auth0-deploy-cli 8.38.0 → 8.40.0

package/CHANGELOG.md

@@ -7,6 +7,25 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [8.40.0] - 2026-07-09
+
+### Added
+
+- Add client credential lifecycle management for Private Key JWT and mTLS authentication methods. [#1417]
+- Add Rate Limit Policies (EA) support. [#1395]
+
+### Fixed
+
+- Preserve `false` value for `default_head_tags_disabled` in screen renderer update. [#1416]
+- Skip destination update for action event streams as the destination type cannot be changed after creation. [#1425]
+
+## [8.39.0] - 2026-06-30
+
+### Added
+
+- Add `eventStreams` support. [#1412]
+- Add `id_token_session_expiry_supported` validation for enterprise connections. [#1411]
+
 ## [8.38.0] - 2026-06-25
 
 ### Added
@@ -1835,6 +1854,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 [#1389]: https://github.com/auth0/auth0-deploy-cli/issues/1389
 [#1391]: https://github.com/auth0/auth0-deploy-cli/issues/1391
 [#1392]: https://github.com/auth0/auth0-deploy-cli/issues/1392
+[#1395]: https://github.com/auth0/auth0-deploy-cli/issues/1395
 [#1396]: https://github.com/auth0/auth0-deploy-cli/issues/1396
 [#1398]: https://github.com/auth0/auth0-deploy-cli/issues/1398
 [#1400]: https://github.com/auth0/auth0-deploy-cli/issues/1400
@@ -1845,7 +1865,14 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 [#1407]: https://github.com/auth0/auth0-deploy-cli/issues/1407
 [#1408]: https://github.com/auth0/auth0-deploy-cli/issues/1408
 [#1409]: https://github.com/auth0/auth0-deploy-cli/issues/1409
-[Unreleased]: https://github.com/auth0/auth0-deploy-cli/compare/v8.38.0...HEAD
+[#1411]: https://github.com/auth0/auth0-deploy-cli/issues/1411
+[#1412]: https://github.com/auth0/auth0-deploy-cli/issues/1412
+[#1416]: https://github.com/auth0/auth0-deploy-cli/issues/1416
+[#1417]: https://github.com/auth0/auth0-deploy-cli/issues/1417
+[#1425]: https://github.com/auth0/auth0-deploy-cli/issues/1425
+[Unreleased]: https://github.com/auth0/auth0-deploy-cli/compare/v8.40.0...HEAD
+[8.40.0]: https://github.com/auth0/auth0-deploy-cli/compare/v8.39.0...v8.40.0
+[8.39.0]: https://github.com/auth0/auth0-deploy-cli/compare/v8.38.0...v8.39.0
 [8.38.0]: https://github.com/auth0/auth0-deploy-cli/compare/v8.37.0...v8.38.0
 [8.37.0]: https://github.com/auth0/auth0-deploy-cli/compare/v8.36.0...v8.37.0
 [8.36.0]: https://github.com/auth0/auth0-deploy-cli/compare/v8.35.0...v8.36.0

package/lib/context/defaults.d.ts

@@ -5,4 +5,5 @@ export declare function phoneProviderDefaults(phoneProvider: any): any;
 export declare function phoneTemplatesDefaults(phoneTemplate: any): any;
 export declare function connectionDefaults(connection: any, config?: Pick<Config, 'AUTH0_EXPORT_SECRETS'>): any;
 export declare function logStreamDefaults(logStreams: any, config?: Pick<Config, 'AUTH0_EXPORT_SECRETS'>): any;
+export declare function eventStreamDefaults(eventStreams: any[], config?: Pick<Config, 'AUTH0_EXPORT_SECRETS'>): any[];
 export declare function attackProtectionDefaults(attackProtection: AttackProtection, config?: Pick<Config, 'AUTH0_EXPORT_SECRETS'>): AttackProtection;

package/lib/context/defaults.js

@@ -5,6 +5,7 @@ exports.phoneProviderDefaults = phoneProviderDefaults;
 exports.phoneTemplatesDefaults = phoneTemplatesDefaults;
 exports.connectionDefaults = connectionDefaults;
 exports.logStreamDefaults = logStreamDefaults;
+exports.eventStreamDefaults = eventStreamDefaults;
 exports.attackProtectionDefaults = attackProtectionDefaults;
 const utils_1 = require("../tools/utils");
 // env vars arrive as strings, so check both forms
@@ -146,6 +147,52 @@ function logStreamDefaults(logStreams, config) {
     });
     return maskedLogStreams;
 }
+function eventStreamDefaults(eventStreams, config) {
+    return eventStreams.map((stream) => {
+        const { created_at: _ca, updated_at: _ua, ...rest } = stream;
+        stream = rest;
+        if (isExportSecrets(config))
+            return stream;
+        if (stream.destination?.type !== 'webhook')
+            return stream;
+        const auth = stream.destination.configuration?.webhook_authorization;
+        if (!auth)
+            return stream;
+        const method = auth.method;
+        let maskedAuth;
+        if (method === 'basic') {
+            maskedAuth = {
+                method,
+                username: auth.username ?? '',
+                password: `##EVENT_STREAM_WEBHOOK_BASIC_AUTH_PASSWORD##`,
+            };
+        }
+        else if (method === 'bearer') {
+            maskedAuth = { method, token: `##EVENT_STREAM_WEBHOOK_BEARER_TOKEN##` };
+        }
+        else if (method === 'custom_header') {
+            maskedAuth = {
+                method,
+                header_key: auth.header_key ?? '',
+                header_value: `##EVENT_STREAM_WEBHOOK_HEADER_VALUE##`,
+            };
+        }
+        else {
+            // Unknown auth method — preserve as-is rather than silently dropping credentials
+            return stream;
+        }
+        return {
+            ...stream,
+            destination: {
+                ...stream.destination,
+                configuration: {
+                    ...stream.destination.configuration,
+                    webhook_authorization: maskedAuth,
+                },
+            },
+        };
+    });
+}
 function attackProtectionDefaults(attackProtection, config) {
     if (isExportSecrets(config))
         return attackProtection;

package/lib/context/directory/handlers/clientAuthCredentials.d.ts

@@ -0,0 +1,5 @@
+import { DirectoryHandler } from '.';
+import { ParsedAsset } from '../../../types';
+type ParsedClientAuthCredentials = ParsedAsset<'clientAuthCredentials', null>;
+declare const clientAuthCredentialsHandler: DirectoryHandler<ParsedClientAuthCredentials>;
+export default clientAuthCredentialsHandler;

package/lib/context/directory/handlers/clientAuthCredentials.js

@@ -0,0 +1,13 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+function parse(_context) {
+    return { clientAuthCredentials: null };
+}
+async function dump(_context) {
+    // Credentials are embedded inside each client's JSON file — nothing to dump separately.
+}
+const clientAuthCredentialsHandler = {
+    parse,
+    dump,
+};
+exports.default = clientAuthCredentialsHandler;

package/lib/context/directory/handlers/clients.js

@@ -106,6 +106,21 @@ async function dump(context) {
                 organization_require_behavior: client.organization_require_behavior,
             };
         }
+        else {
+            // strip id-only credentials and remove client_authentication_methods entirely
+            // if no named credentials remain — an absent field is treated as deletion on deploy
+            if (client.client_authentication_methods) {
+                Object.values(client.client_authentication_methods).forEach((method) => {
+                    if (method?.credentials) {
+                        method.credentials = method.credentials.filter((c) => c.name);
+                    }
+                });
+                const hasAnyCredentials = Object.values(client.client_authentication_methods).some((method) => method?.credentials?.length > 0);
+                if (!hasAnyCredentials) {
+                    delete client.client_authentication_methods;
+                }
+            }
+        }
         (0, utils_1.dumpJSON)(clientFile, (0, utils_1.clearClientArrays)(client));
     });
 }

package/lib/context/directory/handlers/eventStreams.d.ts

@@ -0,0 +1,5 @@
+import { DirectoryHandler } from '.';
+import { Asset, ParsedAsset } from '../../../types';
+type ParsedEventStreams = ParsedAsset<'eventStreams', Asset[]>;
+declare const eventStreamsHandler: DirectoryHandler<ParsedEventStreams>;
+export default eventStreamsHandler;

package/lib/context/directory/handlers/eventStreams.js

@@ -0,0 +1,52 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const path_1 = __importDefault(require("path"));
+const fs_extra_1 = __importDefault(require("fs-extra"));
+const tools_1 = require("../../../tools");
+const utils_1 = require("../../../utils");
+const defaults_1 = require("../../defaults");
+function parse(context) {
+    const eventStreamsDirectory = path_1.default.join(context.filePath, tools_1.constants.EVENT_STREAMS_DIRECTORY);
+    if (!(0, utils_1.existsMustBeDir)(eventStreamsDirectory))
+        return { eventStreams: null };
+    const foundFiles = (0, utils_1.getFiles)(eventStreamsDirectory, ['.json']);
+    const eventStreams = foundFiles
+        .map((f) => (0, utils_1.loadJSON)(f, {
+        mappings: context.mappings,
+        disableKeywordReplacement: context.disableKeywordReplacement,
+    }))
+        .filter((p) => Object.keys(p).length > 0);
+    return {
+        eventStreams,
+    };
+}
+async function dump(context) {
+    const { eventStreams } = context.assets;
+    if (!eventStreams)
+        return;
+    const eventStreamsDirectory = path_1.default.join(context.filePath, tools_1.constants.EVENT_STREAMS_DIRECTORY);
+    fs_extra_1.default.ensureDirSync(eventStreamsDirectory);
+    const maskedEventStreams = (0, defaults_1.eventStreamDefaults)(eventStreams, context.config);
+    const expectedFiles = new Set();
+    maskedEventStreams.forEach((eventStream) => {
+        const fileName = `${(0, utils_1.sanitize)(eventStream.name)}.json`;
+        const streamFile = path_1.default.join(eventStreamsDirectory, fileName);
+        (0, utils_1.dumpJSON)(streamFile, eventStream);
+        expectedFiles.add(fileName);
+    });
+    // Remove files for event streams no longer present in the tenant
+    for (const existing of fs_extra_1.default.readdirSync(eventStreamsDirectory)) {
+        const fullPath = path_1.default.join(eventStreamsDirectory, existing);
+        if (fs_extra_1.default.statSync(fullPath).isFile() && !expectedFiles.has(existing)) {
+            fs_extra_1.default.removeSync(fullPath);
+        }
+    }
+}
+const eventStreamsHandler = {
+    parse,
+    dump,
+};
+exports.default = eventStreamsHandler;

package/lib/context/directory/handlers/index.js

@@ -43,6 +43,9 @@ const userAttributeProfiles_1 = __importDefault(require("./userAttributeProfiles
 const connectionProfiles_1 = __importDefault(require("./connectionProfiles"));
 const tokenExchangeProfiles_1 = __importDefault(require("./tokenExchangeProfiles"));
 const supplementalSignals_1 = __importDefault(require("./supplementalSignals"));
+const rateLimitPolicies_1 = __importDefault(require("./rateLimitPolicies"));
+const eventStreams_1 = __importDefault(require("./eventStreams"));
+const clientAuthCredentials_1 = __importDefault(require("./clientAuthCredentials"));
 const selfServiceProfiles_1 = __importDefault(require("./selfServiceProfiles"));
 const directoryHandlers = {
     rules: rules_1.default,
@@ -86,5 +89,8 @@ const directoryHandlers = {
     connectionProfiles: connectionProfiles_1.default,
     tokenExchangeProfiles: tokenExchangeProfiles_1.default,
     supplementalSignals: supplementalSignals_1.default,
+    rateLimitPolicies: rateLimitPolicies_1.default,
+    eventStreams: eventStreams_1.default,
+    clientAuthCredentials: clientAuthCredentials_1.default,
 };
 exports.default = directoryHandlers;

package/lib/context/directory/handlers/rateLimitPolicies.d.ts

@@ -0,0 +1,6 @@
+import { DirectoryHandler } from '.';
+import { ParsedAsset } from '../../../types';
+import { RateLimitPolicy } from '../../../tools/auth0/handlers/rateLimitPolicies';
+type ParsedRateLimitPolicies = ParsedAsset<'rateLimitPolicies', RateLimitPolicy[]>;
+declare const rateLimitPoliciesHandler: DirectoryHandler<ParsedRateLimitPolicies>;
+export default rateLimitPoliciesHandler;

package/lib/context/directory/handlers/rateLimitPolicies.js

@@ -0,0 +1,53 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const path_1 = __importDefault(require("path"));
+const fs_extra_1 = __importDefault(require("fs-extra"));
+const tools_1 = require("../../../tools");
+const utils_1 = require("../../../utils");
+function parse(context) {
+    const rateLimitPoliciesDirectory = path_1.default.join(context.filePath, tools_1.constants.RATE_LIMIT_POLICIES_DIRECTORY);
+    if (!(0, utils_1.existsMustBeDir)(rateLimitPoliciesDirectory))
+        return { rateLimitPolicies: null }; // Skip
+    const foundFiles = (0, utils_1.getFiles)(rateLimitPoliciesDirectory, ['.json']);
+    const rateLimitPolicies = foundFiles
+        .map((f) => (0, utils_1.loadJSON)(f, {
+        mappings: context.mappings,
+        disableKeywordReplacement: context.disableKeywordReplacement,
+    }))
+        .filter((p) => Object.keys(p).length > 0);
+    return { rateLimitPolicies };
+}
+async function dump(context) {
+    const { rateLimitPolicies } = context.assets;
+    if (!rateLimitPolicies)
+        return; // Skip, nothing to dump
+    const rateLimitPoliciesDirectory = path_1.default.join(context.filePath, tools_1.constants.RATE_LIMIT_POLICIES_DIRECTORY);
+    fs_extra_1.default.ensureDirSync(rateLimitPoliciesDirectory);
+    const removeKeysFromOutput = ['id', 'created_at', 'updated_at'];
+    const expectedFiles = new Set();
+    rateLimitPolicies.forEach((policy) => {
+        const policyToWrite = { ...policy };
+        removeKeysFromOutput.forEach((key) => {
+            delete policyToWrite[key];
+        });
+        const fileName = (0, utils_1.sanitize)(policy.consumer_selector);
+        const filePath = path_1.default.join(rateLimitPoliciesDirectory, `${fileName}.json`);
+        expectedFiles.add(`${fileName}.json`);
+        (0, utils_1.dumpJSON)(filePath, policyToWrite);
+    });
+    // Remove files for policies that no longer exist in the tenant
+    for (const existing of fs_extra_1.default.readdirSync(rateLimitPoliciesDirectory)) {
+        const fullPath = path_1.default.join(rateLimitPoliciesDirectory, existing);
+        if (fs_extra_1.default.statSync(fullPath).isFile() && !expectedFiles.has(existing)) {
+            fs_extra_1.default.removeSync(fullPath);
+        }
+    }
+}
+const rateLimitPoliciesHandler = {
+    parse,
+    dump,
+};
+exports.default = rateLimitPoliciesHandler;

package/lib/context/yaml/handlers/clientAuthCredentials.d.ts

@@ -0,0 +1,5 @@
+import { YAMLHandler } from '.';
+import { ParsedAsset } from '../../../types';
+type ParsedClientAuthCredentials = ParsedAsset<'clientAuthCredentials', null>;
+declare const clientAuthCredentialsHandler: YAMLHandler<ParsedClientAuthCredentials>;
+export default clientAuthCredentialsHandler;

package/lib/context/yaml/handlers/clientAuthCredentials.js

@@ -0,0 +1,13 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+async function parse(_context) {
+    return { clientAuthCredentials: null };
+}
+async function dump(_context) {
+    return { clientAuthCredentials: null };
+}
+const clientAuthCredentialsHandler = {
+    parse,
+    dump,
+};
+exports.default = clientAuthCredentialsHandler;

package/lib/context/yaml/handlers/clients.js

@@ -99,6 +99,21 @@ async function dump(context) {
                         organization_require_behavior: client.organization_require_behavior,
                     };
                 }
+                else {
+                    // strip id-only credentials and remove client_authentication_methods entirely
+                    // if no named credentials remain — an absent field is treated as deletion on deploy
+                    if (client.client_authentication_methods) {
+                        Object.values(client.client_authentication_methods).forEach((method) => {
+                            if (method?.credentials) {
+                                method.credentials = method.credentials.filter((c) => c.name);
+                            }
+                        });
+                        const hasAnyCredentials = Object.values(client.client_authentication_methods).some((method) => method?.credentials?.length > 0);
+                        if (!hasAnyCredentials) {
+                            delete client.client_authentication_methods;
+                        }
+                    }
+                }
                 return (0, utils_1.clearClientArrays)(client);
             }),
         ],

package/lib/context/yaml/handlers/eventStreams.d.ts

@@ -0,0 +1,5 @@
+import { YAMLHandler } from '.';
+import { Asset, ParsedAsset } from '../../../types';
+type ParsedEventStreams = ParsedAsset<'eventStreams', Asset[]>;
+declare const eventStreamsHandler: YAMLHandler<ParsedEventStreams>;
+export default eventStreamsHandler;

package/lib/context/yaml/handlers/eventStreams.js

@@ -0,0 +1,24 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const defaults_1 = require("../../defaults");
+async function parse(context) {
+    const { eventStreams } = context.assets;
+    if (!eventStreams)
+        return { eventStreams: null };
+    return {
+        eventStreams,
+    };
+}
+async function dump(context) {
+    const { eventStreams } = context.assets;
+    if (!eventStreams)
+        return { eventStreams: null };
+    return {
+        eventStreams: (0, defaults_1.eventStreamDefaults)(eventStreams, context.config),
+    };
+}
+const eventStreamsHandler = {
+    parse,
+    dump,
+};
+exports.default = eventStreamsHandler;

package/lib/context/yaml/handlers/index.js

@@ -43,6 +43,9 @@ const userAttributeProfiles_1 = __importDefault(require("./userAttributeProfiles
 const connectionProfiles_1 = __importDefault(require("./connectionProfiles"));
 const tokenExchangeProfiles_1 = __importDefault(require("./tokenExchangeProfiles"));
 const supplementalSignals_1 = __importDefault(require("./supplementalSignals"));
+const rateLimitPolicies_1 = __importDefault(require("./rateLimitPolicies"));
+const eventStreams_1 = __importDefault(require("./eventStreams"));
+const clientAuthCredentials_1 = __importDefault(require("./clientAuthCredentials"));
 const selfServiceProfiles_1 = __importDefault(require("./selfServiceProfiles"));
 const yamlHandlers = {
     rules: rules_1.default,
@@ -86,5 +89,8 @@ const yamlHandlers = {
     connectionProfiles: connectionProfiles_1.default,
     tokenExchangeProfiles: tokenExchangeProfiles_1.default,
     supplementalSignals: supplementalSignals_1.default,
+    rateLimitPolicies: rateLimitPolicies_1.default,
+    eventStreams: eventStreams_1.default,
+    clientAuthCredentials: clientAuthCredentials_1.default,
 };
 exports.default = yamlHandlers;

package/lib/context/yaml/handlers/rateLimitPolicies.d.ts

@@ -0,0 +1,6 @@
+import { YAMLHandler } from '.';
+import { ParsedAsset } from '../../../types';
+import { RateLimitPolicy } from '../../../tools/auth0/handlers/rateLimitPolicies';
+type ParsedRateLimitPolicies = ParsedAsset<'rateLimitPolicies', RateLimitPolicy[]>;
+declare const rateLimitPoliciesHandler: YAMLHandler<ParsedRateLimitPolicies>;
+export default rateLimitPoliciesHandler;

package/lib/context/yaml/handlers/rateLimitPolicies.js

@@ -0,0 +1,27 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+async function parse(context) {
+    const { rateLimitPolicies } = context.assets;
+    if (!rateLimitPolicies)
+        return { rateLimitPolicies: null };
+    return { rateLimitPolicies };
+}
+async function dump(context) {
+    const { rateLimitPolicies } = context.assets;
+    if (!rateLimitPolicies)
+        return { rateLimitPolicies: null };
+    const removeKeysFromOutput = ['id', 'created_at', 'updated_at'];
+    const cleaned = rateLimitPolicies.map((policy) => {
+        const policyToWrite = { ...policy };
+        removeKeysFromOutput.forEach((key) => {
+            delete policyToWrite[key];
+        });
+        return policyToWrite;
+    });
+    return { rateLimitPolicies: cleaned };
+}
+const rateLimitPoliciesHandler = {
+    parse,
+    dump,
+};
+exports.default = rateLimitPoliciesHandler;

package/lib/tools/auth0/handlers/clientAuthCredentials.d.ts

@@ -0,0 +1,26 @@
+import { Assets, Auth0APIClient } from '../../../types';
+import { ConfigFunction } from '../../../configFactory';
+export declare const schema: {
+    type: string;
+    items: {
+        type: string;
+    };
+};
+export default class ClientAuthCredentialsHandler {
+    client: Auth0APIClient;
+    config: ConfigFunction;
+    type: string;
+    existing: null;
+    constructor({ client, config }: {
+        client: Auth0APIClient;
+        config: ConfigFunction;
+    });
+    getType(): Promise<null>;
+    load(): Promise<{
+        [x: string]: null;
+    }>;
+    validate(): Promise<null>;
+    processChanges(assets: Assets): Promise<void>;
+    private inferCredentialType;
+    private inferMethodFromType;
+}