UsefulSoftwareCo · RhysSullivan · Aug 25, 2026 · Aug 25, 2026
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -1,11 +1,19 @@
 # Changelog
 
-## 0.13.9
+## 0.14.0
 
 <!-- release:start -->
 
 ### New Features
 
+- **Okta enterprise-managed authorization (ID-JAG token exchange)** — the Okta emulator's token endpoint now handles RFC 8693 token exchange minting Identity Assertion JWT Authorization Grants (`requested_token_type=urn:ietf:params:oauth:token-type:id-jag`, per draft-ietf-oauth-identity-assertion-authz-grant-04) on both the org issuer and per-authorization-server issuers, accepting ID-token and refresh-token subject tokens with the draft's validation rules (issuer-pinned signature, subject-token audience must be the authenticating client). A seedable administrator policy table (`token_exchange_policies`: user × client × audience × resource × scopes, ALLOW/DENY with DENY-wins and scope narrowing) governs issuance — unconfigured means every exchange is allowed, any seeded policy flips the table to an allowlist — and is manageable at `/api/v1/tokenExchangePolicies` behind management auth (an emulator extension; real Okta has no public API for this). Denials return RFC 8693 `invalid_target`/`invalid_scope`. Minted ID-JAGs redeem against the MCP emulator's existing jwt-bearer endpoint unchanged, proven by a new Okta → MCP enterprise-managed-authorization end-to-end suite.
+
+<!-- release:end -->
+
+## 0.13.9
+
+### New Features
+
 - **WorkOS organization-owned API keys** — the WorkOS emulator now serves the SDK's organization API key surface: `GET /organizations/:id/api_keys` lists an organization's own keys (organization-owned only — members' personal keys never share the listing) and `POST /organizations/:id/api_keys` mints one. An organization-owned key carries the real wire owner shape (`owner: { type: "organization", id }`, no member field), round-trips through `POST /api_keys/validations` with that shape, and deletes through the shared `DELETE /api_keys/:id`. Unknown organizations 404.
 
 <!-- release:end -->

diff --git a/packages/@emulators/adapter-next/package.json b/packages/@emulators/adapter-next/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@emulators/adapter-next",
-  "version": "0.13.9",
+  "version": "0.14.0",
   "private": true,
   "license": "Apache-2.0",
   "type": "module",

diff --git a/packages/@emulators/apple/package.json b/packages/@emulators/apple/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@emulators/apple",
-  "version": "0.13.9",
+  "version": "0.14.0",
   "private": true,
   "license": "Apache-2.0",
   "type": "module",

diff --git a/packages/@emulators/autumn/package.json b/packages/@emulators/autumn/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@emulators/autumn",
-  "version": "0.13.9",
+  "version": "0.14.0",
   "private": true,
   "license": "Apache-2.0",
   "type": "module",

diff --git a/packages/@emulators/aws/package.json b/packages/@emulators/aws/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@emulators/aws",
-  "version": "0.13.9",
+  "version": "0.14.0",
   "private": true,
   "license": "Apache-2.0",
   "type": "module",

diff --git a/packages/@emulators/clerk/package.json b/packages/@emulators/clerk/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@emulators/clerk",
-  "version": "0.13.9",
+  "version": "0.14.0",
   "private": true,
   "license": "Apache-2.0",
   "type": "module",

diff --git a/packages/@emulators/cloudflare/package.json b/packages/@emulators/cloudflare/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@emulators/cloudflare",
-  "version": "0.13.9",
+  "version": "0.14.0",
   "private": true,
   "license": "Apache-2.0",
   "type": "module",

diff --git a/packages/@emulators/core/package.json b/packages/@emulators/core/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@emulators/core",
-  "version": "0.13.9",
+  "version": "0.14.0",
   "private": true,
   "license": "Apache-2.0",
   "type": "module",

diff --git a/packages/@emulators/github/package.json b/packages/@emulators/github/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@emulators/github",
-  "version": "0.13.9",
+  "version": "0.14.0",
   "private": true,
   "license": "Apache-2.0",
   "type": "module",

diff --git a/packages/@emulators/gitlab/package.json b/packages/@emulators/gitlab/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@emulators/gitlab",
-  "version": "0.13.9",
+  "version": "0.14.0",
   "private": true,
   "license": "Apache-2.0",
   "type": "module",

diff --git a/packages/@emulators/google/package.json b/packages/@emulators/google/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@emulators/google",
-  "version": "0.13.9",
+  "version": "0.14.0",
   "private": true,
   "license": "Apache-2.0",
   "type": "module",

diff --git a/packages/@emulators/mcp/package.json b/packages/@emulators/mcp/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@emulators/mcp",
-  "version": "0.13.9",
+  "version": "0.14.0",
   "private": true,
   "license": "Apache-2.0",
   "type": "module",

diff --git a/packages/@emulators/microsoft/package.json b/packages/@emulators/microsoft/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@emulators/microsoft",
-  "version": "0.13.9",
+  "version": "0.14.0",
   "private": true,
   "license": "Apache-2.0",
   "type": "module",

diff --git a/packages/@emulators/mongoatlas/package.json b/packages/@emulators/mongoatlas/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@emulators/mongoatlas",
-  "version": "0.13.9",
+  "version": "0.14.0",
   "private": true,
   "license": "Apache-2.0",
   "type": "module",

diff --git a/packages/@emulators/okta/package.json b/packages/@emulators/okta/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@emulators/okta",
-  "version": "0.13.9",
+  "version": "0.14.0",
   "private": true,
   "license": "Apache-2.0",
   "type": "module",

diff --git a/packages/@emulators/posthog/package.json b/packages/@emulators/posthog/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@emulators/posthog",
-  "version": "0.13.9",
+  "version": "0.14.0",
   "private": true,
   "license": "Apache-2.0",
   "type": "module",

diff --git a/packages/@emulators/resend/package.json b/packages/@emulators/resend/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@emulators/resend",
-  "version": "0.13.9",
+  "version": "0.14.0",
   "private": true,
   "license": "Apache-2.0",
   "type": "module",

diff --git a/packages/@emulators/slack/package.json b/packages/@emulators/slack/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@emulators/slack",
-  "version": "0.13.9",
+  "version": "0.14.0",
   "private": true,
   "license": "Apache-2.0",
   "type": "module",

diff --git a/packages/@emulators/spotify/package.json b/packages/@emulators/spotify/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@emulators/spotify",
-  "version": "0.13.9",
+  "version": "0.14.0",
   "private": true,
   "license": "Apache-2.0",
   "type": "module",

diff --git a/packages/@emulators/stripe/package.json b/packages/@emulators/stripe/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@emulators/stripe",
-  "version": "0.13.9",
+  "version": "0.14.0",
   "private": true,
   "license": "Apache-2.0",
   "type": "module",

diff --git a/packages/@emulators/vercel/package.json b/packages/@emulators/vercel/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@emulators/vercel",
-  "version": "0.13.9",
+  "version": "0.14.0",
   "private": true,
   "license": "Apache-2.0",
   "type": "module",

diff --git a/packages/@emulators/workos/package.json b/packages/@emulators/workos/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@emulators/workos",
-  "version": "0.13.9",
+  "version": "0.14.0",
   "private": true,
   "license": "Apache-2.0",
   "type": "module",

diff --git a/packages/@emulators/x/package.json b/packages/@emulators/x/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@emulators/x",
-  "version": "0.13.9",
+  "version": "0.14.0",
   "private": true,
   "license": "Apache-2.0",
   "type": "module",

diff --git a/packages/emulate/package.json b/packages/emulate/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@executor-js/emulate",
-  "version": "0.13.9",
+  "version": "0.14.0",
   "description": "Local drop-in replacement services for CI and no-network sandboxes",
   "license": "Apache-2.0",
   "type": "module",