestId
+* Fetch identification data from the identify API by requestId
 */
-async function getIdentification(requestId, $kv) {
+async function getIdentification(requestId, $kv, retryOptions = DEFAULT_KV_RETRY) {
 	maybeCleanup();
 	const cached = identificationCache.get(requestId);
 	if (cached && Date.now() - cached.timestamp < CACHE_TTL_MS) return cached.data;
+	const retry = resolveIdentifyGetRetry(retryOptions);
 	for (let networkAttempt = 0;; networkAttempt++) try {
 		const { data, error } = await $kv(`/identify/${requestId}`, {
 			method: "GET",
-			retry: IDENTIFY_GET_RETRY
+			retry
 		});
 		if (data && !error) {
 			identificationCache.set(requestId, {
@@ -996,11 +1111,11 @@ async function getIdentification(requestId, $kv) {
 		});
 		return null;
 	} catch (error) {
-		if (networkAttempt >= IDENTIFY_GET_RETRY.attempts) {
+		if (networkAttempt >= retry.attempts) {
 			logger.error("[Dash] Failed to fetch identification:", error);
 			return null;
 		}
-		await new Promise((resolve) => setTimeout(resolve, identifyGetRetryDelay(networkAttempt)));
+		await new Promise((resolve) => setTimeout(resolve, identifyGetRetryDelay(retryOptions, networkAttempt)));
 	}
 }
 /**
@@ -1046,6 +1161,7 @@ function resolveUntrustedVisitorId(visitorId, ip, headerVisitorId) {
 * @param $kv — KV client from {@link createKV} for the same plugin options (one instance per plugin).
 */
 function createIdentificationMiddleware($kv, options) {
+	const retry = options?.retry ?? DEFAULT_KV_RETRY;
 	return createAuthMiddleware(async (ctx) => {
 		const skipIdentification = options?.skipIdentification?.(ctx) ?? false;
 		let headerVisitorId = null;
@@ -1058,7 +1174,7 @@ function createIdentificationMiddleware($kv, options) {
 		ctx.context.requestId = requestId;
 		if (skipIdentification) ctx.context.identification = null;
 		else if (requestId) {
-			if (ctx.context.identification === void 0) ctx.context.identification = await getIdentification(requestId, $kv) ?? null;
+			if (ctx.context.identification === void 0) ctx.context.identification = await getIdentification(requestId, $kv, retry) ?? null;
 		} else ctx.context.identification = null;
 		const identification = ctx.context.identification;
 		const visitorId = resolveSecurityVisitorId(headerVisitorId, identification);
@@ -1181,8 +1297,9 @@ function isEmailNormalizationEnabled(security) {
 * @param $api — Dash client from `createAPI(opts, { throw: true })`.
 */
 function createSecurityClient(conn, $api, options, onSecurityEvent) {
+	const resolvedApiUrl = conn.apiUrl || INFRA_API_URL;
 	const emailSender = createEmailSender({
-		apiUrl: conn.apiUrl || INFRA_API_URL,
+		apiUrl: resolvedApiUrl,
 		apiKey: conn.apiKey
 	});
 	function logEvent(event) {
@@ -1626,7 +1743,7 @@ const authPaths = [
 	"/email-otp/send-verification-otp"
 ];
 const registration = new Set(registrationPaths);
-const all = new Set([...registrationPaths, ...authPaths]);
+const all = /* @__PURE__ */ new Set([...registrationPaths, ...authPaths]);
 /** Path carries an email we hook for normalization + syntax validation. */
 const allEmail = ({ path }) => !!path && all.has(path);
 /**
@@ -1639,11 +1756,11 @@ const registrationEmail = ({ path }) => !!path && registration.has(path);
 /**
 * Gmail-like providers that ignore dots in the local part
 */
-const GMAIL_LIKE_DOMAINS = new Set(["gmail.com", "googlemail.com"]);
+const GMAIL_LIKE_DOMAINS = /* @__PURE__ */ new Set(["gmail.com", "googlemail.com"]);
 /**
 * Providers known to support plus addressing
 */
-const PLUS_ADDRESSING_DOMAINS = new Set([
+const PLUS_ADDRESSING_DOMAINS = /* @__PURE__ */ new Set([
 	"gmail.com",
 	"googlemail.com",
 	"outlook.com",
@@ -1913,7 +2030,7 @@ function createEmailHooks(options = {}) {
 * Common fake/test phone numbers that should be blocked
 * These are numbers commonly used in testing, movies, documentation, etc.
 */
-const INVALID_PHONE_NUMBERS = new Set([
+const INVALID_PHONE_NUMBERS = /* @__PURE__ */ new Set([
 	"+15550000000",
 	"+15550001111",
 	"+15550001234",
@@ -2002,7 +2119,7 @@ const INVALID_PHONE_PATTERNS = [
 * Key: country code, Value: set of invalid prefixes
 */
 const INVALID_PREFIXES_BY_COUNTRY = {
-	US: new Set([
+	US: /* @__PURE__ */ new Set([
 		"555",
 		"000",
 		"111",
@@ -2010,17 +2127,17 @@ const INVALID_PREFIXES_BY_COUNTRY = {
 		"411",
 		"611"
 	]),
-	CA: new Set([
+	CA: /* @__PURE__ */ new Set([
 		"555",
 		"000",
 		"911"
 	]),
-	GB: new Set([
+	GB: /* @__PURE__ */ new Set([
 		"7700900",
 		"1632960",
 		"1134960"
 	]),
-	AU: new Set([
+	AU: /* @__PURE__ */ new Set([
 		"0491570",
 		"0491571",
 		"0491572"
@@ -2090,7 +2207,7 @@ const validatePhone = (phone, options = {}) => {
 	if (blockVoip && phoneType === "VOIP") return false;
 	return true;
 };
-const allPhonePaths = new Set([
+const allPhonePaths = /* @__PURE__ */ new Set([
 	"/phone-number/send-otp",
 	"/phone-number/verify",
 	"/sign-in/phone-number",
@@ -2188,9 +2305,24 @@ const sentinel = (options) => {
 	const opts = resolveSentinelOptions(options);
 	const $api = createAPI(opts);
 	const $apiThrowing = createAPI(opts, { throw: true });
-	const $kv = createKV(opts);
+	const $kv = createKV({
+		kvUrl: opts.kvUrl,
+		apiKey: opts.apiKey,
+		timeout: opts.kvOptions.timeout
+	});
 	const { tracker } = initTrackEvents($api);
 	const { trackEvent } = tracker;
+	const STALE_ACCOUNT_BLOCK_ERROR = {
+		message: "This account has been inactive for an extended period. Please contact support to reactivate.",
+		code: "STALE_ACCOUNT"
+	};
+	function isStaleAccountError(returned) {
+		if (!(returned instanceof Error)) return false;
+		const err = returned;
+		if (err.code === STALE_ACCOUNT_BLOCK_ERROR.code) return true;
+		return typeof err.body === "object" && err.body !== null && "code" in err.body && err.body.code === STALE_ACCOUNT_BLOCK_ERROR.code;
+	}
+	let activityTrackingEnabled = false;
 	if (!opts.apiKey) logger.warn("[Sentinel] Missing BETTER_AUTH_API_KEY. Security checks may fall back to allow mode when the Infra API rejects requests.");
 	const securityService = createSecurityClient(opts, $apiThrowing, opts.security || {}, (event) => {
 		trackEvent({
@@ -2220,7 +2352,7 @@ const sentinel = (options) => {
 	return {
 		id: "sentinel",
 		init(ctx) {
-			const activityTrackingEnabled = (ctx.getPlugin("dash")?.options)?.activityTracking?.enabled === true;
+			activityTrackingEnabled = (ctx.getPlugin("dash")?.options)?.activityTracking?.enabled === true;
 			return { options: {
 				emailValidation: opts.security?.emailValidation,
 				emailNormalization: opts.security?.emailNormalization,
@@ -2324,35 +2456,6 @@ const sentinel = (options) => {
 							if (visitorId) {
 								if (await securityService.checkUnknownDevice(session.userId, visitorId) && user?.email) await ctx.context.runInBackgroundOrAwait(securityService.notifyUnknownDevice(session.userId, user.email, identification));
 							}
-							if (opts.security?.staleUsers?.enabled && user) {
-								recordCheck(ctx, "stale_users");
-								const lastActiveAtForStale = activityTrackingEnabled ? user.lastActiveAt ?? null : null;
-								const staleCheck = await securityService.checkStaleUser(session.userId, lastActiveAtForStale);
-								if (staleCheck.isStale) {
-									const staleOpts = opts.security.staleUsers;
-									const notificationPromises = [];
-									if (staleCheck.notifyUser && user.email) notificationPromises.push(securityService.notifyStaleAccountUser(user.email, user.name || null, staleCheck.daysSinceLastActive || 0, identification));
-									if (staleCheck.notifyAdmin && staleOpts.adminEmail) notificationPromises.push(securityService.notifyStaleAccountAdmin(staleOpts.adminEmail, session.userId, user.email || "unknown", user.name || null, staleCheck.daysSinceLastActive || 0, identification));
-									if (notificationPromises.length > 0) Promise.all(notificationPromises).catch((error) => {
-										logger.error("[Sentinel] Failed to send stale account notifications:", error);
-									});
-									if (staleCheck.action === "block") {
-										setOutcome(ctx, "blocked", "stale_users", {
-											userId: session.userId,
-											daysSinceLastActive: staleCheck.daysSinceLastActive,
-											staleDays: staleCheck.staleDays,
-											lastActiveAt: staleCheck.lastActiveAt,
-											notifyUser: staleCheck.notifyUser,
-											notifyAdmin: staleCheck.notifyAdmin
-										});
-										emitEvaluation(ctx, trackEvent);
-										throw new APIError("FORBIDDEN", {
-											message: "This account has been inactive for an extended period. Please contact support to reactivate.",
-											code: "STALE_ACCOUNT"
-										});
-									}
-								}
-							}
 							if (opts.security?.impossibleTravel?.enabled && identification?.location) await ctx.context.runInBackgroundOrAwait(securityService.storeLastLocation(session.userId, identification.location, identification.ip));
 						}
 					} }
@@ -2363,7 +2466,10 @@ const sentinel = (options) => {
 			before: [
 				{
 					matcher: (ctx) => ctx.request?.method !== "GET",
-					handler: createIdentificationMiddleware($kv, { skipIdentification: (ctx) => isDashRoute(ctx.path) })
+					handler: createIdentificationMiddleware($kv, {
+						skipIdentification: (ctx) => isDashRoute(ctx.path),
+						retry: opts.kvOptions.retry
+					})
 				},
 				...emailHooks.before,
 				...phoneValidationHooks.before,
@@ -2462,6 +2568,52 @@ const sentinel = (options) => {
 				}
 			],
 			after: [{
+				matcher: (ctx) => !!opts.security?.staleUsers?.enabled && !isDashRoute(ctx.path),
+				handler: createAuthMiddleware(async (ctx) => {
+					if (ctx.context.returned instanceof Error) return;
+					const created = ctx.context.newSession;
+					const userId = created?.user?.id ?? created?.session?.userId;
+					const sessionToken = created?.session?.token;
+					if (!userId || !sessionToken) return;
+					let user = created?.user ?? null;
+					try {
+						user = await getUserById(userId, ctx, { includeLastActiveAt: activityTrackingEnabled }) ?? user;
+					} catch (error) {
+						logger.warn("[Sentinel] Failed to fetch user for stale-account check:", error);
+						if (!user) return;
+					}
+					if (!user) return;
+					recordCheck(ctx, "stale_users");
+					const staleCheck = await securityService.checkStaleUser(userId, activityTrackingEnabled ? user.lastActiveAt ?? null : null);
+					if (!staleCheck.isStale) return;
+					const identification = ctx.context.identification;
+					const staleOpts = opts.security?.staleUsers;
+					const notificationPromises = [];
+					if (staleCheck.notifyUser && user.email) notificationPromises.push(securityService.notifyStaleAccountUser(user.email, user.name || null, staleCheck.daysSinceLastActive || 0, identification));
+					if (staleCheck.notifyAdmin && staleOpts?.adminEmail) notificationPromises.push(securityService.notifyStaleAccountAdmin(staleOpts.adminEmail, userId, user.email || "unknown", user.name || null, staleCheck.daysSinceLastActive || 0, identification));
+					if (notificationPromises.length > 0) Promise.all(notificationPromises).catch((error) => {
+						logger.error("[Sentinel] Failed to send stale account notifications:", error);
+					});
+					if (staleCheck.action !== "block") return;
+					setOutcome(ctx, "blocked", "stale_users", {
+						userId,
+						daysSinceLastActive: staleCheck.daysSinceLastActive,
+						staleDays: staleCheck.staleDays,
+						lastActiveAt: staleCheck.lastActiveAt,
+						notifyUser: staleCheck.notifyUser,
+						notifyAdmin: staleCheck.notifyAdmin
+					});
+					emitEvaluation(ctx, trackEvent);
+					try {
+						await ctx.context.internalAdapter.deleteSession(sessionToken);
+					} catch (error) {
+						logger.warn("[Sentinel] Failed to delete stale-blocked session:", error);
+					}
+					deleteSessionCookie(ctx);
+					ctx.context.setNewSession(null);
+					throw new APIError("FORBIDDEN", STALE_ACCOUNT_BLOCK_ERROR);
+				})
+			}, {
 				matcher: (ctx) => ctx.request?.method !== "GET" && !isDashRoute(ctx.path),
 				handler: createAuthMiddleware(async (ctx) => {
 					const untrustedVisitorId = ctx.context.untrustedVisitorId;
@@ -2477,14 +2629,433 @@ const sentinel = (options) => {
 						identifier: loginId,
 						userAgent: ctx.headers?.get?.("user-agent") || ""
 					});
-					if (isPasswordSignInRoute && ctx.context.returned instanceof Error && loginId && body?.password && untrustedVisitorId) await ctx.context.runInBackgroundOrAwait(securityService.trackFailedAttempt(loginId, untrustedVisitorId, body.password, ip, ctx.context.requestId ?? null));
-					if (isPasswordSignInRoute && !(ctx.context.returned instanceof Error) && loginId) await ctx.context.runInBackgroundOrAwait(securityService.clearFailedAttempts(loginId));
+					const returned = ctx.context.returned;
+					const staleBlocked = isStaleAccountError(returned);
+					if (isPasswordSignInRoute && returned instanceof Error && !staleBlocked && loginId && body?.password && untrustedVisitorId) await ctx.context.runInBackgroundOrAwait(securityService.trackFailedAttempt(loginId, untrustedVisitorId, body.password, ip, ctx.context.requestId ?? null));
+					if (isPasswordSignInRoute && (!(returned instanceof Error) || staleBlocked) && loginId) await ctx.context.runInBackgroundOrAwait(securityService.clearFailedAttempts(loginId));
 				})
 			}]
 		}
 	};
 };
 //#endregion
+//#region src/directory-sync/membership-projection.ts
+async function createMembershipKey(provisioningDomainId, userId) {
+	return `directory-sync-membership:${await hash$1(JSON.stringify([provisioningDomainId, userId]))}`;
+}
+async function findDirectory(input, context) {
+	const row = await context.database.findOne({
+		model: "directorySyncConnection",
+		where: [{
+			field: "provisioningDomainId",
+			value: input.provisioningDomainId
+		}]
+	});
+	if (!row || row.status !== "active" && row.status !== "decommissioning" && row.status !== "decommissioned" || !row.connectionId) return null;
+	return row;
+}
+async function findMembership(context, organizationId, userId) {
+	const memberships = await context.database.findMany({
+		model: "member",
+		where: [{
+			field: "organizationId",
+			value: organizationId
+		}, {
+			field: "userId",
+			value: userId
+		}]
+	});
+	if (memberships.length > 1) throw new Error("Directory sync membership projection requires a unique organization and user membership");
+	return memberships.at(0) ?? null;
+}
+async function findProvenance(context, membershipKey) {
+	return await context.database.findOne({
+		model: "directorySyncMembershipProvenance",
+		where: [{
+			field: "membershipKey",
+			value: membershipKey
+		}]
+	});
+}
+async function createProvenance(context, input) {
+	const now = /* @__PURE__ */ new Date();
+	await context.database.create({
+		model: "directorySyncMembershipProvenance",
+		data: {
+			...input,
+			createdAt: now,
+			updatedAt: now
+		}
+	});
+}
+function createOrganizationMembershipProjection(options) {
+	if (!options.role.trim()) throw new Error("Directory sync membership role must not be empty");
+	return async (input, context) => {
+		const directory = await findDirectory(input, context);
+		if (!directory?.connectionId) return;
+		const membershipKey = await createMembershipKey(input.provisioningDomainId, input.userId);
+		const [membership, provenance] = await Promise.all([findMembership(context, directory.organizationId, input.userId), findProvenance(context, membershipKey)]);
+		if (provenance && (provenance.ownership !== "created" && provenance.ownership !== "observed" || provenance.provisioningDomainId !== input.provisioningDomainId || provenance.organizationId !== directory.organizationId || provenance.userId !== input.userId)) throw new Error("Directory sync membership provenance does not match its provisioning domain");
+		if (!input.active) {
+			if (!provenance) return;
+			if (provenance.ownership === "created" && membership?.id === provenance.memberId && membership.organizationId === provenance.organizationId && membership.userId === provenance.userId) await context.database.delete({
+				model: "member",
+				where: [
+					{
+						field: "id",
+						value: provenance.memberId
+					},
+					{
+						field: "organizationId",
+						value: provenance.organizationId
+					},
+					{
+						field: "userId",
+						value: provenance.userId
+					}
+				]
+			});
+			await context.database.delete({
+				model: "directorySyncMembershipProvenance",
+				where: [{
+					field: "id",
+					value: provenance.id
+				}, {
+					field: "membershipKey",
+					value: membershipKey
+				}]
+			});
+			return;
+		}
+		if (membership) {
+			if (provenance?.memberId === membership.id) return;
+			if (provenance) await context.database.delete({
+				model: "directorySyncMembershipProvenance",
+				where: [{
+					field: "id",
+					value: provenance.id
+				}, {
+					field: "membershipKey",
+					value: membershipKey
+				}]
+			});
+			await createProvenance(context, {
+				membershipKey,
+				organizationId: directory.organizationId,
+				userId: input.userId,
+				memberId: membership.id,
+				ownership: "observed",
+				provisioningDomainId: input.provisioningDomainId
+			});
+			return;
+		}
+		if (provenance) await context.database.delete({
+			model: "directorySyncMembershipProvenance",
+			where: [{
+				field: "id",
+				value: provenance.id
+			}, {
+				field: "membershipKey",
+				value: membershipKey
+			}]
+		});
+		const now = /* @__PURE__ */ new Date();
+		const createdMembership = await context.database.create({
+			model: "member",
+			data: {
+				organizationId: directory.organizationId,
+				userId: input.userId,
+				role: options.role,
+				createdAt: now
+			}
+		});
+		await createProvenance(context, {
+			membershipKey,
+			organizationId: directory.organizationId,
+			userId: input.userId,
+			memberId: createdMembership.id,
+			ownership: "created",
+			provisioningDomainId: input.provisioningDomainId
+		});
+	};
+}
+//#endregion
+//#region src/routes/directory-sync/contract.ts
+const DIRECTORY_SYNC_PURPOSE = "directory-sync-management";
+const ALL_SCIM_SCOPES = [
+	"scim.users.read",
+	"scim.users.write",
+	"scim.groups.read",
+	"scim.groups.write"
+];
+const scimScopeSchema = z.enum(ALL_SCIM_SCOPES);
+const credentialPolicySchema = {
+	scopes: z.array(scimScopeSchema).min(1).optional(),
+	expiresAt: z.coerce.date().optional()
+};
+const directorySyncSSOPairingSchema = z.discriminatedUnion("protocol", [z.object({
+	ssoProviderId: z.string().trim().min(1).max(255),
+	protocol: z.literal("oidc"),
+	externalIdSource: z.discriminatedUnion("kind", [z.object({ kind: z.literal("subject") }), z.object({
+		kind: z.literal("verifiedIdTokenClaim"),
+		name: z.string().trim().min(1).max(255)
+	})])
+}), z.object({
+	ssoProviderId: z.string().trim().min(1).max(255),
+	protocol: z.literal("saml"),
+	externalIdSource: z.discriminatedUnion("kind", [z.object({ kind: z.literal("nameId") }), z.object({
+		kind: z.literal("attribute"),
+		name: z.string().trim().min(1).max(255)
+	})])
+})]);
+const createDirectoryBodySchema = z.object({
+	providerId: z.string().trim().min(1).max(255),
+	pairing: directorySyncSSOPairingSchema.optional(),
+	...credentialPolicySchema
+});
+const rotateCredentialBodySchema = z.object(credentialPolicySchema);
+const emptyBodySchema = z.object({});
+function setCredentialResponseSecurityHeaders(ctx) {
+	ctx.setHeader("Cache-Control", "no-store, max-age=0");
+	ctx.setHeader("Pragma", "no-cache");
+	ctx.setHeader("Referrer-Policy", "no-referrer");
+}
+//#endregion
+//#region src/directory-sync/pairing.ts
+let samlPolicyModule;
+function loadSAMLPolicy() {
+	samlPolicyModule ??= import("./saml-policy-DQR0MBLk.mjs");
+	return samlPolicyModule;
+}
+function isRecord$1(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function parseConfiguration(value) {
+	if (isRecord$1(value)) return value;
+	if (typeof value !== "string") return null;
+	try {
+		const parsed = JSON.parse(value);
+		return isRecord$1(parsed) ? parsed : null;
+	} catch {
+		return null;
+	}
+}
+function parseDirectorySyncSSOPairing(value) {
+	if (!value) return null;
+	let parsed;
+	try {
+		parsed = JSON.parse(value);
+	} catch {
+		return null;
+	}
+	const result = directorySyncSSOPairingSchema.safeParse(parsed);
+	return result.success ? result.data : null;
+}
+async function createActiveSSOProviderKey(ssoProviderRecordId) {
+	return `directory-sync-sso-active:${await hash$1(ssoProviderRecordId)}`;
+}
+function createInactiveSSOProviderKey(aliasKey) {
+	return `directory-sync-sso-inactive:${aliasKey}`;
+}
+function createTerminalSSOProviderKey(aliasKey) {
+	return `directory-sync-sso-terminal:${aliasKey}`;
+}
+async function resolveDirectorySyncSSOPairing(ctx, organizationId, pairing) {
+	const exactProvider = await ctx.context.adapter.update({
+		model: "ssoProvider",
+		where: [{
+			field: "providerId",
+			value: pairing.ssoProviderId
+		}, {
+			field: "organizationId",
+			value: organizationId
+		}],
+		update: { providerId: pairing.ssoProviderId }
+	});
+	if (!exactProvider || exactProvider.providerId !== pairing.ssoProviderId || exactProvider.organizationId !== organizationId) throw ctx.error("BAD_REQUEST", { message: "The selected SSO provider is not available" });
+	const oidcConfiguration = parseConfiguration(exactProvider.oidcConfig);
+	const samlConfiguration = parseConfiguration(exactProvider.samlConfig);
+	if (pairing.protocol === "oidc") {
+		if (!oidcConfiguration || samlConfiguration) throw ctx.error("BAD_REQUEST", { message: "The selected SSO provider is not an OIDC provider" });
+	} else {
+		if (!samlConfiguration || oidcConfiguration) throw ctx.error("BAD_REQUEST", { message: "The selected SSO provider is not a SAML provider" });
+		const samlPolicy = await loadSAMLPolicy();
+		let wantAssertionsSigned = false;
+		try {
+			wantAssertionsSigned = await samlPolicy.requiresSignedSAMLAssertions({
+				spMetadata: isRecord$1(samlConfiguration.spMetadata) ? { metadata: typeof samlConfiguration.spMetadata.metadata === "string" ? samlConfiguration.spMetadata.metadata : void 0 } : void 0,
+				wantAssertionsSigned: samlConfiguration.wantAssertionsSigned === true
+			});
+		} catch {
+			throw ctx.error("BAD_REQUEST", { message: "The selected SAML provider metadata is invalid" });
+		}
+		if (!wantAssertionsSigned) throw ctx.error("BAD_REQUEST", { message: "Paired SAML providers must require cryptographically signed assertions" });
+	}
+	return {
+		pairing,
+		ssoProviderId: exactProvider.providerId,
+		ssoProviderRecordId: exactProvider.id,
+		activeSsoProviderKey: await createActiveSSOProviderKey(exactProvider.id)
+	};
+}
+function serializePairingRow(row) {
+	return parseDirectorySyncSSOPairing(row.serializedSsoPairing);
+}
+async function guardDirectorySyncSSOProviderMutation(input, context) {
+	if (input.providerReference.source.type !== "persisted" || input.providerReference.source.recordId !== input.provider.id) throw new Error("SSO provider mutation reference is not exact");
+	if (await context.database.findOne({
+		model: "directorySyncConnection",
+		where: [
+			{
+				field: "ssoProviderRecordId",
+				value: input.provider.id
+			},
+			{
+				field: "ssoProviderId",
+				value: input.provider.providerId
+			},
+			{
+				field: "organizationId",
+				value: input.provider.organizationId
+			},
+			{
+				field: "pairingEnforced",
+				value: true
+			}
+		]
+	})) {
+		if (input.action === "update" && "isAuthenticationBoundaryChange" in input && input.isAuthenticationBoundaryChange === false) return;
+		throw new Error("SSO provider is paired with directory sync");
+	}
+}
+//#endregion
+//#region src/directory-sync/sso-user-resolution.ts
+const GENERIC_REJECTION = {
+	action: "reject",
+	code: "DIRECTORY_SYNC_AUTHENTICATION_FAILED",
+	message: "Unable to sign in with this SSO connection"
+};
+let scimCatalogModule;
+function loadSCIMCatalog() {
+	scimCatalogModule ??= import("@better-auth/scim");
+	return scimCatalogModule;
+}
+function readStringExternalId(value) {
+	if (typeof value === "string" && value.length > 0) return value;
+	return null;
+}
+function readSAMLExternalId(value) {
+	const scalar = readStringExternalId(value);
+	if (scalar) return scalar;
+	if (Array.isArray(value) && value.length === 1 && typeof value[0] === "string" && value[0].length > 0) return value[0];
+	return null;
+}
+function readExternalId(input, pairing) {
+	if (input.protocol !== pairing.protocol) return null;
+	if (pairing.protocol === "oidc" && input.protocol === "oidc") return readStringExternalId(pairing.externalIdSource.kind === "subject" ? input.accountKey.accountId : input.verifiedIdTokenClaims[pairing.externalIdSource.name]);
+	if (pairing.protocol === "saml" && input.protocol === "saml") return readSAMLExternalId(pairing.externalIdSource.kind === "nameId" ? input.accountKey.accountId : input.providerAttributes[pairing.externalIdSource.name]);
+	return null;
+}
+async function resolveOrganizationDirectorySyncUser(input, context) {
+	if (input.providerReference.source.type !== "persisted") return { action: "continue" };
+	const directories = await context.database.findMany({
+		model: "directorySyncConnection",
+		where: [
+			{
+				field: "ssoProviderRecordId",
+				value: input.providerReference.source.recordId
+			},
+			{
+				field: "ssoProviderId",
+				value: input.providerId
+			},
+			{
+				field: "pairingEnforced",
+				value: true
+			}
+		]
+	});
+	if (directories.length === 0) return { action: "continue" };
+	if (directories.length !== 1) return GENERIC_REJECTION;
+	const directory = directories[0];
+	if (directory?.status !== "active") return GENERIC_REJECTION;
+	if (directory.activeSsoProviderKey !== await createActiveSSOProviderKey(input.providerReference.source.recordId)) return GENERIC_REJECTION;
+	const pairing = parseDirectorySyncSSOPairing(directory.serializedSsoPairing);
+	if (!pairing || pairing.ssoProviderId !== input.providerId || pairing.protocol !== input.protocol || !directory.connectionId) return GENERIC_REJECTION;
+	const externalId = readExternalId(input, pairing);
+	if (!externalId) return GENERIC_REJECTION;
+	try {
+		const catalog = await loadSCIMCatalog();
+		if (typeof catalog.acquireActiveSCIMUserLink !== "function") return GENERIC_REJECTION;
+		const link = await catalog.acquireActiveSCIMUserLink({
+			connectionId: directory.connectionId,
+			externalId
+		}, { database: context.database });
+		if (!link) return GENERIC_REJECTION;
+		return {
+			action: "link",
+			userId: link.userId,
+			profile: "preserve"
+		};
+	} catch {
+		return GENERIC_REJECTION;
+	}
+}
+//#endregion
+//#region src/directory-sync/instrument.ts
+/**
+* When managed directory sync is enabled, optionally install SSO/SCIM
+* callbacks on sibling plugins (same pattern as organization hook
+* instrumentation).
+*/
+function instrumentDirectorySyncIntegration(ctx, options) {
+	if (!options.ssoPairing && !options.membershipProjection.enabled) {
+		logger.debug("[Dash] Managed directory sync instrumentation skipped (ssoPairing and membershipProjection are both disabled)");
+		return;
+	}
+	const ssoPlugin = ctx.getPlugin("sso");
+	const scimPlugin = ctx.getPlugin("scim");
+	if (!ssoPlugin && !scimPlugin) {
+		logger.debug("[Dash] Managed directory sync enabled but SSO/SCIM plugins are not active. Skipping integration instrumentation");
+		return;
+	}
+	if (options.ssoPairing) {
+		if (ssoPlugin) {
+			if (!ssoPlugin.options) logger.error("[Dash] Managed directory sync ssoPairing requires sso({ ... }) (at least sso({})) so pairing callbacks can be installed on the shared options object.");
+			else {
+				const ssoOptions = ssoPlugin.options;
+				const previousResolveUser = ssoOptions.resolveUser;
+				ssoOptions.resolveUser = async (input, context) => {
+					const result = await resolveOrganizationDirectorySyncUser(input, context);
+					if (result.action !== "continue") return result;
+					if (previousResolveUser) return previousResolveUser(input, context);
+					return { action: "continue" };
+				};
+				const previousGuard = ssoOptions.guardProviderMutation;
+				ssoOptions.guardProviderMutation = async (input, context) => {
+					await guardDirectorySyncSSOProviderMutation(input, context);
+					if (previousGuard) await previousGuard(input, context);
+				};
+			}
+		} else logger.debug("[Dash] Managed directory sync ssoPairing enabled but SSO plugin is not active. Skipping SSO pairing instrumentation");
+	}
+	if (options.membershipProjection.enabled) {
+		if (scimPlugin) {
+			if (!scimPlugin.options) logger.error("[Dash] Managed directory sync membershipProjection requires scim({ ... }) with an options object so membership projection can be installed.");
+			else {
+				const scimOptions = scimPlugin.options;
+				const projection = scimOptions.projection ??= {};
+				const previousReconcileUser = projection.reconcileUser;
+				const reconcileUser = createOrganizationMembershipProjection({ role: options.membershipProjection.role });
+				projection.reconcileUser = async (input, context) => {
+					await reconcileUser(input, context);
+					if (previousReconcileUser) await previousReconcileUser(input, context);
+				};
+			}
+		} else logger.debug("[Dash] Managed directory sync membershipProjection enabled but SCIM plugin is not active. Skipping membership projection instrumentation");
+	}
+}
+//#endregion
 //#region src/events/organization/events-invitation.ts
 const initInvitationEvents = (tracker) => {
 	const { trackEvent } = tracker;
@@ -2840,61 +3411,58 @@ const initTeamEvents = (tracker) => {
 };
 //#endregion
 //#region ../utils/dist/redact.mjs
-const EXACT_SENSITIVE_STRING_KEYS_LOWER = new Set([...new Set([
-	"accessToken",
-	"apiKey",
-	"apiSecret",
-	"authorization",
-	"authToken",
-	"bearerToken",
-	"backupCodes",
-	"clientSecret",
-	"consumerSecret",
-	"credentialID",
-	"deviceCode",
-	"encPrivateKey",
-	"encPrivateKeyPass",
-	"encryptionKey",
-	"encryptionSecret",
-	"forwardHeaders",
-	"idToken",
-	"oidcConfig",
-	"pass",
-	"passwd",
-	"password",
-	"privateKey",
-	"privateKeyPass",
-	"pwd",
-	"refreshToken",
-	"samlConfig",
-	"secret",
-	"secretAccessKey",
-	"secretKey",
-	"signingSecret",
-	"stripeWebhookSecret",
-	"userCode",
-	"webhookSecret"
-])].map((k) => k.toLowerCase()));
-/**
-* Case-insensitive suffixes for unknown property names.
-*/
-const SENSITIVE_KEY_SUFFIXES_LOWER = [
-	"accesskey",
-	"secret",
-	"password",
-	"passphrase",
-	"privatekey",
-	"keypass",
-	"apikey",
-	"token",
-	"signingkey",
-	"credentials",
-	"authheader"
-];
-/**
-* Embedded secret substrings checked against the normalized (compact, lowercased) key.
-*/
-const SENSITIVE_KEY_SUBSTRINGS_LOWER = ["secretaccess", "accesskeysecret"];
+/** Built-in sensitive key patterns for consumers that want the defaults. */
+const SENSITIVE_KEY_PATTERNS = {
+	keys: [
+		"accessToken",
+		"apiKey",
+		"apiSecret",
+		"authorization",
+		"authToken",
+		"bearerToken",
+		"backupCodes",
+		"clientSecret",
+		"consumerSecret",
+		"credentialID",
+		"deviceCode",
+		"encPrivateKey",
+		"encPrivateKeyPass",
+		"encryptionKey",
+		"encryptionSecret",
+		"forwardHeaders",
+		"idToken",
+		"oidcConfig",
+		"pass",
+		"passwd",
+		"password",
+		"privateKey",
+		"privateKeyPass",
+		"pwd",
+		"refreshToken",
+		"samlConfig",
+		"secret",
+		"secretAccessKey",
+		"secretKey",
+		"signingSecret",
+		"stripeWebhookSecret",
+		"userCode",
+		"webhookSecret"
+	],
+	suffixes: [
+		"accesskey",
+		"secret",
+		"password",
+		"passphrase",
+		"privatekey",
+		"keypass",
+		"apikey",
+		"token",
+		"signingkey",
+		"credentials",
+		"authheader"
+	],
+	substrings: ["secretaccess", "accesskeysecret"]
+};
 const REDACTED_SIMPLE_STRING = "[REDACTED]";
 function snakeCaseToCamelCase(key) {
 	return key.replace(/_([a-zA-Z])/g, (_, ch) => ch.toUpperCase());
@@ -2902,24 +3470,36 @@ function snakeCaseToCamelCase(key) {
 function keyVariantsForMatching(key) {
 	const trimmed = key.replace(/^[\s._-]+/, "");
 	if (!trimmed) return [key];
-	const out = new Set([key, trimmed]);
+	const out = /* @__PURE__ */ new Set([key, trimmed]);
 	if (trimmed.includes("_")) out.add(snakeCaseToCamelCase(trimmed));
 	return [...out];
 }
-/** Whether a property name should have string values redacted in `redact()`. */
-function isSensitiveStringKey(key) {
+function normalizePatterns(patterns) {
+	const keysLower = /* @__PURE__ */ new Set();
+	for (const key of patterns?.keys ?? []) keysLower.add(key.toLowerCase());
+	return {
+		keysLower,
+		suffixesLower: [...patterns?.suffixes ?? []].map((s) => s.toLowerCase()),
+		substringsLower: [...patterns?.substrings ?? []].map((s) => s.toLowerCase())
+	};
+}
+function hasAnyPatterns(patterns) {
+	return patterns.keysLower.size > 0 || patterns.suffixesLower.length > 0 || patterns.substringsLower.length > 0;
+}
+function matchesNormalizedPatterns(key, patterns) {
+	if (!hasAnyPatterns(patterns)) return false;
 	const variants = keyVariantsForMatching(key);
 	const compactLower = key.replace(/[\s._-]/g, "").toLowerCase();
-	const forms = new Set([compactLower]);
+	const forms = /* @__PURE__ */ new Set([compactLower]);
 	for (const raw of variants) {
 		forms.add(raw);
 		forms.add(raw.toLowerCase());
 	}
 	for (const form of forms) {
 		const fl = form.toLowerCase();
-		if (EXACT_SENSITIVE_STRING_KEYS_LOWER.has(fl)) return true;
-		for (const suffix of SENSITIVE_KEY_SUFFIXES_LOWER) if (fl.endsWith(suffix)) return true;
-		for (const substring of SENSITIVE_KEY_SUBSTRINGS_LOWER) if (compactLower.includes(substring)) return true;
+		if (patterns.keysLower.has(fl)) return true;
+		for (const suffix of patterns.suffixesLower) if (fl.endsWith(suffix)) return true;
+		for (const substring of patterns.substringsLower) if (compactLower.includes(substring)) return true;
 	}
 	return false;
 }
@@ -2931,7 +3511,7 @@ function isPlainSerializable(value) {
 	if (constructor && constructor.name !== "Object" && constructor.name !== "Array") return false;
 	return true;
 }
-function redactInner(value, visiting, options) {
+function redactInner(value, visiting, options, patterns) {
 	if (value === null || value === void 0) return value;
 	if (typeof value === "function") return void 0;
 	if (typeof value !== "object") return value;
@@ -2939,17 +3519,17 @@ function redactInner(value, visiting, options) {
 	if (visiting.has(obj)) return void 0;
 	visiting.add(obj);
 	try {
-		if (Array.isArray(value)) return value.map((item) => redactInner(item, visiting, options)).filter((item) => item !== void 0);
+		if (Array.isArray(value)) return value.map((item) => redactInner(item, visiting, options, patterns)).filter((item) => item !== void 0);
 		const result = {};
 		for (const [key, val] of Object.entries(value)) {
 			if (options?.excludeKeys?.has(key)) continue;
 			if (typeof val === "function") continue;
-			if (typeof val === "string" && isSensitiveStringKey(key)) {
+			if (typeof val === "string" && matchesNormalizedPatterns(key, patterns) && !options?.ignoreKeys?.has(key)) {
 				result[key] = REDACTED_SIMPLE_STRING;
 				continue;
 			}
 			if (options?.skipNonPlainSerializable && val !== null && typeof val === "object" && !isPlainSerializable(val)) continue;
-			const redacted = redactInner(val, visiting, options);
+			const redacted = redactInner(val, visiting, options, patterns);
 			if (redacted !== void 0) result[key] = redacted;
 		}
 		return result;
@@ -2957,9 +3537,55 @@ function redactInner(value, visiting, options) {
 		visiting.delete(obj);
 	}
 }
-/** Recursively redact sensitive string values in a JSON-like object tree. */
+/**
+* Recursively walk a JSON-like object tree.
+*
+* String values are redacted only when `patterns` is provided. With no patterns,
+* this only applies structural options (`excludeKeys`,
+* `skipNonPlainSerializable`, dropping functions).
+*/
 function redact(value, options) {
-	return redactInner(value, /* @__PURE__ */ new WeakSet(), options);
+	const patterns = normalizePatterns(options?.patterns);
+	return redactInner(value, /* @__PURE__ */ new WeakSet(), options, patterns);
+}
+const DASH_PLUGIN_OPTIONS_EXCLUDE_KEYS = { stripe: /* @__PURE__ */ new Set(["stripeClient"]) };
+/** Storage-strategy enums that match sensitive key suffixes but are not secrets. */
+const DASH_PLUGIN_OPTIONS_IGNORE_KEYS = /* @__PURE__ */ new Set([
+	"storeApiKey",
+	"storeClientSecret",
+	"storeSCIMToken",
+	"storeToken"
+]);
+function redactDashPluginOptions(pluginId, options, redactOptions) {
+	return redact(options, {
+		patterns: SENSITIVE_KEY_PATTERNS,
+		...redactOptions,
+		excludeKeys: DASH_PLUGIN_OPTIONS_EXCLUDE_KEYS[pluginId],
+		ignoreKeys: DASH_PLUGIN_OPTIONS_IGNORE_KEYS
+	});
+}
+/**
+* Redact a dash settings payload: `emailAndPassword` and each plugin's `options`.
+*/
+function redactDashSettings(data, redactOptions) {
+	if (data === null || typeof data !== "object") return data;
+	const d = data;
+	const next = { ...d };
+	if ("emailAndPassword" in d) next.emailAndPassword = redact(d.emailAndPassword, {
+		patterns: SENSITIVE_KEY_PATTERNS,
+		...redactOptions
+	});
+	const plugins = d.plugins;
+	if (Array.isArray(plugins)) next.plugins = plugins.map((plugin) => {
+		if (plugin === null || typeof plugin !== "object") return plugin;
+		const p = plugin;
+		const id = typeof p.id === "string" ? p.id : "";
+		return {
+			...p,
+			options: redactDashPluginOptions(id, p.options, redactOptions)
+		};
+	});
+	return next;
 }
 //#endregion
 //#region ../utils/dist/crypto/index.mjs
@@ -3005,7 +3631,7 @@ function timingSafeEqualHash(a, b) {
 * A freshly issued token is almost certainly legitimate.
 */
 const JTI_CHECK_GRACE_PERIOD_SECONDS = 30;
-const JWKS_CACHE_TTL_MS = 900 * 1e3;
+const JWKS_CACHE_TTL_MS = 9e5;
 const jwksCache = /* @__PURE__ */ new Map();
 const inflightRequests = /* @__PURE__ */ new Map();
 async function fetchJWKS(ctx, cacheKey, $api) {
@@ -3054,7 +3680,8 @@ const jwtMiddleware = (options, schema, getJWT) => {
 			ctx.context.logger.warn("[Dash] JWT is missing from header");
 			throw ctx.error("UNAUTHORIZED", { message: "Invalid API key" });
 		}
-		const { payload } = await jwtVerify(jwsFromHeader, await getJWKs(ctx, cacheKey, $api), { maxTokenAge: "5m" }).catch((e) => {
+		const remoteJWKs = await getJWKs(ctx, cacheKey, $api);
+		const { payload } = await jwtVerify(jwsFromHeader, remoteJWKs, { maxTokenAge: "5m" }).catch((e) => {
 			ctx.context.logger.warn("[Dash] JWT verification failed:", e);
 			throw ctx.error("UNAUTHORIZED", { message: "Invalid API key" });
 		});
@@ -3108,7 +3735,8 @@ const jwtValidateMiddleware = (options) => {
 			ctx.context.logger.warn("[Dash] JWT is missing from header");
 			throw ctx.error("UNAUTHORIZED", { message: "Invalid API key" });
 		}
-		const { payload } = await jwtVerify(jwsFromHeader, await getJWKs(ctx, cacheKey, $api), { maxTokenAge: "5m" }).catch((e) => {
+		const remoteJWKs = await getJWKs(ctx, cacheKey, $api);
+		const { payload } = await jwtVerify(jwsFromHeader, remoteJWKs, { maxTokenAge: "5m" }).catch((e) => {
 			ctx.context.logger.error("[Dash] JWT verification failed:", e);
 			throw ctx.error("UNAUTHORIZED", { message: "Invalid API key" });
 		});
@@ -3128,13 +3756,61 @@ const jwtValidateMiddleware = (options) => {
 	});
 };
 //#endregion
-//#region src/lib/redact-plugin-options.ts
-const PLUGIN_OPTIONS_EXCLUDE_KEYS = { stripe: new Set(["stripeClient"]) };
-function redactPluginOptions(pluginId, options, optionsConfig) {
-	return redact(options, {
-		...optionsConfig,
-		excludeKeys: PLUGIN_OPTIONS_EXCLUDE_KEYS[pluginId]
-	});
+//#region ../utils/dist/semver.mjs
+/**
+* Parses a semver string into components.
+* Accepts `major.minor`, `major.minor.patch`, and optional prerelease (`-rc.2`).
+* Returns `null` when the input is missing or not a valid semver prefix.
+*/
+function parseSemver(version) {
+	if (!version) return null;
+	const match = version.trim().match(/^(\d+)\.(\d+)(?:\.(\d+))?(?:-([0-9A-Za-z.-]+))?/);
+	if (!match) return null;
+	return {
+		major: Number(match[1]),
+		minor: Number(match[2]),
+		patch: Number(match[3] ?? 0),
+		prerelease: match[4]
+	};
+}
+function resolve(version) {
+	if (typeof version === "string" || version == null) return parseSemver(version);
+	return version;
+}
+/**
+* True when `version`'s core identity (`major.minor.patch`) is ≥ `target`.
+* Prerelease on `version` is ignored (e.g. `1.7.0-rc.1` ≥ `1.7.0`).
+* `target` may be `major.minor` or `major.minor.patch` (missing patch → 0).
+*/
+function isSemverAtLeast(version, target) {
+	const parsed = resolve(version);
+	const targetParsed = parseSemver(target);
+	if (!parsed || !targetParsed) return false;
+	if (parsed.major !== targetParsed.major) return parsed.major > targetParsed.major;
+	if (parsed.minor !== targetParsed.minor) return parsed.minor > targetParsed.minor;
+	return parsed.patch >= targetParsed.patch;
+}
+//#endregion
+//#region src/semver.ts
+/** Compare semver strings (e.g. "1.7.0-beta.8" against "1.7" or "1.7.0"). */
+function isVersionAtLeast(version, target) {
+	return isSemverAtLeast(version, target);
+}
+/**
+* True for better-auth 1.7+ (including 1.8+).
+* Marks the cutover for issuer-scoped accounts, protocol-defined SSO subjects,
+* `advanced.database.joins`, and post-legacy SCIM connections.
+* Keep in sync with `apps/web/lib/better-auth-compat.ts`.
+*/
+function isBetterAuth17OrLater(version) {
+	const parsed = parseSemver(version);
+	if (!parsed) return false;
+	if (isSemverAtLeast(parsed, "1.8.0")) return true;
+	if (!isSemverAtLeast(parsed, "1.7.0")) return false;
+	if (!parsed.prerelease || parsed.patch > 0) return true;
+	const prereleaseMatch = parsed.prerelease.match(/^rc\.(\d+)/);
+	if (prereleaseMatch) return Number(prereleaseMatch[1]) >= 4;
+	return false;
 }
 //#endregion
 //#region src/routes/auth/config.ts
@@ -3150,16 +3826,16 @@ const getConfig = (options) => {
 	}, async (ctx) => {
 		const advancedOptions = ctx.context.options.advanced;
 		const organizationPlugin = ctx.context.getPlugin("organization");
-		return {
+		return redactDashSettings({
 			version: ctx.context.version || null,
 			socialProviders: Object.keys(ctx.context.options.socialProviders || {}),
-			emailAndPassword: redact(ctx.context.options.emailAndPassword, { skipNonPlainSerializable: true }),
+			emailAndPassword: ctx.context.options.emailAndPassword,
 			plugins: ctx.context.options.plugins?.map((plugin) => {
 				const base = {
 					id: plugin.id,
 					schema: plugin.schema,
 					version: plugin.version,
-					options: redactPluginOptions(plugin.id, plugin.options, { skipNonPlainSerializable: true })
+					options: plugin.options
 				};
 				if (plugin.id === "dash" && !plugin.version) return {
 					...base,
@@ -3262,76 +3938,970 @@ const getConfig = (options) => {
 					secure: typeof ctx.context.options.advanced?.defaultCookieAttributes?.secure !== "undefined" ? ctx.context.options.advanced?.defaultCookieAttributes?.secure : null
 				} : null,
 				appName: ctx.context.options.appName || null,
-				hasJoinsEnabled: ctx.context.options.experimental?.joins === true,
+				hasJoinsEnabled: (() => {
+					const advancedJoins = (ctx.context.options.advanced?.database)?.joins === true;
+					if (isBetterAuth17OrLater(ctx.context.version)) return advancedJoins;
+					return advancedJoins || ctx.context.options.experimental?.joins === true;
+				})(),
 				hasErrorURLConfigured: !!ctx.context.options.onAPIError?.errorURL
 			}
+		}, { skipNonPlainSerializable: true });
+	});
+};
+//#endregion
+//#region src/routes/auth/validate.ts
+/**
+* Lightweight endpoint to verify API key ownership during onboarding
+*/
+const getValidate = (options) => {
+	return createAuthEndpoint("/dash/validate", {
+		method: "GET",
+		use: [jwtValidateMiddleware(options)]
+	}, async () => {
+		return { valid: true };
+	});
+};
+//#endregion
+//#region src/routes/organization-guards.ts
+/** Returns true if organization plugin is enabled. */
+function isOrganizationEnabled(ctx) {
+	return !!ctx.context.getPlugin("organization");
+}
+/** Returns the organization plugin, throws if not enabled. Use for write endpoints. */
+function requireOrganizationPlugin(ctx) {
+	const plugin = ctx.context.getPlugin("organization");
+	if (!plugin) throw ctx.error("BAD_REQUEST", { message: "Organization plugin not enabled" });
+	return plugin;
+}
+/** Returns true if organization plugin and teams feature are enabled. */
+function isTeamsEnabled(ctx) {
+	return !!ctx.context.getPlugin("organization")?.options?.teams?.enabled;
+}
+/**
+* Validates that the organization plugin is enabled and teams feature is enabled.
+*
+* @returns The organization options for use in team logic (maximumTeams, hooks, etc.)
+*/
+function requireTeamsEnabled(ctx) {
+	const orgOptions = requireOrganizationPlugin(ctx).options || {};
+	if (!orgOptions?.teams?.enabled) throw ctx.error("BAD_REQUEST", { message: "Teams are not enabled" });
+	return orgOptions;
+}
+//#endregion
+//#region src/routes/directory-sync/managed-catalog.ts
+function getRequestHeaders(ctx) {
+	return ctx.request?.headers ?? new Headers();
+}
+function getManagedEndpoints(ctx) {
+	const plugin = ctx.context.getPlugin("scim");
+	if (!plugin?.endpoints) throw ctx.error("BAD_REQUEST", { message: "SCIM managed connections are unavailable. Install a Better Auth release that includes the managed SCIM catalog and configure managedConnections." });
+	return plugin.endpoints;
+}
+function requireManagedEndpoint(ctx, endpoint, name) {
+	if (!endpoint) throw ctx.error("BAD_REQUEST", { message: `SCIM managed connection operation "${name}" is unavailable. Publish and install the required Better Auth SCIM release.` });
+	return endpoint;
+}
+function assertManagedConnectionLifecycleConfigured(ctx) {
+	const endpoints = getManagedEndpoints(ctx);
+	requireManagedEndpoint(ctx, endpoints.createSCIMManagedConnection, "create");
+	requireManagedEndpoint(ctx, endpoints.listSCIMManagedConnections, "list");
+	requireManagedEndpoint(ctx, endpoints.getSCIMManagedConnection, "get");
+	requireManagedEndpoint(ctx, endpoints.rotateSCIMManagedCredential, "rotate");
+	requireManagedEndpoint(ctx, endpoints.revokeSCIMManagedCredential, "revoke");
+	requireManagedEndpoint(ctx, endpoints.decommissionSCIMManagedConnection, "decommission");
+	return endpoints;
+}
+async function getManagedState(ctx, connection) {
+	if (!connection.connectionId) return;
+	return await requireManagedEndpoint(ctx, getManagedEndpoints(ctx).getSCIMManagedConnection, "get")({
+		body: {
+			connectionId: connection.connectionId,
+			provisioningDomainId: connection.provisioningDomainId
+		},
+		context: ctx.context,
+		headers: getRequestHeaders(ctx)
+	});
+}
+//#endregion
+//#region src/routes/directory-sync/mode.ts
+function getSCIMPlugin(ctx) {
+	return ctx.context.getPlugin("scim");
+}
+function getDashPluginOptions(ctx) {
+	return ctx.context.getPlugin("dash")?.options;
+}
+/** True when dash was configured with `managedDirectorySync: { enabled: true }`. */
+function isManagedDirectorySyncEnabled(ctx) {
+	return getDashPluginOptions(ctx)?.managedDirectorySync?.enabled === true;
+}
+function usesLegacyScimDirectorySync(scimPlugin) {
+	return typeof scimPlugin?.endpoints.generateSCIMToken === "function";
+}
+/** True when the SCIM plugin exposes the 1.7+ managed connection endpoints. */
+function hasManagedScimSurface(scimPlugin) {
+	return typeof scimPlugin?.endpoints.createSCIMManagedConnection === "function" && typeof scimPlugin?.endpoints.listSCIMManagedConnections === "function";
+}
+function usesManagedScimDirectorySync(scimPlugin) {
+	return hasManagedScimSurface(scimPlugin) && scimPlugin?.options?.managedConnections != null;
+}
+/**
+* Resolve which directory-sync experience the dashboard should use.
+* Managed mode also requires dash `managedDirectorySync.enabled`.
+* Legacy SCIM mode ignores that option.
+*/
+function resolveDirectorySyncMode(scimPlugin, managedDirectorySyncEnabled = false) {
+	if (!scimPlugin) return "unavailable";
+	if (hasManagedScimSurface(scimPlugin)) return usesManagedScimDirectorySync(scimPlugin) && managedDirectorySyncEnabled ? "managed" : "unavailable";
+	if (usesLegacyScimDirectorySync(scimPlugin)) {
+		const ownership = scimPlugin.options?.providerOwnership;
+		if (ownership != null && ownership.enabled !== true) return "unavailable";
+		return "legacy";
+	}
+	return "unavailable";
+}
+function assertManagedDirectorySyncEnabled(ctx) {
+	if (isManagedDirectorySyncEnabled(ctx)) return;
+	throw ctx.error("BAD_REQUEST", { message: "Managed directory sync is disabled. Enable dash({ managedDirectorySync: { enabled: true } }) and migrate the directory sync schema. Legacy SCIM directory sync does not use this option." });
+}
+//#endregion
+//#region src/routes/directory-sync/route-contract.ts
+const DIRECTORY_SYNC_CREDENTIAL_LIFETIME_MS = 31536e6;
+const directorySyncClaimsSchema = z.object({
+	purpose: z.literal(DIRECTORY_SYNC_PURPOSE),
+	organizationId: z.string().trim().min(1),
+	actorId: z.string().trim().min(1),
+	setupOperationId: z.string().trim().min(16).max(255).optional()
+});
+function getScimEndpoint$1(baseUrl) {
+	return `${baseUrl}/scim/v2`;
+}
+function assertDirectorySyncClaims(ctx, organizationId) {
+	const claims = ctx.context.payload;
+	if (claims.purpose !== "directory-sync-management" || claims.organizationId !== organizationId || !claims.actorId) throw ctx.error("UNAUTHORIZED", { message: "Invalid directory sync management authorization" });
+	return claims;
+}
+function assertDirectorySyncManagementClaims(ctx, organizationId) {
+	const claims = assertDirectorySyncClaims(ctx, organizationId);
+	if (claims.setupOperationId) throw ctx.error("FORBIDDEN", { message: "Directory sync setup authorization cannot perform management operations" });
+	const { setupOperationId: _, ...managementClaims } = claims;
+	return managementClaims;
+}
+async function assertTargetOrganizationExists(ctx, organizationId) {
+	if (!await ctx.context.adapter.findOne({
+		model: "organization",
+		where: [{
+			field: "id",
+			value: organizationId
+		}],
+		select: ["id"]
+	})) throw ctx.error("NOT_FOUND", { message: "Target organization not found" });
+}
+function resolveCredentialPolicy(input) {
+	const expiresAt = input.expiresAt ?? new Date(Date.now() + DIRECTORY_SYNC_CREDENTIAL_LIFETIME_MS);
+	if (expiresAt.getTime() <= Date.now()) throw new APIError$1("BAD_REQUEST", { message: "Directory sync credential expiry must be in the future" });
+	const scopes = input.scopes ?? ALL_SCIM_SCOPES;
+	if (new Set(scopes).size !== scopes.length) throw new APIError$1("BAD_REQUEST", { message: "Directory sync credential scopes must be unique" });
+	return {
+		scopes,
+		expiresAt
+	};
+}
+function serializeDate(value) {
+	return value instanceof Date ? value.toISOString() : value;
+}
+function serializeNullableDate(value) {
+	return value == null ? null : serializeDate(value);
+}
+function serializeCredential(credential) {
+	return {
+		credentialId: credential.credentialId,
+		status: credential.status,
+		scopes: credential.scopes,
+		expiresAt: serializeDate(credential.expiresAt),
+		createdAt: serializeDate(credential.createdAt),
+		createdBy: credential.createdBy,
+		lastUsedAt: serializeNullableDate(credential.lastUsedAt),
+		revokedAt: serializeNullableDate(credential.revokedAt),
+		revokedBy: credential.revokedBy
+	};
+}
+function serializeDirectory(row, scimEndpoint, state) {
+	return {
+		connectionId: row.connectionId ?? null,
+		organizationId: row.organizationId,
+		providerId: row.providerId,
+		provisioningDomainId: row.provisioningDomainId,
+		status: row.status,
+		scimEndpoint,
+		credentials: state?.credentials.map(serializeCredential) ?? [],
+		createdAt: serializeDate(row.createdAt),
+		updatedAt: serializeDate(row.updatedAt),
+		pairing: serializePairingRow(row),
+		pairingEnforced: row.pairingEnforced === true,
+		unpairedAt: serializeNullableDate(row.unpairedAt ?? null),
+		unpairedBy: row.unpairedBy ?? null,
+		decommissionedAt: serializeNullableDate(row.decommissionedAt ?? null)
+	};
+}
+//#endregion
+//#region src/routes/directory-sync/transaction.ts
+/**
+* `better-auth` and `@better-auth/core` can resolve to distinct physical
+* copies of the same version. Endpoint adapters are typed from the former;
+* `runWithTransaction` / `getCurrentAdapter` are typed from the latter.
+*/
+function runWithTransaction$1(adapter, fn) {
+	return runWithTransaction(adapter, fn);
+}
+function getCurrentAdapter$1(adapter) {
+	return getCurrentAdapter(adapter);
+}
+//#endregion
+//#region src/routes/directory-sync/reservation.ts
+function withTransactionAdapter(ctx, adapter) {
+	return {
+		...ctx,
+		context: {
+			...ctx.context,
+			adapter
+		}
+	};
+}
+async function createAliasKey(organizationId, providerId) {
+	return `directory-sync-alias:${await hash$1(JSON.stringify([organizationId, providerId]))}`;
+}
+async function createProvisioningDomainId(organizationId, providerId) {
+	return `dash_scim_domain_${await hash$1(JSON.stringify({
+		purpose: DIRECTORY_SYNC_PURPOSE,
+		organizationId,
+		providerId
+	}))}`;
+}
+async function createActiveOrganizationKey(organizationId) {
+	return `directory-sync-active:${await hash$1(organizationId)}`;
+}
+function createInactiveOrganizationKey(aliasKey) {
+	return `directory-sync-inactive:${aliasKey}`;
+}
+function createCreationRequestId() {
+	return generateRandomString(32, "a-z", "A-Z", "0-9", "-_");
+}
+function isUniqueConstraintError(error) {
+	return error instanceof Error && /unique|duplicate|constraint|P2002/i.test(error.message);
+}
+async function assertManagedDirectoryTransactionsConfigured(ctx) {
+	if (typeof ctx.context.adapter.options?.adapterConfig.transaction !== "function") throw ctx.error("NOT_IMPLEMENTED", {
+		code: "DIRECTORY_SYNC_REQUIRES_NATIVE_TRANSACTIONS",
+		message: "Managed directory sync requires a database adapter with native transaction support"
+	});
+	try {
+		await getCurrentDBAdapterAsyncLocalStorage();
+	} catch {
+		throw ctx.error("NOT_IMPLEMENTED", {
+			code: "DIRECTORY_SYNC_REQUIRES_ASYNC_CONTEXT",
+			message: "Managed directory sync requires database transaction async context support"
+		});
+	}
+}
+async function assertDirectorySyncSSOIntegrationConfigured(ctx) {
+	const ssoPlugin = ctx.context.getPlugin("sso");
+	if (typeof ssoPlugin?.options?.resolveUser !== "function" || typeof ssoPlugin.options.guardProviderMutation !== "function") throw ctx.error("BAD_REQUEST", { message: "Paired directory sync requires SSO resolveUser and guardProviderMutation callbacks. Enable dash({ managedDirectorySync: { enabled: true, ssoPairing: true } }) and pass sso({}) (or richer SSO options) so dash can install them." });
+	await assertManagedDirectoryTransactionsConfigured(ctx);
+}
+async function findDirectorySyncConnection(ctx, organizationId, providerId) {
+	return await (await getCurrentAdapter$1(ctx.context.adapter)).findOne({
+		model: "directorySyncConnection",
+		where: [{
+			field: "organizationId",
+			value: organizationId
+		}, {
+			field: "providerId",
+			value: providerId
+		}]
+	});
+}
+async function getDirectorySyncConnection(ctx, organizationId, providerId) {
+	const row = await findDirectorySyncConnection(ctx, organizationId, providerId);
+	if (!row) throw ctx.error("NOT_FOUND", { message: "Directory sync connection not found" });
+	return row;
+}
+function isExactManagedConnection(issued, input) {
+	return issued.connection.creationRequestId === input.creationRequestId && issued.connection.provisioningDomainId === input.provisioningDomainId;
+}
+async function lockExactPairedSSOProvider(adapter, row) {
+	if (!row.pairingEnforced) return;
+	if (!row.ssoProviderRecordId || !row.ssoProviderId) throw new Error("Enforced directory sync pairing is incomplete");
+	if (!await adapter.update({
+		model: "ssoProvider",
+		where: [
+			{
+				field: "id",
+				value: row.ssoProviderRecordId
+			},
+			{
+				field: "providerId",
+				value: row.ssoProviderId
+			},
+			{
+				field: "organizationId",
+				value: row.organizationId
+			}
+		],
+		update: { providerId: row.ssoProviderId }
+	})) throw new Error("Paired SSO provider changed during directory sync");
+}
+async function recoverManagedDirectoryConnection(ctx, row, input, policy) {
+	if (row.organizationId !== input.organizationId || row.providerId !== input.providerId || row.creationRequestId !== input.creationRequestId || row.status !== "active" || !row.connectionId) throw ctx.error("CONFLICT", { message: "This directory sync alias belongs to a different setup operation" });
+	const connectionId = row.connectionId;
+	const serializedPairing = input.pairing ? JSON.stringify(input.pairing) : null;
+	if ((row.serializedSsoPairing ?? null) !== serializedPairing) throw ctx.error("CONFLICT", { message: "Directory sync setup recovery must use the original SSO pairing" });
+	const endpoints = getManagedEndpoints(ctx);
+	const getManagedConnection = requireManagedEndpoint(ctx, endpoints.getSCIMManagedConnection, "get");
+	const revokeManagedCredential = requireManagedEndpoint(ctx, endpoints.revokeSCIMManagedCredential, "revoke");
+	const rotateManagedCredential = requireManagedEndpoint(ctx, endpoints.rotateSCIMManagedCredential, "rotate");
+	return await runWithTransaction$1(ctx.context.adapter, async () => {
+		const database = await getCurrentAdapter$1(ctx.context.adapter);
+		await lockExactPairedSSOProvider(database, row);
+		const locked = await database.update({
+			model: "directorySyncConnection",
+			where: [
+				{
+					field: "id",
+					value: row.id
+				},
+				{
+					field: "status",
+					value: "active"
+				},
+				{
+					field: "revision",
+					value: row.revision
+				},
+				{
+					field: "connectionId",
+					value: connectionId
+				},
+				{
+					field: "creationRequestId",
+					value: input.creationRequestId
+				}
+			],
+			update: {
+				revision: row.revision + 1,
+				updatedAt: /* @__PURE__ */ new Date(),
+				lastActorId: input.actorId,
+				lastError: null
+			}
+		});
+		if (!locked) throw ctx.error("CONFLICT", { message: "Directory sync connection changed before setup recovery started" });
+		const state = await getManagedConnection({
+			body: {
+				connectionId,
+				provisioningDomainId: row.provisioningDomainId
+			},
+			context: ctx.context,
+			headers: getRequestHeaders(ctx)
+		});
+		if (state.connection.connectionId !== connectionId || state.connection.creationRequestId !== input.creationRequestId || state.connection.provisioningDomainId !== row.provisioningDomainId || state.connection.status !== "active") throw ctx.error("CONFLICT", { message: "Managed connection ownership changed before setup recovery" });
+		for (const credential of state.credentials) {
+			if (credential.status !== "active") continue;
+			await revokeManagedCredential({
+				body: {
+					connectionId,
+					provisioningDomainId: row.provisioningDomainId,
+					credentialId: credential.credentialId,
+					actorId: input.actorId
+				},
+				context: ctx.context,
+				headers: getRequestHeaders(ctx)
+			});
+		}
+		const issued = await rotateManagedCredential({
+			body: {
+				connectionId,
+				provisioningDomainId: row.provisioningDomainId,
+				actorId: input.actorId,
+				...policy
+			},
+			context: ctx.context,
+			headers: getRequestHeaders(ctx)
+		});
+		if (issued.connection.connectionId !== connectionId || issued.connection.creationRequestId !== input.creationRequestId || issued.connection.provisioningDomainId !== row.provisioningDomainId) throw ctx.error("CONFLICT", { message: "Managed connection recovery returned mismatched ownership correlation" });
+		return {
+			row: locked,
+			issued
+		};
+	});
+}
+async function createManagedDirectoryConnection(ctx, input, policy) {
+	await assertManagedDirectoryTransactionsConfigured(ctx);
+	if (input.pairing) await assertDirectorySyncSSOIntegrationConfigured(ctx);
+	if (input.pairing?.protocol === "saml") try {
+		await loadSAMLPolicy();
+	} catch {
+		throw ctx.error("NOT_IMPLEMENTED", {
+			code: "DIRECTORY_SYNC_SAML_POLICY_UNAVAILABLE",
+			message: "SAML pairing requires a compatible SSO package with service provider metadata policy support"
+		});
+	}
+	const aliasKey = await createAliasKey(input.organizationId, input.providerId);
+	const provisioningDomainId = await createProvisioningDomainId(input.organizationId, input.providerId);
+	const activeOrganizationKey = await createActiveOrganizationKey(input.organizationId);
+	const creationRequestId = input.creationRequestId ?? createCreationRequestId();
+	const createManagedConnection = requireManagedEndpoint(ctx, getManagedEndpoints(ctx).createSCIMManagedConnection, "create");
+	try {
+		return await runWithTransaction$1(ctx.context.adapter, async () => {
+			const database = await getCurrentAdapter$1(ctx.context.adapter);
+			const transactionContext = withTransactionAdapter(ctx, database);
+			const pairing = input.pairing ? await resolveDirectorySyncSSOPairing(transactionContext, input.organizationId, input.pairing) : null;
+			const now = /* @__PURE__ */ new Date();
+			const row = await database.create({
+				model: "directorySyncConnection",
+				data: {
+					organizationId: input.organizationId,
+					providerId: input.providerId,
+					aliasKey,
+					provisioningDomainId,
+					activeOrganizationKey,
+					creationRequestId,
+					status: "active",
+					revision: 0,
+					createdAt: now,
+					createdByActorId: input.actorId,
+					updatedAt: now,
+					lastActorId: input.actorId,
+					activeSsoProviderKey: pairing?.activeSsoProviderKey ?? createInactiveSSOProviderKey(aliasKey),
+					pairingEnforced: pairing != null,
+					...pairing ? {
+						ssoProviderId: pairing.ssoProviderId,
+						ssoProviderRecordId: pairing.ssoProviderRecordId,
+						serializedSsoPairing: JSON.stringify(pairing.pairing)
+					} : {}
+				}
+			});
+			const issued = await createManagedConnection({
+				body: {
+					creationRequestId,
+					provisioningDomainId,
+					actorId: input.actorId,
+					...policy
+				},
+				context: ctx.context,
+				headers: getRequestHeaders(ctx)
+			});
+			if (!isExactManagedConnection(issued, {
+				creationRequestId,
+				provisioningDomainId
+			})) throw ctx.error("CONFLICT", { message: "Managed connection creation returned mismatched ownership correlation" });
+			await lockExactPairedSSOProvider(database, row);
+			const bound = await database.update({
+				model: "directorySyncConnection",
+				where: [
+					{
+						field: "id",
+						value: row.id
+					},
+					{
+						field: "status",
+						value: "active"
+					},
+					{
+						field: "revision",
+						value: 0
+					},
+					{
+						field: "connectionId",
+						value: null
+					}
+				],
+				update: {
+					connectionId: issued.connection.connectionId,
+					revision: 1,
+					updatedAt: /* @__PURE__ */ new Date()
+				}
+			});
+			if (!bound) throw ctx.error("CONFLICT", { message: "Directory sync connection changed before catalog binding completed" });
+			await supersedeTerminalDirectorySyncPairings(transactionContext, bound);
+			return {
+				row: bound,
+				issued
+			};
+		});
+	} catch (error) {
+		if (isUniqueConstraintError(error)) {
+			const aliasConflict = await ctx.context.adapter.findOne({
+				model: "directorySyncConnection",
+				where: [{
+					field: "aliasKey",
+					value: aliasKey
+				}]
+			});
+			if (aliasConflict) {
+				if (input.creationRequestId && aliasConflict.creationRequestId === input.creationRequestId && aliasConflict.organizationId === input.organizationId && aliasConflict.providerId === input.providerId && aliasConflict.provisioningDomainId === provisioningDomainId) return await recoverManagedDirectoryConnection(ctx, aliasConflict, {
+					...input,
+					creationRequestId: input.creationRequestId
+				}, policy);
+				throw ctx.error("CONFLICT", { message: "This organization already has a directory sync connection for the requested provider" });
+			}
+			if (await ctx.context.adapter.findOne({
+				model: "directorySyncConnection",
+				where: [{
+					field: "activeOrganizationKey",
+					value: activeOrganizationKey
+				}]
+			})) throw ctx.error("CONFLICT", { message: "This organization already has an active directory sync connection" });
+			throw error;
+		}
+		throw error;
+	}
+}
+function createTerminalOrganizationKey(aliasKey) {
+	return createInactiveOrganizationKey(aliasKey);
+}
+function createTerminalPairingKey(aliasKey) {
+	return createTerminalSSOProviderKey(aliasKey);
+}
+async function supersedeTerminalDirectorySyncPairings(ctx, activeRow) {
+	if (!activeRow.ssoProviderRecordId || !activeRow.pairingEnforced) return;
+	const terminalRows = await ctx.context.adapter.findMany({
+		model: "directorySyncConnection",
+		where: [{
+			field: "ssoProviderRecordId",
+			value: activeRow.ssoProviderRecordId
+		}, {
+			field: "pairingEnforced",
+			value: true
+		}]
+	});
+	const now = /* @__PURE__ */ new Date();
+	for (const row of terminalRows) {
+		if (row.id === activeRow.id || row.status !== "decommissioned") continue;
+		if (!await ctx.context.adapter.update({
+			model: "directorySyncConnection",
+			where: [
+				{
+					field: "id",
+					value: row.id
+				},
+				{
+					field: "status",
+					value: "decommissioned"
+				},
+				{
+					field: "revision",
+					value: row.revision
+				},
+				{
+					field: "pairingEnforced",
+					value: true
+				}
+			],
+			update: {
+				pairingEnforced: false,
+				revision: row.revision + 1,
+				unpairedAt: now,
+				unpairedBy: activeRow.lastActorId,
+				updatedAt: now,
+				lastActorId: activeRow.lastActorId
+			}
+		})) throw ctx.error("CONFLICT", { message: "Directory sync SSO pairing changed before replacement activation" });
+	}
+}
+async function startDirectorySyncDecommission(ctx, row, actorId) {
+	if (row.status !== "active") return row;
+	await assertManagedDirectoryTransactionsConfigured(ctx);
+	return await runWithTransaction$1(ctx.context.adapter, async () => {
+		const database = await getCurrentAdapter$1(ctx.context.adapter);
+		await lockExactPairedSSOProvider(database, row);
+		const updated = await database.update({
+			model: "directorySyncConnection",
+			where: [
+				{
+					field: "id",
+					value: row.id
+				},
+				{
+					field: "status",
+					value: "active"
+				},
+				{
+					field: "revision",
+					value: row.revision
+				}
+			],
+			update: {
+				status: "decommissioning",
+				revision: row.revision + 1,
+				decommissionStartedAt: /* @__PURE__ */ new Date(),
+				updatedAt: /* @__PURE__ */ new Date(),
+				lastActorId: actorId
+			}
+		});
+		if (!updated) throw ctx.error("CONFLICT", { message: "Directory sync connection changed while decommissioning started" });
+		return updated;
+	});
+}
+async function unpairTerminalDirectorySyncConnection(ctx, row, actorId) {
+	if (row.status !== "decommissioned") throw ctx.error("CONFLICT", { message: "Directory sync can only be unpaired after it has decommissioned" });
+	if (!row.pairingEnforced) return row;
+	await assertManagedDirectoryTransactionsConfigured(ctx);
+	return await runWithTransaction$1(ctx.context.adapter, async () => {
+		const database = await getCurrentAdapter$1(ctx.context.adapter);
+		await lockExactPairedSSOProvider(database, row);
+		const now = /* @__PURE__ */ new Date();
+		const updated = await database.update({
+			model: "directorySyncConnection",
+			where: [
+				{
+					field: "id",
+					value: row.id
+				},
+				{
+					field: "status",
+					value: "decommissioned"
+				},
+				{
+					field: "revision",
+					value: row.revision
+				},
+				{
+					field: "pairingEnforced",
+					value: true
+				}
+			],
+			update: {
+				activeSsoProviderKey: createTerminalSSOProviderKey(row.aliasKey),
+				pairingEnforced: false,
+				revision: row.revision + 1,
+				unpairedAt: now,
+				unpairedBy: actorId,
+				updatedAt: now,
+				lastActorId: actorId
+			}
+		});
+		if (!updated) throw ctx.error("CONFLICT", { message: "Directory sync SSO pairing changed before it was unpaired" });
+		return updated;
+	});
+}
+//#endregion
+//#region src/routes/directory-sync/managed-directories.ts
+/** Shared list handler for mode-dispatch on GET /:id/directories. */
+async function listOrganizationDirectoriesManagedHandler(ctx) {
+	requireOrganizationPlugin(ctx);
+	assertManagedDirectorySyncEnabled(ctx);
+	const organizationId = tryDecode(ctx.params?.id ?? "");
+	assertDirectorySyncManagementClaims(ctx, organizationId);
+	await assertTargetOrganizationExists(ctx, organizationId);
+	const rows = await ctx.context.adapter.findMany({
+		model: "directorySyncConnection",
+		where: [{
+			field: "organizationId",
+			value: organizationId
+		}],
+		sortBy: {
+			field: "createdAt",
+			direction: "desc"
+		}
+	});
+	return await Promise.all(rows.map(async (row) => serializeDirectory(row, getScimEndpoint$1(ctx.context.baseURL), await getManagedState(ctx, row))));
+}
+const getOrganizationDirectory = (options) => createAuthEndpoint("/dash/organization/:id/directories/:providerId", {
+	method: "GET",
+	use: [jwtMiddleware(options, directorySyncClaimsSchema)]
+}, async (ctx) => {
+	requireOrganizationPlugin(ctx);
+	assertManagedDirectorySyncEnabled(ctx);
+	const organizationId = tryDecode(ctx.params.id);
+	assertDirectorySyncManagementClaims(ctx, organizationId);
+	await assertTargetOrganizationExists(ctx, organizationId);
+	const row = await getDirectorySyncConnection(ctx, organizationId, tryDecode(ctx.params.providerId));
+	return serializeDirectory(row, getScimEndpoint$1(ctx.context.baseURL), await getManagedState(ctx, row));
+});
+const createOrganizationDirectory = (options) => createAuthEndpoint("/dash/organization/:id/directories", {
+	method: "POST",
+	use: [jwtMiddleware(options, directorySyncClaimsSchema)],
+	body: createDirectoryBodySchema,
+	metadata: { noStore: true }
+}, async (ctx) => {
+	requireOrganizationPlugin(ctx);
+	assertManagedDirectorySyncEnabled(ctx);
+	const organizationId = tryDecode(ctx.params.id);
+	const claims = assertDirectorySyncClaims(ctx, organizationId);
+	await assertTargetOrganizationExists(ctx, organizationId);
+	const policy = resolveCredentialPolicy(ctx.body);
+	assertManagedConnectionLifecycleConfigured(ctx);
+	const { row, issued } = await createManagedDirectoryConnection(ctx, {
+		organizationId,
+		providerId: ctx.body.providerId,
+		actorId: claims.actorId,
+		...claims.setupOperationId ? { creationRequestId: claims.setupOperationId } : {},
+		...ctx.body.pairing ? { pairing: ctx.body.pairing } : {}
+	}, policy);
+	setCredentialResponseSecurityHeaders(ctx);
+	return {
+		...serializeDirectory(row, getScimEndpoint$1(ctx.context.baseURL), {
+			connection: issued.connection,
+			credentials: [issued.credential]
+		}),
+		connectionId: issued.connection.connectionId,
+		credential: serializeCredential(issued.credential),
+		scimToken: issued.token
+	};
+});
+const rotateDirectoryCredential = (options) => createAuthEndpoint("/dash/organization/:id/directories/:providerId/credentials/rotate", {
+	method: "POST",
+	use: [jwtMiddleware(options, directorySyncClaimsSchema)],
+	body: rotateCredentialBodySchema,
+	metadata: { noStore: true }
+}, async (ctx) => {
+	requireOrganizationPlugin(ctx);
+	assertManagedDirectorySyncEnabled(ctx);
+	const organizationId = tryDecode(ctx.params.id);
+	const claims = assertDirectorySyncManagementClaims(ctx, organizationId);
+	await assertTargetOrganizationExists(ctx, organizationId);
+	const policy = resolveCredentialPolicy(ctx.body);
+	await assertManagedDirectoryTransactionsConfigured(ctx);
+	const providerId = tryDecode(ctx.params.providerId);
+	const endpoint = requireManagedEndpoint(ctx, getManagedEndpoints(ctx).rotateSCIMManagedCredential, "rotate");
+	const { connectionId, issued } = await runWithTransaction$1(ctx.context.adapter, async () => {
+		const database = await getCurrentAdapter$1(ctx.context.adapter);
+		const row = await getDirectorySyncConnection(ctx, organizationId, providerId);
+		if (row.status !== "active" || !row.connectionId) throw ctx.error("CONFLICT", { message: "Directory sync connection is not active" });
+		if (!await database.update({
+			model: "directorySyncConnection",
+			where: [
+				{
+					field: "id",
+					value: row.id
+				},
+				{
+					field: "status",
+					value: "active"
+				},
+				{
+					field: "revision",
+					value: row.revision
+				},
+				{
+					field: "connectionId",
+					value: row.connectionId
+				}
+			],
+			update: {
+				revision: row.revision + 1,
+				updatedAt: /* @__PURE__ */ new Date(),
+				lastActorId: claims.actorId,
+				lastError: null
+			}
+		})) throw ctx.error("CONFLICT", { message: "Directory sync connection changed before credential rotation started" });
+		const issued = await endpoint({
+			body: {
+				connectionId: row.connectionId,
+				provisioningDomainId: row.provisioningDomainId,
+				actorId: claims.actorId,
+				...policy
+			},
+			context: ctx.context,
+			headers: getRequestHeaders(ctx)
+		});
+		return {
+			connectionId: row.connectionId,
+			issued
 		};
 	});
-};
-//#endregion
-//#region src/routes/auth/validate.ts
-/**
-* Lightweight endpoint to verify API key ownership during onboarding
-*/
-const getValidate = (options) => {
-	return createAuthEndpoint("/dash/validate", {
-		method: "GET",
-		use: [jwtValidateMiddleware(options)]
-	}, async () => {
-		return { valid: true };
+	setCredentialResponseSecurityHeaders(ctx);
+	return {
+		connectionId,
+		credential: serializeCredential(issued.credential),
+		scimToken: issued.token,
+		scimEndpoint: getScimEndpoint$1(ctx.context.baseURL)
+	};
+});
+const revokeDirectoryCredential = (options) => createAuthEndpoint("/dash/organization/:id/directories/:providerId/credentials/:credentialId/revoke", {
+	method: "POST",
+	use: [jwtMiddleware(options, directorySyncClaimsSchema)],
+	body: emptyBodySchema
+}, async (ctx) => {
+	requireOrganizationPlugin(ctx);
+	assertManagedDirectorySyncEnabled(ctx);
+	const organizationId = tryDecode(ctx.params.id);
+	const claims = assertDirectorySyncManagementClaims(ctx, organizationId);
+	await assertTargetOrganizationExists(ctx, organizationId);
+	await assertManagedDirectoryTransactionsConfigured(ctx);
+	const providerId = tryDecode(ctx.params.providerId);
+	const credentialId = tryDecode(ctx.params.credentialId);
+	const endpoint = requireManagedEndpoint(ctx, getManagedEndpoints(ctx).revokeSCIMManagedCredential, "revoke");
+	const { state, updated } = await runWithTransaction$1(ctx.context.adapter, async () => {
+		const database = await getCurrentAdapter$1(ctx.context.adapter);
+		const row = await getDirectorySyncConnection(ctx, organizationId, providerId);
+		if (row.status !== "active" || !row.connectionId) throw ctx.error("CONFLICT", { message: "Directory sync connection is not active" });
+		const updated = await database.update({
+			model: "directorySyncConnection",
+			where: [
+				{
+					field: "id",
+					value: row.id
+				},
+				{
+					field: "status",
+					value: "active"
+				},
+				{
+					field: "revision",
+					value: row.revision
+				},
+				{
+					field: "connectionId",
+					value: row.connectionId
+				}
+			],
+			update: {
+				revision: row.revision + 1,
+				updatedAt: /* @__PURE__ */ new Date(),
+				lastActorId: claims.actorId,
+				lastError: null
+			}
+		});
+		if (!updated) throw ctx.error("CONFLICT", { message: "Directory sync connection changed before credential revocation started" });
+		return {
+			state: await endpoint({
+				body: {
+					connectionId: row.connectionId,
+					provisioningDomainId: row.provisioningDomainId,
+					credentialId,
+					actorId: claims.actorId
+				},
+				context: ctx.context,
+				headers: getRequestHeaders(ctx)
+			}),
+			updated
+		};
 	});
-};
-//#endregion
-//#region src/semver.ts
-function parseVersion(version) {
-	if (!version) return null;
-	const match = version.trim().match(/^(\d+)\.(\d+)\.(\d+)/);
-	if (!match) return null;
-	return [
-		Number(match[1]),
-		Number(match[2]),
-		Number(match[3])
-	];
-}
-/** Compare semver strings (e.g. "1.7.0-beta.8" against "1.7" or "1.7.0"). */
-function isVersionAtLeast(version, target) {
-	const parsed = parseVersion(version);
-	if (!parsed) return false;
-	const targetParts = target.split(".").map(Number);
-	const major = targetParts[0] ?? 0;
-	const minor = targetParts[1] ?? 0;
-	const patch = targetParts[2] ?? 0;
-	const [vMajor, vMinor, vPatch] = parsed;
-	if (vMajor !== major) return vMajor > major;
-	if (vMinor !== minor) return vMinor > minor;
-	return vPatch >= patch;
-}
-//#endregion
-//#region src/routes/organization-guards.ts
-/** Returns true if organization plugin is enabled. */
-function isOrganizationEnabled(ctx) {
-	return !!ctx.context.getPlugin("organization");
-}
-/** Returns the organization plugin, throws if not enabled. Use for write endpoints. */
-function requireOrganizationPlugin(ctx) {
-	const plugin = ctx.context.getPlugin("organization");
-	if (!plugin) throw ctx.error("BAD_REQUEST", { message: "Organization plugin not enabled" });
-	return plugin;
-}
-/** Returns true if organization plugin and teams feature are enabled. */
-function isTeamsEnabled(ctx) {
-	return !!ctx.context.getPlugin("organization")?.options?.teams?.enabled;
-}
-/**
-* Validates that the organization plugin is enabled and teams feature is enabled.
-*
-* @returns The organization options for use in team logic (maximumTeams, hooks, etc.)
-*/
-function requireTeamsEnabled(ctx) {
-	const orgOptions = requireOrganizationPlugin(ctx).options || {};
-	if (!orgOptions?.teams?.enabled) throw ctx.error("BAD_REQUEST", { message: "Teams are not enabled" });
-	return orgOptions;
+	return serializeDirectory(updated, getScimEndpoint$1(ctx.context.baseURL), state);
+});
+const DIRECTORY_EVENTS_DEFAULT_LIMIT = 10;
+const DIRECTORY_PAGE_MAX_LIMIT = 100;
+const DIRECTORY_EVENTS_DEFAULT_SORT_DIRECTION = "desc";
+const directoryEventsQuerySchema = z.object({
+	limit: z.number().or(z.string().transform(Number)).optional(),
+	offset: z.number().or(z.string().transform(Number)).optional(),
+	sortDirection: z.enum(["asc", "desc"]).optional()
+}).optional();
+function resolveDirectoryEventsPage(query) {
+	const requestedLimit = query?.limit;
+	const limit = Number.isFinite(requestedLimit) ? Math.min(Math.max(1, Math.floor(requestedLimit)), DIRECTORY_PAGE_MAX_LIMIT) : DIRECTORY_EVENTS_DEFAULT_LIMIT;
+	const requestedOffset = query?.offset;
+	return {
+		limit,
+		offset: Number.isFinite(requestedOffset) ? Math.max(0, Math.floor(requestedOffset)) : 0,
+		sortDirection: query?.sortDirection ?? DIRECTORY_EVENTS_DEFAULT_SORT_DIRECTION
+	};
 }
+const listDirectoryEvents = (options) => createAuthEndpoint("/dash/organization/:id/directories/:providerId/events", {
+	method: "GET",
+	use: [jwtMiddleware(options, directorySyncClaimsSchema)],
+	query: directoryEventsQuerySchema
+}, async (ctx) => {
+	requireOrganizationPlugin(ctx);
+	assertManagedDirectorySyncEnabled(ctx);
+	const organizationId = tryDecode(ctx.params.id);
+	assertDirectorySyncManagementClaims(ctx, organizationId);
+	await assertTargetOrganizationExists(ctx, organizationId);
+	const { limit, offset, sortDirection } = resolveDirectoryEventsPage(ctx.query);
+	const row = await getDirectorySyncConnection(ctx, organizationId, tryDecode(ctx.params.providerId));
+	if (!row.connectionId) return {
+		events: [],
+		total: 0,
+		limit,
+		offset
+	};
+	const result = await requireManagedEndpoint(ctx, getManagedEndpoints(ctx).listSCIMManagedConnectionEvents, "events")({
+		body: {
+			connectionId: row.connectionId,
+			provisioningDomainId: row.provisioningDomainId,
+			limit,
+			offset,
+			sortDirection
+		},
+		context: ctx.context,
+		headers: getRequestHeaders(ctx)
+	});
+	const events = result.events.map((event) => ({
+		...event,
+		createdAt: event.createdAt instanceof Date ? event.createdAt.toISOString() : event.createdAt
+	}));
+	if (typeof result.total === "number" && typeof result.limit === "number" && typeof result.offset === "number") return {
+		events,
+		total: result.total,
+		limit: result.limit,
+		offset: result.offset
+	};
+	const sorted = [...events].sort((a, b) => sortDirection === "asc" ? a.sequence - b.sequence : b.sequence - a.sequence);
+	return {
+		events: sorted.slice(offset, offset + limit),
+		total: sorted.length,
+		limit,
+		offset
+	};
+});
+const decommissionOrganizationDirectory = (options) => createAuthEndpoint("/dash/organization/:id/directories/:providerId/decommission", {
+	method: "POST",
+	use: [jwtMiddleware(options, directorySyncClaimsSchema)],
+	body: emptyBodySchema
+}, async (ctx) => {
+	requireOrganizationPlugin(ctx);
+	assertManagedDirectorySyncEnabled(ctx);
+	const organizationId = tryDecode(ctx.params.id);
+	const claims = assertDirectorySyncManagementClaims(ctx, organizationId);
+	await assertTargetOrganizationExists(ctx, organizationId);
+	let row = await getDirectorySyncConnection(ctx, organizationId, tryDecode(ctx.params.providerId));
+	if (row.status === "decommissioned") return serializeDirectory(row, getScimEndpoint$1(ctx.context.baseURL), await getManagedState(ctx, row));
+	if (!row.connectionId) throw ctx.error("CONFLICT", { message: "Directory sync connection has an invalid catalog binding" });
+	const connectionId = row.connectionId;
+	if (row.status === "active") row = await startDirectorySyncDecommission(ctx, row, claims.actorId);
+	if (row.status !== "decommissioning") throw ctx.error("CONFLICT", { message: "Directory sync connection cannot be decommissioned" });
+	const state = await requireManagedEndpoint(ctx, getManagedEndpoints(ctx).decommissionSCIMManagedConnection, "decommission")({
+		body: {
+			connectionId,
+			provisioningDomainId: row.provisioningDomainId,
+			actorId: claims.actorId
+		},
+		context: ctx.context,
+		headers: getRequestHeaders(ctx)
+	});
+	if (state.connection.status === "decommissioned" || state.decommission.status === "complete") row = await ctx.context.adapter.update({
+		model: "directorySyncConnection",
+		where: [{
+			field: "id",
+			value: row.id
+		}, {
+			field: "status",
+			value: "decommissioning"
+		}],
+		update: {
+			activeOrganizationKey: createTerminalOrganizationKey(row.aliasKey),
+			activeSsoProviderKey: createTerminalPairingKey(row.aliasKey),
+			status: "decommissioned",
+			decommissionedAt: /* @__PURE__ */ new Date(),
+			updatedAt: /* @__PURE__ */ new Date(),
+			lastActorId: claims.actorId
+		}
+	}) ?? row;
+	return serializeDirectory(row, getScimEndpoint$1(ctx.context.baseURL), state);
+});
+const unpairOrganizationDirectory = (options) => createAuthEndpoint("/dash/organization/:id/directories/:providerId/unpair", {
+	method: "POST",
+	use: [jwtMiddleware(options, directorySyncClaimsSchema)],
+	body: emptyBodySchema
+}, async (ctx) => {
+	requireOrganizationPlugin(ctx);
+	assertManagedDirectorySyncEnabled(ctx);
+	const organizationId = tryDecode(ctx.params.id);
+	const claims = assertDirectorySyncManagementClaims(ctx, organizationId);
+	await assertTargetOrganizationExists(ctx, organizationId);
+	const updated = await unpairTerminalDirectorySyncConnection(ctx, await getDirectorySyncConnection(ctx, organizationId, tryDecode(ctx.params.providerId)), claims.actorId);
+	return serializeDirectory(updated, getScimEndpoint$1(ctx.context.baseURL), await getManagedState(ctx, updated));
+});
 //#endregion
 //#region src/routes/directory-sync/session.ts
 async function buildSyntheticSession(ctx, ownerUserId) {
@@ -3367,7 +4937,7 @@ function parseMemberRoles(role) {
 }
 function getScimManagementRoles(ctx) {
 	const creatorRole = ctx.context.getPlugin("organization")?.options?.creatorRole ?? "owner";
-	return Array.from(new Set(["admin", creatorRole]));
+	return Array.from(/* @__PURE__ */ new Set(["admin", creatorRole]));
 }
 async function findOrganizationScimManagerUserId(ctx, organizationId) {
 	const requiredRoles = getScimManagementRoles(ctx);
@@ -3415,13 +4985,12 @@ async function scimProviderExists(ctx, organizationId, providerId) {
 function getScimEndpoint(baseUrl) {
 	return `${baseUrl}/scim/v2`;
 }
-function getSCIMPlugin(ctx) {
-	return ctx.context.getPlugin("scim");
+function resolveMode(ctx) {
+	return resolveDirectorySyncMode(getSCIMPlugin(ctx), isManagedDirectorySyncEnabled(ctx));
 }
-function isScimDirectorySyncEnabled(scimPlugin, authVersion) {
-	if (!scimPlugin) return false;
-	if (isVersionAtLeast(authVersion, "1.7.0")) return true;
-	return scimPlugin.options?.providerOwnership?.enabled === true;
+/** Legacy provider-ownership APIs. Never true when the 1.7+ managed surface exists. */
+function isLegacyDirectorySyncEnabled(ctx) {
+	return resolveMode(ctx) === "legacy";
 }
 const DIRECTORY_SYNC_DUPLICATE_MESSAGE = "A directory sync connection with this provider ID already exists. Remove the existing connection or choose a different provider ID.";
 function isDuplicateDirectorySyncError(e) {
@@ -3434,14 +5003,15 @@ const listOrganizationDirectories = (options) => {
 		method: "GET",
 		use: [jwtMiddleware(options)]
 	}, async (ctx) => {
+		if (resolveMode(ctx) === "managed") return listOrganizationDirectoriesManagedHandler(ctx);
 		if (!isOrganizationEnabled(ctx)) {
 			ctx.context.logger.warn("[Dash] Organization plugin not enabled, returning empty directories list");
 			return [];
 		}
 		const organizationId = tryDecode(ctx.params.id);
 		const scimPlugin = getSCIMPlugin(ctx);
-		if (!scimPlugin?.endpoints.listSCIMProviderConnections || !isScimDirectorySyncEnabled(scimPlugin, ctx.context.version)) {
-			ctx.context.logger.warn("[Dash] SCIM plugin not available or provider ownership disabled, returning empty directories list", { organizationId });
+		if (!isLegacyDirectorySyncEnabled(ctx) || !scimPlugin?.endpoints.listSCIMProviderConnections) {
+			ctx.context.logger.warn("[Dash] Legacy SCIM directory sync is unavailable, returning empty directories list", { organizationId });
 			return [];
 		}
 		const managerUserId = await resolveScimManagementUserId(ctx, organizationId);
@@ -3465,19 +5035,19 @@ const listOrganizationDirectories = (options) => {
 		}
 	});
 };
-const createOrganizationDirectory = (options) => {
+const createOrganizationDirectoryLegacy = (options) => {
 	return createAuthEndpoint("/dash/organization/directory/create", {
 		method: "POST",
-		use: [jwtMiddleware(options, z$1.object({ organizationId: z$1.string() }))],
-		body: z$1.object({
-			providerId: z$1.string().min(1, "Provider ID is required"),
-			ownerUserId: z$1.string().min(1, "Owner user ID is required")
+		use: [jwtMiddleware(options, z.object({ organizationId: z.string() }))],
+		body: z.object({
+			providerId: z.string().min(1, "Provider ID is required"),
+			ownerUserId: z.string().min(1, "Owner user ID is required")
 		})
 	}, async (ctx) => {
 		requireOrganizationPlugin(ctx);
 		const { organizationId } = ctx.context.payload;
 		const scimPlugin = getSCIMPlugin(ctx);
-		if (!scimPlugin?.endpoints.generateSCIMToken || !isScimDirectorySyncEnabled(scimPlugin, ctx.context.version)) throw ctx.error("BAD_REQUEST", { message: "SCIM plugin is not enabled or does not support this feature" });
+		if (!isLegacyDirectorySyncEnabled(ctx) || !scimPlugin?.endpoints.generateSCIMToken) throw ctx.error("BAD_REQUEST", { message: "SCIM plugin is not enabled or does not support this feature" });
 		const { providerId, ownerUserId } = ctx.body;
 		if (await scimProviderExists(ctx, organizationId, providerId)) throw ctx.error("BAD_REQUEST", { message: DIRECTORY_SYNC_DUPLICATE_MESSAGE });
 		let scimToken;
@@ -3505,15 +5075,15 @@ const createOrganizationDirectory = (options) => {
 		};
 	});
 };
-const deleteOrganizationDirectory = (options) => {
+const deleteOrganizationDirectoryLegacy = (options) => {
 	return createAuthEndpoint("/dash/organization/directory/delete", {
 		method: "POST",
-		use: [jwtMiddleware(options, z$1.object({ organizationId: z$1.string() }))],
-		body: z$1.object({ providerId: z$1.string().min(1, "Provider ID is required") })
+		use: [jwtMiddleware(options, z.object({ organizationId: z.string() }))],
+		body: z.object({ providerId: z.string().min(1, "Provider ID is required") })
 	}, async (ctx) => {
 		requireOrganizationPlugin(ctx);
 		const scimPlugin = getSCIMPlugin(ctx);
-		if (!scimPlugin?.endpoints.deleteSCIMProviderConnection || !isScimDirectorySyncEnabled(scimPlugin, ctx.context.version)) throw ctx.error("BAD_REQUEST", { message: "SCIM plugin is not enabled or does not support this feature" });
+		if (!isLegacyDirectorySyncEnabled(ctx) || !scimPlugin?.endpoints.deleteSCIMProviderConnection) throw ctx.error("BAD_REQUEST", { message: "SCIM plugin is not enabled or does not support this feature" });
 		const { organizationId } = ctx.context.payload;
 		const { providerId } = ctx.body;
 		const managerUserId = await resolveScimManagementUserId(ctx, organizationId, providerId);
@@ -3529,15 +5099,15 @@ const deleteOrganizationDirectory = (options) => {
 		return { success: true };
 	});
 };
-const regenerateDirectoryToken = (options) => {
+const regenerateDirectoryTokenLegacy = (options) => {
 	return createAuthEndpoint("/dash/organization/directory/regenerate-token", {
 		method: "POST",
-		use: [jwtMiddleware(options, z$1.object({ organizationId: z$1.string() }))],
-		body: z$1.object({ providerId: z$1.string().min(1, "Provider ID is required") })
+		use: [jwtMiddleware(options, z.object({ organizationId: z.string() }))],
+		body: z.object({ providerId: z.string().min(1, "Provider ID is required") })
 	}, async (ctx) => {
 		requireOrganizationPlugin(ctx);
 		const scimPlugin = getSCIMPlugin(ctx);
-		if (!scimPlugin?.endpoints.generateSCIMToken || !isScimDirectorySyncEnabled(scimPlugin, ctx.context.version)) throw ctx.error("BAD_REQUEST", { message: "SCIM plugin is not enabled or does not support this feature" });
+		if (!isLegacyDirectorySyncEnabled(ctx) || !scimPlugin?.endpoints.generateSCIMToken) throw ctx.error("BAD_REQUEST", { message: "SCIM plugin is not enabled or does not support this feature" });
 		const { organizationId } = ctx.context.payload;
 		const { providerId } = ctx.body;
 		const managerUserId = await resolveScimManagementUserId(ctx, organizationId, providerId);
@@ -3603,13 +5173,13 @@ const getUserEvents = (options) => {
 	return createAuthEndpoint("/events/list", {
 		method: "GET",
 		use: [sessionMiddleware],
-		query: z$1.object({
+		query: z.object({
 			/** Maximum number of events to return (default: 50, max: 100) */
-			limit: z$1.number().or(z$1.string().transform(Number)).optional(),
+			limit: z.number().or(z.string().transform(Number)).optional(),
 			/** Number of events to skip for pagination (default: 0) */
-			offset: z$1.number().or(z$1.string().transform(Number)).optional(),
+			offset: z.number().or(z.string().transform(Number)).optional(),
 			/** Filter by event type (e.g., "user_signed_in") */
-			eventType: z$1.string().optional()
+			eventType: z.string().optional()
 		}).optional()
 	}, async (ctx) => {
 		const session = ctx.context.session;
@@ -3672,13 +5242,13 @@ const getAuditLogs = (options) => {
 	return createAuthEndpoint("/events/audit-logs", {
 		method: "GET",
 		use: [sessionMiddleware],
-		query: z$1.object({
-			limit: z$1.number().or(z$1.string().transform(Number)).optional(),
-			offset: z$1.number().or(z$1.string().transform(Number)).optional(),
-			userId: z$1.string().optional(),
-			organizationId: z$1.string().optional(),
-			identifier: z$1.string().optional(),
-			eventType: z$1.string().optional()
+		query: z.object({
+			limit: z.number().or(z.string().transform(Number)).optional(),
+			offset: z.number().or(z.string().transform(Number)).optional(),
+			userId: z.string().optional(),
+			organizationId: z.string().optional(),
+			identifier: z.string().optional(),
+			eventType: z.string().optional()
 		}).optional()
 	}, async (ctx) => {
 		const session = ctx.context.session;
@@ -3753,7 +5323,7 @@ const getAuditLogs = (options) => {
 		};
 	});
 };
-const OWNER_ADMIN_ROLES = new Set(["owner", "admin"]);
+const OWNER_ADMIN_ROLES = /* @__PURE__ */ new Set(["owner", "admin"]);
 function isOwnerOrAdminRole(role) {
 	return role !== void 0 && OWNER_ADMIN_ROLES.has(role);
 }
@@ -3794,15 +5364,15 @@ const getAllAuditLogs = (options) => {
 	return createAuthEndpoint("/events/all-audit-logs", {
 		method: "GET",
 		use: [sessionMiddleware],
-		query: z$1.object({
-			limit: z$1.number().or(z$1.string().transform(Number)).optional(),
-			offset: z$1.number().or(z$1.string().transform(Number)).optional(),
-			userId: z$1.string().optional(),
-			organizationId: z$1.string().optional(),
+		query: z.object({
+			limit: z.number().or(z.string().transform(Number)).optional(),
+			offset: z.number().or(z.string().transform(Number)).optional(),
+			userId: z.string().optional(),
+			organizationId: z.string().optional(),
 			/** Filter by event type (e.g. `organization_member_added`) */
-			eventType: z$1.string().optional(),
+			eventType: z.string().optional(),
 			/** Match `eventData.identifier` (organization-scoped actor identity) */
-			identifier: z$1.string().optional()
+			identifier: z.string().optional()
 		}).refine((q) => {
 			const u = q.userId?.trim();
 			const o = q.organizationId?.trim();
@@ -3859,10 +5429,10 @@ const getAllAuditLogs = (options) => {
 };
 //#endregion
 //#region src/routes/execute-adapter/index.ts
-const whereClause = z.object({
-	field: z.string(),
-	value: z.unknown(),
-	operator: z.enum([
+const whereClause = z$1.object({
+	field: z$1.string(),
+	value: z$1.unknown(),
+	operator: z$1.enum([
 		"eq",
 		"ne",
 		"gt",
@@ -3874,44 +5444,44 @@ const whereClause = z.object({
 		"starts_with",
 		"ends_with"
 	]).optional(),
-	connector: z.enum(["AND", "OR"]).optional()
+	connector: z$1.enum(["AND", "OR"]).optional()
 });
-const sortBySchema = z.object({
-	field: z.string(),
-	direction: z.enum(["asc", "desc"])
+const sortBySchema = z$1.object({
+	field: z$1.string(),
+	direction: z$1.enum(["asc", "desc"])
 });
-const actionSchema = z.discriminatedUnion("action", [
-	z.object({
-		action: z.literal("findOne"),
-		model: z.string(),
-		where: z.array(whereClause).optional(),
-		select: z.array(z.string()).optional(),
-		join: z.record(z.string(), z.boolean()).optional()
+const actionSchema = z$1.discriminatedUnion("action", [
+	z$1.object({
+		action: z$1.literal("findOne"),
+		model: z$1.string(),
+		where: z$1.array(whereClause).optional(),
+		select: z$1.array(z$1.string()).optional(),
+		join: z$1.record(z$1.string(), z$1.boolean()).optional()
 	}),
-	z.object({
-		action: z.literal("findMany"),
-		model: z.string(),
-		where: z.array(whereClause).optional(),
-		limit: z.number().optional(),
-		offset: z.number().optional(),
+	z$1.object({
+		action: z$1.literal("findMany"),
+		model: z$1.string(),
+		where: z$1.array(whereClause).optional(),
+		limit: z$1.number().optional(),
+		offset: z$1.number().optional(),
 		sortBy: sortBySchema.optional(),
-		join: z.record(z.string(), z.boolean()).optional()
+		join: z$1.record(z$1.string(), z$1.boolean()).optional()
 	}),
-	z.object({
-		action: z.literal("create"),
-		model: z.string(),
-		data: z.record(z.string(), z.unknown())
+	z$1.object({
+		action: z$1.literal("create"),
+		model: z$1.string(),
+		data: z$1.record(z$1.string(), z$1.unknown())
 	}),
-	z.object({
-		action: z.literal("update"),
-		model: z.string(),
-		where: z.array(whereClause),
-		update: z.record(z.string(), z.unknown())
+	z$1.object({
+		action: z$1.literal("update"),
+		model: z$1.string(),
+		where: z$1.array(whereClause),
+		update: z$1.record(z$1.string(), z$1.unknown())
 	}),
-	z.object({
-		action: z.literal("count"),
-		model: z.string(),
-		where: z.array(whereClause).optional()
+	z$1.object({
+		action: z$1.literal("count"),
+		model: z$1.string(),
+		where: z$1.array(whereClause).optional()
 	})
 ]);
 const executeAdapter = (options) => {
@@ -4029,8 +5599,8 @@ function isSafeHttpUrl(value) {
 	}
 }
 /** http(s) absolute URL without embedded credentials. */
-const safeUrlSchema = z$1.string().trim().min(1).pipe(z$1.url().refine(isSafeHttpUrl, { message: "URL must be a valid http(s) URL without credentials" })).transform((value) => new URL(value).href);
-const optionalSafeUrlSchema = z$1.union([safeUrlSchema, z$1.literal("")]).optional();
+const safeUrlSchema = z.string().trim().min(1).pipe(z.url().refine(isSafeHttpUrl, { message: "URL must be a valid http(s) URL without credentials" })).transform((value) => new URL(value).href);
+const optionalSafeUrlSchema = z.union([safeUrlSchema, z.literal("")]).optional();
 function getAuthBaseUrl(ctx) {
 	const baseURL = ctx.context.options.baseURL;
 	return typeof baseURL === "string" && baseURL.trim() ? baseURL : "/";
@@ -4109,10 +5679,13 @@ async function executePlatformInvitationCompletion(ctx, $api, invitation, args)
 			}
 		});
 		if (markError) ctx.context.logger.warn("[Dash] Failed to mark invitation as accepted", markError);
-		if (shouldCreateSessionOnInviteComplete(invitation.authMode)) await setSessionCookie(ctx, {
-			session: await ctx.context.internalAdapter.createSession(existingUser.id),
-			user: existingUser
-		});
+		if (shouldCreateSessionOnInviteComplete(invitation.authMode)) {
+			const session = await ctx.context.internalAdapter.createSession(existingUser.id);
+			await setSessionCookie(ctx, {
+				session,
+				user: existingUser
+			});
+		}
 		return { redirectUrl: resolveTrustedAuthRedirectUrl(ctx, invitation.redirectUrl, getAuthBaseUrl(ctx)) };
 	}
 	if (!password && !allowsPasswordlessInviteComplete(invitation.authMode)) throw new APIError("BAD_REQUEST", { message: "Password is required to complete this invitation." });
@@ -4125,10 +5698,8 @@ async function executePlatformInvitationCompletion(ctx, $api, invitation, args)
 	};
 	const adapter = ctx.context.internalAdapter;
 	const user = isVersionAtLeast(ctx.context.version, "1.7.0") ? await adapter.createUser(userPayload, { method: "admin" }) : await adapter.createUser(userPayload);
-	if (password) await ctx.context.internalAdapter.createAccount({
+	if (password) await createCredentialAccountCompat(ctx.context.internalAdapter, {
 		userId: user.id,
-		providerId: "credential",
-		accountId: user.id,
 		password: await ctx.context.password.hash(password)
 	});
 	const { error: markError } = await $api("/api/internal/invitations/mark-accepted", {
@@ -4139,10 +5710,13 @@ async function executePlatformInvitationCompletion(ctx, $api, invitation, args)
 		}
 	});
 	if (markError) ctx.context.logger.warn("[Dash] Failed to mark invitation as accepted", markError);
-	if (shouldCreateSessionOnInviteComplete(invitation.authMode)) await setSessionCookie(ctx, {
-		session: await ctx.context.internalAdapter.createSession(user.id),
-		user
-	});
+	if (shouldCreateSessionOnInviteComplete(invitation.authMode)) {
+		const session = await ctx.context.internalAdapter.createSession(user.id);
+		await setSessionCookie(ctx, {
+			session,
+			user
+		});
+	}
 	return { redirectUrl: resolveTrustedAuthRedirectUrl(ctx, invitation.redirectUrl, getAuthBaseUrl(ctx)) };
 }
 /**
@@ -4154,7 +5728,7 @@ const acceptInvitation = (options) => {
 	const { $api } = options;
 	return createAuthEndpoint("/dash/accept-invitation", {
 		method: "GET",
-		query: z$1.object({ token: z$1.string() })
+		query: z.object({ token: z.string() })
 	}, async (ctx) => {
 		const { token } = ctx.query;
 		const invitation = await verifyPendingInvitation(token, $api, ctx);
@@ -4169,10 +5743,13 @@ const acceptInvitation = (options) => {
 				}
 			});
 			if (markError) ctx.context.logger.warn("[Dash] Failed to mark invitation as accepted (existing user)", markError);
-			if (shouldCreateSessionOnInviteComplete(invitation.authMode)) await setSessionCookie(ctx, {
-				session: await ctx.context.internalAdapter.createSession(existingUser.id),
-				user: existingUser
-			});
+			if (shouldCreateSessionOnInviteComplete(invitation.authMode)) {
+				const session = await ctx.context.internalAdapter.createSession(existingUser.id);
+				await setSessionCookie(ctx, {
+					session,
+					user: existingUser
+				});
+			}
 			const redirectUrl = resolveTrustedAuthRedirectUrl(ctx, invitation.redirectUrl, getAuthBaseUrl(ctx));
 			return ctx.redirect(redirectUrl);
 		}
@@ -4201,10 +5778,13 @@ const acceptInvitation = (options) => {
 			}
 		});
 		if (markError) ctx.context.logger.warn("[Dash] Failed to mark invitation as accepted", markError);
-		if (shouldCreateSessionOnInviteComplete(invitation.authMode)) await setSessionCookie(ctx, {
-			session: await ctx.context.internalAdapter.createSession(user.id),
-			user
-		});
+		if (shouldCreateSessionOnInviteComplete(invitation.authMode)) {
+			const session = await ctx.context.internalAdapter.createSession(user.id);
+			await setSessionCookie(ctx, {
+				session,
+				user
+			});
+		}
 		const redirectUrl = resolveTrustedAuthRedirectUrl(ctx, invitation.redirectUrl, getAuthBaseUrl(ctx));
 		return ctx.redirect(redirectUrl);
 	});
@@ -4218,13 +5798,14 @@ const completeInvitation = (options) => {
 	const { $api } = options;
 	return createAuthEndpoint("/dash/complete-invitation", {
 		method: "POST",
-		body: z$1.object({
-			token: z$1.string(),
-			password: z$1.string().optional()
+		body: z.object({
+			token: z.string(),
+			password: z.string().optional()
 		})
 	}, async (ctx) => {
 		const { token, password } = ctx.body;
-		const { redirectUrl } = await executePlatformInvitationCompletion(ctx, $api, await verifyPendingInvitation(token, $api, ctx), {
+		const invitation = await verifyPendingInvitation(token, $api, ctx);
+		const { redirectUrl } = await executePlatformInvitationCompletion(ctx, $api, invitation, {
 			token,
 			password
 		});
@@ -4242,14 +5823,15 @@ const completeInvitationHandoff = (options) => {
 	const { $api } = options;
 	return createAuthEndpoint("/dash/complete-invitation-handoff", {
 		method: "GET",
-		query: z$1.object({ handoff: z$1.string().min(1) })
+		query: z.object({ handoff: z.string().min(1) })
 	}, async (ctx) => {
 		const { data, error } = await $api("/api/internal/invitations/redeem-handoff", {
 			method: "POST",
 			body: { handoff: ctx.query.handoff }
 		});
 		if (error || !data?.invitationToken) throw new APIError("BAD_REQUEST", { message: "This invitation link has expired. Please try again." });
-		const { redirectUrl } = await executePlatformInvitationCompletion(ctx, $api, await verifyPendingInvitation(data.invitationToken, $api, ctx), {
+		const invitation = await verifyPendingInvitation(data.invitationToken, $api, ctx);
+		const { redirectUrl } = await executePlatformInvitationCompletion(ctx, $api, invitation, {
 			token: data.invitationToken,
 			password: data.password ?? void 0
 		});
@@ -4260,7 +5842,7 @@ const completeInvitationSocial = (options) => {
 	const { $api } = options;
 	return createAuthEndpoint("/dash/complete-invitation-social", {
 		method: "GET",
-		query: z$1.object({ token: z$1.string() }),
+		query: z.object({ token: z.string() }),
 		use: [sessionMiddleware]
 	}, async (ctx) => {
 		const sessionUser = ctx.context.session?.user;
@@ -4295,7 +5877,7 @@ const checkUserExists = (options) => {
 	return createAuthEndpoint("/dash/check-user-exists", {
 		method: "POST",
 		use: [jwtMiddleware(options)],
-		body: z$1.object({ email: z$1.email() })
+		body: z.object({ email: z.email() })
 	}, async (ctx) => {
 		const { email } = ctx.body;
 		const normalizedEmail = normalizeEmail(email, ctx.context);
@@ -4325,7 +5907,7 @@ function getOrganizationRoleKeys(orgOptions) {
 	if (roles && typeof roles === "object" && Object.keys(roles).length > 0) return Object.keys(roles);
 	return [...DEFAULT_ORG_MEMBER_ROLES];
 }
-const organizationMemberRoleInputSchema = z$1.string().trim().min(1, "Role is required").max(64, "Role is too long").regex(/^[a-zA-Z][a-zA-Z0-9_-]*$/, "Role must start with a letter and contain only letters, numbers, hyphens, and underscores");
+const organizationMemberRoleInputSchema = z.string().trim().min(1, "Role is required").max(64, "Role is too long").regex(/^[a-zA-Z][a-zA-Z0-9_-]*$/, "Role must start with a letter and contain only letters, numbers, hyphens, and underscores");
 function validateOrganizationMemberRole(ctx, role, orgOptions) {
 	const allowedRoles = getOrganizationRoleKeys(orgOptions);
 	if (!allowedRoles.includes(role)) throw ctx.error("BAD_REQUEST", { message: `Invalid role. Allowed roles: ${allowedRoles.join(", ")}` });
@@ -4387,14 +5969,14 @@ const listOrganizationInvitations = (options) => {
 const inviteMember = (options) => {
 	return createAuthEndpoint("/dash/organization/invite-member", {
 		method: "POST",
-		body: z$1.object({
-			email: z$1.string(),
+		body: z.object({
+			email: z.string(),
 			role: organizationMemberRoleInputSchema,
-			invitedBy: z$1.string()
+			invitedBy: z.string()
 		}),
-		use: [jwtMiddleware(options, z$1.object({
-			organizationId: z$1.string(),
-			invitedBy: z$1.string()
+		use: [jwtMiddleware(options, z.object({
+			organizationId: z.string(),
+			invitedBy: z.string()
 		}))]
 	}, async (ctx) => {
 		const { organizationId } = ctx.context.payload;
@@ -4431,8 +6013,8 @@ const inviteMember = (options) => {
 const checkUserByEmail = (options) => {
 	return createAuthEndpoint("/dash/organization/check-user-by-email", {
 		method: "POST",
-		body: z$1.object({ email: z$1.string() }),
-		use: [jwtMiddleware(options, z$1.object({ organizationId: z$1.string() }))]
+		body: z.object({ email: z.string() }),
+		use: [jwtMiddleware(options, z.object({ organizationId: z.string() }))]
 	}, async (ctx) => {
 		requireOrganizationPlugin(ctx);
 		const { organizationId } = ctx.context.payload;
@@ -4475,11 +6057,11 @@ const checkUserByEmail = (options) => {
 const cancelInvitation = (options) => {
 	return createAuthEndpoint("/dash/organization/cancel-invitation", {
 		method: "POST",
-		use: [jwtMiddleware(options, z$1.object({
-			organizationId: z$1.string(),
-			invitationId: z$1.string()
+		use: [jwtMiddleware(options, z.object({
+			organizationId: z.string(),
+			invitationId: z.string()
 		}))],
-		body: z$1.object({ invitationId: z$1.string() })
+		body: z.object({ invitationId: z.string() })
 	}, async (ctx) => {
 		const orgOptions = requireOrganizationPlugin(ctx).options || {};
 		const { invitationId, organizationId } = ctx.context.payload;
@@ -4533,11 +6115,11 @@ const cancelInvitation = (options) => {
 const resendInvitation = (options) => {
 	return createAuthEndpoint("/dash/organization/resend-invitation", {
 		method: "POST",
-		use: [jwtMiddleware(options, z$1.object({
-			organizationId: z$1.string(),
-			invitationId: z$1.string()
+		use: [jwtMiddleware(options, z.object({
+			organizationId: z.string(),
+			invitationId: z.string()
 		}))],
-		body: z$1.object({ invitationId: z$1.string() })
+		body: z.object({ invitationId: z.string() })
 	}, async (ctx) => {
 		const organizationPlugin = requireOrganizationPlugin(ctx);
 		const { invitationId, organizationId } = ctx.context.payload;
@@ -4646,9 +6228,9 @@ const listOrganizationMembers = (options) => {
 const addMember = (options) => {
 	return createAuthEndpoint("/dash/organization/add-member", {
 		method: "POST",
-		use: [jwtMiddleware(options, z$1.object({ organizationId: z$1.string() }))],
-		body: z$1.object({
-			userId: z$1.string(),
+		use: [jwtMiddleware(options, z.object({ organizationId: z.string() }))],
+		body: z.object({
+			userId: z.string(),
 			role: organizationMemberRoleInputSchema
 		})
 	}, async (ctx) => {
@@ -4703,8 +6285,8 @@ const addMember = (options) => {
 const removeMember = (options) => {
 	return createAuthEndpoint("/dash/organization/remove-member", {
 		method: "POST",
-		use: [jwtMiddleware(options, z$1.object({ organizationId: z$1.string() }))],
-		body: z$1.object({ memberId: z$1.string() })
+		use: [jwtMiddleware(options, z.object({ organizationId: z.string() }))],
+		body: z.object({ memberId: z.string() })
 	}, async (ctx) => {
 		const { organizationId } = ctx.context.payload;
 		const orgOptions = requireOrganizationPlugin(ctx).options || {};
@@ -4773,9 +6355,9 @@ const removeMember = (options) => {
 const updateMemberRole = (options) => {
 	return createAuthEndpoint("/dash/organization/update-member-role", {
 		method: "POST",
-		use: [jwtMiddleware(options, z$1.object({ organizationId: z$1.string() }))],
-		body: z$1.object({
-			memberId: z$1.string(),
+		use: [jwtMiddleware(options, z.object({ organizationId: z.string() }))],
+		body: z.object({
+			memberId: z.string(),
 			role: organizationMemberRoleInputSchema
 		})
 	}, async (ctx) => {
@@ -4834,7 +6416,7 @@ const updateMemberRole = (options) => {
 //#region src/export-factory.ts
 const exportFactory = (input, options) => async (ctx) => {
 	const batchSize = options?.batchSize || 1e4;
-	const staleMs = options?.staleMs || 300 * 1e3;
+	const staleMs = options?.staleMs || 3e5;
 	const enabledFields = options?.enabledFields || [];
 	const userLimit = input.limit;
 	const userOffset = input.offset || 0;
@@ -4931,16 +6513,16 @@ async function withConcurrency(items, fn, options) {
 	return results;
 }
 /** Zod schema for validating organization/project slug format. */
-const slugSchema = z.string().min(1, "Slug is required").regex(/^[a-z0-9-]+$/, "Slug can only contain lowercase letters, numbers, and hyphens");
+const slugSchema = z$1.string().min(1, "Slug is required").regex(/^[a-z0-9-]+$/, "Slug can only contain lowercase letters, numbers, and hyphens");
 //#endregion
 //#region src/routes/organizations/schemas.ts
-const DENIED_ORG_WRITE_KEYS = new Set([
+const DENIED_ORG_WRITE_KEYS = /* @__PURE__ */ new Set([
 	"id",
 	"createdAt",
 	"updatedAt"
 ]);
-const CREATE_NON_PERSISTED_KEYS = new Set(["defaultTeamName"]);
-const CREATE_REQUEST_ONLY_KEYS$1 = new Set(["userId", "skipDefaultTeam"]);
+const CREATE_NON_PERSISTED_KEYS = /* @__PURE__ */ new Set(["defaultTeamName"]);
+const CREATE_REQUEST_ONLY_KEYS$1 = /* @__PURE__ */ new Set(["userId", "skipDefaultTeam"]);
 const CORE_CREATE_KEYS$1 = [
 	"name",
 	"slug",
@@ -4972,7 +6554,7 @@ function getWritableOrganizationFieldNames(orgOptions, mode) {
 */
 function pickWritableOrganizationFields(body, orgOptions, mode) {
 	const allowed = getWritableOrganizationFieldNames(orgOptions, mode);
-	const skip = new Set([
+	const skip = /* @__PURE__ */ new Set([
 		...DENIED_ORG_WRITE_KEYS,
 		...mode === "create" ? CREATE_NON_PERSISTED_KEYS : [],
 		...mode === "create" ? CREATE_REQUEST_ONLY_KEYS$1 : []
@@ -4984,26 +6566,26 @@ function pickWritableOrganizationFields(body, orgOptions, mode) {
 	}
 	return result;
 }
-const BaseCreateOrgCoreBodySchema = z$1.object({
-	name: z$1.string(),
+const BaseCreateOrgCoreBodySchema = z.object({
+	name: z.string(),
 	slug: slugSchema,
-	logo: z$1.string().optional(),
-	defaultTeamName: z$1.string().optional()
+	logo: z.string().optional(),
+	defaultTeamName: z.string().optional()
 });
-const BaseUpdateOrgCoreBodySchema = z$1.object({
+const BaseUpdateOrgCoreBodySchema = z.object({
 	logo: optionalSafeUrlSchema,
-	name: z$1.string().optional(),
+	name: z.string().optional(),
 	slug: slugSchema.optional(),
-	metadata: z$1.string().optional()
+	metadata: z.string().optional()
 });
-const CreateOrganizationBodySchema = BaseCreateOrgCoreBodySchema.catchall(z$1.unknown());
-const UpdateOrganizationBodySchema = BaseUpdateOrgCoreBodySchema.catchall(z$1.unknown());
+const CreateOrganizationBodySchema = BaseCreateOrgCoreBodySchema.catchall(z.unknown());
+const UpdateOrganizationBodySchema = BaseUpdateOrgCoreBodySchema.catchall(z.unknown());
 function createSchemaForDBField$1(field) {
 	switch (field.type) {
-		case "number": return field.required ? z$1.coerce.number() : z$1.coerce.number().optional();
-		case "boolean": return field.required ? z$1.coerce.boolean() : z$1.coerce.boolean().optional();
-		case "date": return field.required ? z$1.union([z$1.string().min(1), z$1.coerce.date()]) : z$1.union([z$1.string(), z$1.coerce.date()]).optional();
-		default: return field.required ? z$1.string().min(1) : z$1.string().optional();
+		case "number": return field.required ? z.coerce.number() : z.coerce.number().optional();
+		case "boolean": return field.required ? z.coerce.boolean() : z.coerce.boolean().optional();
+		case "date": return field.required ? z.union([z.string().min(1), z.coerce.date()]) : z.union([z.string(), z.coerce.date()]).optional();
+		default: return field.required ? z.string().min(1) : z.string().optional();
 	}
 }
 /**
@@ -5012,39 +6594,39 @@ function createSchemaForDBField$1(field) {
 */
 function validateWritableCreateOrganizationFields(data, options) {
 	const shape = {
-		name: z$1.string().min(1),
+		name: z.string().min(1),
 		slug: slugSchema,
-		logo: z$1.string().optional()
+		logo: z.string().optional()
 	};
 	const additional = getOrganizationAdditionalFields(options);
 	for (const [name, field] of Object.entries(additional)) {
 		if (field.input === false) continue;
 		shape[name] = createSchemaForDBField$1(field);
 	}
-	const result = z$1.object(shape).strict().safeParse(data);
+	const result = z.object(shape).strict().safeParse(data);
 	if (!result.success) throw result.error;
 }
 /**
 * Ensures at least one field is present on update and validates additional field types.
 */
 function validateWritableOrganizationUpdateFields(data, orgOptions) {
-	if (Object.keys(data).length === 0) throw new z$1.ZodError([{
+	if (Object.keys(data).length === 0) throw new z.ZodError([{
 		code: "custom",
 		message: "No valid fields to update",
 		path: []
 	}]);
 	const shape = {
-		name: z$1.string().min(1).optional(),
+		name: z.string().min(1).optional(),
 		slug: slugSchema.optional(),
 		logo: optionalSafeUrlSchema,
-		metadata: z$1.string().optional()
+		metadata: z.string().optional()
 	};
 	const additional = getOrganizationAdditionalFields(orgOptions);
 	for (const [name, field] of Object.entries(additional)) {
 		if (field.input === false) continue;
 		shape[name] = createSchemaForDBField$1(field);
 	}
-	const result = z$1.object(shape).partial().strict().safeParse(data);
+	const result = z.object(shape).partial().strict().safeParse(data);
 	if (!result.success) throw result.error;
 }
 //#endregion
@@ -5086,26 +6668,26 @@ const listOrganizations = (options) => {
 	return createAuthEndpoint("/dash/list-organizations", {
 		method: "GET",
 		use: [jwtMiddleware(options)],
-		query: z$1.object({
-			limit: z$1.number().or(z$1.string().transform(Number)).optional(),
-			offset: z$1.number().or(z$1.string().transform(Number)).optional(),
-			sortBy: z$1.enum([
+		query: z.object({
+			limit: z.number().or(z.string().transform(Number)).optional(),
+			offset: z.number().or(z.string().transform(Number)).optional(),
+			sortBy: z.enum([
 				"createdAt",
 				"name",
 				"slug",
 				"members"
 			]).optional(),
-			sortOrder: z$1.enum(["asc", "desc"]).optional(),
-			filterMembers: z$1.enum([
+			sortOrder: z.enum(["asc", "desc"]).optional(),
+			filterMembers: z.enum([
 				"abandoned",
 				"eq1",
 				"gt1",
 				"gt5",
 				"gt10"
 			]).optional(),
-			search: z$1.string().optional(),
-			startDate: z$1.date().or(z$1.string().transform((val) => new Date(val))).optional(),
-			endDate: z$1.date().or(z$1.string().transform((val) => new Date(val))).optional()
+			search: z.string().optional(),
+			startDate: z.date().or(z.string().transform((val) => new Date(val))).optional(),
+			endDate: z.date().or(z.string().transform((val) => new Date(val))).optional()
 		}).optional()
 	}, async (ctx) => {
 		const { limit = 10, offset = 0, sortBy = "createdAt", sortOrder = "desc", search, filterMembers } = ctx.query || {};
@@ -5226,12 +6808,12 @@ function parseWhereClause$1(val) {
 	if (!Array.isArray(parsed)) return [];
 	return parsed;
 }
-const exportOrganizationsQuerySchema = z$1.object({
-	limit: z$1.number().or(z$1.string().transform(Number)).optional(),
-	offset: z$1.number().or(z$1.string().transform(Number)).optional(),
-	sortBy: z$1.string().optional(),
-	sortOrder: z$1.enum(["asc", "desc"]).optional(),
-	where: z$1.string().transform(parseWhereClause$1).optional()
+const exportOrganizationsQuerySchema = z.object({
+	limit: z.number().or(z.string().transform(Number)).optional(),
+	offset: z.number().or(z.string().transform(Number)).optional(),
+	sortBy: z.string().optional(),
+	sortOrder: z.enum(["asc", "desc"]).optional(),
+	where: z.string().transform(parseWhereClause$1).optional()
 }).optional();
 const exportOrganizations = (options) => {
 	return createAuthEndpoint("/dash/export-organizations", {
@@ -5296,8 +6878,8 @@ const getOrganization = (options) => {
 const deleteOrganization = (options) => {
 	return createAuthEndpoint("/dash/organization/delete", {
 		method: "POST",
-		use: [jwtMiddleware(options, z$1.object({ organizationId: z$1.string() }))],
-		body: z$1.object({ organizationId: z$1.string() })
+		use: [jwtMiddleware(options, z.object({ organizationId: z.string() }))],
+		body: z.object({ organizationId: z.string() })
 	}, async (ctx) => {
 		const { organizationId } = ctx.context.payload;
 		const { organizationId: bodyOrganizationId } = ctx.body;
@@ -5346,7 +6928,7 @@ const deleteOrganization = (options) => {
 const deleteManyOrganizations = (options) => {
 	return createAuthEndpoint("/dash/organization/delete-many", {
 		method: "POST",
-		use: [jwtMiddleware(options, z$1.object({ organizationIds: z$1.string().array() }))]
+		use: [jwtMiddleware(options, z.object({ organizationIds: z.string().array() }))]
 	}, async (ctx) => {
 		requireOrganizationPlugin(ctx);
 		const { organizationIds } = ctx.context.payload;
@@ -5383,9 +6965,9 @@ const deleteManyOrganizations = (options) => {
 const createOrganization = (options) => {
 	return createAuthEndpoint("/dash/organization/create", {
 		method: "POST",
-		use: [jwtMiddleware(options, z$1.object({
-			userId: z$1.string(),
-			skipDefaultTeam: z$1.boolean().optional().default(false)
+		use: [jwtMiddleware(options, z.object({
+			userId: z.string(),
+			skipDefaultTeam: z.boolean().optional().default(false)
 		}))],
 		body: CreateOrganizationBodySchema
 	}, async (ctx) => {
@@ -5411,7 +6993,7 @@ const createOrganization = (options) => {
 		try {
 			validateWritableCreateOrganizationFields(orgData, orgOptions);
 		} catch (error) {
-			if (error instanceof z$1.ZodError) throw ctx.error("BAD_REQUEST", { message: error.issues[0]?.message ?? "Invalid organization data" });
+			if (error instanceof z.ZodError) throw ctx.error("BAD_REQUEST", { message: error.issues[0]?.message ?? "Invalid organization data" });
 			throw error;
 		}
 		if (orgOptions.organizationCreation?.beforeCreate) {
@@ -5547,7 +7129,7 @@ const createOrganization = (options) => {
 const updateOrganization = (options) => {
 	return createAuthEndpoint("/dash/organization/update", {
 		method: "POST",
-		use: [jwtMiddleware(options, z$1.object({ organizationId: z$1.string() }))],
+		use: [jwtMiddleware(options, z.object({ organizationId: z.string() }))],
 		body: UpdateOrganizationBodySchema
 	}, async (ctx) => {
 		const { organizationId } = ctx.context.payload;
@@ -5587,7 +7169,7 @@ const updateOrganization = (options) => {
 		try {
 			validateWritableOrganizationUpdateFields(updateData, orgOptions);
 		} catch (error) {
-			if (error instanceof z$1.ZodError) throw ctx.error("BAD_REQUEST", { message: error.issues[0]?.message ?? "Invalid organization data" });
+			if (error instanceof z.ZodError) throw ctx.error("BAD_REQUEST", { message: error.issues[0]?.message ?? "Invalid organization data" });
 			throw error;
 		}
 		if (typeof updateData.metadata === "string") try {
@@ -5674,10 +7256,10 @@ const listOrganizationTeams = (options) => {
 const updateTeam = (options) => {
 	return createAuthEndpoint("/dash/organization/update-team", {
 		method: "POST",
-		use: [jwtMiddleware(options, z$1.object({ organizationId: z$1.string() }))],
-		body: z$1.object({
-			teamId: z$1.string(),
-			name: z$1.string().optional()
+		use: [jwtMiddleware(options, z.object({ organizationId: z.string() }))],
+		body: z.object({
+			teamId: z.string(),
+			name: z.string().optional()
 		})
 	}, async (ctx) => {
 		const { organizationId } = ctx.context.payload;
@@ -5748,8 +7330,8 @@ const updateTeam = (options) => {
 const deleteTeam = (options) => {
 	return createAuthEndpoint("/dash/organization/delete-team", {
 		method: "POST",
-		use: [jwtMiddleware(options, z$1.object({ organizationId: z$1.string() }))],
-		body: z$1.object({ teamId: z$1.string() })
+		use: [jwtMiddleware(options, z.object({ organizationId: z.string() }))],
+		body: z.object({ teamId: z.string() })
 	}, async (ctx) => {
 		const { organizationId } = ctx.context.payload;
 		const orgOptions = requireTeamsEnabled(ctx);
@@ -5817,8 +7399,8 @@ const deleteTeam = (options) => {
 const createTeam = (options) => {
 	return createAuthEndpoint("/dash/organization/create-team", {
 		method: "POST",
-		use: [jwtMiddleware(options, z$1.object({ organizationId: z$1.string() }))],
-		body: z$1.object({ name: z$1.string() })
+		use: [jwtMiddleware(options, z.object({ organizationId: z.string() }))],
+		body: z.object({ name: z.string() })
 	}, async (ctx) => {
 		const { organizationId } = ctx.context.payload;
 		const orgOptions = requireTeamsEnabled(ctx);
@@ -5936,10 +7518,10 @@ const listTeamMembers = (options) => {
 const addTeamMember = (options) => {
 	return createAuthEndpoint("/dash/organization/add-team-member", {
 		method: "POST",
-		use: [jwtMiddleware(options, z$1.object({ organizationId: z$1.string() }))],
-		body: z$1.object({
-			teamId: z$1.string(),
-			userId: z$1.string()
+		use: [jwtMiddleware(options, z.object({ organizationId: z.string() }))],
+		body: z.object({
+			teamId: z.string(),
+			userId: z.string()
 		})
 	}, async (ctx) => {
 		const { organizationId } = ctx.context.payload;
@@ -6029,10 +7611,10 @@ const addTeamMember = (options) => {
 const removeTeamMember = (options) => {
 	return createAuthEndpoint("/dash/organization/remove-team-member", {
 		method: "POST",
-		use: [jwtMiddleware(options, z$1.object({ organizationId: z$1.string() }))],
-		body: z$1.object({
-			teamId: z$1.string(),
-			userId: z$1.string()
+		use: [jwtMiddleware(options, z.object({ organizationId: z.string() }))],
+		body: z.object({
+			teamId: z.string(),
+			userId: z.string()
 		})
 	}, async (ctx) => {
 		const { organizationId } = ctx.context.payload;
@@ -6135,7 +7717,7 @@ const revokeSession = (options) => createAuthEndpoint("/dash/sessions/revoke", {
 const revokeAllSessions = (options) => createAuthEndpoint("/dash/sessions/revoke-all", {
 	method: "POST",
 	use: [jwtMiddleware(options)],
-	body: z$1.object({ userId: z$1.string() })
+	body: z.object({ userId: z.string() })
 }, async (ctx) => {
 	const { userId } = ctx.body;
 	if (!await ctx.context.internalAdapter.findUserById(userId)) throw ctx.error("NOT_FOUND", { message: "User not found" });
@@ -6144,7 +7726,7 @@ const revokeAllSessions = (options) => createAuthEndpoint("/dash/sessions/revoke
 });
 const revokeManySessions = (options) => createAuthEndpoint("/dash/sessions/revoke-many", {
 	method: "POST",
-	use: [jwtMiddleware(options, z$1.object({ userIds: z$1.string().array() }))]
+	use: [jwtMiddleware(options, z.object({ userIds: z.string().array() }))]
 }, async (ctx) => {
 	const { userIds } = ctx.context.payload;
 	await withConcurrency(chunkArray(userIds, { batchSize: 50 }), async (chunk) => {
@@ -6189,7 +7771,7 @@ function getSSOPlugin(ctx) {
 * (see packages/sso dist constants). Inlined so consumers (e.g. Metro) never
 * statically pull @better-auth/sso for validation-only code paths.
 */
-const DEFAULT_MAX_SAML_METADATA_SIZE = 100 * 1024;
+const DEFAULT_MAX_SAML_METADATA_SIZE = 102400;
 const RSA_SHA1 = "http://www.w3.org/2000/09/xmldsig#rsa-sha1";
 const SHA1 = "http://www.w3.org/2000/09/xmldsig#sha1";
 /** @public */
@@ -6233,48 +7815,84 @@ function validateSAMLMetadataAlgorithms(metadataXml) {
 	return warnings;
 }
 //#endregion
+//#region src/routes/sso/verify-domain-error.ts
+const DOMAIN_ALREADY_VERIFIED = {
+	verified: true,
+	message: "Domain has already been verified"
+};
+const PROVIDER_CHANGED = {
+	verified: false,
+	message: "SSO provider changed while domain verification was in progress. Reload the provider and try again."
+};
+const DNS_RECORD_MISSING = {
+	verified: false,
+	message: "Unable to verify domain ownership. The TXT record was not found. It may take up to 48 hours for DNS changes to propagate."
+};
+function isRecord(value) {
+	return typeof value === "object" && value !== null;
+}
+function getApiErrorCode(error) {
+	const withExtras = error;
+	if (typeof withExtras.code === "string") return withExtras.code;
+	if (isRecord(withExtras.body) && typeof withExtras.body.code === "string") return withExtras.body.code;
+}
+/**
+* Maps SSO plugin `verifyDomain` API errors to dash responses.
+* Returns `null` when the caller should rethrow.
+*/
+function mapSsoVerifyDomainApiError(error) {
+	if (error.status === "CONFLICT") {
+		if (getApiErrorCode(error) === "SSO_PROVIDER_CHANGED") return PROVIDER_CHANGED;
+		return DOMAIN_ALREADY_VERIFIED;
+	}
+	if (error.status === "BAD_GATEWAY") return DNS_RECORD_MISSING;
+	return null;
+}
+//#endregion
 //#region src/routes/sso/index.ts
 function requireOrganizationAccess(ctx) {
 	const orgIdFromUrl = tryDecode(ctx.params.id);
 	const orgIdFromToken = ctx.context.payload?.organizationId;
 	if (!orgIdFromToken || orgIdFromUrl !== orgIdFromToken) throw ctx.error("FORBIDDEN", { message: "You do not have access to this organization" });
 }
-const samlConfigSchema = z$1.object({
-	idpMetadata: z$1.object({
-		metadata: z$1.string().optional(),
-		metadataUrl: z$1.string().optional()
+const samlConfigSchema = z.object({
+	idpMetadata: z.object({
+		metadata: z.string().optional(),
+		metadataUrl: z.string().optional()
 	}).optional(),
-	entryPoint: z$1.string().optional(),
-	cert: z$1.string().optional(),
-	entityId: z$1.string().optional(),
-	mapping: z$1.object({
-		id: z$1.string().optional(),
-		email: z$1.string().optional(),
-		emailVerified: z$1.string().optional(),
-		name: z$1.string().optional(),
-		firstName: z$1.string().optional(),
-		lastName: z$1.string().optional(),
-		extraFields: z$1.record(z$1.string(), z$1.any()).optional()
+	entryPoint: z.string().optional(),
+	cert: z.string().optional(),
+	entityId: z.string().optional(),
+	mapping: z.object({
+		/** @deprecated Removed in better-auth 1.7+; SAML subject is NameID. */
+		id: z.string().optional(),
+		email: z.string().optional(),
+		emailVerified: z.string().optional(),
+		name: z.string().optional(),
+		firstName: z.string().optional(),
+		lastName: z.string().optional(),
+		extraFields: z.record(z.string(), z.any()).optional()
 	}).optional()
 });
-const oidcConfigSchema = z$1.object({
-	clientId: z$1.string(),
-	clientSecret: z$1.string().optional(),
-	discoveryUrl: z$1.string().optional(),
-	issuer: z$1.string().optional(),
-	discoveryEndpoint: z$1.string().optional(),
-	authorizationEndpoint: z$1.string().optional(),
-	tokenEndpoint: z$1.string().optional(),
-	jwksEndpoint: z$1.string().optional(),
-	userInfoEndpoint: z$1.string().optional(),
-	tokenEndpointAuthentication: z$1.enum(["client_secret_post", "client_secret_basic"]).optional(),
-	mapping: z$1.object({
-		id: z$1.string().optional(),
-		email: z$1.string().optional(),
-		emailVerified: z$1.string().optional(),
-		name: z$1.string().optional(),
-		image: z$1.string().optional(),
-		extraFields: z$1.record(z$1.string(), z$1.any()).optional()
+const oidcConfigSchema = z.object({
+	clientId: z.string(),
+	clientSecret: z.string().optional(),
+	discoveryUrl: z.string().optional(),
+	issuer: z.string().optional(),
+	discoveryEndpoint: z.string().optional(),
+	authorizationEndpoint: z.string().optional(),
+	tokenEndpoint: z.string().optional(),
+	jwksEndpoint: z.string().optional(),
+	userInfoEndpoint: z.string().optional(),
+	tokenEndpointAuthentication: z.enum(["client_secret_post", "client_secret_basic"]).optional(),
+	mapping: z.object({
+		/** @deprecated Removed in better-auth 1.7+; OIDC subject is `sub`. */
+		id: z.string().optional(),
+		email: z.string().optional(),
+		emailVerified: z.string().optional(),
+		name: z.string().optional(),
+		image: z.string().optional(),
+		extraFields: z.record(z.string(), z.any()).optional()
 	}).optional()
 });
 async function resolveSAMLConfig(samlConfig, providerId, baseURL, ctx) {
@@ -6294,20 +7912,24 @@ async function resolveSAMLConfig(samlConfig, providerId, baseURL, ctx) {
 			ctx.context.logger.warn("[Dash] SAML IdP metadata uses deprecated algorithms:", providerId, warnings);
 		}
 	}
+	const m = samlConfig.mapping;
+	const resolvedEntryPoint = samlConfig.entryPoint?.trim() || (idpMetadataXml ? extractEntryPointFromSAMLMetadata(idpMetadataXml) : void 0);
+	const saml17OrNewer = isVersionAtLeast(ctx.context.version, "1.7.0");
+	const ba17OrLater = isBetterAuth17OrLater(ctx.context.version);
+	if (saml17OrNewer && !resolvedEntryPoint) throw ctx.error("BAD_REQUEST", { message: "SAML entry point URL is required; provide entryPoint or IdP metadata with SingleSignOnService Location" });
+	if (ba17OrLater && !idpMetadataXml && !samlConfig.entityId?.trim()) throw ctx.error("BAD_REQUEST", { message: "IdP entity ID is required when IdP metadata XML is not provided" });
+	const spIssuer = `${baseURL}/sso/saml2/sp/metadata?providerId=${providerId}`;
 	const idpMetadata = idpMetadataXml ? { metadata: idpMetadataXml } : {
+		...ba17OrLater ? { entityID: samlConfig.entityId } : {},
 		...samlConfig.entryPoint ? { singleSignOnService: [{
 			Binding: "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect",
 			Location: samlConfig.entryPoint
 		}] } : {},
 		...samlConfig.cert ? { cert: samlConfig.cert } : {}
 	};
-	const m = samlConfig.mapping;
-	const resolvedEntryPoint = samlConfig.entryPoint?.trim() || (idpMetadataXml ? extractEntryPointFromSAMLMetadata(idpMetadataXml) : void 0);
-	const saml17OrNewer = isVersionAtLeast(ctx.context.version, "1.7.0");
-	if (saml17OrNewer && !resolvedEntryPoint) throw ctx.error("BAD_REQUEST", { message: "SAML entry point URL is required; provide entryPoint or IdP metadata with SingleSignOnService Location" });
 	return {
 		config: {
-			issuer: samlConfig.entityId ?? `${baseURL}/sso/saml2/sp/metadata?providerId=${providerId}`,
+			issuer: ba17OrLater && !idpMetadataXml ? spIssuer : samlConfig.entityId ?? spIssuer,
 			idpMetadata,
 			...saml17OrNewer ? {
 				entryPoint: resolvedEntryPoint,
@@ -6319,7 +7941,7 @@ async function resolveSAMLConfig(samlConfig, providerId, baseURL, ctx) {
 				cert: samlConfig.cert ?? ""
 			},
 			...m ? { mapping: {
-				id: m.id ?? "nameID",
+				...!ba17OrLater ? { id: m.id ?? "nameID" } : {},
 				email: m.email ?? "email",
 				name: m.name ?? "name",
 				emailVerified: m.emailVerified,
@@ -6335,6 +7957,7 @@ async function resolveOIDCConfig(oidcConfig, _domain, ctx) {
 	if (!oidcConfig.issuer || !oidcConfig.authorizationEndpoint || !oidcConfig.tokenEndpoint || !oidcConfig.jwksEndpoint) throw ctx.error("BAD_REQUEST", { message: "OIDC discovery must be resolved before submitting; provide issuer, authorizationEndpoint, tokenEndpoint, and jwksEndpoint" });
 	const om = oidcConfig.mapping;
 	const discoveryEndpoint = oidcConfig.discoveryEndpoint ?? oidcConfig.discoveryUrl ?? oidcConfig.issuer;
+	const ba17OrLater = isBetterAuth17OrLater(ctx.context.version);
 	return {
 		config: {
 			clientId: oidcConfig.clientId,
@@ -6348,7 +7971,7 @@ async function resolveOIDCConfig(oidcConfig, _domain, ctx) {
 			tokenEndpointAuthentication: oidcConfig.tokenEndpointAuthentication,
 			pkce: true,
 			...om ? { mapping: {
-				id: om.id ?? "sub",
+				...!ba17OrLater ? { id: om.id ?? "sub" } : {},
 				email: om.email ?? "email",
 				name: om.name ?? "name",
 				emailVerified: om.emailVerified,
@@ -6362,7 +7985,7 @@ async function resolveOIDCConfig(oidcConfig, _domain, ctx) {
 const listOrganizationSsoProviders = (options) => {
 	return createAuthEndpoint("/dash/organization/:id/sso-providers", {
 		method: "GET",
-		use: [jwtMiddleware(options, z$1.object({ organizationId: z$1.string() }))]
+		use: [jwtMiddleware(options, z.object({ organizationId: z.string() }))]
 	}, async (ctx) => {
 		if (!isOrganizationEnabled(ctx)) {
 			ctx.context.logger.warn("[Dash] Organization plugin not enabled, returning empty SSO providers list");
@@ -6391,12 +8014,12 @@ const listOrganizationSsoProviders = (options) => {
 const createSsoProvider = (options) => {
 	return createAuthEndpoint("/dash/organization/:id/sso-provider/create", {
 		method: "POST",
-		use: [jwtMiddleware(options, z$1.object({ organizationId: z$1.string() }))],
-		body: z$1.object({
-			providerId: z$1.string(),
-			domain: z$1.string(),
-			protocol: z$1.enum(["SAML", "OIDC"]),
-			userId: z$1.string(),
+		use: [jwtMiddleware(options, z.object({ organizationId: z.string() }))],
+		body: z.object({
+			providerId: z.string(),
+			domain: z.string(),
+			protocol: z.enum(["SAML", "OIDC"]),
+			userId: z.string(),
 			samlConfig: samlConfigSchema.optional(),
 			oidcConfig: oidcConfigSchema.optional()
 		})
@@ -6415,7 +8038,7 @@ const createSsoProvider = (options) => {
 		};
 		if (protocol === "SAML" && samlConfig) {
 			const samlResult = await resolveSAMLConfig(samlConfig, providerId, ctx.context.baseURL, ctx);
-			registerBody.issuer = samlResult.config.issuer ?? (samlConfig.entityId || `${ctx.context.baseURL}/sso/saml2/sp/metadata?providerId=${providerId}`);
+			registerBody.issuer = samlResult.config.issuer;
 			registerBody.samlConfig = samlResult.config;
 		}
 		if (protocol === "OIDC" && oidcConfig) {
@@ -6434,15 +8057,17 @@ const createSsoProvider = (options) => {
 			});
 			let verificationToken = null;
 			if ("domainVerificationToken" in result && typeof result.domainVerificationToken === "string") verificationToken = result.domainVerificationToken;
+			const tokenPrefix = ssoPlugin.options?.domainVerification?.tokenPrefix || "better-auth-token";
+			const resolvedProviderId = result.providerId || providerId;
 			return {
 				success: true,
 				provider: {
 					id: result.providerId,
-					providerId: result.providerId || providerId,
+					providerId: resolvedProviderId,
 					domain: result.domain || domain
 				},
 				domainVerification: {
-					txtRecordName: `better-auth-token-${providerId}`,
+					txtRecordName: `_${tokenPrefix}-${resolvedProviderId}`,
 					verificationToken
 				}
 			};
@@ -6456,11 +8081,11 @@ const createSsoProvider = (options) => {
 const updateSsoProvider = (options) => {
 	return createAuthEndpoint("/dash/organization/:id/sso-provider/update", {
 		method: "POST",
-		use: [jwtMiddleware(options, z$1.object({ organizationId: z$1.string() }))],
-		body: z$1.object({
-			providerId: z$1.string(),
-			domain: z$1.string(),
-			protocol: z$1.enum(["SAML", "OIDC"]),
+		use: [jwtMiddleware(options, z.object({ organizationId: z.string() }))],
+		body: z.object({
+			providerId: z.string(),
+			domain: z.string(),
+			protocol: z.enum(["SAML", "OIDC"]),
 			samlConfig: samlConfigSchema.optional(),
 			oidcConfig: oidcConfigSchema.optional()
 		})
@@ -6486,7 +8111,7 @@ const updateSsoProvider = (options) => {
 		if (domain && domain !== existingProvider.domain) updateBody.domain = domain;
 		if (protocol === "SAML" && samlConfig) {
 			const samlResult = await resolveSAMLConfig(samlConfig, providerId, ctx.context.baseURL, ctx);
-			updateBody.issuer = samlResult.config.issuer ?? (samlConfig.entityId || `${ctx.context.baseURL}/sso/saml2/sp/metadata?providerId=${providerId}`);
+			updateBody.issuer = samlResult.config.issuer;
 			updateBody.samlConfig = samlResult.config;
 		}
 		if (protocol === "OIDC" && oidcConfig) {
@@ -6539,8 +8164,8 @@ const updateSsoProvider = (options) => {
 const requestSsoVerificationToken = (options) => {
 	return createAuthEndpoint("/dash/organization/:id/sso-provider/request-verification-token", {
 		method: "POST",
-		use: [jwtMiddleware(options, z$1.object({ organizationId: z$1.string() }))],
-		body: z$1.object({ providerId: z$1.string() })
+		use: [jwtMiddleware(options, z.object({ organizationId: z.string() }))],
+		body: z.object({ providerId: z.string() })
 	}, async (ctx) => {
 		requireOrganizationPlugin(ctx);
 		requireOrganizationAccess(ctx);
@@ -6561,7 +8186,7 @@ const requestSsoVerificationToken = (options) => {
 			}]
 		});
 		if (!provider) throw ctx.error("NOT_FOUND", { message: "SSO provider not found" });
-		const txtRecordName = `${ssoPlugin.options?.domainVerification?.tokenPrefix || "better-auth-token"}-${provider.providerId}`;
+		const txtRecordName = `_${ssoPlugin.options?.domainVerification?.tokenPrefix || "better-auth-token"}-${provider.providerId}`;
 		try {
 			const result = await endpoints.requestDomainVerification({
 				body: { providerId },
@@ -6587,8 +8212,8 @@ const requestSsoVerificationToken = (options) => {
 const verifySsoProviderDomain = (options) => {
 	return createAuthEndpoint("/dash/organization/:id/sso-provider/verify-domain", {
 		method: "POST",
-		use: [jwtMiddleware(options, z$1.object({ organizationId: z$1.string() }))],
-		body: z$1.object({ providerId: z$1.string() })
+		use: [jwtMiddleware(options, z.object({ organizationId: z.string() }))],
+		body: z.object({ providerId: z.string() })
 	}, async (ctx) => {
 		requireOrganizationPlugin(ctx);
 		requireOrganizationAccess(ctx);
@@ -6623,14 +8248,8 @@ const verifySsoProviderDomain = (options) => {
 			};
 		} catch (e) {
 			if (e instanceof APIError$1) {
-				if (e.status === "CONFLICT") return {
-					verified: true,
-					message: "Domain has already been verified"
-				};
-				if (e.status === "BAD_GATEWAY") return {
-					verified: false,
-					message: "Unable to verify domain ownership. The TXT record was not found. It may take up to 48 hours for DNS changes to propagate."
-				};
+				const mapped = mapSsoVerifyDomainApiError(e);
+				if (mapped) return mapped;
 				throw e;
 			}
 			throw ctx.error("BAD_REQUEST", { message: e instanceof Error ? e.message : "Failed to verify domain" });
@@ -6640,8 +8259,8 @@ const verifySsoProviderDomain = (options) => {
 const deleteSsoProvider = (options) => {
 	return createAuthEndpoint("/dash/organization/:id/sso-provider/delete", {
 		method: "POST",
-		use: [jwtMiddleware(options, z$1.object({ organizationId: z$1.string() }))],
-		body: z$1.object({ providerId: z$1.string() })
+		use: [jwtMiddleware(options, z.object({ organizationId: z.string() }))],
+		body: z.object({ providerId: z.string() })
 	}, async (ctx) => {
 		requireOrganizationPlugin(ctx);
 		requireOrganizationAccess(ctx);
@@ -6683,10 +8302,10 @@ const deleteSsoProvider = (options) => {
 const markSsoProviderDomainVerified = (options) => {
 	return createAuthEndpoint("/dash/organization/:id/sso-provider/mark-domain-verified", {
 		method: "POST",
-		use: [jwtMiddleware(options, z$1.object({ organizationId: z$1.string() }))],
-		body: z$1.object({
-			providerId: z$1.string(),
-			verified: z$1.literal(false).describe("Clears domain verification. Domains can only be marked verified via DNS (verify-domain).")
+		use: [jwtMiddleware(options, z.object({ organizationId: z.string() }))],
+		body: z.object({
+			providerId: z.string(),
+			verified: z.literal(false).describe("Clears domain verification. Domains can only be marked verified via DNS (verify-domain).")
 		})
 	}, async (ctx) => {
 		requireOrganizationPlugin(ctx);
@@ -6782,7 +8401,7 @@ function buildTotpUri(params) {
 //#region src/routes/two-factor/index.ts
 const enableTwoFactor = (options) => createAuthEndpoint("/dash/enable-two-factor", {
 	method: "POST",
-	use: [jwtMiddleware(options, z$1.object({ userId: z$1.string() }))]
+	use: [jwtMiddleware(options, z.object({ userId: z.string() }))]
 }, async (ctx) => {
 	const { userId } = ctx.context.payload;
 	const twoFactorPlugin = ctx.context.getPlugin("two-factor");
@@ -6843,7 +8462,7 @@ const enableTwoFactor = (options) => createAuthEndpoint("/dash/enable-two-factor
 });
 const completeTwoFactorSetup = (options) => createAuthEndpoint("/dash/complete-two-factor-setup", {
 	method: "POST",
-	use: [jwtMiddleware(options, z$1.object({ userId: z$1.string() }))]
+	use: [jwtMiddleware(options, z.object({ userId: z.string() }))]
 }, async (ctx) => {
 	const { userId } = ctx.context.payload;
 	const twoFactorPlugin = ctx.context.getPlugin("two-factor");
@@ -6871,7 +8490,7 @@ const completeTwoFactorSetup = (options) => createAuthEndpoint("/dash/complete-t
 const viewTwoFactorTotpUri = (options) => createAuthEndpoint("/dash/view-two-factor-totp-uri", {
 	method: "POST",
 	metadata: { scope: "http" },
-	use: [jwtMiddleware(options, z$1.object({ userId: z$1.string() }))]
+	use: [jwtMiddleware(options, z.object({ userId: z.string() }))]
 }, async (ctx) => {
 	const { userId } = ctx.context.payload;
 	const twoFactorPlugin = ctx.context.getPlugin("two-factor");
@@ -6909,13 +8528,13 @@ const viewTwoFactorTotpUri = (options) => createAuthEndpoint("/dash/view-two-fac
 });
 const viewBackupCodes = (options) => createAuthEndpoint("/dash/view-backup-codes", {
 	method: "POST",
-	use: [jwtMiddleware(options, z$1.object({ userId: z$1.string() }))]
+	use: [jwtMiddleware(options, z.object({ userId: z.string() }))]
 }, async () => {
 	throw new APIError("FORBIDDEN", { message: "Backup codes cannot be viewed after initial setup. Generate new codes instead." });
 });
 const disableTwoFactor = (options) => createAuthEndpoint("/dash/disable-two-factor", {
 	method: "POST",
-	use: [jwtMiddleware(options, z$1.object({ userId: z$1.string() }))]
+	use: [jwtMiddleware(options, z.object({ userId: z.string() }))]
 }, async (ctx) => {
 	const { userId } = ctx.context.payload;
 	const twoFactorPlugin = ctx.context.getPlugin("two-factor");
@@ -6936,7 +8555,7 @@ const disableTwoFactor = (options) => createAuthEndpoint("/dash/disable-two-fact
 });
 const generateBackupCodes = (options) => createAuthEndpoint("/dash/generate-backup-codes", {
 	method: "POST",
-	use: [jwtMiddleware(options, z$1.object({ userId: z$1.string() }))]
+	use: [jwtMiddleware(options, z.object({ userId: z.string() }))]
 }, async (ctx) => {
 	const { userId } = ctx.context.payload;
 	const twoFactorPlugin = ctx.context.getPlugin("two-factor");
@@ -7001,13 +8620,13 @@ async function resolveTwoFactorStatus(context, userId, user) {
 }
 //#endregion
 //#region src/routes/users/schemas.ts
-const DENIED_USER_WRITE_KEYS = new Set([
+const DENIED_USER_WRITE_KEYS = /* @__PURE__ */ new Set([
 	"id",
 	"createdAt",
 	"updatedAt"
 ]);
 /** Fields that must be changed through dedicated permission-checked endpoints. */
-const DENIED_SENSITIVE_USER_KEYS = new Set([
+const DENIED_SENSITIVE_USER_KEYS = /* @__PURE__ */ new Set([
 	"banned",
 	"banReason",
 	"banExpires",
@@ -7016,7 +8635,7 @@ const DENIED_SENSITIVE_USER_KEYS = new Set([
 	"twoFactorEnabled",
 	"twoFactorSecret"
 ]);
-const CREATE_REQUEST_ONLY_KEYS = new Set([
+const CREATE_REQUEST_ONLY_KEYS = /* @__PURE__ */ new Set([
 	"password",
 	"generatePassword",
 	"sendVerificationEmail",
@@ -7072,7 +8691,7 @@ function getWritableUserFieldNames(options, mode) {
 */
 function pickWritableUserFields(body, options, mode) {
 	const allowed = getWritableUserFieldNames(options, mode);
-	const skip = new Set([
+	const skip = /* @__PURE__ */ new Set([
 		...DENIED_USER_WRITE_KEYS,
 		...DENIED_SENSITIVE_USER_KEYS,
 		...mode === "create" ? CREATE_REQUEST_ONLY_KEYS : []
@@ -7084,32 +8703,32 @@ function pickWritableUserFields(body, options, mode) {
 	}
 	return result;
 }
-const BaseCreateUserCoreBodySchema = z$1.object({
-	name: z$1.string(),
-	email: z$1.email(),
-	image: z$1.string().optional(),
-	password: z$1.string().optional(),
-	generatePassword: z$1.boolean().optional(),
-	emailVerified: z$1.boolean().optional(),
-	sendVerificationEmail: z$1.boolean().optional(),
-	sendOrganizationInvite: z$1.boolean().optional(),
-	organizationRole: z$1.string().optional(),
-	organizationId: z$1.string().optional()
+const BaseCreateUserCoreBodySchema = z.object({
+	name: z.string(),
+	email: z.email(),
+	image: z.string().optional(),
+	password: z.string().optional(),
+	generatePassword: z.boolean().optional(),
+	emailVerified: z.boolean().optional(),
+	sendVerificationEmail: z.boolean().optional(),
+	sendOrganizationInvite: z.boolean().optional(),
+	organizationRole: z.string().optional(),
+	organizationId: z.string().optional()
 });
-const BaseUpdateUserCoreBodySchema = z$1.object({
-	name: z$1.string().nullable().optional(),
-	email: z$1.email().optional(),
-	image: z$1.string().nullable().optional(),
-	emailVerified: z$1.boolean().optional()
+const BaseUpdateUserCoreBodySchema = z.object({
+	name: z.string().nullable().optional(),
+	email: z.email().optional(),
+	image: z.string().nullable().optional(),
+	emailVerified: z.boolean().optional()
 });
-const CreateUserBodySchema = BaseCreateUserCoreBodySchema.catchall(z$1.unknown());
-const UpdateUserBodySchema = BaseUpdateUserCoreBodySchema.catchall(z$1.unknown());
+const CreateUserBodySchema = BaseCreateUserCoreBodySchema.catchall(z.unknown());
+const UpdateUserBodySchema = BaseUpdateUserCoreBodySchema.catchall(z.unknown());
 function createSchemaForDBField(field) {
 	switch (field.type) {
-		case "number": return field.required ? z$1.coerce.number() : z$1.coerce.number().optional();
-		case "boolean": return field.required ? z$1.coerce.boolean() : z$1.coerce.boolean().optional();
-		case "date": return field.required ? z$1.union([z$1.string().min(1), z$1.coerce.date()]) : z$1.union([z$1.string(), z$1.coerce.date()]).optional();
-		default: return field.required ? z$1.string().min(1) : z$1.string().optional();
+		case "number": return field.required ? z.coerce.number() : z.coerce.number().optional();
+		case "boolean": return field.required ? z.coerce.boolean() : z.coerce.boolean().optional();
+		case "date": return field.required ? z.union([z.string().min(1), z.coerce.date()]) : z.union([z.string(), z.coerce.date()]).optional();
+		default: return field.required ? z.string().min(1) : z.string().optional();
 	}
 }
 /**
@@ -7117,38 +8736,38 @@ function createSchemaForDBField(field) {
 */
 function validateWritableCreateUserFields(data, options) {
 	const shape = {
-		name: z$1.string().min(1),
-		email: z$1.email(),
-		image: z$1.string().optional(),
-		emailVerified: z$1.boolean().optional()
+		name: z.string().min(1),
+		email: z.email(),
+		image: z.string().optional(),
+		emailVerified: z.boolean().optional()
 	};
 	for (const [name, field] of Object.entries(getUserInputFields(options))) {
 		if (!isWritableUserInputField(field)) continue;
 		shape[name] = createSchemaForDBField(field);
 	}
-	const result = z$1.object(shape).strict().safeParse(data);
+	const result = z.object(shape).strict().safeParse(data);
 	if (!result.success) throw result.error;
 }
 /**
 * Ensures at least one field is present on update and validates additional field types.
 */
 function validateWritableUserUpdateFields(data, options) {
-	if (Object.keys(data).length === 0) throw new z$1.ZodError([{
+	if (Object.keys(data).length === 0) throw new z.ZodError([{
 		code: "custom",
 		message: "No valid fields to update",
 		path: []
 	}]);
 	const shape = {
-		name: z$1.string().nullable().optional(),
-		email: z$1.email().optional(),
-		image: z$1.string().nullable().optional(),
-		emailVerified: z$1.boolean().optional()
+		name: z.string().nullable().optional(),
+		email: z.email().optional(),
+		image: z.string().nullable().optional(),
+		emailVerified: z.boolean().optional()
 	};
 	for (const [name, field] of Object.entries(getUserInputFields(options))) {
 		if (!isWritableUserInputField(field)) continue;
 		shape[name] = createSchemaForDBField(field);
 	}
-	const result = z$1.object(shape).partial().strict().safeParse(data);
+	const result = z.object(shape).partial().strict().safeParse(data);
 	if (!result.success) throw result.error;
 }
 //#endregion
@@ -7171,13 +8790,13 @@ function clampUserListOffset(value, fallback = 0) {
 	if (!Number.isFinite(n)) return fallback;
 	return Math.max(0, Math.floor(n));
 }
-const getUsersQuerySchema = z$1.object({
-	limit: z$1.number().or(z$1.string().transform(Number)).optional(),
-	offset: z$1.number().or(z$1.string().transform(Number)).optional(),
-	sortBy: z$1.string().optional(),
-	sortOrder: z$1.enum(["asc", "desc"]).optional(),
-	where: z$1.string().transform(parseWhereClause).optional(),
-	countWhere: z$1.string().transform(parseWhereClause).optional()
+const getUsersQuerySchema = z.object({
+	limit: z.number().or(z.string().transform(Number)).optional(),
+	offset: z.number().or(z.string().transform(Number)).optional(),
+	sortBy: z.string().optional(),
+	sortOrder: z.enum(["asc", "desc"]).optional(),
+	where: z.string().transform(parseWhereClause).optional(),
+	countWhere: z.string().transform(parseWhereClause).optional()
 }).optional();
 const getUsers = (options) => {
 	return createAuthEndpoint("/dash/list-users", {
@@ -7214,7 +8833,7 @@ const getUsers = (options) => {
 			model: "user",
 			where: [{
 				field: "lastActiveAt",
-				value: /* @__PURE__ */ new Date(Date.now() - 1e3 * 60 * 2),
+				value: /* @__PURE__ */ new Date(Date.now() - 12e4),
 				operator: "gte"
 			}]
 		}).catch((e) => {
@@ -7272,7 +8891,7 @@ const exportUsers = (options) => {
 const deleteUser = (options) => {
 	return createAuthEndpoint("/dash/delete-user", {
 		method: "POST",
-		use: [jwtMiddleware(options, z$1.object({ userId: z$1.string() }))]
+		use: [jwtMiddleware(options, z.object({ userId: z.string() }))]
 	}, async (ctx) => {
 		try {
 			await ctx.context.adapter.delete({
@@ -7291,7 +8910,7 @@ const deleteUser = (options) => {
 const deleteManyUsers = (options) => {
 	return createAuthEndpoint("/dash/delete-many-users", {
 		method: "POST",
-		use: [jwtMiddleware(options, z$1.object({ userIds: z$1.string().array() }))]
+		use: [jwtMiddleware(options, z.object({ userIds: z.string().array() }))]
 	}, async (ctx) => {
 		const { userIds } = ctx.context.payload;
 		const deletedUserIds = /* @__PURE__ */ new Set();
@@ -7327,11 +8946,11 @@ const deleteManyUsers = (options) => {
 const impersonateUser = (options) => {
 	return createAuthEndpoint("/dash/impersonate-user", {
 		method: "GET",
-		query: z$1.object({ impersonation_token: z$1.string() }),
-		use: [jwtMiddleware(options, z$1.object({
-			userId: z$1.string(),
+		query: z.object({ impersonation_token: z.string() }),
+		use: [jwtMiddleware(options, z.object({
+			userId: z.string(),
 			redirectUrl: safeUrlSchema,
-			impersonatedBy: z$1.string().optional()
+			impersonatedBy: z.string().optional()
 		}), async (ctx) => {
 			return ctx.query.impersonation_token;
 		})]
@@ -7341,7 +8960,7 @@ const impersonateUser = (options) => {
 		const trustedRedirectUrl = parseTrustedAuthRedirectUrl(ctx, redirectUrl);
 		if (!trustedRedirectUrl) throw ctx.error("BAD_REQUEST", { message: "Invalid redirect URL" });
 		const session = await ctx.context.internalAdapter.createSession(userId, true, {
-			expiresAt: new Date(Date.now() + 1e3 * 60 * 10),
+			expiresAt: new Date(Date.now() + 6e5),
 			impersonatedBy: impersonatedBy || void 0
 		});
 		const user = await ctx.context.internalAdapter.findUserById(userId);
@@ -7356,9 +8975,9 @@ const impersonateUser = (options) => {
 const createUser = (options) => {
 	return createAuthEndpoint("/dash/create-user", {
 		method: "POST",
-		use: [jwtMiddleware(options, z$1.object({
-			organizationId: z$1.string().optional(),
-			organizationRole: z$1.string().optional()
+		use: [jwtMiddleware(options, z.object({
+			organizationId: z.string().optional(),
+			organizationRole: z.string().optional()
 		}))],
 		body: CreateUserBodySchema
 	}, async (ctx) => {
@@ -7367,7 +8986,7 @@ const createUser = (options) => {
 		try {
 			validateWritableCreateUserFields(userData, ctx.context.options);
 		} catch (error) {
-			if (error instanceof z$1.ZodError) throw new APIError("BAD_REQUEST", { message: error.issues[0]?.message ?? "Invalid user data" });
+			if (error instanceof z.ZodError) throw new APIError("BAD_REQUEST", { message: error.issues[0]?.message ?? "Invalid user data" });
 			throw error;
 		}
 		const email = normalizeEmail(userData.email, ctx.context);
@@ -7402,10 +9021,8 @@ const createUser = (options) => {
 		};
 		const adapter = ctx.context.internalAdapter;
 		const user = isVersionAtLeast(ctx.context.version, "1.7.0") ? await adapter.createUser(userPayload, { method: "admin" }) : await adapter.createUser(userPayload);
-		if (password) await ctx.context.internalAdapter.createAccount({
+		if (password) await createCredentialAccountCompat(ctx.context.internalAdapter, {
 			userId: user.id,
-			providerId: "credential",
-			accountId: user.id,
 			password: await ctx.context.password.hash(password)
 		});
 		if (body.sendVerificationEmail && !emailVerified) {
@@ -7458,8 +9075,8 @@ const createUser = (options) => {
 const setPassword = (options) => {
 	return createAuthEndpoint("/dash/set-password", {
 		method: "POST",
-		use: [jwtMiddleware(options, z$1.object({ userId: z$1.string() }))],
-		body: z$1.object({ password: z$1.string().min(8) })
+		use: [jwtMiddleware(options, z.object({ userId: z.string() }))],
+		body: z.object({ password: z.string().min(8) })
 	}, async (ctx) => {
 		const { userId } = ctx.context.payload;
 		const { password } = ctx.body;
@@ -7470,10 +9087,8 @@ const setPassword = (options) => {
 			password: hashed,
 			updatedAt: /* @__PURE__ */ new Date()
 		});
-		else await ctx.context.internalAdapter.createAccount({
+		else await createCredentialAccountCompat(ctx.context.internalAdapter, {
 			userId,
-			providerId: "credential",
-			accountId: userId,
 			password: hashed
 		});
 		return { success: true };
@@ -7482,10 +9097,10 @@ const setPassword = (options) => {
 const unlinkAccount = (options) => {
 	return createAuthEndpoint("/dash/unlink-account", {
 		method: "POST",
-		use: [jwtMiddleware(options, z$1.object({ userId: z$1.string() }))],
-		body: z$1.object({
-			providerId: z$1.string(),
-			accountId: z$1.string().optional()
+		use: [jwtMiddleware(options, z.object({ userId: z.string() }))],
+		body: z.object({
+			providerId: z.string(),
+			accountId: z.string()
 		})
 	}, async (ctx) => {
 		const { userId } = ctx.context.payload;
@@ -7494,22 +9109,25 @@ const unlinkAccount = (options) => {
 		const accounts = await ctx.context.internalAdapter.findAccounts(userId);
 		const allowUnlinkingAll = ctx.context.options.account?.accountLinking?.allowUnlinkingAll ?? false;
 		if (accounts.length === 1 && !allowUnlinkingAll) throw new APIError("BAD_REQUEST", { message: "Cannot unlink the last account. This would lock the user out." });
-		const accountToUnlink = accounts.find((account) => accountId ? account.accountId === accountId && account.providerId === providerId : account.providerId === providerId);
+		const accountToUnlink = resolveAccountForUnlink(accounts, {
+			providerId,
+			accountId
+		});
 		if (!accountToUnlink) throw new APIError("NOT_FOUND", { message: "Account not found" });
 		await ctx.context.internalAdapter.deleteAccount(accountToUnlink.id);
 		return { success: true };
 	});
 };
-const getUserDetailsJwtSchema = z$1.object({
-	userId: z$1.string(),
-	sessionOnly: z$1.boolean().optional(),
-	accountOnly: z$1.boolean().optional()
+const getUserDetailsJwtSchema = z.object({
+	userId: z.string(),
+	sessionOnly: z.boolean().optional(),
+	accountOnly: z.boolean().optional()
 });
 const getUserDetails = (options) => {
 	return createAuthEndpoint("/dash/user", {
 		method: "GET",
 		use: [jwtMiddleware(options, getUserDetailsJwtSchema)],
-		query: z$1.object({ minimal: z$1.boolean().or(z$1.string().transform((val) => val === "true")).optional() }).optional()
+		query: z.object({ minimal: z.boolean().or(z.string().transform((val) => val === "true")).optional() }).optional()
 	}, async (ctx) => {
 		const { userId, sessionOnly, accountOnly } = ctx.context.payload;
 		const minimal = !!ctx.query?.minimal;
@@ -7606,7 +9224,7 @@ const getUserDetails = (options) => {
 const getUserOrganizations = (options) => {
 	return createAuthEndpoint("/dash/user-organizations", {
 		method: "GET",
-		use: [jwtMiddleware(options, z$1.object({ userId: z$1.string() }))]
+		use: [jwtMiddleware(options, z.object({ userId: z.string() }))]
 	}, async (ctx) => {
 		const { userId } = ctx.context.payload;
 		if (!isOrganizationEnabled(ctx)) {
@@ -7651,7 +9269,7 @@ const getUserOrganizations = (options) => {
 };
 const updateUser = (options) => createAuthEndpoint("/dash/update-user", {
 	method: "POST",
-	use: [jwtMiddleware(options, z$1.object({ userId: z$1.string() }))],
+	use: [jwtMiddleware(options, z.object({ userId: z.string() }))],
 	body: UpdateUserBodySchema
 }, async (ctx) => {
 	const userId = ctx.context.payload?.userId;
@@ -7660,7 +9278,7 @@ const updateUser = (options) => createAuthEndpoint("/dash/update-user", {
 	try {
 		validateWritableUserUpdateFields(updateData, ctx.context.options);
 	} catch (error) {
-		if (error instanceof z$1.ZodError) throw new APIError("BAD_REQUEST", { message: error.issues[0]?.message ?? "Invalid user data" });
+		if (error instanceof z.ZodError) throw new APIError("BAD_REQUEST", { message: error.issues[0]?.message ?? "Invalid user data" });
 		throw error;
 	}
 	const user = await ctx.context.internalAdapter.updateUser(userId, {
@@ -7746,12 +9364,12 @@ const getUserStats = (options) => createAuthEndpoint("/dash/user-stats", {
 	use: [jwtMiddleware(options)]
 }, async (ctx) => {
 	const now = /* @__PURE__ */ new Date();
-	const oneDayAgo = /* @__PURE__ */ new Date(now.getTime() - 1440 * 60 * 1e3);
-	const twoDaysAgo = /* @__PURE__ */ new Date(now.getTime() - 2880 * 60 * 1e3);
-	const oneWeekAgo = /* @__PURE__ */ new Date(now.getTime() - 10080 * 60 * 1e3);
-	const twoWeeksAgo = /* @__PURE__ */ new Date(now.getTime() - 336 * 60 * 60 * 1e3);
-	const oneMonthAgo = /* @__PURE__ */ new Date(now.getTime() - 720 * 60 * 60 * 1e3);
-	const twoMonthsAgo = /* @__PURE__ */ new Date(now.getTime() - 1440 * 60 * 60 * 1e3);
+	const oneDayAgo = /* @__PURE__ */ new Date(now.getTime() - 864e5);
+	const twoDaysAgo = /* @__PURE__ */ new Date(now.getTime() - 1728e5);
+	const oneWeekAgo = /* @__PURE__ */ new Date(now.getTime() - 6048e5);
+	const twoWeeksAgo = /* @__PURE__ */ new Date(now.getTime() - 12096e5);
+	const oneMonthAgo = /* @__PURE__ */ new Date(now.getTime() - 2592e6);
+	const twoMonthsAgo = /* @__PURE__ */ new Date(now.getTime() - 5184e6);
 	const activityTrackingEnabled = !!options.activityTracking?.enabled;
 	const storeInSecondaryStorageOnly = isSessionInSecondaryStorageOnly(ctx.context);
 	const [rDailySignups, rPrevDaySignups, rWeeklySignups, rPrevWeekSignups, rMonthlySignups, rPrevMonthSignups, rTotalUsers, rActiveDaily, rActivePrevDay, rActiveWeekly, rActivePrevWeek, rActiveMonthly, rActivePrevMonth] = await withConcurrency([
@@ -7886,7 +9504,7 @@ const getUserStats = (options) => createAuthEndpoint("/dash/user-stats", {
 const getUserGraphData = (options) => createAuthEndpoint("/dash/user-graph-data", {
 	method: "GET",
 	use: [jwtMiddleware(options)],
-	query: z$1.object({ period: z$1.enum([
+	query: z.object({ period: z.enum([
 		"daily",
 		"weekly",
 		"monthly"
@@ -7897,7 +9515,7 @@ const getUserGraphData = (options) => createAuthEndpoint("/dash/user-graph-data"
 	const activityTrackingEnabled = !!options.activityTracking?.enabled;
 	const storeInSecondaryStorageOnly = isSessionInSecondaryStorageOnly(ctx.context);
 	const intervals = period === "daily" ? 7 : period === "weekly" ? 8 : 6;
-	const msPerInterval = period === "daily" ? 1440 * 60 * 1e3 : period === "weekly" ? 10080 * 60 * 1e3 : 720 * 60 * 60 * 1e3;
+	const msPerInterval = period === "daily" ? 864e5 : period === "weekly" ? 6048e5 : 2592e6;
 	const intervalData = [];
 	for (let i = intervals - 1; i >= 0; i--) {
 		const endDate = new Date(now.getTime() - i * msPerInterval);
@@ -7958,7 +9576,7 @@ const getUserGraphData = (options) => createAuthEndpoint("/dash/user-graph-data"
 const getUserRetentionData = (options) => createAuthEndpoint("/dash/user-retention-data", {
 	method: "GET",
 	use: [jwtMiddleware(options)],
-	query: z$1.object({ period: z$1.enum([
+	query: z.object({ period: z.enum([
 		"daily",
 		"weekly",
 		"monthly"
@@ -8130,11 +9748,11 @@ const getUserRetentionData = (options) => createAuthEndpoint("/dash/user-retenti
 });
 const banUser = (options) => createAuthEndpoint("/dash/ban-user", {
 	method: "POST",
-	use: [jwtMiddleware(options, z$1.object({ userId: z$1.string() }))],
-	body: z$1.object({
-		banReason: z$1.string().optional(),
-		banExpires: z$1.number().optional(),
-		deleteAllSessions: z$1.boolean().optional().default(true)
+	use: [jwtMiddleware(options, z.object({ userId: z.string() }))],
+	body: z.object({
+		banReason: z.string().optional(),
+		banExpires: z.number().optional(),
+		deleteAllSessions: z.boolean().optional().default(true)
 	})
 }, async (ctx) => {
 	const { userId } = ctx.context.payload;
@@ -8152,11 +9770,11 @@ const banUser = (options) => createAuthEndpoint("/dash/ban-user", {
 const banManyUsers = (options) => {
 	return createAuthEndpoint("/dash/ban-many-users", {
 		method: "POST",
-		use: [jwtMiddleware(options, z$1.object({ userIds: z$1.string().array() }))],
-		body: z$1.object({
-			banReason: z$1.string().optional(),
-			banExpires: z$1.number().optional(),
-			deleteAllSessions: z$1.boolean().optional().default(true)
+		use: [jwtMiddleware(options, z.object({ userIds: z.string().array() }))],
+		body: z.object({
+			banReason: z.string().optional(),
+			banExpires: z.number().optional(),
+			deleteAllSessions: z.boolean().optional().default(true)
 		})
 	}, async (ctx) => {
 		const { userIds } = ctx.context.payload;
@@ -8206,7 +9824,7 @@ const banManyUsers = (options) => {
 };
 const unbanUser = (options) => createAuthEndpoint("/dash/unban-user", {
 	method: "POST",
-	use: [jwtMiddleware(options, z$1.object({ userId: z$1.string() }))]
+	use: [jwtMiddleware(options, z.object({ userId: z.string() }))]
 }, async (ctx) => {
 	const { userId } = ctx.context.payload;
 	if (!await ctx.context.internalAdapter.findUserById(userId)) throw new APIError("NOT_FOUND", { message: "User not found" });
@@ -8220,8 +9838,8 @@ const unbanUser = (options) => createAuthEndpoint("/dash/unban-user", {
 });
 const sendVerificationEmail = (options) => createAuthEndpoint("/dash/send-verification-email", {
 	method: "POST",
-	use: [jwtMiddleware(options, z$1.object({ userId: z$1.string() }))],
-	body: z$1.object({ callbackUrl: safeUrlSchema })
+	use: [jwtMiddleware(options, z.object({ userId: z.string() }))],
+	body: z.object({ callbackUrl: safeUrlSchema })
 }, async (ctx) => {
 	const { userId } = ctx.context.payload;
 	const callbackUrl = requireTrustedAuthCallbackUrl(ctx, ctx.body.callbackUrl);
@@ -8230,20 +9848,21 @@ const sendVerificationEmail = (options) => createAuthEndpoint("/dash/send-verifi
 	if (user.emailVerified) throw ctx.error("BAD_REQUEST", { message: "Email is already verified" });
 	if (!user.email) throw ctx.error("BAD_REQUEST", { message: "User has no associated email address" });
 	if (!ctx.context.options.emailVerification?.sendVerificationEmail) throw ctx.error("BAD_REQUEST", { message: "Email verification is not enabled" });
-	await sendVerificationEmailFn({
+	const modifiedCtx = {
 		...ctx,
 		body: {
 			...ctx.body,
 			callbackURL: callbackUrl
 		}
-	}, user);
+	};
+	await sendVerificationEmailFn(modifiedCtx, user);
 	return { success: true };
 });
 const sendManyVerificationEmails = (options) => {
 	return createAuthEndpoint("/dash/send-many-verification-emails", {
 		method: "POST",
-		use: [jwtMiddleware(options, z$1.object({ userIds: z$1.string().array() }))],
-		body: z$1.object({ callbackUrl: safeUrlSchema })
+		use: [jwtMiddleware(options, z.object({ userIds: z.string().array() }))],
+		body: z.object({ callbackUrl: safeUrlSchema })
 	}, async (ctx) => {
 		if (!ctx.context.options.emailVerification?.sendVerificationEmail) throw ctx.error("BAD_REQUEST", { message: "Email verification is not enabled" });
 		const { userIds } = ctx.context.payload;
@@ -8287,9 +9906,10 @@ const sendManyVerificationEmails = (options) => {
 					success: true,
 					id: user.id
 				};
-			}))) if (result.status === "fulfilled") if (result.value.success) sentEmailUserIds.add(result.value.id);
-			else skippedEmailUserIds.add(result.value.id);
-			else for (const { id } of users) skippedEmailUserIds.add(id);
+			}))) if (result.status === "fulfilled") {
+				if (result.value.success) sentEmailUserIds.add(result.value.id);
+				else skippedEmailUserIds.add(result.value.id);
+			} else for (const { id } of users) skippedEmailUserIds.add(id);
 		}, { concurrency: 2 });
 		const end = performance.now();
 		console.log(`Time taken to send verification emails to ${sentEmailUserIds.size} users: ${Math.round((end - start) / 1e3)}s`, skippedEmailUserIds.size > 0 ? `Skipped: ${skippedEmailUserIds.size}` : "");
@@ -8302,8 +9922,8 @@ const sendManyVerificationEmails = (options) => {
 };
 const sendResetPasswordEmail = (options) => createAuthEndpoint("/dash/send-reset-password-email", {
 	method: "POST",
-	use: [jwtMiddleware(options, z$1.object({ userId: z$1.string() }))],
-	body: z$1.object({ callbackUrl: safeUrlSchema })
+	use: [jwtMiddleware(options, z.object({ userId: z.string() }))],
+	body: z.object({ callbackUrl: safeUrlSchema })
 }, async (ctx) => {
 	const { userId } = ctx.context.payload;
 	const callbackUrl = requireTrustedAuthCallbackUrl(ctx, ctx.body.callbackUrl);
@@ -8316,19 +9936,17 @@ const sendResetPasswordEmail = (options) => createAuthEndpoint("/dash/send-reset
 });
 //#endregion
 //#region src/pow.ts
+/**
+* Proof of Work Challenge System - Client Side
+*
+* Client-side PoW solver and encoding utilities.
+* Server-side challenge generation and verification moved to Infra API.
+*/
 /** Default difficulty in bits (18 = ~500ms solve time) */
 const DEFAULT_DIFFICULTY = 18;
 /** Challenge TTL in seconds */
 const CHALLENGE_TTL = 60;
 /**
-* SHA-256 hash function that works in both Node.js and browser
-*/
-async function sha256(message) {
-	const msgBuffer = new TextEncoder().encode(message);
-	const hashBuffer = await crypto.subtle.digest("SHA-256", msgBuffer);
-	return Array.from(new Uint8Array(hashBuffer)).map((b) => b.toString(16).padStart(2, "0")).join("");
-}
-/**
 * Check if a hash has the required number of leading zero bits
 */
 function hasLeadingZeroBits(hash, bits) {
@@ -8348,7 +9966,8 @@ async function solvePoWChallenge(challenge) {
 	const { nonce, difficulty } = challenge;
 	let counter = 0;
 	while (true) {
-		if (hasLeadingZeroBits(await sha256(`${nonce}:${counter}`), difficulty)) return {
+		const input = `${nonce}:${counter}`;
+		if (hasLeadingZeroBits(await hash$1(input), difficulty)) return {
 			nonce,
 			counter
 		};
@@ -8378,7 +9997,8 @@ function encodePoWSolution(solution) {
 * Verify a PoW solution locally (for testing purposes)
 */
 async function verifyPoWSolution(nonce, counter, difficulty) {
-	return hasLeadingZeroBits(await sha256(`${nonce}:${counter}`), difficulty);
+	const input = `${nonce}:${counter}`;
+	return hasLeadingZeroBits(await hash$1(input), difficulty);
 }
 //#endregion
 //#region src/sms.ts
@@ -8412,7 +10032,7 @@ function createSMSSender(config) {
 			"user-agent": INFRA_USER_AGENT,
 			Authorization: `Bearer ${apiKey}`
 		},
-		timeout: config?.apiTimeout ?? 3e3
+		timeout: config?.apiOptions?.timeout ?? config?.apiTimeout ?? 3e3
 	});
 	/**
 	* Send an SMS with OTP code
@@ -8491,6 +10111,18 @@ async function sendSMS(options, config) {
 }
 //#endregion
 //#region src/index.ts
+/**
+* Stashed when session.create after runs before newSession/returned user is
+* available (1.7+ / better-auth#10473). Avoids a fallback user DB lookup by
+* flushing tracking once the endpoint after hook can resolve the user.
+*/
+const PENDING_SESSION_TRACKING = Symbol.for("dash.pendingSessionTracking");
+function getPendingSessionTracking(ctx) {
+	return ctx.context[PENDING_SESSION_TRACKING];
+}
+function setPendingSessionTracking(ctx, pending) {
+	ctx.context[PENDING_SESSION_TRACKING] = pending;
+}
 async function getRequestLocation() {
 	try {
 		return (await getCurrentAuthContext()).context.location;
@@ -8506,7 +10138,11 @@ const dash = (options) => {
 		...opts,
 		$api
 	};
-	const $kv = createKV(opts);
+	const $kv = createKV({
+		kvUrl: opts.kvUrl,
+		apiKey: opts.apiKey,
+		timeout: opts.kvOptions.timeout
+	});
 	const activityUpdateInterval = opts.activityTracking?.updateInterval ?? 3e5;
 	const scheduleLastActiveUpdate = async (ctx, userId) => {
 		await ctx.context.runInBackgroundOrAwait(ctx.context.adapter.updateMany({
@@ -8523,6 +10159,21 @@ const dash = (options) => {
 	const { tracker } = initTrackEvents($api);
 	const { trackUserSignedUp, trackUserProfileUpdated, trackUserProfileImageUpdated, trackUserEmailVerified, trackUserBanned, trackUserUnBanned, trackUserDeleted } = initUserEvents(tracker);
 	const { trackEmailVerificationSent, trackEmailSignInAttempt, trackUserSignedIn, trackUserSignedOut, trackSessionCreated, trackSocialSignInAttempt, trackSocialSignInRedirectionAttempt, trackUserImpersonated, trackUserImpersonationStop, trackSessionRevoked, trackSessionRevokedAll } = initSessionEvents(tracker);
+	const trackSessionLifecycle = (enrichedSession, userId, ctx, location, eventUser, trackSignIn, impersonatedBy) => {
+		let trigger = null;
+		if (trackSignIn) {
+			trigger = getTriggerInfo(ctx, userId, enrichedSession);
+			trackUserSignedIn(enrichedSession, trigger, ctx, location, eventUser);
+		} else trigger = getTriggerInfo(ctx, userId);
+		trackSessionCreated(enrichedSession, trigger, ctx, location, eventUser);
+		if (impersonatedBy) {
+			trigger = {
+				...trigger,
+				triggeredBy: impersonatedBy
+			};
+			trackUserImpersonated(enrichedSession, trigger, ctx, location, eventUser, resolveUserFromContext(impersonatedBy, ctx));
+		}
+	};
 	const { trackAccountLinking, trackAccountUnlink, trackAccountPasswordChange } = initAccountEvents(tracker);
 	const { trackPasswordResetRequest, trackPasswordResetRequestCompletion } = initVerificationEvents(tracker);
 	const { trackOrganizationCreated, trackOrganizationUpdated } = initOrganizationEvents(tracker);
@@ -8542,90 +10193,130 @@ const dash = (options) => {
 					const afterCreateOrganization = organizationHooks.afterCreateOrganization;
 					organizationHooks.afterCreateOrganization = async (...args) => {
 						const [{ organization, user }] = args;
-						trackOrganizationCreated(organization, getOrganizationTriggerInfo(user), await getRequestLocation());
+						const trigger = getOrganizationTriggerInfo(user);
+						const location = await getRequestLocation();
+						trackOrganizationCreated(organization, trigger, location);
 						if (afterCreateOrganization) return afterCreateOrganization(...args);
 					};
 					const afterUpdateOrganization = organizationHooks.afterUpdateOrganization;
 					organizationHooks.afterUpdateOrganization = async (...args) => {
 						const [{ organization, user }] = args;
-						if (organization) trackOrganizationUpdated(organization, getOrganizationTriggerInfo(user), await getRequestLocation());
+						if (organization) {
+							const trigger = getOrganizationTriggerInfo(user);
+							const location = await getRequestLocation();
+							trackOrganizationUpdated(organization, trigger, location);
+						}
 						if (afterUpdateOrganization) return afterUpdateOrganization(...args);
 					};
 					const afterAddMember = organizationHooks.afterAddMember;
 					organizationHooks.afterAddMember = async (...args) => {
 						const [{ organization, member, user }] = args;
-						trackOrganizationMemberAdded(organization, member, user, getOrganizationTriggerInfo(user), await getRequestLocation());
+						const trigger = getOrganizationTriggerInfo(user);
+						const location = await getRequestLocation();
+						trackOrganizationMemberAdded(organization, member, user, trigger, location);
 						if (afterAddMember) return afterAddMember(...args);
 					};
 					const afterRemoveMember = organizationHooks.afterRemoveMember;
 					organizationHooks.afterRemoveMember = async (...args) => {
 						const [{ organization, member, user }] = args;
-						trackOrganizationMemberRemoved(organization, member, user, getOrganizationTriggerInfo(user), await getRequestLocation());
+						const trigger = getOrganizationTriggerInfo(user);
+						const location = await getRequestLocation();
+						trackOrganizationMemberRemoved(organization, member, user, trigger, location);
 						if (afterRemoveMember) return afterRemoveMember(...args);
 					};
 					const afterUpdateMemberRole = organizationHooks.afterUpdateMemberRole;
 					organizationHooks.afterUpdateMemberRole = async (...args) => {
 						const [{ organization, member, user, previousRole }] = args;
-						trackOrganizationMemberRoleUpdated(organization, member, user, previousRole, getOrganizationTriggerInfo(user), await getRequestLocation());
+						const trigger = getOrganizationTriggerInfo(user);
+						const location = await getRequestLocation();
+						trackOrganizationMemberRoleUpdated(organization, member, user, previousRole, trigger, location);
 						if (afterUpdateMemberRole) return afterUpdateMemberRole(...args);
 					};
 					const afterCreateInvitation = organizationHooks.afterCreateInvitation;
 					organizationHooks.afterCreateInvitation = async (...args) => {
 						const [{ organization, invitation, inviter }] = args;
-						trackOrganizationMemberInvited(organization, invitation, inviter, getOrganizationTriggerInfo(inviter), await getRequestLocation());
+						const trigger = getOrganizationTriggerInfo(inviter);
+						const location = await getRequestLocation();
+						trackOrganizationMemberInvited(organization, invitation, inviter, trigger, location);
 						if (afterCreateInvitation) return afterCreateInvitation(...args);
 					};
 					const afterAcceptInvitation = organizationHooks.afterAcceptInvitation;
 					organizationHooks.afterAcceptInvitation = async (...args) => {
 						const [{ organization, invitation, member, user }] = args;
-						trackOrganizationMemberInviteAccepted(organization, invitation, member, user, getOrganizationTriggerInfo(user), await getRequestLocation());
+						const trigger = getOrganizationTriggerInfo(user);
+						const location = await getRequestLocation();
+						trackOrganizationMemberInviteAccepted(organization, invitation, member, user, trigger, location);
 						if (afterAcceptInvitation) return afterAcceptInvitation(...args);
 					};
 					const afterRejectInvitation = organizationHooks.afterRejectInvitation;
 					organizationHooks.afterRejectInvitation = async (...args) => {
 						const [{ organization, invitation, user }] = args;
-						trackOrganizationMemberInviteRejected(organization, invitation, user, getOrganizationTriggerInfo(user), await getRequestLocation());
+						const trigger = getOrganizationTriggerInfo(user);
+						const location = await getRequestLocation();
+						trackOrganizationMemberInviteRejected(organization, invitation, user, trigger, location);
 						if (afterRejectInvitation) return afterRejectInvitation(...args);
 					};
 					const afterCancelInvitation = organizationHooks.afterCancelInvitation;
 					organizationHooks.afterCancelInvitation = async (...args) => {
 						const [{ organization, invitation, cancelledBy }] = args;
-						trackOrganizationMemberInviteCanceled(organization, invitation, cancelledBy, getOrganizationTriggerInfo(cancelledBy), await getRequestLocation());
+						const trigger = getOrganizationTriggerInfo(cancelledBy);
+						const location = await getRequestLocation();
+						trackOrganizationMemberInviteCanceled(organization, invitation, cancelledBy, trigger, location);
 						if (afterCancelInvitation) return afterCancelInvitation(...args);
 					};
 					const afterCreateTeam = organizationHooks.afterCreateTeam;
 					organizationHooks.afterCreateTeam = async (...args) => {
 						const [{ organization, team, user }] = args;
-						trackOrganizationTeamCreated(organization, team, getOrganizationTriggerInfo(user), await getRequestLocation());
+						const trigger = getOrganizationTriggerInfo(user);
+						const location = await getRequestLocation();
+						trackOrganizationTeamCreated(organization, team, trigger, location);
 						if (afterCreateTeam) return afterCreateTeam(...args);
 					};
 					const afterUpdateTeam = organizationHooks.afterUpdateTeam;
 					organizationHooks.afterUpdateTeam = async (...args) => {
 						const [{ organization, team, user }] = args;
-						if (team) trackOrganizationTeamUpdated(organization, team, getOrganizationTriggerInfo(user), await getRequestLocation());
+						if (team) {
+							const trigger = getOrganizationTriggerInfo(user);
+							const location = await getRequestLocation();
+							trackOrganizationTeamUpdated(organization, team, trigger, location);
+						}
 						if (afterUpdateTeam) return afterUpdateTeam(...args);
 					};
 					const afterDeleteTeam = organizationHooks.afterDeleteTeam;
 					organizationHooks.afterDeleteTeam = async (...args) => {
 						const [{ organization, team, user }] = args;
-						trackOrganizationTeamDeleted(organization, team, getOrganizationTriggerInfo(user), await getRequestLocation());
+						const trigger = getOrganizationTriggerInfo(user);
+						const location = await getRequestLocation();
+						trackOrganizationTeamDeleted(organization, team, trigger, location);
 						if (afterDeleteTeam) return afterDeleteTeam(...args);
 					};
 					const afterAddTeamMember = organizationHooks.afterAddTeamMember;
 					organizationHooks.afterAddTeamMember = async (...args) => {
 						const [{ organization, team, user, teamMember }] = args;
-						trackOrganizationTeamMemberAdded(organization, team, user, teamMember, getOrganizationTriggerInfo(user), await getRequestLocation());
+						const trigger = getOrganizationTriggerInfo(user);
+						const location = await getRequestLocation();
+						trackOrganizationTeamMemberAdded(organization, team, user, teamMember, trigger, location);
 						if (afterAddTeamMember) return afterAddTeamMember(...args);
 					};
 					const afterRemoveTeamMember = organizationHooks.afterRemoveTeamMember;
 					organizationHooks.afterRemoveTeamMember = async (...args) => {
 						const [{ organization, team, user, teamMember }] = args;
-						trackOrganizationTeamMemberRemoved(organization, team, user, teamMember, getOrganizationTriggerInfo(user), await getRequestLocation());
+						const trigger = getOrganizationTriggerInfo(user);
+						const location = await getRequestLocation();
+						trackOrganizationTeamMemberRemoved(organization, team, user, teamMember, trigger, location);
 						if (afterRemoveTeamMember) return afterRemoveTeamMember(...args);
 					};
 				};
 				instrumentOrganizationHooks(organizationPlugin.options = organizationPlugin.options ?? {});
 			} else logger.debug("[Dash] Organization plugin not active. Skipping instrumentation");
+			const managedDirectorySync = opts.managedDirectorySync;
+			if (managedDirectorySync?.enabled) instrumentDirectorySyncIntegration(ctx, {
+				ssoPairing: managedDirectorySync.ssoPairing ?? true,
+				membershipProjection: {
+					enabled: managedDirectorySync.membershipProjection?.enabled ?? true,
+					role: managedDirectorySync.membershipProjection?.role ?? "member"
+				}
+			});
 			return { options: {
 				databaseHooks: {
 					user: {
@@ -8687,25 +10378,25 @@ const dash = (options) => {
 									countryCode: location?.countryCode
 								};
 								const eventUser = resolveUserFromContext(session.userId, ctx);
-								let trigger = null;
-								if (matchesAnyRoute(ctx.path, [
+								const trackSignIn = matchesAnyRoute(ctx.path, [
 									routes.SIGN_IN,
 									routes.SIGN_UP,
 									routes.SIGN_IN_SOCIAL_CALLBACK,
 									routes.SIGN_IN_OAUTH_CALLBACK
-								])) {
-									trigger = getTriggerInfo(ctx, session.userId, enrichedSession);
-									trackUserSignedIn(enrichedSession, trigger, ctx, location, eventUser);
-								} else trigger = getTriggerInfo(ctx, session.userId);
-								trackSessionCreated(enrichedSession, trigger, ctx, location, eventUser);
-								if ("impersonatedBy" in session && session.impersonatedBy) {
-									trigger = {
-										...trigger,
-										triggeredBy: session.impersonatedBy
-									};
-									const knownImpersonator = resolveUserFromContext(session.impersonatedBy, ctx);
-									trackUserImpersonated(enrichedSession, trigger, ctx, location, eventUser, knownImpersonator);
+								]);
+								const impersonatedBy = "impersonatedBy" in session && session.impersonatedBy ? session.impersonatedBy : void 0;
+								if (!eventUser) {
+									setPendingSessionTracking(ctx, {
+										enrichedSession,
+										location,
+										userId: session.userId,
+										trackSignIn,
+										impersonatedBy
+									});
+									if (opts.activityTracking?.enabled) await scheduleLastActiveUpdate(ctx, session.userId);
+									return;
 								}
+								trackSessionLifecycle(enrichedSession, session.userId, ctx, location, eventUser, trackSignIn, impersonatedBy);
 								if (opts.activityTracking?.enabled) await scheduleLastActiveUpdate(ctx, session.userId);
 							}
 						},
@@ -8735,7 +10426,10 @@ const dash = (options) => {
 								}
 							} else if (matchesAnyRoute(path, [routes.SIGN_OUT])) trackUserSignedOut(enrichedSession, trigger, ctx, location, eventUser);
 							else trackSessionRevoked(enrichedSession, trigger, ctx, location, eventUser);
-							if ("impersonatedBy" in session && session.impersonatedBy) trackUserImpersonationStop(enrichedSession, trigger, ctx, location, eventUser, resolveUserFromContext(session.impersonatedBy, ctx));
+							if ("impersonatedBy" in session && session.impersonatedBy) {
+								const knownImpersonator = resolveUserFromContext(session.impersonatedBy, ctx);
+								trackUserImpersonationStop(enrichedSession, trigger, ctx, location, eventUser, knownImpersonator);
+							}
 						} }
 					},
 					account: {
@@ -8774,14 +10468,16 @@ const dash = (options) => {
 							const ctx = _ctx;
 							if (!ctx) return;
 							const path = ctx.path;
-							const trigger = getTriggerInfo(ctx, ctx.context.session?.user.id ?? "unknown");
+							const maybeUserId = ctx.context.session?.user.id ?? "unknown";
+							const trigger = getTriggerInfo(ctx, maybeUserId);
 							const location = ctx.context.location;
 							if (matchesAnyRoute(path, [routes.REQUEST_PASSWORD_RESET])) trackPasswordResetRequest(verification, trigger, ctx, location);
 						} },
 						delete: { async after(verification, ctx) {
 							if (!ctx) return;
 							const path = ctx.path;
-							const trigger = getTriggerInfo(ctx, ctx.context.session?.user.id ?? "unknown");
+							const maybeUserId = ctx.context.session?.user.id ?? "unknown";
+							const trigger = getTriggerInfo(ctx, maybeUserId);
 							const location = ctx.context.location;
 							if (matchesAnyRoute(path, [routes.RESET_PASSWORD])) trackPasswordResetRequestCompletion(verification, trigger, ctx, location);
 						} }
@@ -8804,53 +10500,68 @@ const dash = (options) => {
 						routes.DASH_COMPLETE_INVITATION_SOCIAL
 					]);
 				},
-				handler: createIdentificationMiddleware($kv, { skipIdentification: (ctx) => isDashRoute(ctx.path) })
+				handler: createIdentificationMiddleware($kv, {
+					skipIdentification: (ctx) => isDashRoute(ctx.path),
+					retry: opts.kvOptions.retry
+				})
 			}],
-			after: [{
-				matcher: (ctx) => {
-					if (ctx.request?.method !== "GET") return true;
-					return matchesAnyRoute(ctx.path, [
-						routes.SIGN_IN_SOCIAL_CALLBACK,
-						routes.SIGN_IN_OAUTH_CALLBACK,
-						routes.DASH_IMPERSONATE_USER
-					]);
+			after: [
+				{
+					matcher: (ctx) => !!getPendingSessionTracking(ctx),
+					handler: createAuthMiddleware(async (ctx) => {
+						const pending = getPendingSessionTracking(ctx);
+						if (!pending) return;
+						trackSessionLifecycle(pending.enrichedSession, pending.userId, ctx, pending.location, resolveUserFromContext(pending.userId, ctx), pending.trackSignIn, pending.impersonatedBy);
+					})
 				},
-				handler: createAuthMiddleware(async (_ctx) => {
-					const ctx = _ctx;
-					const trigger = getTriggerInfo(ctx, ctx.context.session?.user.id ?? "unknown");
-					if (matchesAnyRoute(ctx.path, [routes.SEND_VERIFICATION_EMAIL, routes.DASH_SEND_VERIFICATION_EMAIL]) && ctx.context.session && !(ctx.context.returned instanceof Error)) trackEmailVerificationSent(ctx.context.session.session, ctx.context.session.user, trigger, ctx.context.location);
-					const body = ctx.body;
-					if (matchesAnyRoute(ctx.path, [routes.SIGN_IN_EMAIL, routes.SIGN_IN_EMAIL_OTP]) && ctx.context.returned instanceof Error && body?.email) trackEmailSignInAttempt(ctx, trigger, ctx.context.location);
-					if (matchesAnyRoute(ctx.path, [routes.SIGN_IN_SOCIAL]) && ctx.context.returned instanceof Error && ctx.body.provider && ctx.body.idToken) trackSocialSignInAttempt(ctx, trigger, ctx.context.location);
-					if (matchesAnyRoute(ctx.path, [routes.SIGN_IN_SOCIAL_CALLBACK, routes.SIGN_IN_OAUTH_CALLBACK]) && ctx.request?.method === "GET" && !ctx.context.newSession) trackSocialSignInRedirectionAttempt(ctx, trigger, ctx.context.location);
-					const headerRequestId = ctx.request?.headers.get("X-Request-Id");
-					if (headerRequestId) ctx.setCookie(IDENTIFICATION_COOKIE_NAME, headerRequestId, {
-						maxAge: 600,
-						sameSite: "lax",
-						httpOnly: true,
-						path: "/"
-					});
-					else if (ctx.context.requestId) ctx.setCookie(IDENTIFICATION_COOKIE_NAME, "", {
-						maxAge: 0,
-						path: "/"
-					});
-				})
-			}, {
-				handler: createAuthMiddleware(async (ctx) => {
-					if (!opts.activityTracking?.enabled) return;
-					if (activityUpdateInterval === 0) return;
-					const session = ctx.context.session || ctx.context.newSession;
-					if (!session?.user?.id) return;
-					const userId = session.user.id;
-					const now = Date.now();
-					const lastUpdate = session.user.lastActiveAt;
-					if (lastUpdate) {
-						if (now - new Date(lastUpdate).getTime() < activityUpdateInterval) return;
-					}
-					await scheduleLastActiveUpdate(ctx, userId);
-				}),
-				matcher: (ctx) => ctx.request?.method !== "GET"
-			}]
+				{
+					matcher: (ctx) => {
+						if (ctx.request?.method !== "GET") return true;
+						return matchesAnyRoute(ctx.path, [
+							routes.SIGN_IN_SOCIAL_CALLBACK,
+							routes.SIGN_IN_OAUTH_CALLBACK,
+							routes.DASH_IMPERSONATE_USER
+						]);
+					},
+					handler: createAuthMiddleware(async (_ctx) => {
+						const ctx = _ctx;
+						const maybeUserId = ctx.context.session?.user.id ?? "unknown";
+						const trigger = getTriggerInfo(ctx, maybeUserId);
+						if (matchesAnyRoute(ctx.path, [routes.SEND_VERIFICATION_EMAIL, routes.DASH_SEND_VERIFICATION_EMAIL]) && ctx.context.session && !(ctx.context.returned instanceof Error)) trackEmailVerificationSent(ctx.context.session.session, ctx.context.session.user, trigger, ctx.context.location);
+						const body = ctx.body;
+						if (matchesAnyRoute(ctx.path, [routes.SIGN_IN_EMAIL, routes.SIGN_IN_EMAIL_OTP]) && ctx.context.returned instanceof Error && body?.email) trackEmailSignInAttempt(ctx, trigger, ctx.context.location);
+						if (matchesAnyRoute(ctx.path, [routes.SIGN_IN_SOCIAL]) && ctx.context.returned instanceof Error && ctx.body.provider && ctx.body.idToken) trackSocialSignInAttempt(ctx, trigger, ctx.context.location);
+						if (matchesAnyRoute(ctx.path, [routes.SIGN_IN_SOCIAL_CALLBACK, routes.SIGN_IN_OAUTH_CALLBACK]) && ctx.request?.method === "GET" && !ctx.context.newSession) trackSocialSignInRedirectionAttempt(ctx, trigger, ctx.context.location);
+						const headerRequestId = ctx.request?.headers.get("X-Request-Id");
+						if (headerRequestId) ctx.setCookie(IDENTIFICATION_COOKIE_NAME, headerRequestId, {
+							maxAge: 600,
+							sameSite: "lax",
+							httpOnly: true,
+							path: "/"
+						});
+						else if (ctx.context.requestId) ctx.setCookie(IDENTIFICATION_COOKIE_NAME, "", {
+							maxAge: 0,
+							path: "/"
+						});
+					})
+				},
+				{
+					handler: createAuthMiddleware(async (ctx) => {
+						if (!opts.activityTracking?.enabled) return;
+						if (activityUpdateInterval === 0) return;
+						const session = ctx.context.session || ctx.context.newSession;
+						if (!session?.user?.id) return;
+						const userId = session.user.id;
+						const now = Date.now();
+						const lastUpdate = session.user.lastActiveAt;
+						if (lastUpdate) {
+							if (now - new Date(lastUpdate).getTime() < activityUpdateInterval) return;
+						}
+						await scheduleLastActiveUpdate(ctx, userId);
+					}),
+					matcher: (ctx) => ctx.request?.method !== "GET"
+				}
+			]
 		},
 		endpoints: {
 			getDashConfig: getConfig(settings),
@@ -8925,15 +10636,178 @@ const dash = (options) => {
 			dashCompleteInvitationSocial: completeInvitationSocial(settings),
 			dashCheckUserExists: checkUserExists(settings),
 			listDashOrganizationDirectories: listOrganizationDirectories(settings),
-			createDashOrganizationDirectory: createOrganizationDirectory(settings),
-			deleteDashOrganizationDirectory: deleteOrganizationDirectory(settings),
-			regenerateDashDirectoryToken: regenerateDirectoryToken(settings),
+			createDashOrganizationDirectory: createOrganizationDirectoryLegacy(settings),
+			deleteDashOrganizationDirectory: deleteOrganizationDirectoryLegacy(settings),
+			regenerateDashDirectoryToken: regenerateDirectoryTokenLegacy(settings),
+			getDashManagedOrganizationDirectory: getOrganizationDirectory(settings),
+			createDashManagedOrganizationDirectory: createOrganizationDirectory(settings),
+			rotateDashManagedDirectoryCredential: rotateDirectoryCredential(settings),
+			revokeDashManagedDirectoryCredential: revokeDirectoryCredential(settings),
+			listDashManagedDirectoryEvents: listDirectoryEvents(settings),
+			decommissionDashManagedOrganizationDirectory: decommissionOrganizationDirectory(settings),
+			unpairDashManagedOrganizationDirectory: unpairOrganizationDirectory(settings),
 			dashExecuteAdapter: executeAdapter(settings)
 		},
-		schema: opts.activityTracking?.enabled ? { user: { fields: { lastActiveAt: {
-			type: "date",
-			required: false
-		} } } } : {}
+		schema: {
+			...opts.activityTracking?.enabled ? { user: { fields: { lastActiveAt: {
+				type: "date",
+				required: false
+			} } } } : {},
+			...opts.managedDirectorySync?.enabled ? {
+				directorySyncConnection: { fields: {
+					organizationId: {
+						type: "string",
+						required: true,
+						index: true
+					},
+					providerId: {
+						type: "string",
+						required: true
+					},
+					aliasKey: {
+						type: "string",
+						required: true,
+						unique: true,
+						returned: false
+					},
+					provisioningDomainId: {
+						type: "string",
+						required: true,
+						unique: true
+					},
+					activeOrganizationKey: {
+						type: "string",
+						required: true,
+						unique: true,
+						returned: false
+					},
+					connectionId: {
+						type: "string",
+						required: false,
+						unique: true
+					},
+					creationRequestId: {
+						type: "string",
+						required: true,
+						unique: true,
+						returned: false
+					},
+					status: {
+						type: "string",
+						required: true
+					},
+					revision: {
+						type: "number",
+						required: true,
+						defaultValue: 0,
+						returned: false
+					},
+					createdAt: {
+						type: "date",
+						required: true
+					},
+					createdByActorId: {
+						type: "string",
+						required: true
+					},
+					updatedAt: {
+						type: "date",
+						required: true
+					},
+					lastActorId: {
+						type: "string",
+						required: true
+					},
+					ssoProviderId: {
+						type: "string",
+						required: false
+					},
+					ssoProviderRecordId: {
+						type: "string",
+						required: false,
+						index: true
+					},
+					activeSsoProviderKey: {
+						type: "string",
+						required: true,
+						unique: true,
+						returned: false
+					},
+					serializedSsoPairing: {
+						type: "string",
+						required: false,
+						returned: false
+					},
+					pairingEnforced: {
+						type: "boolean",
+						required: true,
+						defaultValue: false
+					},
+					unpairedAt: {
+						type: "date",
+						required: false
+					},
+					unpairedBy: {
+						type: "string",
+						required: false
+					},
+					decommissionStartedAt: {
+						type: "date",
+						required: false
+					},
+					decommissionedAt: {
+						type: "date",
+						required: false
+					},
+					lastError: {
+						type: "string",
+						required: false,
+						returned: false
+					}
+				} },
+				directorySyncMembershipProvenance: { fields: {
+					membershipKey: {
+						type: "string",
+						required: true,
+						unique: true,
+						returned: false
+					},
+					organizationId: {
+						type: "string",
+						required: true,
+						index: true
+					},
+					userId: {
+						type: "string",
+						required: true,
+						index: true
+					},
+					memberId: {
+						type: "string",
+						required: true,
+						unique: true
+					},
+					ownership: {
+						type: "string",
+						required: true,
+						returned: false
+					},
+					provisioningDomainId: {
+						type: "string",
+						required: true,
+						index: true
+					},
+					createdAt: {
+						type: "date",
+						required: true
+					},
+					updatedAt: {
+						type: "date",
+						required: true
+					}
+				} }
+			} : {}
+		}
 	};
 };
 //#endregion