auth0-deploy-cli 8.41.0 → 8.42.0

package/CHANGELOG.md

@@ -7,6 +7,25 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [8.42.0] - 2026-07-30
+
+### Added
+
+- Add UL identifier input support for themes and tenant settings. [#1433]
+- Add `token_vault_privileged_access` support for clients. [#1430]
+- Add `auth0_managed` field support for network ACLs (Curated Blocklists - EA). [#1435]
+- Add Cross App Access (XAA) resource app support for connections and clients. [#1431]
+- Add `cross_app_access_requesting_app` support for connections (EA). [#1422]
+
+### Fixed
+
+- Prevent dry-run crash on `clientAuthCredentials` handler. [#1438]
+- Resolve spurious dry-run diffs for rules, themes, and hooks. [#1437]
+- Strip unresolved placeholders on deploy instead of throwing. [#1436]
+- Handle 403 entitlement errors for bot detection and captcha on export. [#1434]
+- Warn and skip deprecated guardian phone provider on 403 during import. [#1429]
+- Add `use_scope_descriptions_for_consent` to allowed tenant flags. [#1428]
+
 ## [8.41.0] - 2026-07-16
 
 ### Added
@@ -1876,8 +1895,20 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 [#1416]: https://github.com/auth0/auth0-deploy-cli/issues/1416
 [#1417]: https://github.com/auth0/auth0-deploy-cli/issues/1417
 [#1421]: https://github.com/auth0/auth0-deploy-cli/issues/1421
+[#1422]: https://github.com/auth0/auth0-deploy-cli/issues/1422
 [#1425]: https://github.com/auth0/auth0-deploy-cli/issues/1425
-[Unreleased]: https://github.com/auth0/auth0-deploy-cli/compare/v8.41.0...HEAD
+[#1428]: https://github.com/auth0/auth0-deploy-cli/issues/1428
+[#1429]: https://github.com/auth0/auth0-deploy-cli/issues/1429
+[#1430]: https://github.com/auth0/auth0-deploy-cli/issues/1430
+[#1431]: https://github.com/auth0/auth0-deploy-cli/issues/1431
+[#1433]: https://github.com/auth0/auth0-deploy-cli/issues/1433
+[#1434]: https://github.com/auth0/auth0-deploy-cli/issues/1434
+[#1435]: https://github.com/auth0/auth0-deploy-cli/issues/1435
+[#1436]: https://github.com/auth0/auth0-deploy-cli/issues/1436
+[#1437]: https://github.com/auth0/auth0-deploy-cli/issues/1437
+[#1438]: https://github.com/auth0/auth0-deploy-cli/issues/1438
+[Unreleased]: https://github.com/auth0/auth0-deploy-cli/compare/v8.42.0...HEAD
+[8.42.0]: https://github.com/auth0/auth0-deploy-cli/compare/v8.41.0...v8.42.0
 [8.41.0]: https://github.com/auth0/auth0-deploy-cli/compare/v8.40.0...v8.41.0
 [8.40.0]: https://github.com/auth0/auth0-deploy-cli/compare/v8.39.0...v8.40.0
 [8.39.0]: https://github.com/auth0/auth0-deploy-cli/compare/v8.38.0...v8.39.0

package/lib/tools/auth0/handlers/attackProtection.js

@@ -243,14 +243,25 @@ class AttackProtectionHandler extends default_1.default {
         let botDetection = null;
         let captcha = null;
         try {
-            [botDetection, captcha] = await Promise.all([
-                this.client.attackProtection.botDetection.get(),
-                this.client.attackProtection.captcha.get(),
-            ]);
+            botDetection = await this.client.attackProtection.botDetection.get();
         }
         catch (err) {
             if (err.statusCode === 403) {
-                logger_1.default.warn('Bot Detection API are not enabled for this tenant. Please verify `scope` or contact Auth0 support to enable this feature.');
+                logger_1.default.warn("Bot detection is not available on this tenant's current plan. Skipping bot detection settings.");
+            }
+            else {
+                throw err;
+            }
+        }
+        try {
+            captcha = await this.client.attackProtection.captcha.get();
+        }
+        catch (err) {
+            if (err.statusCode === 403) {
+                logger_1.default.warn("Captcha is not available on this tenant's current plan. Skipping captcha settings.");
+            }
+            else {
+                throw err;
             }
         }
         const attackProtection = {

package/lib/tools/auth0/handlers/clientAuthCredentials.d.ts

@@ -1,4 +1,4 @@
-import { Assets, Auth0APIClient } from '../../../types';
+import { Assets, Auth0APIClient, CalculatedChanges } from '../../../types';
 import { ConfigFunction } from '../../../configFactory';
 export declare const schema: {
     type: string;
@@ -20,6 +20,7 @@ export default class ClientAuthCredentialsHandler {
         [x: string]: null;
     }>;
     validate(): Promise<null>;
+    dryRunChanges(_assets: Assets): Promise<CalculatedChanges>;
     processChanges(assets: Assets): Promise<void>;
     private inferCredentialType;
     private inferMethodFromType;

package/lib/tools/auth0/handlers/clientAuthCredentials.js

@@ -39,6 +39,13 @@ class ClientAuthCredentialsHandler {
     async validate() {
         return null;
     }
+    // Credentials are per-client sub-resources with no top-level asset list, so they are not
+    // modeled in the dry-run diff. Return empty changes so the dry-run loop (which calls
+    // dryRunChanges on every handler) does not crash. Credential changes are still applied
+    // during a real import via processChanges.
+    async dryRunChanges(_assets) {
+        return { del: [], create: [], conflicts: [], update: [] };
+    }
     async processChanges(assets) {
         const { clients } = assets;
         if (!clients)

package/lib/tools/auth0/handlers/clientAuthCredentialsPre.d.ts

@@ -1,4 +1,4 @@
-import { Assets, Auth0APIClient } from '../../../types';
+import { Assets, Auth0APIClient, CalculatedChanges } from '../../../types';
 import { ConfigFunction } from '../../../configFactory';
 export declare const schema: {
     type: string;
@@ -33,5 +33,6 @@ export default class ClientAuthCredentialsPreHandler {
         [x: string]: null;
     }>;
     validate(): Promise<null>;
+    dryRunChanges(_assets: Assets): Promise<CalculatedChanges>;
     processChanges(assets: Assets): Promise<void>;
 }

package/lib/tools/auth0/handlers/clientAuthCredentialsPre.js

@@ -48,6 +48,11 @@ class ClientAuthCredentialsPreHandler {
     async validate() {
         return null;
     }
+    // Deploy-only pre-pass handler with no dry-run representation. Return empty changes so the
+    // dry-run loop (which calls dryRunChanges on every registered handler) does not crash.
+    async dryRunChanges(_assets) {
+        return { del: [], create: [], conflicts: [], update: [] };
+    }
     async processChanges(assets) {
         const { clients } = assets;
         if (!clients)

package/lib/tools/auth0/handlers/clientGrants.d.ts

@@ -22,7 +22,7 @@ export declare const schema: {
             };
             subject_type: {
                 type: string;
-                enum: ("client" | "user")[];
+                enum: ("client" | "user" | "anonymous_user")[];
                 description: string;
             };
             authorization_details_types: {

package/lib/tools/auth0/handlers/clients.d.ts

@@ -193,6 +193,18 @@ export declare const schema: {
                 };
                 additionalProperties: boolean;
             };
+            identity_assertion_authorization_grant: {
+                type: string;
+                description: string;
+                properties: {
+                    active: {
+                        type: string;
+                        description: string;
+                    };
+                };
+                required: string[];
+                additionalProperties: boolean;
+            };
             app_type: {
                 type: string;
                 description: string;
@@ -328,6 +340,40 @@ export declare const schema: {
                     };
                 };
             };
+            token_vault_privileged_access: {
+                type: string[];
+                description: string;
+                properties: {
+                    ip_allowlist: {
+                        type: string;
+                        description: string;
+                        items: {
+                            type: string;
+                        };
+                    };
+                    grants: {
+                        type: string;
+                        description: string;
+                        items: {
+                            type: string;
+                            properties: {
+                                connection: {
+                                    type: string;
+                                    description: string;
+                                };
+                                scopes: {
+                                    type: string;
+                                    description: string;
+                                    items: {
+                                        type: string;
+                                    };
+                                };
+                            };
+                            required: string[];
+                        };
+                    };
+                };
+            };
             third_party_security_mode: {
                 type: string;
                 enum: string[];

package/lib/tools/auth0/handlers/clients.js

@@ -66,6 +66,40 @@ const myOrganizationConfigurationSchema = {
     },
     required: ['allowed_strategies', 'connection_deletion_behavior'],
 };
+const tokenVaultPrivilegedAccessSchema = {
+    type: ['object', 'null'],
+    description: 'Settings for Token Vault Privileged Access, hardening a privileged client by restricting the caller IPs, connections, and scopes it may use at runtime. Early Access, gated by the token_vault_subject_type_jwt_ea_rollout feature flag. Export-only: this object is exported for visibility but is not deployed by the Deploy CLI (it is stripped from create/update payloads because the required credentials are tenant-specific ids). Manage it directly on the tenant.',
+    properties: {
+        ip_allowlist: {
+            type: 'array',
+            description: 'IPv4/IPv6 addresses or CIDR ranges permitted to call token exchange on behalf of this privileged client. When the EA flag is on, this is required (non-empty) on create if token_vault_privileged_access is being set.',
+            items: {
+                type: 'string',
+            },
+        },
+        grants: {
+            type: 'array',
+            description: 'Connection/scope pin objects restricting which federated connections and OAuth scopes the privileged client may use at runtime. Maximum 5 connections; maximum 20 scopes in total across all connections.',
+            items: {
+                type: 'object',
+                properties: {
+                    connection: {
+                        type: 'string',
+                        description: 'The connection name (e.g. google-oauth2). Validated at runtime; the connection need not exist at configuration time.',
+                    },
+                    scopes: {
+                        type: 'array',
+                        description: 'The OAuth scopes permitted for that connection.',
+                        items: {
+                            type: 'string',
+                        },
+                    },
+                },
+                required: ['connection', 'scopes'],
+            },
+        },
+    },
+};
 exports.schema = {
     type: 'array',
     items: {
@@ -221,6 +255,18 @@ exports.schema = {
                 },
                 additionalProperties: true,
             },
+            identity_assertion_authorization_grant: {
+                type: 'object',
+                description: 'Settings for Cross App Access (ID-JAG) token exchange. Early Access. Enables the client to request identity assertion authorization grants.',
+                properties: {
+                    active: {
+                        type: 'boolean',
+                        description: 'Indicates whether the client can request an identity assertion authorization grant (ID-JAG) via token exchange.',
+                    },
+                },
+                required: ['active'],
+                additionalProperties: false,
+            },
             app_type: {
                 type: 'string',
                 description: 'The type of application this client represents',
@@ -332,6 +378,7 @@ exports.schema = {
                     },
                 },
             },
+            token_vault_privileged_access: tokenVaultPrivilegedAccessSchema,
             third_party_security_mode: {
                 type: 'string',
                 enum: ['strict', 'permissive'],
@@ -460,6 +507,40 @@ const createClientSanitizer = (clients) => {
         },
     };
 };
+/**
+ * On export, remove `credentials` from `token_vault_privileged_access`.
+ *
+ * Auth0 returns these as tenant-specific credential references (`{ id }`) — never
+ * names or key material — so they are not portable across tenants and must never be
+ * written to disk. `ip_allowlist` and `grants` are kept for visibility. Mutates and
+ * returns the same client.
+ */
+const stripTokenVaultCredentialsOnExport = (client) => {
+    const tvpa = client
+        .token_vault_privileged_access;
+    if (tvpa && 'credentials' in tvpa) {
+        delete tvpa.credentials;
+    }
+    return client;
+};
+/**
+ * On write (create/update), remove the entire `token_vault_privileged_access` object.
+ *
+ * The Management API requires `credentials` whenever `token_vault_privileged_access`
+ * is present in the payload, but those credentials are tenant-specific ids that the
+ * Deploy CLI intentionally never persists (see stripTokenVaultCredentialsOnExport).
+ * Sending the object without `credentials` fails validation ("Missing required
+ * property: credentials"); sending it with exported ids would re-send stale ids on a
+ * cross-tenant deploy. The Deploy CLI therefore does not manage this field — it is
+ * export-only. Manage `token_vault_privileged_access` directly on the tenant.
+ * Mutates and returns the same client.
+ */
+const stripTokenVaultPrivilegedAccessOnWrite = (client) => {
+    if ('token_vault_privileged_access' in client) {
+        delete client.token_vault_privileged_access;
+    }
+    return client;
+};
 class ClientHandler extends default_1.default {
     constructor(config) {
         super({
@@ -577,6 +658,10 @@ class ClientHandler extends default_1.default {
                     delete item.token_endpoint_auth_method;
                 }
                 delete item.client_authentication_methods;
+                // token_vault_privileged_access requires tenant-specific credential ids that
+                // the Deploy CLI never persists. Strip the whole object on write so we neither
+                // re-send stale ids nor fail validation for the missing credentials property.
+                stripTokenVaultPrivilegedAccessOnWrite(item);
                 return item;
             });
         };
@@ -598,7 +683,12 @@ class ClientHandler extends default_1.default {
             is_global: false,
             ...((0, utils_1.shouldExcludeThirdPartyClients)(this.config) && { is_first_party: true }),
         });
-        const sanitized = createClientSanitizer(clients).sanitizeCrossOriginAuth(false).get();
+        const sanitized = createClientSanitizer(clients)
+            .sanitizeCrossOriginAuth(false)
+            .get()
+            // token_vault_privileged_access.credentials are returned as tenant-specific
+            // ids — strip them so they are never exported to disk.
+            .map(stripTokenVaultCredentialsOnExport);
         // Enrich credential stubs with name and credential_type for export.
         // Auth0 does not return pem on read — it is never exported.
         await Promise.all(sanitized.map(async (client) => {

package/lib/tools/auth0/handlers/connections.d.ts

@@ -103,6 +103,27 @@ export declare const schema: {
                 required: string[];
                 additionalProperties: boolean;
             };
+            cross_app_access_requesting_app: {
+                type: string;
+                properties: {
+                    active: {
+                        type: string;
+                    };
+                };
+                required: string[];
+                additionalProperties: boolean;
+            };
+            cross_app_access_resource_app: {
+                type: string;
+                properties: {
+                    status: {
+                        type: string;
+                        enum: string[];
+                    };
+                };
+                required: string[];
+                additionalProperties: boolean;
+            };
             directory_provisioning_configuration: {
                 type: string;
                 properties: {

package/lib/tools/auth0/handlers/connections.js

@@ -129,6 +129,22 @@ exports.schema = {
                 required: ['active'],
                 additionalProperties: false,
             },
+            cross_app_access_requesting_app: {
+                type: 'object',
+                properties: {
+                    active: { type: 'boolean' },
+                },
+                required: ['active'],
+                additionalProperties: false,
+            },
+            cross_app_access_resource_app: {
+                type: 'object',
+                properties: {
+                    status: { type: 'string', enum: ['enabled', 'disabled'] },
+                },
+                required: ['status'],
+                additionalProperties: false,
+            },
             directory_provisioning_configuration: {
                 type: 'object',
                 properties: {

package/lib/tools/auth0/handlers/default.js

@@ -328,8 +328,8 @@ class APIHandler {
                 const updateFN = this.getClientFN(this.functions.update);
                 const updatePayload = (() => {
                     const data = (0, utils_1.stripFields)({ ...updateItem }, this.stripUpdateFields);
-                    const stripped = (0, utils_1.stripObfuscatedFieldsFromPayload)(data, this.sensitiveFieldsToObfuscate);
-                    return (0, utils_1.validateNoUnresolvedPlaceholders)(stripped, this.type, this.objString(updateItem));
+                    const obfuscatedStripped = (0, utils_1.stripObfuscatedFieldsFromPayload)(data, this.sensitiveFieldsToObfuscate);
+                    return (0, utils_1.stripUnresolvedPlaceholders)(obfuscatedStripped, this.type, this.objString(updateItem));
                 })();
                 return updateFN(updateItem[this.id], updatePayload);
             }, retryConfig)
@@ -347,8 +347,8 @@ class APIHandler {
                 const createFunction = this.getClientFN(this.functions.create);
                 const createPayload = (() => {
                     const strippedPayload = (0, utils_1.stripFields)(createItem, this.stripCreateFields);
-                    const stripped = (0, utils_1.stripObfuscatedFieldsFromPayload)(strippedPayload, this.sensitiveFieldsToObfuscate);
-                    return (0, utils_1.validateNoUnresolvedPlaceholders)(stripped, this.type, this.objString(createItem));
+                    const obfuscatedStripped = (0, utils_1.stripObfuscatedFieldsFromPayload)(strippedPayload, this.sensitiveFieldsToObfuscate);
+                    return (0, utils_1.stripUnresolvedPlaceholders)(obfuscatedStripped, this.type, this.objString(createItem));
                 })();
                 return createFunction(createPayload);
             }, retryConfig)
@@ -369,8 +369,8 @@ class APIHandler {
                 const updateFN = this.getClientFN(this.functions.update);
                 const updatePayload = (() => {
                     const data = (0, utils_1.stripFields)({ ...updateItem }, this.stripUpdateFields);
-                    const stripped = (0, utils_1.stripObfuscatedFieldsFromPayload)(data, this.sensitiveFieldsToObfuscate);
-                    return (0, utils_1.validateNoUnresolvedPlaceholders)(stripped, this.type, this.objString(updateItem));
+                    const obfuscatedStripped = (0, utils_1.stripObfuscatedFieldsFromPayload)(data, this.sensitiveFieldsToObfuscate);
+                    return (0, utils_1.stripUnresolvedPlaceholders)(obfuscatedStripped, this.type, this.objString(updateItem));
                 })();
                 return updateFN(updateItem[this.id], updatePayload);
             }, retryConfig)

package/lib/tools/auth0/handlers/guardianFactorTemplates.js

@@ -60,11 +60,20 @@ class GuardianFactorTemplatesHandler extends default_1.default {
         await Promise.all(guardianFactorTemplates.map(async (fatorTemplates) => {
             const { name, ...data } = fatorTemplates;
             const params = { name: fatorTemplates.name };
-            if (name === 'sms') {
-                await this.client.guardian.factors.sms.setTemplates(data);
+            try {
+                if (name === 'sms') {
+                    await this.client.guardian.factors.sms.setTemplates(data);
+                }
+                else if (name === 'phone') {
+                    await this.client.guardian.factors.phone.setTemplates(data);
+                }
             }
-            else if (name === 'phone') {
-                await this.client.guardian.factors.phone.setTemplates(data);
+            catch (err) {
+                if ((0, utils_1.isForbiddenFeatureError)(err, this.type)) {
+                    // Feature is deprecated/disabled on this tenant; warn and skip instead of failing the import.
+                    return;
+                }
+                throw err;
             }
             this.didUpdate(params);
             this.updated += 1;

package/lib/tools/auth0/handlers/guardianPhoneFactorMessageTypes.js

@@ -25,14 +25,7 @@ const isFeatureUnavailableError = (err) => {
         // Older Management API version where the endpoint is not available.
         return true;
     }
-    if (err.statusCode === 403 &&
-        err.originalError &&
-        err.originalError.response &&
-        err.originalError.response.body &&
-        err.originalError.response.body.errorCode === 'voice_mfa_not_allowed') {
-        // Recent Management API version, but with feature explicitly disabled.
-        return true;
-    }
+    // 403s (feature explicitly disabled) are handled by isForbiddenFeatureError.
     return false;
 };
 class GuardianPhoneMessageTypesHandler extends default_1.default {
@@ -75,7 +68,16 @@ class GuardianPhoneMessageTypesHandler extends default_1.default {
             }
         }
         const data = guardianPhoneFactorMessageTypes;
-        await this.client.guardian.factors.phone.setMessageTypes(data);
+        try {
+            await this.client.guardian.factors.phone.setMessageTypes(data);
+        }
+        catch (err) {
+            if (isFeatureUnavailableError(err) || (0, utils_1.isForbiddenFeatureError)(err, this.type)) {
+                // Feature is deprecated/disabled on this tenant; warn and skip instead of failing the import.
+                return;
+            }
+            throw err;
+        }
         this.updated += 1;
         this.didUpdate(guardianPhoneFactorMessageTypes);
     }

package/lib/tools/auth0/handlers/guardianPhoneFactorSelectedProvider.js

@@ -22,14 +22,7 @@ const isFeatureUnavailableError = (err) => {
         // Older Management API version where the endpoint is not available.
         return true;
     }
-    if (err.statusCode === 403 &&
-        err.originalError &&
-        err.originalError.response &&
-        err.originalError.response.body &&
-        err.originalError.response.body.errorCode === 'hooks_not_allowed') {
-        // Recent Management API version, but with feature explicitly disabled.
-        return true;
-    }
+    // 403s (feature explicitly disabled) are handled by isForbiddenFeatureError.
     return false;
 };
 class GuardianPhoneSelectedProviderHandler extends default_1.default {
@@ -72,7 +65,16 @@ class GuardianPhoneSelectedProviderHandler extends default_1.default {
             }
         }
         const data = guardianPhoneFactorSelectedProvider;
-        await this.client.guardian.factors.phone.setProvider(data);
+        try {
+            await this.client.guardian.factors.phone.setProvider(data);
+        }
+        catch (err) {
+            if (isFeatureUnavailableError(err) || (0, utils_1.isForbiddenFeatureError)(err, this.type)) {
+                // Feature is deprecated/disabled on this tenant; warn and skip instead of failing the import.
+                return;
+            }
+            throw err;
+        }
         this.updated += 1;
         this.didUpdate(guardianPhoneFactorSelectedProvider);
     }

package/lib/tools/auth0/handlers/hooks.js

@@ -151,7 +151,7 @@ class HooksHandler extends default_1.default {
                 .get(hook.id)
                 .then((hookWithCode) => this.client.hooks.secrets
                 .get(hook.id)
-                .then(({ data: secrets }) => ({ ...hookWithCode, secrets })))));
+                .then((secrets) => ({ ...hookWithCode, secrets })))));
             return this.existing;
         }
         catch (err) {

package/lib/tools/auth0/handlers/networkACLs.d.ts

@@ -85,6 +85,15 @@ export declare const schema: {
                                     uniqueItems: boolean;
                                     minItems: number;
                                 };
+                                auth0_managed: {
+                                    type: string;
+                                    items: {
+                                        type: string;
+                                        pattern: string;
+                                    };
+                                    uniqueItems: boolean;
+                                    minItems: number;
+                                };
                                 geo_country_codes: {
                                     type: string;
                                     items: {
@@ -176,6 +185,15 @@ export declare const schema: {
                                     uniqueItems: boolean;
                                     minItems: number;
                                 };
+                                auth0_managed: {
+                                    type: string;
+                                    items: {
+                                        type: string;
+                                        pattern: string;
+                                    };
+                                    uniqueItems: boolean;
+                                    minItems: number;
+                                };
                                 geo_country_codes: {
                                     type: string;
                                     items: {

package/lib/tools/auth0/handlers/networkACLs.js

@@ -69,6 +69,15 @@ const MatchSchema = {
             uniqueItems: true,
             minItems: 1,
         },
+        auth0_managed: {
+            type: 'array',
+            items: {
+                type: 'string',
+                pattern: '^auth0\\.[^.\\s]+$',
+            },
+            uniqueItems: true,
+            minItems: 1,
+        },
         geo_country_codes: {
             type: 'array',
             items: {

package/lib/tools/auth0/handlers/rules.js

@@ -9,6 +9,7 @@ const utils_1 = require("../../utils");
 const default_1 = __importDefault(require("./default"));
 const logger_1 = __importDefault(require("../../../logger"));
 const calculateChanges_1 = require("../../calculateChanges");
+const calculateDryRunChanges_1 = require("../../calculateDryRunChanges");
 const client_1 = require("../client");
 exports.excludeSchema = {
     type: 'array',
@@ -135,13 +136,24 @@ class RulesHandler extends default_1.default {
         };
     }
     async dryRunChanges(assets) {
-        const { del, update, create, conflicts } = await this.calcChanges(assets);
-        return {
-            del,
-            update,
-            create,
-            conflicts,
-        };
+        let { rules } = assets;
+        if (!rules) {
+            return { del: [], create: [], conflicts: [], update: [] };
+        }
+        const excludedRules = (assets.exclude && assets.exclude.rules) || [];
+        rules = rules.filter((r) => !excludedRules.includes(r.name));
+        let existing = await this.getType();
+        if (existing === null) {
+            return { del: [], create: [], conflicts: [], update: [] };
+        }
+        existing = existing.filter((r) => !excludedRules.includes(r.name));
+        return (0, calculateDryRunChanges_1.calculateDryRunChanges)({
+            type: this.type,
+            assets: rules,
+            existing,
+            identifiers: this.identifiers,
+            ignoreDryRunFields: this.getEffectiveIgnoreDryRunFields(),
+        });
     }
     async validate(assets) {
         const { rules } = assets;

package/lib/tools/auth0/handlers/tenant.d.ts

@@ -79,6 +79,29 @@ export declare const schema: {
             enum: string[];
             description: string;
         };
+        country_codes: {
+            type: string[];
+            description: string;
+            properties: {
+                list: {
+                    type: string;
+                    description: string;
+                    items: {
+                        type: string;
+                        pattern: string;
+                    };
+                    minItems: number;
+                    uniqueItems: boolean;
+                };
+                mode: {
+                    type: string;
+                    enum: string[];
+                    description: string;
+                };
+            };
+            required: string[];
+            additionalProperties: boolean;
+        };
     };
 };
 export interface Tenant extends Management.GetTenantSettingsResponseContent {

package/lib/tools/auth0/handlers/tenant.js

@@ -106,6 +106,29 @@ exports.schema = {
             enum: ['strict', 'permissive'],
             description: 'Indicates the security mode for new clients created through the Dynamic Client Registration endpoint.',
         },
+        country_codes: {
+            type: ['object', 'null'],
+            description: 'Phone country code configuration for identifier input. Set to `null` to remove filtering (allow all countries). Requires the `tenant_country_codes_filtering` feature flag to be enabled on the tenant.',
+            properties: {
+                list: {
+                    type: 'array',
+                    description: 'ISO 3166-1 alpha-2 country codes (e.g. `US`, `GB`).',
+                    items: {
+                        type: 'string',
+                        pattern: '^[A-Z]{2}$',
+                    },
+                    minItems: 1,
+                    uniqueItems: true,
+                },
+                mode: {
+                    type: 'string',
+                    enum: ['allow', 'deny'],
+                    description: 'Whether the list is an allowlist or denylist.',
+                },
+            },
+            required: ['list', 'mode'],
+            additionalProperties: false,
+        },
     },
 };
 const blockPageKeys = [
@@ -147,6 +170,7 @@ exports.allowedTenantFlags = [
     'require_pushed_authorization_requests',
     'mfa_show_factor_list_on_enrollment',
     'improved_signup_bot_detection_in_classic',
+    'use_scope_descriptions_for_consent',
 ];
 const removeUnallowedTenantFlags = (proposedFlags) => {
     if (proposedFlags === undefined)

package/lib/tools/auth0/handlers/themes.d.ts

@@ -1,5 +1,5 @@
 import { Management } from 'auth0';
-import { Assets } from '../../../types';
+import { Assets, CalculatedChanges } from '../../../types';
 import DefaultHandler from './default';
 /**
  * Schema
@@ -179,6 +179,41 @@ export declare const schema: {
                 pattern: string;
                 type: string;
             };
+            identifiers: {
+                additionalProperties: boolean;
+                description: string;
+                properties: {
+                    login_display: {
+                        description: string;
+                        enum: string[];
+                        type: string;
+                    };
+                    otp_autocomplete: {
+                        description: string;
+                        type: string;
+                    };
+                    phone_display: {
+                        additionalProperties: boolean;
+                        description: string;
+                        properties: {
+                            formatting: {
+                                description: string;
+                                enum: string[];
+                                type: string;
+                            };
+                            masking: {
+                                description: string;
+                                enum: string[];
+                                type: string;
+                            };
+                        };
+                        required: string[];
+                        type: string;
+                    };
+                };
+                required: string[];
+                type: string;
+            };
             fonts: {
                 additionalProperties: boolean;
                 properties: {
@@ -375,6 +410,7 @@ export default class ThemesHandler extends DefaultHandler {
     existing: Theme[] | null;
     constructor(options: DefaultHandler);
     objString(theme: Theme): string;
+    dryRunChanges(assets: Assets): Promise<CalculatedChanges>;
     getType(): Promise<Theme[] | null>;
     processChanges(assets: Assets): Promise<void>;
     deleteThemes(): Promise<void>;

package/lib/tools/auth0/handlers/themes.js

@@ -46,6 +46,7 @@ exports.schema = void 0;
 const logger_1 = __importDefault(require("../../../logger"));
 const default_1 = __importStar(require("./default"));
 const utils_1 = require("../../utils");
+const calculateDryRunChanges_1 = require("../../calculateDryRunChanges");
 /**
  * Schema
  */
@@ -251,6 +252,41 @@ exports.schema = {
                 pattern: '^[^<>]*$',
                 type: 'string',
             },
+            identifiers: {
+                additionalProperties: false,
+                description: 'Identifier display settings on the theme. Requires the `universal_login_theme_identifiers` feature flag to be enabled on the tenant.',
+                properties: {
+                    login_display: {
+                        description: 'Login display mode',
+                        enum: ['separate', 'unified'],
+                        type: 'string',
+                    },
+                    otp_autocomplete: {
+                        description: 'Whether OTP autocomplete is enabled',
+                        type: 'boolean',
+                    },
+                    phone_display: {
+                        additionalProperties: false,
+                        description: 'Phone number display settings',
+                        properties: {
+                            formatting: {
+                                description: 'Phone number formatting style',
+                                enum: ['international', 'regional'],
+                                type: 'string',
+                            },
+                            masking: {
+                                description: 'Phone number masking strategy',
+                                enum: ['hide_country_code', 'mask_digits', 'show_all'],
+                                type: 'string',
+                            },
+                        },
+                        required: ['formatting', 'masking'],
+                        type: 'object',
+                    },
+                },
+                required: ['login_display', 'otp_autocomplete', 'phone_display'],
+                type: 'object',
+            },
             fonts: {
                 additionalProperties: false,
                 properties: {
@@ -470,6 +506,34 @@ class ThemesHandler extends default_1.default {
     objString(theme) {
         return theme.displayName || JSON.stringify(theme);
     }
+    async dryRunChanges(assets) {
+        const { themes } = assets;
+        if (!themes) {
+            return { del: [], create: [], conflicts: [], update: [] };
+        }
+        const existing = await this.getType();
+        // getType() returns null when Universal Login customizations are not enabled
+        // on the tenant (the 400 "no-code not enabled" path in getThemes).
+        if (existing === null) {
+            return { del: [], create: [], conflicts: [], update: [] };
+        }
+        // Themes are singletons — at most one per tenant. If the local theme has no
+        // themeId (stripped during export when --export_ids is not set), backfill it
+        // from the remote so the matcher can find a match without requiring --export_ids.
+        const normalizedThemes = themes.map((theme) => {
+            if (!theme.themeId && existing.length > 0 && existing[0].themeId) {
+                return { ...theme, themeId: existing[0].themeId };
+            }
+            return theme;
+        });
+        return (0, calculateDryRunChanges_1.calculateDryRunChanges)({
+            type: this.type,
+            assets: normalizedThemes,
+            existing,
+            identifiers: this.identifiers,
+            ignoreDryRunFields: this.getEffectiveIgnoreDryRunFields(),
+        });
+    }
     async getType() {
         if (!this.existing) {
             this.existing = await this.getThemes();

package/lib/tools/auth0/index.js

@@ -14,6 +14,7 @@ const handlers_1 = __importDefault(require("./handlers"));
 const calculateDryRunChanges_1 = require("../calculateDryRunChanges");
 const utils_1 = require("../../utils");
 const utils_2 = require("../utils");
+const logger_1 = __importDefault(require("../../logger"));
 /**
  * Sorts handlers by their @order decorator metadata for a given stage.
  * Handlers are sorted in ascending order (lower values execute first).
@@ -145,6 +146,14 @@ class Auth0 {
             data: this.handlers,
             generator: (handler) => (async () => {
                 try {
+                    // Every handler in the dry-run loop is expected to implement dryRunChanges.
+                    // Guard against non-conforming handlers (e.g. deploy-only handlers that don't
+                    // extend the base APIHandler) so a missing method skips the handler instead of
+                    // crashing the whole dry run. Logged loudly so an omitted preview is visible.
+                    if (typeof handler.dryRunChanges !== 'function') {
+                        logger_1.default.warn(`Handler "${handler.type}" does not implement dryRunChanges; skipping it in the dry-run preview. Changes for this resource will still be applied during a real import.`);
+                        return;
+                    }
                     const detailedChanges = [];
                     let created = 0;
                     let updated = 0;

package/lib/tools/utils.d.ts

@@ -27,6 +27,7 @@ export declare function areArraysEquals(x: any[], y: any[]): boolean;
 export declare const obfuscateSensitiveValues: (data: Asset | Asset[] | null, sensitiveFieldsToObfuscate: string[]) => Asset | Asset[] | null;
 export declare const validateNoUnresolvedPlaceholders: (data: Asset | null, resourceType: string, resourceName: string) => Asset | null;
 export declare const stripObfuscatedFieldsFromPayload: (data: Asset | Asset[] | null, obfuscatedFields: string[]) => Asset | Asset[] | null;
+export declare const stripUnresolvedPlaceholders: (data: Asset | null, resourceType: string, resourceName: string) => Asset | null;
 export declare const detectInsufficientScopeError: <T>(fn: Function) => Promise<{
     hadSufficientScopes: true;
     data: T;

package/lib/tools/utils.js

@@ -36,7 +36,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.shouldExcludeThirdPartyClients = exports.isForbiddenFeatureError = exports.isDeprecatedError = exports.detectInsufficientScopeError = exports.stripObfuscatedFieldsFromPayload = exports.validateNoUnresolvedPlaceholders = exports.obfuscateSensitiveValues = exports.keywordReplaceStringRegExp = exports.keywordReplaceArrayRegExp = void 0;
+exports.shouldExcludeThirdPartyClients = exports.isForbiddenFeatureError = exports.isDeprecatedError = exports.detectInsufficientScopeError = exports.stripUnresolvedPlaceholders = exports.stripObfuscatedFieldsFromPayload = exports.validateNoUnresolvedPlaceholders = exports.obfuscateSensitiveValues = exports.keywordReplaceStringRegExp = exports.keywordReplaceArrayRegExp = void 0;
 exports.keywordArrayReplace = keywordArrayReplace;
 exports.keywordStringReplace = keywordStringReplace;
 exports.keywordReplace = keywordReplace;
@@ -309,6 +309,24 @@ const stripObfuscatedFieldsFromPayload = (data, obfuscatedFields) => {
     return newAsset;
 };
 exports.stripObfuscatedFieldsFromPayload = stripObfuscatedFieldsFromPayload;
+// Strips unresolved ##...## / @@...@@ placeholders before sending to Auth0.
+// Keyword replacement runs first; any remaining placeholder means no mapping was
+// provided. The field is dropped so Auth0 preserves its existing value.
+const stripUnresolvedPlaceholders = (data, resourceType, resourceName) => {
+    if (data === null)
+        return data;
+    const unresolved = collectUnresolvedPlaceholders(data);
+    if (unresolved.length === 0)
+        return data;
+    const newAsset = { ...data };
+    unresolved.forEach(({ path, value }) => {
+        logger_1.default.warn(`Stripping unresolved placeholder for ${resourceType} "${resourceName}" field "${path}": ${value}. ` +
+            `To use this value, define ${value.replace(/^##|##$|^@@|@@$/g, '')} in AUTH0_KEYWORD_REPLACE_MAPPINGS. The existing value on Auth0 will be preserved.`);
+        dot_prop_1.default.delete(newAsset, path);
+    });
+    return newAsset;
+};
+exports.stripUnresolvedPlaceholders = stripUnresolvedPlaceholders;
 const detectInsufficientScopeError = async (fn) => {
     try {
         const data = await fn();
@@ -342,7 +360,12 @@ const isDeprecatedError = (err) => {
 exports.isDeprecatedError = isDeprecatedError;
 const isForbiddenFeatureError = (err, type) => {
     if (err.statusCode === 403) {
-        logger_1.default.warn(`${err.message};${err.errorCode ?? ''} - Skipping ${type}`);
+        // The SDK error's top-level `message` is the full serialized response body; the clean,
+        // human-readable message and errorCode live on the response body itself.
+        const body = err.originalError?.response?.body ?? {};
+        const message = body.message ?? err.message;
+        const errorCode = body.errorCode ?? err.errorCode ?? '';
+        logger_1.default.warn(`${message}${errorCode ? ` (${errorCode})` : ''} - Skipping ${type}`);
         return true;
     }
     return false;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "auth0-deploy-cli",
-  "version": "8.41.0",
+  "version": "8.42.0",
   "description": "A command line tool for deploying updates to your Auth0 tenant",
   "main": "lib/index.js",
   "bin": {
@@ -35,7 +35,7 @@
   "dependencies": {
     "@clack/prompts": "1.4.0",
     "ajv": "^6.12.6",
-    "auth0": "^6.0.0",
+    "auth0": "^6.1.0",
     "chalk": "5.6.2",
     "dot-prop": "^5.3.0",
     "fs-extra": "^10.1.0",