v0.14.2

New Features

• Autumn payment method setup and billing portal — the Autumn emulator now models the card on file end to end. POST /v1/billing.setup_payment (autumn-js billing.setupPayment) opens a Stripe setup-mode checkout and returns { customer_id, entity_id?, url }; the hosted page at GET /checkout/setup/:sessionId captures a card (card_number, exp, both editable so a test can pick the brand) and redirects to success_url. As with the existing checkout flow, nothing changes on the customer until the checkout.session.completed webhook lands, modelled by POST /checkout/setup/:sessionId/settle (or the customer-wide POST /checkout/settle, which now settles setup sessions too). Settling matches real Autumn's surprising behaviour: a setup session only sets the default payment method when the customer has none, and never replaces an existing card, because Autumn's setup-checkout handler reads the current default first and re-sets that same card.
• Autumn hosted billing portal — POST /v1/billing.open_customer_portal now returns a URL that actually serves a page. GET /checkout/portal/:customerId shows the customer's current plan, the card on file (or "No payment method"), a form to update it, and a link back to the return_url the portal session was opened with (recorded in the new autumn.portals collection). POST /checkout/portal/:customerId/payment-method changes the card IMMEDIATELY, with no settle step, because real Stripe swaps the default inside the portal and Autumn reads the card live on every expand. This is how an application under test changes a card. Unknown customers 404.
• Autumn payment_method expand — customers.get_or_create honours expand: ["payment_method"], returning the Stripe PaymentMethod (id, type, card.brand, card.last4, card.exp_month, card.exp_year), and omitting the field entirely when there is no card or when expand does not ask for it. Settling a paid checkout also leaves a visa 4242 on file when the customer had no card, and customers can be seeded with a payment_method.

v0.14.1

New Features

• Autumn balances.update — the Autumn emulator now supports the SDK's balance update call (POST /v1/balances.update) for reconciling continuous-use features such as seats. Exactly one of usage, remaining, or add_to_balance is required; the update is recorded as an adjustment event, so events.list shows the reconciliation and balances.check and customers.get_or_create reflect it from the same state. remaining is rejected on unlimited balances, unknown customers 404 with Autumn's real customer_not_found code (update is a non-creating endpoint upstream, unlike track and check), and a feature the customer's plan does not carry 404s.

v0.14.0

New Features

• Okta enterprise-managed authorization (ID-JAG token exchange) — the Okta emulator's token endpoint now handles RFC 8693 token exchange minting Identity Assertion JWT Authorization Grants (requested_token_type=urn:ietf:params:oauth:token-type:id-jag, per draft-ietf-oauth-identity-assertion-authz-grant-04) on both the org issuer and per-authorization-server issuers, accepting ID-token and refresh-token subject tokens with the draft's validation rules (issuer-pinned signature, subject-token audience must be the authenticating client). A seedable administrator policy table (token_exchange_policies: user × client × audience × resource × scopes, ALLOW/DENY with DENY-wins and scope narrowing) governs issuance — unconfigured means every exchange is allowed, any seeded policy flips the table to an allowlist — and is manageable at /api/v1/tokenExchangePolicies behind management auth (an emulator extension; real Okta has no public API for this). Denials return RFC 8693 invalid_target/invalid_scope. Minted ID-JAGs redeem against the MCP emulator's existing jwt-bearer endpoint unchanged, proven by a new Okta → MCP enterprise-managed-authorization end-to-end suite.

v0.13.9

New Features

• WorkOS organization-owned API keys — the WorkOS emulator now serves the SDK's organization API key surface: GET /organizations/:id/api_keys lists an organization's own keys (organization-owned only — members' personal keys never share the listing) and POST /organizations/:id/api_keys mints one. An organization-owned key carries the real wire owner shape (owner: { type: "organization", id }, no member field), round-trips through POST /api_keys/validations with that shape, and deletes through the shared DELETE /api_keys/:id. Unknown organizations 404.

v0.13.6

New Features

• WorkOS session logout — the WorkOS emulator now serves AuthKit's session-end endpoint (GET /user_management/sessions/logout?session_id=...&return_to=...), the URL the Node SDK's getLogoutUrl builds. It revokes the session (its refresh token stops minting tokens, matching real WorkOS) and redirects to return_to, or renders a signed-out page when none is given. Apps can now exercise their full sign-out flow, including the hop through WorkOS, against the emulator.

v0.9.0

New Features

• Autumn checkout and free-trial flow — the Autumn emulator now backs a real billing UI end to end. plans.list returns a seedable plan catalog with per-customer eligibility (attach_action, status, trialing, trial_available), billing.attach and billing.open_customer_portal are supported, and a paid plan or a card-required free trial routes attach through a hosted checkout page. Completing checkout redirects to the app's success_url without activating the subscription; activation lands when the checkout settles (POST /checkout/settle), mirroring Stripe's checkout.session.completed webhook arriving after the redirect. customers.get_or_create now returns SDK-shaped subscriptions and per-feature balances.

Published manually: @executor-js/emulate@0.9.0 (the bundle consumed by executor; carries the autumn changes). The standalone @emulators/* packages were not republished from this run.