@executor-js/emulate 0.6.0 → 0.7.0

package/dist/{dist-IYZPDKJW.js → dist-S47YJ552.js}

@@ -9,11 +9,7 @@ function getWorkosStore(store) {
   return {
     users: store.collection("workos.users", ["workos_id", "email"]),
     organizations: store.collection("workos.organizations", ["workos_id"]),
-    memberships: store.collection("workos.memberships", [
-      "workos_id",
-      "user_id",
-      "organization_id"
-    ]),
+    memberships: store.collection("workos.memberships", ["workos_id", "user_id", "organization_id"]),
     invitations: store.collection("workos.invitations", [
       "workos_id",
       "email",
@@ -23,12 +19,10 @@ function getWorkosStore(store) {
     apiKeys: store.collection("workos.api_keys", ["workos_id", "value", "user_id"]),
     authCodes: store.collection("workos.auth_codes", ["code"]),
     sessions: store.collection("workos.sessions", ["refresh_token", "workos_id"]),
-    vaultObjects: store.collection("workos.vault_objects", [
-      "workos_id",
-      "name"
-    ]),
+    vaultObjects: store.collection("workos.vault_objects", ["workos_id", "name"]),
     oauthClients: store.collection("workos.oauth_clients", ["client_id"]),
-    oauthCodes: store.collection("workos.oauth_codes", ["code"])
+    oauthCodes: store.collection("workos.oauth_codes", ["code"]),
+    oauthSettings: store.collection("workos.oauth_settings", [])
   };
 }
 function createErrorHandler(documentationUrl) {
@@ -527,7 +521,8 @@ async function authenticationResponse(c, ws, baseUrl, user, organizationId, clie
     user_id: user.workos_id,
     organization_id: organizationId,
     client_id: clientId,
-    revoked: false
+    revoked: false,
+    scope: null
   });
   const membership = organizationId ? ws.memberships.findBy("user_id", user.workos_id).find((m) => m.organization_id === organizationId) : void 0;
   const accessToken = await signAccessToken(
@@ -970,7 +965,8 @@ function oauthRoutes(ctx) {
       client_id: workosId("client"),
       client_secret: null,
       redirect_uris: Array.isArray(body.redirect_uris) ? body.redirect_uris : [],
-      name: typeof body.client_name === "string" ? body.client_name : null
+      name: typeof body.client_name === "string" ? body.client_name : null,
+      access_token_ttl_seconds: typeof body.access_token_ttl_seconds === "number" && body.access_token_ttl_seconds > 0 ? Math.floor(body.access_token_ttl_seconds) : null
     });
     return c.json(
       {
@@ -989,6 +985,7 @@ function oauthRoutes(ctx) {
     const redirectUri = c.req.query("redirect_uri") ?? "";
     const state = c.req.query("state") ?? "";
     const codeChallenge = c.req.query("code_challenge") ?? "";
+    const scope = c.req.query("scope") ?? "";
     const loginHint = c.req.query("login_hint");
     if (!redirectUri) return workosError(c, 422, "invalid_request", "redirect_uri is required");
     const issue = (email) => {
@@ -1002,6 +999,7 @@ function oauthRoutes(ctx) {
         client_id: clientId,
         redirect_uri: redirectUri,
         code_challenge: codeChallenge || null,
+        scope: scope || null,
         used: false
       });
       const target = new URL(redirectUri);
@@ -1023,7 +1021,8 @@ function oauthRoutes(ctx) {
           client_id: clientId,
           redirect_uri: redirectUri,
           state,
-          code_challenge: codeChallenge
+          code_challenge: codeChallenge,
+          scope
         }
       })
     ).join("\n");
@@ -1033,6 +1032,7 @@ function oauthRoutes(ctx) {
         <input type="hidden" name="redirect_uri" value="${escapeHtml(redirectUri)}" />
         <input type="hidden" name="state" value="${escapeHtml(state)}" />
         <input type="hidden" name="code_challenge" value="${escapeHtml(codeChallenge)}" />
+        <input type="hidden" name="scope" value="${escapeHtml(scope)}" />
         <input type="email" name="email" class="checkout-input" placeholder="new-user@example.com" required />
         <button type="submit" class="checkout-pay-btn">Continue as new user</button>
       </form>`;
@@ -1058,6 +1058,7 @@ function oauthRoutes(ctx) {
       client_id: String(form.client_id ?? ""),
       redirect_uri: redirectUri,
       code_challenge: String(form.code_challenge ?? "") || null,
+      scope: String(form.scope ?? "") || null,
       used: false
     });
     const target = new URL(redirectUri);
@@ -1070,6 +1071,7 @@ function oauthRoutes(ctx) {
     const contentType = c.req.header("content-type") ?? "";
     const body = contentType.includes("json") ? await c.req.json().catch(() => ({})) : await c.req.parseBody();
     const grantType = String(body.grant_type ?? "");
+    const ttlFor = (clientId) => ws().oauthClients.findOneBy("client_id", clientId)?.access_token_ttl_seconds ?? ws().oauthSettings.all()[0]?.default_access_token_ttl_seconds ?? 3600;
     if (grantType === "refresh_token") {
       const refreshToken = String(body.refresh_token ?? "");
       const session2 = ws().sessions.findOneBy("refresh_token", refreshToken);
@@ -1083,9 +1085,11 @@ function oauthRoutes(ctx) {
         user_id: session2.user_id,
         organization_id: session2.organization_id,
         client_id: session2.client_id,
-        revoked: false
+        revoked: false,
+        scope: session2.scope
       });
       const audience2 = process.env.EMULATE_WORKOS_AUDIENCE ?? session2.client_id;
+      const expiresIn2 = ttlFor(session2.client_id);
       const accessToken2 = await signAccessToken(
         {
           sub: session2.user_id,
@@ -1093,13 +1097,14 @@ function oauthRoutes(ctx) {
           ...session2.organization_id ? { org_id: session2.organization_id } : {},
           permissions: []
         },
-        { issuer: baseUrl, audience: audience2 }
+        { issuer: baseUrl, audience: audience2, expiresIn: `${expiresIn2}s` }
       );
       return c.json({
         access_token: accessToken2,
         token_type: "Bearer",
-        expires_in: 3600,
-        refresh_token: rotated.refresh_token
+        expires_in: expiresIn2,
+        refresh_token: rotated.refresh_token,
+        ...session2.scope ? { scope: session2.scope } : {}
       });
     }
     if (grantType !== "authorization_code") {
@@ -1112,31 +1117,442 @@ function oauthRoutes(ctx) {
     }
     ws().oauthCodes.update(oauthCode.id, { used: true });
     const audience = process.env.EMULATE_WORKOS_AUDIENCE ?? oauthCode.client_id;
-    const session = ws().sessions.insert({
+    const grantedScopes = (oauthCode.scope ?? "").split(" ").filter(Boolean);
+    const offline = grantedScopes.includes("offline_access");
+    const session = offline ? ws().sessions.insert({
       workos_id: workosId("session"),
       refresh_token: randomToken("rt"),
       user_id: oauthCode.user_id,
       organization_id: oauthCode.organization_id,
       client_id: oauthCode.client_id,
-      revoked: false
-    });
+      revoked: false,
+      scope: oauthCode.scope
+    }) : null;
+    const expiresIn = ttlFor(oauthCode.client_id);
     const accessToken = await signAccessToken(
       {
         sub: oauthCode.user_id,
-        sid: session.workos_id,
+        sid: session?.workos_id ?? workosId("session"),
         ...oauthCode.organization_id ? { org_id: oauthCode.organization_id } : {},
         permissions: []
       },
-      { issuer: baseUrl, audience }
+      { issuer: baseUrl, audience, expiresIn: `${expiresIn}s` }
     );
     return c.json({
       access_token: accessToken,
       token_type: "Bearer",
-      expires_in: 3600,
-      refresh_token: session.refresh_token
+      expires_in: expiresIn,
+      ...session ? { refresh_token: session.refresh_token } : {},
+      ...grantedScopes.length > 0 ? { scope: grantedScopes.join(" ") } : {}
     });
   });
 }
+function openapiRoutes({ app, baseUrl }) {
+  app.get("/openapi.json", (c) => c.json(buildSpec(baseUrl)));
+}
+var ok = (description) => ({
+  description,
+  content: { "application/json": { schema: { type: "object" } } }
+});
+var noContent = (description) => ({ description });
+var id = { name: "id", in: "path", required: true, schema: { type: "string" } };
+var query = (name, description) => ({
+  name,
+  in: "query",
+  required: false,
+  schema: { type: "string" },
+  description
+});
+var jsonBody = (properties, required, description) => ({
+  required: true,
+  description,
+  content: {
+    "application/json": {
+      schema: { type: "object", properties, required: [...required] }
+    }
+  }
+});
+function buildSpec(baseUrl) {
+  return {
+    openapi: "3.1.0",
+    info: {
+      title: "WorkOS API (Emulated)",
+      version: "1.0.0",
+      description: "Emulated subset of the WorkOS REST API: user management, organization memberships, invitations, API keys, Vault KV, and the OAuth token surface. Authenticate with a bearer secret key (mint one at POST /_emulate/credentials)."
+    },
+    servers: [{ url: baseUrl }],
+    components: {
+      securitySchemes: {
+        bearerAuth: {
+          type: "http",
+          scheme: "bearer",
+          description: "WorkOS secret API key, sent as `Authorization: Bearer sk_\u2026`."
+        }
+      }
+    },
+    security: [{ bearerAuth: [] }],
+    paths: {
+      "/user_management/authenticate": {
+        post: {
+          operationId: "userManagement.authenticate",
+          tags: ["user-management"],
+          summary: "Exchange an authorization code or refresh token for a session",
+          security: [],
+          requestBody: jsonBody(
+            {
+              grant_type: { type: "string", enum: ["authorization_code", "refresh_token"] },
+              client_id: { type: "string" },
+              code: { type: "string" },
+              refresh_token: { type: "string" },
+              organization_id: { type: "string" }
+            },
+            ["grant_type"],
+            "authorization_code grants need `code`; refresh_token grants need `refresh_token` (optionally switching `organization_id`)."
+          ),
+          responses: {
+            "200": ok("User, access token, and refresh token."),
+            "400": ok("Invalid or used grant.")
+          }
+        }
+      },
+      "/user_management/users/{id}": {
+        get: {
+          operationId: "userManagement.getUser",
+          tags: ["user-management"],
+          summary: "Retrieve a user",
+          parameters: [id],
+          responses: { "200": ok("The user."), "404": ok("Not found.") }
+        }
+      },
+      "/user_management/organization_memberships": {
+        get: {
+          operationId: "memberships.list",
+          tags: ["memberships"],
+          summary: "List organization memberships",
+          parameters: [
+            query("user_id", "Filter by user."),
+            query("organization_id", "Filter by organization."),
+            query("statuses", "Comma-separated membership statuses.")
+          ],
+          responses: { "200": ok("Membership list.") }
+        },
+        post: {
+          operationId: "memberships.create",
+          tags: ["memberships"],
+          summary: "Add a user to an organization",
+          requestBody: jsonBody(
+            {
+              user_id: { type: "string" },
+              organization_id: { type: "string" },
+              role_slug: { type: "string" }
+            },
+            ["user_id", "organization_id"],
+            "The membership to create."
+          ),
+          responses: {
+            "201": ok("The created membership."),
+            "404": ok("User or organization not found."),
+            "409": ok("Already a member.")
+          }
+        }
+      },
+      "/user_management/organization_memberships/{id}": {
+        get: {
+          operationId: "memberships.get",
+          tags: ["memberships"],
+          summary: "Retrieve a membership",
+          parameters: [id],
+          responses: { "200": ok("The membership."), "404": ok("Not found.") }
+        },
+        put: {
+          operationId: "memberships.update",
+          tags: ["memberships"],
+          summary: "Update a membership's role",
+          parameters: [id],
+          requestBody: jsonBody({ role_slug: { type: "string" } }, [], "Fields to update."),
+          responses: { "200": ok("The updated membership."), "404": ok("Not found.") }
+        },
+        delete: {
+          operationId: "memberships.delete",
+          tags: ["memberships"],
+          summary: "Remove a membership",
+          parameters: [id],
+          responses: { "204": noContent("Deleted."), "404": ok("Not found.") }
+        }
+      },
+      "/user_management/invitations": {
+        get: {
+          operationId: "invitations.list",
+          tags: ["invitations"],
+          summary: "List invitations",
+          parameters: [query("email", "Filter by invitee email."), query("organization_id", "Filter by organization.")],
+          responses: { "200": ok("Invitation list.") }
+        },
+        post: {
+          operationId: "invitations.send",
+          tags: ["invitations"],
+          summary: "Send an invitation",
+          requestBody: jsonBody(
+            {
+              email: { type: "string" },
+              organization_id: { type: "string" },
+              inviter_user_id: { type: "string" },
+              role_slug: { type: "string" }
+            },
+            ["email", "organization_id"],
+            "The invitation to send."
+          ),
+          responses: {
+            "201": ok("The created invitation."),
+            "404": ok("Organization not found."),
+            "422": ok("Validation error.")
+          }
+        }
+      },
+      "/user_management/invitations/{id}/accept": {
+        post: {
+          operationId: "invitations.accept",
+          tags: ["invitations"],
+          summary: "Accept a pending invitation",
+          parameters: [id],
+          responses: {
+            "200": ok("The accepted invitation."),
+            "400": ok("Invitation is not pending."),
+            "404": ok("Not found.")
+          }
+        }
+      },
+      "/user_management/users/{id}/api_keys": {
+        get: {
+          operationId: "userApiKeys.list",
+          tags: ["api-keys"],
+          summary: "List a user's API keys",
+          parameters: [id, query("organization_id", "Filter by organization.")],
+          responses: { "200": ok("API key list.") }
+        },
+        post: {
+          operationId: "userApiKeys.create",
+          tags: ["api-keys"],
+          summary: "Create an API key for a user",
+          parameters: [id],
+          requestBody: jsonBody(
+            { name: { type: "string" }, organization_id: { type: "string" } },
+            [],
+            "The API key to create."
+          ),
+          responses: {
+            "201": ok("The created key (value shown once)."),
+            "404": ok("User not found.")
+          }
+        }
+      },
+      "/api_keys/validations": {
+        post: {
+          operationId: "apiKeys.validate",
+          tags: ["api-keys"],
+          summary: "Validate an API key value",
+          requestBody: jsonBody({ value: { type: "string" } }, ["value"], "The API key value to validate."),
+          responses: { "200": ok("The matching key."), "404": ok("Invalid API key.") }
+        }
+      },
+      "/api_keys/{id}": {
+        delete: {
+          operationId: "apiKeys.delete",
+          tags: ["api-keys"],
+          summary: "Delete an API key",
+          parameters: [id],
+          responses: { "204": noContent("Deleted."), "404": ok("Not found.") }
+        }
+      },
+      "/organizations": {
+        post: {
+          operationId: "organizations.create",
+          tags: ["organizations"],
+          summary: "Create an organization",
+          requestBody: jsonBody(
+            { name: { type: "string" }, external_id: { type: "string" } },
+            ["name"],
+            "The organization to create."
+          ),
+          responses: { "201": ok("The created organization."), "422": ok("Validation error.") }
+        }
+      },
+      "/organizations/{id}": {
+        get: {
+          operationId: "organizations.get",
+          tags: ["organizations"],
+          summary: "Retrieve an organization",
+          parameters: [id],
+          responses: { "200": ok("The organization."), "404": ok("Not found.") }
+        },
+        put: {
+          operationId: "organizations.update",
+          tags: ["organizations"],
+          summary: "Update an organization",
+          parameters: [id],
+          requestBody: jsonBody({ name: { type: "string" } }, [], "Fields to update."),
+          responses: { "200": ok("The updated organization."), "404": ok("Not found.") }
+        }
+      },
+      "/organizations/{id}/roles": {
+        get: {
+          operationId: "organizations.roles",
+          tags: ["organizations"],
+          summary: "List an organization's roles",
+          parameters: [id],
+          responses: { "200": ok("Role list."), "404": ok("Not found.") }
+        }
+      },
+      "/sso/jwks/{clientId}": {
+        get: {
+          operationId: "sso.jwks",
+          tags: ["oauth"],
+          summary: "JWKS for verifying issued access tokens",
+          security: [],
+          parameters: [{ name: "clientId", in: "path", required: true, schema: { type: "string" } }],
+          responses: { "200": ok("JSON Web Key Set.") }
+        }
+      },
+      "/.well-known/oauth-authorization-server": {
+        get: {
+          operationId: "oauth.metadata",
+          tags: ["oauth"],
+          summary: "OAuth authorization-server metadata",
+          security: [],
+          responses: { "200": ok("Authorization-server metadata.") }
+        }
+      },
+      "/oauth2/register": {
+        post: {
+          operationId: "oauth.register",
+          tags: ["oauth"],
+          summary: "Dynamically register an OAuth client",
+          security: [],
+          requestBody: jsonBody(
+            {
+              redirect_uris: { type: "array", items: { type: "string" } },
+              client_name: { type: "string" }
+            },
+            [],
+            "The client to register."
+          ),
+          responses: { "201": ok("The registered client.") }
+        }
+      },
+      "/oauth2/token": {
+        post: {
+          operationId: "oauth.token",
+          tags: ["oauth"],
+          summary: "Exchange an authorization code or refresh token for tokens",
+          security: [],
+          requestBody: {
+            required: true,
+            description: "Form-encoded or JSON. authorization_code grants need `code`; refresh_token grants need `refresh_token`.",
+            content: {
+              "application/x-www-form-urlencoded": {
+                schema: {
+                  type: "object",
+                  properties: {
+                    grant_type: {
+                      type: "string",
+                      enum: ["authorization_code", "refresh_token"]
+                    },
+                    code: { type: "string" },
+                    refresh_token: { type: "string" }
+                  },
+                  required: ["grant_type"]
+                }
+              },
+              "application/json": {
+                schema: {
+                  type: "object",
+                  properties: {
+                    grant_type: {
+                      type: "string",
+                      enum: ["authorization_code", "refresh_token"]
+                    },
+                    code: { type: "string" },
+                    refresh_token: { type: "string" }
+                  },
+                  required: ["grant_type"]
+                }
+              }
+            }
+          },
+          responses: { "200": ok("Access and refresh tokens."), "400": ok("Invalid grant.") }
+        }
+      },
+      "/vault/v1/kv": {
+        post: {
+          operationId: "vault.create",
+          tags: ["vault"],
+          summary: "Create a Vault KV object",
+          requestBody: jsonBody(
+            {
+              name: { type: "string" },
+              value: { type: "string" },
+              key_context: { type: "object" }
+            },
+            ["name"],
+            "The object to create."
+          ),
+          responses: {
+            "201": ok("The created object's metadata."),
+            "400": ok("Validation error."),
+            "409": ok("Name already exists.")
+          }
+        },
+        get: {
+          operationId: "vault.list",
+          tags: ["vault"],
+          summary: "List Vault KV objects",
+          responses: { "200": ok("Object list (id + name).") }
+        }
+      },
+      "/vault/v1/kv/name/{name}": {
+        get: {
+          operationId: "vault.readByName",
+          tags: ["vault"],
+          summary: "Read a Vault KV object by name",
+          parameters: [{ name: "name", in: "path", required: true, schema: { type: "string" } }],
+          responses: { "200": ok("The object."), "404": ok("Not found.") }
+        }
+      },
+      "/vault/v1/kv/{id}": {
+        get: {
+          operationId: "vault.read",
+          tags: ["vault"],
+          summary: "Read a Vault KV object",
+          parameters: [id],
+          responses: { "200": ok("The object."), "404": ok("Not found.") }
+        },
+        put: {
+          operationId: "vault.update",
+          tags: ["vault"],
+          summary: "Update a Vault KV object's value",
+          parameters: [id],
+          requestBody: jsonBody(
+            { value: { type: "string" }, version_check: { type: "string" } },
+            [],
+            "The new value; pass `version_check` for optimistic concurrency."
+          ),
+          responses: {
+            "200": ok("The updated object."),
+            "404": ok("Not found."),
+            "409": ok("Version check failed.")
+          }
+        },
+        delete: {
+          operationId: "vault.delete",
+          tags: ["vault"],
+          summary: "Delete a Vault KV object",
+          parameters: [id],
+          responses: { "204": noContent("Deleted."), "404": ok("Not found.") }
+        }
+      }
+    }
+  };
+}
 var manifest = {
   id: "workos",
   name: "WorkOS",
@@ -1144,43 +1560,120 @@ var manifest = {
   docsUrl: "https://docs.emulators.dev/workos",
   surfaces: [
     { id: "rest", kind: "rest", title: "WorkOS REST API", status: "partial", basePath: "/" },
-    { id: "authkit", kind: "ui", title: "Hosted AuthKit login", status: "supported", basePath: "/user_management/authorize" },
+    {
+      id: "authkit",
+      kind: "ui",
+      title: "Hosted AuthKit login",
+      status: "supported",
+      basePath: "/user_management/authorize"
+    },
     { id: "oauth", kind: "rest", title: "OAuth authorization server (MCP)", status: "supported", basePath: "/oauth2" },
     { id: "vault", kind: "rest", title: "Vault KV", status: "supported", basePath: "/vault/v1/kv" }
   ],
   auth: [{ id: "api-key", title: "WorkOS secret key", type: "api-key", status: "supported" }],
   specs: [
     {
-      kind: "manual",
+      kind: "openapi",
       title: "WorkOS User Management + Organizations subset",
       coverage: "hand-authored",
+      url: "/openapi.json",
       operations: [
-        { operationId: "userManagement.authorize", method: "GET", path: "/user_management/authorize", status: "hand-authored" },
-        { operationId: "userManagement.authenticate", method: "POST", path: "/user_management/authenticate", status: "hand-authored" },
-        { operationId: "userManagement.getUser", method: "GET", path: "/user_management/users/:id", status: "hand-authored" },
-        { operationId: "memberships.list", method: "GET", path: "/user_management/organization_memberships", status: "hand-authored" },
-        { operationId: "memberships.create", method: "POST", path: "/user_management/organization_memberships", status: "hand-authored" },
-        { operationId: "memberships.get", method: "GET", path: "/user_management/organization_memberships/:id", status: "hand-authored" },
-        { operationId: "memberships.update", method: "PUT", path: "/user_management/organization_memberships/:id", status: "hand-authored" },
-        { operationId: "memberships.delete", method: "DELETE", path: "/user_management/organization_memberships/:id", status: "hand-authored" },
-        { operationId: "invitations.list", method: "GET", path: "/user_management/invitations", status: "hand-authored" },
-        { operationId: "invitations.send", method: "POST", path: "/user_management/invitations", status: "hand-authored" },
-        { operationId: "invitations.accept", method: "POST", path: "/user_management/invitations/:id/accept", status: "hand-authored" },
-        { operationId: "userApiKeys.list", method: "GET", path: "/user_management/users/:id/api_keys", status: "hand-authored" },
-        { operationId: "userApiKeys.create", method: "POST", path: "/user_management/users/:id/api_keys", status: "hand-authored" },
+        {
+          operationId: "userManagement.authenticate",
+          method: "POST",
+          path: "/user_management/authenticate",
+          status: "hand-authored"
+        },
+        {
+          operationId: "userManagement.getUser",
+          method: "GET",
+          path: "/user_management/users/:id",
+          status: "hand-authored"
+        },
+        {
+          operationId: "memberships.list",
+          method: "GET",
+          path: "/user_management/organization_memberships",
+          status: "hand-authored"
+        },
+        {
+          operationId: "memberships.create",
+          method: "POST",
+          path: "/user_management/organization_memberships",
+          status: "hand-authored"
+        },
+        {
+          operationId: "memberships.get",
+          method: "GET",
+          path: "/user_management/organization_memberships/:id",
+          status: "hand-authored"
+        },
+        {
+          operationId: "memberships.update",
+          method: "PUT",
+          path: "/user_management/organization_memberships/:id",
+          status: "hand-authored"
+        },
+        {
+          operationId: "memberships.delete",
+          method: "DELETE",
+          path: "/user_management/organization_memberships/:id",
+          status: "hand-authored"
+        },
+        {
+          operationId: "invitations.list",
+          method: "GET",
+          path: "/user_management/invitations",
+          status: "hand-authored"
+        },
+        {
+          operationId: "invitations.send",
+          method: "POST",
+          path: "/user_management/invitations",
+          status: "hand-authored"
+        },
+        {
+          operationId: "invitations.accept",
+          method: "POST",
+          path: "/user_management/invitations/:id/accept",
+          status: "hand-authored"
+        },
+        {
+          operationId: "userApiKeys.list",
+          method: "GET",
+          path: "/user_management/users/:id/api_keys",
+          status: "hand-authored"
+        },
+        {
+          operationId: "userApiKeys.create",
+          method: "POST",
+          path: "/user_management/users/:id/api_keys",
+          status: "hand-authored"
+        },
         { operationId: "apiKeys.validate", method: "POST", path: "/api_keys/validations", status: "hand-authored" },
         { operationId: "apiKeys.delete", method: "DELETE", path: "/api_keys/:id", status: "hand-authored" },
         { operationId: "organizations.create", method: "POST", path: "/organizations", status: "hand-authored" },
         { operationId: "organizations.get", method: "GET", path: "/organizations/:id", status: "hand-authored" },
         { operationId: "organizations.update", method: "PUT", path: "/organizations/:id", status: "hand-authored" },
-        { operationId: "organizations.roles", method: "GET", path: "/organizations/:id/roles", status: "hand-authored" },
+        {
+          operationId: "organizations.roles",
+          method: "GET",
+          path: "/organizations/:id/roles",
+          status: "hand-authored"
+        },
         { operationId: "sso.jwks", method: "GET", path: "/sso/jwks/:clientId", status: "hand-authored" },
-        { operationId: "oauth.metadata", method: "GET", path: "/.well-known/oauth-authorization-server", status: "hand-authored" },
+        {
+          operationId: "oauth.metadata",
+          method: "GET",
+          path: "/.well-known/oauth-authorization-server",
+          status: "hand-authored"
+        },
         { operationId: "oauth.register", method: "POST", path: "/oauth2/register", status: "hand-authored" },
-        { operationId: "oauth.authorize", method: "GET", path: "/oauth2/authorize", status: "hand-authored" },
         { operationId: "oauth.token", method: "POST", path: "/oauth2/token", status: "hand-authored" },
         { operationId: "vault.create", method: "POST", path: "/vault/v1/kv", status: "hand-authored" },
+        { operationId: "vault.list", method: "GET", path: "/vault/v1/kv", status: "hand-authored" },
         { operationId: "vault.readByName", method: "GET", path: "/vault/v1/kv/name/:name", status: "hand-authored" },
+        { operationId: "vault.read", method: "GET", path: "/vault/v1/kv/:id", status: "hand-authored" },
         { operationId: "vault.update", method: "PUT", path: "/vault/v1/kv/:id", status: "hand-authored" },
         { operationId: "vault.delete", method: "DELETE", path: "/vault/v1/kv/:id", status: "hand-authored" }
       ]
@@ -1233,6 +1726,12 @@ var manifest = {
 };
 function seedFromConfig(store, _baseUrl, config) {
   const ws = getWorkosStore(store);
+  if (config.oauth !== void 0) {
+    const ttl = config.oauth.default_access_token_ttl_seconds ?? null;
+    const existing = ws.oauthSettings.all()[0];
+    if (existing) ws.oauthSettings.update(existing.id, { default_access_token_ttl_seconds: ttl });
+    else ws.oauthSettings.insert({ default_access_token_ttl_seconds: ttl });
+  }
   for (const user of config.users ?? []) {
     const created = ensureUserByEmail(ws, user.email);
     if (user.first_name || user.last_name) {
@@ -1269,6 +1768,7 @@ var workosPlugin = {
     organizationRoutes(ctx);
     apiKeyRoutes(ctx);
     vaultRoutes(ctx);
+    openapiRoutes(ctx);
   },
   seed(_store, _baseUrl) {
   }
@@ -1281,4 +1781,4 @@ export {
   seedFromConfig,
   workosPlugin
 };
-//# sourceMappingURL=dist-IYZPDKJW.js.map
+//# sourceMappingURL=dist-S47YJ552.js.map