Every seam, a folder.
The kits stay narrow by pushing integrations to the edges: payment providers into billing-kit-adapters, enterprise identity and RBAC engines into tenant-kit-adapters. Statuses below are honest to the repos today — a tile is never a roadmap.
Payments in
BillingProvider — settlement, capture, refunds, webhooks. billing-kit branches on capabilities, never a provider name.
Settlement, capture, refunds, verified webhooks — ships in billing-kit.
Merchant-of-record settlement; the provider’s number is authoritative.
The BillingProvider contract and conformance testkit are waiting.
Same contract; the template typechecks before you write a line.
Same contract, same testkit, same review checklist.
cp -r adapters/_template — idempotency is the rule the review checks first.
Identity in
SsoResolver — a verified assertion becomes a membership-checked ResolvedTenant. Adapters never verify credentials.
Per-tenant connections, group→role mapping, JIT provisioning.
Shared-issuer multi-tenant routing via the tid claim predicate.
Any OIDC issuer routes by exact match — lookalikes have a test.
Verified ID-token claims in; ResolvedTenant out.
The family’s own issuer — first-party tokens for fromClaim.
A verified assertion maps to VerifiedIdentity; no separate adapter needed.
Provisioning in
ScimDirectory — the enterprise directory pushes membership; offboarding offboards, last_owner answers 409.
Lookup-then-create, replay convergence, deactivate-as-offboard.
The SCIM 2.0 Users subset the major IdPs actually drive.
Any SCIM 2.0 client speaks to the same framework-neutral handler.
Roles out
RoleBridge over a TupleStore — memberships mirrored as convergent desired-state sync; unexplained grants die on the next pass.
One direct tuple per membership; inheritance lives in the model.
Same 3-method store contract; convergent desired-state sync.
Anything storing subject–relation–object triples fits the seam.