@workos/openapi-spec 0.6.0 → 0.7.0

package/README.md

@@ -74,6 +74,35 @@ npm run sdk:compat-summary -- --report .oagen/python/compat-report.json --report
 npm run sdk:compat-summary -- --report .oagen/python/compat-report.json --output summary.md
 ```
 
+### SDK changelog metadata
+
+The SDK PR workflow writes `.changelog-pending/*.md` fragments from deterministic release entries generated by [`scripts/sdk-release-metadata.mjs`](scripts/sdk-release-metadata.mjs). Entries answer three questions: where the change occurred (`scope`), how severe it is (`feat!`, `feat`, or `fix`), and what changed. Known scopes also include `docs_url`, which the changelog renderer uses to link scope names to WorkOS API reference pages.
+
+Each entry includes `scope_sources` and `scope_candidates` so the chosen scope can be audited. Model and enum scope resolution uses parsed IR references when no explicit symbol taxonomy matches; if the symbol taxonomy and IR references disagree, the script emits a warning with both values. Automated runs pass `--strict-scopes`, which fails the workflow if a user-facing entry resolves to the fallback `sdk` scope or lacks `docs_url` metadata.
+
+In automation, `.github/workflows/generate-prs.yml` provides the structured `oagen diff`, parsed old/new IR, compat report, and changed SDK files. The script outputs JSON entries; the workflow creates the PR and adds the PR link/number when writing the changelog fragment.
+
+For manual repair of existing fragments, pass the `openapi-spec` workflow commit that triggered the SDK PR. The script uses the spec state at that commit and diffs it against the previous spec-changing commit.
+
+```bash
+# JSON entries, useful for inspection
+node scripts/sdk-release-metadata.mjs \
+  --spec-commit dee95fc \
+  --sdk-repo ../backend/workos-dotnet
+
+# Full markdown fragment for replacing an existing .changelog-pending file
+node scripts/sdk-release-metadata.mjs \
+  --spec-commit dee95fc \
+  --sdk-repo ../backend/workos-dotnet \
+  --format changelog \
+  --pr-number 263 \
+  --pr-url https://github.com/workos/workos-dotnet/pull/263
+```
+
+`--pr-number` and `--pr-url` only affect manual `--format changelog` output: they render the first fragment line with a PR link. Automated runs do not pass them because the workflow already gets the PR URL from `gh pr create`.
+
+Run `node scripts/sdk-release-metadata.mjs --help` for all options.
+
 ### Local development
 
 Install dependencies:

package/dist/policy.mjs

@@ -7,6 +7,7 @@ import { toCamelCase } from "@workos/oagen";
 const operationHints = {
 	"POST /radar/lists/{type}/{action}": { name: "add_list_entry" },
 	"DELETE /radar/lists/{type}/{action}": { name: "remove_list_entry" },
+	"POST /data-integrations/{provider}/token": { name: "get_access_token" },
 	"GET /sso/authorize": {
 		name: "get_authorization_url",
 		defaults: { response_type: "code" },
@@ -379,6 +380,26 @@ function transformSpec(spec) {
 	}
 	delete schemas["UserlandUserOrganizationMembershipBaseWithUser"];
 	delete schemas["UserlandUserOrganizationMembershipBaseWithUserList"];
+	const tokenResponse = schemas["DataIntegrationAccessTokenResponse"];
+	for (const variant of tokenResponse?.oneOf ?? []) {
+		const expiresAt = variant.properties?.access_token?.properties?.expires_at;
+		if (expiresAt && expiresAt.format === void 0) expiresAt.format = "date-time";
+		const errorEnum = variant.properties?.error?.enum;
+		if (Array.isArray(errorEnum) && errorEnum.length === 2 && errorEnum[0] === "needs_reauthorization" && errorEnum[1] === "not_installed") errorEnum.reverse();
+	}
+	const slugTokenPath = "/data-integrations/{slug}/token";
+	const providerTokenPath = "/data-integrations/{provider}/token";
+	const tokenPathItem = paths[slugTokenPath];
+	if (tokenPathItem && !paths[providerTokenPath]) {
+		for (const [key, member] of Object.entries(tokenPathItem)) {
+			const params = key === "parameters" ? member : member?.parameters;
+			for (const param of params ?? []) if (param.in === "path" && param.name === "slug") param.name = "provider";
+		}
+		paths[providerTokenPath] = tokenPathItem;
+		delete paths[slugTokenPath];
+	}
+	const orgIdProp = (paths[providerTokenPath]?.post?.requestBody?.content?.["application/json"]?.schema)?.properties?.organization_id;
+	if (orgIdProp && orgIdProp.type === "string") orgIdProp.type = ["string", "null"];
 	if (schemas["JwtTemplate"] && !schemas["JwtTemplateResponse"]) {
 		schemas["JwtTemplateResponse"] = schemas["JwtTemplate"];
 		delete schemas["JwtTemplate"];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@workos/openapi-spec",
-  "version": "0.6.0",
+  "version": "0.7.0",
   "type": "module",
   "description": "WorkOS OpenAPI specification, TypeScript types, and SDK resolution policy",
   "license": "MIT",
@@ -26,7 +26,7 @@
     "./package.json": "./package.json"
   },
   "dependencies": {
-    "@workos/oagen": "^0.22.4"
+    "@workos/oagen": "^0.22.6"
   },
   "scripts": {
     "build:policy": "tsdown",
@@ -54,13 +54,13 @@
   },
   "devDependencies": {
     "@types/js-yaml": "^4.0.9",
-    "@types/node": "^25.9.1",
-    "@workos/oagen-emitters": "^0.16.0",
+    "@types/node": "^25.9.3",
+    "@workos/oagen-emitters": "^0.18.1",
     "diff2html": "^3.4.56",
     "husky": "^9.1.7",
     "js-yaml": "^4.2.0",
-    "openapi-to-postmanv2": "^6.0.1",
-    "tsdown": "^0.22.1",
+    "openapi-to-postmanv2": "^6.1.0",
+    "tsdown": "^0.22.3",
     "tsx": "^4.22.4",
     "typescript": "^6.0.3"
   }