@avallon-labs/sdk 33.1.0-staging.853 → 34.0.0

package/dist/index.d.ts

@@ -2935,11 +2935,15 @@ declare const GetOAuthUrlProvider: {
 type GetOAuthUrlParams = {
     provider: GetOAuthUrlProvider;
     redirect_uri: string;
-    code_challenge_method: GetOAuthUrlCodeChallengeMethod;
     /**
+     * How code_challenge was derived. Required whenever code_challenge is sent.
+     */
+    code_challenge_method?: GetOAuthUrlCodeChallengeMethod;
+    /**
+     * PKCE challenge derived from a verifier you keep until sign-in. Omit, together with code_challenge_method, to run the flow without PKCE.
      * @minLength 1
      */
-    code_challenge: string;
+    code_challenge?: string;
     email?: string;
 };
 
@@ -4860,8 +4864,13 @@ type SignInBody = {
     password: string;
 } | {
     type: "oauth";
+    /** @minLength 1 */
     code: string;
-    verifier: string;
+    /**
+     * PKCE verifier. Required only when the flow was started with a code_challenge.
+     * @minLength 1
+     */
+    verifier?: string;
     provider?: "google" | "microsoft" | "sso";
 } | {
     type: "email_otp";
@@ -6519,7 +6528,7 @@ declare const useSignUp: <TError = ErrorType<ErrorResponse>>(options?: {
  * Authenticate using one of the supported methods:
 
 - **Password:** Email and password credentials. If the password is correct but the email is not verified yet, responds 403 with `data.pending_authentication_token` and a fresh verification code is emailed; complete verification via **Email OTP**. Each password attempt invalidates earlier codes and tokens, so always use the most recent pair — repeating the password sign-in is also how a new code is requested.
-- **OAuth:** Authorization code from OAuth flow (social or enterprise SSO). Pass the `provider` the flow was started with so the code is exchanged against the system that issued it.
+- **OAuth:** Authorization code from OAuth flow (social or enterprise SSO). Pass the `provider` the flow was started with so the code is exchanged against the system that issued it. `verifier` is only required when the flow was started with a `code_challenge` — see **Get OAuth sign-in URL**.
 - **Email OTP:** One-time password sent to email. Include the `pending_authentication_token` from sign-up, or from the 403 returned by an unverified user's password sign-in, when completing email verification.
  * @summary Sign in
  */
@@ -6574,7 +6583,9 @@ declare const useRefreshToken: <TError = ErrorType<ErrorResponse>>(options?: {
     swrKey: string | readonly ["/v1/auth/refresh-token"];
 };
 /**
- * Generate an OAuth authorization URL for a given provider. Use with PKCE flow.
+ * Generate an OAuth authorization URL for a given provider.
+
+PKCE is optional. To use it, generate a random verifier, derive `code_challenge` from it, and pass both `code_challenge` and the matching `code_challenge_method` — then send the verifier to **Sign in** when exchanging the code. Omit both to run the flow without PKCE and exchange the code on its own. `provider=microsoft` is PKCE-only: it responds 400 without a challenge.
 
 For enterprise SSO, pass `provider=sso` together with the user's `email`; the email domain selects the SSO organization. Responds 404 when no SSO organization is configured for the domain.
  * @summary Get OAuth sign-in URL