refactor(plugin-auth): move the organization plugin factory into auth-manager-organization-plugin.ts

The body of the arrow AuthManager.buildPluginList() hands
addOptionalPlugin for 'organization' moves unedited into the module
function buildOrganizationPlugin, re-indented two levels: the closed
organization-role vocabulary and the roles map built from it, the
options object (schema, teams, the invitation verification declaration,
the organization and membership limits, the organization hooks with
their refusal codes, the invitation e-mail), the vendor plugin and the
rebuilt invitation listing. The arrow keeps its place in
buildPluginList; it now builds one host of the ten AuthManager members
the body reads (eight methods as late-bound closures, config as a
getter, orgRolesMap as a get/set pair because the body stores the roles
map on the manager) and returns buildOrganizationPlugin.call(host). The
async moved from the arrow to the function.

The eight top-level declarations of auth-manager.ts the body reads and
the file did not export (five hook refusal codes, two read-fault
answers and the placement gate's refusal test) are exported in place
and imported by value, with readInvitationPlacementIntent; src/index.ts
names its auth-manager.ts exports one by one, so nothing new is
published. Fifteen imported names leave auth-manager.ts with the body.

Readers that follow it: the api-error-code pin counts the module among
the AuthManager files, the two plugin-factory scans read it, the
population comments in auth-email-locale.test.ts name it, and the
module gets its own ADR anchor entry carrying the ADR-0108 paragraph
verbatim, since the body is the roles map that paragraph describes.

Co-Authored-By: Claude <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LSXBc2GCBwiAL7vV4kWkyr

Author: claude

packages/plugins/plugin-auth/src/api-error-code.pin.test.ts

@@ -182,6 +182,7 @@ describe('every new APIError( in plugin-auth/src carries an ADR-0112 code (#2424
       'auth-manager-password-session-policy.ts',
       'auth-manager-email-sms-delivery.ts',
       'auth-manager-before-hook.ts',
+      'auth-manager-organization-plugin.ts',
     ];
     expect(sites.length).toBeGreaterThanOrEqual(30);
     expect(new Set(sites.map((s) => s.file)).size).toBeGreaterThanOrEqual(4);

packages/plugins/plugin-auth/src/auth-email-locale.test.ts

@@ -859,8 +859,9 @@ describe("#14641 — an invitation reads the INVITEE's own sys_user.locale", ()
  * ⚠️ POPULATION of the class claim these blocks close, stated rather than
  * implied: the auth mail surface is the five `sendTemplate` call sites in
  * `auth-manager.ts`, `auth-manager-auth-instance.ts` (the body of
- * `createAuthInstance`) and `auth-manager-email-sms-delivery.ts` (the body of
- * the change-email notice) — `IEmailService` declares exactly two delivering
+ * `createAuthInstance`), `auth-manager-organization-plugin.ts` (the body of
+ * the organization plugin's factory) and `auth-manager-email-sms-delivery.ts`
+ * (the body of the change-email notice) — `IEmailService` declares exactly two delivering
  * members (`send`, `sendTemplate`), plugin-auth's only `.send(` calls are the
  * SMS service's, and no other file under `plugin-auth/src` calls either.
  * Those five are the same five `driveAllFive` above drives and `TEMPLATES`
@@ -1124,8 +1125,8 @@ describe('#15106 — the CLASS claim: all five auth sends read the recipient col
 
   it('every one of the five sends is written in the stored language of its own recipient', async () => {
     // ⚠️ POPULATION: the five `sendTemplate` sites in `auth-manager.ts`,
-    // `auth-manager-auth-instance.ts` and `auth-manager-email-sms-delivery.ts`
-    // — the same five `driveAllFive` drives and `TEMPLATES` names, and the whole of
+    // `auth-manager-auth-instance.ts`, `auth-manager-organization-plugin.ts` and
+    // `auth-manager-email-sms-delivery.ts` — the same five `driveAllFive` drives and `TEMPLATES` names, and the whole of
     // plugin-auth's mail surface (see this section's header). This is the pin
     // that closes the class; the per-send pins above only cover one member.
     //

packages/plugins/plugin-auth/src/auth-manager-organization-plugin.ts

@@ -320,8 +320,8 @@ function betterAuthPluginSet(): unknown[] {
  */
 function authManagerPluginFactories(): string[] {
   // [#25224] The auth manager's source: `auth-manager.ts` and the method
-  // bodies moved out of it whole. A factory imported in either is one it loads.
-  const source = ['auth-manager.ts', 'auth-manager-actor-guards.ts']
+  // bodies moved out of it whole. A factory imported in any of them is one it loads.
+  const source = ['auth-manager.ts', 'auth-manager-actor-guards.ts', 'auth-manager-organization-plugin.ts']
     .map((file) => readFileSync(join(PKG, 'src', file), 'utf8'))
     .join('\n');
   const found = new Set<string>();

packages/plugins/plugin-auth/src/auth-manager.ts

@@ -630,8 +630,8 @@ function findCollisions(
  */
 function authManagerPluginFactories(): string[] {
   // [#25224] The auth manager's source: `auth-manager.ts` and the method
-  // bodies moved out of it whole. A factory imported in either is one it loads.
-  const source = ['auth-manager.ts', 'auth-manager-actor-guards.ts']
+  // bodies moved out of it whole. A factory imported in any of them is one it loads.
+  const source = ['auth-manager.ts', 'auth-manager-actor-guards.ts', 'auth-manager-organization-plugin.ts']
     .map((file) => readFileSync(join(HERE, file), 'utf8'))
     .join('\n');
   const found = new Set<string>();

packages/plugins/plugin-auth/src/better-auth-schema-parity.test.ts

@@ -0,0 +1,7 @@
+{
+  "file": "packages/plugins/plugin-auth/src/auth-manager-organization-plugin.ts",
+  "adrs": [
+    "ADR-0108"
+  ],
+  "invariant": "ADR-0108 — better-auth's organization roles map registers the closed framework vocabulary ONLY. App-declared `position` / `permission` names are not organization roles — registering one makes it storable in `sys_member.role`, which `resolve-authz-context` projects into `current_user.positions`."
+}