v0.14.0

New Features

• Okta enterprise-managed authorization (ID-JAG token exchange) — the Okta emulator's token endpoint now handles RFC 8693 token exchange minting Identity Assertion JWT Authorization Grants (requested_token_type=urn:ietf:params:oauth:token-type:id-jag, per draft-ietf-oauth-identity-assertion-authz-grant-04) on both the org issuer and per-authorization-server issuers, accepting ID-token and refresh-token subject tokens with the draft's validation rules (issuer-pinned signature, subject-token audience must be the authenticating client). A seedable administrator policy table (token_exchange_policies: user × client × audience × resource × scopes, ALLOW/DENY with DENY-wins and scope narrowing) governs issuance — unconfigured means every exchange is allowed, any seeded policy flips the table to an allowlist — and is manageable at /api/v1/tokenExchangePolicies behind management auth (an emulator extension; real Okta has no public API for this). Denials return RFC 8693 invalid_target/invalid_scope. Minted ID-JAGs redeem against the MCP emulator's existing jwt-bearer endpoint unchanged, proven by a new Okta → MCP enterprise-managed-authorization end-to-end suite.