better-authlisted

# better-auth in this repository better-auth owns identity. It owns the `user`, `session`, `account`, `member`, `invitation`, `organizationRole`, `ssoProvider` and `scimProvider` tables, and it owns the endpoints that write them. Everything below follows from that one fact. ## The rule that costs the most to learn **A check on our side is one a request straight to better-auth's own endpoint walks past.** The seat limit taught this. Ours would have been a `Policy` on an RPC handler; an invitation created through `POST /api/auth/organization/invite-member` never reaches that handler. It is `membershipLimit` inside the plugin now, asked per invitation so an upgrade lands on the next invite rather than the next deploy. So, before adding a rule, ask **who owns the endpoint**: | The rule is about | Where it goes | | --------------------------------------------- | ---------------------------------------------------------------------- | | Something better-auth's endpoints do | Its own option (`membershipLimit`, `requiredRole`, `canGenerateToken`) | | Something only our procedures do | `withPolicy(...)` in the handler | | A **plan** question better-auth cannot answer | A `before` hook in `auth/Options.ts` | That third row is the pattern to copy. `/sso/register` and `/scim/generate-token` are both gated