feat(copy): 2.4.0 features, and fix the agent-safety claim

.gitignore

@@ -32,3 +32,4 @@ yarn-error.log*
 
 # vercel
 .vercel
+tsconfig.tsbuildinfo

components/AiUseCase.tsx

@@ -27,8 +27,8 @@ const guarantees = [
   },
   {
     icon: <FaRobot className="text-blue-500 text-2xl" />,
-    title: "Prompt-injection safe",
-    body: "The agent calls Authorizer with the end user’s JWT and the subject is pinned server-side. A hijacked agent holds no privileged credential—it asks as the user, and gets the user’s answer.",
+    title: "A hijacked agent can’t reach further than it was trusted with",
+    body: "The subject is pinned server-side—an agent can never ask on someone else’s behalf. And an agent acting for a user gets the intersection of what the agent is trusted with and what that user can see, never the user’s full reach. Prompt-inject it all you like: it cannot open a door it was not given.",
   },
 ];
 

components/Features.tsx

@@ -1,15 +1,21 @@
 import {
+	FaBuilding,
 	FaCloud,
 	FaCode,
 	FaConnectdevelop,
 	FaDatabase,
+	FaExchangeAlt,
+	FaFingerprint,
 	FaLock,
 	FaMailBulk,
 	FaNetworkWired,
 	FaPlug,
 	FaProjectDiagram,
 	FaRobot,
+	FaServer,
 	FaShieldAlt,
+	FaSitemap,
+	FaSyncAlt,
 	FaUserAstronaut,
 	FaUsers,
 } from 'react-icons/fa';
@@ -68,7 +74,7 @@ const features = [
 		label: 'GraphQL, REST & gRPC APIs',
 		icon: <FaNetworkWired className="text-blue-500 text-2xl" />,
 		description:
-			'Integrate over three protocols on standard OAuth2 and OpenID Connect, with official SDKs for Go, Python, JavaScript, and React (Vue, Svelte, and Flutter coming soon).',
+			'Full parity across three protocols on standard OAuth2 and OpenID Connect—every operation available over GraphQL, REST, and gRPC. Official SDKs for Go, Python, JavaScript, React, Vue, and Svelte.',
 		position: 12,
 	},
 	{
@@ -107,9 +113,51 @@ const features = [
 
 		icon: <FaLock className="text-blue-500 text-2xl" />,
 		description:
-			'Added layer of security with email based OTP for your basic authentication recipe',
+			'TOTP authenticator apps, email and SMS one-time codes, and passkeys as a second factor—on by default, optional per user, with brute-force lockout and admin recovery.',
 		position: 9,
 	},
+	{
+		label: 'PASSKEYS & WEBAUTHN',
+		icon: <FaFingerprint className="text-blue-500 text-2xl" />,
+		description:
+			'Phishing-resistant passwordless login with WebAuthn passkeys—Touch ID, Face ID, Windows Hello, and hardware keys. Use them to sign in, or as a second factor.',
+		position: 14,
+	},
+	{
+		label: 'ENTERPRISE SSO (SAML & OIDC)',
+		icon: <FaBuilding className="text-blue-500 text-2xl" />,
+		description:
+			'Per-organization SAML 2.0 and OIDC single sign-on to Okta, Entra ID, Google Workspace, and any compliant IdP. Authorizer also runs as a SAML 2.0 Identity Provider for your own downstream apps.',
+		position: 15,
+	},
+	{
+		label: 'ORGANIZATIONS & MULTI-TENANCY',
+		icon: <FaSitemap className="text-blue-500 text-2xl" />,
+		description:
+			'First-class organizations with memberships, org-scoped admins, verified email domains, and home-realm discovery that routes users to their own identity provider.',
+		position: 16,
+	},
+	{
+		label: 'SCIM 2.0 PROVISIONING',
+		icon: <FaSyncAlt className="text-blue-500 text-2xl" />,
+		description:
+			'Inbound SCIM 2.0 keeps users and groups in sync from your customers’ directories—automatic joiner, mover, and leaver handling, with SCIM groups mapped to roles.',
+		position: 17,
+	},
+	{
+		label: 'MACHINE-TO-MACHINE AUTH',
+		icon: <FaServer className="text-blue-500 text-2xl" />,
+		description:
+			'Service accounts with the client_credentials grant, plus workload identity that needs no shared secret—private-key JWT (RFC 7523), SPIFFE JWT-SVIDs, and Kubernetes TokenReview.',
+		position: 18,
+	},
+	{
+		label: 'DELEGATION FOR AI AGENTS',
+		icon: <FaExchangeAlt className="text-blue-500 text-2xl" />,
+		description:
+			'RFC 8693 token exchange lets an agent act on a user’s behalf with a verifiable actor chain—delegation only, never silent impersonation. Give each agent its own permissions: it gets what it AND the user are allowed, never the user’s full reach.',
+		position: 19,
+	},
 ];
 
 const pillars = [

constants/site.ts

@@ -36,7 +36,7 @@ export const TWITTER_CARD_IMAGE_HEIGHT = 600;
 
 /** ~155 chars for meta description snippets */
 export const META_DESCRIPTION =
-  "Own your identity layer. Self-host open-source auth & fine-grained authorization—OAuth2, OIDC, RBAC, MFA, OpenFGA—with permission-aware AI on your data.";
+  "Own your identity layer. Self-host open-source auth—OAuth2, OIDC, SAML SSO, SCIM, passkeys, MFA, OpenFGA—with permission-aware AI on your own data.";
 
 export const DEFAULT_DESCRIPTION =
-  "Own your identity layer with open-source authentication and authorization you self-host. OAuth2, OpenID Connect, social login, magic links, RBAC, MFA, and fine-grained authorization (OpenFGA) for permission-aware AI and RAG. GraphQL, REST, and gRPC APIs with Go, Python, and JS SDKs—your users stay in your own database, not someone else's dashboard. No per-seat auth tax.";
+  "Own your identity layer with open-source authentication and authorization you self-host. OAuth2, OpenID Connect, SAML 2.0 enterprise SSO, SCIM 2.0 provisioning, passkeys, MFA, organizations, machine-to-machine auth, and fine-grained authorization (OpenFGA) for permission-aware AI and RAG. GraphQL, REST, and gRPC APIs with Go, Python, JS, React, Vue, and Svelte SDKs—your users stay in your own database, not someone else's dashboard. No per-seat auth tax.";