auth0-deploy-cli 8.35.0 → 8.37.0

package/.github/workflows/npm-publish.yml

@@ -14,9 +14,9 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: 22.14.0
           registry-url: https://registry.npmjs.org

package/CHANGELOG.md

@@ -7,6 +7,27 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [8.37.0] - 2026-06-17
+
+### Added
+
+- Add `invitation_landing_client_id` support to `my_organization_configuration` on the Client entity, with client ID-to-name resolution on export and name-to-ID resolution on import. [#1400]
+
+### Fixed
+
+- Remove `enable_custom_domain_in_emails` from managed tenant flags to prevent import failures on tenants without a ready custom domain. [#1401]
+- Remove incorrect `maximum: 10` constraint on Network ACL `priority` field in schema validation. [#1403]
+
+## [8.36.0] - 2026-06-05
+
+### Added
+
+- Add optional flag to skip secret masking during export. [#1396]
+
+### Fixed
+
+- Remove stale connection files from directory export when connections are deleted. [#1389]
+
 ## [8.35.0] - 2026-05-22
 
 ### Added
@@ -1797,9 +1818,16 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 [#1385]: https://github.com/auth0/auth0-deploy-cli/issues/1385
 [#1386]: https://github.com/auth0/auth0-deploy-cli/issues/1386
 [#1387]: https://github.com/auth0/auth0-deploy-cli/issues/1387
+[#1389]: https://github.com/auth0/auth0-deploy-cli/issues/1389
 [#1391]: https://github.com/auth0/auth0-deploy-cli/issues/1391
 [#1392]: https://github.com/auth0/auth0-deploy-cli/issues/1392
-[Unreleased]: https://github.com/auth0/auth0-deploy-cli/compare/v8.35.0...HEAD
+[#1396]: https://github.com/auth0/auth0-deploy-cli/issues/1396
+[#1400]: https://github.com/auth0/auth0-deploy-cli/issues/1400
+[#1401]: https://github.com/auth0/auth0-deploy-cli/issues/1401
+[#1403]: https://github.com/auth0/auth0-deploy-cli/issues/1403
+[Unreleased]: https://github.com/auth0/auth0-deploy-cli/compare/v8.37.0...HEAD
+[8.37.0]: https://github.com/auth0/auth0-deploy-cli/compare/v8.36.0...v8.37.0
+[8.36.0]: https://github.com/auth0/auth0-deploy-cli/compare/v8.35.0...v8.36.0
 [8.35.0]: https://github.com/auth0/auth0-deploy-cli/compare/v8.34.0...v8.35.0
 [8.34.0]: https://github.com/auth0/auth0-deploy-cli/compare/v8.33.0...v8.34.0
 [8.33.0]: https://github.com/auth0/auth0-deploy-cli/compare/v8.32.0...v8.33.0

package/lib/args.d.ts

@@ -21,6 +21,7 @@ type ExportSpecificParams = {
     output_folder: string;
     export_ids?: boolean;
     export_ordered?: boolean;
+    export_secrets?: boolean;
 };
 export type ExportParams = ExportSpecificParams & SharedParams;
 export type ImportParams = ImportSpecificParams & SharedParams;

package/lib/args.js

@@ -103,6 +103,11 @@ function getParams() {
             describe: 'Order keys in exported JSON files for consistent diffs.',
             type: 'boolean',
         },
+        export_secrets: {
+            describe: 'Export actual secret values instead of placeholder markers.',
+            type: 'boolean',
+            default: false,
+        },
     })
         .example('$0 export -c config.json -f yaml -o path/to/export', 'Dump Auth0 config to folder in YAML format')
         .example('$0 export -c config.json -f directory -o path/to/export', 'Dump Auth0 config to folder in directory format')

package/lib/commands/export.js

@@ -11,7 +11,7 @@ const logger_1 = __importDefault(require("../logger"));
 const utils_1 = require("../utils");
 const index_1 = require("../context/index");
 async function exportCMD(params) {
-    const { output_folder: outputFolder, base_path: basePath, config_file: configFile, config: configObj, export_ids: exportIds, export_ordered: exportOrdered, secret: clientSecret, env: shouldInheritEnv = false, experimental_ea: experimentalEA, } = params;
+    const { output_folder: outputFolder, base_path: basePath, config_file: configFile, config: configObj, export_ids: exportIds, export_ordered: exportOrdered, export_secrets: exportSecrets, secret: clientSecret, env: shouldInheritEnv = false, experimental_ea: experimentalEA, } = params;
     if (shouldInheritEnv) {
         nconf_1.default.env().use('memory');
     }
@@ -36,6 +36,10 @@ async function exportCMD(params) {
     if (exportOrdered) {
         overrides.AUTH0_EXPORT_ORDERED = exportOrdered;
     }
+    // Allow passed in export_secrets to override the configured one
+    if (exportSecrets) {
+        overrides.AUTH0_EXPORT_SECRETS = exportSecrets;
+    }
     // Overrides AUTH0_INCLUDE_EXPERIMENTAL_EA is experimental_ea passed in command line
     if (experimentalEA) {
         overrides.AUTH0_EXPERIMENTAL_EA = experimentalEA;

package/lib/context/defaults.d.ts

@@ -1,7 +1,8 @@
 import { AttackProtection } from '../tools/auth0/handlers/attackProtection';
-export declare function emailProviderDefaults(emailProvider: any): any;
+import { Config } from '../types';
+export declare function emailProviderDefaults(emailProvider: any, config?: Pick<Config, 'AUTH0_EXPORT_SECRETS'>): any;
 export declare function phoneProviderDefaults(phoneProvider: any): any;
 export declare function phoneTemplatesDefaults(phoneTemplate: any): any;
-export declare function connectionDefaults(connection: any): any;
-export declare function logStreamDefaults(logStreams: any): any;
-export declare function attackProtectionDefaults(attackProtection: AttackProtection): AttackProtection;
+export declare function connectionDefaults(connection: any, config?: Pick<Config, 'AUTH0_EXPORT_SECRETS'>): any;
+export declare function logStreamDefaults(logStreams: any, config?: Pick<Config, 'AUTH0_EXPORT_SECRETS'>): any;
+export declare function attackProtectionDefaults(attackProtection: AttackProtection, config?: Pick<Config, 'AUTH0_EXPORT_SECRETS'>): AttackProtection;

package/lib/context/defaults.js

@@ -7,9 +7,15 @@ exports.connectionDefaults = connectionDefaults;
 exports.logStreamDefaults = logStreamDefaults;
 exports.attackProtectionDefaults = attackProtectionDefaults;
 const utils_1 = require("../tools/utils");
+// env vars arrive as strings, so check both forms
+function isExportSecrets(config) {
+    return (config?.AUTH0_EXPORT_SECRETS === true || config?.AUTH0_EXPORT_SECRETS === 'true');
+}
 // eslint-disable-next-line import/prefer-default-export
-function emailProviderDefaults(emailProvider) {
+function emailProviderDefaults(emailProvider, config) {
     // eslint-disable-line
+    if (isExportSecrets(config))
+        return emailProvider;
     const updated = { ...emailProvider };
     const apiKeyProviders = ['mailgun', 'mandrill', 'sendgrid', 'sparkpost'];
     // Add placeholder for credentials as they cannot be exported
@@ -100,8 +106,8 @@ function phoneTemplatesDefaults(phoneTemplate) {
     });
     return updated;
 }
-function connectionDefaults(connection) {
-    if (connection.options) {
+function connectionDefaults(connection, config) {
+    if (!isExportSecrets(config) && connection.options) {
         // Mask secret for key: connection.options.client_secret
         (0, utils_1.maskSecretAtPath)({
             resourceTypeName: 'connections',
@@ -112,7 +118,9 @@ function connectionDefaults(connection) {
     }
     return connection;
 }
-function logStreamDefaults(logStreams) {
+function logStreamDefaults(logStreams, config) {
+    if (isExportSecrets(config))
+        return logStreams;
     // masked sensitive fields
     const sensitiveKeys = [
         'httpAuthorization',
@@ -138,7 +146,9 @@ function logStreamDefaults(logStreams) {
     });
     return maskedLogStreams;
 }
-function attackProtectionDefaults(attackProtection) {
+function attackProtectionDefaults(attackProtection, config) {
+    if (isExportSecrets(config))
+        return attackProtection;
     const { captcha } = attackProtection;
     if (captcha) {
         const providersWithSecrets = ['arkose', 'hcaptcha', 'friendly_captcha', 'recaptcha_v2'];

package/lib/context/directory/handlers/attackProtection.js

@@ -65,7 +65,7 @@ async function dump(context) {
         return;
     const files = attackProtectionFiles(context.filePath);
     fs_extra_1.default.ensureDirSync(files.directory);
-    const maskedAttackProtection = (0, defaults_1.attackProtectionDefaults)(attackProtection);
+    const maskedAttackProtection = (0, defaults_1.attackProtectionDefaults)(attackProtection, context.config);
     if (maskedAttackProtection.botDetection) {
         (0, utils_1.dumpJSON)(files.botDetection, maskedAttackProtection.botDetection);
     }

package/lib/context/directory/handlers/clients.js

@@ -90,6 +90,12 @@ async function dump(context) {
                 client.my_organization_configuration.connection_profile_id =
                     c?.name || myOrganizationConnectionProfileId;
             }
+            const invitationLandingClientId = client.my_organization_configuration.invitation_landing_client_id;
+            if (invitationLandingClientId) {
+                const c = clients?.find((cl) => cl.client_id === invitationLandingClientId);
+                client.my_organization_configuration.invitation_landing_client_id =
+                    c?.name || invitationLandingClientId;
+            }
         }
         if (client.app_type === 'express_configuration') {
             // only keep relevant fields for express configuration

package/lib/context/directory/handlers/connections.js

@@ -51,6 +51,14 @@ async function dump(context) {
     }
     const connectionsFolder = path_1.default.join(context.filePath, tools_1.constants.CONNECTIONS_DIRECTORY);
     fs_extra_1.default.ensureDirSync(connectionsFolder);
+    // Track files that should remain after dump (written + excluded).
+    // Seed from exclude names directly so excluded connections' files are preserved
+    // regardless of whether the connection still exists on the tenant.
+    const expectedFiles = new Set();
+    for (const name of excludedConnections) {
+        expectedFiles.add(`${(0, utils_1.sanitize)(name)}.json`);
+        expectedFiles.add(`${(0, utils_1.sanitize)(name)}.html`);
+    }
     // Convert enabled_clients from id to name
     connections.forEach((connection) => {
         let dumpedConnection = {
@@ -62,7 +70,7 @@ async function dump(context) {
         };
         const connectionName = (0, utils_1.sanitize)(dumpedConnection.name);
         // Mask secrets
-        dumpedConnection = (0, defaults_1.connectionDefaults)(dumpedConnection);
+        dumpedConnection = (0, defaults_1.connectionDefaults)(dumpedConnection, context.config);
         if (dumpedConnection.strategy === 'email') {
             (0, utils_1.ensureProp)(dumpedConnection, 'options.email.body');
             const html = dumpedConnection.options.email.body;
@@ -81,7 +89,19 @@ async function dump(context) {
         }
         const connectionFile = path_1.default.join(connectionsFolder, `${connectionName}.json`);
         (0, utils_1.dumpJSON)(connectionFile, dumpedConnection);
+        expectedFiles.add(`${connectionName}.json`);
+        if (dumpedConnection.strategy === 'email')
+            expectedFiles.add(`${connectionName}.html`);
     });
+    // Remove files that belong to connections no longer present (and not excluded)
+    if (fs_extra_1.default.existsSync(connectionsFolder)) {
+        for (const existing of fs_extra_1.default.readdirSync(connectionsFolder)) {
+            const fullPath = path_1.default.join(connectionsFolder, existing);
+            if (fs_extra_1.default.statSync(fullPath).isFile() && !expectedFiles.has(existing)) {
+                fs_extra_1.default.removeSync(fullPath);
+            }
+        }
+    }
 }
 const connectionsHandler = {
     parse,

package/lib/context/directory/handlers/emailProvider.js

@@ -31,7 +31,7 @@ async function dump(context) {
         const excludedDefaults = context.assets.exclude?.defaults || [];
         if (!excludedDefaults.includes('emailProvider')) {
             // Add placeholder for credentials as they cannot be exported
-            return (0, defaults_1.emailProviderDefaults)(context.assets.emailProvider);
+            return (0, defaults_1.emailProviderDefaults)(context.assets.emailProvider, context.config);
         }
         return context.assets.emailProvider;
     })();

package/lib/context/directory/handlers/logStreams.js

@@ -31,7 +31,7 @@ async function dump(context) {
     const logStreamsDirectory = path_1.default.join(context.filePath, tools_1.constants.LOG_STREAMS_DIRECTORY);
     fs_extra_1.default.ensureDirSync(logStreamsDirectory);
     // masked sensitive fields
-    const maskedLogStreams = (0, defaults_1.logStreamDefaults)(logStreams);
+    const maskedLogStreams = (0, defaults_1.logStreamDefaults)(logStreams, context.config);
     maskedLogStreams.forEach((logStream) => {
         const ruleFile = path_1.default.join(logStreamsDirectory, `${(0, utils_1.sanitize)(logStream.name)}.json`);
         (0, utils_1.dumpJSON)(ruleFile, logStream);

package/lib/context/directory/index.js

@@ -126,6 +126,18 @@ class DirectoryContext {
         else {
             this.assets = auth0.assets;
         }
+        // Re-attach exclude/include config lost when assets was overwritten above
+        this.assets.exclude = {
+            rules: this.config.AUTH0_EXCLUDED_RULES || [],
+            clients: this.config.AUTH0_EXCLUDED_CLIENTS || [],
+            databases: this.config.AUTH0_EXCLUDED_DATABASES || [],
+            connections: this.config.AUTH0_EXCLUDED_CONNECTIONS || [],
+            resourceServers: this.config.AUTH0_EXCLUDED_RESOURCE_SERVERS || [],
+            defaults: this.config.AUTH0_EXCLUDED_DEFAULTS || [],
+        };
+        this.assets.include = {
+            connections: this.config.AUTH0_INCLUDED_CONNECTIONS || [],
+        };
         // Clean known read only fields
         this.assets = (0, readonly_1.default)(this.assets, this.config);
         // Copy clients to be used by handlers which require converting client_id to the name

package/lib/context/yaml/handlers/attackProtection.js

@@ -25,7 +25,7 @@ async function dump(context) {
     if (captcha) {
         attackProtectionConfig.captcha = captcha;
     }
-    const maskedAttackProtection = (0, defaults_1.attackProtectionDefaults)(attackProtectionConfig);
+    const maskedAttackProtection = (0, defaults_1.attackProtectionDefaults)(attackProtectionConfig, context.config);
     return {
         attackProtection: maskedAttackProtection,
     };

package/lib/context/yaml/handlers/clients.js

@@ -70,6 +70,12 @@ async function dump(context) {
             client.my_organization_configuration.connection_profile_id =
                 c?.name || myOrganizationConnectionProfileId;
         }
+        const invitationLandingClientId = client?.my_organization_configuration?.invitation_landing_client_id;
+        if (client.my_organization_configuration && invitationLandingClientId) {
+            const c = clients?.find((cl) => cl.client_id === invitationLandingClientId);
+            client.my_organization_configuration.invitation_landing_client_id =
+                c?.name || invitationLandingClientId;
+        }
         return client;
     });
     return {

package/lib/context/yaml/handlers/connections.js

@@ -53,7 +53,7 @@ async function dump(context) {
                 }),
             };
             // Mask secrets
-            dumpedConnection = (0, defaults_1.connectionDefaults)(dumpedConnection);
+            dumpedConnection = (0, defaults_1.connectionDefaults)(dumpedConnection, context.config);
             if (dumpedConnection.strategy === 'email') {
                 (0, utils_1.ensureProp)(connection, 'options.email.body');
                 const connectionsFolder = path_1.default.join(context.basePath, tools_1.constants.CONNECTIONS_DIRECTORY);

package/lib/context/yaml/handlers/emailProvider.js

@@ -17,7 +17,7 @@ async function dump(context) {
         const excludedDefaults = context.assets.exclude?.defaults || [];
         if (emailProvider && !excludedDefaults.includes('emailProvider')) {
             // Add placeholder for credentials as they cannot be exported
-            return (0, defaults_1.emailProviderDefaults)(emailProvider);
+            return (0, defaults_1.emailProviderDefaults)(emailProvider, context.config);
         }
         return emailProvider;
     })();

package/lib/context/yaml/handlers/logStreams.js

@@ -14,7 +14,7 @@ async function dump(context) {
     if (!logStreams)
         return { logStreams: null };
     // masked sensitive fields
-    const maskedLogStreams = (0, defaults_1.logStreamDefaults)(logStreams);
+    const maskedLogStreams = (0, defaults_1.logStreamDefaults)(logStreams, context.config);
     return {
         logStreams: maskedLogStreams,
     };

package/lib/tools/auth0/handlers/clients.d.ts

@@ -226,6 +226,10 @@ export declare const schema: {
                         enum: ("allow" | "allow_if_empty")[];
                         description: string;
                     };
+                    invitation_landing_client_id: {
+                        type: string;
+                        description: string;
+                    };
                 };
                 required: string[];
             };

package/lib/tools/auth0/handlers/clients.js

@@ -59,6 +59,10 @@ const myOrganizationConfigurationSchema = {
             enum: Object.values(auth0_1.Management.ClientMyOrganizationDeletionBehaviorEnum),
             description: 'The deletion behavior for My Organization connections created by this client',
         },
+        invitation_landing_client_id: {
+            type: 'string',
+            description: 'The client ID of the invitation landing client for the My Organization configuration',
+        },
     },
     required: ['allowed_strategies', 'connection_deletion_behavior'],
 };
@@ -651,6 +655,14 @@ class ClientHandler extends default_1.default {
                     client.my_organization_configuration.connection_profile_id = connectionProfile.id;
                 }
             }
+            const invitationLandingClientName = client.my_organization_configuration.invitation_landing_client_id;
+            if (invitationLandingClientName) {
+                const invitationLandingClient = clientData?.find((c) => c.name === invitationLandingClientName);
+                if (invitationLandingClient?.client_id) {
+                    client.my_organization_configuration.invitation_landing_client_id =
+                        invitationLandingClient.client_id;
+                }
+            }
             return client;
         });
     }

package/lib/tools/auth0/handlers/networkACLs.d.ts

@@ -19,7 +19,6 @@ export declare const schema: {
             priority: {
                 type: string;
                 minimum: number;
-                maximum: number;
             };
             rule: {
                 anyOf: {
@@ -85,7 +84,6 @@ export declare const schema: {
                                     };
                                     uniqueItems: boolean;
                                     minItems: number;
-                                    maxItems: number;
                                 };
                                 geo_country_codes: {
                                     type: string;
@@ -94,7 +92,6 @@ export declare const schema: {
                                     };
                                     uniqueItems: boolean;
                                     minItems: number;
-                                    maxItems: number;
                                 };
                                 geo_subdivision_codes: {
                                     type: string;
@@ -103,7 +100,6 @@ export declare const schema: {
                                     };
                                     uniqueItems: boolean;
                                     minItems: number;
-                                    maxItems: number;
                                 };
                                 ipv4_cidrs: {
                                     type: string;
@@ -112,7 +108,6 @@ export declare const schema: {
                                     };
                                     uniqueItems: boolean;
                                     minItems: number;
-                                    maxItems: number;
                                 };
                                 ipv6_cidrs: {
                                     type: string;
@@ -121,7 +116,6 @@ export declare const schema: {
                                     };
                                     uniqueItems: boolean;
                                     minItems: number;
-                                    maxItems: number;
                                 };
                                 ja3_fingerprints: {
                                     type: string;
@@ -130,7 +124,6 @@ export declare const schema: {
                                     };
                                     uniqueItems: boolean;
                                     minItems: number;
-                                    maxItems: number;
                                 };
                                 ja4_fingerprints: {
                                     type: string;
@@ -139,7 +132,6 @@ export declare const schema: {
                                     };
                                     uniqueItems: boolean;
                                     minItems: number;
-                                    maxItems: number;
                                 };
                                 user_agents: {
                                     type: string;
@@ -148,7 +140,6 @@ export declare const schema: {
                                     };
                                     uniqueItems: boolean;
                                     minItems: number;
-                                    maxItems: number;
                                 };
                                 hostnames: {
                                     type: string;
@@ -184,7 +175,6 @@ export declare const schema: {
                                     };
                                     uniqueItems: boolean;
                                     minItems: number;
-                                    maxItems: number;
                                 };
                                 geo_country_codes: {
                                     type: string;
@@ -193,7 +183,6 @@ export declare const schema: {
                                     };
                                     uniqueItems: boolean;
                                     minItems: number;
-                                    maxItems: number;
                                 };
                                 geo_subdivision_codes: {
                                     type: string;
@@ -202,7 +191,6 @@ export declare const schema: {
                                     };
                                     uniqueItems: boolean;
                                     minItems: number;
-                                    maxItems: number;
                                 };
                                 ipv4_cidrs: {
                                     type: string;
@@ -211,7 +199,6 @@ export declare const schema: {
                                     };
                                     uniqueItems: boolean;
                                     minItems: number;
-                                    maxItems: number;
                                 };
                                 ipv6_cidrs: {
                                     type: string;
@@ -220,7 +207,6 @@ export declare const schema: {
                                     };
                                     uniqueItems: boolean;
                                     minItems: number;
-                                    maxItems: number;
                                 };
                                 ja3_fingerprints: {
                                     type: string;
@@ -229,7 +215,6 @@ export declare const schema: {
                                     };
                                     uniqueItems: boolean;
                                     minItems: number;
-                                    maxItems: number;
                                 };
                                 ja4_fingerprints: {
                                     type: string;
@@ -238,7 +223,6 @@ export declare const schema: {
                                     };
                                     uniqueItems: boolean;
                                     minItems: number;
-                                    maxItems: number;
                                 };
                                 user_agents: {
                                     type: string;
@@ -247,7 +231,6 @@ export declare const schema: {
                                     };
                                     uniqueItems: boolean;
                                     minItems: number;
-                                    maxItems: number;
                                 };
                                 hostnames: {
                                     type: string;

package/lib/tools/auth0/handlers/networkACLs.js

@@ -68,7 +68,6 @@ const MatchSchema = {
             },
             uniqueItems: true,
             minItems: 1,
-            maxItems: 10,
         },
         geo_country_codes: {
             type: 'array',
@@ -77,7 +76,6 @@ const MatchSchema = {
             },
             uniqueItems: true,
             minItems: 1,
-            maxItems: 10,
         },
         geo_subdivision_codes: {
             type: 'array',
@@ -86,7 +84,6 @@ const MatchSchema = {
             },
             uniqueItems: true,
             minItems: 1,
-            maxItems: 10,
         },
         ipv4_cidrs: {
             type: 'array',
@@ -95,7 +92,6 @@ const MatchSchema = {
             },
             uniqueItems: true,
             minItems: 1,
-            maxItems: 10,
         },
         ipv6_cidrs: {
             type: 'array',
@@ -104,7 +100,6 @@ const MatchSchema = {
             },
             uniqueItems: true,
             minItems: 1,
-            maxItems: 10,
         },
         ja3_fingerprints: {
             type: 'array',
@@ -113,7 +108,6 @@ const MatchSchema = {
             },
             uniqueItems: true,
             minItems: 1,
-            maxItems: 10,
         },
         ja4_fingerprints: {
             type: 'array',
@@ -122,7 +116,6 @@ const MatchSchema = {
             },
             uniqueItems: true,
             minItems: 1,
-            maxItems: 10,
         },
         user_agents: {
             type: 'array',
@@ -131,7 +124,6 @@ const MatchSchema = {
             },
             uniqueItems: true,
             minItems: 1,
-            maxItems: 10,
         },
         hostnames: {
             type: 'array',
@@ -174,7 +166,6 @@ exports.schema = {
             priority: {
                 type: 'number',
                 minimum: 1,
-                maximum: 10,
             },
             rule: {
                 anyOf: [

package/lib/tools/auth0/handlers/tenant.js

@@ -127,7 +127,6 @@ exports.allowedTenantFlags = [
     'enable_apis_section',
     'enable_pipeline2',
     'enable_dynamic_client_registration',
-    'enable_custom_domain_in_emails',
     'allow_legacy_tokeninfo_endpoint',
     'enable_legacy_profile',
     'enable_idtoken_api2',
@@ -206,7 +205,7 @@ class TenantHandler extends default_1.default {
     }
     // Run after other updates so objected can be referenced such as default directory
     async processChanges(assets) {
-        const { tenant } = assets;
+        let { tenant } = assets;
         // Do nothing if not set
         if (!tenant)
             return;
@@ -216,6 +215,15 @@ class TenantHandler extends default_1.default {
                 return;
             }
         }
+        if (tenant.flags?.enable_custom_domain_in_emails !== undefined) {
+            logger_1.default.warn('The "enable_custom_domain_in_emails" tenant flag is deprecated and has been removed from management. ' +
+                'It will not be applied during import. ' +
+                'Use the "is_default" field on customDomains to configure the default domain instead.');
+            tenant = {
+                ...tenant,
+                flags: (0, lodash_1.omit)(tenant.flags, 'enable_custom_domain_in_emails'),
+            };
+        }
         const updatedTenant = {
             ...tenant,
             flags: tenant.flags
@@ -227,11 +235,6 @@ class TenantHandler extends default_1.default {
                 delete updatedTenant.flags;
             }
         }
-        if (tenant.flags?.enable_custom_domain_in_emails !== undefined) {
-            logger_1.default.warn('The "enable_custom_domain_in_emails" tenant flag is deprecated. ' +
-                'Use the "is_default" field on customDomains to configure the default domain instead. ' +
-                'The flag will still be applied for now but will be removed in a future release.');
-        }
         if (updatedTenant && Object.keys(updatedTenant).length > 0) {
             const sessionDurations = (0, sessionDurationsToMinutes_1.default)({
                 session_lifetime: updatedTenant?.session_lifetime,

package/lib/types.d.ts

@@ -72,6 +72,7 @@ export type Config = {
     AUTH0_KEYWORD_REPLACE_MAPPINGS?: KeywordMappings;
     AUTH0_EXPORT_IDENTIFIERS?: boolean;
     AUTH0_EXPORT_ORDERED?: boolean;
+    AUTH0_EXPORT_SECRETS?: boolean;
     AUTH0_CONNECTIONS_DIRECTORY?: string;
     AUTH0_DRY_RUN?: boolean | 'preview';
     AUTH0_DRY_RUN_INTERACTIVE?: boolean;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "auth0-deploy-cli",
-  "version": "8.35.0",
+  "version": "8.37.0",
   "description": "A command line tool for deploying updates to your Auth0 tenant",
   "main": "lib/index.js",
   "bin": {
@@ -35,8 +35,8 @@
   "dependencies": {
     "@clack/prompts": "1.3.0",
     "ajv": "^6.12.6",
+    "auth0": "^5.12.0",
     "chalk": "5.6.2",
-    "auth0": "^5.9.0",
     "dot-prop": "^5.3.0",
     "fs-extra": "^10.1.0",
     "js-yaml": "^4.1.1",