@objectstack/plugin-auth 10.3.0 → 11.1.0

package/dist/index.js

@@ -45,7 +45,9 @@ __export(index_exports, {
   AUTH_OAUTH_REFRESH_TOKEN_SCHEMA: () => AUTH_OAUTH_REFRESH_TOKEN_SCHEMA,
   AUTH_ORGANIZATION_SCHEMA: () => AUTH_ORGANIZATION_SCHEMA,
   AUTH_ORG_SESSION_FIELDS: () => AUTH_ORG_SESSION_FIELDS,
+  AUTH_SCIM_PROVIDER_SCHEMA: () => AUTH_SCIM_PROVIDER_SCHEMA,
   AUTH_SESSION_CONFIG: () => AUTH_SESSION_CONFIG,
+  AUTH_SSO_PROVIDER_SCHEMA: () => AUTH_SSO_PROVIDER_SCHEMA,
   AUTH_TEAM_MEMBER_SCHEMA: () => AUTH_TEAM_MEMBER_SCHEMA,
   AUTH_TEAM_SCHEMA: () => AUTH_TEAM_SCHEMA,
   AUTH_TWO_FACTOR_SCHEMA: () => AUTH_TWO_FACTOR_SCHEMA,
@@ -63,8 +65,14 @@ __export(index_exports, {
   buildTwoFactorPluginSchema: () => buildTwoFactorPluginSchema,
   createObjectQLAdapter: () => createObjectQLAdapter,
   createObjectQLAdapterFactory: () => createObjectQLAdapterFactory,
+  ipMatchesRange: () => ipMatchesRange,
   resolveProtocolName: () => resolveProtocolName,
-  runSetInitialPassword: () => runSetInitialPassword
+  runRegisterSamlProviderFromForm: () => runRegisterSamlProviderFromForm,
+  runRegisterSsoProviderFromForm: () => runRegisterSsoProviderFromForm,
+  runRequestDomainVerification: () => runRequestDomainVerification,
+  runSetInitialPassword: () => runSetInitialPassword,
+  runVerifyDomain: () => runVerifyDomain,
+  withSystemReadContext: () => withSystemReadContext
 });
 module.exports = __toCommonJS(index_exports);
 
@@ -75,6 +83,7 @@ var import_pages = require("@objectstack/platform-objects/pages");
 
 // src/auth-manager.ts
 var import_types = require("@objectstack/types");
+var import_spec = require("@objectstack/spec");
 
 // src/objectql-adapter.ts
 var import_adapters = require("better-auth/adapters");
@@ -83,7 +92,16 @@ var AUTH_MODEL_TO_PROTOCOL = {
   user: import_system.SystemObjectName.USER,
   session: import_system.SystemObjectName.SESSION,
   account: import_system.SystemObjectName.ACCOUNT,
-  verification: import_system.SystemObjectName.VERIFICATION
+  verification: import_system.SystemObjectName.VERIFICATION,
+  // Plugin models. `@better-auth/sso` and `@better-auth/scim` both hardcode
+  // their model name and accept NO `schema` option (verified vs 1.6.2x — no
+  // mergeSchema, runtime never reads options.schema), so the table name is
+  // bridged here and `createObjectQLAdapterFactory` (below) auto-maps their
+  // camelCase fields to snake_case (oidcConfig→oidc_config, scimToken→
+  // scim_token, …) on every CRUD op via resolveProtocolName. Off by default
+  // (OS_SSO_ENABLED / OS_SCIM_ENABLED). See ADR-0024 / ADR-0071.
+  ssoProvider: "sys_sso_provider",
+  scimProvider: "sys_scim_provider"
 };
 function resolveProtocolName(model) {
   return AUTH_MODEL_TO_PROTOCOL[model] ?? model;
@@ -147,7 +165,28 @@ function convertWhere(where) {
   }
   return filter;
 }
-function createObjectQLAdapterFactory(dataEngine) {
+function withSystemReadContext(engine) {
+  const e = engine;
+  const asSystem = (q) => ({ ...q ?? {}, context: { isSystem: true, ...q?.context ?? {} } });
+  return {
+    insert: (m, d) => e.insert(m, d),
+    update: (m, d) => e.update(m, d),
+    delete: (m, q) => e.delete(m, q),
+    find: (m, q) => e.find(m, asSystem(q)),
+    findOne: (m, q) => e.findOne(m, asSystem(q)),
+    count: (m, q) => e.count(m, asSystem(q))
+  };
+}
+function createObjectQLAdapterFactory(rawDataEngine) {
+  const dataEngine = withSystemReadContext(rawDataEngine);
+  const camelToSnake = (s) => s.replace(/[A-Z]/g, (c) => "_" + c.toLowerCase());
+  const snakeToCamel = (s) => s.replace(/_([a-z])/g, (_m, c) => c.toUpperCase());
+  const remapKeys = (obj, fn) => {
+    const out = {};
+    for (const k of Object.keys(obj)) out[fn(k)] = obj[k];
+    return out;
+  };
+  const remapWhere = (where) => where.map((c) => ({ ...c, field: camelToSnake(c.field) }));
   return (0, import_adapters.createAdapterFactory)({
     config: {
       adapterId: "objectql",
@@ -162,62 +201,90 @@ function createObjectQLAdapterFactory(dataEngine) {
     },
     adapter: () => ({
       create: async ({ model, data, select: _select }) => {
-        const result = await dataEngine.insert(model, data);
-        return normaliseLegacyDates(model, result);
+        const objectName = resolveProtocolName(model);
+        const bridged = objectName !== model;
+        const result = await dataEngine.insert(objectName, bridged ? remapKeys(data, camelToSnake) : data);
+        const norm = normaliseLegacyDates(model, result);
+        return bridged ? remapKeys(norm, snakeToCamel) : norm;
       },
       findOne: async ({ model, where, select, join: _join }) => {
-        const filter = convertWhere(where);
-        const result = await dataEngine.findOne(model, { where: filter, fields: select });
-        return result ? normaliseLegacyDates(model, result) : null;
+        const objectName = resolveProtocolName(model);
+        const bridged = objectName !== model;
+        const filter = convertWhere(bridged ? remapWhere(where) : where);
+        const fields = bridged && select ? select.map(camelToSnake) : select;
+        const result = await dataEngine.findOne(objectName, { where: filter, fields });
+        if (!result) return null;
+        const norm = normaliseLegacyDates(model, result);
+        return bridged ? remapKeys(norm, snakeToCamel) : norm;
       },
       findMany: async ({ model, where, limit, offset, sortBy, join: _join }) => {
-        const filter = where ? convertWhere(where) : {};
-        const orderBy = sortBy ? [{ field: sortBy.field, order: sortBy.direction }] : void 0;
-        const results = await dataEngine.find(model, {
+        const objectName = resolveProtocolName(model);
+        const bridged = objectName !== model;
+        const filter = where ? convertWhere(bridged ? remapWhere(where) : where) : {};
+        const orderBy = sortBy ? [{ field: bridged ? camelToSnake(sortBy.field) : sortBy.field, order: sortBy.direction }] : void 0;
+        const results = await dataEngine.find(objectName, {
           where: filter,
           limit: limit || 100,
           offset,
           orderBy
         });
-        return results.map((r) => normaliseLegacyDates(model, r));
+        return results.map((r) => {
+          const norm = normaliseLegacyDates(model, r);
+          return bridged ? remapKeys(norm, snakeToCamel) : norm;
+        });
       },
       count: async ({ model, where }) => {
-        const filter = where ? convertWhere(where) : {};
-        return await dataEngine.count(model, { where: filter });
+        const objectName = resolveProtocolName(model);
+        const bridged = objectName !== model;
+        const filter = where ? convertWhere(bridged ? remapWhere(where) : where) : {};
+        return await dataEngine.count(objectName, { where: filter });
       },
       update: async ({ model, where, update }) => {
-        const filter = convertWhere(where);
-        const record = await dataEngine.findOne(model, { where: filter });
+        const objectName = resolveProtocolName(model);
+        const bridged = objectName !== model;
+        const filter = convertWhere(bridged ? remapWhere(where) : where);
+        const record = await dataEngine.findOne(objectName, { where: filter });
         if (!record) return null;
-        const result = await dataEngine.update(model, { ...update, id: record.id });
-        return result ? normaliseLegacyDates(model, result) : null;
+        const patch = bridged ? remapKeys(update, camelToSnake) : update;
+        const result = await dataEngine.update(objectName, { ...patch, id: record.id });
+        if (!result) return null;
+        const norm = normaliseLegacyDates(model, result);
+        return bridged ? remapKeys(norm, snakeToCamel) : norm;
       },
       updateMany: async ({ model, where, update }) => {
-        const filter = convertWhere(where);
-        const records = await dataEngine.find(model, { where: filter });
+        const objectName = resolveProtocolName(model);
+        const bridged = objectName !== model;
+        const filter = convertWhere(bridged ? remapWhere(where) : where);
+        const records = await dataEngine.find(objectName, { where: filter });
+        const patch = bridged ? remapKeys(update, camelToSnake) : update;
         for (const record of records) {
-          await dataEngine.update(model, { ...update, id: record.id });
+          await dataEngine.update(objectName, { ...patch, id: record.id });
         }
         return records.length;
       },
       delete: async ({ model, where }) => {
-        const filter = convertWhere(where);
-        const record = await dataEngine.findOne(model, { where: filter });
+        const objectName = resolveProtocolName(model);
+        const bridged = objectName !== model;
+        const filter = convertWhere(bridged ? remapWhere(where) : where);
+        const record = await dataEngine.findOne(objectName, { where: filter });
         if (!record) return;
-        await dataEngine.delete(model, { where: { id: record.id } });
+        await dataEngine.delete(objectName, { where: { id: record.id } });
       },
       deleteMany: async ({ model, where }) => {
-        const filter = convertWhere(where);
-        const records = await dataEngine.find(model, { where: filter });
+        const objectName = resolveProtocolName(model);
+        const bridged = objectName !== model;
+        const filter = convertWhere(bridged ? remapWhere(where) : where);
+        const records = await dataEngine.find(objectName, { where: filter });
         for (const record of records) {
-          await dataEngine.delete(model, { where: { id: record.id } });
+          await dataEngine.delete(objectName, { where: { id: record.id } });
         }
         return records.length;
       }
     })
   });
 }
-function createObjectQLAdapter(dataEngine) {
+function createObjectQLAdapter(rawDataEngine) {
+  const dataEngine = withSystemReadContext(rawDataEngine);
   return {
     create: async ({ model, data, select: _select }) => {
       const objectName = resolveProtocolName(model);
@@ -523,6 +590,31 @@ function buildOauthProviderPluginSchema() {
   };
 }
 var buildOidcProviderPluginSchema = buildOauthProviderPluginSchema;
+var AUTH_SSO_PROVIDER_SCHEMA = {
+  modelName: "sys_sso_provider",
+  fields: {
+    providerId: "provider_id",
+    oidcConfig: "oidc_config",
+    samlConfig: "saml_config",
+    userId: "user_id",
+    organizationId: "organization_id",
+    // DNS domain-ownership proof (ADR-0024 ②). @better-auth/sso writes
+    // `domainVerified` on its `ssoProvider` model when domain verification is
+    // enabled; map it so the env can surface a verified/unverified badge. The
+    // one-time `domainVerificationToken` is NOT a provider column — it lives in
+    // the verification table and is returned only from request-domain-verification.
+    domainVerified: "domain_verified"
+  }
+};
+var AUTH_SCIM_PROVIDER_SCHEMA = {
+  modelName: "sys_scim_provider",
+  fields: {
+    providerId: "provider_id",
+    scimToken: "scim_token",
+    organizationId: "organization_id",
+    userId: "user_id"
+  }
+};
 function buildDeviceAuthorizationPluginSchema() {
   return {
     deviceCode: AUTH_DEVICE_CODE_SCHEMA
@@ -587,9 +679,39 @@ function readDisableSignUpEnv() {
   if (signupEnabled != null) return !signupEnabled;
   return readBooleanEnv("OS_DISABLE_SIGNUP");
 }
+function readSsoOnlyEnv() {
+  return readBooleanEnv("OS_AUTH_SSO_ONLY");
+}
+function ipv4ToInt(ip) {
+  const m = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(ip.trim());
+  if (!m) return null;
+  const p = [Number(m[1]), Number(m[2]), Number(m[3]), Number(m[4])];
+  if (p.some((n) => n > 255)) return null;
+  return (p[0] << 24 >>> 0) + (p[1] << 16) + (p[2] << 8) + p[3] >>> 0;
+}
+function ipMatchesRange(ip, range) {
+  const r = (range || "").trim();
+  if (!r) return false;
+  if (r.includes("/")) {
+    const [base, bitsStr] = r.split("/");
+    const bits = Number(bitsStr);
+    const ipInt = ipv4ToInt(ip);
+    const baseInt = ipv4ToInt(base);
+    if (ipInt === null || baseInt === null || !(bits >= 0 && bits <= 32)) {
+      return ip.trim() === base.trim();
+    }
+    const mask = bits === 0 ? 0 : ~0 << 32 - bits >>> 0;
+    return (ipInt & mask) >>> 0 === (baseInt & mask) >>> 0;
+  }
+  return ip.trim() === r;
+}
 var AuthManager = class {
   constructor(config) {
     this.auth = null;
+    // ADR-0069 — cached "does any org require MFA" flag (per-org tightening).
+    // Refreshed lazily with a TTL so isAuthGateActive() stays synchronous + cheap.
+    this._orgMfaCache = { value: false, at: 0 };
+    this._orgMfaRefreshing = false;
     this.config = config;
     installWebContainerRequestStatePolyfill();
     if (config.authInstance) {
@@ -626,6 +748,14 @@ var AuthManager = class {
       // createAdapterFactory.
       user: {
         ...AUTH_USER_CONFIG
+        // NOTE: the env-side AI-seat marker `sys_user.ai_access` is deliberately
+        // NOT declared as a better-auth additionalField. sys_user is a
+        // better-auth-MANAGED table and better-auth SELECTs explicit columns, so
+        // declaring it here would make getSession query a column that may not
+        // exist on every env yet → broken auth. Instead the column is owned by
+        // the objectql `SysUser` object def (provisioned by boot schema-sync)
+        // and read by a GUARDED system query in resolveCtx (can only no-op,
+        // never break auth). better-auth stays oblivious to the extra column.
       },
       account: {
         ...AUTH_ACCOUNT_CONFIG,
@@ -674,7 +804,7 @@ var AuthManager = class {
       // lock the registration policy without relying on UI state.
       emailAndPassword: (() => {
         const disableSignUpFromEnv = readDisableSignUpEnv();
-        const effectiveDisableSignUp = disableSignUpFromEnv ?? this.config.emailAndPassword?.disableSignUp;
+        const effectiveDisableSignUp = this.resolveSsoOnly() ? true : disableSignUpFromEnv ?? this.config.emailAndPassword?.disableSignUp;
         return {
           enabled: this.config.emailAndPassword?.enabled ?? true,
           ...passwordHasher ? { password: passwordHasher } : {},
@@ -688,28 +818,28 @@ var AuthManager = class {
           sendResetPassword: async ({ user, url, token }) => {
             const email = this.getEmailService();
             if (!email) {
-              console.warn(
-                `[AuthManager] Password-reset requested for ${user.email} but no email service is wired. URL: ${url}`
+              throw new Error(
+                `Password-reset email could not be sent to ${user.email}: no email service is configured for this deployment.`
               );
-              return;
             }
             const ttlSec = this.config.emailAndPassword?.resetPasswordTokenExpiresIn ?? 60 * 60;
-            try {
-              await email.sendTemplate({
-                template: "auth.password_reset",
-                to: { address: user.email, ...user.name ? { name: user.name } : {} },
-                data: {
-                  user: { name: user.name || user.email, email: user.email, id: user.id },
-                  resetUrl: url,
-                  token,
-                  expiresInMinutes: Math.round(ttlSec / 60),
-                  appName: this.getAppName()
-                },
-                relatedObject: "sys_user",
-                relatedId: user.id
-              });
-            } catch (err) {
-              console.error(`[AuthManager] sendResetPassword failed (swallowed): ${err?.message ?? err}`);
+            const result = await email.sendTemplate({
+              template: "auth.password_reset",
+              to: { address: user.email, ...user.name ? { name: user.name } : {} },
+              data: {
+                user: { name: user.name || user.email, email: user.email, id: user.id },
+                resetUrl: url,
+                token,
+                expiresInMinutes: Math.round(ttlSec / 60),
+                appName: this.getAppName()
+              },
+              relatedObject: "sys_user",
+              relatedId: user.id
+            });
+            if (result?.status === "failed") {
+              throw new Error(
+                `Password-reset email could not be sent to ${user.email}: ${result.error ?? "delivery failed"}`
+              );
             }
           }
         };
@@ -724,28 +854,28 @@ var AuthManager = class {
           sendVerificationEmail: async ({ user, url, token }) => {
             const email = this.getEmailService();
             if (!email) {
-              console.warn(
-                `[AuthManager] Verification email requested for ${user.email} but no email service is wired. URL: ${url}`
+              throw new Error(
+                `Verification email could not be sent to ${user.email}: no email service is configured for this deployment.`
               );
-              return;
             }
             const ttlSec = this.config.emailVerification?.expiresIn ?? 60 * 60;
-            try {
-              await email.sendTemplate({
-                template: "auth.verify_email",
-                to: { address: user.email, ...user.name ? { name: user.name } : {} },
-                data: {
-                  user: { name: user.name || user.email, email: user.email, id: user.id },
-                  verificationUrl: url,
-                  token,
-                  expiresInMinutes: Math.round(ttlSec / 60),
-                  appName: this.getAppName()
-                },
-                relatedObject: "sys_user",
-                relatedId: user.id
-              });
-            } catch (err) {
-              console.error(`[AuthManager] sendVerificationEmail failed (swallowed): ${err?.message ?? err}`);
+            const result = await email.sendTemplate({
+              template: "auth.verify_email",
+              to: { address: user.email, ...user.name ? { name: user.name } : {} },
+              data: {
+                user: { name: user.name || user.email, email: user.email, id: user.id },
+                verificationUrl: url,
+                token,
+                expiresInMinutes: Math.round(ttlSec / 60),
+                appName: this.getAppName()
+              },
+              relatedObject: "sys_user",
+              relatedId: user.id
+            });
+            if (result?.status === "failed") {
+              throw new Error(
+                `Verification email could not be sent to ${user.email}: ${result.error ?? "delivery failed"}`
+              );
             }
           }
         }
@@ -758,12 +888,18 @@ var AuthManager = class {
         updateAge: this.config.session?.updateAge || 60 * 60 * 24
         // 1 day default
       },
+      // ADR-0069 D2 — per-IP rate limiting (native). Only set when configured
+      // so better-auth keeps its own defaults otherwise. The settings bind
+      // supplies stricter `customRules` for the auth endpoints.
+      ...this.config.rateLimit ? { rateLimit: this.config.rateLimit } : {},
       // better-auth plugins — registered based on AuthPluginConfig flags
       plugins,
       // Database hooks (fired by better-auth's adapter writes — these run
       // for SSO JIT-provisioning too, unlike kernel-level ObjectQL
-      // middleware which better-auth's adapter bypasses).
-      ...this.config.databaseHooks ? { databaseHooks: this.config.databaseHooks } : {},
+      // middleware which better-auth's adapter bypasses). The framework's
+      // identity-source stamp (`account.create.after`) is always composed in,
+      // preserving any host-supplied hooks.
+      databaseHooks: this.composeDatabaseHooks(this.config.databaseHooks),
       // Bootstrap bypass for `disableSignUp`. The first-run owner wizard
       // (`/_account/setup`) calls `POST /auth/sign-up/email` to create
       // the very first user — if `OS_DISABLE_SIGNUP=true` is set on a
@@ -774,6 +910,127 @@ var AuthManager = class {
       // sees `userCount > 0` and the toggle is enforced again.
       hooks: {
         before: createAuthMiddleware(async (ctx) => {
+          if (ctx?.path === "/sign-up/email" || ctx?.path === "/reset-password" || ctx?.path === "/change-password") {
+            const candidate = typeof ctx?.body?.password === "string" && ctx.body.password || typeof ctx?.body?.newPassword === "string" && ctx.body.newPassword || "";
+            if (candidate) await this.assertPasswordComplexity(candidate);
+            if (candidate && (ctx?.path === "/reset-password" || ctx?.path === "/change-password")) {
+              const userId = await this.resolvePasswordChangeUserId(ctx).catch(() => void 0);
+              if (userId) {
+                ctx.context.__osPwChangeUserId = userId;
+                const pw = ctx?.context?.password;
+                const verify = typeof pw?.verify === "function" ? pw.verify.bind(pw) : void 0;
+                const oldHash = await this.assertPasswordNotReused(userId, candidate, verify);
+                if (oldHash !== void 0) ctx.context.__osPwHistory = { userId, oldHash };
+              }
+            }
+          }
+          if (ctx?.path === "/sso/register") {
+            const actor = await this.resolveActor(ctx);
+            if (actor?.userId) {
+              const ok = await this.isOrgOrPlatformAdmin(actor.userId, actor.activeOrgId);
+              if (!ok) {
+                const { APIError } = await import("better-auth/api");
+                throw new APIError("FORBIDDEN", {
+                  message: "Only an organization owner/admin or a platform admin can register an SSO provider.",
+                  code: "SSO_REGISTER_FORBIDDEN"
+                });
+              }
+            }
+            return;
+          }
+          if (ctx?.path === "/oauth2/authorize" && this.config.oidcAuthorizeGate) {
+            const clientId = ctx?.query?.client_id;
+            if (clientId) {
+              let gateUserId;
+              try {
+                const { getSessionFromCtx } = await import("better-auth/api");
+                const s = await getSessionFromCtx(ctx);
+                gateUserId = s?.user?.id ?? s?.session?.userId;
+              } catch {
+              }
+              if (!gateUserId) {
+                try {
+                  const hdr = (k) => (ctx?.headers?.get?.(k) ?? ctx?.request?.headers?.get?.(k)) || "";
+                  let token;
+                  const bm = /^Bearer\s+(.+)$/i.exec(hdr("authorization"));
+                  if (bm?.[1]) token = bm[1].trim();
+                  if (!token) {
+                    const cm = /(?:^|;\s*)(?:__Secure-|__Host-)?better-auth\.session_token=([^;]+)/.exec(hdr("cookie"));
+                    if (cm?.[1]) token = decodeURIComponent(cm[1]).split(".")[0];
+                  }
+                  if (token) {
+                    const sess = await ctx.context.adapter.findOne({
+                      model: "session",
+                      where: [{ field: "token", value: token }]
+                    });
+                    const exp = sess?.expiresAt ?? sess?.expires_at;
+                    if (sess && (!exp || new Date(exp).getTime() > Date.now())) {
+                      gateUserId = String(sess.userId ?? sess.user_id ?? "") || void 0;
+                    }
+                  }
+                } catch {
+                }
+              }
+              if (gateUserId) {
+                const allowed = await this.config.oidcAuthorizeGate({
+                  userId: gateUserId,
+                  clientId: String(clientId)
+                });
+                if (!allowed) {
+                  const { APIError } = await import("better-auth/api");
+                  throw new APIError("FORBIDDEN", {
+                    message: "You are not authorized to sign in to this environment.",
+                    code: "ENV_ACCESS_DENIED"
+                  });
+                }
+              }
+            }
+            return;
+          }
+          if (ctx?.path === "/delete-user" || ctx?.path === "/admin/remove-user" || ctx?.path === "/admin/ban-user") {
+            let isLastLocalCredential = false;
+            try {
+              const adapter = ctx.context.adapter;
+              let targetId = ctx?.body?.userId ?? ctx?.body?.user_id;
+              if (!targetId && ctx.path === "/delete-user") {
+                const { getSessionFromCtx } = await import("better-auth/api");
+                const s = await getSessionFromCtx(ctx).catch(() => null);
+                targetId = s?.user?.id ?? s?.session?.userId;
+              }
+              if (targetId) {
+                const targetCred = await adapter.findOne({
+                  model: "account",
+                  where: [
+                    { field: "userId", value: targetId },
+                    { field: "providerId", value: "credential" }
+                  ]
+                });
+                if (targetCred) {
+                  const creds = await adapter.findMany({
+                    model: "account",
+                    where: [{ field: "providerId", value: "credential" }]
+                  });
+                  const otherHolders = new Set(
+                    (creds ?? []).map((a) => a?.userId ?? a?.user_id).filter((id) => id && id !== targetId)
+                  );
+                  isLastLocalCredential = otherHolders.size === 0;
+                }
+              }
+            } catch {
+            }
+            if (isLastLocalCredential) {
+              const { APIError } = await import("better-auth/api");
+              throw new APIError("CONFLICT", {
+                message: "Cannot remove the last local password login. At least one break-glass account with a password must remain so an identity-provider outage can never lock the organization out. Add another local password first, then retry.",
+                code: "LAST_LOCAL_CREDENTIAL"
+              });
+            }
+          }
+          if (ctx?.path === "/sign-in/email") {
+            const email = typeof ctx?.body?.email === "string" ? ctx.body.email : "";
+            if (email) await this.assertAccountNotLocked(email);
+            return;
+          }
           if (ctx?.path !== "/sign-up/email") return;
           const ep = ctx?.context?.options?.emailAndPassword;
           if (!ep?.disableSignUp) return;
@@ -788,7 +1045,54 @@ var AuthManager = class {
           }
         }),
         after: createAuthMiddleware(async (ctx) => {
+          if (ctx?.path === "/sign-in/email") {
+            const email = typeof ctx?.body?.email === "string" ? ctx.body.email : "";
+            if (email) {
+              let succeeded = true;
+              try {
+                const { isAPIError } = await import("better-auth/api");
+                succeeded = !isAPIError(ctx?.context?.returned);
+              } catch {
+                succeeded = !(ctx?.context?.returned instanceof Error);
+              }
+              await this.recordSignInOutcome(email, succeeded);
+              if (succeeded) {
+                const uid = ctx?.context?.returned?.user?.id;
+                if (typeof uid === "string") await this.enforceConcurrentCap(uid);
+              }
+            }
+            return;
+          }
+          if (ctx?.path === "/change-password" || ctx?.path === "/reset-password") {
+            let succeeded;
+            try {
+              const { isAPIError } = await import("better-auth/api");
+              succeeded = !isAPIError(ctx?.context?.returned);
+            } catch {
+              succeeded = !(ctx?.context?.returned instanceof Error);
+            }
+            if (succeeded) {
+              const stampId = ctx?.context?.__osPwChangeUserId;
+              if (stampId) await this.stampPasswordChangedAt(stampId);
+              const stash = ctx?.context?.__osPwHistory;
+              if (stash?.userId) await this.recordPasswordHistory(stash.userId, stash.oldHash);
+            }
+            delete ctx.context.__osPwChangeUserId;
+            delete ctx.context.__osPwHistory;
+            return;
+          }
           if (ctx?.path !== "/sign-up/email") return;
+          {
+            const newUserId = ctx?.context?.returned?.user?.id;
+            let signupOk;
+            try {
+              const { isAPIError } = await import("better-auth/api");
+              signupOk = !isAPIError(ctx?.context?.returned);
+            } catch {
+              signupOk = !(ctx?.context?.returned instanceof Error);
+            }
+            if (signupOk && typeof newUserId === "string") await this.stampPasswordChangedAt(newUserId);
+          }
           const ep = ctx?.context?.options?.emailAndPassword;
           if (ep && ctx.context.__osDisableSignUpOrig !== void 0) {
             ep.disableSignUp = ctx.context.__osDisableSignUpOrig;
@@ -800,7 +1104,7 @@ var AuthManager = class {
       // Auto-includes origins from OS_CORS_ORIGIN env var so CORS and CSRF stay in sync.
       ...(() => {
         const origins = [...this.config.trustedOrigins || []];
-        const corsOrigin = (0, import_types.readEnvWithDeprecation)("OS_CORS_ORIGIN", "CORS_ORIGIN");
+        const corsOrigin = (0, import_types.readEnvWithDeprecation)("OS_CORS_ORIGIN", "CORS_ORIGIN", { silent: true });
         if (corsOrigin && corsOrigin !== "*") {
           corsOrigin.split(",").map((s) => s.trim()).filter(Boolean).forEach((o) => {
             if (!origins.includes(o)) origins.push(o);
@@ -811,6 +1115,20 @@ var AuthManager = class {
           origins.push("http://*.localhost:*");
           origins.push("https://*.localhost:*");
         }
+        if (this.isSsoWired()) {
+          return {
+            trustedOrigins: async (request) => {
+              const base = [...origins];
+              try {
+                for (const o of await this.ssoDiscoveryTrustedOrigins(request)) {
+                  if (!base.includes(o)) base.push(o);
+                }
+              } catch {
+              }
+              return base;
+            }
+          };
+        }
         return origins.length ? { trustedOrigins: origins } : {};
       })(),
       // Advanced options (cross-subdomain cookies, secure cookies, CSRF, etc.)
@@ -886,17 +1204,25 @@ var AuthManager = class {
   async buildPluginList() {
     const pluginConfig = this.config.plugins ?? {};
     const plugins = [];
-    const oidcEnv = globalThis?.process?.env?.OS_OIDC_PROVIDER_ENABLED;
-    const oidcFromEnv = oidcEnv != null ? String(oidcEnv).toLowerCase() === "true" : void 0;
+    const oidcFromEnv = readBooleanEnv("OS_OIDC_PROVIDER_ENABLED");
+    const ssoFromEnv = readBooleanEnv("OS_SSO_ENABLED");
+    const scimFromEnv = readBooleanEnv("OS_SCIM_ENABLED");
+    const ssoDomainVerifyFromEnv = readBooleanEnv("OS_SSO_DOMAIN_VERIFICATION");
+    const scimEffective = scimFromEnv ?? pluginConfig.scim ?? false;
     const twoFactorFromEnv = readBooleanEnv("OS_AUTH_TWO_FACTOR");
+    const hibpFromEnv = readBooleanEnv("OS_AUTH_PASSWORD_REJECT_BREACHED");
     const enabled = {
       organization: pluginConfig.organization ?? true,
       twoFactor: twoFactorFromEnv ?? pluginConfig.twoFactor ?? false,
+      passwordRejectBreached: hibpFromEnv ?? pluginConfig.passwordRejectBreached ?? false,
       passkeys: pluginConfig.passkeys ?? false,
       magicLink: pluginConfig.magicLink ?? false,
       oidcProvider: oidcFromEnv ?? pluginConfig.oidcProvider ?? false,
       deviceAuthorization: pluginConfig.deviceAuthorization ?? false,
-      admin: pluginConfig.admin ?? false
+      admin: pluginConfig.admin ?? scimEffective,
+      sso: ssoFromEnv ?? pluginConfig.sso ?? false,
+      ssoDomainVerification: ssoDomainVerifyFromEnv ?? pluginConfig.ssoDomainVerification ?? false,
+      scim: scimEffective
     };
     const { bearer } = await import("better-auth/plugins/bearer");
     plugins.push(bearer());
@@ -939,6 +1265,28 @@ var AuthManager = class {
         // the built-in /accept-invitation route usable for pilots; operators
         // who wire a real mailer can re-enable downstream.
         requireEmailVerificationOnInvitation: false,
+        // Cap how many orgs a user can CREATE (OS_ORG_LIMIT). Counts only orgs
+        // the user OWNS (role=owner) — never orgs they were merely invited into —
+        // so a generous cap stops scripted org/free-env spam (each new org can
+        // auto-provision a free environment on the cloud control plane) WITHOUT
+        // ever blocking a collaborator who belongs to many orgs. Unset → no
+        // limit (self-host default). Fail-open: if the count can't be taken we
+        // allow creation rather than block a legitimate user on an infra hiccup.
+        organizationLimit: async (user) => {
+          const limit = (0, import_types.resolveOrgLimit)();
+          if (limit == null) return false;
+          const engine = this.config.dataEngine;
+          const uid = typeof user?.id === "string" ? user.id : "";
+          if (!engine || !uid) return false;
+          try {
+            const owned = await withSystemReadContext(engine).count("sys_member", {
+              where: { user_id: uid, role: "owner" }
+            });
+            return (owned ?? 0) >= limit;
+          } catch {
+            return false;
+          }
+        },
         ...customOrgRoles ? { roles: customOrgRoles } : {},
         // ── Slug-change guard ─────────────────────────────────────
         // An org's slug is baked into every env hostname at creation
@@ -957,21 +1305,35 @@ var AuthManager = class {
           // The plugin itself is always installed (so list/update/invite endpoints
           // keep responding); only the `create` operation is denied when the
           // deployment is provisioned in single-org mode. Resolution order:
-          // 1. explicit `OS_MULTI_ORG_ENABLED` (wins for backwards compat),
-          // 2. else `OS_MULTI_TENANT` (multi-tenant deployments are always
-          //    multi-org), default `'false'` → single-org / per-env runtime.
+          // `OS_MULTI_ORG_ENABLED` (default `'false'` → single-org /
+          // per-env runtime).
           beforeCreateOrganization: async () => {
-            const env = globalThis?.process?.env ?? {};
-            const explicit = env.OS_MULTI_ORG_ENABLED;
-            const legacy = explicit === void 0 ? (0, import_types.readEnvWithDeprecation)("OS_MULTI_ORG_ENABLED", "OS_MULTI_TENANT") : explicit;
-            const flag = String(legacy ?? "false").toLowerCase();
-            if (flag === "false") {
+            if (!(0, import_types.resolveMultiOrgEnabled)()) {
               const { APIError } = await import("better-auth/api");
               throw new APIError("FORBIDDEN", {
                 message: "Creating additional organizations is disabled on this deployment."
               });
             }
           },
+          // Run host-provided org-creation side effects (e.g. the cloud control
+          // plane provisions the org's born-with production environment). The
+          // org-plugin's models don't fire core databaseHooks, so this is the
+          // only server-side seam for "every org is born with its prod env".
+          // Failure-isolated: org creation must not roll back on a side-effect miss.
+          afterCreateOrganization: async ({ organization: organization2, member, user }) => {
+            const cb = this.config.onOrganizationCreated;
+            if (typeof cb !== "function") return;
+            try {
+              await cb({
+                organizationId: organization2?.id,
+                userId: user?.id ?? member?.userId,
+                name: organization2?.name,
+                slug: organization2?.slug
+              });
+            } catch (err) {
+              console.warn("[auth] onOrganizationCreated callback failed:", err?.message ?? String(err));
+            }
+          },
           beforeUpdateOrganization: async ({ organization: organization2, member }) => {
             const newSlug = organization2?.slug;
             const orgId = member?.organizationId;
@@ -1049,6 +1411,12 @@ var AuthManager = class {
         schema: buildTwoFactorPluginSchema()
       }));
     }
+    if (enabled.passwordRejectBreached) {
+      const { haveIBeenPwned } = await import("better-auth/plugins/haveibeenpwned");
+      plugins.push(haveIBeenPwned({
+        customPasswordCompromisedMessage: "This password has appeared in a known data breach. Please choose a different one."
+      }));
+    }
     if (enabled.admin) {
       const { admin } = await import("better-auth/plugins/admin");
       plugins.push(admin({
@@ -1116,6 +1484,17 @@ var AuthManager = class {
         schema: buildOauthProviderPluginSchema()
       }));
     }
+    if (enabled.sso) {
+      const { sso } = await import("@better-auth/sso");
+      plugins.push(sso({
+        organizationProvisioning: { defaultRole: "member" },
+        ...enabled.ssoDomainVerification ? { domainVerification: { enabled: true } } : {}
+      }));
+    }
+    if (enabled.scim) {
+      const { scim } = await import("@better-auth/scim");
+      plugins.push(scim({ storeSCIMToken: "hashed" }));
+    }
     if (enabled.deviceAuthorization) {
       const { deviceAuthorization } = await import("better-auth/plugins/device-authorization");
       const baseUrl = (this.config.baseUrl ?? "").replace(/\/$/, "");
@@ -1152,30 +1531,45 @@ var AuthManager = class {
             return false;
           }
         };
-        const isActiveOrgAdmin = async () => {
+        const activeOrgRoles = async () => {
           try {
             const orgId = session?.activeOrganizationId;
-            if (!orgId) return false;
+            if (!orgId) return [];
             const members = await dataEngine.find("sys_member", {
               where: { user_id: user.id, organization_id: orgId },
               limit: 5
             });
-            return (Array.isArray(members) ? members : []).some((m) => {
+            const out = [];
+            for (const m of Array.isArray(members) ? members : []) {
               const raw = typeof m?.role === "string" ? m.role : "";
-              const roles2 = raw.split(",").map((s) => s.trim().toLowerCase());
-              return roles2.includes("owner") || roles2.includes("admin");
-            });
+              for (const r of raw.split(",").map((s) => s.trim()).filter(Boolean)) {
+                const mapped = (0, import_spec.mapMembershipRole)(r);
+                if (!out.includes(mapped)) out.push(mapped);
+              }
+            }
+            return out;
           } catch {
-            return false;
+            return [];
           }
         };
         const platformAdmin = await isPlatformAdmin();
-        const promote = platformAdmin || await isActiveOrgAdmin();
+        const orgRoles = await activeOrgRoles();
         const storedRole = typeof user.role === "string" ? user.role : "";
-        const roles = storedRole.split(",").map((s) => s.trim()).filter(Boolean);
-        if (promote && !roles.includes("admin")) roles.push("admin");
-        if (!promote) return { user: { ...user, roles, isPlatformAdmin: platformAdmin }, session };
-        return { user: { ...user, role: "admin", roles, isPlatformAdmin: platformAdmin }, session };
+        const roles = Array.from(/* @__PURE__ */ new Set([
+          ...storedRole.split(",").map((s) => s.trim()).filter(Boolean),
+          ...orgRoles,
+          ...platformAdmin ? [import_spec.BUILTIN_ROLE_PLATFORM_ADMIN] : []
+        ]));
+        await this.enforceSessionControls(session?.id, session?.createdAt);
+        const authGate = await this.computeAuthGate(
+          user.id,
+          session?.activeOrganizationId,
+          user?.twoFactorEnabled === true
+        );
+        return {
+          user: { ...user, roles, isPlatformAdmin: platformAdmin, ...authGate ? { authGate } : {} },
+          session
+        };
       }));
     }
     return plugins;
@@ -1205,7 +1599,7 @@ var AuthManager = class {
    * Generate a secure secret if not provided
    */
   generateSecret() {
-    const envSecret = (0, import_types.readEnvWithDeprecation)("OS_AUTH_SECRET", ["AUTH_SECRET", "BETTER_AUTH_SECRET"]);
+    const envSecret = (0, import_types.readEnvWithDeprecation)("OS_AUTH_SECRET", ["AUTH_SECRET", "BETTER_AUTH_SECRET"], { silent: true });
     if (envSecret) return envSecret;
     if (process.env.NODE_ENV === "production") {
       throw new Error(
@@ -1374,6 +1768,18 @@ var AuthManager = class {
   // `sys_device_code`. Enable via `plugins.deviceAuthorization: true` in
   // AuthPluginConfig.
   // ---------------------------------------------------------------------------
+  /**
+   * SSO-only ("enforced") login mode: the login UI hides the local password
+   * form + self-registration so the team signs in via the IdP only.
+   * `OS_AUTH_SSO_ONLY` (when set) wins over the `ssoOnlyMode` config knob —
+   * parity with the `disableSignUp` env override — so a deployment can force
+   * it regardless of the per-env/config value. Break-glass is preserved: this
+   * NEVER disables `emailAndPassword.enabled`; it only forces `disableSignUp`
+   * and signals the UI to hide the password form. Generic over the IdP.
+   */
+  resolveSsoOnly() {
+    return readSsoOnlyEnv() ?? (this.config.ssoOnlyMode ?? false);
+  }
   getPublicConfig() {
     const socialProviders = [];
     if (this.config.socialProviders) {
@@ -1411,16 +1817,15 @@ var AuthManager = class {
     }
     const emailPasswordConfig = this.config.emailAndPassword ?? {};
     const disableSignUpFromEnv = readDisableSignUpEnv();
+    const ssoOnly = this.resolveSsoOnly();
     const emailPassword = {
       enabled: emailPasswordConfig.enabled !== false,
       // Default to true
-      disableSignUp: disableSignUpFromEnv ?? emailPasswordConfig.disableSignUp ?? false,
+      disableSignUp: ssoOnly ? true : disableSignUpFromEnv ?? emailPasswordConfig.disableSignUp ?? false,
       requireEmailVerification: emailPasswordConfig.requireEmailVerification ?? false
     };
     const pluginConfig = this.config.plugins ?? {};
-    const multiOrgEnv = globalThis?.process?.env ?? {};
-    const multiOrgRaw = multiOrgEnv.OS_MULTI_ORG_ENABLED !== void 0 ? multiOrgEnv.OS_MULTI_ORG_ENABLED : (0, import_types.readEnvWithDeprecation)("OS_MULTI_ORG_ENABLED", "OS_MULTI_TENANT") ?? "false";
-    const multiOrgEnabled = String(multiOrgRaw).toLowerCase() !== "false";
+    const multiOrgEnabled = (0, import_types.resolveMultiOrgEnabled)();
     const DEFAULT_TERMS_URL = "https://objectstack.ai/terms";
     const DEFAULT_PRIVACY_URL = "https://objectstack.ai/privacy";
     const rawTermsUrl = globalThis?.process?.env?.OS_TERMS_URL;
@@ -1443,6 +1848,15 @@ var AuthManager = class {
       organization: pluginConfig.organization ?? true,
       multiOrgEnabled,
       oidcProvider: oidcFromEnv ?? pluginConfig.oidcProvider ?? false,
+      // Coarse "is the @better-auth/sso plugin wired" flag. The `/auth/config`
+      // route refines this to "usable" (≥1 provider configured) via
+      // `isSsoUsable()` so the login UI can hide the "Sign in with SSO" button
+      // both when SSO is off AND when it's on but no IdP exists yet.
+      sso: this.isSsoWired(),
+      // SSO-only ("enforced"): tell the login UI to hide the local password
+      // form + self-registration. A break-glass "use a password" link remains
+      // for the env owner / local admin. Driven by `ssoOnlyMode` / `OS_AUTH_SSO_ONLY`.
+      ssoEnforced: ssoOnly,
       deviceAuthorization: pluginConfig.deviceAuthorization ?? false,
       admin: pluginConfig.admin ?? false,
       ...termsUrl ? { termsUrl } : {},
@@ -1454,6 +1868,712 @@ var AuthManager = class {
       features
     };
   }
+  /**
+   * Coarse "is the domain-routed `@better-auth/sso` plugin wired" flag.
+   * Resolved with the EXACT logic that decides whether the plugin is mounted
+   * in `buildPlugins()` (`ssoFromEnv ?? pluginConfig.sso ?? false`) so the
+   * advertised capability can never disagree with the actual `/sign-in/sso`
+   * route. `OS_SSO_ENABLED` (when set) wins over the config-file setting.
+   * Public so `AuthPlugin` can gate the Setup-nav "SSO Providers" entry on it
+   * (captures both self-host `OS_SSO_ENABLED` and the cloud per-env
+   * `planAllowsSso` config, since that arrives via `plugins.sso`).
+   */
+  isSsoWired() {
+    const ssoFromEnv = readBooleanEnv("OS_SSO_ENABLED");
+    return ssoFromEnv ?? this.config.plugins?.sso ?? false;
+  }
+  /**
+   * Whether opt-in DNS domain-verification (ADR-0024 ②) is wired — i.e. the
+   * `/sso/request-domain-verification` + `/sso/verify-domain` endpoints are
+   * mounted (and the hard "domain must be verified to log in" gate is active).
+   * Resolved with the EXACT logic `buildPluginList` uses for the `sso()`
+   * `domainVerification.enabled` option, so the bridge can return a clear
+   * "not enabled for this environment" instead of a bare 404 when off.
+   * Implies `isSsoWired()` (the sso plugin must be loaded to honor it).
+   */
+  isSsoDomainVerificationEnabled() {
+    if (!this.isSsoWired()) return false;
+    const fromEnv = readBooleanEnv("OS_SSO_DOMAIN_VERIFICATION");
+    return fromEnv ?? this.config.plugins?.ssoDomainVerification ?? false;
+  }
+  /**
+   * Whether enterprise SSO is actually *usable*, not merely wired: the plugin
+   * is on AND at least one `sys_sso_provider` row exists. Per-email domain→IdP
+   * matching still happens at `/sign-in/sso`; this answers the coarser "is
+   * there any point showing the SSO button at all", so a freshly-enabled but
+   * unconfigured SSO setup doesn't advertise a button that errors for everyone.
+   *
+   * Fails OPEN to the wired flag when providers can't be counted (no data
+   * engine, query error) — a config-introspection hiccup must never make the
+   * login page hide a button that genuinely works.
+   */
+  async isSsoUsable() {
+    if (!this.isSsoWired()) return false;
+    const engine = this.getDataEngine();
+    if (!engine) return true;
+    try {
+      const count = await withSystemReadContext(engine).count("sys_sso_provider");
+      return typeof count === "number" ? count > 0 : true;
+    } catch {
+      return true;
+    }
+  }
+  /**
+   * Extra `trustedOrigins` entries derived from an external-SSO registration
+   * request. For a `POST /sso/register` | `/sso/update-provider`, parse the
+   * (cloned) body and return the PUBLIC-ROUTABLE origins of the declared
+   * `issuer` / `oidcConfig` endpoints so `@better-auth/sso`'s discovery
+   * validation accepts a customer IdP registered at runtime (ADR-0024) without
+   * the operator pre-listing it in boot config. Only public-routable hosts are
+   * returned — private / internal / loopback hosts are never auto-trusted
+   * (better-auth's `isPublicRoutableHost`, the same predicate its own
+   * sub-endpoint check uses). Best-effort: any parse error yields `[]`.
+   */
+  async ssoDiscoveryTrustedOrigins(request) {
+    try {
+      const req = request;
+      if (!req || typeof req.clone !== "function" || !req.url) return [];
+      if ((req.method ?? "GET").toUpperCase() !== "POST") return [];
+      const path = new URL(req.url).pathname;
+      if (!/\/sso\/(register|update-provider)$/.test(path)) return [];
+      const body = await req.clone().json().catch(() => null);
+      if (!body || typeof body !== "object") return [];
+      const oidc = body.oidcConfig ?? {};
+      const candidates = [
+        body.issuer,
+        oidc.discoveryEndpoint,
+        oidc.authorizationEndpoint,
+        oidc.tokenEndpoint,
+        oidc.jwksEndpoint,
+        oidc.userInfoEndpoint
+      ].filter((v) => typeof v === "string" && v.length > 0);
+      if (!candidates.length) return [];
+      const { isPublicRoutableHost } = await import("@better-auth/core/utils/host");
+      const out = [];
+      for (const c of candidates) {
+        try {
+          const u = new URL(c);
+          if (isPublicRoutableHost(u.hostname) && !out.includes(u.origin)) out.push(u.origin);
+        } catch {
+        }
+      }
+      return out;
+    } catch {
+      return [];
+    }
+  }
+  /**
+   * Resolve the acting user (+ their active org) for a before-hook gate,
+   * hook-order-independent. Tries the standard cookie session first, then falls
+   * back to explicit token resolution (bearer or the session cookie's token
+   * part) — the bearer plugin may convert `Authorization: Bearer` to a session
+   * AFTER this global before-hook runs. Returns `null` when no valid session
+   * can be resolved (→ caller lets `sessionMiddleware` issue the 401).
+   */
+  async resolveActor(ctx) {
+    try {
+      const { getSessionFromCtx } = await import("better-auth/api");
+      const s = await getSessionFromCtx(ctx);
+      const userId = s?.user?.id ?? s?.session?.userId;
+      if (userId) {
+        return {
+          userId: String(userId),
+          activeOrgId: s?.session?.activeOrganizationId ?? s?.activeOrganizationId ?? void 0
+        };
+      }
+    } catch {
+    }
+    try {
+      const hdr = (k) => (ctx?.headers?.get?.(k) ?? ctx?.request?.headers?.get?.(k)) || "";
+      let token;
+      const bm = /^Bearer\s+(.+)$/i.exec(hdr("authorization"));
+      if (bm?.[1]) token = bm[1].trim();
+      if (!token) {
+        const cm = /(?:^|;\s*)(?:__Secure-|__Host-)?better-auth\.session_token=([^;]+)/.exec(hdr("cookie"));
+        if (cm?.[1]) token = decodeURIComponent(cm[1]).split(".")[0];
+      }
+      if (token) {
+        const sess = await ctx.context.adapter.findOne({
+          model: "session",
+          where: [{ field: "token", value: token }]
+        });
+        const exp = sess?.expiresAt ?? sess?.expires_at;
+        if (sess && (!exp || new Date(exp).getTime() > Date.now())) {
+          const userId = String(sess.userId ?? sess.user_id ?? "");
+          if (userId) {
+            return {
+              userId,
+              activeOrgId: sess.activeOrganizationId ?? sess.active_organization_id ?? void 0
+            };
+          }
+        }
+      }
+    } catch {
+    }
+    return null;
+  }
+  /**
+   * True when `userId` is a platform admin (a `sys_user_permission_set` row
+   * pointing at `admin_full_access` with `organization_id = null`) OR an
+   * owner/admin member of `activeOrgId` (any org membership with role
+   * owner/admin when no active org is set). Mirrors the role-derivation in
+   * `customSession`; reads through `withSystemReadContext` so the lookups are
+   * not themselves RLS-scoped to the acting (possibly non-privileged) user.
+   * Fails CLOSED (returns false) on any lookup error — this backs a security
+   * gate, so an unverifiable actor must never pass.
+   */
+  async isOrgOrPlatformAdmin(userId, activeOrgId) {
+    const engine = this.getDataEngine();
+    if (!engine) return false;
+    const sys = withSystemReadContext(engine);
+    try {
+      const links = await sys.find("sys_user_permission_set", {
+        where: { user_id: userId },
+        limit: 50
+      });
+      const platformLinks = (Array.isArray(links) ? links : []).filter(
+        (l) => !l.organization_id
+      );
+      if (platformLinks.length) {
+        const sets = await sys.find("sys_permission_set", { limit: 50 });
+        const adminSet = (Array.isArray(sets) ? sets : []).find(
+          (r) => r.name === "admin_full_access"
+        );
+        if (adminSet && platformLinks.some((l) => l.permission_set_id === adminSet.id)) {
+          return true;
+        }
+      }
+      const where = { user_id: userId };
+      if (activeOrgId) where.organization_id = activeOrgId;
+      const members = await sys.find("sys_member", { where, limit: 10 });
+      for (const m of Array.isArray(members) ? members : []) {
+        const raw = typeof m?.role === "string" ? m.role : "";
+        if (raw.split(",").map((s) => s.trim()).some((r) => r === "owner" || r === "admin")) {
+          return true;
+        }
+      }
+      return false;
+    } catch {
+      return false;
+    }
+  }
+  /**
+   * Compose the framework's identity-source stamp (`account.create.after`)
+   * with any host-supplied `databaseHooks`, preserving BOTH. The cloud passes
+   * `user.create.after` (personal-org provisioning) + `session.create.before`
+   * (active-org) — different model/op, so no collision — but if a host ever
+   * adds its own `account.create.after` we chain it after the stamp rather
+   * than silently dropping one.
+   */
+  composeDatabaseHooks(host) {
+    const stamp = (account, ctx) => this.stampIdentitySource(account, ctx);
+    const hostAccountAfter = host?.account?.create?.after;
+    const after = hostAccountAfter ? async (account, ctx) => {
+      await stamp(account, ctx);
+      return hostAccountAfter(account, ctx);
+    } : stamp;
+    return {
+      ...host ?? {},
+      account: {
+        ...host?.account ?? {},
+        create: {
+          ...host?.account?.create ?? {},
+          after
+        }
+      }
+    };
+  }
+  /**
+   * Maintain `sys_user.source` (ADR-0024 D4 provenance) as accounts are linked.
+   * Drives the managed-vs-native user-mgmt gating: a managed (`idp-provisioned`)
+   * user holds no local credential, so the password / identity-edit actions
+   * hide for them — preventing a managed user from self-minting a local
+   * password that would bypass enforced SSO.
+   *
+   * Two cases, both break-glass safe and idempotent (only writes on a real
+   * change, so trackHistory stays quiet):
+   *
+   *  • A **federated** account (any non-`credential` provider — the cloud-as-IdP
+   *    `objectstack-cloud` provider OR a customer's own OIDC/SAML IdP) is
+   *    linked AND the user holds NO local credential → mark `idp-provisioned`.
+   *    A user who already has a `credential` account (an env-native user who
+   *    linked SSO) is left `env-native` — they keep a usable password.
+   *
+   *  • A **credential** account is created (local signup, or the break-glass
+   *    owner's password set via set-initial-password — which can land AFTER the
+   *    first SSO link) → ensure `env-native`. This flips a previously-stamped
+   *    owner back, so the break-glass admin never loses self-service password
+   *    management.
+   *
+   * Best-effort: any failure leaves the prior value (the gate fails open — a
+   * managed user might transiently show a password action that simply errors —
+   * never a hard login failure).
+   */
+  async stampIdentitySource(account, _ctx) {
+    try {
+      const providerId = account?.providerId ?? account?.provider_id;
+      const userId = account?.userId ?? account?.user_id;
+      if (!userId || !providerId) return;
+      const engine = this.getDataEngine();
+      if (!engine) return;
+      const SYSTEM_CTX = { isSystem: true, roles: [], permissions: [] };
+      if (providerId === "credential") {
+        const u = await engine.findOne("sys_user", {
+          filter: { id: userId },
+          fields: ["id", "source"],
+          context: SYSTEM_CTX
+        });
+        if (u && u.source === "idp_provisioned") {
+          await engine.update("sys_user", { id: userId, source: "env_native" }, { context: SYSTEM_CTX });
+        }
+        return;
+      }
+      const credentialCount = await engine.count("sys_account", {
+        filter: { user_id: userId, provider_id: "credential" },
+        context: SYSTEM_CTX
+      });
+      if (typeof credentialCount === "number" && credentialCount > 0) return;
+      await engine.update("sys_user", { id: userId, source: "idp_provisioned" }, { context: SYSTEM_CTX });
+    } catch {
+    }
+  }
+  /**
+   * ADR-0069 D1 — reject a password that doesn't meet the configured character-
+   * class complexity. No-op when `passwordRequireComplexity` is off. Counts the
+   * four classes (upper / lower / digit / symbol) present and throws
+   * `PASSWORD_POLICY_VIOLATION` when fewer than `passwordMinClasses` are used.
+   */
+  async assertPasswordComplexity(password) {
+    if (!this.config.passwordRequireComplexity) return;
+    const min = Math.min(4, Math.max(1, Math.floor(Number(this.config.passwordMinClasses) || 3)));
+    const classes = (/[a-z]/.test(password) ? 1 : 0) + (/[A-Z]/.test(password) ? 1 : 0) + (/[0-9]/.test(password) ? 1 : 0) + (/[^A-Za-z0-9]/.test(password) ? 1 : 0);
+    if (classes < min) {
+      const { APIError } = await import("better-auth/api");
+      throw new APIError("BAD_REQUEST", {
+        message: `Password must include at least ${min} of: uppercase, lowercase, digit, symbol.`,
+        code: "PASSWORD_POLICY_VIOLATION"
+      });
+    }
+  }
+  /**
+   * ADR-0069 — is any authentication-policy gate enabled? Cheap, synchronous;
+   * lets the transport seams skip session lookups entirely when off (the
+   * default), keeping the gate zero-overhead until an admin opts in.
+   */
+  isAuthGateActive() {
+    this.refreshOrgMfaCacheIfStale();
+    return Math.floor(Number(this.config.passwordExpiryDays) || 0) > 0 || this.config.mfaRequired === true || this._orgMfaCache.value;
+  }
+  /**
+   * ADR-0069 — refresh the "any org requires MFA" cache in the background when
+   * stale (60s TTL). Fire-and-forget: a brand-new per-org requirement activates
+   * the gate on the next request, never blocking this one. No-op when global MFA
+   * is already on (the gate is active regardless).
+   */
+  refreshOrgMfaCacheIfStale() {
+    if (this.config.mfaRequired === true) return;
+    if (this._orgMfaRefreshing) return;
+    if (Date.now() - this._orgMfaCache.at < 6e4) return;
+    const engine = this.getDataEngine();
+    if (!engine) return;
+    this._orgMfaRefreshing = true;
+    void (async () => {
+      try {
+        const SYSTEM_CTX = { isSystem: true, roles: [], permissions: [] };
+        const n = await engine.count("sys_organization", {
+          where: { require_mfa: true },
+          context: SYSTEM_CTX
+        });
+        this._orgMfaCache = { value: typeof n === "number" && n > 0, at: Date.now() };
+      } catch {
+      } finally {
+        this._orgMfaRefreshing = false;
+      }
+    })();
+  }
+  /**
+   * ADR-0069 — compute the auth-policy gate posture for a session. Returns an
+   * `{ code, message }` when the user is currently blocked (e.g. password
+   * expired), else undefined. No-op (and no DB read) when no gate feature is
+   * enabled. Fails OPEN on any lookup error — a transient hiccup must never lock
+   * a compliant user out.
+   */
+  async computeAuthGate(userId, _activeOrgId, _twoFactorEnabledHint) {
+    const expiryDays = Math.floor(Number(this.config.passwordExpiryDays) || 0);
+    const mfaGlobal = this.config.mfaRequired === true;
+    const orgMaybeRequires = !mfaGlobal && !!_activeOrgId && this._orgMfaCache.value;
+    if (expiryDays <= 0 && !mfaGlobal && !orgMaybeRequires) return void 0;
+    const engine = this.getDataEngine();
+    if (!engine || !userId) return void 0;
+    try {
+      const SYSTEM_CTX = { isSystem: true, roles: [], permissions: [] };
+      const u = await engine.findOne("sys_user", {
+        where: { id: userId },
+        fields: ["password_changed_at", "two_factor_enabled", "mfa_required_at"],
+        context: SYSTEM_CTX
+      });
+      let mfaRequired = mfaGlobal;
+      if (!mfaRequired && orgMaybeRequires) {
+        const org = await engine.findOne("sys_organization", {
+          where: { id: _activeOrgId },
+          fields: ["require_mfa"],
+          context: SYSTEM_CTX
+        });
+        mfaRequired = org?.require_mfa === true || org?.require_mfa === 1;
+      }
+      if (expiryDays > 0) {
+        const changed = u?.password_changed_at;
+        if (changed && Date.now() - new Date(changed).getTime() > expiryDays * 864e5) {
+          return {
+            code: "PASSWORD_EXPIRED",
+            message: "Your password has expired. Please change it to continue."
+          };
+        }
+      }
+      if (mfaRequired && !(u?.two_factor_enabled === true || u?.two_factor_enabled === 1)) {
+        const graceDays = Math.max(0, Math.floor(Number(this.config.mfaGracePeriodDays ?? 7)));
+        let requiredAt = u?.mfa_required_at;
+        if (!requiredAt) {
+          requiredAt = /* @__PURE__ */ new Date();
+          engine.update("sys_user", { id: userId, mfa_required_at: requiredAt }, { context: SYSTEM_CTX }).catch(() => void 0);
+        }
+        const elapsedMs = Date.now() - new Date(requiredAt).getTime();
+        if (elapsedMs > graceDays * 864e5) {
+          return {
+            code: "MFA_REQUIRED",
+            message: "Multi-factor authentication is required. Please set up an authenticator app to continue."
+          };
+        }
+      }
+    } catch {
+      return void 0;
+    }
+    return void 0;
+  }
+  /**
+   * ADR-0069 D1 — stamp `sys_user.password_changed_at = now` after a password is
+   * set (sign-up / change / reset). Best-effort; never throws. Written as a Date
+   * (never epoch-ms) per ADR-0074.
+   */
+  async stampPasswordChangedAt(userId) {
+    const engine = this.getDataEngine();
+    if (!engine || !userId) return;
+    try {
+      const SYSTEM_CTX = { isSystem: true, roles: [], permissions: [] };
+      await engine.update(
+        "sys_user",
+        { id: userId, password_changed_at: /* @__PURE__ */ new Date() },
+        { context: SYSTEM_CTX }
+      );
+    } catch {
+    }
+  }
+  /**
+   * ADR-0069 D1 — parse the bounded `previous_password_hashes` JSON column into
+   * a string[] of hashes, tolerating null / malformed values.
+   */
+  parseHashes(raw) {
+    if (typeof raw !== "string" || !raw.trim()) return [];
+    try {
+      const arr = JSON.parse(raw);
+      return Array.isArray(arr) ? arr.filter((h) => typeof h === "string" && !!h) : [];
+    } catch {
+      return [];
+    }
+  }
+  /**
+   * ADR-0069 D1 — resolve the user whose password is being changed. For
+   * `/change-password` the caller is authenticated (session); for
+   * `/reset-password` the user is carried by the reset token's verification
+   * value (the same lookup better-auth's own handler uses).
+   */
+  async resolvePasswordChangeUserId(ctx) {
+    if (ctx?.path === "/change-password") {
+      const { getSessionFromCtx } = await import("better-auth/api");
+      const sess = await getSessionFromCtx(ctx).catch(() => null);
+      return sess?.user?.id ?? sess?.session?.userId ?? void 0;
+    }
+    if (ctx?.path === "/reset-password") {
+      const token = typeof ctx?.body?.token === "string" ? ctx.body.token : "";
+      if (!token) return void 0;
+      try {
+        const v = await ctx.context.internalAdapter.findVerificationValue(`reset-password:${token}`);
+        const raw = v?.value;
+        if (!raw) return void 0;
+        if (typeof raw === "string") {
+          const t = raw.trim();
+          if (t.startsWith("{") || t.startsWith('"')) {
+            try {
+              const o = JSON.parse(t);
+              return (typeof o === "string" ? o : o?.userId) ?? void 0;
+            } catch {
+              return t;
+            }
+          }
+          return t;
+        }
+        return raw?.userId ?? void 0;
+      } catch {
+        return void 0;
+      }
+    }
+    return void 0;
+  }
+  /**
+   * ADR-0069 D1 — throw `PASSWORD_REUSE` when `candidate` matches the user's
+   * current password or any hash in the bounded history. Reuses better-auth's
+   * native `password.verify` (passed in) rather than re-hashing. Returns the
+   * current hash (for the after-hook to append) when the candidate is fresh, or
+   * undefined when the feature is off / nothing to compare.
+   */
+  async assertPasswordNotReused(userId, candidate, verify) {
+    const count = Math.floor(Number(this.config.passwordHistoryCount) || 0);
+    if (count <= 0 || typeof verify !== "function") return void 0;
+    const engine = this.getDataEngine();
+    if (!engine) return void 0;
+    const SYSTEM_CTX = { isSystem: true, roles: [], permissions: [] };
+    let account;
+    try {
+      account = await engine.findOne("sys_account", {
+        where: { user_id: userId, provider_id: "credential" },
+        fields: ["id", "password", "previous_password_hashes"],
+        context: SYSTEM_CTX
+      });
+    } catch {
+      return void 0;
+    }
+    if (!account?.id) return void 0;
+    const currentHash = typeof account.password === "string" ? account.password : "";
+    const compareList = [currentHash, ...this.parseHashes(account.previous_password_hashes)].filter(Boolean);
+    for (const h of compareList) {
+      let match = false;
+      try {
+        match = await verify({ password: candidate, hash: h });
+      } catch {
+        match = false;
+      }
+      if (match) {
+        const { APIError } = await import("better-auth/api");
+        throw new APIError("BAD_REQUEST", {
+          message: `For security you can't reuse one of your last ${count} passwords. Please choose a different one.`,
+          code: "PASSWORD_REUSE"
+        });
+      }
+    }
+    return currentHash;
+  }
+  /**
+   * ADR-0069 D1 — append `oldHash` to the bounded password-history ring after a
+   * successful change/reset. Best-effort; never throws.
+   */
+  async recordPasswordHistory(userId, oldHash) {
+    const count = Math.floor(Number(this.config.passwordHistoryCount) || 0);
+    if (count <= 0 || !oldHash) return;
+    const engine = this.getDataEngine();
+    if (!engine) return;
+    try {
+      const SYSTEM_CTX = { isSystem: true, roles: [], permissions: [] };
+      const account = await engine.findOne("sys_account", {
+        where: { user_id: userId, provider_id: "credential" },
+        fields: ["id", "previous_password_hashes"],
+        context: SYSTEM_CTX
+      });
+      if (!account?.id) return;
+      const prev = this.parseHashes(account.previous_password_hashes);
+      const next = [oldHash, ...prev.filter((h) => h !== oldHash)].slice(0, count);
+      await engine.update(
+        "sys_account",
+        { id: account.id, previous_password_hashes: JSON.stringify(next) },
+        { context: SYSTEM_CTX }
+      );
+    } catch {
+    }
+  }
+  /**
+   * ADR-0069 D2 — throw `ACCOUNT_LOCKED` when the identity is currently locked
+   * out (brute-force protection). No-op when lockout is disabled
+   * (`lockoutThreshold <= 0`) or no data engine is wired. Fails OPEN on a
+   * lookup error: an infra hiccup must never block every login.
+   */
+  async assertAccountNotLocked(email) {
+    const threshold = Number(this.config.lockoutThreshold) || 0;
+    if (threshold <= 0) return;
+    const engine = this.getDataEngine();
+    if (!engine) return;
+    let locked = false;
+    try {
+      const SYSTEM_CTX = { isSystem: true, roles: [], permissions: [] };
+      const u = await engine.findOne("sys_user", {
+        where: { email },
+        fields: ["id", "locked_until"],
+        context: SYSTEM_CTX
+      });
+      const lu = u?.locked_until;
+      locked = !!(lu && new Date(lu).getTime() > Date.now());
+    } catch {
+      return;
+    }
+    if (locked) {
+      const { APIError } = await import("better-auth/api");
+      throw new APIError("FORBIDDEN", {
+        message: "This account is temporarily locked after too many failed sign-in attempts. Try again later or ask an administrator to unlock it.",
+        code: "ACCOUNT_LOCKED"
+      });
+    }
+  }
+  /**
+   * ADR-0069 D2 — record a sign-in outcome for lockout accounting. On failure
+   * increments `failed_login_count` and, once it reaches `lockoutThreshold`,
+   * stamps `locked_until = now + lockoutDurationMinutes`. On success resets
+   * both (only writing when there is something to clear, to avoid a no-op
+   * history row on every login). No-op when lockout is disabled. Never throws —
+   * a counter write must not turn a valid login into an error.
+   */
+  async recordSignInOutcome(email, success) {
+    const threshold = Number(this.config.lockoutThreshold) || 0;
+    if (threshold <= 0) return;
+    const engine = this.getDataEngine();
+    if (!engine) return;
+    try {
+      const SYSTEM_CTX = { isSystem: true, roles: [], permissions: [] };
+      const u = await engine.findOne("sys_user", {
+        where: { email },
+        fields: ["id", "failed_login_count", "locked_until"],
+        context: SYSTEM_CTX
+      });
+      if (!u?.id) return;
+      if (success) {
+        if ((Number(u.failed_login_count) || 0) !== 0 || u.locked_until) {
+          await engine.update(
+            "sys_user",
+            { id: u.id, failed_login_count: 0, locked_until: null },
+            { context: SYSTEM_CTX }
+          );
+        }
+        return;
+      }
+      const next = (Number(u.failed_login_count) || 0) + 1;
+      const patch = { id: u.id, failed_login_count: next };
+      if (next >= threshold) {
+        const mins = Number(this.config.lockoutDurationMinutes) || 15;
+        patch.locked_until = new Date(Date.now() + mins * 6e4);
+      }
+      await engine.update("sys_user", patch, { context: SYSTEM_CTX });
+    } catch {
+    }
+  }
+  /**
+   * ADR-0069 D2 — clear a user's lockout state (admin "Unlock" action).
+   * Resets `failed_login_count` and `locked_until`. Returns false when no data
+   * engine is wired or the user does not exist.
+   */
+  async unlockUser(userId) {
+    const engine = this.getDataEngine();
+    if (!engine || !userId) return false;
+    const SYSTEM_CTX = { isSystem: true, roles: [], permissions: [] };
+    const u = await engine.findOne("sys_user", {
+      where: { id: userId },
+      fields: ["id"],
+      context: SYSTEM_CTX
+    });
+    if (!u?.id) return false;
+    await engine.update(
+      "sys_user",
+      { id: userId, failed_login_count: 0, locked_until: null },
+      { context: SYSTEM_CTX }
+    );
+    return true;
+  }
+  /**
+   * ADR-0069 D4 — idle / absolute session enforcement, run per request from
+   * `customSession`. No-op when both are off. Revokes (expires in place +
+   * stamps revoked_at/revoke_reason) when a limit is exceeded so better-auth
+   * returns no session on the NEXT request; otherwise touches `last_activity_at`
+   * (throttled to once a minute). Best-effort — never throws.
+   */
+  async enforceSessionControls(sessionId, createdAtHint) {
+    const idleMin = Math.floor(Number(this.config.sessionIdleTimeoutMinutes) || 0);
+    const absHrs = Math.floor(Number(this.config.sessionAbsoluteMaxHours) || 0);
+    if (idleMin <= 0 && absHrs <= 0) return;
+    const engine = this.getDataEngine();
+    if (!engine || !sessionId) return;
+    try {
+      const SYSTEM_CTX = { isSystem: true, roles: [], permissions: [] };
+      const srow = await engine.findOne("sys_session", {
+        where: { id: sessionId },
+        fields: ["id", "created_at", "last_activity_at", "revoked_at"],
+        context: SYSTEM_CTX
+      });
+      if (!srow?.id || srow.revoked_at) return;
+      const now = Date.now();
+      let reason;
+      if (absHrs > 0) {
+        const created = srow.created_at ?? createdAtHint;
+        if (created && now - new Date(created).getTime() > absHrs * 36e5) reason = "absolute_max";
+      }
+      if (!reason && idleMin > 0) {
+        const last = srow.last_activity_at ?? srow.created_at ?? createdAtHint;
+        if (last && now - new Date(last).getTime() > idleMin * 6e4) reason = "idle_timeout";
+      }
+      if (reason) {
+        await engine.update(
+          "sys_session",
+          { id: sessionId, expires_at: new Date(now - 1e3), revoked_at: new Date(now), revoke_reason: reason },
+          { context: SYSTEM_CTX }
+        ).catch(() => void 0);
+        return;
+      }
+      if (idleMin > 0) {
+        const la = srow.last_activity_at ? new Date(srow.last_activity_at).getTime() : 0;
+        if (now - la > 6e4) {
+          await engine.update("sys_session", { id: sessionId, last_activity_at: new Date(now) }, { context: SYSTEM_CTX }).catch(() => void 0);
+        }
+      }
+    } catch {
+    }
+  }
+  /**
+   * ADR-0069 D4 — concurrent-session cap, run from the sign-in after-hook.
+   * Keeps the newest `maxConcurrentSessions` live sessions for the user and
+   * revokes the rest (oldest first). No-op when off. Best-effort.
+   */
+  async enforceConcurrentCap(userId) {
+    const cap = Math.floor(Number(this.config.maxConcurrentSessions) || 0);
+    if (cap <= 0 || !userId) return;
+    const engine = this.getDataEngine();
+    if (!engine) return;
+    try {
+      const SYSTEM_CTX = { isSystem: true, roles: [], permissions: [] };
+      const rows = await engine.find("sys_session", {
+        where: { user_id: userId },
+        fields: ["id", "created_at", "expires_at", "revoked_at"],
+        limit: 200,
+        context: SYSTEM_CTX
+      });
+      const now = Date.now();
+      const live = (Array.isArray(rows) ? rows : []).filter((sn) => !sn.revoked_at && (!sn.expires_at || new Date(sn.expires_at).getTime() > now)).sort((a, b) => new Date(b.created_at ?? 0).getTime() - new Date(a.created_at ?? 0).getTime());
+      for (const sn of live.slice(cap)) {
+        await engine.update(
+          "sys_session",
+          { id: sn.id, expires_at: new Date(now - 1e3), revoked_at: new Date(now), revoke_reason: "concurrent_cap" },
+          { context: SYSTEM_CTX }
+        ).catch(() => void 0);
+      }
+    } catch {
+    }
+  }
+  /**
+   * ADR-0069 D5 — is `ip` within the configured allow-list? True (allow) when no
+   * ranges are configured, OR when the IP can't be determined (fail-open so a
+   * misconfigured proxy never locks everyone out — an admin enabling this must
+   * ensure forwarded headers are trusted). Supports IPv4 CIDR + exact IPv4/IPv6.
+   */
+  isClientIpAllowed(ip) {
+    const ranges = this.config.allowedIpRanges;
+    if (!ranges || ranges.length === 0) return true;
+    if (!ip) return true;
+    return ranges.some((r) => ipMatchesRange(ip, r));
+  }
   /**
    * Returns the data engine wired into this auth manager. Used by route
    * handlers (e.g. bootstrap-status) that need to query identity tables
@@ -1495,6 +2615,283 @@ function mapSetPasswordError(error) {
   return { status, body: { success: false, error: { code, message } } };
 }
 
+// src/register-sso-provider.ts
+async function resolveActiveOrganizationId(handle, registerUrl, headers) {
+  try {
+    const sessionUrl = registerUrl.replace(/\/sso\/register$/, "/get-session");
+    if (sessionUrl === registerUrl) return void 0;
+    const h = new Headers({ accept: "application/json" });
+    const cookie = headers.get("cookie");
+    if (cookie) h.set("cookie", cookie);
+    const authz = headers.get("authorization");
+    if (authz) h.set("authorization", authz);
+    const resp = await handle(new Request(sessionUrl, { method: "GET", headers: h }));
+    if (!resp.ok) return void 0;
+    const data = await resp.json().catch(() => null);
+    const org = data?.session?.activeOrganizationId ?? data?.activeOrganizationId;
+    return typeof org === "string" && org.length > 0 ? org : void 0;
+  } catch {
+    return void 0;
+  }
+}
+async function runRegisterSsoProviderFromForm(handle, request) {
+  let body;
+  try {
+    body = await request.json();
+  } catch {
+    body = {};
+  }
+  const str = (v) => typeof v === "string" ? v.trim() : "";
+  const providerId = str(body?.providerId);
+  const issuer = str(body?.issuer);
+  const domain = str(body?.domain);
+  const clientId = str(body?.clientId);
+  const clientSecret = str(body?.clientSecret);
+  const discoveryEndpoint = str(body?.discoveryEndpoint);
+  const scopesRaw = str(body?.scopes);
+  const missing = [
+    ["providerId", providerId],
+    ["issuer", issuer],
+    ["domain", domain],
+    ["clientId", clientId],
+    ["clientSecret", clientSecret]
+  ].filter(([, v]) => !v).map(([k]) => k);
+  if (missing.length) {
+    return {
+      status: 400,
+      body: { success: false, error: { code: "invalid_request", message: `Missing required field(s): ${missing.join(", ")}` } }
+    };
+  }
+  const oidcConfig = { clientId, clientSecret };
+  if (discoveryEndpoint) oidcConfig.discoveryEndpoint = discoveryEndpoint;
+  oidcConfig.scopes = scopesRaw ? scopesRaw.split(/[\s,]+/).filter(Boolean) : ["openid", "email", "profile"];
+  oidcConfig.mapping = {
+    id: str(body?.mapId) || "sub",
+    email: str(body?.mapEmail) || "email",
+    name: str(body?.mapName) || "name"
+  };
+  let innerUrl;
+  let origin;
+  try {
+    const url = new URL(request.url);
+    origin = url.origin;
+    innerUrl = `${origin}${url.pathname.replace(/\/admin\/sso\/register$/, "/sso/register")}`;
+  } catch {
+    return { status: 400, body: { success: false, error: { code: "invalid_request", message: "Bad request URL" } } };
+  }
+  const headers = new Headers({ "content-type": "application/json" });
+  const cookie = request.headers.get("cookie");
+  if (cookie) headers.set("cookie", cookie);
+  const authz = request.headers.get("authorization");
+  if (authz) headers.set("authorization", authz);
+  headers.set("origin", request.headers.get("origin") || origin);
+  const organizationId = await resolveActiveOrganizationId(handle, innerUrl, headers);
+  const innerReq = new Request(innerUrl, {
+    method: "POST",
+    headers,
+    body: JSON.stringify({ providerId, issuer, domain, oidcConfig, ...organizationId ? { organizationId } : {} })
+  });
+  const resp = await handle(innerReq);
+  let parsed = {};
+  try {
+    const t = await resp.text();
+    parsed = t ? JSON.parse(t) : {};
+  } catch {
+    parsed = {};
+  }
+  if (!resp.ok) {
+    return {
+      status: resp.status,
+      body: { success: false, error: { code: "sso_register_failed", message: parsed?.message || "SSO provider registration failed" } }
+    };
+  }
+  return { status: 200, body: { success: true, data: { providerId: parsed?.providerId ?? providerId } } };
+}
+async function runRegisterSamlProviderFromForm(handle, request) {
+  let body;
+  try {
+    body = await request.json();
+  } catch {
+    body = {};
+  }
+  const str = (v) => typeof v === "string" ? v.trim() : "";
+  const providerId = str(body?.providerId);
+  const issuer = str(body?.issuer);
+  const domain = str(body?.domain);
+  const entryPoint = str(body?.entryPoint);
+  const cert = str(body?.cert);
+  const identifierFormat = str(body?.identifierFormat);
+  const missing = [
+    ["providerId", providerId],
+    ["issuer", issuer],
+    ["domain", domain],
+    ["entryPoint", entryPoint],
+    ["cert", cert]
+  ].filter(([, v]) => !v).map(([k]) => k);
+  if (missing.length) {
+    return { status: 400, body: { success: false, error: { code: "invalid_request", message: `Missing required field(s): ${missing.join(", ")}` } } };
+  }
+  let origin;
+  let prefix;
+  let innerUrl;
+  try {
+    const url = new URL(request.url);
+    origin = url.origin;
+    prefix = url.pathname.replace(/\/admin\/sso\/register-saml$/, "");
+    innerUrl = `${origin}${prefix}/sso/register`;
+  } catch {
+    return { status: 400, body: { success: false, error: { code: "invalid_request", message: "Bad request URL" } } };
+  }
+  const acsUrl = `${origin}${prefix}/sso/saml2/sp/acs/${encodeURIComponent(providerId)}`;
+  const spMetadataUrl = `${origin}${prefix}/sso/saml2/sp/metadata?providerId=${encodeURIComponent(providerId)}`;
+  const samlConfig = {
+    entryPoint,
+    cert,
+    callbackUrl: acsUrl,
+    // better-auth requires an SP descriptor (its inner fields are optional). Use
+    // the SP metadata URL as our EntityID — the value the IdP keys this SP on.
+    spMetadata: { entityID: spMetadataUrl }
+  };
+  if (identifierFormat) samlConfig.identifierFormat = identifierFormat;
+  const headers = new Headers({ "content-type": "application/json" });
+  const cookie = request.headers.get("cookie");
+  if (cookie) headers.set("cookie", cookie);
+  const authz = request.headers.get("authorization");
+  if (authz) headers.set("authorization", authz);
+  headers.set("origin", request.headers.get("origin") || origin);
+  const organizationId = await resolveActiveOrganizationId(handle, innerUrl, headers);
+  const innerReq = new Request(innerUrl, {
+    method: "POST",
+    headers,
+    body: JSON.stringify({ providerId, issuer, domain, samlConfig, ...organizationId ? { organizationId } : {} })
+  });
+  const resp = await handle(innerReq);
+  let parsed = {};
+  try {
+    const t = await resp.text();
+    parsed = t ? JSON.parse(t) : {};
+  } catch {
+    parsed = {};
+  }
+  if (!resp.ok) {
+    return { status: resp.status, body: { success: false, error: { code: "saml_register_failed", message: parsed?.message || "SAML provider registration failed" } } };
+  }
+  return { status: 200, body: { success: true, data: { providerId: parsed?.providerId ?? providerId }, acsUrl, spMetadataUrl } };
+}
+var SSO_DOMAIN_TOKEN_PREFIX = "better-auth-token";
+function bareHostname(domain) {
+  let d = domain.trim();
+  if (!d) return d;
+  const schemeIdx = d.indexOf("://");
+  if (schemeIdx !== -1) {
+    try {
+      return new URL(d).hostname;
+    } catch {
+      d = d.slice(schemeIdx + 3);
+    }
+  }
+  for (const sep of ["/", ":", "?", "#"]) {
+    const i = d.indexOf(sep);
+    if (i !== -1) d = d.slice(0, i);
+  }
+  return d;
+}
+function rewriteSsoAdminUrl(request, fromSuffix, toPath) {
+  try {
+    const url = new URL(request.url);
+    return { origin: url.origin, innerUrl: `${url.origin}${url.pathname.replace(fromSuffix, toPath)}` };
+  } catch {
+    return null;
+  }
+}
+function forwardAuthHeaders(request, origin) {
+  const headers = new Headers({ "content-type": "application/json" });
+  const cookie = request.headers.get("cookie");
+  if (cookie) headers.set("cookie", cookie);
+  const authz = request.headers.get("authorization");
+  if (authz) headers.set("authorization", authz);
+  headers.set("origin", request.headers.get("origin") || origin);
+  return headers;
+}
+async function runRequestDomainVerification(handle, request) {
+  let body;
+  try {
+    body = await request.json();
+  } catch {
+    body = {};
+  }
+  const str = (v) => typeof v === "string" ? v.trim() : "";
+  const providerId = str(body?.providerId);
+  const domain = bareHostname(str(body?.domain));
+  if (!providerId) {
+    return { status: 400, body: { success: false, error: { code: "invalid_request", message: "Missing required field: providerId" } } };
+  }
+  const rw = rewriteSsoAdminUrl(request, /\/admin\/sso\/request-domain-verification$/, "/sso/request-domain-verification");
+  if (!rw) return { status: 400, body: { success: false, error: { code: "invalid_request", message: "Bad request URL" } } };
+  const headers = forwardAuthHeaders(request, rw.origin);
+  const resp = await handle(new Request(rw.innerUrl, { method: "POST", headers, body: JSON.stringify({ providerId }) }));
+  let parsed = {};
+  try {
+    const t = await resp.text();
+    parsed = t ? JSON.parse(t) : {};
+  } catch {
+    parsed = {};
+  }
+  if (!resp.ok) {
+    if (resp.status === 404 && !parsed?.code) {
+      return { status: 400, body: { success: false, error: { code: "domain_verification_disabled", message: "Domain verification is not enabled for this environment (set OS_SSO_DOMAIN_VERIFICATION)." } } };
+    }
+    return { status: resp.status, body: { success: false, error: { code: parsed?.code || "request_domain_verification_failed", message: parsed?.message || "Failed to request domain verification" } } };
+  }
+  const token = str(parsed?.domainVerificationToken);
+  const label = `_${SSO_DOMAIN_TOKEN_PREFIX}-${providerId}`;
+  const dnsRecordName = domain ? `${label}.${domain}` : label;
+  const dnsRecordValue = `${label}=${token}`;
+  return {
+    status: 200,
+    body: {
+      success: true,
+      data: { providerId, domain, token, dnsRecordType: "TXT", dnsRecordName, dnsRecordValue }
+    }
+  };
+}
+async function runVerifyDomain(handle, request) {
+  let body;
+  try {
+    body = await request.json();
+  } catch {
+    body = {};
+  }
+  const str = (v) => typeof v === "string" ? v.trim() : "";
+  const providerId = str(body?.providerId);
+  if (!providerId) {
+    return { status: 400, body: { success: false, error: { code: "invalid_request", message: "Missing required field: providerId" } } };
+  }
+  const rw = rewriteSsoAdminUrl(request, /\/admin\/sso\/verify-domain$/, "/sso/verify-domain");
+  if (!rw) return { status: 400, body: { success: false, error: { code: "invalid_request", message: "Bad request URL" } } };
+  const headers = forwardAuthHeaders(request, rw.origin);
+  const resp = await handle(new Request(rw.innerUrl, { method: "POST", headers, body: JSON.stringify({ providerId }) }));
+  let parsed = {};
+  try {
+    const t = await resp.text();
+    parsed = t ? JSON.parse(t) : {};
+  } catch {
+    parsed = {};
+  }
+  if (resp.ok) {
+    return { status: 200, body: { success: true, data: { providerId, verified: true, message: "Domain ownership verified \u2014 this provider can now sign users in." } } };
+  }
+  let message = parsed?.message || "Domain verification failed";
+  if (resp.status === 404 && !parsed?.code) {
+    message = "Domain verification is not enabled for this environment (set OS_SSO_DOMAIN_VERIFICATION).";
+  } else if (parsed?.code === "NO_PENDING_VERIFICATION") {
+    message = "No pending verification \u2014 click \u201CRequest Domain Verification\u201D first to get the DNS record.";
+  } else if (parsed?.code === "DOMAIN_VERIFICATION_FAILED") {
+    message = "DNS TXT record not found yet. Add the record shown when you requested verification, allow time for DNS to propagate, then retry.";
+  }
+  return { status: resp.status, body: { success: false, error: { code: parsed?.code || "verify_domain_failed", message } } };
+}
+
 // src/manifest.ts
 var import_identity = require("@objectstack/platform-objects/identity");
 var AUTH_PLUGIN_ID = "com.objectstack.plugin-auth";
@@ -1517,7 +2914,9 @@ var authIdentityObjects = [
   import_identity.SysOauthRefreshToken,
   import_identity.SysOauthConsent,
   import_identity.SysJwks,
-  import_identity.SysDeviceCode
+  import_identity.SysDeviceCode,
+  import_identity.SysSsoProvider,
+  import_identity.SysScimProvider
 ];
 var authPluginManifestHeader = {
   id: AUTH_PLUGIN_ID,
@@ -1610,7 +3009,33 @@ var AuthPlugin = class {
       // source of truth.
       dashboards: [import_apps.SystemOverviewDashboard],
       // ADR-0021 — datasets backing the System Overview dashboard's widgets.
-      datasets: import_apps.SystemOverviewDatasets
+      datasets: import_apps.SystemOverviewDatasets,
+      // ADR-0024 / cloud#551 — surface "SSO Providers" (sys_sso_provider) in the
+      // Setup app's Access Control group, but ONLY when the external-IdP RP is
+      // wired (self-host `OS_SSO_ENABLED`, or the cloud per-env `planAllowsSso`
+      // arriving via `plugins.sso`). Without the gate the entry would render an
+      // empty list + a "Register" button whose endpoint 404s when SSO is off.
+      // Owning-plugin-contributes pattern (ADR-0029 K2), mirroring plugin-security.
+      ...this.authManager.isSsoWired() ? {
+        navigationContributions: [
+          {
+            app: "setup",
+            group: "group_access_control",
+            // After Roles/Permission-Sets (100) and Sharing (200), near API Keys (300).
+            priority: 250,
+            items: [
+              {
+                id: "nav_sso_providers",
+                type: "object",
+                label: "SSO Providers",
+                objectName: "sys_sso_provider",
+                icon: "log-in",
+                requiredPermissions: ["manage_platform_settings"]
+              }
+            ]
+          }
+        ]
+      } : {}
     });
     ctx.logger.info("Auth Plugin initialized successfully");
   }
@@ -1623,14 +3048,24 @@ var AuthPlugin = class {
       ctx.hook("kernel:ready", async () => {
         if (this.authManager) {
           await this.bindAuthSettings(ctx);
+          let emailSvc;
           try {
-            const emailSvc = ctx.getService("email");
-            if (emailSvc) {
-              this.authManager.setEmailService(emailSvc);
-              ctx.logger.info("Auth: email service wired (transactional mail enabled)");
-            }
+            emailSvc = ctx.getService("email");
           } catch {
-            ctx.logger.info("Auth: no email service registered \u2014 auth callbacks will log instead of sending");
+            emailSvc = void 0;
+          }
+          if (emailSvc) {
+            this.authManager.setEmailService(emailSvc);
+            ctx.logger.info("Auth: email service wired (transactional mail enabled)");
+          } else {
+            const requiresEmail = !!this.authManager.getPublicConfig?.()?.emailPassword?.requireEmailVerification;
+            if (requiresEmail) {
+              ctx.logger.error(
+                "Auth: email verification is REQUIRED but NO email service is registered \u2014 verification & password-reset emails will FAIL and new users will be locked out at sign-in. Register an email service (e.g. EmailServicePlugin + OS_EMAIL_*) or disable verification (OS_AUTH_REQUIRE_EMAIL_VERIFICATION=false)."
+              );
+            } else {
+              ctx.logger.info("Auth: no email service registered \u2014 transactional mail disabled");
+            }
           }
           try {
             const settings = ctx.getService("settings");
@@ -1693,6 +3128,38 @@ var AuthPlugin = class {
     ctx.hook("kernel:ready", async () => {
       await this.maybeSeedDevAdmin(ctx);
     });
+    ctx.hook("kernel:ready", async () => {
+      try {
+        const engine = ctx.getService("objectql");
+        if (!engine || typeof engine.registerHook !== "function") return;
+        const SYSTEM_CTX = { isSystem: true, roles: [], permissions: [] };
+        engine.registerHook("afterInsert", async (hookCtx) => {
+          try {
+            if (hookCtx?.object !== "sys_account") return;
+            const acct = hookCtx.result ?? {};
+            const providerId = acct.provider_id ?? acct.providerId;
+            const userId = acct.user_id ?? acct.userId;
+            if (!userId || !providerId || providerId === "credential") return;
+            const credCount = await engine.count("sys_account", {
+              where: { user_id: userId, provider_id: "credential" },
+              context: SYSTEM_CTX
+            });
+            if (typeof credCount === "number" && credCount > 0) return;
+            const u = await engine.findOne("sys_user", {
+              where: { id: userId },
+              fields: ["id", "source"],
+              context: SYSTEM_CTX
+            });
+            if (u && u.source !== "idp_provisioned") {
+              await engine.update("sys_user", { id: userId, source: "idp_provisioned" }, { context: SYSTEM_CTX });
+            }
+          } catch {
+          }
+        }, { packageId: "com.objectstack.plugin-auth" });
+        ctx.logger.info("Identity-source afterInsert stamp registered on sys_account (SCIM-safe)");
+      } catch {
+      }
+    });
     try {
       const ql = ctx.getService("objectql");
       if (ql && typeof ql.registerMiddleware === "function") {
@@ -1776,6 +3243,41 @@ var AuthPlugin = class {
         if (Object.keys(emailAndPassword).length > 0) {
           patch.emailAndPassword = emailAndPassword;
         }
+        if (isExplicit("password_reject_breached")) {
+          patch.plugins = {
+            ...patch.plugins ?? {},
+            passwordRejectBreached: asBoolean(values.password_reject_breached, false)
+          };
+        }
+        if (isExplicit("password_require_complexity")) {
+          patch.passwordRequireComplexity = asBoolean(values.password_require_complexity, false);
+        }
+        if (isExplicit("password_min_classes")) {
+          const n = asPositiveInt(values.password_min_classes);
+          if (n !== void 0) patch.passwordMinClasses = Math.min(4, Math.max(1, n));
+        }
+        if (isExplicit("password_history_count")) {
+          const n = Math.floor(Number(values.password_history_count));
+          if (Number.isFinite(n) && n >= 0) patch.passwordHistoryCount = Math.min(24, n);
+        }
+        if (isExplicit("password_expiry_days")) {
+          const n = Math.floor(Number(values.password_expiry_days));
+          if (Number.isFinite(n) && n >= 0) patch.passwordExpiryDays = Math.min(3650, n);
+        }
+        if (isExplicit("mfa_required")) {
+          const on = asBoolean(values.mfa_required, false);
+          patch.mfaRequired = on;
+          if (on) {
+            patch.plugins = {
+              ...patch.plugins ?? {},
+              twoFactor: true
+            };
+          }
+        }
+        if (isExplicit("mfa_grace_period_days")) {
+          const n = Math.floor(Number(values.mfa_grace_period_days));
+          if (Number.isFinite(n) && n >= 0) patch.mfaGracePeriodDays = Math.min(90, n);
+        }
         const session = {};
         if (isExplicit("session_expiry_days")) {
           const d = asPositiveInt(values.session_expiry_days);
@@ -1788,6 +3290,53 @@ var AuthPlugin = class {
         if (Object.keys(session).length > 0) {
           patch.session = session;
         }
+        const asNonNeg = (v) => {
+          const n = Math.floor(Number(v));
+          return Number.isFinite(n) && n >= 0 ? n : void 0;
+        };
+        if (isExplicit("session_idle_timeout_minutes")) {
+          const n = asNonNeg(values.session_idle_timeout_minutes);
+          if (n !== void 0) patch.sessionIdleTimeoutMinutes = n;
+        }
+        if (isExplicit("session_absolute_max_hours")) {
+          const n = asNonNeg(values.session_absolute_max_hours);
+          if (n !== void 0) patch.sessionAbsoluteMaxHours = n;
+        }
+        if (isExplicit("max_concurrent_sessions_per_user")) {
+          const n = asNonNeg(values.max_concurrent_sessions_per_user);
+          if (n !== void 0) patch.maxConcurrentSessions = n;
+        }
+        if (isExplicit("allowed_ip_ranges")) {
+          const raw = asTrimmedString(values.allowed_ip_ranges) ?? "";
+          patch.allowedIpRanges = raw.split(/[\n,]+/).map((r) => r.trim()).filter(Boolean);
+        }
+        const asNonNegativeInt = (value) => {
+          const n = Math.floor(Number(value));
+          return Number.isFinite(n) && n >= 0 ? n : void 0;
+        };
+        if (isExplicit("lockout_threshold")) {
+          const n = asNonNegativeInt(values.lockout_threshold);
+          if (n !== void 0) patch.lockoutThreshold = n;
+        }
+        if (isExplicit("lockout_duration_minutes")) {
+          const n = asPositiveInt(values.lockout_duration_minutes);
+          if (n !== void 0) patch.lockoutDurationMinutes = n;
+        }
+        if (isExplicit("rate_limit_max") || isExplicit("rate_limit_window_seconds")) {
+          const max = asPositiveInt(values.rate_limit_max) ?? 10;
+          const window = asPositiveInt(values.rate_limit_window_seconds) ?? 60;
+          patch.rateLimit = {
+            enabled: true,
+            window,
+            max,
+            customRules: {
+              "/sign-in/email": { window, max },
+              "/sign-up/email": { window, max },
+              "/request-password-reset": { window, max },
+              "/reset-password": { window, max }
+            }
+          };
+        }
         if (isExplicit("google_enabled") || isExplicit("google_client_id") || isExplicit("google_client_secret")) {
           const socialProviders = {
             ...this.configuredSocialProviders ?? {}
@@ -1909,9 +3458,27 @@ var AuthPlugin = class {
       );
     }
     const rawApp = httpServer.getRawApp();
-    rawApp.get(`${basePath}/config`, (c) => {
+    if (typeof rawApp.use === "function") rawApp.use(`${basePath}/*`, async (c, next) => {
+      const mgr = this.authManager;
+      if (!mgr || typeof mgr.isClientIpAllowed !== "function") return next();
+      const path = c.req.path || "";
+      if (path.endsWith("/config") || path.endsWith("/bootstrap-status")) return next();
+      const fwd = c.req.header("x-forwarded-for");
+      const ip = typeof fwd === "string" && fwd.split(",")[0].trim() || c.req.header("cf-connecting-ip") || c.req.header("x-real-ip") || void 0;
+      if (!mgr.isClientIpAllowed(ip)) {
+        return c.json(
+          { success: false, error: { code: "IP_NOT_ALLOWED", message: "Sign-in is not allowed from your network." } },
+          403
+        );
+      }
+      return next();
+    });
+    rawApp.get(`${basePath}/config`, async (c) => {
       try {
         const config = this.authManager.getPublicConfig();
+        if (config.features?.sso) {
+          config.features.sso = await this.authManager.isSsoUsable();
+        }
         return c.json({ success: true, data: config });
       } catch (error) {
         const err = error instanceof Error ? error : new Error(String(error));
@@ -1997,6 +3564,91 @@ var AuthPlugin = class {
         return c.json({ success: false, error: { code: "internal", message: err.message } }, 500);
       }
     });
+    rawApp.post(`${basePath}/admin/sso/register`, async (c) => {
+      try {
+        const { status, body } = await runRegisterSsoProviderFromForm(
+          (req) => this.authManager.handleRequest(req),
+          c.req.raw
+        );
+        return c.json(body, status);
+      } catch (error) {
+        const err = error instanceof Error ? error : new Error(String(error));
+        ctx.logger.error("[AuthPlugin] sso/register bridge failed", err);
+        return c.json({ success: false, error: { code: "internal", message: err.message } }, 500);
+      }
+    });
+    rawApp.post(`${basePath}/admin/unlock-user`, async (c) => {
+      try {
+        let body = {};
+        try {
+          body = await c.req.json();
+        } catch {
+          body = {};
+        }
+        const userId = body?.userId ?? body?.user_id;
+        if (typeof userId !== "string" || userId.length === 0) {
+          return c.json({ success: false, error: { code: "invalid_request", message: "userId is required" } }, 400);
+        }
+        const authApi = await this.authManager.getApi();
+        const session = await authApi.getSession({ headers: c.req.raw.headers });
+        if (!session?.user?.id) {
+          return c.json({ success: false, error: { code: "unauthorized", message: "Sign in first" } }, 401);
+        }
+        const u = session.user;
+        const isAdmin = u?.isPlatformAdmin === true || Array.isArray(u?.roles) && u.roles.includes("platform_admin") || u?.role === "admin";
+        if (!isAdmin) {
+          return c.json({ success: false, error: { code: "forbidden", message: "Admin role required" } }, 403);
+        }
+        const ok = await this.authManager.unlockUser(userId);
+        if (!ok) {
+          return c.json({ success: false, error: { code: "not_found", message: "User not found or data engine unavailable" } }, 404);
+        }
+        return c.json({ success: true, data: { userId } });
+      } catch (error) {
+        const err = error instanceof Error ? error : new Error(String(error));
+        ctx.logger.error("[AuthPlugin] unlock-user failed", err);
+        return c.json({ success: false, error: { code: "internal", message: err.message } }, 500);
+      }
+    });
+    rawApp.post(`${basePath}/admin/sso/register-saml`, async (c) => {
+      try {
+        const { status, body } = await runRegisterSamlProviderFromForm(
+          (req) => this.authManager.handleRequest(req),
+          c.req.raw
+        );
+        return c.json(body, status);
+      } catch (error) {
+        const err = error instanceof Error ? error : new Error(String(error));
+        ctx.logger.error("[AuthPlugin] sso/register-saml bridge failed", err);
+        return c.json({ success: false, error: { code: "internal", message: err.message } }, 500);
+      }
+    });
+    rawApp.post(`${basePath}/admin/sso/request-domain-verification`, async (c) => {
+      try {
+        const { status, body } = await runRequestDomainVerification(
+          (req) => this.authManager.handleRequest(req),
+          c.req.raw
+        );
+        return c.json(body, status);
+      } catch (error) {
+        const err = error instanceof Error ? error : new Error(String(error));
+        ctx.logger.error("[AuthPlugin] sso/request-domain-verification bridge failed", err);
+        return c.json({ success: false, error: { code: "internal", message: err.message } }, 500);
+      }
+    });
+    rawApp.post(`${basePath}/admin/sso/verify-domain`, async (c) => {
+      try {
+        const { status, body } = await runVerifyDomain(
+          (req) => this.authManager.handleRequest(req),
+          c.req.raw
+        );
+        return c.json(body, status);
+      } catch (error) {
+        const err = error instanceof Error ? error : new Error(String(error));
+        ctx.logger.error("[AuthPlugin] sso/verify-domain bridge failed", err);
+        return c.json({ success: false, error: { code: "internal", message: err.message } }, 500);
+      }
+    });
     rawApp.post(`${basePath}/sys-oauth-application/register`, async (c) => {
       try {
         let body = {};
@@ -2143,7 +3795,9 @@ var AuthPlugin = class {
   AUTH_OAUTH_REFRESH_TOKEN_SCHEMA,
   AUTH_ORGANIZATION_SCHEMA,
   AUTH_ORG_SESSION_FIELDS,
+  AUTH_SCIM_PROVIDER_SCHEMA,
   AUTH_SESSION_CONFIG,
+  AUTH_SSO_PROVIDER_SCHEMA,
   AUTH_TEAM_MEMBER_SCHEMA,
   AUTH_TEAM_SCHEMA,
   AUTH_TWO_FACTOR_SCHEMA,
@@ -2161,7 +3815,13 @@ var AuthPlugin = class {
   buildTwoFactorPluginSchema,
   createObjectQLAdapter,
   createObjectQLAdapterFactory,
+  ipMatchesRange,
   resolveProtocolName,
-  runSetInitialPassword
+  runRegisterSamlProviderFromForm,
+  runRegisterSsoProviderFromForm,
+  runRequestDomainVerification,
+  runSetInitialPassword,
+  runVerifyDomain,
+  withSystemReadContext
 });
 //# sourceMappingURL=index.js.map