@snokam/platform-client 3.0.0 → 3.1.0

package/CHANGELOG.md

@@ -3,6 +3,17 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# [3.1.0](https://github.com/GIT_USER_ID/GIT_REPO_ID/compare/@snokam/platform-client@3.0.0...@snokam/platform-client@3.1.0) (2026-10-02)
+
+
+### Features
+
+* **auth:** let MCP clients sign in through the Snøsky login ([#2542](https://github.com/GIT_USER_ID/GIT_REPO_ID/issues/2542)) ([5ea6750](https://github.com/GIT_USER_ID/GIT_REPO_ID/commit/5ea67501bde43d999d518e41f98611af2536ff23))
+
+
+
+
+
 # [3.0.0](https://github.com/GIT_USER_ID/GIT_REPO_ID/compare/@snokam/platform-client@2.0.0...@snokam/platform-client@3.0.0) (2026-10-01)
 
 

package/README.md

@@ -1,4 +1,4 @@
-# @snokam/platform-client@1.0.0
+# @snokam/platform-client@3.0.0
 
 A TypeScript SDK client for the snokam.snosky.no API.
 
@@ -58,6 +58,7 @@ All URIs are relative to *https://snokam.snosky.no/api/platform*
 | ----- | ------ | ------------ | -------------
 *PlatformClient* | [**addCustomDomain**](docs/PlatformClient.md#addcustomdomainoperation) | **POST** /v1.0/protected/businesses/{id}/custom-domains | Add a custom domain
 *PlatformClient* | [**approveDevice**](docs/PlatformClient.md#approvedeviceoperation) | **POST** /v1.0/protected/businesses/{id}/devices | Approve a screen into this business
+*PlatformClient* | [**approveOAuthAuthorization**](docs/PlatformClient.md#approveoauthauthorization) | **POST** /v1.0/protected/oauth/authorization | Approve an authorization request as the signed-in user
 *PlatformClient* | [**assignBusinessEmployeeSystem**](docs/PlatformClient.md#assignbusinessemployeesystem) | **POST** /v1.0/protected/businesses/{id}/employees/{upn}/systems/{systemKey} | Grant an employee a seat in a third-party system
 *PlatformClient* | [**backfillBridgeWebhook**](docs/PlatformClient.md#backfillbridgewebhook) | **POST** /v1.0/protected/businesses/{id}/bridge-webhook | Re-create a business\'s Sanity bridge webhook with a managed API key
 *PlatformClient* | [**checkIntegration**](docs/PlatformClient.md#checkintegration) | **POST** /v1.0/protected/businesses/{id}/integrations/{key}/check | Run a live integration connectivity check
@@ -148,6 +149,7 @@ All URIs are relative to *https://snokam.snosky.no/api/platform*
 *PlatformClient* | [**powerOfficeOnboardingReturn**](docs/PlatformClient.md#powerofficeonboardingreturn) | **GET** /v1.0/connect/poweroffice/return/{reference} | PowerOffice onboarding return
 *PlatformClient* | [**previewBillingInvoice**](docs/PlatformClient.md#previewbillinginvoice) | **POST** /v1.0/protected/businesses/{id}/billing/invoice-preview | Preview a month\'s invoice basis
 *PlatformClient* | [**previewDevice**](docs/PlatformClient.md#previewdevice) | **GET** /v1.0/protected/businesses/{id}/devices/preview | Look up a pairing code before approving
+*PlatformClient* | [**previewOAuthAuthorization**](docs/PlatformClient.md#previewoauthauthorization) | **POST** /v1.0/protected/oauth/authorization/preview | Describe an authorization request before the user approves it
 *PlatformClient* | [**provisionBusiness**](docs/PlatformClient.md#provisionbusiness) | **POST** /v1.0/protected/businesses/{id}/provision | Provision a business
 *PlatformClient* | [**publicCapabilities**](docs/PlatformClient.md#publiccapabilities) | **GET** /v1.0/public/capabilities | Get capabilities
 *PlatformClient* | [**publicModules**](docs/PlatformClient.md#publicmodules) | **GET** /v1.0/public/modules | Get available modules
@@ -200,6 +202,8 @@ All URIs are relative to *https://snokam.snosky.no/api/platform*
 - [AppCatalogEntry](docs/AppCatalogEntry.md)
 - [AppModule](docs/AppModule.md)
 - [ApproveDeviceRequest](docs/ApproveDeviceRequest.md)
+- [AuthorizationPreview](docs/AuthorizationPreview.md)
+- [AuthorizationRequest](docs/AuthorizationRequest.md)
 - [BillingPaymentMethod](docs/BillingPaymentMethod.md)
 - [BillingSessionRequest](docs/BillingSessionRequest.md)
 - [BillingSessionResponse](docs/BillingSessionResponse.md)
@@ -254,6 +258,7 @@ All URIs are relative to *https://snokam.snosky.no/api/platform*
 - [InviteCredentialRequest](docs/InviteCredentialRequest.md)
 - [InvoiceBasis](docs/InvoiceBasis.md)
 - [InvoiceBasisLine](docs/InvoiceBasisLine.md)
+- [IssuedAuthorizationCode](docs/IssuedAuthorizationCode.md)
 - [LoginConfig](docs/LoginConfig.md)
 - [MeApp](docs/MeApp.md)
 - [MeterEnforcementDecision](docs/MeterEnforcementDecision.md)
@@ -384,7 +389,7 @@ and is automatically generated by the
 [OpenAPI Generator](https://openapi-generator.tech) project:
 
 - API version: `v1.0.0`
-- Package version: `1.0.0`
+- Package version: `3.0.0`
 - Generator version: `7.23.0`
 - Build package: `org.openapitools.codegen.languages.TypeScriptFetchClientCodegen`
 

package/dist/apis/PlatformClient.d.ts

@@ -10,7 +10,7 @@
  * Do not edit the class manually.
  */
 import * as runtime from '../runtime';
-import type { ActivateRequest, ActivateResult, AddCustomDomainRequest, ApiTokenSummary, ApiTokenVerifyResult, AppCatalogEntry, AppModule, ApproveDeviceRequest, BillingPaymentMethod, BillingSessionRequest, BillingSessionResponse, BridgeWebhookResult, Business, BusinessAccess, BusinessHealth, Capability, ChooseProviderRequest, CreateApiTokenRequest, CreateUserRequest, CreatedApiToken, CredentialSummary, CustomDomainProvisioning, DevicePairRequestBody, DevicePairing, DevicePairingStatus, DevicePollRequestBody, DeviceScreen, DirectoryGroupsResponse, DirectoryLicensesResponse, DirectoryMailbox, DirectoryServicePrincipalsResponse, EmployeeSettings, EmployeeSystemAccess, EmployeeSystemConfig, FacebookAccount, GitHubRepo, GoogleAnalyticsProperty, GoogleAnalyticsSelection, ImpersonationHistoryEntry, IntegrationCheckResult, IntegrationSummary, InviteCredentialRequest, InvoiceBasis, LoginConfig, MeApp, MeterEnforcementDecision, OAuthAccessTokenResponse, OAuthStartResponse, OlafApiKeyResponse, OlafTeamsSettings, OnboardBusinessRequest, OnboardingConfig, OnboardingStatus, PasswordLoginRequest, PasswordLoginResult, PatchBusinessRequest, PatchEmployee, PendingDevicePreview, PlanInfo, PlatformIntegration, PlatformSanityConfig, PlatformSecretStatus, PowerOfficeConnectResponse, PowerOfficeProduct, PowerOfficeProductsResponse, PowerOfficeProject, PowerOfficeProjectsResponse, ProtectedEmployee, ProviderCatalogResponse, RecordImpersonationActivityRequest, RenameDeviceRequest, ResetConfirmRequest, ResetRequest, RevokeRequest, ScopeDefinition, SessionBootstrapRequest, SetFacebookAccountRequest, SetGoogleAnalyticsPropertyRequest, SetPlatformSecretRequest, SetScopeGrantsRequest, SetWorkReposRequest, SetWorkspaceRepoRequest, SignupConfig, SignupRequest, SignupResult, SsoExchangeRequest, StartImpersonationRequest, StartImpersonationResult, StudioSanityConfig, TeamsAcsTokenResponse, TeamsAuthStateResponse, TenantInfo, TenantSanityCredentials, TokenExchangeRequest, TokenExchangeResult, TokenReconciliationReport, TotpEnrollRequest, TotpEnrollResult, UpdateAppsRequest, UpdateSecretsRequest, UsageDailySeries, UsageEventsRequest, UsageRollup, UsageSummary, VerifyApiTokenRequest, WorkReposSelection, WorkspaceRepoSelection } from '../models/index';
+import type { ActivateRequest, ActivateResult, AddCustomDomainRequest, ApiTokenSummary, ApiTokenVerifyResult, AppCatalogEntry, AppModule, ApproveDeviceRequest, AuthorizationPreview, AuthorizationRequest, BillingPaymentMethod, BillingSessionRequest, BillingSessionResponse, BridgeWebhookResult, Business, BusinessAccess, BusinessHealth, Capability, ChooseProviderRequest, CreateApiTokenRequest, CreateUserRequest, CreatedApiToken, CredentialSummary, CustomDomainProvisioning, DevicePairRequestBody, DevicePairing, DevicePairingStatus, DevicePollRequestBody, DeviceScreen, DirectoryGroupsResponse, DirectoryLicensesResponse, DirectoryMailbox, DirectoryServicePrincipalsResponse, EmployeeSettings, EmployeeSystemAccess, EmployeeSystemConfig, FacebookAccount, GitHubRepo, GoogleAnalyticsProperty, GoogleAnalyticsSelection, ImpersonationHistoryEntry, IntegrationCheckResult, IntegrationSummary, InviteCredentialRequest, InvoiceBasis, IssuedAuthorizationCode, LoginConfig, MeApp, MeterEnforcementDecision, OAuthAccessTokenResponse, OAuthStartResponse, OlafApiKeyResponse, OlafTeamsSettings, OnboardBusinessRequest, OnboardingConfig, OnboardingStatus, PasswordLoginRequest, PasswordLoginResult, PatchBusinessRequest, PatchEmployee, PendingDevicePreview, PlanInfo, PlatformIntegration, PlatformSanityConfig, PlatformSecretStatus, PowerOfficeConnectResponse, PowerOfficeProduct, PowerOfficeProductsResponse, PowerOfficeProject, PowerOfficeProjectsResponse, ProtectedEmployee, ProviderCatalogResponse, RecordImpersonationActivityRequest, RenameDeviceRequest, ResetConfirmRequest, ResetRequest, RevokeRequest, ScopeDefinition, SessionBootstrapRequest, SetFacebookAccountRequest, SetGoogleAnalyticsPropertyRequest, SetPlatformSecretRequest, SetScopeGrantsRequest, SetWorkReposRequest, SetWorkspaceRepoRequest, SignupConfig, SignupRequest, SignupResult, SsoExchangeRequest, StartImpersonationRequest, StartImpersonationResult, StudioSanityConfig, TeamsAcsTokenResponse, TeamsAuthStateResponse, TenantInfo, TenantSanityCredentials, TokenExchangeRequest, TokenExchangeResult, TokenReconciliationReport, TotpEnrollRequest, TotpEnrollResult, UpdateAppsRequest, UpdateSecretsRequest, UsageDailySeries, UsageEventsRequest, UsageRollup, UsageSummary, VerifyApiTokenRequest, WorkReposSelection, WorkspaceRepoSelection } from '../models/index';
 export interface AddCustomDomainOperationRequest {
     id: string;
     addCustomDomainRequest: AddCustomDomainRequest;
@@ -19,6 +19,9 @@ export interface ApproveDeviceOperationRequest {
     id: string;
     approveDeviceRequest: ApproveDeviceRequest;
 }
+export interface ApproveOAuthAuthorizationRequest {
+    authorizationRequest: AuthorizationRequest;
+}
 export interface AssignBusinessEmployeeSystemRequest {
     id: string;
     upn: string;
@@ -266,6 +269,9 @@ export interface PreviewDeviceRequest {
     id: string;
     code: string;
 }
+export interface PreviewOAuthAuthorizationRequest {
+    authorizationRequest: AuthorizationRequest;
+}
 export interface ProvisionBusinessRequest {
     id: string;
 }
@@ -429,6 +435,20 @@ export declare class PlatformClient extends runtime.BaseAPI {
      * Approve a screen into this business
      */
     approveDevice(requestParameters: ApproveDeviceOperationRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<DeviceScreen>;
+    /**
+     * Creates request options for approveOAuthAuthorization without sending the request
+     */
+    approveOAuthAuthorizationRequestOpts(requestParameters: ApproveOAuthAuthorizationRequest): Promise<runtime.RequestOpts>;
+    /**
+     * Issues a single-use authorization code the client redeems at the token endpoint.
+     * Approve an authorization request as the signed-in user
+     */
+    approveOAuthAuthorizationRaw(requestParameters: ApproveOAuthAuthorizationRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<IssuedAuthorizationCode>>;
+    /**
+     * Issues a single-use authorization code the client redeems at the token endpoint.
+     * Approve an authorization request as the signed-in user
+     */
+    approveOAuthAuthorization(requestParameters: ApproveOAuthAuthorizationRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<IssuedAuthorizationCode>;
     /**
      * Creates request options for assignBusinessEmployeeSystem without sending the request
      */
@@ -1685,6 +1705,20 @@ export declare class PlatformClient extends runtime.BaseAPI {
      * Look up a pairing code before approving
      */
     previewDevice(requestParameters: PreviewDeviceRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<PendingDevicePreview>;
+    /**
+     * Creates request options for previewOAuthAuthorization without sending the request
+     */
+    previewOAuthAuthorizationRequestOpts(requestParameters: PreviewOAuthAuthorizationRequest): Promise<runtime.RequestOpts>;
+    /**
+     * Validates the client, redirect URI and resource for the signed-in user and names the client.
+     * Describe an authorization request before the user approves it
+     */
+    previewOAuthAuthorizationRaw(requestParameters: PreviewOAuthAuthorizationRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<AuthorizationPreview>>;
+    /**
+     * Validates the client, redirect URI and resource for the signed-in user and names the client.
+     * Describe an authorization request before the user approves it
+     */
+    previewOAuthAuthorization(requestParameters: PreviewOAuthAuthorizationRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<AuthorizationPreview>;
     /**
      * Creates request options for provisionBusiness without sending the request
      */
@@ -1814,12 +1848,12 @@ export declare class PlatformClient extends runtime.BaseAPI {
      */
     resolvePlatformSanityConfigRequestOpts(): Promise<runtime.RequestOpts>;
     /**
-     * Returns the shared platform Sanity project, dataset, studio URL and read token used as the content fallback layer for every tenant. All four values live in platform Key Vault (editable in platform-web), so nothing Sanity-related is baked onto frontends. This is a render-path config endpoint, so it accepts any principal from the platform Entra tenant — the platform managed identity in production, or a Snøkam developer\'s az session locally — with no operator role required.
+     * Returns the shared platform Sanity project, dataset, studio URL and read token used as the content fallback layer for every tenant. All four values live in platform Key Vault (editable in platform-web), so nothing Sanity-related is baked onto frontends. The answer is cached in-process for five minutes and served stale if Key Vault is briefly unreachable. This is a render-path config endpoint, so it accepts any principal from the platform Entra tenant — the platform managed identity in production, or a Snøkam developer\'s az session locally — with no operator role required.
      * Resolve the platform Sanity read config
      */
     resolvePlatformSanityConfigRaw(initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<PlatformSanityConfig>>;
     /**
-     * Returns the shared platform Sanity project, dataset, studio URL and read token used as the content fallback layer for every tenant. All four values live in platform Key Vault (editable in platform-web), so nothing Sanity-related is baked onto frontends. This is a render-path config endpoint, so it accepts any principal from the platform Entra tenant — the platform managed identity in production, or a Snøkam developer\'s az session locally — with no operator role required.
+     * Returns the shared platform Sanity project, dataset, studio URL and read token used as the content fallback layer for every tenant. All four values live in platform Key Vault (editable in platform-web), so nothing Sanity-related is baked onto frontends. The answer is cached in-process for five minutes and served stale if Key Vault is briefly unreachable. This is a render-path config endpoint, so it accepts any principal from the platform Entra tenant — the platform managed identity in production, or a Snøkam developer\'s az session locally — with no operator role required.
      * Resolve the platform Sanity read config
      */
     resolvePlatformSanityConfig(initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<PlatformSanityConfig>;

package/dist/apis/PlatformClient.js

@@ -128,6 +128,52 @@ class PlatformClient extends runtime.BaseAPI {
             return yield response.value();
         });
     }
+    /**
+     * Creates request options for approveOAuthAuthorization without sending the request
+     */
+    approveOAuthAuthorizationRequestOpts(requestParameters) {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (requestParameters['authorizationRequest'] == null) {
+                throw new runtime.RequiredError('authorizationRequest', 'Required parameter "authorizationRequest" was null or undefined when calling approveOAuthAuthorization().');
+            }
+            const queryParameters = {};
+            const headerParameters = {};
+            headerParameters['Content-Type'] = 'application/json';
+            if (this.configuration && this.configuration.accessToken) {
+                // oauth required
+                headerParameters["Authorization"] = yield this.configuration.accessToken("Implicit", []);
+            }
+            let urlPath = `/v1.0/protected/oauth/authorization`;
+            return {
+                path: urlPath,
+                method: 'POST',
+                headers: headerParameters,
+                query: queryParameters,
+                body: requestParameters['authorizationRequest'],
+            };
+        });
+    }
+    /**
+     * Issues a single-use authorization code the client redeems at the token endpoint.
+     * Approve an authorization request as the signed-in user
+     */
+    approveOAuthAuthorizationRaw(requestParameters, initOverrides) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const requestOptions = yield this.approveOAuthAuthorizationRequestOpts(requestParameters);
+            const response = yield this.request(requestOptions, initOverrides);
+            return new runtime.JSONApiResponse(response);
+        });
+    }
+    /**
+     * Issues a single-use authorization code the client redeems at the token endpoint.
+     * Approve an authorization request as the signed-in user
+     */
+    approveOAuthAuthorization(requestParameters, initOverrides) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const response = yield this.approveOAuthAuthorizationRaw(requestParameters, initOverrides);
+            return yield response.value();
+        });
+    }
     /**
      * Creates request options for assignBusinessEmployeeSystem without sending the request
      */
@@ -4167,6 +4213,52 @@ class PlatformClient extends runtime.BaseAPI {
             return yield response.value();
         });
     }
+    /**
+     * Creates request options for previewOAuthAuthorization without sending the request
+     */
+    previewOAuthAuthorizationRequestOpts(requestParameters) {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (requestParameters['authorizationRequest'] == null) {
+                throw new runtime.RequiredError('authorizationRequest', 'Required parameter "authorizationRequest" was null or undefined when calling previewOAuthAuthorization().');
+            }
+            const queryParameters = {};
+            const headerParameters = {};
+            headerParameters['Content-Type'] = 'application/json';
+            if (this.configuration && this.configuration.accessToken) {
+                // oauth required
+                headerParameters["Authorization"] = yield this.configuration.accessToken("Implicit", []);
+            }
+            let urlPath = `/v1.0/protected/oauth/authorization/preview`;
+            return {
+                path: urlPath,
+                method: 'POST',
+                headers: headerParameters,
+                query: queryParameters,
+                body: requestParameters['authorizationRequest'],
+            };
+        });
+    }
+    /**
+     * Validates the client, redirect URI and resource for the signed-in user and names the client.
+     * Describe an authorization request before the user approves it
+     */
+    previewOAuthAuthorizationRaw(requestParameters, initOverrides) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const requestOptions = yield this.previewOAuthAuthorizationRequestOpts(requestParameters);
+            const response = yield this.request(requestOptions, initOverrides);
+            return new runtime.JSONApiResponse(response);
+        });
+    }
+    /**
+     * Validates the client, redirect URI and resource for the signed-in user and names the client.
+     * Describe an authorization request before the user approves it
+     */
+    previewOAuthAuthorization(requestParameters, initOverrides) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const response = yield this.previewOAuthAuthorizationRaw(requestParameters, initOverrides);
+            return yield response.value();
+        });
+    }
     /**
      * Creates request options for provisionBusiness without sending the request
      */
@@ -4575,7 +4667,7 @@ class PlatformClient extends runtime.BaseAPI {
         });
     }
     /**
-     * Returns the shared platform Sanity project, dataset, studio URL and read token used as the content fallback layer for every tenant. All four values live in platform Key Vault (editable in platform-web), so nothing Sanity-related is baked onto frontends. This is a render-path config endpoint, so it accepts any principal from the platform Entra tenant — the platform managed identity in production, or a Snøkam developer\'s az session locally — with no operator role required.
+     * Returns the shared platform Sanity project, dataset, studio URL and read token used as the content fallback layer for every tenant. All four values live in platform Key Vault (editable in platform-web), so nothing Sanity-related is baked onto frontends. The answer is cached in-process for five minutes and served stale if Key Vault is briefly unreachable. This is a render-path config endpoint, so it accepts any principal from the platform Entra tenant — the platform managed identity in production, or a Snøkam developer\'s az session locally — with no operator role required.
      * Resolve the platform Sanity read config
      */
     resolvePlatformSanityConfigRaw(initOverrides) {
@@ -4586,7 +4678,7 @@ class PlatformClient extends runtime.BaseAPI {
         });
     }
     /**
-     * Returns the shared platform Sanity project, dataset, studio URL and read token used as the content fallback layer for every tenant. All four values live in platform Key Vault (editable in platform-web), so nothing Sanity-related is baked onto frontends. This is a render-path config endpoint, so it accepts any principal from the platform Entra tenant — the platform managed identity in production, or a Snøkam developer\'s az session locally — with no operator role required.
+     * Returns the shared platform Sanity project, dataset, studio URL and read token used as the content fallback layer for every tenant. All four values live in platform Key Vault (editable in platform-web), so nothing Sanity-related is baked onto frontends. The answer is cached in-process for five minutes and served stale if Key Vault is briefly unreachable. This is a render-path config endpoint, so it accepts any principal from the platform Entra tenant — the platform managed identity in production, or a Snøkam developer\'s az session locally — with no operator role required.
      * Resolve the platform Sanity read config
      */
     resolvePlatformSanityConfig(initOverrides) {

package/dist/esm/apis/PlatformClient.d.ts

@@ -10,7 +10,7 @@
  * Do not edit the class manually.
  */
 import * as runtime from '../runtime';
-import type { ActivateRequest, ActivateResult, AddCustomDomainRequest, ApiTokenSummary, ApiTokenVerifyResult, AppCatalogEntry, AppModule, ApproveDeviceRequest, BillingPaymentMethod, BillingSessionRequest, BillingSessionResponse, BridgeWebhookResult, Business, BusinessAccess, BusinessHealth, Capability, ChooseProviderRequest, CreateApiTokenRequest, CreateUserRequest, CreatedApiToken, CredentialSummary, CustomDomainProvisioning, DevicePairRequestBody, DevicePairing, DevicePairingStatus, DevicePollRequestBody, DeviceScreen, DirectoryGroupsResponse, DirectoryLicensesResponse, DirectoryMailbox, DirectoryServicePrincipalsResponse, EmployeeSettings, EmployeeSystemAccess, EmployeeSystemConfig, FacebookAccount, GitHubRepo, GoogleAnalyticsProperty, GoogleAnalyticsSelection, ImpersonationHistoryEntry, IntegrationCheckResult, IntegrationSummary, InviteCredentialRequest, InvoiceBasis, LoginConfig, MeApp, MeterEnforcementDecision, OAuthAccessTokenResponse, OAuthStartResponse, OlafApiKeyResponse, OlafTeamsSettings, OnboardBusinessRequest, OnboardingConfig, OnboardingStatus, PasswordLoginRequest, PasswordLoginResult, PatchBusinessRequest, PatchEmployee, PendingDevicePreview, PlanInfo, PlatformIntegration, PlatformSanityConfig, PlatformSecretStatus, PowerOfficeConnectResponse, PowerOfficeProduct, PowerOfficeProductsResponse, PowerOfficeProject, PowerOfficeProjectsResponse, ProtectedEmployee, ProviderCatalogResponse, RecordImpersonationActivityRequest, RenameDeviceRequest, ResetConfirmRequest, ResetRequest, RevokeRequest, ScopeDefinition, SessionBootstrapRequest, SetFacebookAccountRequest, SetGoogleAnalyticsPropertyRequest, SetPlatformSecretRequest, SetScopeGrantsRequest, SetWorkReposRequest, SetWorkspaceRepoRequest, SignupConfig, SignupRequest, SignupResult, SsoExchangeRequest, StartImpersonationRequest, StartImpersonationResult, StudioSanityConfig, TeamsAcsTokenResponse, TeamsAuthStateResponse, TenantInfo, TenantSanityCredentials, TokenExchangeRequest, TokenExchangeResult, TokenReconciliationReport, TotpEnrollRequest, TotpEnrollResult, UpdateAppsRequest, UpdateSecretsRequest, UsageDailySeries, UsageEventsRequest, UsageRollup, UsageSummary, VerifyApiTokenRequest, WorkReposSelection, WorkspaceRepoSelection } from '../models/index';
+import type { ActivateRequest, ActivateResult, AddCustomDomainRequest, ApiTokenSummary, ApiTokenVerifyResult, AppCatalogEntry, AppModule, ApproveDeviceRequest, AuthorizationPreview, AuthorizationRequest, BillingPaymentMethod, BillingSessionRequest, BillingSessionResponse, BridgeWebhookResult, Business, BusinessAccess, BusinessHealth, Capability, ChooseProviderRequest, CreateApiTokenRequest, CreateUserRequest, CreatedApiToken, CredentialSummary, CustomDomainProvisioning, DevicePairRequestBody, DevicePairing, DevicePairingStatus, DevicePollRequestBody, DeviceScreen, DirectoryGroupsResponse, DirectoryLicensesResponse, DirectoryMailbox, DirectoryServicePrincipalsResponse, EmployeeSettings, EmployeeSystemAccess, EmployeeSystemConfig, FacebookAccount, GitHubRepo, GoogleAnalyticsProperty, GoogleAnalyticsSelection, ImpersonationHistoryEntry, IntegrationCheckResult, IntegrationSummary, InviteCredentialRequest, InvoiceBasis, IssuedAuthorizationCode, LoginConfig, MeApp, MeterEnforcementDecision, OAuthAccessTokenResponse, OAuthStartResponse, OlafApiKeyResponse, OlafTeamsSettings, OnboardBusinessRequest, OnboardingConfig, OnboardingStatus, PasswordLoginRequest, PasswordLoginResult, PatchBusinessRequest, PatchEmployee, PendingDevicePreview, PlanInfo, PlatformIntegration, PlatformSanityConfig, PlatformSecretStatus, PowerOfficeConnectResponse, PowerOfficeProduct, PowerOfficeProductsResponse, PowerOfficeProject, PowerOfficeProjectsResponse, ProtectedEmployee, ProviderCatalogResponse, RecordImpersonationActivityRequest, RenameDeviceRequest, ResetConfirmRequest, ResetRequest, RevokeRequest, ScopeDefinition, SessionBootstrapRequest, SetFacebookAccountRequest, SetGoogleAnalyticsPropertyRequest, SetPlatformSecretRequest, SetScopeGrantsRequest, SetWorkReposRequest, SetWorkspaceRepoRequest, SignupConfig, SignupRequest, SignupResult, SsoExchangeRequest, StartImpersonationRequest, StartImpersonationResult, StudioSanityConfig, TeamsAcsTokenResponse, TeamsAuthStateResponse, TenantInfo, TenantSanityCredentials, TokenExchangeRequest, TokenExchangeResult, TokenReconciliationReport, TotpEnrollRequest, TotpEnrollResult, UpdateAppsRequest, UpdateSecretsRequest, UsageDailySeries, UsageEventsRequest, UsageRollup, UsageSummary, VerifyApiTokenRequest, WorkReposSelection, WorkspaceRepoSelection } from '../models/index';
 export interface AddCustomDomainOperationRequest {
     id: string;
     addCustomDomainRequest: AddCustomDomainRequest;
@@ -19,6 +19,9 @@ export interface ApproveDeviceOperationRequest {
     id: string;
     approveDeviceRequest: ApproveDeviceRequest;
 }
+export interface ApproveOAuthAuthorizationRequest {
+    authorizationRequest: AuthorizationRequest;
+}
 export interface AssignBusinessEmployeeSystemRequest {
     id: string;
     upn: string;
@@ -266,6 +269,9 @@ export interface PreviewDeviceRequest {
     id: string;
     code: string;
 }
+export interface PreviewOAuthAuthorizationRequest {
+    authorizationRequest: AuthorizationRequest;
+}
 export interface ProvisionBusinessRequest {
     id: string;
 }
@@ -429,6 +435,20 @@ export declare class PlatformClient extends runtime.BaseAPI {
      * Approve a screen into this business
      */
     approveDevice(requestParameters: ApproveDeviceOperationRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<DeviceScreen>;
+    /**
+     * Creates request options for approveOAuthAuthorization without sending the request
+     */
+    approveOAuthAuthorizationRequestOpts(requestParameters: ApproveOAuthAuthorizationRequest): Promise<runtime.RequestOpts>;
+    /**
+     * Issues a single-use authorization code the client redeems at the token endpoint.
+     * Approve an authorization request as the signed-in user
+     */
+    approveOAuthAuthorizationRaw(requestParameters: ApproveOAuthAuthorizationRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<IssuedAuthorizationCode>>;
+    /**
+     * Issues a single-use authorization code the client redeems at the token endpoint.
+     * Approve an authorization request as the signed-in user
+     */
+    approveOAuthAuthorization(requestParameters: ApproveOAuthAuthorizationRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<IssuedAuthorizationCode>;
     /**
      * Creates request options for assignBusinessEmployeeSystem without sending the request
      */
@@ -1685,6 +1705,20 @@ export declare class PlatformClient extends runtime.BaseAPI {
      * Look up a pairing code before approving
      */
     previewDevice(requestParameters: PreviewDeviceRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<PendingDevicePreview>;
+    /**
+     * Creates request options for previewOAuthAuthorization without sending the request
+     */
+    previewOAuthAuthorizationRequestOpts(requestParameters: PreviewOAuthAuthorizationRequest): Promise<runtime.RequestOpts>;
+    /**
+     * Validates the client, redirect URI and resource for the signed-in user and names the client.
+     * Describe an authorization request before the user approves it
+     */
+    previewOAuthAuthorizationRaw(requestParameters: PreviewOAuthAuthorizationRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<AuthorizationPreview>>;
+    /**
+     * Validates the client, redirect URI and resource for the signed-in user and names the client.
+     * Describe an authorization request before the user approves it
+     */
+    previewOAuthAuthorization(requestParameters: PreviewOAuthAuthorizationRequest, initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<AuthorizationPreview>;
     /**
      * Creates request options for provisionBusiness without sending the request
      */
@@ -1814,12 +1848,12 @@ export declare class PlatformClient extends runtime.BaseAPI {
      */
     resolvePlatformSanityConfigRequestOpts(): Promise<runtime.RequestOpts>;
     /**
-     * Returns the shared platform Sanity project, dataset, studio URL and read token used as the content fallback layer for every tenant. All four values live in platform Key Vault (editable in platform-web), so nothing Sanity-related is baked onto frontends. This is a render-path config endpoint, so it accepts any principal from the platform Entra tenant — the platform managed identity in production, or a Snøkam developer\'s az session locally — with no operator role required.
+     * Returns the shared platform Sanity project, dataset, studio URL and read token used as the content fallback layer for every tenant. All four values live in platform Key Vault (editable in platform-web), so nothing Sanity-related is baked onto frontends. The answer is cached in-process for five minutes and served stale if Key Vault is briefly unreachable. This is a render-path config endpoint, so it accepts any principal from the platform Entra tenant — the platform managed identity in production, or a Snøkam developer\'s az session locally — with no operator role required.
      * Resolve the platform Sanity read config
      */
     resolvePlatformSanityConfigRaw(initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<runtime.ApiResponse<PlatformSanityConfig>>;
     /**
-     * Returns the shared platform Sanity project, dataset, studio URL and read token used as the content fallback layer for every tenant. All four values live in platform Key Vault (editable in platform-web), so nothing Sanity-related is baked onto frontends. This is a render-path config endpoint, so it accepts any principal from the platform Entra tenant — the platform managed identity in production, or a Snøkam developer\'s az session locally — with no operator role required.
+     * Returns the shared platform Sanity project, dataset, studio URL and read token used as the content fallback layer for every tenant. All four values live in platform Key Vault (editable in platform-web), so nothing Sanity-related is baked onto frontends. The answer is cached in-process for five minutes and served stale if Key Vault is briefly unreachable. This is a render-path config endpoint, so it accepts any principal from the platform Entra tenant — the platform managed identity in production, or a Snøkam developer\'s az session locally — with no operator role required.
      * Resolve the platform Sanity read config
      */
     resolvePlatformSanityConfig(initOverrides?: RequestInit | runtime.InitOverrideFunction): Promise<PlatformSanityConfig>;

package/dist/esm/apis/PlatformClient.js

@@ -125,6 +125,52 @@ export class PlatformClient extends runtime.BaseAPI {
             return yield response.value();
         });
     }
+    /**
+     * Creates request options for approveOAuthAuthorization without sending the request
+     */
+    approveOAuthAuthorizationRequestOpts(requestParameters) {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (requestParameters['authorizationRequest'] == null) {
+                throw new runtime.RequiredError('authorizationRequest', 'Required parameter "authorizationRequest" was null or undefined when calling approveOAuthAuthorization().');
+            }
+            const queryParameters = {};
+            const headerParameters = {};
+            headerParameters['Content-Type'] = 'application/json';
+            if (this.configuration && this.configuration.accessToken) {
+                // oauth required
+                headerParameters["Authorization"] = yield this.configuration.accessToken("Implicit", []);
+            }
+            let urlPath = `/v1.0/protected/oauth/authorization`;
+            return {
+                path: urlPath,
+                method: 'POST',
+                headers: headerParameters,
+                query: queryParameters,
+                body: requestParameters['authorizationRequest'],
+            };
+        });
+    }
+    /**
+     * Issues a single-use authorization code the client redeems at the token endpoint.
+     * Approve an authorization request as the signed-in user
+     */
+    approveOAuthAuthorizationRaw(requestParameters, initOverrides) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const requestOptions = yield this.approveOAuthAuthorizationRequestOpts(requestParameters);
+            const response = yield this.request(requestOptions, initOverrides);
+            return new runtime.JSONApiResponse(response);
+        });
+    }
+    /**
+     * Issues a single-use authorization code the client redeems at the token endpoint.
+     * Approve an authorization request as the signed-in user
+     */
+    approveOAuthAuthorization(requestParameters, initOverrides) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const response = yield this.approveOAuthAuthorizationRaw(requestParameters, initOverrides);
+            return yield response.value();
+        });
+    }
     /**
      * Creates request options for assignBusinessEmployeeSystem without sending the request
      */
@@ -4164,6 +4210,52 @@ export class PlatformClient extends runtime.BaseAPI {
             return yield response.value();
         });
     }
+    /**
+     * Creates request options for previewOAuthAuthorization without sending the request
+     */
+    previewOAuthAuthorizationRequestOpts(requestParameters) {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (requestParameters['authorizationRequest'] == null) {
+                throw new runtime.RequiredError('authorizationRequest', 'Required parameter "authorizationRequest" was null or undefined when calling previewOAuthAuthorization().');
+            }
+            const queryParameters = {};
+            const headerParameters = {};
+            headerParameters['Content-Type'] = 'application/json';
+            if (this.configuration && this.configuration.accessToken) {
+                // oauth required
+                headerParameters["Authorization"] = yield this.configuration.accessToken("Implicit", []);
+            }
+            let urlPath = `/v1.0/protected/oauth/authorization/preview`;
+            return {
+                path: urlPath,
+                method: 'POST',
+                headers: headerParameters,
+                query: queryParameters,
+                body: requestParameters['authorizationRequest'],
+            };
+        });
+    }
+    /**
+     * Validates the client, redirect URI and resource for the signed-in user and names the client.
+     * Describe an authorization request before the user approves it
+     */
+    previewOAuthAuthorizationRaw(requestParameters, initOverrides) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const requestOptions = yield this.previewOAuthAuthorizationRequestOpts(requestParameters);
+            const response = yield this.request(requestOptions, initOverrides);
+            return new runtime.JSONApiResponse(response);
+        });
+    }
+    /**
+     * Validates the client, redirect URI and resource for the signed-in user and names the client.
+     * Describe an authorization request before the user approves it
+     */
+    previewOAuthAuthorization(requestParameters, initOverrides) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const response = yield this.previewOAuthAuthorizationRaw(requestParameters, initOverrides);
+            return yield response.value();
+        });
+    }
     /**
      * Creates request options for provisionBusiness without sending the request
      */
@@ -4572,7 +4664,7 @@ export class PlatformClient extends runtime.BaseAPI {
         });
     }
     /**
-     * Returns the shared platform Sanity project, dataset, studio URL and read token used as the content fallback layer for every tenant. All four values live in platform Key Vault (editable in platform-web), so nothing Sanity-related is baked onto frontends. This is a render-path config endpoint, so it accepts any principal from the platform Entra tenant — the platform managed identity in production, or a Snøkam developer\'s az session locally — with no operator role required.
+     * Returns the shared platform Sanity project, dataset, studio URL and read token used as the content fallback layer for every tenant. All four values live in platform Key Vault (editable in platform-web), so nothing Sanity-related is baked onto frontends. The answer is cached in-process for five minutes and served stale if Key Vault is briefly unreachable. This is a render-path config endpoint, so it accepts any principal from the platform Entra tenant — the platform managed identity in production, or a Snøkam developer\'s az session locally — with no operator role required.
      * Resolve the platform Sanity read config
      */
     resolvePlatformSanityConfigRaw(initOverrides) {
@@ -4583,7 +4675,7 @@ export class PlatformClient extends runtime.BaseAPI {
         });
     }
     /**
-     * Returns the shared platform Sanity project, dataset, studio URL and read token used as the content fallback layer for every tenant. All four values live in platform Key Vault (editable in platform-web), so nothing Sanity-related is baked onto frontends. This is a render-path config endpoint, so it accepts any principal from the platform Entra tenant — the platform managed identity in production, or a Snøkam developer\'s az session locally — with no operator role required.
+     * Returns the shared platform Sanity project, dataset, studio URL and read token used as the content fallback layer for every tenant. All four values live in platform Key Vault (editable in platform-web), so nothing Sanity-related is baked onto frontends. The answer is cached in-process for five minutes and served stale if Key Vault is briefly unreachable. This is a render-path config endpoint, so it accepts any principal from the platform Entra tenant — the platform managed identity in production, or a Snøkam developer\'s az session locally — with no operator role required.
      * Resolve the platform Sanity read config
      */
     resolvePlatformSanityConfig(initOverrides) {

package/dist/esm/models/index.d.ts

@@ -277,6 +277,62 @@ export interface ApproveDeviceRequest {
      */
     name?: string | null;
 }
+/**
+ *
+ * @export
+ * @interface AuthorizationPreview
+ */
+export interface AuthorizationPreview {
+    /**
+     *
+     * @type {string}
+     * @memberof AuthorizationPreview
+     */
+    businessName?: string | null;
+    /**
+     *
+     * @type {string}
+     * @memberof AuthorizationPreview
+     */
+    clientName?: string | null;
+}
+/**
+ *
+ * @export
+ * @interface AuthorizationRequest
+ */
+export interface AuthorizationRequest {
+    /**
+     *
+     * @type {string}
+     * @memberof AuthorizationRequest
+     */
+    clientId?: string | null;
+    /**
+     *
+     * @type {string}
+     * @memberof AuthorizationRequest
+     */
+    codeChallenge?: string | null;
+    /**
+     *
+     * @type {string}
+     * @memberof AuthorizationRequest
+     */
+    codeChallengeMethod?: string | null;
+    /**
+     *
+     * @type {string}
+     * @memberof AuthorizationRequest
+     */
+    redirectUri?: string | null;
+    /**
+     *
+     * @type {string}
+     * @memberof AuthorizationRequest
+     */
+    resource?: string | null;
+}
 /**
  *
  * @export
@@ -2387,6 +2443,19 @@ export interface InvoiceBasisLine {
      */
     unitPriceOre?: number | null;
 }
+/**
+ *
+ * @export
+ * @interface IssuedAuthorizationCode
+ */
+export interface IssuedAuthorizationCode {
+    /**
+     *
+     * @type {string}
+     * @memberof IssuedAuthorizationCode
+     */
+    code?: string | null;
+}
 /**
  *
  * @export
@@ -3323,6 +3392,12 @@ export interface PatchEmployee {
      * @memberof PatchEmployee
      */
     isSeekingProject?: boolean | null;
+    /**
+     *
+     * @type {boolean}
+     * @memberof PatchEmployee
+     */
+    leadershipGroupMember?: boolean | null;
     /**
      *
      * @type {string}
@@ -3373,12 +3448,6 @@ export interface PatchEmployee {
      * @memberof PatchEmployee
      */
     parentalLeaveCoverage?: PatchEmployeeParentalLeaveCoverageEnum | null;
-    /**
-     *
-     * @type {string}
-     * @memberof PatchEmployee
-     */
-    parentalLeaveStartDate?: string;
     /**
      *
      * @type {string}
@@ -4092,6 +4161,12 @@ export interface ProtectedEmployee {
      * @memberof ProtectedEmployee
      */
     isSeekingProject?: boolean;
+    /**
+     *
+     * @type {boolean}
+     * @memberof ProtectedEmployee
+     */
+    leadershipGroupMember?: boolean;
     /**
      *
      * @type {string}
@@ -4142,12 +4217,6 @@ export interface ProtectedEmployee {
      * @memberof ProtectedEmployee
      */
     parentalLeaveCoverage?: ProtectedEmployeeParentalLeaveCoverageEnum | null;
-    /**
-     *
-     * @type {string}
-     * @memberof ProtectedEmployee
-     */
-    parentalLeaveStartDate?: string;
     /**
      *
      * @type {string}
@@ -4899,6 +4968,12 @@ export interface SanityEmployeeGroupsInner {
      * @memberof SanityEmployeeGroupsInner
      */
     scopeGrants?: Array<string>;
+    /**
+     *
+     * @type {string}
+     * @memberof SanityEmployeeGroupsInner
+     */
+    slackChannel?: string;
 }
 /**
  * @export