chore: mark concurrent PKCE flows as implemented in the compliance matrix

[spydon]

What

The capability-ID sync in #1786 added auth.sign_in.concurrent_pkce_flows to sdk-compliance.yaml with the default not_implemented status. The capability is already implemented, so this marks it implemented and gives it the symbols that describe it.

Why it is already implemented

The canonical capability asks for each PKCE code verifier to live in its own bounded, per-flow slot keyed by a generated flow id, with the code exchange accepting an optional flow id to select the right verifier. That is what PKCEVerifierStore does, landed in #1662 and refactored in #1744:

• Each flow gets its own storage slot, pending ids are tracked in an index entry, and starting another flow past AuthConstants.pkceMaxConcurrentFlows (5) evicts the oldest.
• AuthClient.exchangeCodeForSession takes an optional flowId and validates it before building a storage key.
• AuthClient.appendPkceFlowIdToRedirects and AuthClientOptions.appendPkceFlowIdToRedirects put the id on the callback URL, and getOAuthSignInUrl / getLinkIdentityUrl return it as OAuthResponse.flowId.

Changes

AuthClient.appendPkceFlowIdToRedirects, AuthClientOptions.appendPkceFlowIdToRedirects and OAuthResponse.flowId move from auth.sign_in.exchange_code_for_session to the new capability, which is where they belong now that it exists. exchange_code_for_session keeps AuthClient.exchangeCodeForSession.

No note is added, since the implementation matches expected parity.

Verification

The supabase/sdk compliance tooling was run locally against this branch:

validate-compliance  OK — compliance file is valid.
check-api-symbols    All new public API symbols are covered in the capability matrix.
check-drift          No capability matrix drift detected.

Summary by CodeRabbit

• New Features
  • Added support for handling multiple concurrent PKCE authentication flows.
• Bug Fixes
  • Updated sign-in capability reporting to accurately associate PKCE flow support with concurrent authentication flows.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 8c2cdf3f-956e-4fc0-9bb6-c50df329eb09

📥 Commits

Reviewing files that changed from the base of the PR and between 1172e96 and e799d10.

📒 Files selected for processing (1)

• sdk-compliance.yaml

Included review availability: Your plan provides up to 4 included reviews per hour; 3 remain after this review.

---

📝 Walkthrough

Walkthrough

Changes

PKCE compliance declarations

Layer / File(s)	Summary
Declare concurrent PKCE support sdk-compliance.yaml	The auth.sign_in.concurrent_pkce_flows capability changes to implemented and lists the related PKCE symbols.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Merge Risk: ⚪ Minimal · up to e799d

This localized compliance-matrix update records an already implemented PKCE capability and moves its related symbols to the correct entry; no actionable merge-blocking risk remains after normal checks and review.

Suggested reviewers: dshukertjr, vinzent03

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the primary change: marking concurrent PKCE flows as implemented in the compliance matrix.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch session/dashing-siskin-s1vq

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}