@@ -0,0 +1,22 @@
+---
+'@objectstack/plugin-auth': patch
+---
+
+fix(plugin-auth)!: a cloud-managed environment (`OS_CLOUD_MANAGED=1`) refuses local self-registration, invitations, user creation and import, and sets passwords only on local accounts — self-hosted deployments are unchanged
+
+Clause-②: yes (narrowing) — one widening and one narrowing. The widening: the package entry now exports `cloudManagedRefusal`, `CLOUD_MANAGED_REFUSAL_CODE`, `CLOUD_MANAGED_REFUSAL_STATUS`, `CLOUD_MANAGED_REFUSAL_MESSAGES` and `CloudManagedDoor`, so a host that mounts its own twin of one of these doors (the cloud's per-environment `set-initial-password`, objectstack-ai/cloud#3169) refuses with the same status, code and message. The narrowing: under the managed mode only, doors that admitted a request now refuse it: every audience posture but `invite_only`, email sign-up, member invitations, admin create-user and import-users, an admin password set on an identity-provider account, and a first password for a caller without platform-admin standing. A process that does not set `OS_CLOUD_MANAGED=1` answers every one of these doors exactly as before.
+Metadata-protocol: none
+
+<!-- adr-0087: not-required (no-migration-prescription) No metadata moves: no spec key, authorable spelling, object definition, settings key or stored shape is added, removed, renamed or re-shaped, and no exported declaration is removed or narrowed (the only export change is five added names), so there is nothing for `objectstack migrate meta` to rewrite. What changes is the answer plugin-auth's runtime doors give on a process whose environment sets `OS_CLOUD_MANAGED=1`, which the cloud sets on its hosted containers; the remedy is to invite people from the organisation in the cloud console, never a rewrite of a package source or a stored row. `sys_user`, `sys_invitation` and `sys_account` rows are not touched. The other categories are closed on facts: the package publishes (not unpublished); no ADR-0087 id is named or touched (not registered or already-registered); and nothing exported is removed or narrowed (not runtime-interface-only, type-surface-only or runtime-export-retired). -->
+
+**BREAKING** for a cloud-managed environment only (a process started with `OS_CLOUD_MANAGED=1`). A hosted environment's people are invited by the organisation that hosts it, in the cloud, and sign in through the cloud's identity provider; authorization (positions, permission sets) stays in the environment. The local doors that would let someone in another way now refuse, and the password doors split by population rather than switching off, so a local break-glass administrator stays reachable when the identity provider is not. Every refusal is `409` with code `RESOURCE_CONFLICT` (in the ADR-0112 envelope on the raw routes, in better-auth's own `{ code, message }` body on `invite-member`) and a message that says what was not done and where it is done instead.
+
+- **Audience posture.** FROM: any posture booted and patched. TO: under the managed mode every posture but `invite_only` (the default) is refused at construction and on every merged config patch, with a message naming the posture and the fix.
+- **Email sign-up.** FROM: open unless `disableSignUp` or SSO-only was set. TO: forced off under the managed mode, and `getPublicConfig()` advertises `disableSignUp: true`. The bootstrap owner's first sign-up still enters, as it does under SSO-only.
+- **Invitations.** FROM: `organization/invite-member` created an invitation, and with `resend: true` extended a pending one and sent its e-mail again. TO: `409` on both, refused in the route's `before` hook, ahead of better-auth's body validation, session and permission checks and handler, so no invitation row is written or extended and no e-mail leaves.
+- **Admin create-user and import-users.** FROM: created or imported users. TO: `409` after the administrator check (a caller without it still gets `403`), and no user is written.
+- **Admin set-user-password.** FROM: set a password on any user. TO: refuses a target whose `source` is `idp_provisioned` with `409`; a local (`env_native`) target is still answered.
+- **Set-initial-password.** FROM: any signed-in user without a credential could set one. TO: only a caller with platform-admin standing may; any other signed-in caller gets `409`, and an anonymous caller still gets `401`.
+- **New exports.** `cloudManagedRefusal(door)` and the constants behind it, for a host twin of one of these doors.
+- **Unchanged:** every door on a process without `OS_CLOUD_MANAGED=1`, including one running SSO-only; existing users, invitations and credentials.
+- **The fix for an operator:** nothing on a self-hosted deployment. On a hosted environment, invite people from the organisation in the cloud console; their account arrives on their first sign-in. Keep a local password only for the break-glass administrator.
@@ -209,6 +209,8 @@ import { revokeSessionsAndApiKeys, type ForcedResetRevocationOutcome } from './f
 import { reconcileMembership, type MembershipPolicy } from './reconcile-membership.js';
 import { resolveDefaultOrgId } from './tenancy-service.js';
 import { readJsonRequestBody } from './request-json-body.js';
+import { cloudManagedRefusal } from './cloud-managed.js';
+import { isCloudManaged } from '@objectstack/core';
 import { resolveThrownHttpError, validationFailureDetails } from '@objectstack/types';
 
 const SYSTEM_CTX = { isSystem: true, positions: [], permissions: [] };
@@ -337,6 +339,32 @@ async function resolvePassword(
  * fail-open gate, so a failed stamp must not fail the whole operation; we
  * surface the *actual* stamped state in the response instead.
  */
+/**
+ * [#25083] The target's `sys_user.source` (`idp_provisioned` | `env_native`),
+ * read as the system. `ok: false` when it cannot be read at all (no engine,
+ * no read surface, or the read throws), so the cloud-managed check above
+ * fails closed instead of reading an outage as a local account.
+ */
+async function readUserSource(
+  deps: AdminUserEndpointDeps,
+  userId: string,
+): Promise<{ ok: true; value: string | null } | { ok: false }> {
+  const engine = deps.getDataEngine();
+  if (!engine?.find) return { ok: false };
+  try {
+    const rows = await engine.find('sys_user', {
+      where: { id: userId },
+      fields: ['id', 'source'],
+      limit: 1,
+      context: SYSTEM_CTX,
+    });
+    const row = Array.isArray(rows) ? (rows[0] as { source?: unknown } | undefined) : undefined;
+    return { ok: true, value: typeof row?.source === 'string' ? row.source : null };
+  } catch {
+    return { ok: false };
+  }
+}
+
 async function stampMustChangePassword(
   deps: AdminUserEndpointDeps,
   userId: string,
@@ -881,6 +909,30 @@ export async function runAdminSetUserPassword(
       return { status: 404, body: { success: false, error: { code: 'RESOURCE_NOT_FOUND', message: 'User not found' } } };
     }
 
+    // [#25083] On a cloud-managed environment a password is set here only on
+    // a local account. An `idp_provisioned` user signs in through the hosting
+    // organisation's identity provider, which owns their password; an
+    // `env_native` row (the break-glass administrator among them) still
+    // answers, because ADR-0135 D5.2 narrows by population, never wholesale.
+    if (isCloudManaged()) {
+      const source = await readUserSource(deps, userId);
+      if (!source.ok) {
+        return {
+          status: 503,
+          body: {
+            success: false,
+            error: {
+              code: 'SERVICE_UNAVAILABLE',
+              message:
+                "The user's identity source could not be read, so whether this cloud-managed environment may set "
+                + 'their password here cannot be judged. No password was changed.',
+            },
+          },
+        };
+      }
+      if (source.value === 'idp_provisioned') return cloudManagedRefusal('setUserPassword');
+    }
+
     // Mirrors the stock /admin/set-user-password core: hash, then update the
     // credential account or create one for SSO/invite-onboarded users.
     const hashed = await authCtx.password.hash(resolved.password);
 
@@ -89,6 +89,7 @@
  * direction this gate must never take.
  */
 
+import { isCloudManaged } from '@objectstack/core';
 import {
   AUDIENCE_POSTURES,
   SystemUserId,
@@ -228,6 +229,10 @@ export const OPEN_POSTURE_VERIFICATION_OFF_WARNING =
  *     (#20389: a pre-production deployment with no mail transport otherwise
  *     dead-ends every sign-up at the verify page), and refused when only the
  *     console stored it (`verificationDeclaredBy: 'console'`).
+ *
+ * On a cloud-managed environment (`isCloudManaged()`, `@objectstack/core`)
+ * every posture but `invite_only` is refused: the vocabulary is unchanged, the
+ * refusal is the runtime's.
  */
 export function assertAudienceConfig(
   raw: AudienceConfig | undefined,
@@ -246,6 +251,17 @@ export function assertAudienceConfig(
     );
   }
   const posture: AudiencePosture = (rawPosture as AudiencePosture | undefined) ?? 'invite_only';
+  // [#25083] A cloud-managed environment never opens self-registration: the
+  // organisation that hosts it invites its people in the cloud. Refused rather
+  // than coerced, so a declared `open` never reads as in force — at
+  // construction the refusal stops the boot, and on a merged patch the
+  // standing posture keeps ruling.
+  if (posture !== 'invite_only' && isCloudManaged()) {
+    fail(
+      `posture '${posture}' opens self-registration, which a cloud-managed environment (OS_CLOUD_MANAGED) never offers: ` +
+      "the organisation that hosts it invites its people in the cloud. Use posture 'invite_only' (the default), or remove the posture.",
+    );
+  }
   const domains = raw.allowedEmailDomains;
   if (domains !== undefined && !Array.isArray(domains)) {
     fail('allowedEmailDomains must be an array of bare domain names');
 
@@ -36,13 +36,16 @@ import {
   type LinkingAuthContext,
   refuseImplicitAccountLink,
 } from './implicit-account-linking.js';
+import { CLOUD_MANAGED_REFUSAL_CODE, CLOUD_MANAGED_REFUSAL_MESSAGES } from './cloud-managed.js';
 import { IdpLocaleSync } from './idp-locale-claim.js';
 import type { IDataEngine } from '@objectstack/core';
 import {
   API_KEY_DEFAULT_EXPIRY_DAYS,
   API_KEY_INACTIVITY_DAYS,
   API_KEY_MAX_EXPIRY_DAYS,
   accountScopeAuthGate,
+  // [#25083] Is this process a cloud-managed (hosted) environment? The ONE
+  // accessor every managed-mode judgement here asks, and nothing else.
   isCloudManaged,
   resolveUserAuthzGrants,
 } from '@objectstack/core';
@@ -1892,10 +1895,11 @@ export class AuthManager {
       // lock the registration policy without relying on UI state.
       emailAndPassword: (() => {
         const disableSignUpFromEnv = readDisableSignUpEnv();
-        // SSO-only ("enforced") forces self-registration off (the managed team
-        // signs in via the IdP). `enabled` stays true so the break-glass
-        // password endpoint keeps working for the env owner / local admin.
-        const effectiveDisableSignUp = this.resolveSsoOnly()
+        // SSO-only ("enforced") and a cloud-managed environment force
+        // self-registration off (see `signUpForcedOff`). `enabled` stays true
+        // so the break-glass password endpoint keeps working for the env
+        // owner / local admin.
+        const effectiveDisableSignUp = this.signUpForcedOff()
           ? true
           : (disableSignUpFromEnv ?? this.config.emailAndPassword?.disableSignUp);
         return {
@@ -2748,6 +2752,28 @@ export class AuthManager {
             // fall through — the vendor still decides everything it owns
           }
 
+          // ── [#25083] cloud-managed: invite-member issues nothing ────
+          // `beforeCreateInvitation` refuses a NEW invitation, but
+          // better-auth answers `resend: true` for an invitee who is
+          // already pending BEFORE it consults that hook: it extends the
+          // row's `expiresAt` and sends the invitation e-mail again
+          // (`organization/routes/crud-invites.mjs`, better-auth 1.7.12).
+          // The console reaches exactly that branch through
+          // `sys_invitation`'s `resend_invitation` action. On a
+          // cloud-managed environment no invitation leaves this door in
+          // either shape, so the route refuses ahead of the vendor's
+          // handler; the hook keeps its own arm as the second line. The
+          // fact is public (`features.cloudManaged` on `/auth/config`), so
+          // answering it ahead of the session check tells an anonymous
+          // caller nothing new.
+          if (ctx?.path === '/organization/invite-member' && isCloudManaged()) {
+            const { APIError } = await import('better-auth/api');
+            throw new APIError('CONFLICT', {
+              message: CLOUD_MANAGED_REFUSAL_MESSAGES.invitation,
+              code: CLOUD_MANAGED_REFUSAL_CODE,
+            });
+          }
+
           // ── ADR-0069 D2: account lockout (gate) ─────────────────────
           // Reject a sign-in for a locked identity BEFORE better-auth checks
           // the password — a lock must hold even against the correct password.
@@ -3650,6 +3676,20 @@ export class AuthManager {
           // denied (auto-org-admin-grant.ts keeps it read-only on those
           // tables precisely so a fresh org admin cannot rebind themselves).
           beforeCreateInvitation: async ({ invitation, inviter, organization }: any) => {
+            // [#25083] A cloud-managed environment creates no invitation at
+            // all: the organisation that hosts it invites its people in the
+            // cloud. The `before` hook refuses `/organization/invite-member`
+            // first, resends included; this arm is the second line, for any
+            // other path that reaches the hook. First here, before the role
+            // cap and the placement gate, because no invitation is issuable
+            // whatever its role or placement.
+            if (isCloudManaged()) {
+              const { APIError } = await import('better-auth/api');
+              throw new APIError('CONFLICT', {
+                message: CLOUD_MANAGED_REFUSAL_MESSAGES.invitation,
+                code: CLOUD_MANAGED_REFUSAL_CODE,
+              });
+            }
             const inviterUserId = inviter?.id ?? inviter?.userId ?? null;
             const organizationId = organization?.id ?? invitation?.organizationId;
 
@@ -7555,6 +7595,18 @@ export class AuthManager {
     return readSsoOnlyEnv() ?? (this.config.ssoOnlyMode ?? false);
   }
 
+  /**
+   * Is local self-registration forced off, whatever `disableSignUp` says?
+   * Under SSO-only ({@link resolveSsoOnly}), and [#25083] on a cloud-managed
+   * environment, whose people the hosting organisation invites in the cloud.
+   * Read by the wiring and by `getPublicConfig()` alike, so the advertised
+   * flag cannot disagree with the wired one. Break-glass is untouched: neither
+   * case disables `emailAndPassword.enabled`.
+   */
+  private signUpForcedOff(): boolean {
+    return this.resolveSsoOnly() || isCloudManaged();
+  }
+
   /**
    * The tenancy posture ACTUALLY IN FORCE on this deployment — the one fact
    * both `organization/create`'s gate and `/auth/config`'s
@@ -7663,7 +7715,8 @@ export class AuthManager {
     const disableSignUpFromEnv = readDisableSignUpEnv();
     // SSO-only ("enforced") hides the local password form + self-registration.
     // `enabled` stays true (break-glass), but signup is forced off and the UI
-    // suppresses the password form via `features.ssoEnforced` below.
+    // suppresses the password form via `features.ssoEnforced` below. A
+    // cloud-managed environment forces signup off too (`signUpForcedOff`).
     const ssoOnly = this.resolveSsoOnly();
     // [#11739] The audience posture, resolved once for this response: the
     // forced-verification mirror below and `features.audiencePosture` must
@@ -7675,7 +7728,7 @@ export class AuthManager {
     const audience = this.getAudience();
     const emailPassword = {
       enabled: emailPasswordConfig.enabled !== false, // Default to true
-      disableSignUp: ssoOnly ? true : (disableSignUpFromEnv ?? emailPasswordConfig.disableSignUp ?? false),
+      disableSignUp: this.signUpForcedOff() ? true : (disableSignUpFromEnv ?? emailPasswordConfig.disableSignUp ?? false),
       // Mirrors the wiring in createAuthInstance() through the SAME resolver:
       // a self-registration-permitting posture forces verification ON, except
       // an `open` deployment's explicit opt-out (#20389) — the advertised flag
 
@@ -1,6 +1,7 @@
 // Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.
 
-import { Plugin, PluginContext, IHttpServer, resolveRequestExecutionContext, type RequestAuthService } from '@objectstack/core';
+// [#25083] `isCloudManaged`: the ONE accessor the cloud-managed doors below ask.
+import { Plugin, PluginContext, IHttpServer, isCloudManaged, resolveRequestExecutionContext, type RequestAuthService } from '@objectstack/core';
 import type { BetterAuthOptions } from 'better-auth';
 import {
   AuthConfig,
@@ -90,6 +91,7 @@ import {
   type SignInPathConfigView,
 } from './boot-sign-in-reachability.js';
 import { judgePlatformAdmin, isPlatformAdminUser, type PlatformAdminActor } from './platform-admin-gate.js';
+import { cloudManagedRefusal } from './cloud-managed.js';
 import {
   runAdminBanUser,
   runAdminUnbanUser,
@@ -2860,6 +2862,20 @@ export class AuthPlugin implements Plugin {
     rawApp.post(`${basePath}/set-initial-password`, async (c: any) => {
       try {
         const authApi = await this.authManager!.getApi();
+        // [#25083] On a cloud-managed environment the door narrows to a caller
+        // with platform-admin standing: everyone else signs in through the
+        // hosting organisation's identity provider, while an administrator can
+        // still give themselves the local password break-glass needs (ADR-0135
+        // D5.2 splits by population, never wholesale). A caller with no
+        // session falls through to the body, which answers it as before.
+        if (isCloudManaged()) {
+          // [#24222] Read as `AuthSessionApi` declares the answer (see `SessionRead`).
+          const session: SessionRead | null = await authApi.getSession(inProcessSessionReadInput(c.req.raw.headers));
+          if (session?.user?.id && !isPlatformAdminUser(session.user)) {
+            const refusal = cloudManagedRefusal('setInitialPassword');
+            return c.json(refusal.body, refusal.status);
+          }
+        }
         const { status, body } = await runSetInitialPassword(authApi as any, c.req.raw);
         return c.json(body, status);
       } catch (error) {
@@ -3212,6 +3228,12 @@ export class AuthPlugin implements Plugin {
         try {
           const actor = await gateAdmin(c);
           if (actor instanceof Response) return actor;
+          // [#25083] After the identity and admin checks, before any write: a
+          // cloud-managed environment's users are invited in the cloud.
+          if (isCloudManaged()) {
+            const refusal = cloudManagedRefusal('createUser');
+            return c.json(refusal.body, refusal.status);
+          }
           const authApi: any = await this.authManager!.getApi();
           if (typeof authApi.createUser !== 'function') {
             return c.json(
@@ -3482,6 +3504,11 @@ export class AuthPlugin implements Plugin {
         try {
           const actor = await gateAdmin(c);
           if (actor instanceof Response) return actor;
+          // [#25083] Same placement and reason as create-user's refusal.
+          if (isCloudManaged()) {
+            const refusal = cloudManagedRefusal('importUsers');
+            return c.json(refusal.body, refusal.status);
+          }
           const { runAdminImportUsers } = await import('./admin-import-users.js');
           // [#4251] Resolved from `protocol`, not `metadata`. `getMetaItem` is a
           // PROTOCOL method (`ObjectStackProtocolImplementation`, registered by