@objectstack/plugin-auth 10.2.0 → 11.0.0

package/dist/index.mjs

@@ -7,7 +7,8 @@ import {
 import { SysOrganizationDetailPage, SysUserDetailPage } from "@objectstack/platform-objects/pages";
 
 // src/auth-manager.ts
-import { readEnvWithDeprecation } from "@objectstack/types";
+import { readEnvWithDeprecation, resolveMultiOrgEnabled, resolveOrgLimit } from "@objectstack/types";
+import { mapMembershipRole, BUILTIN_ROLE_PLATFORM_ADMIN } from "@objectstack/spec";
 
 // src/objectql-adapter.ts
 import { createAdapterFactory } from "better-auth/adapters";
@@ -16,7 +17,16 @@ var AUTH_MODEL_TO_PROTOCOL = {
   user: SystemObjectName.USER,
   session: SystemObjectName.SESSION,
   account: SystemObjectName.ACCOUNT,
-  verification: SystemObjectName.VERIFICATION
+  verification: SystemObjectName.VERIFICATION,
+  // Plugin models. `@better-auth/sso` and `@better-auth/scim` both hardcode
+  // their model name and accept NO `schema` option (verified vs 1.6.2x — no
+  // mergeSchema, runtime never reads options.schema), so the table name is
+  // bridged here and `createObjectQLAdapterFactory` (below) auto-maps their
+  // camelCase fields to snake_case (oidcConfig→oidc_config, scimToken→
+  // scim_token, …) on every CRUD op via resolveProtocolName. Off by default
+  // (OS_SSO_ENABLED / OS_SCIM_ENABLED). See ADR-0024 / ADR-0071.
+  ssoProvider: "sys_sso_provider",
+  scimProvider: "sys_scim_provider"
 };
 function resolveProtocolName(model) {
   return AUTH_MODEL_TO_PROTOCOL[model] ?? model;
@@ -80,7 +90,28 @@ function convertWhere(where) {
   }
   return filter;
 }
-function createObjectQLAdapterFactory(dataEngine) {
+function withSystemReadContext(engine) {
+  const e = engine;
+  const asSystem = (q) => ({ ...q ?? {}, context: { isSystem: true, ...q?.context ?? {} } });
+  return {
+    insert: (m, d) => e.insert(m, d),
+    update: (m, d) => e.update(m, d),
+    delete: (m, q) => e.delete(m, q),
+    find: (m, q) => e.find(m, asSystem(q)),
+    findOne: (m, q) => e.findOne(m, asSystem(q)),
+    count: (m, q) => e.count(m, asSystem(q))
+  };
+}
+function createObjectQLAdapterFactory(rawDataEngine) {
+  const dataEngine = withSystemReadContext(rawDataEngine);
+  const camelToSnake = (s) => s.replace(/[A-Z]/g, (c) => "_" + c.toLowerCase());
+  const snakeToCamel = (s) => s.replace(/_([a-z])/g, (_m, c) => c.toUpperCase());
+  const remapKeys = (obj, fn) => {
+    const out = {};
+    for (const k of Object.keys(obj)) out[fn(k)] = obj[k];
+    return out;
+  };
+  const remapWhere = (where) => where.map((c) => ({ ...c, field: camelToSnake(c.field) }));
   return createAdapterFactory({
     config: {
       adapterId: "objectql",
@@ -95,62 +126,90 @@ function createObjectQLAdapterFactory(dataEngine) {
     },
     adapter: () => ({
       create: async ({ model, data, select: _select }) => {
-        const result = await dataEngine.insert(model, data);
-        return normaliseLegacyDates(model, result);
+        const objectName = resolveProtocolName(model);
+        const bridged = objectName !== model;
+        const result = await dataEngine.insert(objectName, bridged ? remapKeys(data, camelToSnake) : data);
+        const norm = normaliseLegacyDates(model, result);
+        return bridged ? remapKeys(norm, snakeToCamel) : norm;
       },
       findOne: async ({ model, where, select, join: _join }) => {
-        const filter = convertWhere(where);
-        const result = await dataEngine.findOne(model, { where: filter, fields: select });
-        return result ? normaliseLegacyDates(model, result) : null;
+        const objectName = resolveProtocolName(model);
+        const bridged = objectName !== model;
+        const filter = convertWhere(bridged ? remapWhere(where) : where);
+        const fields = bridged && select ? select.map(camelToSnake) : select;
+        const result = await dataEngine.findOne(objectName, { where: filter, fields });
+        if (!result) return null;
+        const norm = normaliseLegacyDates(model, result);
+        return bridged ? remapKeys(norm, snakeToCamel) : norm;
       },
       findMany: async ({ model, where, limit, offset, sortBy, join: _join }) => {
-        const filter = where ? convertWhere(where) : {};
-        const orderBy = sortBy ? [{ field: sortBy.field, order: sortBy.direction }] : void 0;
-        const results = await dataEngine.find(model, {
+        const objectName = resolveProtocolName(model);
+        const bridged = objectName !== model;
+        const filter = where ? convertWhere(bridged ? remapWhere(where) : where) : {};
+        const orderBy = sortBy ? [{ field: bridged ? camelToSnake(sortBy.field) : sortBy.field, order: sortBy.direction }] : void 0;
+        const results = await dataEngine.find(objectName, {
           where: filter,
           limit: limit || 100,
           offset,
           orderBy
         });
-        return results.map((r) => normaliseLegacyDates(model, r));
+        return results.map((r) => {
+          const norm = normaliseLegacyDates(model, r);
+          return bridged ? remapKeys(norm, snakeToCamel) : norm;
+        });
       },
       count: async ({ model, where }) => {
-        const filter = where ? convertWhere(where) : {};
-        return await dataEngine.count(model, { where: filter });
+        const objectName = resolveProtocolName(model);
+        const bridged = objectName !== model;
+        const filter = where ? convertWhere(bridged ? remapWhere(where) : where) : {};
+        return await dataEngine.count(objectName, { where: filter });
       },
       update: async ({ model, where, update }) => {
-        const filter = convertWhere(where);
-        const record = await dataEngine.findOne(model, { where: filter });
+        const objectName = resolveProtocolName(model);
+        const bridged = objectName !== model;
+        const filter = convertWhere(bridged ? remapWhere(where) : where);
+        const record = await dataEngine.findOne(objectName, { where: filter });
         if (!record) return null;
-        const result = await dataEngine.update(model, { ...update, id: record.id });
-        return result ? normaliseLegacyDates(model, result) : null;
+        const patch = bridged ? remapKeys(update, camelToSnake) : update;
+        const result = await dataEngine.update(objectName, { ...patch, id: record.id });
+        if (!result) return null;
+        const norm = normaliseLegacyDates(model, result);
+        return bridged ? remapKeys(norm, snakeToCamel) : norm;
       },
       updateMany: async ({ model, where, update }) => {
-        const filter = convertWhere(where);
-        const records = await dataEngine.find(model, { where: filter });
+        const objectName = resolveProtocolName(model);
+        const bridged = objectName !== model;
+        const filter = convertWhere(bridged ? remapWhere(where) : where);
+        const records = await dataEngine.find(objectName, { where: filter });
+        const patch = bridged ? remapKeys(update, camelToSnake) : update;
         for (const record of records) {
-          await dataEngine.update(model, { ...update, id: record.id });
+          await dataEngine.update(objectName, { ...patch, id: record.id });
         }
         return records.length;
       },
       delete: async ({ model, where }) => {
-        const filter = convertWhere(where);
-        const record = await dataEngine.findOne(model, { where: filter });
+        const objectName = resolveProtocolName(model);
+        const bridged = objectName !== model;
+        const filter = convertWhere(bridged ? remapWhere(where) : where);
+        const record = await dataEngine.findOne(objectName, { where: filter });
         if (!record) return;
-        await dataEngine.delete(model, { where: { id: record.id } });
+        await dataEngine.delete(objectName, { where: { id: record.id } });
       },
       deleteMany: async ({ model, where }) => {
-        const filter = convertWhere(where);
-        const records = await dataEngine.find(model, { where: filter });
+        const objectName = resolveProtocolName(model);
+        const bridged = objectName !== model;
+        const filter = convertWhere(bridged ? remapWhere(where) : where);
+        const records = await dataEngine.find(objectName, { where: filter });
         for (const record of records) {
-          await dataEngine.delete(model, { where: { id: record.id } });
+          await dataEngine.delete(objectName, { where: { id: record.id } });
         }
         return records.length;
       }
     })
   });
 }
-function createObjectQLAdapter(dataEngine) {
+function createObjectQLAdapter(rawDataEngine) {
+  const dataEngine = withSystemReadContext(rawDataEngine);
   return {
     create: async ({ model, data, select: _select }) => {
       const objectName = resolveProtocolName(model);
@@ -456,6 +515,25 @@ function buildOauthProviderPluginSchema() {
   };
 }
 var buildOidcProviderPluginSchema = buildOauthProviderPluginSchema;
+var AUTH_SSO_PROVIDER_SCHEMA = {
+  modelName: "sys_sso_provider",
+  fields: {
+    providerId: "provider_id",
+    oidcConfig: "oidc_config",
+    samlConfig: "saml_config",
+    userId: "user_id",
+    organizationId: "organization_id"
+  }
+};
+var AUTH_SCIM_PROVIDER_SCHEMA = {
+  modelName: "sys_scim_provider",
+  fields: {
+    providerId: "provider_id",
+    scimToken: "scim_token",
+    organizationId: "organization_id",
+    userId: "user_id"
+  }
+};
 function buildDeviceAuthorizationPluginSchema() {
   return {
     deviceCode: AUTH_DEVICE_CODE_SCHEMA
@@ -520,6 +598,9 @@ function readDisableSignUpEnv() {
   if (signupEnabled != null) return !signupEnabled;
   return readBooleanEnv("OS_DISABLE_SIGNUP");
 }
+function readSsoOnlyEnv() {
+  return readBooleanEnv("OS_AUTH_SSO_ONLY");
+}
 var AuthManager = class {
   constructor(config) {
     this.auth = null;
@@ -559,6 +640,14 @@ var AuthManager = class {
       // createAdapterFactory.
       user: {
         ...AUTH_USER_CONFIG
+        // NOTE: the env-side AI-seat marker `sys_user.ai_access` is deliberately
+        // NOT declared as a better-auth additionalField. sys_user is a
+        // better-auth-MANAGED table and better-auth SELECTs explicit columns, so
+        // declaring it here would make getSession query a column that may not
+        // exist on every env yet → broken auth. Instead the column is owned by
+        // the objectql `SysUser` object def (provisioned by boot schema-sync)
+        // and read by a GUARDED system query in resolveCtx (can only no-op,
+        // never break auth). better-auth stays oblivious to the extra column.
       },
       account: {
         ...AUTH_ACCOUNT_CONFIG,
@@ -607,7 +696,7 @@ var AuthManager = class {
       // lock the registration policy without relying on UI state.
       emailAndPassword: (() => {
         const disableSignUpFromEnv = readDisableSignUpEnv();
-        const effectiveDisableSignUp = disableSignUpFromEnv ?? this.config.emailAndPassword?.disableSignUp;
+        const effectiveDisableSignUp = this.resolveSsoOnly() ? true : disableSignUpFromEnv ?? this.config.emailAndPassword?.disableSignUp;
         return {
           enabled: this.config.emailAndPassword?.enabled ?? true,
           ...passwordHasher ? { password: passwordHasher } : {},
@@ -621,28 +710,28 @@ var AuthManager = class {
           sendResetPassword: async ({ user, url, token }) => {
             const email = this.getEmailService();
             if (!email) {
-              console.warn(
-                `[AuthManager] Password-reset requested for ${user.email} but no email service is wired. URL: ${url}`
+              throw new Error(
+                `Password-reset email could not be sent to ${user.email}: no email service is configured for this deployment.`
               );
-              return;
             }
             const ttlSec = this.config.emailAndPassword?.resetPasswordTokenExpiresIn ?? 60 * 60;
-            try {
-              await email.sendTemplate({
-                template: "auth.password_reset",
-                to: { address: user.email, ...user.name ? { name: user.name } : {} },
-                data: {
-                  user: { name: user.name || user.email, email: user.email, id: user.id },
-                  resetUrl: url,
-                  token,
-                  expiresInMinutes: Math.round(ttlSec / 60),
-                  appName: this.getAppName()
-                },
-                relatedObject: "sys_user",
-                relatedId: user.id
-              });
-            } catch (err) {
-              console.error(`[AuthManager] sendResetPassword failed (swallowed): ${err?.message ?? err}`);
+            const result = await email.sendTemplate({
+              template: "auth.password_reset",
+              to: { address: user.email, ...user.name ? { name: user.name } : {} },
+              data: {
+                user: { name: user.name || user.email, email: user.email, id: user.id },
+                resetUrl: url,
+                token,
+                expiresInMinutes: Math.round(ttlSec / 60),
+                appName: this.getAppName()
+              },
+              relatedObject: "sys_user",
+              relatedId: user.id
+            });
+            if (result?.status === "failed") {
+              throw new Error(
+                `Password-reset email could not be sent to ${user.email}: ${result.error ?? "delivery failed"}`
+              );
             }
           }
         };
@@ -657,28 +746,28 @@ var AuthManager = class {
           sendVerificationEmail: async ({ user, url, token }) => {
             const email = this.getEmailService();
             if (!email) {
-              console.warn(
-                `[AuthManager] Verification email requested for ${user.email} but no email service is wired. URL: ${url}`
+              throw new Error(
+                `Verification email could not be sent to ${user.email}: no email service is configured for this deployment.`
               );
-              return;
             }
             const ttlSec = this.config.emailVerification?.expiresIn ?? 60 * 60;
-            try {
-              await email.sendTemplate({
-                template: "auth.verify_email",
-                to: { address: user.email, ...user.name ? { name: user.name } : {} },
-                data: {
-                  user: { name: user.name || user.email, email: user.email, id: user.id },
-                  verificationUrl: url,
-                  token,
-                  expiresInMinutes: Math.round(ttlSec / 60),
-                  appName: this.getAppName()
-                },
-                relatedObject: "sys_user",
-                relatedId: user.id
-              });
-            } catch (err) {
-              console.error(`[AuthManager] sendVerificationEmail failed (swallowed): ${err?.message ?? err}`);
+            const result = await email.sendTemplate({
+              template: "auth.verify_email",
+              to: { address: user.email, ...user.name ? { name: user.name } : {} },
+              data: {
+                user: { name: user.name || user.email, email: user.email, id: user.id },
+                verificationUrl: url,
+                token,
+                expiresInMinutes: Math.round(ttlSec / 60),
+                appName: this.getAppName()
+              },
+              relatedObject: "sys_user",
+              relatedId: user.id
+            });
+            if (result?.status === "failed") {
+              throw new Error(
+                `Verification email could not be sent to ${user.email}: ${result.error ?? "delivery failed"}`
+              );
             }
           }
         }
@@ -691,12 +780,18 @@ var AuthManager = class {
         updateAge: this.config.session?.updateAge || 60 * 60 * 24
         // 1 day default
       },
+      // ADR-0069 D2 — per-IP rate limiting (native). Only set when configured
+      // so better-auth keeps its own defaults otherwise. The settings bind
+      // supplies stricter `customRules` for the auth endpoints.
+      ...this.config.rateLimit ? { rateLimit: this.config.rateLimit } : {},
       // better-auth plugins — registered based on AuthPluginConfig flags
       plugins,
       // Database hooks (fired by better-auth's adapter writes — these run
       // for SSO JIT-provisioning too, unlike kernel-level ObjectQL
-      // middleware which better-auth's adapter bypasses).
-      ...this.config.databaseHooks ? { databaseHooks: this.config.databaseHooks } : {},
+      // middleware which better-auth's adapter bypasses). The framework's
+      // identity-source stamp (`account.create.after`) is always composed in,
+      // preserving any host-supplied hooks.
+      databaseHooks: this.composeDatabaseHooks(this.config.databaseHooks),
       // Bootstrap bypass for `disableSignUp`. The first-run owner wizard
       // (`/_account/setup`) calls `POST /auth/sign-up/email` to create
       // the very first user — if `OS_DISABLE_SIGNUP=true` is set on a
@@ -707,6 +802,126 @@ var AuthManager = class {
       // sees `userCount > 0` and the toggle is enforced again.
       hooks: {
         before: createAuthMiddleware(async (ctx) => {
+          if (ctx?.path === "/sign-up/email" || ctx?.path === "/reset-password" || ctx?.path === "/change-password") {
+            const candidate = typeof ctx?.body?.password === "string" && ctx.body.password || typeof ctx?.body?.newPassword === "string" && ctx.body.newPassword || "";
+            if (candidate) await this.assertPasswordComplexity(candidate);
+            if (candidate && (ctx?.path === "/reset-password" || ctx?.path === "/change-password")) {
+              const userId = await this.resolvePasswordChangeUserId(ctx).catch(() => void 0);
+              if (userId) {
+                const pw = ctx?.context?.password;
+                const verify = typeof pw?.verify === "function" ? pw.verify.bind(pw) : void 0;
+                const oldHash = await this.assertPasswordNotReused(userId, candidate, verify);
+                if (oldHash !== void 0) ctx.context.__osPwHistory = { userId, oldHash };
+              }
+            }
+          }
+          if (ctx?.path === "/sso/register") {
+            const actor = await this.resolveActor(ctx);
+            if (actor?.userId) {
+              const ok = await this.isOrgOrPlatformAdmin(actor.userId, actor.activeOrgId);
+              if (!ok) {
+                const { APIError } = await import("better-auth/api");
+                throw new APIError("FORBIDDEN", {
+                  message: "Only an organization owner/admin or a platform admin can register an SSO provider.",
+                  code: "SSO_REGISTER_FORBIDDEN"
+                });
+              }
+            }
+            return;
+          }
+          if (ctx?.path === "/oauth2/authorize" && this.config.oidcAuthorizeGate) {
+            const clientId = ctx?.query?.client_id;
+            if (clientId) {
+              let gateUserId;
+              try {
+                const { getSessionFromCtx } = await import("better-auth/api");
+                const s = await getSessionFromCtx(ctx);
+                gateUserId = s?.user?.id ?? s?.session?.userId;
+              } catch {
+              }
+              if (!gateUserId) {
+                try {
+                  const hdr = (k) => (ctx?.headers?.get?.(k) ?? ctx?.request?.headers?.get?.(k)) || "";
+                  let token;
+                  const bm = /^Bearer\s+(.+)$/i.exec(hdr("authorization"));
+                  if (bm?.[1]) token = bm[1].trim();
+                  if (!token) {
+                    const cm = /(?:^|;\s*)(?:__Secure-|__Host-)?better-auth\.session_token=([^;]+)/.exec(hdr("cookie"));
+                    if (cm?.[1]) token = decodeURIComponent(cm[1]).split(".")[0];
+                  }
+                  if (token) {
+                    const sess = await ctx.context.adapter.findOne({
+                      model: "session",
+                      where: [{ field: "token", value: token }]
+                    });
+                    const exp = sess?.expiresAt ?? sess?.expires_at;
+                    if (sess && (!exp || new Date(exp).getTime() > Date.now())) {
+                      gateUserId = String(sess.userId ?? sess.user_id ?? "") || void 0;
+                    }
+                  }
+                } catch {
+                }
+              }
+              if (gateUserId) {
+                const allowed = await this.config.oidcAuthorizeGate({
+                  userId: gateUserId,
+                  clientId: String(clientId)
+                });
+                if (!allowed) {
+                  const { APIError } = await import("better-auth/api");
+                  throw new APIError("FORBIDDEN", {
+                    message: "You are not authorized to sign in to this environment.",
+                    code: "ENV_ACCESS_DENIED"
+                  });
+                }
+              }
+            }
+            return;
+          }
+          if (ctx?.path === "/delete-user" || ctx?.path === "/admin/remove-user" || ctx?.path === "/admin/ban-user") {
+            let isLastLocalCredential = false;
+            try {
+              const adapter = ctx.context.adapter;
+              let targetId = ctx?.body?.userId ?? ctx?.body?.user_id;
+              if (!targetId && ctx.path === "/delete-user") {
+                const { getSessionFromCtx } = await import("better-auth/api");
+                const s = await getSessionFromCtx(ctx).catch(() => null);
+                targetId = s?.user?.id ?? s?.session?.userId;
+              }
+              if (targetId) {
+                const targetCred = await adapter.findOne({
+                  model: "account",
+                  where: [
+                    { field: "userId", value: targetId },
+                    { field: "providerId", value: "credential" }
+                  ]
+                });
+                if (targetCred) {
+                  const creds = await adapter.findMany({
+                    model: "account",
+                    where: [{ field: "providerId", value: "credential" }]
+                  });
+                  const otherHolders = new Set(
+                    (creds ?? []).map((a) => a?.userId ?? a?.user_id).filter((id) => id && id !== targetId)
+                  );
+                  isLastLocalCredential = otherHolders.size === 0;
+                }
+              }
+            } catch {
+            }
+            if (isLastLocalCredential) {
+              const { APIError } = await import("better-auth/api");
+              throw new APIError("CONFLICT", {
+                message: "Cannot remove the last local password login. At least one break-glass account with a password must remain so an identity-provider outage can never lock the organization out. Add another local password first, then retry.",
+                code: "LAST_LOCAL_CREDENTIAL"
+              });
+            }
+          }
+          if (ctx?.path === "/sign-in/email") {
+            const email = typeof ctx?.body?.email === "string" ? ctx.body.email : "";
+            if (email) await this.assertAccountNotLocked(email);
+            return;
+          }
           if (ctx?.path !== "/sign-up/email") return;
           const ep = ctx?.context?.options?.emailAndPassword;
           if (!ep?.disableSignUp) return;
@@ -721,6 +936,35 @@ var AuthManager = class {
           }
         }),
         after: createAuthMiddleware(async (ctx) => {
+          if (ctx?.path === "/sign-in/email") {
+            const email = typeof ctx?.body?.email === "string" ? ctx.body.email : "";
+            if (email) {
+              let succeeded = true;
+              try {
+                const { isAPIError } = await import("better-auth/api");
+                succeeded = !isAPIError(ctx?.context?.returned);
+              } catch {
+                succeeded = !(ctx?.context?.returned instanceof Error);
+              }
+              await this.recordSignInOutcome(email, succeeded);
+            }
+            return;
+          }
+          if (ctx?.path === "/change-password" || ctx?.path === "/reset-password") {
+            const stash = ctx?.context?.__osPwHistory;
+            if (stash?.userId) {
+              let succeeded = true;
+              try {
+                const { isAPIError } = await import("better-auth/api");
+                succeeded = !isAPIError(ctx?.context?.returned);
+              } catch {
+                succeeded = !(ctx?.context?.returned instanceof Error);
+              }
+              if (succeeded) await this.recordPasswordHistory(stash.userId, stash.oldHash);
+              delete ctx.context.__osPwHistory;
+            }
+            return;
+          }
           if (ctx?.path !== "/sign-up/email") return;
           const ep = ctx?.context?.options?.emailAndPassword;
           if (ep && ctx.context.__osDisableSignUpOrig !== void 0) {
@@ -744,6 +988,20 @@ var AuthManager = class {
           origins.push("http://*.localhost:*");
           origins.push("https://*.localhost:*");
         }
+        if (this.isSsoWired()) {
+          return {
+            trustedOrigins: async (request) => {
+              const base = [...origins];
+              try {
+                for (const o of await this.ssoDiscoveryTrustedOrigins(request)) {
+                  if (!base.includes(o)) base.push(o);
+                }
+              } catch {
+              }
+              return base;
+            }
+          };
+        }
         return origins.length ? { trustedOrigins: origins } : {};
       })(),
       // Advanced options (cross-subdomain cookies, secure cookies, CSRF, etc.)
@@ -821,15 +1079,24 @@ var AuthManager = class {
     const plugins = [];
     const oidcEnv = globalThis?.process?.env?.OS_OIDC_PROVIDER_ENABLED;
     const oidcFromEnv = oidcEnv != null ? String(oidcEnv).toLowerCase() === "true" : void 0;
+    const ssoEnv = globalThis?.process?.env?.OS_SSO_ENABLED;
+    const ssoFromEnv = ssoEnv != null ? String(ssoEnv).toLowerCase() === "true" : void 0;
+    const scimEnv = globalThis?.process?.env?.OS_SCIM_ENABLED;
+    const scimFromEnv = scimEnv != null ? String(scimEnv).toLowerCase() === "true" : void 0;
+    const scimEffective = scimFromEnv ?? pluginConfig.scim ?? false;
     const twoFactorFromEnv = readBooleanEnv("OS_AUTH_TWO_FACTOR");
+    const hibpFromEnv = readBooleanEnv("OS_AUTH_PASSWORD_REJECT_BREACHED");
     const enabled = {
       organization: pluginConfig.organization ?? true,
       twoFactor: twoFactorFromEnv ?? pluginConfig.twoFactor ?? false,
+      passwordRejectBreached: hibpFromEnv ?? pluginConfig.passwordRejectBreached ?? false,
       passkeys: pluginConfig.passkeys ?? false,
       magicLink: pluginConfig.magicLink ?? false,
       oidcProvider: oidcFromEnv ?? pluginConfig.oidcProvider ?? false,
       deviceAuthorization: pluginConfig.deviceAuthorization ?? false,
-      admin: pluginConfig.admin ?? false
+      admin: pluginConfig.admin ?? scimEffective,
+      sso: ssoFromEnv ?? pluginConfig.sso ?? false,
+      scim: scimEffective
     };
     const { bearer } = await import("better-auth/plugins/bearer");
     plugins.push(bearer());
@@ -872,6 +1139,28 @@ var AuthManager = class {
         // the built-in /accept-invitation route usable for pilots; operators
         // who wire a real mailer can re-enable downstream.
         requireEmailVerificationOnInvitation: false,
+        // Cap how many orgs a user can CREATE (OS_ORG_LIMIT). Counts only orgs
+        // the user OWNS (role=owner) — never orgs they were merely invited into —
+        // so a generous cap stops scripted org/free-env spam (each new org can
+        // auto-provision a free environment on the cloud control plane) WITHOUT
+        // ever blocking a collaborator who belongs to many orgs. Unset → no
+        // limit (self-host default). Fail-open: if the count can't be taken we
+        // allow creation rather than block a legitimate user on an infra hiccup.
+        organizationLimit: async (user) => {
+          const limit = resolveOrgLimit();
+          if (limit == null) return false;
+          const engine = this.config.dataEngine;
+          const uid = typeof user?.id === "string" ? user.id : "";
+          if (!engine || !uid) return false;
+          try {
+            const owned = await withSystemReadContext(engine).count("sys_member", {
+              where: { user_id: uid, role: "owner" }
+            });
+            return (owned ?? 0) >= limit;
+          } catch {
+            return false;
+          }
+        },
         ...customOrgRoles ? { roles: customOrgRoles } : {},
         // ── Slug-change guard ─────────────────────────────────────
         // An org's slug is baked into every env hostname at creation
@@ -894,17 +1183,32 @@ var AuthManager = class {
           // 2. else `OS_MULTI_TENANT` (multi-tenant deployments are always
           //    multi-org), default `'false'` → single-org / per-env runtime.
           beforeCreateOrganization: async () => {
-            const env = globalThis?.process?.env ?? {};
-            const explicit = env.OS_MULTI_ORG_ENABLED;
-            const legacy = explicit === void 0 ? readEnvWithDeprecation("OS_MULTI_ORG_ENABLED", "OS_MULTI_TENANT") : explicit;
-            const flag = String(legacy ?? "false").toLowerCase();
-            if (flag === "false") {
+            if (!resolveMultiOrgEnabled()) {
               const { APIError } = await import("better-auth/api");
               throw new APIError("FORBIDDEN", {
                 message: "Creating additional organizations is disabled on this deployment."
               });
             }
           },
+          // Run host-provided org-creation side effects (e.g. the cloud control
+          // plane provisions the org's born-with production environment). The
+          // org-plugin's models don't fire core databaseHooks, so this is the
+          // only server-side seam for "every org is born with its prod env".
+          // Failure-isolated: org creation must not roll back on a side-effect miss.
+          afterCreateOrganization: async ({ organization: organization2, member, user }) => {
+            const cb = this.config.onOrganizationCreated;
+            if (typeof cb !== "function") return;
+            try {
+              await cb({
+                organizationId: organization2?.id,
+                userId: user?.id ?? member?.userId,
+                name: organization2?.name,
+                slug: organization2?.slug
+              });
+            } catch (err) {
+              console.warn("[auth] onOrganizationCreated callback failed:", err?.message ?? String(err));
+            }
+          },
           beforeUpdateOrganization: async ({ organization: organization2, member }) => {
             const newSlug = organization2?.slug;
             const orgId = member?.organizationId;
@@ -982,6 +1286,12 @@ var AuthManager = class {
         schema: buildTwoFactorPluginSchema()
       }));
     }
+    if (enabled.passwordRejectBreached) {
+      const { haveIBeenPwned } = await import("better-auth/plugins/haveibeenpwned");
+      plugins.push(haveIBeenPwned({
+        customPasswordCompromisedMessage: "This password has appeared in a known data breach. Please choose a different one."
+      }));
+    }
     if (enabled.admin) {
       const { admin } = await import("better-auth/plugins/admin");
       plugins.push(admin({
@@ -1049,6 +1359,16 @@ var AuthManager = class {
         schema: buildOauthProviderPluginSchema()
       }));
     }
+    if (enabled.sso) {
+      const { sso } = await import("@better-auth/sso");
+      plugins.push(sso({
+        organizationProvisioning: { defaultRole: "member" }
+      }));
+    }
+    if (enabled.scim) {
+      const { scim } = await import("@better-auth/scim");
+      plugins.push(scim({ storeSCIMToken: "hashed" }));
+    }
     if (enabled.deviceAuthorization) {
       const { deviceAuthorization } = await import("better-auth/plugins/device-authorization");
       const baseUrl = (this.config.baseUrl ?? "").replace(/\/$/, "");
@@ -1085,30 +1405,36 @@ var AuthManager = class {
             return false;
           }
         };
-        const isActiveOrgAdmin = async () => {
+        const activeOrgRoles = async () => {
           try {
             const orgId = session?.activeOrganizationId;
-            if (!orgId) return false;
+            if (!orgId) return [];
             const members = await dataEngine.find("sys_member", {
               where: { user_id: user.id, organization_id: orgId },
               limit: 5
             });
-            return (Array.isArray(members) ? members : []).some((m) => {
+            const out = [];
+            for (const m of Array.isArray(members) ? members : []) {
               const raw = typeof m?.role === "string" ? m.role : "";
-              const roles2 = raw.split(",").map((s) => s.trim().toLowerCase());
-              return roles2.includes("owner") || roles2.includes("admin");
-            });
+              for (const r of raw.split(",").map((s) => s.trim()).filter(Boolean)) {
+                const mapped = mapMembershipRole(r);
+                if (!out.includes(mapped)) out.push(mapped);
+              }
+            }
+            return out;
           } catch {
-            return false;
+            return [];
           }
         };
         const platformAdmin = await isPlatformAdmin();
-        const promote = platformAdmin || await isActiveOrgAdmin();
+        const orgRoles = await activeOrgRoles();
         const storedRole = typeof user.role === "string" ? user.role : "";
-        const roles = storedRole.split(",").map((s) => s.trim()).filter(Boolean);
-        if (promote && !roles.includes("admin")) roles.push("admin");
-        if (!promote) return { user: { ...user, roles, isPlatformAdmin: platformAdmin }, session };
-        return { user: { ...user, role: "admin", roles, isPlatformAdmin: platformAdmin }, session };
+        const roles = Array.from(/* @__PURE__ */ new Set([
+          ...storedRole.split(",").map((s) => s.trim()).filter(Boolean),
+          ...orgRoles,
+          ...platformAdmin ? [BUILTIN_ROLE_PLATFORM_ADMIN] : []
+        ]));
+        return { user: { ...user, roles, isPlatformAdmin: platformAdmin }, session };
       }));
     }
     return plugins;
@@ -1307,6 +1633,18 @@ var AuthManager = class {
   // `sys_device_code`. Enable via `plugins.deviceAuthorization: true` in
   // AuthPluginConfig.
   // ---------------------------------------------------------------------------
+  /**
+   * SSO-only ("enforced") login mode: the login UI hides the local password
+   * form + self-registration so the team signs in via the IdP only.
+   * `OS_AUTH_SSO_ONLY` (when set) wins over the `ssoOnlyMode` config knob —
+   * parity with the `disableSignUp` env override — so a deployment can force
+   * it regardless of the per-env/config value. Break-glass is preserved: this
+   * NEVER disables `emailAndPassword.enabled`; it only forces `disableSignUp`
+   * and signals the UI to hide the password form. Generic over the IdP.
+   */
+  resolveSsoOnly() {
+    return readSsoOnlyEnv() ?? (this.config.ssoOnlyMode ?? false);
+  }
   getPublicConfig() {
     const socialProviders = [];
     if (this.config.socialProviders) {
@@ -1344,16 +1682,15 @@ var AuthManager = class {
     }
     const emailPasswordConfig = this.config.emailAndPassword ?? {};
     const disableSignUpFromEnv = readDisableSignUpEnv();
+    const ssoOnly = this.resolveSsoOnly();
     const emailPassword = {
       enabled: emailPasswordConfig.enabled !== false,
       // Default to true
-      disableSignUp: disableSignUpFromEnv ?? emailPasswordConfig.disableSignUp ?? false,
+      disableSignUp: ssoOnly ? true : disableSignUpFromEnv ?? emailPasswordConfig.disableSignUp ?? false,
       requireEmailVerification: emailPasswordConfig.requireEmailVerification ?? false
     };
     const pluginConfig = this.config.plugins ?? {};
-    const multiOrgEnv = globalThis?.process?.env ?? {};
-    const multiOrgRaw = multiOrgEnv.OS_MULTI_ORG_ENABLED !== void 0 ? multiOrgEnv.OS_MULTI_ORG_ENABLED : readEnvWithDeprecation("OS_MULTI_ORG_ENABLED", "OS_MULTI_TENANT") ?? "false";
-    const multiOrgEnabled = String(multiOrgRaw).toLowerCase() !== "false";
+    const multiOrgEnabled = resolveMultiOrgEnabled();
     const DEFAULT_TERMS_URL = "https://objectstack.ai/terms";
     const DEFAULT_PRIVACY_URL = "https://objectstack.ai/privacy";
     const rawTermsUrl = globalThis?.process?.env?.OS_TERMS_URL;
@@ -1376,6 +1713,15 @@ var AuthManager = class {
       organization: pluginConfig.organization ?? true,
       multiOrgEnabled,
       oidcProvider: oidcFromEnv ?? pluginConfig.oidcProvider ?? false,
+      // Coarse "is the @better-auth/sso plugin wired" flag. The `/auth/config`
+      // route refines this to "usable" (≥1 provider configured) via
+      // `isSsoUsable()` so the login UI can hide the "Sign in with SSO" button
+      // both when SSO is off AND when it's on but no IdP exists yet.
+      sso: this.isSsoWired(),
+      // SSO-only ("enforced"): tell the login UI to hide the local password
+      // form + self-registration. A break-glass "use a password" link remains
+      // for the env owner / local admin. Driven by `ssoOnlyMode` / `OS_AUTH_SSO_ONLY`.
+      ssoEnforced: ssoOnly,
       deviceAuthorization: pluginConfig.deviceAuthorization ?? false,
       admin: pluginConfig.admin ?? false,
       ...termsUrl ? { termsUrl } : {},
@@ -1387,6 +1733,493 @@ var AuthManager = class {
       features
     };
   }
+  /**
+   * Coarse "is the domain-routed `@better-auth/sso` plugin wired" flag.
+   * Resolved with the EXACT logic that decides whether the plugin is mounted
+   * in `buildPlugins()` (`ssoFromEnv ?? pluginConfig.sso ?? false`) so the
+   * advertised capability can never disagree with the actual `/sign-in/sso`
+   * route. `OS_SSO_ENABLED` (when set) wins over the config-file setting.
+   */
+  isSsoWired() {
+    const ssoEnv = globalThis?.process?.env?.OS_SSO_ENABLED;
+    const ssoFromEnv = ssoEnv != null ? String(ssoEnv).toLowerCase() === "true" : void 0;
+    return ssoFromEnv ?? this.config.plugins?.sso ?? false;
+  }
+  /**
+   * Whether enterprise SSO is actually *usable*, not merely wired: the plugin
+   * is on AND at least one `sys_sso_provider` row exists. Per-email domain→IdP
+   * matching still happens at `/sign-in/sso`; this answers the coarser "is
+   * there any point showing the SSO button at all", so a freshly-enabled but
+   * unconfigured SSO setup doesn't advertise a button that errors for everyone.
+   *
+   * Fails OPEN to the wired flag when providers can't be counted (no data
+   * engine, query error) — a config-introspection hiccup must never make the
+   * login page hide a button that genuinely works.
+   */
+  async isSsoUsable() {
+    if (!this.isSsoWired()) return false;
+    const engine = this.getDataEngine();
+    if (!engine) return true;
+    try {
+      const count = await withSystemReadContext(engine).count("sys_sso_provider");
+      return typeof count === "number" ? count > 0 : true;
+    } catch {
+      return true;
+    }
+  }
+  /**
+   * Extra `trustedOrigins` entries derived from an external-SSO registration
+   * request. For a `POST /sso/register` | `/sso/update-provider`, parse the
+   * (cloned) body and return the PUBLIC-ROUTABLE origins of the declared
+   * `issuer` / `oidcConfig` endpoints so `@better-auth/sso`'s discovery
+   * validation accepts a customer IdP registered at runtime (ADR-0024) without
+   * the operator pre-listing it in boot config. Only public-routable hosts are
+   * returned — private / internal / loopback hosts are never auto-trusted
+   * (better-auth's `isPublicRoutableHost`, the same predicate its own
+   * sub-endpoint check uses). Best-effort: any parse error yields `[]`.
+   */
+  async ssoDiscoveryTrustedOrigins(request) {
+    try {
+      const req = request;
+      if (!req || typeof req.clone !== "function" || !req.url) return [];
+      if ((req.method ?? "GET").toUpperCase() !== "POST") return [];
+      const path = new URL(req.url).pathname;
+      if (!/\/sso\/(register|update-provider)$/.test(path)) return [];
+      const body = await req.clone().json().catch(() => null);
+      if (!body || typeof body !== "object") return [];
+      const oidc = body.oidcConfig ?? {};
+      const candidates = [
+        body.issuer,
+        oidc.discoveryEndpoint,
+        oidc.authorizationEndpoint,
+        oidc.tokenEndpoint,
+        oidc.jwksEndpoint,
+        oidc.userInfoEndpoint
+      ].filter((v) => typeof v === "string" && v.length > 0);
+      if (!candidates.length) return [];
+      const { isPublicRoutableHost } = await import("@better-auth/core/utils/host");
+      const out = [];
+      for (const c of candidates) {
+        try {
+          const u = new URL(c);
+          if (isPublicRoutableHost(u.hostname) && !out.includes(u.origin)) out.push(u.origin);
+        } catch {
+        }
+      }
+      return out;
+    } catch {
+      return [];
+    }
+  }
+  /**
+   * Resolve the acting user (+ their active org) for a before-hook gate,
+   * hook-order-independent. Tries the standard cookie session first, then falls
+   * back to explicit token resolution (bearer or the session cookie's token
+   * part) — the bearer plugin may convert `Authorization: Bearer` to a session
+   * AFTER this global before-hook runs. Returns `null` when no valid session
+   * can be resolved (→ caller lets `sessionMiddleware` issue the 401).
+   */
+  async resolveActor(ctx) {
+    try {
+      const { getSessionFromCtx } = await import("better-auth/api");
+      const s = await getSessionFromCtx(ctx);
+      const userId = s?.user?.id ?? s?.session?.userId;
+      if (userId) {
+        return {
+          userId: String(userId),
+          activeOrgId: s?.session?.activeOrganizationId ?? s?.activeOrganizationId ?? void 0
+        };
+      }
+    } catch {
+    }
+    try {
+      const hdr = (k) => (ctx?.headers?.get?.(k) ?? ctx?.request?.headers?.get?.(k)) || "";
+      let token;
+      const bm = /^Bearer\s+(.+)$/i.exec(hdr("authorization"));
+      if (bm?.[1]) token = bm[1].trim();
+      if (!token) {
+        const cm = /(?:^|;\s*)(?:__Secure-|__Host-)?better-auth\.session_token=([^;]+)/.exec(hdr("cookie"));
+        if (cm?.[1]) token = decodeURIComponent(cm[1]).split(".")[0];
+      }
+      if (token) {
+        const sess = await ctx.context.adapter.findOne({
+          model: "session",
+          where: [{ field: "token", value: token }]
+        });
+        const exp = sess?.expiresAt ?? sess?.expires_at;
+        if (sess && (!exp || new Date(exp).getTime() > Date.now())) {
+          const userId = String(sess.userId ?? sess.user_id ?? "");
+          if (userId) {
+            return {
+              userId,
+              activeOrgId: sess.activeOrganizationId ?? sess.active_organization_id ?? void 0
+            };
+          }
+        }
+      }
+    } catch {
+    }
+    return null;
+  }
+  /**
+   * True when `userId` is a platform admin (a `sys_user_permission_set` row
+   * pointing at `admin_full_access` with `organization_id = null`) OR an
+   * owner/admin member of `activeOrgId` (any org membership with role
+   * owner/admin when no active org is set). Mirrors the role-derivation in
+   * `customSession`; reads through `withSystemReadContext` so the lookups are
+   * not themselves RLS-scoped to the acting (possibly non-privileged) user.
+   * Fails CLOSED (returns false) on any lookup error — this backs a security
+   * gate, so an unverifiable actor must never pass.
+   */
+  async isOrgOrPlatformAdmin(userId, activeOrgId) {
+    const engine = this.getDataEngine();
+    if (!engine) return false;
+    const sys = withSystemReadContext(engine);
+    try {
+      const links = await sys.find("sys_user_permission_set", {
+        where: { user_id: userId },
+        limit: 50
+      });
+      const platformLinks = (Array.isArray(links) ? links : []).filter(
+        (l) => !l.organization_id
+      );
+      if (platformLinks.length) {
+        const sets = await sys.find("sys_permission_set", { limit: 50 });
+        const adminSet = (Array.isArray(sets) ? sets : []).find(
+          (r) => r.name === "admin_full_access"
+        );
+        if (adminSet && platformLinks.some((l) => l.permission_set_id === adminSet.id)) {
+          return true;
+        }
+      }
+      const where = { user_id: userId };
+      if (activeOrgId) where.organization_id = activeOrgId;
+      const members = await sys.find("sys_member", { where, limit: 10 });
+      for (const m of Array.isArray(members) ? members : []) {
+        const raw = typeof m?.role === "string" ? m.role : "";
+        if (raw.split(",").map((s) => s.trim()).some((r) => r === "owner" || r === "admin")) {
+          return true;
+        }
+      }
+      return false;
+    } catch {
+      return false;
+    }
+  }
+  /**
+   * Compose the framework's identity-source stamp (`account.create.after`)
+   * with any host-supplied `databaseHooks`, preserving BOTH. The cloud passes
+   * `user.create.after` (personal-org provisioning) + `session.create.before`
+   * (active-org) — different model/op, so no collision — but if a host ever
+   * adds its own `account.create.after` we chain it after the stamp rather
+   * than silently dropping one.
+   */
+  composeDatabaseHooks(host) {
+    const stamp = (account, ctx) => this.stampIdentitySource(account, ctx);
+    const hostAccountAfter = host?.account?.create?.after;
+    const after = hostAccountAfter ? async (account, ctx) => {
+      await stamp(account, ctx);
+      return hostAccountAfter(account, ctx);
+    } : stamp;
+    return {
+      ...host ?? {},
+      account: {
+        ...host?.account ?? {},
+        create: {
+          ...host?.account?.create ?? {},
+          after
+        }
+      }
+    };
+  }
+  /**
+   * Maintain `sys_user.source` (ADR-0024 D4 provenance) as accounts are linked.
+   * Drives the managed-vs-native user-mgmt gating: a managed (`idp-provisioned`)
+   * user holds no local credential, so the password / identity-edit actions
+   * hide for them — preventing a managed user from self-minting a local
+   * password that would bypass enforced SSO.
+   *
+   * Two cases, both break-glass safe and idempotent (only writes on a real
+   * change, so trackHistory stays quiet):
+   *
+   *  • A **federated** account (any non-`credential` provider — the cloud-as-IdP
+   *    `objectstack-cloud` provider OR a customer's own OIDC/SAML IdP) is
+   *    linked AND the user holds NO local credential → mark `idp-provisioned`.
+   *    A user who already has a `credential` account (an env-native user who
+   *    linked SSO) is left `env-native` — they keep a usable password.
+   *
+   *  • A **credential** account is created (local signup, or the break-glass
+   *    owner's password set via set-initial-password — which can land AFTER the
+   *    first SSO link) → ensure `env-native`. This flips a previously-stamped
+   *    owner back, so the break-glass admin never loses self-service password
+   *    management.
+   *
+   * Best-effort: any failure leaves the prior value (the gate fails open — a
+   * managed user might transiently show a password action that simply errors —
+   * never a hard login failure).
+   */
+  async stampIdentitySource(account, _ctx) {
+    try {
+      const providerId = account?.providerId ?? account?.provider_id;
+      const userId = account?.userId ?? account?.user_id;
+      if (!userId || !providerId) return;
+      const engine = this.getDataEngine();
+      if (!engine) return;
+      const SYSTEM_CTX = { isSystem: true, roles: [], permissions: [] };
+      if (providerId === "credential") {
+        const u = await engine.findOne("sys_user", {
+          filter: { id: userId },
+          fields: ["id", "source"],
+          context: SYSTEM_CTX
+        });
+        if (u && u.source === "idp_provisioned") {
+          await engine.update("sys_user", { id: userId, source: "env_native" }, { context: SYSTEM_CTX });
+        }
+        return;
+      }
+      const credentialCount = await engine.count("sys_account", {
+        filter: { user_id: userId, provider_id: "credential" },
+        context: SYSTEM_CTX
+      });
+      if (typeof credentialCount === "number" && credentialCount > 0) return;
+      await engine.update("sys_user", { id: userId, source: "idp_provisioned" }, { context: SYSTEM_CTX });
+    } catch {
+    }
+  }
+  /**
+   * ADR-0069 D1 — reject a password that doesn't meet the configured character-
+   * class complexity. No-op when `passwordRequireComplexity` is off. Counts the
+   * four classes (upper / lower / digit / symbol) present and throws
+   * `PASSWORD_POLICY_VIOLATION` when fewer than `passwordMinClasses` are used.
+   */
+  async assertPasswordComplexity(password) {
+    if (!this.config.passwordRequireComplexity) return;
+    const min = Math.min(4, Math.max(1, Math.floor(Number(this.config.passwordMinClasses) || 3)));
+    const classes = (/[a-z]/.test(password) ? 1 : 0) + (/[A-Z]/.test(password) ? 1 : 0) + (/[0-9]/.test(password) ? 1 : 0) + (/[^A-Za-z0-9]/.test(password) ? 1 : 0);
+    if (classes < min) {
+      const { APIError } = await import("better-auth/api");
+      throw new APIError("BAD_REQUEST", {
+        message: `Password must include at least ${min} of: uppercase, lowercase, digit, symbol.`,
+        code: "PASSWORD_POLICY_VIOLATION"
+      });
+    }
+  }
+  /**
+   * ADR-0069 D1 — parse the bounded `previous_password_hashes` JSON column into
+   * a string[] of hashes, tolerating null / malformed values.
+   */
+  parseHashes(raw) {
+    if (typeof raw !== "string" || !raw.trim()) return [];
+    try {
+      const arr = JSON.parse(raw);
+      return Array.isArray(arr) ? arr.filter((h) => typeof h === "string" && !!h) : [];
+    } catch {
+      return [];
+    }
+  }
+  /**
+   * ADR-0069 D1 — resolve the user whose password is being changed. For
+   * `/change-password` the caller is authenticated (session); for
+   * `/reset-password` the user is carried by the reset token's verification
+   * value (the same lookup better-auth's own handler uses).
+   */
+  async resolvePasswordChangeUserId(ctx) {
+    if (ctx?.path === "/change-password") {
+      const { getSessionFromCtx } = await import("better-auth/api");
+      const sess = await getSessionFromCtx(ctx).catch(() => null);
+      return sess?.user?.id ?? sess?.session?.userId ?? void 0;
+    }
+    if (ctx?.path === "/reset-password") {
+      const token = typeof ctx?.body?.token === "string" ? ctx.body.token : "";
+      if (!token) return void 0;
+      try {
+        const v = await ctx.context.internalAdapter.findVerificationValue(`reset-password:${token}`);
+        const raw = v?.value;
+        if (!raw) return void 0;
+        if (typeof raw === "string") {
+          const t = raw.trim();
+          if (t.startsWith("{") || t.startsWith('"')) {
+            try {
+              const o = JSON.parse(t);
+              return (typeof o === "string" ? o : o?.userId) ?? void 0;
+            } catch {
+              return t;
+            }
+          }
+          return t;
+        }
+        return raw?.userId ?? void 0;
+      } catch {
+        return void 0;
+      }
+    }
+    return void 0;
+  }
+  /**
+   * ADR-0069 D1 — throw `PASSWORD_REUSE` when `candidate` matches the user's
+   * current password or any hash in the bounded history. Reuses better-auth's
+   * native `password.verify` (passed in) rather than re-hashing. Returns the
+   * current hash (for the after-hook to append) when the candidate is fresh, or
+   * undefined when the feature is off / nothing to compare.
+   */
+  async assertPasswordNotReused(userId, candidate, verify) {
+    const count = Math.floor(Number(this.config.passwordHistoryCount) || 0);
+    if (count <= 0 || typeof verify !== "function") return void 0;
+    const engine = this.getDataEngine();
+    if (!engine) return void 0;
+    const SYSTEM_CTX = { isSystem: true, roles: [], permissions: [] };
+    let account;
+    try {
+      account = await engine.findOne("sys_account", {
+        where: { user_id: userId, provider_id: "credential" },
+        fields: ["id", "password", "previous_password_hashes"],
+        context: SYSTEM_CTX
+      });
+    } catch {
+      return void 0;
+    }
+    if (!account?.id) return void 0;
+    const currentHash = typeof account.password === "string" ? account.password : "";
+    const compareList = [currentHash, ...this.parseHashes(account.previous_password_hashes)].filter(Boolean);
+    for (const h of compareList) {
+      let match = false;
+      try {
+        match = await verify({ password: candidate, hash: h });
+      } catch {
+        match = false;
+      }
+      if (match) {
+        const { APIError } = await import("better-auth/api");
+        throw new APIError("BAD_REQUEST", {
+          message: `For security you can't reuse one of your last ${count} passwords. Please choose a different one.`,
+          code: "PASSWORD_REUSE"
+        });
+      }
+    }
+    return currentHash;
+  }
+  /**
+   * ADR-0069 D1 — append `oldHash` to the bounded password-history ring after a
+   * successful change/reset. Best-effort; never throws.
+   */
+  async recordPasswordHistory(userId, oldHash) {
+    const count = Math.floor(Number(this.config.passwordHistoryCount) || 0);
+    if (count <= 0 || !oldHash) return;
+    const engine = this.getDataEngine();
+    if (!engine) return;
+    try {
+      const SYSTEM_CTX = { isSystem: true, roles: [], permissions: [] };
+      const account = await engine.findOne("sys_account", {
+        where: { user_id: userId, provider_id: "credential" },
+        fields: ["id", "previous_password_hashes"],
+        context: SYSTEM_CTX
+      });
+      if (!account?.id) return;
+      const prev = this.parseHashes(account.previous_password_hashes);
+      const next = [oldHash, ...prev.filter((h) => h !== oldHash)].slice(0, count);
+      await engine.update(
+        "sys_account",
+        { id: account.id, previous_password_hashes: JSON.stringify(next) },
+        { context: SYSTEM_CTX }
+      );
+    } catch {
+    }
+  }
+  /**
+   * ADR-0069 D2 — throw `ACCOUNT_LOCKED` when the identity is currently locked
+   * out (brute-force protection). No-op when lockout is disabled
+   * (`lockoutThreshold <= 0`) or no data engine is wired. Fails OPEN on a
+   * lookup error: an infra hiccup must never block every login.
+   */
+  async assertAccountNotLocked(email) {
+    const threshold = Number(this.config.lockoutThreshold) || 0;
+    if (threshold <= 0) return;
+    const engine = this.getDataEngine();
+    if (!engine) return;
+    let locked = false;
+    try {
+      const SYSTEM_CTX = { isSystem: true, roles: [], permissions: [] };
+      const u = await engine.findOne("sys_user", {
+        where: { email },
+        fields: ["id", "locked_until"],
+        context: SYSTEM_CTX
+      });
+      const lu = u?.locked_until;
+      locked = !!(lu && new Date(lu).getTime() > Date.now());
+    } catch {
+      return;
+    }
+    if (locked) {
+      const { APIError } = await import("better-auth/api");
+      throw new APIError("FORBIDDEN", {
+        message: "This account is temporarily locked after too many failed sign-in attempts. Try again later or ask an administrator to unlock it.",
+        code: "ACCOUNT_LOCKED"
+      });
+    }
+  }
+  /**
+   * ADR-0069 D2 — record a sign-in outcome for lockout accounting. On failure
+   * increments `failed_login_count` and, once it reaches `lockoutThreshold`,
+   * stamps `locked_until = now + lockoutDurationMinutes`. On success resets
+   * both (only writing when there is something to clear, to avoid a no-op
+   * history row on every login). No-op when lockout is disabled. Never throws —
+   * a counter write must not turn a valid login into an error.
+   */
+  async recordSignInOutcome(email, success) {
+    const threshold = Number(this.config.lockoutThreshold) || 0;
+    if (threshold <= 0) return;
+    const engine = this.getDataEngine();
+    if (!engine) return;
+    try {
+      const SYSTEM_CTX = { isSystem: true, roles: [], permissions: [] };
+      const u = await engine.findOne("sys_user", {
+        where: { email },
+        fields: ["id", "failed_login_count", "locked_until"],
+        context: SYSTEM_CTX
+      });
+      if (!u?.id) return;
+      if (success) {
+        if ((Number(u.failed_login_count) || 0) !== 0 || u.locked_until) {
+          await engine.update(
+            "sys_user",
+            { id: u.id, failed_login_count: 0, locked_until: null },
+            { context: SYSTEM_CTX }
+          );
+        }
+        return;
+      }
+      const next = (Number(u.failed_login_count) || 0) + 1;
+      const patch = { id: u.id, failed_login_count: next };
+      if (next >= threshold) {
+        const mins = Number(this.config.lockoutDurationMinutes) || 15;
+        patch.locked_until = new Date(Date.now() + mins * 6e4);
+      }
+      await engine.update("sys_user", patch, { context: SYSTEM_CTX });
+    } catch {
+    }
+  }
+  /**
+   * ADR-0069 D2 — clear a user's lockout state (admin "Unlock" action).
+   * Resets `failed_login_count` and `locked_until`. Returns false when no data
+   * engine is wired or the user does not exist.
+   */
+  async unlockUser(userId) {
+    const engine = this.getDataEngine();
+    if (!engine || !userId) return false;
+    const SYSTEM_CTX = { isSystem: true, roles: [], permissions: [] };
+    const u = await engine.findOne("sys_user", {
+      where: { id: userId },
+      fields: ["id"],
+      context: SYSTEM_CTX
+    });
+    if (!u?.id) return false;
+    await engine.update(
+      "sys_user",
+      { id: userId, failed_login_count: 0, locked_until: null },
+      { context: SYSTEM_CTX }
+    );
+    return true;
+  }
   /**
    * Returns the data engine wired into this auth manager. Used by route
    * handlers (e.g. bootstrap-status) that need to query identity tables
@@ -1442,6 +2275,8 @@ import {
   SysOauthRefreshToken,
   SysOrganization,
   SysSession,
+  SysSsoProvider,
+  SysScimProvider,
   SysTeam,
   SysTeamMember,
   SysTwoFactor,
@@ -1469,7 +2304,9 @@ var authIdentityObjects = [
   SysOauthRefreshToken,
   SysOauthConsent,
   SysJwks,
-  SysDeviceCode
+  SysDeviceCode,
+  SysSsoProvider,
+  SysScimProvider
 ];
 var authPluginManifestHeader = {
   id: AUTH_PLUGIN_ID,
@@ -1575,14 +2412,24 @@ var AuthPlugin = class {
       ctx.hook("kernel:ready", async () => {
         if (this.authManager) {
           await this.bindAuthSettings(ctx);
+          let emailSvc;
           try {
-            const emailSvc = ctx.getService("email");
-            if (emailSvc) {
-              this.authManager.setEmailService(emailSvc);
-              ctx.logger.info("Auth: email service wired (transactional mail enabled)");
-            }
+            emailSvc = ctx.getService("email");
           } catch {
-            ctx.logger.info("Auth: no email service registered \u2014 auth callbacks will log instead of sending");
+            emailSvc = void 0;
+          }
+          if (emailSvc) {
+            this.authManager.setEmailService(emailSvc);
+            ctx.logger.info("Auth: email service wired (transactional mail enabled)");
+          } else {
+            const requiresEmail = !!this.authManager.getPublicConfig?.()?.emailPassword?.requireEmailVerification;
+            if (requiresEmail) {
+              ctx.logger.error(
+                "Auth: email verification is REQUIRED but NO email service is registered \u2014 verification & password-reset emails will FAIL and new users will be locked out at sign-in. Register an email service (e.g. EmailServicePlugin + OS_EMAIL_*) or disable verification (OS_AUTH_REQUIRE_EMAIL_VERIFICATION=false)."
+              );
+            } else {
+              ctx.logger.info("Auth: no email service registered \u2014 transactional mail disabled");
+            }
           }
           try {
             const settings = ctx.getService("settings");
@@ -1645,6 +2492,38 @@ var AuthPlugin = class {
     ctx.hook("kernel:ready", async () => {
       await this.maybeSeedDevAdmin(ctx);
     });
+    ctx.hook("kernel:ready", async () => {
+      try {
+        const engine = ctx.getService("objectql");
+        if (!engine || typeof engine.registerHook !== "function") return;
+        const SYSTEM_CTX = { isSystem: true, roles: [], permissions: [] };
+        engine.registerHook("afterInsert", async (hookCtx) => {
+          try {
+            if (hookCtx?.object !== "sys_account") return;
+            const acct = hookCtx.result ?? {};
+            const providerId = acct.provider_id ?? acct.providerId;
+            const userId = acct.user_id ?? acct.userId;
+            if (!userId || !providerId || providerId === "credential") return;
+            const credCount = await engine.count("sys_account", {
+              where: { user_id: userId, provider_id: "credential" },
+              context: SYSTEM_CTX
+            });
+            if (typeof credCount === "number" && credCount > 0) return;
+            const u = await engine.findOne("sys_user", {
+              where: { id: userId },
+              fields: ["id", "source"],
+              context: SYSTEM_CTX
+            });
+            if (u && u.source !== "idp_provisioned") {
+              await engine.update("sys_user", { id: userId, source: "idp_provisioned" }, { context: SYSTEM_CTX });
+            }
+          } catch {
+          }
+        }, { packageId: "com.objectstack.plugin-auth" });
+        ctx.logger.info("Identity-source afterInsert stamp registered on sys_account (SCIM-safe)");
+      } catch {
+      }
+    });
     try {
       const ql = ctx.getService("objectql");
       if (ql && typeof ql.registerMiddleware === "function") {
@@ -1728,6 +2607,23 @@ var AuthPlugin = class {
         if (Object.keys(emailAndPassword).length > 0) {
           patch.emailAndPassword = emailAndPassword;
         }
+        if (isExplicit("password_reject_breached")) {
+          patch.plugins = {
+            ...patch.plugins ?? {},
+            passwordRejectBreached: asBoolean(values.password_reject_breached, false)
+          };
+        }
+        if (isExplicit("password_require_complexity")) {
+          patch.passwordRequireComplexity = asBoolean(values.password_require_complexity, false);
+        }
+        if (isExplicit("password_min_classes")) {
+          const n = asPositiveInt(values.password_min_classes);
+          if (n !== void 0) patch.passwordMinClasses = Math.min(4, Math.max(1, n));
+        }
+        if (isExplicit("password_history_count")) {
+          const n = Math.floor(Number(values.password_history_count));
+          if (Number.isFinite(n) && n >= 0) patch.passwordHistoryCount = Math.min(24, n);
+        }
         const session = {};
         if (isExplicit("session_expiry_days")) {
           const d = asPositiveInt(values.session_expiry_days);
@@ -1740,6 +2636,33 @@ var AuthPlugin = class {
         if (Object.keys(session).length > 0) {
           patch.session = session;
         }
+        const asNonNegativeInt = (value) => {
+          const n = Math.floor(Number(value));
+          return Number.isFinite(n) && n >= 0 ? n : void 0;
+        };
+        if (isExplicit("lockout_threshold")) {
+          const n = asNonNegativeInt(values.lockout_threshold);
+          if (n !== void 0) patch.lockoutThreshold = n;
+        }
+        if (isExplicit("lockout_duration_minutes")) {
+          const n = asPositiveInt(values.lockout_duration_minutes);
+          if (n !== void 0) patch.lockoutDurationMinutes = n;
+        }
+        if (isExplicit("rate_limit_max") || isExplicit("rate_limit_window_seconds")) {
+          const max = asPositiveInt(values.rate_limit_max) ?? 10;
+          const window = asPositiveInt(values.rate_limit_window_seconds) ?? 60;
+          patch.rateLimit = {
+            enabled: true,
+            window,
+            max,
+            customRules: {
+              "/sign-in/email": { window, max },
+              "/sign-up/email": { window, max },
+              "/request-password-reset": { window, max },
+              "/reset-password": { window, max }
+            }
+          };
+        }
         if (isExplicit("google_enabled") || isExplicit("google_client_id") || isExplicit("google_client_secret")) {
           const socialProviders = {
             ...this.configuredSocialProviders ?? {}
@@ -1861,9 +2784,12 @@ var AuthPlugin = class {
       );
     }
     const rawApp = httpServer.getRawApp();
-    rawApp.get(`${basePath}/config`, (c) => {
+    rawApp.get(`${basePath}/config`, async (c) => {
       try {
         const config = this.authManager.getPublicConfig();
+        if (config.features?.sso) {
+          config.features.sso = await this.authManager.isSsoUsable();
+        }
         return c.json({ success: true, data: config });
       } catch (error) {
         const err = error instanceof Error ? error : new Error(String(error));
@@ -1949,6 +2875,39 @@ var AuthPlugin = class {
         return c.json({ success: false, error: { code: "internal", message: err.message } }, 500);
       }
     });
+    rawApp.post(`${basePath}/admin/unlock-user`, async (c) => {
+      try {
+        let body = {};
+        try {
+          body = await c.req.json();
+        } catch {
+          body = {};
+        }
+        const userId = body?.userId ?? body?.user_id;
+        if (typeof userId !== "string" || userId.length === 0) {
+          return c.json({ success: false, error: { code: "invalid_request", message: "userId is required" } }, 400);
+        }
+        const authApi = await this.authManager.getApi();
+        const session = await authApi.getSession({ headers: c.req.raw.headers });
+        if (!session?.user?.id) {
+          return c.json({ success: false, error: { code: "unauthorized", message: "Sign in first" } }, 401);
+        }
+        const u = session.user;
+        const isAdmin = u?.isPlatformAdmin === true || Array.isArray(u?.roles) && u.roles.includes("platform_admin") || u?.role === "admin";
+        if (!isAdmin) {
+          return c.json({ success: false, error: { code: "forbidden", message: "Admin role required" } }, 403);
+        }
+        const ok = await this.authManager.unlockUser(userId);
+        if (!ok) {
+          return c.json({ success: false, error: { code: "not_found", message: "User not found or data engine unavailable" } }, 404);
+        }
+        return c.json({ success: true, data: { userId } });
+      } catch (error) {
+        const err = error instanceof Error ? error : new Error(String(error));
+        ctx.logger.error("[AuthPlugin] unlock-user failed", err);
+        return c.json({ success: false, error: { code: "internal", message: err.message } }, 500);
+      }
+    });
     rawApp.post(`${basePath}/sys-oauth-application/register`, async (c) => {
       try {
         let body = {};
@@ -2094,7 +3053,9 @@ export {
   AUTH_OAUTH_REFRESH_TOKEN_SCHEMA,
   AUTH_ORGANIZATION_SCHEMA,
   AUTH_ORG_SESSION_FIELDS,
+  AUTH_SCIM_PROVIDER_SCHEMA,
   AUTH_SESSION_CONFIG,
+  AUTH_SSO_PROVIDER_SCHEMA,
   AUTH_TEAM_MEMBER_SCHEMA,
   AUTH_TEAM_SCHEMA,
   AUTH_TWO_FACTOR_SCHEMA,
@@ -2113,6 +3074,7 @@ export {
   createObjectQLAdapter,
   createObjectQLAdapterFactory,
   resolveProtocolName,
-  runSetInitialPassword
+  runSetInitialPassword,
+  withSystemReadContext
 };
 //# sourceMappingURL=index.mjs.map