auth0-deploy-cli 8.37.0 → 8.38.0

package/CHANGELOG.md

@@ -7,6 +7,20 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [8.38.0] - 2026-06-25
+
+### Added
+
+- Add `session_transfer` delegation config support for CTE impersonation on the Client entity. [#1406]
+- Add `fedcm_login` support for Google One Tap / FedCM in Universal Login on the Client entity. [#1407]
+- Add `login-post-identifier` and `signup-post-identifier` as supported action triggers. [#1409]
+- Add `allow_online_access` and `allow_online_access_with_ephemeral_sessions` fields to resource server. [#1398]
+
+### Fixed
+
+- Fix keyword placeholder validation to allow lowercase Auth0 template variables (e.g. `@@password@@`). [#1408]
+- Re-apply prompt settings after branding update to prevent Authentication Profile reset. [#1404]
+
 ## [8.37.0] - 2026-06-17
 
 ### Added
@@ -1822,10 +1836,17 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 [#1391]: https://github.com/auth0/auth0-deploy-cli/issues/1391
 [#1392]: https://github.com/auth0/auth0-deploy-cli/issues/1392
 [#1396]: https://github.com/auth0/auth0-deploy-cli/issues/1396
+[#1398]: https://github.com/auth0/auth0-deploy-cli/issues/1398
 [#1400]: https://github.com/auth0/auth0-deploy-cli/issues/1400
 [#1401]: https://github.com/auth0/auth0-deploy-cli/issues/1401
 [#1403]: https://github.com/auth0/auth0-deploy-cli/issues/1403
-[Unreleased]: https://github.com/auth0/auth0-deploy-cli/compare/v8.37.0...HEAD
+[#1404]: https://github.com/auth0/auth0-deploy-cli/issues/1404
+[#1406]: https://github.com/auth0/auth0-deploy-cli/issues/1406
+[#1407]: https://github.com/auth0/auth0-deploy-cli/issues/1407
+[#1408]: https://github.com/auth0/auth0-deploy-cli/issues/1408
+[#1409]: https://github.com/auth0/auth0-deploy-cli/issues/1409
+[Unreleased]: https://github.com/auth0/auth0-deploy-cli/compare/v8.38.0...HEAD
+[8.38.0]: https://github.com/auth0/auth0-deploy-cli/compare/v8.37.0...v8.38.0
 [8.37.0]: https://github.com/auth0/auth0-deploy-cli/compare/v8.36.0...v8.37.0
 [8.36.0]: https://github.com/auth0/auth0-deploy-cli/compare/v8.35.0...v8.36.0
 [8.35.0]: https://github.com/auth0/auth0-deploy-cli/compare/v8.34.0...v8.35.0

package/lib/tools/auth0/handlers/branding.js

@@ -130,7 +130,12 @@ class BrandingHandler extends default_1.default {
             delete brandingSettings.logo_url;
         }
         if (brandingSettings && Object.keys(brandingSettings).length) {
+            // Save prompt settings, update branding, then restore prompt settings to avoid mgmt API overwriting prompt settings
+            const promptSettings = await this.client.prompts.getSettings().catch(() => null);
             await this.client.branding.update(brandingSettings);
+            if (promptSettings) {
+                await this.client.prompts.updateSettings(promptSettings);
+            }
             this.updated += 1;
             this.didUpdate(brandingSettings);
         }

package/lib/tools/auth0/handlers/clients.d.ts

@@ -174,6 +174,22 @@ export declare const schema: {
                         description: string;
                         default: boolean;
                     };
+                    delegation: {
+                        type: string;
+                        description: string;
+                        properties: {
+                            allow_delegated_access: {
+                                type: string;
+                                description: string;
+                            };
+                            enforce_device_binding: {
+                                type: string;
+                                description: string;
+                                enum: string[];
+                            };
+                        };
+                        additionalProperties: boolean;
+                    };
                 };
                 additionalProperties: boolean;
             };
@@ -365,6 +381,22 @@ export declare const schema: {
                     };
                 };
             };
+            fedcm_login: {
+                type: string[];
+                description: string;
+                properties: {
+                    google: {
+                        type: string;
+                        properties: {
+                            is_enabled: {
+                                type: string;
+                            };
+                        };
+                        required: string[];
+                    };
+                };
+                required: string[];
+            };
         };
         required: string[];
     };

package/lib/tools/auth0/handlers/clients.js

@@ -202,6 +202,22 @@ exports.schema = {
                         description: "Indicates whether Refresh Tokens created during a native-to-web session are tied to that session's lifetime. This determines if such refresh tokens should be automatically revoked when their corresponding sessions are. Usually configured in the web application.",
                         default: true,
                     },
+                    delegation: {
+                        type: 'object',
+                        description: 'Settings for impersonation via session transfer. Required to accept Session Transfer Tokens that contain an Actor.',
+                        properties: {
+                            allow_delegated_access: {
+                                type: 'boolean',
+                                description: 'Allows clients to access an impersonated session via SSO by accepting STTs that contain an Actor.',
+                            },
+                            enforce_device_binding: {
+                                type: 'string',
+                                description: "Enforces device binding for impersonation sessions. Defaults to 'ip' when omitted.",
+                                enum: ['ip', 'asn'],
+                            },
+                        },
+                        additionalProperties: false,
+                    },
                 },
                 additionalProperties: true,
             },
@@ -379,6 +395,20 @@ exports.schema = {
                     },
                 },
             },
+            fedcm_login: {
+                type: ['object', 'null'],
+                description: 'Configuration for FedCM (Federated Credential Management) login',
+                properties: {
+                    google: {
+                        type: 'object',
+                        properties: {
+                            is_enabled: { type: 'boolean' },
+                        },
+                        required: ['is_enabled'],
+                    },
+                },
+                required: ['google'],
+            },
         },
         required: ['name'],
     },

package/lib/tools/auth0/handlers/resourceServers.d.ts

@@ -33,6 +33,12 @@ export declare const schema: {
                     };
                 };
             };
+            allow_online_access: {
+                type: string;
+            };
+            allow_online_access_with_ephemeral_sessions: {
+                type: string;
+            };
             enforce_policies: {
                 type: string;
             };

package/lib/tools/auth0/handlers/resourceServers.js

@@ -30,6 +30,8 @@ exports.schema = {
                     },
                 },
             },
+            allow_online_access: { type: 'boolean' },
+            allow_online_access_with_ephemeral_sessions: { type: 'boolean' },
             enforce_policies: { type: 'boolean' },
             token_dialect: { type: 'string' },
             proof_of_possession: {

package/lib/tools/constants.js

@@ -66,6 +66,8 @@ const constants = {
         'send-phone-message',
         'password-reset-post-challenge',
         'custom-token-exchange',
+        'login-post-identifier',
+        'signup-post-identifier',
     ],
     EMAIL_TEMPLATES_DIRECTORY: 'emails',
     EMAIL_VERIFY,

package/lib/tools/utils.js

@@ -259,7 +259,8 @@ const obfuscateSensitiveValues = (data, sensitiveFieldsToObfuscate) => {
     return newAsset;
 };
 exports.obfuscateSensitiveValues = obfuscateSensitiveValues;
-const UNRESOLVED_PLACEHOLDER_REGEX = /^(##.+##|@@.+@@)$/;
+// Uppercase-only to avoid false positives on lowercase Auth0 template variables like @@password@@
+const UNRESOLVED_PLACEHOLDER_REGEX = /^(##[A-Z0-9_]+##|@@[A-Z0-9_]+@@)$/;
 // Recursively collects all fields in an asset that still contain an unresolved
 // ##...## (string) or @@...@@ (array) keyword placeholder.
 const collectUnresolvedPlaceholders = (data, parentPath = '') => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "auth0-deploy-cli",
-  "version": "8.37.0",
+  "version": "8.38.0",
   "description": "A command line tool for deploying updates to your Auth0 tenant",
   "main": "lib/index.js",
   "bin": {
@@ -33,9 +33,9 @@
   "readme": "README.md",
   "homepage": "https://github.com/auth0/auth0-deploy-cli#readme",
   "dependencies": {
-    "@clack/prompts": "1.3.0",
+    "@clack/prompts": "1.4.0",
     "ajv": "^6.12.6",
-    "auth0": "^5.12.0",
+    "auth0": "^5.13.0",
     "chalk": "5.6.2",
     "dot-prop": "^5.3.0",
     "fs-extra": "^10.1.0",