@babelforce/manager-sdk 0.38.0 → 0.40.0

package/CHANGELOG.md

@@ -3,6 +3,25 @@
 All notable changes to `@babelforce/manager-sdk` are documented here. This project adheres to
 [Semantic Versioning](https://semver.org/).
 
+## 0.40.0
+
+- Added first-class **Authorization Code + PKCE** (RFC 7636) support: a new `refreshToken` auth mode
+  (transparent refresh with refresh-token rotation) plus the helpers `pkceChallenge`,
+  `buildAuthorizeUrl`, `authorizationCodeGrant`, and `refreshTokenGrant`. `clientCredentialsGrant` is
+  now exported too. `TokenResponse` gained an optional `refresh_token`.
+- Consolidated the docs: the OAuth guide is merged into a single **Authentication** guide (overview +
+  one section per flow + when-to-use). Client credentials is documented with a security-review/limited-
+  availability caveat.
+
+## 0.39.0
+
+- Refreshed the vendored manager API spec (richer endpoint descriptions/examples) and regenerated
+  the client. No operations added or removed — coverage stays at 397/397.
+- Schema corrections carried over from the refresh: the routing `number` field is now typed as a
+  phone-number reference (it previously aliased the application schema), agent-outbound telephony
+  settings have their own request-data type, and session-variable bodies are typed as string→value
+  maps.
+
 ## 0.38.0
 
 - **BREAKING:** Removed the `apiKey` auth mode (the `X-Auth-Access-Id` / `X-Auth-Access-Token`

package/README.md

@@ -37,10 +37,14 @@ await mgr.users.enable(["new.user@acme.com"]);
 
 ### Authentication
 
-- `{ kind: "clientCredentials", clientId, clientSecret }` — recommended for server-to-server use;
-  OAuth2 client_credentials grant against `/oauth/token` with transparent refresh.
+- `{ kind: "refreshToken", refreshToken, clientId }` — a refresh token from the Authorization Code +
+  PKCE flow (helpers: `pkceChallenge`, `buildAuthorizeUrl`, `authorizationCodeGrant`); transparent
+  refresh with rotation. Best for apps acting on behalf of a user.
+- `{ kind: "clientCredentials", clientId, clientSecret }` — OAuth2 client_credentials grant with
+  transparent refresh, for server-to-server use (credential issuance is in security review — see the
+  [Authentication guide](https://babelforce.github.io/manager-sdk/guides/authentication)).
 - `{ kind: "bearer", token }` — a token you already hold.
-- `{ kind: "password", user, pass }` — OAuth2 password grant with transparent refresh.
+- `{ kind: "password", user, pass }` — OAuth2 password grant (legacy) with transparent refresh.
 
 ### Errors