auth0-deploy-cli 8.39.0 → 8.41.0

package/CHANGELOG.md

@@ -7,6 +7,24 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [8.41.0] - 2026-07-16
+
+### Added
+
+- Add `third_party_client_access` support for organizations. [#1421]
+
+## [8.40.0] - 2026-07-09
+
+### Added
+
+- Add client credential lifecycle management for Private Key JWT and mTLS authentication methods. [#1417]
+- Add Rate Limit Policies (EA) support. [#1395]
+
+### Fixed
+
+- Preserve `false` value for `default_head_tags_disabled` in screen renderer update. [#1416]
+- Skip destination update for action event streams as the destination type cannot be changed after creation. [#1425]
+
 ## [8.39.0] - 2026-06-30
 
 ### Added
@@ -1842,6 +1860,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 [#1389]: https://github.com/auth0/auth0-deploy-cli/issues/1389
 [#1391]: https://github.com/auth0/auth0-deploy-cli/issues/1391
 [#1392]: https://github.com/auth0/auth0-deploy-cli/issues/1392
+[#1395]: https://github.com/auth0/auth0-deploy-cli/issues/1395
 [#1396]: https://github.com/auth0/auth0-deploy-cli/issues/1396
 [#1398]: https://github.com/auth0/auth0-deploy-cli/issues/1398
 [#1400]: https://github.com/auth0/auth0-deploy-cli/issues/1400
@@ -1854,7 +1873,13 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 [#1409]: https://github.com/auth0/auth0-deploy-cli/issues/1409
 [#1411]: https://github.com/auth0/auth0-deploy-cli/issues/1411
 [#1412]: https://github.com/auth0/auth0-deploy-cli/issues/1412
-[Unreleased]: https://github.com/auth0/auth0-deploy-cli/compare/v8.39.0...HEAD
+[#1416]: https://github.com/auth0/auth0-deploy-cli/issues/1416
+[#1417]: https://github.com/auth0/auth0-deploy-cli/issues/1417
+[#1421]: https://github.com/auth0/auth0-deploy-cli/issues/1421
+[#1425]: https://github.com/auth0/auth0-deploy-cli/issues/1425
+[Unreleased]: https://github.com/auth0/auth0-deploy-cli/compare/v8.41.0...HEAD
+[8.41.0]: https://github.com/auth0/auth0-deploy-cli/compare/v8.40.0...v8.41.0
+[8.40.0]: https://github.com/auth0/auth0-deploy-cli/compare/v8.39.0...v8.40.0
 [8.39.0]: https://github.com/auth0/auth0-deploy-cli/compare/v8.38.0...v8.39.0
 [8.38.0]: https://github.com/auth0/auth0-deploy-cli/compare/v8.37.0...v8.38.0
 [8.37.0]: https://github.com/auth0/auth0-deploy-cli/compare/v8.36.0...v8.37.0

package/lib/context/directory/handlers/clientAuthCredentials.d.ts

@@ -0,0 +1,5 @@
+import { DirectoryHandler } from '.';
+import { ParsedAsset } from '../../../types';
+type ParsedClientAuthCredentials = ParsedAsset<'clientAuthCredentials', null>;
+declare const clientAuthCredentialsHandler: DirectoryHandler<ParsedClientAuthCredentials>;
+export default clientAuthCredentialsHandler;

package/lib/context/directory/handlers/clientAuthCredentials.js

@@ -0,0 +1,13 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+function parse(_context) {
+    return { clientAuthCredentials: null };
+}
+async function dump(_context) {
+    // Credentials are embedded inside each client's JSON file — nothing to dump separately.
+}
+const clientAuthCredentialsHandler = {
+    parse,
+    dump,
+};
+exports.default = clientAuthCredentialsHandler;

package/lib/context/directory/handlers/clients.js

@@ -106,6 +106,21 @@ async function dump(context) {
                 organization_require_behavior: client.organization_require_behavior,
             };
         }
+        else {
+            // strip id-only credentials and remove client_authentication_methods entirely
+            // if no named credentials remain — an absent field is treated as deletion on deploy
+            if (client.client_authentication_methods) {
+                Object.values(client.client_authentication_methods).forEach((method) => {
+                    if (method?.credentials) {
+                        method.credentials = method.credentials.filter((c) => c.name);
+                    }
+                });
+                const hasAnyCredentials = Object.values(client.client_authentication_methods).some((method) => method?.credentials?.length > 0);
+                if (!hasAnyCredentials) {
+                    delete client.client_authentication_methods;
+                }
+            }
+        }
         (0, utils_1.dumpJSON)(clientFile, (0, utils_1.clearClientArrays)(client));
     });
 }

package/lib/context/directory/handlers/index.js

@@ -43,7 +43,9 @@ const userAttributeProfiles_1 = __importDefault(require("./userAttributeProfiles
 const connectionProfiles_1 = __importDefault(require("./connectionProfiles"));
 const tokenExchangeProfiles_1 = __importDefault(require("./tokenExchangeProfiles"));
 const supplementalSignals_1 = __importDefault(require("./supplementalSignals"));
+const rateLimitPolicies_1 = __importDefault(require("./rateLimitPolicies"));
 const eventStreams_1 = __importDefault(require("./eventStreams"));
+const clientAuthCredentials_1 = __importDefault(require("./clientAuthCredentials"));
 const selfServiceProfiles_1 = __importDefault(require("./selfServiceProfiles"));
 const directoryHandlers = {
     rules: rules_1.default,
@@ -87,6 +89,8 @@ const directoryHandlers = {
     connectionProfiles: connectionProfiles_1.default,
     tokenExchangeProfiles: tokenExchangeProfiles_1.default,
     supplementalSignals: supplementalSignals_1.default,
+    rateLimitPolicies: rateLimitPolicies_1.default,
     eventStreams: eventStreams_1.default,
+    clientAuthCredentials: clientAuthCredentials_1.default,
 };
 exports.default = directoryHandlers;

package/lib/context/directory/handlers/rateLimitPolicies.d.ts

@@ -0,0 +1,6 @@
+import { DirectoryHandler } from '.';
+import { ParsedAsset } from '../../../types';
+import { RateLimitPolicy } from '../../../tools/auth0/handlers/rateLimitPolicies';
+type ParsedRateLimitPolicies = ParsedAsset<'rateLimitPolicies', RateLimitPolicy[]>;
+declare const rateLimitPoliciesHandler: DirectoryHandler<ParsedRateLimitPolicies>;
+export default rateLimitPoliciesHandler;

package/lib/context/directory/handlers/rateLimitPolicies.js

@@ -0,0 +1,53 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const path_1 = __importDefault(require("path"));
+const fs_extra_1 = __importDefault(require("fs-extra"));
+const tools_1 = require("../../../tools");
+const utils_1 = require("../../../utils");
+function parse(context) {
+    const rateLimitPoliciesDirectory = path_1.default.join(context.filePath, tools_1.constants.RATE_LIMIT_POLICIES_DIRECTORY);
+    if (!(0, utils_1.existsMustBeDir)(rateLimitPoliciesDirectory))
+        return { rateLimitPolicies: null }; // Skip
+    const foundFiles = (0, utils_1.getFiles)(rateLimitPoliciesDirectory, ['.json']);
+    const rateLimitPolicies = foundFiles
+        .map((f) => (0, utils_1.loadJSON)(f, {
+        mappings: context.mappings,
+        disableKeywordReplacement: context.disableKeywordReplacement,
+    }))
+        .filter((p) => Object.keys(p).length > 0);
+    return { rateLimitPolicies };
+}
+async function dump(context) {
+    const { rateLimitPolicies } = context.assets;
+    if (!rateLimitPolicies)
+        return; // Skip, nothing to dump
+    const rateLimitPoliciesDirectory = path_1.default.join(context.filePath, tools_1.constants.RATE_LIMIT_POLICIES_DIRECTORY);
+    fs_extra_1.default.ensureDirSync(rateLimitPoliciesDirectory);
+    const removeKeysFromOutput = ['id', 'created_at', 'updated_at'];
+    const expectedFiles = new Set();
+    rateLimitPolicies.forEach((policy) => {
+        const policyToWrite = { ...policy };
+        removeKeysFromOutput.forEach((key) => {
+            delete policyToWrite[key];
+        });
+        const fileName = (0, utils_1.sanitize)(policy.consumer_selector);
+        const filePath = path_1.default.join(rateLimitPoliciesDirectory, `${fileName}.json`);
+        expectedFiles.add(`${fileName}.json`);
+        (0, utils_1.dumpJSON)(filePath, policyToWrite);
+    });
+    // Remove files for policies that no longer exist in the tenant
+    for (const existing of fs_extra_1.default.readdirSync(rateLimitPoliciesDirectory)) {
+        const fullPath = path_1.default.join(rateLimitPoliciesDirectory, existing);
+        if (fs_extra_1.default.statSync(fullPath).isFile() && !expectedFiles.has(existing)) {
+            fs_extra_1.default.removeSync(fullPath);
+        }
+    }
+}
+const rateLimitPoliciesHandler = {
+    parse,
+    dump,
+};
+exports.default = rateLimitPoliciesHandler;

package/lib/context/yaml/handlers/clientAuthCredentials.d.ts

@@ -0,0 +1,5 @@
+import { YAMLHandler } from '.';
+import { ParsedAsset } from '../../../types';
+type ParsedClientAuthCredentials = ParsedAsset<'clientAuthCredentials', null>;
+declare const clientAuthCredentialsHandler: YAMLHandler<ParsedClientAuthCredentials>;
+export default clientAuthCredentialsHandler;

package/lib/context/yaml/handlers/clientAuthCredentials.js

@@ -0,0 +1,13 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+async function parse(_context) {
+    return { clientAuthCredentials: null };
+}
+async function dump(_context) {
+    return { clientAuthCredentials: null };
+}
+const clientAuthCredentialsHandler = {
+    parse,
+    dump,
+};
+exports.default = clientAuthCredentialsHandler;

package/lib/context/yaml/handlers/clients.js

@@ -99,6 +99,21 @@ async function dump(context) {
                         organization_require_behavior: client.organization_require_behavior,
                     };
                 }
+                else {
+                    // strip id-only credentials and remove client_authentication_methods entirely
+                    // if no named credentials remain — an absent field is treated as deletion on deploy
+                    if (client.client_authentication_methods) {
+                        Object.values(client.client_authentication_methods).forEach((method) => {
+                            if (method?.credentials) {
+                                method.credentials = method.credentials.filter((c) => c.name);
+                            }
+                        });
+                        const hasAnyCredentials = Object.values(client.client_authentication_methods).some((method) => method?.credentials?.length > 0);
+                        if (!hasAnyCredentials) {
+                            delete client.client_authentication_methods;
+                        }
+                    }
+                }
                 return (0, utils_1.clearClientArrays)(client);
             }),
         ],

package/lib/context/yaml/handlers/index.js

@@ -43,7 +43,9 @@ const userAttributeProfiles_1 = __importDefault(require("./userAttributeProfiles
 const connectionProfiles_1 = __importDefault(require("./connectionProfiles"));
 const tokenExchangeProfiles_1 = __importDefault(require("./tokenExchangeProfiles"));
 const supplementalSignals_1 = __importDefault(require("./supplementalSignals"));
+const rateLimitPolicies_1 = __importDefault(require("./rateLimitPolicies"));
 const eventStreams_1 = __importDefault(require("./eventStreams"));
+const clientAuthCredentials_1 = __importDefault(require("./clientAuthCredentials"));
 const selfServiceProfiles_1 = __importDefault(require("./selfServiceProfiles"));
 const yamlHandlers = {
     rules: rules_1.default,
@@ -87,6 +89,8 @@ const yamlHandlers = {
     connectionProfiles: connectionProfiles_1.default,
     tokenExchangeProfiles: tokenExchangeProfiles_1.default,
     supplementalSignals: supplementalSignals_1.default,
+    rateLimitPolicies: rateLimitPolicies_1.default,
     eventStreams: eventStreams_1.default,
+    clientAuthCredentials: clientAuthCredentials_1.default,
 };
 exports.default = yamlHandlers;

package/lib/context/yaml/handlers/rateLimitPolicies.d.ts

@@ -0,0 +1,6 @@
+import { YAMLHandler } from '.';
+import { ParsedAsset } from '../../../types';
+import { RateLimitPolicy } from '../../../tools/auth0/handlers/rateLimitPolicies';
+type ParsedRateLimitPolicies = ParsedAsset<'rateLimitPolicies', RateLimitPolicy[]>;
+declare const rateLimitPoliciesHandler: YAMLHandler<ParsedRateLimitPolicies>;
+export default rateLimitPoliciesHandler;

package/lib/context/yaml/handlers/rateLimitPolicies.js

@@ -0,0 +1,27 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+async function parse(context) {
+    const { rateLimitPolicies } = context.assets;
+    if (!rateLimitPolicies)
+        return { rateLimitPolicies: null };
+    return { rateLimitPolicies };
+}
+async function dump(context) {
+    const { rateLimitPolicies } = context.assets;
+    if (!rateLimitPolicies)
+        return { rateLimitPolicies: null };
+    const removeKeysFromOutput = ['id', 'created_at', 'updated_at'];
+    const cleaned = rateLimitPolicies.map((policy) => {
+        const policyToWrite = { ...policy };
+        removeKeysFromOutput.forEach((key) => {
+            delete policyToWrite[key];
+        });
+        return policyToWrite;
+    });
+    return { rateLimitPolicies: cleaned };
+}
+const rateLimitPoliciesHandler = {
+    parse,
+    dump,
+};
+exports.default = rateLimitPoliciesHandler;

package/lib/tools/auth0/handlers/clientAuthCredentials.d.ts

@@ -0,0 +1,26 @@
+import { Assets, Auth0APIClient } from '../../../types';
+import { ConfigFunction } from '../../../configFactory';
+export declare const schema: {
+    type: string;
+    items: {
+        type: string;
+    };
+};
+export default class ClientAuthCredentialsHandler {
+    client: Auth0APIClient;
+    config: ConfigFunction;
+    type: string;
+    existing: null;
+    constructor({ client, config }: {
+        client: Auth0APIClient;
+        config: ConfigFunction;
+    });
+    getType(): Promise<null>;
+    load(): Promise<{
+        [x: string]: null;
+    }>;
+    validate(): Promise<null>;
+    processChanges(assets: Assets): Promise<void>;
+    private inferCredentialType;
+    private inferMethodFromType;
+}

package/lib/tools/auth0/handlers/clientAuthCredentials.js

@@ -0,0 +1,216 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.schema = void 0;
+const default_1 = require("./default");
+const client_1 = require("../client");
+const logger_1 = __importDefault(require("../../../logger"));
+exports.schema = {
+    type: 'array',
+    items: { type: 'object' },
+};
+const CREDENTIAL_TYPE_TO_METHOD = {
+    public_key: 'private_key_jwt',
+    x509_cert: 'self_signed_tls_client_auth',
+    cert_subject_dn: 'tls_client_auth',
+};
+class ClientAuthCredentialsHandler {
+    constructor({ client, config }) {
+        this.type = 'clientAuthCredentials';
+        this.existing = null;
+        this.client = client;
+        this.config = config;
+    }
+    async getType() {
+        return null;
+    }
+    async load() {
+        logger_1.default.info(`Retrieving ${this.type} data from Auth0`);
+        return { [this.type]: null };
+    }
+    async validate() {
+        return null;
+    }
+    async processChanges(assets) {
+        const { clients } = assets;
+        if (!clients)
+            return;
+        const allowDelete = this.config('AUTH0_ALLOW_DELETE') === true || this.config('AUTH0_ALLOW_DELETE') === 'true';
+        // Only process clients that have client_authentication_methods in config.
+        // Full deletion (absent field) is handled by ClientAuthCredentialsPreHandler at order 40,
+        // before clients.ts runs. This handler only manages create and partial delete.
+        const clientsWithCam = clients.filter((c) => c.client_authentication_methods !== undefined);
+        if (clientsWithCam.length === 0)
+            return;
+        // In directory mode client_id is stripped. Resolve names for PKI clients only.
+        const needsNameResolution = clientsWithCam.some((c) => !c.client_id);
+        let clientIdByName = new Map();
+        if (needsNameResolution) {
+            const existingClients = await (0, client_1.paginate)(this.client.clients.list, {
+                paginate: true,
+                is_global: false,
+            });
+            clientIdByName = new Map(existingClients.map((c) => [c.name, c.client_id]));
+        }
+        for (const client of clientsWithCam) {
+            const clientId = client.client_id || (client.name && clientIdByName.get(client.name));
+            if (!clientId)
+                continue;
+            client.client_id = clientId;
+            const clientName = client.name || clientId;
+            // Collect all desired credentials across all auth methods (only pem-bearing entries)
+            const desired = [];
+            if (client.client_authentication_methods) {
+                for (const [methodKey, methodVal] of Object.entries(client.client_authentication_methods)) {
+                    const credentials = methodVal?.credentials || [];
+                    for (const cred of credentials) {
+                        if (!cred.pem)
+                            continue;
+                        desired.push({
+                            name: cred.name,
+                            pem: cred.pem,
+                            credential_type: cred.credential_type || this.inferCredentialType(methodKey),
+                            method: methodKey,
+                        });
+                    }
+                }
+            }
+            // pem is the opt-in signal: present field with no pem = skip (safe export→deploy);
+            // absent field = fall through to delete path (intentional removal).
+            if (desired.length === 0 && client.client_authentication_methods)
+                continue;
+            let existing = [];
+            try {
+                existing = (await this.client.clients.credentials.list(clientId));
+            }
+            catch (err) {
+                logger_1.default.warn(`clientAuthCredentials: failed to list credentials for client "${clientName}": ${err}`);
+                continue;
+            }
+            // No credentials in Auth0 and none desired — nothing to do.
+            if (existing.length === 0 && desired.length === 0)
+                continue;
+            // Warn if duplicate names exist in Auth0 — we can't match safely
+            const existingNames = existing.map((c) => c.name);
+            const duplicateNames = existingNames.filter((n, i) => existingNames.indexOf(n) !== i);
+            if (duplicateNames.length > 0) {
+                logger_1.default.warn(`clientAuthCredentials: client "${clientName}" has duplicate credential names in Auth0 [${duplicateNames.join(', ')}] — skipping credential reconciliation for this client`);
+                continue;
+            }
+            const existingByName = new Map(existing.map((c) => [c.name, c]));
+            const desiredNames = new Set(desired.map((d) => d.name));
+            const toCreate = desired.filter((d) => !existingByName.has(d.name));
+            const toDelete = existing.filter((e) => !desiredNames.has(e.name));
+            // Creates first — Auth0 allows max 2 credentials; both must exist simultaneously during rotation
+            // Track name→id so we can correctly attribute each created credential to its method later.
+            const createdIdByName = new Map();
+            for (const cred of toCreate) {
+                try {
+                    const created = await this.client.clients.credentials.create(clientId, {
+                        name: cred.name,
+                        pem: cred.pem,
+                        credential_type: cred.credential_type,
+                    });
+                    logger_1.default.info(`clientAuthCredentials: created credential "${cred.name}" on client "${clientName}"`);
+                    createdIdByName.set(cred.name, created.id);
+                }
+                catch (err) {
+                    logger_1.default.warn(`clientAuthCredentials: failed to create credential "${cred.name}" on client "${clientName}": ${err}`);
+                }
+            }
+            // Re-wire client_authentication_methods with final IDs (kept + newly created).
+            // This must happen BEFORE deletes — Auth0 rejects deleting a credential that
+            // is still referenced in client_authentication_methods.
+            const keptIds = existing.filter((e) => desiredNames.has(e.name)).map((e) => e.id);
+            const createdIds = [...createdIdByName.values()];
+            const finalIds = [...keptIds, ...createdIds];
+            let updatedAuthMethods = null;
+            if (finalIds.length > 0) {
+                // Build method→ids map. For kept credentials use Auth0's stored type to infer method;
+                // for created credentials use the method from the user's config entry (by name).
+                const methodToIds = {};
+                for (const id of finalIds) {
+                    const fromExisting = existing.find((e) => e.id === id);
+                    const createdName = [...createdIdByName.entries()].find(([, cid]) => cid === id)?.[0];
+                    const fromDesired = createdName ? desired.find((d) => d.name === createdName) : undefined;
+                    const methodKey = (fromExisting && this.inferMethodFromType(fromExisting.credential_type)) ||
+                        (fromDesired && fromDesired.method) ||
+                        Object.keys(client.client_authentication_methods)[0];
+                    if (!methodToIds[methodKey])
+                        methodToIds[methodKey] = [];
+                    methodToIds[methodKey].push(id);
+                }
+                updatedAuthMethods = {};
+                for (const [methodKey, ids] of Object.entries(methodToIds)) {
+                    updatedAuthMethods[methodKey] = { credentials: ids.map((id) => ({ id })) };
+                }
+            }
+            // Always update client_authentication_methods before deletes:
+            // - When finalIds > 0: re-wire to the remaining credentials
+            // - When finalIds === 0 but toDelete > 0: set to null so Auth0 de-references them first
+            if (finalIds.length > 0 || toDelete.length > 0) {
+                try {
+                    const payload = {
+                        client_authentication_methods: updatedAuthMethods ?? null,
+                    };
+                    // Auth0 requires token_endpoint_auth_method: null when setting client_authentication_methods,
+                    // and a non-null value when clearing it.
+                    if (updatedAuthMethods) {
+                        payload.token_endpoint_auth_method = null;
+                    }
+                    else {
+                        payload.token_endpoint_auth_method =
+                            client.token_endpoint_auth_method || 'client_secret_post';
+                    }
+                    await this.client.clients.update(clientId, payload);
+                    logger_1.default.info(`clientAuthCredentials: updated client_authentication_methods on client "${clientName}"`);
+                }
+                catch (err) {
+                    logger_1.default.warn(`clientAuthCredentials: failed to update client_authentication_methods on client "${clientName}": ${err}`);
+                }
+            }
+            // Deletes last — after client_authentication_methods no longer references them
+            if (toDelete.length > 0) {
+                if (!allowDelete) {
+                    logger_1.default.warn(`clientAuthCredentials: the following credentials on client "${clientName}" would be deleted but AUTH0_ALLOW_DELETE is not set:\n${toDelete
+                        .map((c) => `  ${c.name} (${c.id})`)
+                        .join('\n')}`);
+                }
+                else {
+                    for (const cred of toDelete) {
+                        try {
+                            await this.client.clients.credentials.delete(clientId, cred.id);
+                            logger_1.default.info(`clientAuthCredentials: deleted credential "${cred.name}" on client "${clientName}"`);
+                        }
+                        catch (err) {
+                            logger_1.default.warn(`clientAuthCredentials: failed to delete credential "${cred.name}" on client "${clientName}": ${err}`);
+                        }
+                    }
+                }
+            }
+        }
+    }
+    inferCredentialType(methodKey) {
+        const map = {
+            private_key_jwt: 'public_key',
+            self_signed_tls_client_auth: 'x509_cert',
+            tls_client_auth: 'cert_subject_dn',
+        };
+        return map[methodKey] || 'public_key';
+    }
+    inferMethodFromType(credentialType) {
+        return CREDENTIAL_TYPE_TO_METHOD[credentialType] || 'private_key_jwt';
+    }
+}
+exports.default = ClientAuthCredentialsHandler;
+__decorate([
+    (0, default_1.order)('70')
+], ClientAuthCredentialsHandler.prototype, "processChanges", null);

package/lib/tools/auth0/handlers/clientAuthCredentialsPre.d.ts

@@ -0,0 +1,37 @@
+import { Assets, Auth0APIClient } from '../../../types';
+import { ConfigFunction } from '../../../configFactory';
+export declare const schema: {
+    type: string;
+    items: {
+        type: string;
+    };
+};
+/**
+ * Handles full credential deletion BEFORE clients.ts (order 50) patches the client.
+ *
+ * Auth0 rejects a client PATCH containing token_endpoint_auth_method while that client still
+ * has active credentials. By running at order 40, this handler clears credentials (and
+ * client_authentication_methods) for any client where the field is absent from config, so
+ * that clients.ts can safely include token_endpoint_auth_method in its PATCH.
+ *
+ * Partial deletion (some credentials removed, others kept) is handled by
+ * ClientAuthCredentialsHandler at order 70, because those clients still have
+ * client_authentication_methods present in config and clients.ts strips token_endpoint_auth_method
+ * for them anyway.
+ */
+export default class ClientAuthCredentialsPreHandler {
+    client: Auth0APIClient;
+    config: ConfigFunction;
+    type: string;
+    existing: null;
+    constructor({ client, config }: {
+        client: Auth0APIClient;
+        config: ConfigFunction;
+    });
+    getType(): Promise<null>;
+    load(): Promise<{
+        [x: string]: null;
+    }>;
+    validate(): Promise<null>;
+    processChanges(assets: Assets): Promise<void>;
+}

package/lib/tools/auth0/handlers/clientAuthCredentialsPre.js

@@ -0,0 +1,118 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.schema = void 0;
+const default_1 = require("./default");
+const client_1 = require("../client");
+const logger_1 = __importDefault(require("../../../logger"));
+exports.schema = {
+    type: 'array',
+    items: { type: 'object' },
+};
+/**
+ * Handles full credential deletion BEFORE clients.ts (order 50) patches the client.
+ *
+ * Auth0 rejects a client PATCH containing token_endpoint_auth_method while that client still
+ * has active credentials. By running at order 40, this handler clears credentials (and
+ * client_authentication_methods) for any client where the field is absent from config, so
+ * that clients.ts can safely include token_endpoint_auth_method in its PATCH.
+ *
+ * Partial deletion (some credentials removed, others kept) is handled by
+ * ClientAuthCredentialsHandler at order 70, because those clients still have
+ * client_authentication_methods present in config and clients.ts strips token_endpoint_auth_method
+ * for them anyway.
+ */
+class ClientAuthCredentialsPreHandler {
+    constructor({ client, config }) {
+        // Same type as ClientAuthCredentialsHandler so AUTH0_EXCLUDED / AUTH0_INCLUDED_ONLY
+        // applies to both handlers together without needing a separate AssetTypes entry.
+        this.type = 'clientAuthCredentials';
+        this.existing = null;
+        this.client = client;
+        this.config = config;
+    }
+    async getType() {
+        return null;
+    }
+    async load() {
+        return { [this.type]: null };
+    }
+    async validate() {
+        return null;
+    }
+    async processChanges(assets) {
+        const { clients } = assets;
+        if (!clients)
+            return;
+        const allowDelete = this.config('AUTH0_ALLOW_DELETE') === true || this.config('AUTH0_ALLOW_DELETE') === 'true';
+        // When allowDelete is false no deletion will happen — skip entirely to avoid
+        // unnecessary GET /credentials calls for every client.
+        if (!allowDelete)
+            return;
+        // Only act on clients where client_authentication_methods is absent from config.
+        // Absent = intentional full deletion. Clients with the field present (including partial
+        // deletion) are fully handled by ClientAuthCredentialsHandler at order 70.
+        const deletionCandidates = clients.filter((c) => c.client_authentication_methods === undefined);
+        if (deletionCandidates.length === 0)
+            return;
+        // In directory mode client_id is stripped. Resolve names once for all candidates.
+        const needsNameResolution = deletionCandidates.some((c) => !c.client_id);
+        let clientIdByName = new Map();
+        if (needsNameResolution) {
+            const existingClients = await (0, client_1.paginate)(this.client.clients.list, {
+                paginate: true,
+                is_global: false,
+            });
+            clientIdByName = new Map(existingClients.map((c) => [c.name, c.client_id]));
+        }
+        for (const client of deletionCandidates) {
+            const clientId = client.client_id || (client.name && clientIdByName.get(client.name));
+            if (!clientId)
+                continue;
+            const clientName = client.name || clientId;
+            let existing = [];
+            try {
+                existing = (await this.client.clients.credentials.list(clientId));
+            }
+            catch (err) {
+                logger_1.default.warn(`clientAuthCredentials: failed to list credentials for client "${clientName}": ${err}`);
+                continue;
+            }
+            if (existing.length === 0)
+                continue;
+            // De-reference credentials from client_authentication_methods before deleting them —
+            // Auth0 rejects deleting a credential that is still referenced.
+            try {
+                await this.client.clients.update(clientId, {
+                    client_authentication_methods: null,
+                    token_endpoint_auth_method: client.token_endpoint_auth_method || 'client_secret_post',
+                });
+            }
+            catch (err) {
+                logger_1.default.warn(`clientAuthCredentials: failed to clear client_authentication_methods on client "${clientName}": ${err}`);
+                continue;
+            }
+            for (const cred of existing) {
+                try {
+                    await this.client.clients.credentials.delete(clientId, cred.id);
+                    logger_1.default.info(`clientAuthCredentials: deleted credential "${cred.name}" on client "${clientName}"`);
+                }
+                catch (err) {
+                    logger_1.default.warn(`clientAuthCredentials: failed to delete credential "${cred.name}" on client "${clientName}": ${err}`);
+                }
+            }
+        }
+    }
+}
+exports.default = ClientAuthCredentialsPreHandler;
+__decorate([
+    (0, default_1.order)('40')
+], ClientAuthCredentialsPreHandler.prototype, "processChanges", null);

package/lib/tools/auth0/handlers/clients.js

@@ -566,6 +566,17 @@ class ClientHandler extends default_1.default {
                         delete item.refresh_token;
                     }
                 }
+                // Strip client_authentication_methods — the clientAuthCredentials handler (order 70)
+                // owns this field entirely. Auth0 rejects credential objects with name/credential_type in PATCH.
+                // Strip token_endpoint_auth_method only when client_authentication_methods is present in config:
+                // Auth0 rejects it in PATCH while a client has active credentials. For these clients the
+                // clientAuthCredentials handler (order 70) owns token_endpoint_auth_method too.
+                // For clients without client_authentication_methods, credentials were already cleared by
+                // clientAuthCredentialsPre (order 40), so token_endpoint_auth_method passes through safely.
+                if (item.client_authentication_methods) {
+                    delete item.token_endpoint_auth_method;
+                }
+                delete item.client_authentication_methods;
                 return item;
             });
         };
@@ -587,7 +598,33 @@ class ClientHandler extends default_1.default {
             is_global: false,
             ...((0, utils_1.shouldExcludeThirdPartyClients)(this.config) && { is_first_party: true }),
         });
-        this.existing = createClientSanitizer(clients).sanitizeCrossOriginAuth(false).get();
+        const sanitized = createClientSanitizer(clients).sanitizeCrossOriginAuth(false).get();
+        // Enrich credential stubs with name and credential_type for export.
+        // Auth0 does not return pem on read — it is never exported.
+        await Promise.all(sanitized.map(async (client) => {
+            if (!client.client_authentication_methods)
+                return;
+            try {
+                const creds = await this.client.clients.credentials.list(client.client_id);
+                const credMap = new Map(creds.map((c) => [c.id, c]));
+                Object.values(client.client_authentication_methods).forEach((method) => {
+                    if (method?.credentials) {
+                        method.credentials = method.credentials
+                            .map((stub) => {
+                            const full = credMap.get(stub.id);
+                            if (!full?.name)
+                                return null;
+                            return { name: full.name, credential_type: full.credential_type };
+                        })
+                            .filter(Boolean);
+                    }
+                });
+            }
+            catch (_) {
+                // leave stubs as-is if the credentials API call fails
+            }
+        }));
+        this.existing = sanitized;
         return this.existing;
     }
     isCimdClient(client) {

package/lib/tools/auth0/handlers/eventStreams.js

@@ -38,10 +38,14 @@ var __importStar = (this && this.__importStar) || (function () {
         return result;
     };
 })();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.schema = void 0;
 const default_1 = __importStar(require("./default"));
 const client_1 = require("../client");
+const logger_1 = __importDefault(require("../../../logger"));
 exports.schema = {
     type: 'array',
     items: {
@@ -161,8 +165,12 @@ class EventStreamsHandler extends default_1.default {
             create: changesResponse.create.map((stream) => this.resolveActionId(stream)),
             update: changesResponse.update.map((stream) => {
                 const resolved = this.resolveActionId(stream);
-                // EventBridge destinations cannot be patched — the API rejects destination on PATCH
-                if (resolved.destination?.type === 'eventbridge') {
+                // A destination's type cannot be changed once an event stream is created. The API
+                // rejects the destination on PATCH for eventbridge and action streams, so strip it
+                // from the update payload and only apply the other mutable fields.
+                if (resolved.destination?.type === 'eventbridge' ||
+                    resolved.destination?.type === 'action') {
+                    logger_1.default.info(`Skipping destination update for event stream "${resolved.name}": ${resolved.destination.type} destinations cannot be changed after creation.`);
                     const { destination: _dest, ...rest } = resolved;
                     return rest;
                 }

package/lib/tools/auth0/handlers/index.js

@@ -74,7 +74,10 @@ const userAttributeProfiles = __importStar(require("./userAttributeProfiles"));
 const connectionProfiles = __importStar(require("./connectionProfiles"));
 const tokenExchangeProfiles = __importStar(require("./tokenExchangeProfiles"));
 const supplementalSignals = __importStar(require("./supplementalSignals"));
+const rateLimitPolicies = __importStar(require("./rateLimitPolicies"));
 const eventStreams = __importStar(require("./eventStreams"));
+const clientAuthCredentials = __importStar(require("./clientAuthCredentials"));
+const clientAuthCredentialsPre = __importStar(require("./clientAuthCredentialsPre"));
 const auth0ApiHandlers = {
     rules,
     rulesConfigs,
@@ -118,6 +121,11 @@ const auth0ApiHandlers = {
     connectionProfiles,
     tokenExchangeProfiles,
     supplementalSignals,
+    rateLimitPolicies,
     eventStreams,
+    clientAuthCredentials,
+    // clientAuthCredentialsPre is a deploy-only pre-pass handler (order 40) — not a user-facing
+    // asset type so it is not in AssetTypes, but must be registered here to run during deploy.
+    ...{ clientAuthCredentialsPre },
 };
 exports.default = auth0ApiHandlers; // TODO: apply stronger types to schema properties

package/lib/tools/auth0/handlers/organizations.d.ts

@@ -104,6 +104,10 @@ export declare const schema: {
                     required: string[];
                 };
             };
+            third_party_client_access: {
+                type: string;
+                enum: ("allow" | "block")[];
+            };
         };
         required: string[];
     };

package/lib/tools/auth0/handlers/organizations.js

@@ -127,6 +127,10 @@ exports.schema = {
                     required: ['domain', 'status'],
                 },
             },
+            third_party_client_access: {
+                type: 'string',
+                enum: Object.values(auth0_1.Management.OrganizationThirdPartyClientAccessEnum),
+            },
         },
         required: ['name'],
     },

package/lib/tools/auth0/handlers/prompts.js

@@ -496,7 +496,7 @@ class PromptsHandler extends default_1.default {
             updatePayload = {
                 ...updatePrams,
                 rendering_mode: auth0_1.Management.AculRenderingModeEnum.Advanced,
-                default_head_tags_disabled: screenRenderer.default_head_tags_disabled || undefined,
+                default_head_tags_disabled: screenRenderer.default_head_tags_disabled ?? undefined,
                 head_tags: screenRenderer.head_tags,
             };
         }

package/lib/tools/auth0/handlers/rateLimitPolicies.d.ts

@@ -0,0 +1,81 @@
+import { Management } from 'auth0';
+import DefaultAPIHandler from './default';
+import { Asset, Assets, CalculatedChanges } from '../../../types';
+export type RateLimitPolicyConfiguration = Management.RateLimitPolicyConfiguration;
+export type RateLimitPolicy = Management.RateLimitPolicy;
+export declare const schema: {
+    type: string;
+    items: {
+        type: string;
+        properties: {
+            resource: {
+                type: string;
+                enum: "oauth_authentication_api"[];
+            };
+            consumer: {
+                type: string;
+                enum: "client"[];
+            };
+            consumer_selector: {
+                type: string;
+            };
+            configuration: {
+                type: string;
+                oneOf: ({
+                    required: string[];
+                    properties: {
+                        action: {
+                            type: string;
+                            enum: string[];
+                        };
+                        limit?: undefined;
+                        redirect_uri?: undefined;
+                    };
+                    additionalProperties: boolean;
+                } | {
+                    required: string[];
+                    properties: {
+                        action: {
+                            type: string;
+                            enum: string[];
+                        };
+                        limit: {
+                            type: string;
+                        };
+                        redirect_uri?: undefined;
+                    };
+                    additionalProperties: boolean;
+                } | {
+                    required: string[];
+                    properties: {
+                        action: {
+                            type: string;
+                            enum: string[];
+                        };
+                        limit: {
+                            type: string;
+                        };
+                        redirect_uri: {
+                            type: string;
+                        };
+                    };
+                    additionalProperties: boolean;
+                })[];
+            };
+        };
+        required: string[];
+    };
+};
+export default class RateLimitPoliciesHandler extends DefaultAPIHandler {
+    existing: RateLimitPolicy[] | null;
+    constructor(config: DefaultAPIHandler);
+    objString(policy: RateLimitPolicy): string;
+    getType(): Promise<Asset | null>;
+    processChanges(assets: Assets): Promise<void>;
+    createRateLimitPolicy(policy: RateLimitPolicy): Promise<RateLimitPolicy>;
+    createRateLimitPolicies(creates: CalculatedChanges['create']): Promise<void>;
+    updateRateLimitPolicy(policy: RateLimitPolicy): Promise<void>;
+    updateRateLimitPolicies(updates: CalculatedChanges['update']): Promise<void>;
+    deleteRateLimitPolicy(policy: RateLimitPolicy): Promise<void>;
+    deleteRateLimitPolicies(data: Asset[]): Promise<void>;
+}

package/lib/tools/auth0/handlers/rateLimitPolicies.js

@@ -0,0 +1,203 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.schema = void 0;
+const auth0_1 = require("auth0");
+const default_1 = __importDefault(require("./default"));
+const client_1 = require("../client");
+const utils_1 = require("../../utils");
+const logger_1 = __importDefault(require("../../../logger"));
+exports.schema = {
+    type: 'array',
+    items: {
+        type: 'object',
+        properties: {
+            resource: {
+                type: 'string',
+                enum: Object.values(auth0_1.Management.RateLimitPolicyResourceEnum),
+            },
+            consumer: {
+                type: 'string',
+                enum: Object.values(auth0_1.Management.RateLimitPolicyConsumerEnum),
+            },
+            consumer_selector: {
+                type: 'string',
+            },
+            configuration: {
+                type: 'object',
+                oneOf: [
+                    {
+                        required: ['action'],
+                        properties: {
+                            action: { type: 'string', enum: ['allow'] },
+                        },
+                        additionalProperties: false,
+                    },
+                    {
+                        required: ['action', 'limit'],
+                        properties: {
+                            action: { type: 'string', enum: ['block', 'log'] },
+                            limit: { type: 'number' },
+                        },
+                        additionalProperties: false,
+                    },
+                    {
+                        required: ['action', 'limit', 'redirect_uri'],
+                        properties: {
+                            action: { type: 'string', enum: ['redirect'] },
+                            limit: { type: 'number' },
+                            redirect_uri: { type: 'string' },
+                        },
+                        additionalProperties: false,
+                    },
+                ],
+            },
+        },
+        required: ['resource', 'consumer', 'consumer_selector', 'configuration'],
+    },
+};
+class RateLimitPoliciesHandler extends default_1.default {
+    constructor(config) {
+        super({
+            ...config,
+            type: 'rateLimitPolicies',
+            id: 'id',
+            identifiers: ['id', 'consumer_selector'],
+            stripCreateFields: ['id', 'created_at', 'updated_at'],
+            stripUpdateFields: [
+                'id',
+                'resource',
+                'consumer',
+                'consumer_selector',
+                'created_at',
+                'updated_at',
+            ],
+        });
+    }
+    objString(policy) {
+        return super.objString({
+            consumer_selector: policy.consumer_selector,
+            resource: policy.resource,
+        });
+    }
+    async getType() {
+        if (this.existing)
+            return this.existing;
+        try {
+            const rateLimitPolicies = await (0, client_1.paginate)(this.client.rateLimitPolicies.list, { checkpoint: true });
+            this.existing = rateLimitPolicies;
+            return this.existing;
+        }
+        catch (err) {
+            if (err.statusCode === 404 || err.statusCode === 501) {
+                return null;
+            }
+            if (err.statusCode === 403) {
+                logger_1.default.debug('Rate Limit Policies feature is not enabled for this tenant. Please contact Auth0 support to enable this feature.');
+                return null;
+            }
+            throw err;
+        }
+    }
+    async processChanges(assets) {
+        const { rateLimitPolicies } = assets;
+        if (!rateLimitPolicies)
+            return;
+        const { del, update, create } = await this.calcChanges(assets);
+        if ((0, utils_1.isDryRun)(this.config)) {
+            if (create.length === 0 && update.length === 0 && del.length === 0) {
+                return;
+            }
+        }
+        logger_1.default.debug(`Start processChanges for rateLimitPolicies [delete:${del.length}] [update:${update.length}], [create:${create.length}]`);
+        const changes = [{ del }, { create }, { update }];
+        await Promise.all(changes.map(async (change) => {
+            switch (true) {
+                case change.del && change.del.length > 0:
+                    await this.deleteRateLimitPolicies(change.del);
+                    break;
+                case change.create && change.create.length > 0:
+                    await this.createRateLimitPolicies(change.create);
+                    break;
+                case change.update && change.update.length > 0:
+                    await this.updateRateLimitPolicies(change.update);
+                    break;
+                default:
+                    break;
+            }
+        }));
+    }
+    async createRateLimitPolicy(policy) {
+        const created = await this.client.rateLimitPolicies.create(policy);
+        return created;
+    }
+    async createRateLimitPolicies(creates) {
+        await this.client.pool
+            .addEachTask({
+            data: creates || [],
+            generator: (item) => this.createRateLimitPolicy(item)
+                .then((data) => {
+                this.didCreate(data);
+                this.created += 1;
+            })
+                .catch((err) => {
+                throw new Error(`Problem creating ${this.type} ${this.objString(item)}\n${err}`);
+            }),
+        })
+            .promise();
+    }
+    async updateRateLimitPolicy(policy) {
+        const { id, configuration } = policy;
+        if (!id) {
+            throw new Error(`Missing id for ${this.type} ${this.objString(policy)}`);
+        }
+        await this.client.rateLimitPolicies.update(id, { configuration });
+    }
+    async updateRateLimitPolicies(updates) {
+        await this.client.pool
+            .addEachTask({
+            data: updates || [],
+            generator: (item) => this.updateRateLimitPolicy(item)
+                .then(() => {
+                this.didUpdate(item);
+                this.updated += 1;
+            })
+                .catch((err) => {
+                throw new Error(`Problem updating ${this.type} ${this.objString(item)}\n${err}`);
+            }),
+        })
+            .promise();
+    }
+    async deleteRateLimitPolicy(policy) {
+        if (!policy.id) {
+            throw new Error(`Missing id for ${this.type} ${this.objString(policy)}`);
+        }
+        await this.client.rateLimitPolicies.delete(policy.id);
+    }
+    async deleteRateLimitPolicies(data) {
+        if (this.config('AUTH0_ALLOW_DELETE') === 'true' ||
+            this.config('AUTH0_ALLOW_DELETE') === true) {
+            await this.client.pool
+                .addEachTask({
+                data: data || [],
+                generator: (item) => this.deleteRateLimitPolicy(item)
+                    .then(() => {
+                    this.didDelete(item);
+                    this.deleted += 1;
+                })
+                    .catch((err) => {
+                    throw new Error(`Problem deleting ${this.type} ${this.objString(item)}\n${err}`);
+                }),
+            })
+                .promise();
+        }
+        else {
+            logger_1.default.warn(`Detected the following ${this.type} should be deleted. Doing so may be destructive.\nYou can enable deletes by setting 'AUTH0_ALLOW_DELETE' to true in the config\n${data
+                .map((i) => this.objString(i))
+                .join('\n')}`);
+        }
+    }
+}
+exports.default = RateLimitPoliciesHandler;

package/lib/tools/constants.d.ts

@@ -90,6 +90,7 @@ declare const constants: {
     CONNECTION_PROFILES_DIRECTORY: string;
     TOKEN_EXCHANGE_PROFILES_DIRECTORY: string;
     SUPPLEMENTAL_SIGNALS_DIRECTORY: string;
+    RATE_LIMIT_POLICIES_DIRECTORY: string;
     EVENT_STREAMS_DIRECTORY: string;
 };
 export default constants;

package/lib/tools/constants.js

@@ -220,6 +220,7 @@ const constants = {
     CONNECTION_PROFILES_DIRECTORY: 'connection-profiles',
     TOKEN_EXCHANGE_PROFILES_DIRECTORY: 'token-exchange-profiles',
     SUPPLEMENTAL_SIGNALS_DIRECTORY: 'supplemental-signals',
+    RATE_LIMIT_POLICIES_DIRECTORY: 'rate-limit-policies',
     EVENT_STREAMS_DIRECTORY: 'event-streams',
 };
 exports.default = constants;

package/lib/types.d.ts

@@ -21,6 +21,7 @@ import { AttackProtection } from './tools/auth0/handlers/attackProtection';
 import { TokenExchangeProfile } from './tools/auth0/handlers/tokenExchangeProfiles';
 import { RiskAssessment } from './tools/auth0/handlers/riskAssessment';
 import { SupplementalSignals } from './tools/auth0/handlers/supplementalSignals';
+import { RateLimitPolicy } from './tools/auth0/handlers/rateLimitPolicies';
 import { EventStream } from './tools/auth0/handlers/eventStreams';
 type SharedPaginationParams = {
     checkpoint?: boolean;
@@ -159,6 +160,7 @@ export type Assets = Partial<{
     userAttributeProfilesWithId: UserAttributeProfile[] | null;
     connectionProfiles: Asset[] | null;
     tokenExchangeProfiles: TokenExchangeProfile[] | null;
+    rateLimitPolicies: RateLimitPolicy[] | null;
     eventStreams: EventStream[] | null;
 }>;
 export type CalculatedChanges = {
@@ -180,7 +182,7 @@ export type DetailedDryRunChanges = {
         changes: DetailedDryRunChange[];
     };
 };
-export type AssetTypes = 'rules' | 'rulesConfigs' | 'hooks' | 'pages' | 'databases' | 'clientGrants' | 'resourceServers' | 'clients' | 'connections' | 'tenant' | 'emailProvider' | 'emailTemplates' | 'guardianFactors' | 'guardianFactorProviders' | 'guardianFactorTemplates' | 'guardianPhoneFactorMessageTypes' | 'guardianPhoneFactorSelectedProvider' | 'guardianPolicies' | 'roles' | 'actions' | 'actionModules' | 'organizations' | 'triggers' | 'attackProtection' | 'riskAssessment' | 'branding' | 'phoneProviders' | 'phoneTemplates' | 'logStreams' | 'prompts' | 'customDomains' | 'themes' | 'forms' | 'flows' | 'flowVaultConnections' | 'selfServiceProfiles' | 'networkACLs' | 'userAttributeProfiles' | 'connectionProfiles' | 'tokenExchangeProfiles' | 'supplementalSignals' | 'eventStreams';
+export type AssetTypes = 'rules' | 'rulesConfigs' | 'hooks' | 'pages' | 'databases' | 'clientGrants' | 'resourceServers' | 'clients' | 'connections' | 'tenant' | 'emailProvider' | 'emailTemplates' | 'guardianFactors' | 'guardianFactorProviders' | 'guardianFactorTemplates' | 'guardianPhoneFactorMessageTypes' | 'guardianPhoneFactorSelectedProvider' | 'guardianPolicies' | 'roles' | 'actions' | 'actionModules' | 'organizations' | 'triggers' | 'attackProtection' | 'riskAssessment' | 'branding' | 'phoneProviders' | 'phoneTemplates' | 'logStreams' | 'prompts' | 'customDomains' | 'themes' | 'forms' | 'flows' | 'flowVaultConnections' | 'selfServiceProfiles' | 'networkACLs' | 'userAttributeProfiles' | 'connectionProfiles' | 'tokenExchangeProfiles' | 'supplementalSignals' | 'rateLimitPolicies' | 'eventStreams' | 'clientAuthCredentials';
 export type KeywordMappings = {
     [key: string]: (string | number)[] | string | number;
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "auth0-deploy-cli",
-  "version": "8.39.0",
+  "version": "8.41.0",
   "description": "A command line tool for deploying updates to your Auth0 tenant",
   "main": "lib/index.js",
   "bin": {
@@ -35,7 +35,7 @@
   "dependencies": {
     "@clack/prompts": "1.4.0",
     "ajv": "^6.12.6",
-    "auth0": "^5.13.0",
+    "auth0": "^6.0.0",
     "chalk": "5.6.2",
     "dot-prop": "^5.3.0",
     "fs-extra": "^10.1.0",