# Transcodes AI Integration Guide

> Passkey-first authentication SaaS. CDN SDK (`webworker.js`), Transcodes Auth (hosted redirects), transcodes-guard (AI agent gate), Console. Full implementation reference: [llms-full.txt](./llms-full.txt).

This file is the short link index. Every item below points into [llms-full.txt](./llms-full.txt) — fetch that file once, then search for the bracketed heading text to locate the section.

## Agent Directives

- [CRITICAL AGENT DIRECTIVES](./llms-full.txt): CDN default (`<script defer>`), no `init()`, `transcodes.d.ts`, CSR vs SSR, MCP runtime boundary, placeholder resolution.
- [Placeholder Resolution Policy](./llms-full.txt): `RESOLVED_*` values are required inputs before final code.
- [[Index & Tags]](./llms-full.txt): Keyword → API mapping.

## AI Agent (transcodes-guard)

- [AI Agent setup](./llms-full.txt): MAT token, transcodes-guard install, `@bigstrider/transcodes-cli`, deny → MFA → `poll_stepup_session_wait` loop.
- [Governance](./llms-full.txt): RBAC, Audit (`guard_gate_decision`), Webhook — see Common docs in site map.
- Docs: https://www.transcodes.io/docs/ai-agent

## Optional PWA Setup (CDN static)

- [PWA — manifest + sw.js](./llms-full.txt): only when installable Web App Kit is required. Auth-only needs `<script defer>` only.

## Section 2 — Admin Authentication (SDK)

- [Integration Methods (CDN-first)](./llms-full.txt): `<script src="…/webworker.js" defer>`, no `init()`.
- [1. Hosted sign-in — redirectToSignIn + handleSignInCallback](./llms-full.txt): Transcodes Auth redirect; `void` return; `AUTH_CANCELLED` when no `?sid=`.
- [2. redirectToConsole (Hosted Member Console)](./llms-full.txt): Self-service passkey / TOTP.
- [3. redirectToStepUp (Hosted Step-up MFA)](./llms-full.txt): RBAC + resource/action; always `await`.
- [4. Token API](./llms-full.txt): `getCurrentMember` → `GetCurrentMemberResult`, `getAccessToken`, `signOut`.
- [5. Member API](./llms-full.txt): `getMember`.
- [6. Events API](./llms-full.txt): `AUTH_STATE_CHANGED`, `TOKEN_EXPIRED`, `MEMBER_REVOKED`.
- [7. trackUserAction (Audit Logs)](./llms-full.txt): SDK audit + transcodes-guard auto-logging.

## Type Definitions & Patterns

- [Type Definitions](./llms-full.txt): Redirect return types (`void` vs `Promise`), `GetCurrentMemberResult`.
- [Framework setup](./llms-full.txt): React, Next.js, Vue — CDN static, native `<script defer>`.
- [CDN TypeScript setup — MANDATORY](./llms-full.txt): Fetch `transcodes.d.ts` from `/instructions/types`.
- [Step-up MFA example](./llms-full.txt): Sensitive-action pattern with `redirectToStepUp`.

## Server & Infrastructure

- [Server-side JWT verification](./llms-full.txt): `public_key.json`, ES256.
- [CSP](./llms-full.txt): Minimal allow-list.
- [Hosted WebAuthn and Redirect Origins](./llms-full.txt): WebAuthn on Transcodes Auth; `related_origins` for callback allow-list.

## Reference

- [Release Checklist](./llms-full.txt)
- [[Agent Rule — .transcodes Integration Record]](./llms-full.txt)
- [Documentation Site Map](./llms-full.txt): Current docs at `/docs/get-started`, `/docs/common/*`, `/docs/ai-agent`, `/docs/admin/*`.

## Troubleshooting

- [PWA / sw.js](./llms-full.txt): 404, install prompt, manifest.
- [SDK loading (CDN static)](./llms-full.txt): `window.transcodes` undefined, wrong script attributes, `init()` conflict.
- [Hosted auth redirects](./llms-full.txt): `void` redirects, step-up `success` checks.
- [JWT / server-side](./llms-full.txt): ES256, `getAccessToken` null.
- [RBAC](./llms-full.txt): Console + MCP resource/action keys.
- [Hosted WebAuthn / Redirect Origins](./llms-full.txt): Secondary origin callback failures.