@trokky/trokky 2.0.3

package/dist/types/media.d.ts

@@ -0,0 +1,56 @@
+/**
+ * Media Types
+ * Shared types for media handling across all Trokky packages
+ */
+export interface MediaAssetReference {
+    _ref: string;
+    _type: 'mediaAsset';
+}
+export interface MediaFieldValue {
+    _type: 'media';
+    asset: MediaAssetReference;
+    alt?: string;
+    caption?: string;
+    title?: string;
+    variant?: string;
+}
+export type MediaType = 'image' | 'video' | 'audio' | 'document' | 'archive';
+export interface MediaAsset {
+    id: string;
+    filename: string;
+    originalFilename?: string;
+    contentType: string;
+    size: number;
+    url: string;
+    uploadedAt: string;
+    title?: string;
+    description?: string;
+    metadata?: {
+        width?: number;
+        height?: number;
+        duration?: number;
+        title?: string;
+        alt?: string;
+        credit?: string;
+        author?: string;
+        tags?: string[];
+        imageVariants?: Record<string, {
+            url: string;
+            width: number;
+            height: number;
+            format: string;
+            size: number;
+        }>;
+        originalDimensions?: {
+            width: number;
+            height: number;
+        };
+    };
+}
+export interface MediaBrowserConfig {
+    onSelect: (value: MediaFieldValue) => void;
+    mediaTypeFilter?: MediaType;
+    showVariantSelector?: boolean;
+    context?: string;
+}
+//# sourceMappingURL=media.d.ts.map

package/dist/types/media.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"media.d.ts","sourceRoot":"","sources":["../../src/types/media.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,YAAY,CAAC;CACrB;AAGD,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,OAAO,CAAC;IACf,KAAK,EAAE,mBAAmB,CAAC;IAE3B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAGD,MAAM,MAAM,SAAS,GAAG,OAAO,GAAG,OAAO,GAAG,OAAO,GAAG,UAAU,GAAG,SAAS,CAAC;AAG7E,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE;QACT,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;QAChB,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;YAC7B,GAAG,EAAE,MAAM,CAAC;YACZ,KAAK,EAAE,MAAM,CAAC;YACd,MAAM,EAAE,MAAM,CAAC;YACf,MAAM,EAAE,MAAM,CAAC;YACf,IAAI,EAAE,MAAM,CAAC;SACd,CAAC,CAAC;QACH,kBAAkB,CAAC,EAAE;YACnB,KAAK,EAAE,MAAM,CAAC;YACd,MAAM,EAAE,MAAM,CAAC;SAChB,CAAC;KACH,CAAC;CACH;AAGD,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,IAAI,CAAC;IAC3C,eAAe,CAAC,EAAE,SAAS,CAAC;IAC5B,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB"}

package/dist/types/media.js

@@ -0,0 +1,6 @@
+/**
+ * Media Types
+ * Shared types for media handling across all Trokky packages
+ */
+export {};
+//# sourceMappingURL=media.js.map

package/dist/types/media.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"media.js","sourceRoot":"","sources":["../../src/types/media.ts"],"names":[],"mappings":"AAAA;;;GAGG"}

package/dist/types/oauth2.d.ts

@@ -0,0 +1,287 @@
+/**
+ * @trokky/types - OAuth2 Authorization Server Types
+ *
+ * Supports Device Authorization Flow (RFC 8628) and Authorization Code Flow with PKCE.
+ * Enables Trokky Studio to act as an SSO provider for CLI and external applications.
+ */
+import type { Permission } from './auth.js';
+/**
+ * OAuth2 Grant Types supported by the authorization server
+ */
+export type OAuth2GrantType = 'authorization_code' | 'urn:ietf:params:oauth:grant-type:device_code' | 'refresh_token';
+/**
+ * OAuth2 Client Types
+ * - public: No client secret (CLI, SPAs, mobile apps)
+ * - confidential: Has client secret (server-side web apps)
+ */
+export type OAuth2ClientType = 'public' | 'confidential';
+/**
+ * Registered OAuth2 Client (Application)
+ */
+export interface OAuth2Client {
+    /** Unique client identifier */
+    id: string;
+    /** Human-readable client name */
+    name: string;
+    /** Optional description */
+    description?: string;
+    /** Client type (public or confidential) */
+    type: OAuth2ClientType;
+    /** Hashed client secret (only for confidential clients) */
+    secretHash?: string;
+    /** Allowed redirect URIs for authorization code flow */
+    redirectUris: string[];
+    /** Allowed scopes this client can request */
+    allowedScopes: OAuth2Scope[];
+    /** Allowed grant types for this client */
+    grantTypes: OAuth2GrantType[];
+    /** Whether client is active */
+    isActive: boolean;
+    /** Whether this is a built-in client (e.g., CLI) */
+    isBuiltIn?: boolean;
+    /** User ID who registered this client */
+    createdBy?: string;
+    /** Logo URL for consent screen */
+    logoUrl?: string;
+    /** Homepage URL for client info */
+    homepageUrl?: string;
+    /** Privacy policy URL */
+    privacyPolicyUrl?: string;
+    /** Terms of service URL */
+    termsOfServiceUrl?: string;
+    createdAt: string;
+    updatedAt: string;
+}
+/**
+ * OAuth2 Scopes - map to Trokky permissions
+ */
+export type OAuth2Scope = 'openid' | 'profile' | 'content:read' | 'content:write' | 'content:delete' | 'media:read' | 'media:write' | 'offline_access';
+/**
+ * Map OAuth2 scopes to Trokky permissions
+ */
+export declare const SCOPE_TO_PERMISSIONS: Record<OAuth2Scope, Permission[]>;
+/**
+ * Device Authorization Request
+ * POST /auth/device
+ */
+export interface DeviceAuthorizationRequest {
+    /** Client identifier */
+    client_id: string;
+    /** Space-separated list of requested scopes */
+    scope?: string;
+}
+/**
+ * Device Authorization Response
+ * Returned by POST /auth/device
+ */
+export interface DeviceAuthorizationResponse {
+    /** Device verification code (shown to user) */
+    device_code: string;
+    /** User code to enter in browser (short, easy to type) */
+    user_code: string;
+    /** URL where user should go to authorize */
+    verification_uri: string;
+    /** Full URL with user_code pre-filled (optional) */
+    verification_uri_complete?: string;
+    /** Lifetime of device_code in seconds */
+    expires_in: number;
+    /** Minimum polling interval in seconds */
+    interval: number;
+}
+/**
+ * Device code state stored server-side
+ */
+export interface DeviceCodeState {
+    /** The device code (hashed for storage) */
+    deviceCodeHash: string;
+    /** The user code (plain text, for lookup) */
+    userCode: string;
+    /** Client that initiated the request */
+    clientId: string;
+    /** Requested scopes */
+    scopes: OAuth2Scope[];
+    /** When the code expires */
+    expiresAt: number;
+    /** Polling interval in seconds */
+    interval: number;
+    /** Authorization status */
+    status: 'pending' | 'authorized' | 'denied' | 'expired';
+    /** User ID if authorized */
+    userId?: string;
+    /** Timestamp when user authorized/denied */
+    decidedAt?: number;
+}
+/**
+ * Device Token Request
+ * POST /auth/token with grant_type=urn:ietf:params:oauth:grant-type:device_code
+ */
+export interface DeviceTokenRequest {
+    grant_type: 'urn:ietf:params:oauth:grant-type:device_code';
+    device_code: string;
+    client_id: string;
+}
+/**
+ * Authorization Request (GET /auth/authorize)
+ */
+export interface AuthorizationRequest {
+    response_type: 'code';
+    client_id: string;
+    redirect_uri: string;
+    scope?: string;
+    state: string;
+    /** PKCE code challenge */
+    code_challenge: string;
+    /** PKCE code challenge method (always S256) */
+    code_challenge_method: 'S256';
+}
+/**
+ * Authorization code state stored server-side
+ */
+export interface AuthorizationCodeState {
+    /** The authorization code (hashed for storage) */
+    codeHash: string;
+    /** Client that initiated the request */
+    clientId: string;
+    /** Redirect URI used in the request */
+    redirectUri: string;
+    /** Requested scopes */
+    scopes: OAuth2Scope[];
+    /** PKCE code challenge */
+    codeChallenge: string;
+    /** User ID who authorized */
+    userId: string;
+    /** When the code expires (short-lived, ~10 minutes) */
+    expiresAt: number;
+}
+/**
+ * Authorization Code Token Request
+ * POST /auth/token with grant_type=authorization_code
+ */
+export interface AuthorizationCodeTokenRequest {
+    grant_type: 'authorization_code';
+    code: string;
+    redirect_uri: string;
+    client_id: string;
+    /** PKCE code verifier */
+    code_verifier: string;
+}
+/**
+ * Refresh Token Request
+ * POST /auth/token with grant_type=refresh_token
+ */
+export interface OAuth2RefreshTokenRequest {
+    grant_type: 'refresh_token';
+    refresh_token: string;
+    client_id: string;
+    scope?: string;
+}
+/**
+ * Successful Token Response
+ */
+export interface TokenResponse {
+    access_token: string;
+    token_type: 'Bearer';
+    expires_in: number;
+    refresh_token?: string;
+    scope: string;
+}
+/**
+ * OAuth2 Error Response
+ */
+export interface OAuth2ErrorResponse {
+    error: OAuth2ErrorCode;
+    error_description?: string;
+    error_uri?: string;
+}
+/**
+ * OAuth2 Error Codes
+ */
+export type OAuth2ErrorCode = 'authorization_pending' | 'slow_down' | 'access_denied' | 'expired_token' | 'invalid_request' | 'invalid_client' | 'invalid_grant' | 'unauthorized_client' | 'unsupported_grant_type' | 'invalid_scope' | 'server_error';
+/**
+ * User consent record for a client
+ */
+export interface UserConsent {
+    /** User ID */
+    userId: string;
+    /** Client ID */
+    clientId: string;
+    /** Scopes the user has consented to */
+    scopes: OAuth2Scope[];
+    /** When consent was granted */
+    grantedAt: string;
+    /** When consent expires (optional) */
+    expiresAt?: string;
+}
+/**
+ * OAuth2 Access Token record (for revocation tracking)
+ */
+export interface OAuth2AccessToken {
+    /** Token ID (jti claim) */
+    id: string;
+    /** User ID */
+    userId: string;
+    /** Client ID */
+    clientId: string;
+    /** Granted scopes */
+    scopes: OAuth2Scope[];
+    /** When token expires */
+    expiresAt: number;
+    /** Whether token has been revoked */
+    revoked: boolean;
+    createdAt: string;
+}
+/**
+ * OAuth2 Refresh Token record
+ */
+export interface OAuth2RefreshToken {
+    /** Token hash */
+    tokenHash: string;
+    /** User ID */
+    userId: string;
+    /** Client ID */
+    clientId: string;
+    /** Granted scopes */
+    scopes: OAuth2Scope[];
+    /** When token expires */
+    expiresAt: number;
+    /** Whether token has been revoked */
+    revoked: boolean;
+    /** Access token ID this refresh token is associated with */
+    accessTokenId?: string;
+    createdAt: string;
+}
+/**
+ * Data for creating a new OAuth2 client
+ */
+export interface CreateOAuth2ClientData {
+    name: string;
+    description?: string;
+    type: OAuth2ClientType;
+    redirectUris: string[];
+    allowedScopes?: OAuth2Scope[];
+    grantTypes?: OAuth2GrantType[];
+    logoUrl?: string;
+    homepageUrl?: string;
+    privacyPolicyUrl?: string;
+    termsOfServiceUrl?: string;
+}
+/**
+ * Data for updating an OAuth2 client
+ */
+export interface UpdateOAuth2ClientData {
+    name?: string;
+    description?: string;
+    redirectUris?: string[];
+    allowedScopes?: OAuth2Scope[];
+    grantTypes?: OAuth2GrantType[];
+    isActive?: boolean;
+    logoUrl?: string;
+    homepageUrl?: string;
+    privacyPolicyUrl?: string;
+    termsOfServiceUrl?: string;
+}
+/**
+ * Built-in CLI client configuration
+ */
+export declare const BUILTIN_CLI_CLIENT: Omit<OAuth2Client, 'createdAt' | 'updatedAt'>;
+//# sourceMappingURL=oauth2.d.ts.map

package/dist/types/oauth2.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth2.d.ts","sourceRoot":"","sources":["../../src/types/oauth2.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,WAAW,CAAA;AAM3C;;GAEG;AACH,MAAM,MAAM,eAAe,GACvB,oBAAoB,GACpB,8CAA8C,GAC9C,eAAe,CAAA;AAEnB;;;;GAIG;AACH,MAAM,MAAM,gBAAgB,GAAG,QAAQ,GAAG,cAAc,CAAA;AAExD;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,+BAA+B;IAC/B,EAAE,EAAE,MAAM,CAAA;IACV,iCAAiC;IACjC,IAAI,EAAE,MAAM,CAAA;IACZ,2BAA2B;IAC3B,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,2CAA2C;IAC3C,IAAI,EAAE,gBAAgB,CAAA;IACtB,2DAA2D;IAC3D,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,wDAAwD;IACxD,YAAY,EAAE,MAAM,EAAE,CAAA;IACtB,6CAA6C;IAC7C,aAAa,EAAE,WAAW,EAAE,CAAA;IAC5B,0CAA0C;IAC1C,UAAU,EAAE,eAAe,EAAE,CAAA;IAC7B,+BAA+B;IAC/B,QAAQ,EAAE,OAAO,CAAA;IACjB,oDAAoD;IACpD,SAAS,CAAC,EAAE,OAAO,CAAA;IACnB,yCAAyC;IACzC,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,kCAAkC;IAClC,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,mCAAmC;IACnC,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,yBAAyB;IACzB,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,2BAA2B;IAC3B,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED;;GAEG;AACH,MAAM,MAAM,WAAW,GACnB,QAAQ,GACR,SAAS,GACT,cAAc,GACd,eAAe,GACf,gBAAgB,GAChB,YAAY,GACZ,aAAa,GACb,gBAAgB,CAAA;AAEpB;;GAEG;AACH,eAAO,MAAM,oBAAoB,EAAE,MAAM,CAAC,WAAW,EAAE,UAAU,EAAE,CASlE,CAAA;AAMD;;;GAGG;AACH,MAAM,WAAW,0BAA0B;IACzC,wBAAwB;IACxB,SAAS,EAAE,MAAM,CAAA;IACjB,+CAA+C;IAC/C,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED;;;GAGG;AACH,MAAM,WAAW,2BAA2B;IAC1C,+CAA+C;IAC/C,WAAW,EAAE,MAAM,CAAA;IACnB,0DAA0D;IAC1D,SAAS,EAAE,MAAM,CAAA;IACjB,4CAA4C;IAC5C,gBAAgB,EAAE,MAAM,CAAA;IACxB,oDAAoD;IACpD,yBAAyB,CAAC,EAAE,MAAM,CAAA;IAClC,yCAAyC;IACzC,UAAU,EAAE,MAAM,CAAA;IAClB,0CAA0C;IAC1C,QAAQ,EAAE,MAAM,CAAA;CACjB;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,2CAA2C;IAC3C,cAAc,EAAE,MAAM,CAAA;IACtB,6CAA6C;IAC7C,QAAQ,EAAE,MAAM,CAAA;IAChB,wCAAwC;IACxC,QAAQ,EAAE,MAAM,CAAA;IAChB,uBAAuB;IACvB,MAAM,EAAE,WAAW,EAAE,CAAA;IACrB,4BAA4B;IAC5B,SAAS,EAAE,MAAM,CAAA;IACjB,kCAAkC;IAClC,QAAQ,EAAE,MAAM,CAAA;IAChB,2BAA2B;IAC3B,MAAM,EAAE,SAAS,GAAG,YAAY,GAAG,QAAQ,GAAG,SAAS,CAAA;IACvD,4BAA4B;IAC5B,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,4CAA4C;IAC5C,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IACjC,UAAU,EAAE,8CAA8C,CAAA;IAC1D,WAAW,EAAE,MAAM,CAAA;IACnB,SAAS,EAAE,MAAM,CAAA;CAClB;AAMD;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,aAAa,EAAE,MAAM,CAAA;IACrB,SAAS,EAAE,MAAM,CAAA;IACjB,YAAY,EAAE,MAAM,CAAA;IACpB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,KAAK,EAAE,MAAM,CAAA;IACb,0BAA0B;IAC1B,cAAc,EAAE,MAAM,CAAA;IACtB,+CAA+C;IAC/C,qBAAqB,EAAE,MAAM,CAAA;CAC9B;AAED;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC,kDAAkD;IAClD,QAAQ,EAAE,MAAM,CAAA;IAChB,wCAAwC;IACxC,QAAQ,EAAE,MAAM,CAAA;IAChB,uCAAuC;IACvC,WAAW,EAAE,MAAM,CAAA;IACnB,uBAAuB;IACvB,MAAM,EAAE,WAAW,EAAE,CAAA;IACrB,0BAA0B;IAC1B,aAAa,EAAE,MAAM,CAAA;IACrB,6BAA6B;IAC7B,MAAM,EAAE,MAAM,CAAA;IACd,uDAAuD;IACvD,SAAS,EAAE,MAAM,CAAA;CAClB;AAED;;;GAGG;AACH,MAAM,WAAW,6BAA6B;IAC5C,UAAU,EAAE,oBAAoB,CAAA;IAChC,IAAI,EAAE,MAAM,CAAA;IACZ,YAAY,EAAE,MAAM,CAAA;IACpB,SAAS,EAAE,MAAM,CAAA;IACjB,yBAAyB;IACzB,aAAa,EAAE,MAAM,CAAA;CACtB;AAED;;;GAGG;AACH,MAAM,WAAW,yBAAyB;IACxC,UAAU,EAAE,eAAe,CAAA;IAC3B,aAAa,EAAE,MAAM,CAAA;IACrB,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAMD;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,YAAY,EAAE,MAAM,CAAA;IACpB,UAAU,EAAE,QAAQ,CAAA;IACpB,UAAU,EAAE,MAAM,CAAA;IAClB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,KAAK,EAAE,MAAM,CAAA;CACd;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,eAAe,CAAA;IACtB,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED;;GAEG;AACH,MAAM,MAAM,eAAe,GAEvB,uBAAuB,GACvB,WAAW,GACX,eAAe,GACf,eAAe,GAEf,iBAAiB,GACjB,gBAAgB,GAChB,eAAe,GACf,qBAAqB,GACrB,wBAAwB,GACxB,eAAe,GACf,cAAc,CAAA;AAMlB;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,cAAc;IACd,MAAM,EAAE,MAAM,CAAA;IACd,gBAAgB;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,uCAAuC;IACvC,MAAM,EAAE,WAAW,EAAE,CAAA;IACrB,+BAA+B;IAC/B,SAAS,EAAE,MAAM,CAAA;IACjB,sCAAsC;IACtC,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAMD;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,2BAA2B;IAC3B,EAAE,EAAE,MAAM,CAAA;IACV,cAAc;IACd,MAAM,EAAE,MAAM,CAAA;IACd,gBAAgB;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,qBAAqB;IACrB,MAAM,EAAE,WAAW,EAAE,CAAA;IACrB,yBAAyB;IACzB,SAAS,EAAE,MAAM,CAAA;IACjB,qCAAqC;IACrC,OAAO,EAAE,OAAO,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,iBAAiB;IACjB,SAAS,EAAE,MAAM,CAAA;IACjB,cAAc;IACd,MAAM,EAAE,MAAM,CAAA;IACd,gBAAgB;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,qBAAqB;IACrB,MAAM,EAAE,WAAW,EAAE,CAAA;IACrB,yBAAyB;IACzB,SAAS,EAAE,MAAM,CAAA;IACjB,qCAAqC;IACrC,OAAO,EAAE,OAAO,CAAA;IAChB,4DAA4D;IAC5D,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,SAAS,EAAE,MAAM,CAAA;CAClB;AAMD;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,MAAM,CAAA;IACZ,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,IAAI,EAAE,gBAAgB,CAAA;IACtB,YAAY,EAAE,MAAM,EAAE,CAAA;IACtB,aAAa,CAAC,EAAE,WAAW,EAAE,CAAA;IAC7B,UAAU,CAAC,EAAE,eAAe,EAAE,CAAA;IAC9B,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,iBAAiB,CAAC,EAAE,MAAM,CAAA;CAC3B;AAED;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAA;IACvB,aAAa,CAAC,EAAE,WAAW,EAAE,CAAA;IAC7B,UAAU,CAAC,EAAE,eAAe,EAAE,CAAA;IAC9B,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,iBAAiB,CAAC,EAAE,MAAM,CAAA;CAC3B;AAED;;GAEG;AACH,eAAO,MAAM,kBAAkB,EAAE,IAAI,CAAC,YAAY,EAAE,WAAW,GAAG,WAAW,CAmB5E,CAAA"}

package/dist/types/oauth2.js

@@ -0,0 +1,43 @@
+/**
+ * @trokky/types - OAuth2 Authorization Server Types
+ *
+ * Supports Device Authorization Flow (RFC 8628) and Authorization Code Flow with PKCE.
+ * Enables Trokky Studio to act as an SSO provider for CLI and external applications.
+ */
+/**
+ * Map OAuth2 scopes to Trokky permissions
+ */
+export const SCOPE_TO_PERMISSIONS = {
+    'openid': [],
+    'profile': [],
+    'content:read': ['content:read'],
+    'content:write': ['content:read', 'content:write'],
+    'content:delete': ['content:read', 'content:delete'],
+    'media:read': ['media:read'],
+    'media:write': ['media:read', 'media:upload', 'media:edit'],
+    'offline_access': []
+};
+/**
+ * Built-in CLI client configuration
+ */
+export const BUILTIN_CLI_CLIENT = {
+    id: 'trokky-cli',
+    name: 'Trokky CLI',
+    description: 'Official Trokky command-line interface',
+    type: 'public',
+    redirectUris: [], // Device flow doesn't use redirects
+    allowedScopes: [
+        'openid',
+        'profile',
+        'content:read',
+        'content:write',
+        'content:delete',
+        'media:read',
+        'media:write',
+        'offline_access'
+    ],
+    grantTypes: ['urn:ietf:params:oauth:grant-type:device_code', 'refresh_token'],
+    isActive: true,
+    isBuiltIn: true
+};
+//# sourceMappingURL=oauth2.js.map

package/dist/types/oauth2.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth2.js","sourceRoot":"","sources":["../../src/types/oauth2.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AA0EH;;GAEG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAsC;IACrE,QAAQ,EAAE,EAAE;IACZ,SAAS,EAAE,EAAE;IACb,cAAc,EAAE,CAAC,cAAc,CAAC;IAChC,eAAe,EAAE,CAAC,cAAc,EAAE,eAAe,CAAC;IAClD,gBAAgB,EAAE,CAAC,cAAc,EAAE,gBAAgB,CAAC;IACpD,YAAY,EAAE,CAAC,YAAY,CAAC;IAC5B,aAAa,EAAE,CAAC,YAAY,EAAE,cAAc,EAAE,YAAY,CAAC;IAC3D,gBAAgB,EAAE,EAAE;CACrB,CAAA;AAmRD;;GAEG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAkD;IAC/E,EAAE,EAAE,YAAY;IAChB,IAAI,EAAE,YAAY;IAClB,WAAW,EAAE,wCAAwC;IACrD,IAAI,EAAE,QAAQ;IACd,YAAY,EAAE,EAAE,EAAE,oCAAoC;IACtD,aAAa,EAAE;QACb,QAAQ;QACR,SAAS;QACT,cAAc;QACd,eAAe;QACf,gBAAgB;QAChB,YAAY;QACZ,aAAa;QACb,gBAAgB;KACjB;IACD,UAAU,EAAE,CAAC,8CAA8C,EAAE,eAAe,CAAC;IAC7E,QAAQ,EAAE,IAAI;IACd,SAAS,EAAE,IAAI;CAChB,CAAA"}

package/dist/types/passkey.d.ts

@@ -0,0 +1,217 @@
+/**
+ * @trokky/types - Passkey/WebAuthn Types
+ *
+ * Types for passwordless authentication using WebAuthn/Passkeys.
+ * Enables biometric and security key authentication in Trokky Studio.
+ */
+/**
+ * Authenticator transport types (how the authenticator communicates)
+ */
+export type AuthenticatorTransportType = 'usb' | 'ble' | 'nfc' | 'internal' | 'hybrid';
+/**
+ * Stored passkey credential (server-side)
+ */
+export interface PasskeyCredential {
+    /** Base64URL-encoded credential ID */
+    id: string;
+    /** Base64URL-encoded public key */
+    publicKey: string;
+    /** Signature counter for replay attack prevention */
+    counter: number;
+    /** Device type - single device or synced across devices */
+    deviceType: 'singleDevice' | 'multiDevice';
+    /** Whether credential is backed up (e.g., iCloud Keychain, Google Password Manager) */
+    backedUp: boolean;
+    /** How the authenticator communicates */
+    transports?: AuthenticatorTransportType[];
+    /** ISO date when credential was registered */
+    createdAt: string;
+    /** ISO date when credential was last used */
+    lastUsedAt?: string;
+    /** User-friendly name (e.g., "MacBook Pro Touch ID") */
+    friendlyName?: string;
+    /** Authenticator AAGUID for device identification */
+    aaguid?: string;
+}
+/**
+ * Authenticator selection criteria for registration
+ */
+export interface PasskeyAuthenticatorSelection {
+    /** Prefer platform (built-in) or cross-platform (roaming) authenticator */
+    authenticatorAttachment?: 'platform' | 'cross-platform';
+    /** Whether to create a discoverable credential (resident key) */
+    residentKey?: 'required' | 'preferred' | 'discouraged';
+    /** Legacy: require resident key */
+    requireResidentKey?: boolean;
+    /** User verification requirement */
+    userVerification?: 'required' | 'preferred' | 'discouraged';
+}
+/**
+ * Passkey configuration for the security config
+ */
+export interface PasskeyConfig {
+    /** Whether passkey authentication is enabled */
+    enabled: boolean;
+    /** Relying Party ID (domain name, e.g., "example.com") */
+    rpId: string;
+    /** Human-readable Relying Party name */
+    rpName: string;
+    /** Allowed origin(s) for WebAuthn requests */
+    origin: string | string[];
+    /** Attestation conveyance preference */
+    attestation?: 'none' | 'indirect' | 'direct' | 'enterprise';
+    /** User verification requirement for authentication */
+    userVerification?: 'required' | 'preferred' | 'discouraged';
+    /** Challenge timeout in milliseconds (default: 60000) */
+    timeout?: number;
+    /** Authenticator selection criteria for registration */
+    authenticatorSelection?: PasskeyAuthenticatorSelection;
+}
+/**
+ * Credential descriptor for exclude/allow lists
+ */
+export interface PasskeyCredentialDescriptor {
+    /** Base64URL-encoded credential ID */
+    id: string;
+    /** Always 'public-key' for WebAuthn */
+    type: 'public-key';
+    /** Authenticator transports */
+    transports?: AuthenticatorTransportType[];
+}
+/**
+ * Options returned from /auth/passkey/register/options
+ */
+export interface PasskeyRegistrationOptions {
+    /** Base64URL-encoded challenge */
+    challenge: string;
+    /** Server session ID for verification */
+    sessionId: string;
+    /** Relying Party ID */
+    rpId: string;
+    /** Relying Party name */
+    rpName: string;
+    /** Base64URL-encoded user ID */
+    userId: string;
+    /** Username for credential */
+    userName: string;
+    /** Display name for credential */
+    userDisplayName: string;
+    /** Credentials to exclude (already registered) */
+    excludeCredentials: PasskeyCredentialDescriptor[];
+    /** Authenticator selection criteria */
+    authenticatorSelection: PasskeyAuthenticatorSelection;
+    /** Attestation conveyance preference */
+    attestation: 'none' | 'indirect' | 'direct' | 'enterprise';
+    /** Timeout in milliseconds */
+    timeout: number;
+}
+/**
+ * Request body for /auth/passkey/register/options
+ */
+export interface PasskeyRegistrationOptionsRequest {
+    /** Optional friendly name for the passkey */
+    friendlyName?: string;
+}
+/**
+ * Request body for /auth/passkey/register/verify
+ */
+export interface PasskeyRegistrationVerifyRequest {
+    /** Session ID from registration options */
+    sessionId: string;
+    /** WebAuthn credential response from browser */
+    credential: {
+        id: string;
+        rawId: string;
+        type: 'public-key';
+        response: {
+            clientDataJSON: string;
+            attestationObject: string;
+            transports?: AuthenticatorTransportType[];
+        };
+        clientExtensionResults?: Record<string, unknown>;
+        authenticatorAttachment?: 'platform' | 'cross-platform';
+    };
+    /** Optional friendly name for the passkey */
+    friendlyName?: string;
+}
+/**
+ * Options returned from /auth/passkey/login/options
+ */
+export interface PasskeyAuthenticationOptions {
+    /** Base64URL-encoded challenge */
+    challenge: string;
+    /** Server session ID for verification */
+    sessionId: string;
+    /** Relying Party ID */
+    rpId: string;
+    /** Allowed credentials (empty for discoverable credentials) */
+    allowCredentials: PasskeyCredentialDescriptor[];
+    /** User verification requirement */
+    userVerification: 'required' | 'preferred' | 'discouraged';
+    /** Timeout in milliseconds */
+    timeout: number;
+}
+/**
+ * Request body for /auth/passkey/login/options
+ */
+export interface PasskeyAuthenticationOptionsRequest {
+    /** Optional username for targeted authentication */
+    username?: string;
+}
+/**
+ * Request body for /auth/passkey/login/verify
+ */
+export interface PasskeyAuthenticationVerifyRequest {
+    /** Session ID from authentication options */
+    sessionId: string;
+    /** WebAuthn assertion response from browser */
+    credential: {
+        id: string;
+        rawId: string;
+        type: 'public-key';
+        response: {
+            clientDataJSON: string;
+            authenticatorData: string;
+            signature: string;
+            userHandle?: string;
+        };
+        clientExtensionResults?: Record<string, unknown>;
+        authenticatorAttachment?: 'platform' | 'cross-platform';
+    };
+    /** Device ID for trusted device check */
+    deviceId?: string;
+}
+/**
+ * Request body for updating a passkey credential
+ */
+export interface PasskeyUpdateRequest {
+    /** New friendly name */
+    friendlyName: string;
+}
+/**
+ * Response for listing passkey credentials
+ */
+export interface PasskeyCredentialListResponse {
+    /** List of credentials (without publicKey) */
+    credentials: Omit<PasskeyCredential, 'publicKey'>[];
+}
+/**
+ * Server-side session for passkey operations
+ */
+export interface PasskeySession {
+    /** Challenge for this session */
+    challenge: string;
+    /** User ID (for registration) */
+    userId?: string;
+    /** Expected origin for verification */
+    expectedOrigin: string | string[];
+    /** Expected RP ID for verification */
+    expectedRPID: string;
+    /** Session mode */
+    mode: 'register' | 'login';
+    /** Friendly name (for registration) */
+    friendlyName?: string;
+    /** Session expiration timestamp */
+    expiresAt: number;
+}
+//# sourceMappingURL=passkey.d.ts.map

package/dist/types/passkey.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"passkey.d.ts","sourceRoot":"","sources":["../../src/types/passkey.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAMH;;GAEG;AACH,MAAM,MAAM,0BAA0B,GAAG,KAAK,GAAG,KAAK,GAAG,KAAK,GAAG,UAAU,GAAG,QAAQ,CAAA;AAEtF;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,sCAAsC;IACtC,EAAE,EAAE,MAAM,CAAA;IACV,mCAAmC;IACnC,SAAS,EAAE,MAAM,CAAA;IACjB,qDAAqD;IACrD,OAAO,EAAE,MAAM,CAAA;IACf,2DAA2D;IAC3D,UAAU,EAAE,cAAc,GAAG,aAAa,CAAA;IAC1C,uFAAuF;IACvF,QAAQ,EAAE,OAAO,CAAA;IACjB,yCAAyC;IACzC,UAAU,CAAC,EAAE,0BAA0B,EAAE,CAAA;IACzC,8CAA8C;IAC9C,SAAS,EAAE,MAAM,CAAA;IACjB,6CAA6C;IAC7C,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,wDAAwD;IACxD,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,qDAAqD;IACrD,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAMD;;GAEG;AACH,MAAM,WAAW,6BAA6B;IAC5C,2EAA2E;IAC3E,uBAAuB,CAAC,EAAE,UAAU,GAAG,gBAAgB,CAAA;IACvD,iEAAiE;IACjE,WAAW,CAAC,EAAE,UAAU,GAAG,WAAW,GAAG,aAAa,CAAA;IACtD,mCAAmC;IACnC,kBAAkB,CAAC,EAAE,OAAO,CAAA;IAC5B,oCAAoC;IACpC,gBAAgB,CAAC,EAAE,UAAU,GAAG,WAAW,GAAG,aAAa,CAAA;CAC5D;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,gDAAgD;IAChD,OAAO,EAAE,OAAO,CAAA;IAChB,0DAA0D;IAC1D,IAAI,EAAE,MAAM,CAAA;IACZ,wCAAwC;IACxC,MAAM,EAAE,MAAM,CAAA;IACd,8CAA8C;IAC9C,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IACzB,wCAAwC;IACxC,WAAW,CAAC,EAAE,MAAM,GAAG,UAAU,GAAG,QAAQ,GAAG,YAAY,CAAA;IAC3D,uDAAuD;IACvD,gBAAgB,CAAC,EAAE,UAAU,GAAG,WAAW,GAAG,aAAa,CAAA;IAC3D,yDAAyD;IACzD,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,wDAAwD;IACxD,sBAAsB,CAAC,EAAE,6BAA6B,CAAA;CACvD;AAMD;;GAEG;AACH,MAAM,WAAW,2BAA2B;IAC1C,sCAAsC;IACtC,EAAE,EAAE,MAAM,CAAA;IACV,uCAAuC;IACvC,IAAI,EAAE,YAAY,CAAA;IAClB,+BAA+B;IAC/B,UAAU,CAAC,EAAE,0BAA0B,EAAE,CAAA;CAC1C;AAED;;GAEG;AACH,MAAM,WAAW,0BAA0B;IACzC,kCAAkC;IAClC,SAAS,EAAE,MAAM,CAAA;IACjB,yCAAyC;IACzC,SAAS,EAAE,MAAM,CAAA;IACjB,uBAAuB;IACvB,IAAI,EAAE,MAAM,CAAA;IACZ,yBAAyB;IACzB,MAAM,EAAE,MAAM,CAAA;IACd,gCAAgC;IAChC,MAAM,EAAE,MAAM,CAAA;IACd,8BAA8B;IAC9B,QAAQ,EAAE,MAAM,CAAA;IAChB,kCAAkC;IAClC,eAAe,EAAE,MAAM,CAAA;IACvB,kDAAkD;IAClD,kBAAkB,EAAE,2BAA2B,EAAE,CAAA;IACjD,uCAAuC;IACvC,sBAAsB,EAAE,6BAA6B,CAAA;IACrD,wCAAwC;IACxC,WAAW,EAAE,MAAM,GAAG,UAAU,GAAG,QAAQ,GAAG,YAAY,CAAA;IAC1D,8BAA8B;IAC9B,OAAO,EAAE,MAAM,CAAA;CAChB;AAED;;GAEG;AACH,MAAM,WAAW,iCAAiC;IAChD,6CAA6C;IAC7C,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AAED;;GAEG;AACH,MAAM,WAAW,gCAAgC;IAC/C,2CAA2C;IAC3C,SAAS,EAAE,MAAM,CAAA;IACjB,gDAAgD;IAChD,UAAU,EAAE;QACV,EAAE,EAAE,MAAM,CAAA;QACV,KAAK,EAAE,MAAM,CAAA;QACb,IAAI,EAAE,YAAY,CAAA;QAClB,QAAQ,EAAE;YACR,cAAc,EAAE,MAAM,CAAA;YACtB,iBAAiB,EAAE,MAAM,CAAA;YACzB,UAAU,CAAC,EAAE,0BAA0B,EAAE,CAAA;SAC1C,CAAA;QACD,sBAAsB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;QAChD,uBAAuB,CAAC,EAAE,UAAU,GAAG,gBAAgB,CAAA;KACxD,CAAA;IACD,6CAA6C;IAC7C,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AAMD;;GAEG;AACH,MAAM,WAAW,4BAA4B;IAC3C,kCAAkC;IAClC,SAAS,EAAE,MAAM,CAAA;IACjB,yCAAyC;IACzC,SAAS,EAAE,MAAM,CAAA;IACjB,uBAAuB;IACvB,IAAI,EAAE,MAAM,CAAA;IACZ,+DAA+D;IAC/D,gBAAgB,EAAE,2BAA2B,EAAE,CAAA;IAC/C,oCAAoC;IACpC,gBAAgB,EAAE,UAAU,GAAG,WAAW,GAAG,aAAa,CAAA;IAC1D,8BAA8B;IAC9B,OAAO,EAAE,MAAM,CAAA;CAChB;AAED;;GAEG;AACH,MAAM,WAAW,mCAAmC;IAClD,oDAAoD;IACpD,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,kCAAkC;IACjD,6CAA6C;IAC7C,SAAS,EAAE,MAAM,CAAA;IACjB,+CAA+C;IAC/C,UAAU,EAAE;QACV,EAAE,EAAE,MAAM,CAAA;QACV,KAAK,EAAE,MAAM,CAAA;QACb,IAAI,EAAE,YAAY,CAAA;QAClB,QAAQ,EAAE;YACR,cAAc,EAAE,MAAM,CAAA;YACtB,iBAAiB,EAAE,MAAM,CAAA;YACzB,SAAS,EAAE,MAAM,CAAA;YACjB,UAAU,CAAC,EAAE,MAAM,CAAA;SACpB,CAAA;QACD,sBAAsB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;QAChD,uBAAuB,CAAC,EAAE,UAAU,GAAG,gBAAgB,CAAA;KACxD,CAAA;IACD,yCAAyC;IACzC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB;AAMD;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,wBAAwB;IACxB,YAAY,EAAE,MAAM,CAAA;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,6BAA6B;IAC5C,8CAA8C;IAC9C,WAAW,EAAE,IAAI,CAAC,iBAAiB,EAAE,WAAW,CAAC,EAAE,CAAA;CACpD;AAMD;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,iCAAiC;IACjC,SAAS,EAAE,MAAM,CAAA;IACjB,iCAAiC;IACjC,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,uCAAuC;IACvC,cAAc,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IACjC,sCAAsC;IACtC,YAAY,EAAE,MAAM,CAAA;IACpB,mBAAmB;IACnB,IAAI,EAAE,UAAU,GAAG,OAAO,CAAA;IAC1B,uCAAuC;IACvC,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,mCAAmC;IACnC,SAAS,EAAE,MAAM,CAAA;CAClB"}

package/dist/types/passkey.js

@@ -0,0 +1,8 @@
+/**
+ * @trokky/types - Passkey/WebAuthn Types
+ *
+ * Types for passwordless authentication using WebAuthn/Passkeys.
+ * Enables biometric and security key authentication in Trokky Studio.
+ */
+export {};
+//# sourceMappingURL=passkey.js.map

package/dist/types/passkey.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"passkey.js","sourceRoot":"","sources":["../../src/types/passkey.ts"],"names":[],"mappings":"AAAA;;;;;GAKG"}