auth0-deploy-cli 8.38.0 → 8.39.0

package/CHANGELOG.md

@@ -7,6 +7,13 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [8.39.0] - 2026-06-30
+
+### Added
+
+- Add `eventStreams` support. [#1412]
+- Add `id_token_session_expiry_supported` validation for enterprise connections. [#1411]
+
 ## [8.38.0] - 2026-06-25
 
 ### Added
@@ -1845,7 +1852,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 [#1407]: https://github.com/auth0/auth0-deploy-cli/issues/1407
 [#1408]: https://github.com/auth0/auth0-deploy-cli/issues/1408
 [#1409]: https://github.com/auth0/auth0-deploy-cli/issues/1409
-[Unreleased]: https://github.com/auth0/auth0-deploy-cli/compare/v8.38.0...HEAD
+[#1411]: https://github.com/auth0/auth0-deploy-cli/issues/1411
+[#1412]: https://github.com/auth0/auth0-deploy-cli/issues/1412
+[Unreleased]: https://github.com/auth0/auth0-deploy-cli/compare/v8.39.0...HEAD
+[8.39.0]: https://github.com/auth0/auth0-deploy-cli/compare/v8.38.0...v8.39.0
 [8.38.0]: https://github.com/auth0/auth0-deploy-cli/compare/v8.37.0...v8.38.0
 [8.37.0]: https://github.com/auth0/auth0-deploy-cli/compare/v8.36.0...v8.37.0
 [8.36.0]: https://github.com/auth0/auth0-deploy-cli/compare/v8.35.0...v8.36.0

package/lib/context/defaults.d.ts

@@ -5,4 +5,5 @@ export declare function phoneProviderDefaults(phoneProvider: any): any;
 export declare function phoneTemplatesDefaults(phoneTemplate: any): any;
 export declare function connectionDefaults(connection: any, config?: Pick<Config, 'AUTH0_EXPORT_SECRETS'>): any;
 export declare function logStreamDefaults(logStreams: any, config?: Pick<Config, 'AUTH0_EXPORT_SECRETS'>): any;
+export declare function eventStreamDefaults(eventStreams: any[], config?: Pick<Config, 'AUTH0_EXPORT_SECRETS'>): any[];
 export declare function attackProtectionDefaults(attackProtection: AttackProtection, config?: Pick<Config, 'AUTH0_EXPORT_SECRETS'>): AttackProtection;

package/lib/context/defaults.js

@@ -5,6 +5,7 @@ exports.phoneProviderDefaults = phoneProviderDefaults;
 exports.phoneTemplatesDefaults = phoneTemplatesDefaults;
 exports.connectionDefaults = connectionDefaults;
 exports.logStreamDefaults = logStreamDefaults;
+exports.eventStreamDefaults = eventStreamDefaults;
 exports.attackProtectionDefaults = attackProtectionDefaults;
 const utils_1 = require("../tools/utils");
 // env vars arrive as strings, so check both forms
@@ -146,6 +147,52 @@ function logStreamDefaults(logStreams, config) {
     });
     return maskedLogStreams;
 }
+function eventStreamDefaults(eventStreams, config) {
+    return eventStreams.map((stream) => {
+        const { created_at: _ca, updated_at: _ua, ...rest } = stream;
+        stream = rest;
+        if (isExportSecrets(config))
+            return stream;
+        if (stream.destination?.type !== 'webhook')
+            return stream;
+        const auth = stream.destination.configuration?.webhook_authorization;
+        if (!auth)
+            return stream;
+        const method = auth.method;
+        let maskedAuth;
+        if (method === 'basic') {
+            maskedAuth = {
+                method,
+                username: auth.username ?? '',
+                password: `##EVENT_STREAM_WEBHOOK_BASIC_AUTH_PASSWORD##`,
+            };
+        }
+        else if (method === 'bearer') {
+            maskedAuth = { method, token: `##EVENT_STREAM_WEBHOOK_BEARER_TOKEN##` };
+        }
+        else if (method === 'custom_header') {
+            maskedAuth = {
+                method,
+                header_key: auth.header_key ?? '',
+                header_value: `##EVENT_STREAM_WEBHOOK_HEADER_VALUE##`,
+            };
+        }
+        else {
+            // Unknown auth method — preserve as-is rather than silently dropping credentials
+            return stream;
+        }
+        return {
+            ...stream,
+            destination: {
+                ...stream.destination,
+                configuration: {
+                    ...stream.destination.configuration,
+                    webhook_authorization: maskedAuth,
+                },
+            },
+        };
+    });
+}
 function attackProtectionDefaults(attackProtection, config) {
     if (isExportSecrets(config))
         return attackProtection;

package/lib/context/directory/handlers/eventStreams.d.ts

@@ -0,0 +1,5 @@
+import { DirectoryHandler } from '.';
+import { Asset, ParsedAsset } from '../../../types';
+type ParsedEventStreams = ParsedAsset<'eventStreams', Asset[]>;
+declare const eventStreamsHandler: DirectoryHandler<ParsedEventStreams>;
+export default eventStreamsHandler;

package/lib/context/directory/handlers/eventStreams.js

@@ -0,0 +1,52 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const path_1 = __importDefault(require("path"));
+const fs_extra_1 = __importDefault(require("fs-extra"));
+const tools_1 = require("../../../tools");
+const utils_1 = require("../../../utils");
+const defaults_1 = require("../../defaults");
+function parse(context) {
+    const eventStreamsDirectory = path_1.default.join(context.filePath, tools_1.constants.EVENT_STREAMS_DIRECTORY);
+    if (!(0, utils_1.existsMustBeDir)(eventStreamsDirectory))
+        return { eventStreams: null };
+    const foundFiles = (0, utils_1.getFiles)(eventStreamsDirectory, ['.json']);
+    const eventStreams = foundFiles
+        .map((f) => (0, utils_1.loadJSON)(f, {
+        mappings: context.mappings,
+        disableKeywordReplacement: context.disableKeywordReplacement,
+    }))
+        .filter((p) => Object.keys(p).length > 0);
+    return {
+        eventStreams,
+    };
+}
+async function dump(context) {
+    const { eventStreams } = context.assets;
+    if (!eventStreams)
+        return;
+    const eventStreamsDirectory = path_1.default.join(context.filePath, tools_1.constants.EVENT_STREAMS_DIRECTORY);
+    fs_extra_1.default.ensureDirSync(eventStreamsDirectory);
+    const maskedEventStreams = (0, defaults_1.eventStreamDefaults)(eventStreams, context.config);
+    const expectedFiles = new Set();
+    maskedEventStreams.forEach((eventStream) => {
+        const fileName = `${(0, utils_1.sanitize)(eventStream.name)}.json`;
+        const streamFile = path_1.default.join(eventStreamsDirectory, fileName);
+        (0, utils_1.dumpJSON)(streamFile, eventStream);
+        expectedFiles.add(fileName);
+    });
+    // Remove files for event streams no longer present in the tenant
+    for (const existing of fs_extra_1.default.readdirSync(eventStreamsDirectory)) {
+        const fullPath = path_1.default.join(eventStreamsDirectory, existing);
+        if (fs_extra_1.default.statSync(fullPath).isFile() && !expectedFiles.has(existing)) {
+            fs_extra_1.default.removeSync(fullPath);
+        }
+    }
+}
+const eventStreamsHandler = {
+    parse,
+    dump,
+};
+exports.default = eventStreamsHandler;

package/lib/context/directory/handlers/index.js

@@ -43,6 +43,7 @@ const userAttributeProfiles_1 = __importDefault(require("./userAttributeProfiles
 const connectionProfiles_1 = __importDefault(require("./connectionProfiles"));
 const tokenExchangeProfiles_1 = __importDefault(require("./tokenExchangeProfiles"));
 const supplementalSignals_1 = __importDefault(require("./supplementalSignals"));
+const eventStreams_1 = __importDefault(require("./eventStreams"));
 const selfServiceProfiles_1 = __importDefault(require("./selfServiceProfiles"));
 const directoryHandlers = {
     rules: rules_1.default,
@@ -86,5 +87,6 @@ const directoryHandlers = {
     connectionProfiles: connectionProfiles_1.default,
     tokenExchangeProfiles: tokenExchangeProfiles_1.default,
     supplementalSignals: supplementalSignals_1.default,
+    eventStreams: eventStreams_1.default,
 };
 exports.default = directoryHandlers;

package/lib/context/yaml/handlers/eventStreams.d.ts

@@ -0,0 +1,5 @@
+import { YAMLHandler } from '.';
+import { Asset, ParsedAsset } from '../../../types';
+type ParsedEventStreams = ParsedAsset<'eventStreams', Asset[]>;
+declare const eventStreamsHandler: YAMLHandler<ParsedEventStreams>;
+export default eventStreamsHandler;

package/lib/context/yaml/handlers/eventStreams.js

@@ -0,0 +1,24 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const defaults_1 = require("../../defaults");
+async function parse(context) {
+    const { eventStreams } = context.assets;
+    if (!eventStreams)
+        return { eventStreams: null };
+    return {
+        eventStreams,
+    };
+}
+async function dump(context) {
+    const { eventStreams } = context.assets;
+    if (!eventStreams)
+        return { eventStreams: null };
+    return {
+        eventStreams: (0, defaults_1.eventStreamDefaults)(eventStreams, context.config),
+    };
+}
+const eventStreamsHandler = {
+    parse,
+    dump,
+};
+exports.default = eventStreamsHandler;

package/lib/context/yaml/handlers/index.js

@@ -43,6 +43,7 @@ const userAttributeProfiles_1 = __importDefault(require("./userAttributeProfiles
 const connectionProfiles_1 = __importDefault(require("./connectionProfiles"));
 const tokenExchangeProfiles_1 = __importDefault(require("./tokenExchangeProfiles"));
 const supplementalSignals_1 = __importDefault(require("./supplementalSignals"));
+const eventStreams_1 = __importDefault(require("./eventStreams"));
 const selfServiceProfiles_1 = __importDefault(require("./selfServiceProfiles"));
 const yamlHandlers = {
     rules: rules_1.default,
@@ -86,5 +87,6 @@ const yamlHandlers = {
     connectionProfiles: connectionProfiles_1.default,
     tokenExchangeProfiles: tokenExchangeProfiles_1.default,
     supplementalSignals: supplementalSignals_1.default,
+    eventStreams: eventStreams_1.default,
 };
 exports.default = yamlHandlers;

package/lib/tools/auth0/handlers/connections.js

@@ -85,6 +85,7 @@ const oidcOktaOnlyConnectionOptionFields = [
     'token_endpoint_auth_signing_alg',
     'id_token_signed_response_algs',
     'token_endpoint_jwtca_aud_format',
+    'id_token_session_expiry_supported',
 ];
 exports.schema = {
     type: 'array',

package/lib/tools/auth0/handlers/eventStreams.d.ts

@@ -0,0 +1,58 @@
+import { Management } from 'auth0';
+import DefaultAPIHandler from './default';
+import { Asset, Assets } from '../../../types';
+import { Action } from './actions';
+export declare const schema: {
+    type: string;
+    items: {
+        type: string;
+        properties: {
+            id: {
+                type: string;
+            };
+            name: {
+                type: string;
+            };
+            status: {
+                type: string;
+                enum: string[];
+            };
+            subscriptions: {
+                type: string;
+                items: {
+                    type: string;
+                    properties: {
+                        event_type: {
+                            type: string;
+                        };
+                    };
+                };
+            };
+            destination: {
+                type: string;
+                properties: {
+                    type: {
+                        type: string;
+                        enum: string[];
+                    };
+                    configuration: {
+                        type: string;
+                    };
+                };
+                required: string[];
+            };
+        };
+        required: string[];
+    };
+};
+export type EventStream = Management.EventStreamResponseContent;
+export default class EventStreamsHandler extends DefaultAPIHandler {
+    existing: Asset[] | null;
+    private actions;
+    constructor(config: DefaultAPIHandler);
+    objString(item: Asset): string;
+    getActions(): Promise<Action[]>;
+    getType(): Promise<Asset[]>;
+    private resolveActionId;
+    processChanges(assets: Assets): Promise<void>;
+}

package/lib/tools/auth0/handlers/eventStreams.js

@@ -0,0 +1,178 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.schema = void 0;
+const default_1 = __importStar(require("./default"));
+const client_1 = require("../client");
+exports.schema = {
+    type: 'array',
+    items: {
+        type: 'object',
+        properties: {
+            id: { type: 'string' },
+            name: { type: 'string' },
+            status: { type: 'string', enum: ['enabled', 'disabled'] },
+            subscriptions: {
+                type: 'array',
+                items: {
+                    type: 'object',
+                    properties: {
+                        event_type: { type: 'string' },
+                    },
+                },
+            },
+            destination: {
+                type: 'object',
+                properties: {
+                    type: { type: 'string', enum: ['webhook', 'eventbridge', 'action'] },
+                    configuration: { type: 'object' },
+                },
+                required: ['type', 'configuration'],
+            },
+        },
+        required: ['name', 'destination'],
+    },
+};
+class EventStreamsHandler extends default_1.default {
+    constructor(config) {
+        super({
+            ...config,
+            type: 'eventStreams',
+            identifiers: ['id', 'name'],
+            // aws_partner_event_source is auto-populated by AWS after creation; sending it on create fails
+            stripCreateFields: [
+                'destination.configuration.aws_partner_event_source',
+                'created_at',
+                'updated_at',
+            ],
+            stripUpdateFields: ['created_at', 'updated_at'],
+        });
+        this.actions = null;
+    }
+    objString(item) {
+        return super.objString(item.name);
+    }
+    async getActions() {
+        if (this.actions)
+            return this.actions;
+        this.actions = await (0, client_1.paginate)(this.client.actions.list, { paginate: true });
+        return this.actions;
+    }
+    async getType() {
+        if (this.existing) {
+            return this.existing;
+        }
+        const eventStreams = [];
+        let page = await this.client.eventStreams.list();
+        eventStreams.push(...page.data);
+        while (page.hasNextPage()) {
+            page = await page.getNextPage();
+            eventStreams.push(...page.data);
+        }
+        // For action-destination streams, replace action_id with the action name for export
+        const actions = await this.getActions();
+        this.existing = eventStreams.map((stream) => {
+            if (stream.destination?.type === 'action' && stream.destination.configuration?.action_id) {
+                const action = actions.find((a) => a.id === stream.destination.configuration.action_id);
+                if (action) {
+                    return {
+                        ...stream,
+                        destination: {
+                            ...stream.destination,
+                            configuration: {
+                                ...stream.destination.configuration,
+                                action_id: action.name,
+                            },
+                        },
+                    };
+                }
+            }
+            return stream;
+        });
+        return this.existing;
+    }
+    resolveActionId(stream) {
+        if (stream.destination?.type !== 'action' || !stream.destination.configuration?.action_id) {
+            return stream;
+        }
+        const name = stream.destination.configuration.action_id;
+        const action = (this.actions ?? []).find((a) => a.name === name);
+        if (!action) {
+            throw new Error(`Event stream "${stream.name}" references action "${name}" which was not found`);
+        }
+        return {
+            ...stream,
+            destination: {
+                ...stream.destination,
+                configuration: {
+                    ...stream.destination.configuration,
+                    action_id: action.id,
+                },
+            },
+        };
+    }
+    async processChanges(assets) {
+        const { eventStreams } = assets;
+        if (!eventStreams)
+            return;
+        if (!this.actions) {
+            this.actions = await this.getActions();
+        }
+        const changes = await this.calcChanges(assets).then((changesResponse) => ({
+            ...changesResponse,
+            create: changesResponse.create.map((stream) => this.resolveActionId(stream)),
+            update: changesResponse.update.map((stream) => {
+                const resolved = this.resolveActionId(stream);
+                // EventBridge destinations cannot be patched — the API rejects destination on PATCH
+                if (resolved.destination?.type === 'eventbridge') {
+                    const { destination: _dest, ...rest } = resolved;
+                    return rest;
+                }
+                return resolved;
+            }),
+        }));
+        await super.processChanges(assets, changes);
+    }
+}
+exports.default = EventStreamsHandler;
+__decorate([
+    (0, default_1.order)('75')
+], EventStreamsHandler.prototype, "processChanges", null);

package/lib/tools/auth0/handlers/index.js

@@ -74,6 +74,7 @@ const userAttributeProfiles = __importStar(require("./userAttributeProfiles"));
 const connectionProfiles = __importStar(require("./connectionProfiles"));
 const tokenExchangeProfiles = __importStar(require("./tokenExchangeProfiles"));
 const supplementalSignals = __importStar(require("./supplementalSignals"));
+const eventStreams = __importStar(require("./eventStreams"));
 const auth0ApiHandlers = {
     rules,
     rulesConfigs,
@@ -117,5 +118,6 @@ const auth0ApiHandlers = {
     connectionProfiles,
     tokenExchangeProfiles,
     supplementalSignals,
+    eventStreams,
 };
 exports.default = auth0ApiHandlers; // TODO: apply stronger types to schema properties

package/lib/tools/constants.d.ts

@@ -90,5 +90,6 @@ declare const constants: {
     CONNECTION_PROFILES_DIRECTORY: string;
     TOKEN_EXCHANGE_PROFILES_DIRECTORY: string;
     SUPPLEMENTAL_SIGNALS_DIRECTORY: string;
+    EVENT_STREAMS_DIRECTORY: string;
 };
 export default constants;

package/lib/tools/constants.js

@@ -220,5 +220,6 @@ const constants = {
     CONNECTION_PROFILES_DIRECTORY: 'connection-profiles',
     TOKEN_EXCHANGE_PROFILES_DIRECTORY: 'token-exchange-profiles',
     SUPPLEMENTAL_SIGNALS_DIRECTORY: 'supplemental-signals',
+    EVENT_STREAMS_DIRECTORY: 'event-streams',
 };
 exports.default = constants;

package/lib/types.d.ts

@@ -21,6 +21,7 @@ import { AttackProtection } from './tools/auth0/handlers/attackProtection';
 import { TokenExchangeProfile } from './tools/auth0/handlers/tokenExchangeProfiles';
 import { RiskAssessment } from './tools/auth0/handlers/riskAssessment';
 import { SupplementalSignals } from './tools/auth0/handlers/supplementalSignals';
+import { EventStream } from './tools/auth0/handlers/eventStreams';
 type SharedPaginationParams = {
     checkpoint?: boolean;
     paginate?: boolean;
@@ -158,6 +159,7 @@ export type Assets = Partial<{
     userAttributeProfilesWithId: UserAttributeProfile[] | null;
     connectionProfiles: Asset[] | null;
     tokenExchangeProfiles: TokenExchangeProfile[] | null;
+    eventStreams: EventStream[] | null;
 }>;
 export type CalculatedChanges = {
     del: Asset[];
@@ -178,7 +180,7 @@ export type DetailedDryRunChanges = {
         changes: DetailedDryRunChange[];
     };
 };
-export type AssetTypes = 'rules' | 'rulesConfigs' | 'hooks' | 'pages' | 'databases' | 'clientGrants' | 'resourceServers' | 'clients' | 'connections' | 'tenant' | 'emailProvider' | 'emailTemplates' | 'guardianFactors' | 'guardianFactorProviders' | 'guardianFactorTemplates' | 'guardianPhoneFactorMessageTypes' | 'guardianPhoneFactorSelectedProvider' | 'guardianPolicies' | 'roles' | 'actions' | 'actionModules' | 'organizations' | 'triggers' | 'attackProtection' | 'riskAssessment' | 'branding' | 'phoneProviders' | 'phoneTemplates' | 'logStreams' | 'prompts' | 'customDomains' | 'themes' | 'forms' | 'flows' | 'flowVaultConnections' | 'selfServiceProfiles' | 'networkACLs' | 'userAttributeProfiles' | 'connectionProfiles' | 'tokenExchangeProfiles' | 'supplementalSignals';
+export type AssetTypes = 'rules' | 'rulesConfigs' | 'hooks' | 'pages' | 'databases' | 'clientGrants' | 'resourceServers' | 'clients' | 'connections' | 'tenant' | 'emailProvider' | 'emailTemplates' | 'guardianFactors' | 'guardianFactorProviders' | 'guardianFactorTemplates' | 'guardianPhoneFactorMessageTypes' | 'guardianPhoneFactorSelectedProvider' | 'guardianPolicies' | 'roles' | 'actions' | 'actionModules' | 'organizations' | 'triggers' | 'attackProtection' | 'riskAssessment' | 'branding' | 'phoneProviders' | 'phoneTemplates' | 'logStreams' | 'prompts' | 'customDomains' | 'themes' | 'forms' | 'flows' | 'flowVaultConnections' | 'selfServiceProfiles' | 'networkACLs' | 'userAttributeProfiles' | 'connectionProfiles' | 'tokenExchangeProfiles' | 'supplementalSignals' | 'eventStreams';
 export type KeywordMappings = {
     [key: string]: (string | number)[] | string | number;
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "auth0-deploy-cli",
-  "version": "8.38.0",
+  "version": "8.39.0",
   "description": "A command line tool for deploying updates to your Auth0 tenant",
   "main": "lib/index.js",
   "bin": {