tenant-kit-adapters — diagrams

The mermaid sources for this repo. They live here rather than in the README because npm renders no mermaid: on the package page a fence like this one ships as raw DSL. GitHub and the QuxKit docs site both draw them. The README carries an ASCII equivalent of each.

Three seams: identity in, provisioning in, roles out

flowchart LR
    subgraph outside["the enterprise's systems"]
        idp["IdP<br/>Okta · Entra · Keycloak"]
        dir["directory<br/>SCIM client"]
        rbac["RBAC engine<br/>OpenFGA · SpiceDB"]
    end

    subgraph adapters["adapters/*  (this repo)"]
        sso["sso-oidc<br/>SsoResolver"]
        scim["scim<br/>ScimDirectory"]
        fga["openfga<br/>RoleBridge"]
    end

    core["tenant-kit core<br/>directory · resolution · context · isolation"]

    idp -->|"verified identity"| sso -->|"ResolvedTenant + JIT"| core
    dir -->|"provision / deprovision"| scim -->|"memberships"| core
    core -->|"memberships"| fga -->|"relation tuples"| rbac

    classDef own fill:#0d9488,stroke:#0f766e,color:#ffffff;
    classDef ext fill:#1e293b,stroke:#0f172a,color:#e2e8f0;
    class sso,scim,fga,core own;
    class idp,dir,rbac ext;