refactor(plugin-auth): move the organization plugin factory into auth-manager-organization-plugin.ts (#25224 cut 15)

packages/plugins/plugin-auth/src/api-error-code.pin.test.ts

@@ -182,6 +182,7 @@ describe('every new APIError( in plugin-auth/src carries an ADR-0112 code (#2424
       'auth-manager-password-session-policy.ts',
       'auth-manager-email-sms-delivery.ts',
       'auth-manager-before-hook.ts',
+      'auth-manager-organization-plugin.ts',
     ];
     expect(sites.length).toBeGreaterThanOrEqual(30);
     expect(new Set(sites.map((s) => s.file)).size).toBeGreaterThanOrEqual(4);

packages/plugins/plugin-auth/src/auth-email-locale.test.ts

@@ -859,8 +859,9 @@ describe("#14641 — an invitation reads the INVITEE's own sys_user.locale", ()
  * ⚠️ POPULATION of the class claim these blocks close, stated rather than
  * implied: the auth mail surface is the five `sendTemplate` call sites in
  * `auth-manager.ts`, `auth-manager-auth-instance.ts` (the body of
- * `createAuthInstance`) and `auth-manager-email-sms-delivery.ts` (the body of
- * the change-email notice) — `IEmailService` declares exactly two delivering
+ * `createAuthInstance`), `auth-manager-organization-plugin.ts` (the body of
+ * the organization plugin's factory) and `auth-manager-email-sms-delivery.ts`
+ * (the body of the change-email notice) — `IEmailService` declares exactly two delivering
  * members (`send`, `sendTemplate`), plugin-auth's only `.send(` calls are the
  * SMS service's, and no other file under `plugin-auth/src` calls either.
  * Those five are the same five `driveAllFive` above drives and `TEMPLATES`
@@ -1124,8 +1125,8 @@ describe('#15106 — the CLASS claim: all five auth sends read the recipient col
 
   it('every one of the five sends is written in the stored language of its own recipient', async () => {
     // ⚠️ POPULATION: the five `sendTemplate` sites in `auth-manager.ts`,
-    // `auth-manager-auth-instance.ts` and `auth-manager-email-sms-delivery.ts`
-    // — the same five `driveAllFive` drives and `TEMPLATES` names, and the whole of
+    // `auth-manager-auth-instance.ts`, `auth-manager-organization-plugin.ts` and
+    // `auth-manager-email-sms-delivery.ts` — the same five `driveAllFive` drives and `TEMPLATES` names, and the whole of
     // plugin-auth's mail surface (see this section's header). This is the pin
     // that closes the class; the per-send pins above only cover one member.
     //

packages/plugins/plugin-auth/src/better-auth-schema-parity.test.ts

@@ -320,8 +320,8 @@ function betterAuthPluginSet(): unknown[] {
  */
 function authManagerPluginFactories(): string[] {
   // [#25224] The auth manager's source: `auth-manager.ts` and the method
-  // bodies moved out of it whole. A factory imported in either is one it loads.
-  const source = ['auth-manager.ts', 'auth-manager-actor-guards.ts']
+  // bodies moved out of it whole. A factory imported in any of them is one it loads.
+  const source = ['auth-manager.ts', 'auth-manager-actor-guards.ts', 'auth-manager-organization-plugin.ts']
     .map((file) => readFileSync(join(PKG, 'src', file), 'utf8'))
     .join('\n');
   const found = new Set<string>();

packages/plugins/plugin-auth/src/managed-extension-fields.test.ts

@@ -630,8 +630,8 @@ function findCollisions(
  */
 function authManagerPluginFactories(): string[] {
   // [#25224] The auth manager's source: `auth-manager.ts` and the method
-  // bodies moved out of it whole. A factory imported in either is one it loads.
-  const source = ['auth-manager.ts', 'auth-manager-actor-guards.ts']
+  // bodies moved out of it whole. A factory imported in any of them is one it loads.
+  const source = ['auth-manager.ts', 'auth-manager-actor-guards.ts', 'auth-manager-organization-plugin.ts']
     .map((file) => readFileSync(join(HERE, file), 'utf8'))
     .join('\n');
   const found = new Set<string>();

scripts/adr-anchors/packages__plugins__plugin-auth__src__auth-manager-organization-plugin.ts.json

@@ -0,0 +1,7 @@
+{
+  "file": "packages/plugins/plugin-auth/src/auth-manager-organization-plugin.ts",
+  "adrs": [
+    "ADR-0108"
+  ],
+  "invariant": "ADR-0108 — better-auth's organization roles map registers the closed framework vocabulary ONLY. App-declared `position` / `permission` names are not organization roles — registering one makes it storable in `sys_member.role`, which `resolve-authz-context` projects into `current_user.positions`."
+}