auth0-deploy-cli 8.41.0 → 8.43.0

package/CHANGELOG.md

@@ -7,6 +7,39 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [8.43.0] - 2026-08-12
+
+### Added
+
+- Add org-to-app entitlement (EA) support for organizations. [#1454]
+- Support full group metadata for Google Workspace directory sync (GA). [#1456]
+
+### Fixed
+
+- Create phone templates on import instead of skipping when they have no ID. [#1457]
+- Address path traversal vulnerability and false warnings in config file handlers. [#1449]
+- Exclude org-scoped roles from tenant export by filtering `type='tenant'`. [#1453]
+- Strip read-only field from roles to fix export/import round-trip. [#1445]
+
+## [8.42.0] - 2026-07-30
+
+### Added
+
+- Add UL identifier input support for themes and tenant settings. [#1433]
+- Add `token_vault_privileged_access` support for clients. [#1430]
+- Add `auth0_managed` field support for network ACLs (Curated Blocklists - EA). [#1435]
+- Add Cross App Access (XAA) resource app support for connections and clients. [#1431]
+- Add `cross_app_access_requesting_app` support for connections (EA). [#1422]
+
+### Fixed
+
+- Prevent dry-run crash on `clientAuthCredentials` handler. [#1438]
+- Resolve spurious dry-run diffs for rules, themes, and hooks. [#1437]
+- Strip unresolved placeholders on deploy instead of throwing. [#1436]
+- Handle 403 entitlement errors for bot detection and captcha on export. [#1434]
+- Warn and skip deprecated guardian phone provider on 403 during import. [#1429]
+- Add `use_scope_descriptions_for_consent` to allowed tenant flags. [#1428]
+
 ## [8.41.0] - 2026-07-16
 
 ### Added
@@ -1876,8 +1909,27 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 [#1416]: https://github.com/auth0/auth0-deploy-cli/issues/1416
 [#1417]: https://github.com/auth0/auth0-deploy-cli/issues/1417
 [#1421]: https://github.com/auth0/auth0-deploy-cli/issues/1421
+[#1422]: https://github.com/auth0/auth0-deploy-cli/issues/1422
 [#1425]: https://github.com/auth0/auth0-deploy-cli/issues/1425
-[Unreleased]: https://github.com/auth0/auth0-deploy-cli/compare/v8.41.0...HEAD
+[#1428]: https://github.com/auth0/auth0-deploy-cli/issues/1428
+[#1429]: https://github.com/auth0/auth0-deploy-cli/issues/1429
+[#1430]: https://github.com/auth0/auth0-deploy-cli/issues/1430
+[#1431]: https://github.com/auth0/auth0-deploy-cli/issues/1431
+[#1433]: https://github.com/auth0/auth0-deploy-cli/issues/1433
+[#1434]: https://github.com/auth0/auth0-deploy-cli/issues/1434
+[#1435]: https://github.com/auth0/auth0-deploy-cli/issues/1435
+[#1436]: https://github.com/auth0/auth0-deploy-cli/issues/1436
+[#1437]: https://github.com/auth0/auth0-deploy-cli/issues/1437
+[#1438]: https://github.com/auth0/auth0-deploy-cli/issues/1438
+[#1445]: https://github.com/auth0/auth0-deploy-cli/issues/1445
+[#1449]: https://github.com/auth0/auth0-deploy-cli/issues/1449
+[#1453]: https://github.com/auth0/auth0-deploy-cli/issues/1453
+[#1454]: https://github.com/auth0/auth0-deploy-cli/issues/1454
+[#1456]: https://github.com/auth0/auth0-deploy-cli/issues/1456
+[#1457]: https://github.com/auth0/auth0-deploy-cli/issues/1457
+[Unreleased]: https://github.com/auth0/auth0-deploy-cli/compare/v8.43.0...HEAD
+[8.43.0]: https://github.com/auth0/auth0-deploy-cli/compare/v8.42.0...v8.43.0
+[8.42.0]: https://github.com/auth0/auth0-deploy-cli/compare/v8.41.0...v8.42.0
 [8.41.0]: https://github.com/auth0/auth0-deploy-cli/compare/v8.40.0...v8.41.0
 [8.40.0]: https://github.com/auth0/auth0-deploy-cli/compare/v8.39.0...v8.40.0
 [8.39.0]: https://github.com/auth0/auth0-deploy-cli/compare/v8.38.0...v8.39.0

package/lib/context/directory/handlers/actionModules.js

@@ -20,20 +20,19 @@ function parse(context) {
                 disableKeywordReplacement: context.disableKeywordReplacement,
             }),
         };
-        const moduleFolder = path_1.default.join(tools_1.constants.ACTION_MODULES_DIRECTORY, `${module.name}`);
         if (module.code) {
-            // The `module.code` can be a file path. It needs to be loaded.
-            // It can be a relative path, so we need to handle both cases.
-            const unixPath = module.code.replace(/[\\/]+/g, '/').replace(/^([a-zA-Z]+:|\.\/)/, '');
-            if (fs_extra_1.default.existsSync(unixPath)) {
-                logger_1.default.warn(`Support for absolute paths and paths outside the config root will be deprecated in a future version to improve the security of the tool. ` +
-                    `Please update your configuration to use paths relative to the config directory. ` +
-                    `Current absolute path used: ["${module.code}"]`);
-                module.code = context.loadFile(unixPath, moduleFolder);
-            }
-            else {
-                module.code = context.loadFile(path_1.default.join(context.filePath, module.code), moduleFolder);
+            const normalizedCode = module.code.replace(/\\/g, '/');
+            const configRoot = path_1.default.resolve(context.filePath);
+            const resolvedPath = path_1.default.resolve(context.filePath, normalizedCode);
+            if (!resolvedPath.startsWith(configRoot + path_1.default.sep)) {
+                logger_1.default.warn(`Path "${module.code}" resolves to "${resolvedPath}" which is outside the config directory "${configRoot}". ` +
+                    `This will be blocked as an error in the next major release. ` +
+                    `Move the file inside your config directory.`);
             }
+            module.code = (0, tools_1.loadFileAndReplaceKeywords)(resolvedPath, {
+                mappings: context.mappings,
+                disableKeywordReplacement: context.disableKeywordReplacement,
+            });
         }
         return module;
     });

package/lib/context/directory/handlers/actions.js

@@ -22,21 +22,19 @@ function parse(context) {
                 disableKeywordReplacement: context.disableKeywordReplacement,
             }),
         };
-        const actionFolder = path_1.default.join(tools_1.constants.ACTIONS_DIRECTORY, `${action.name}`);
         if (action.code) {
-            // Convert `action.code` path to Unix-style path by replacing backslashes and multiple slashes with a single forward slash, and remove leading drive letters or './'.
-            const unixPath = action.code.replace(/[\\/]+/g, '/').replace(/^([a-zA-Z]+:|\.\/)/, '');
-            if (fs_extra_1.default.existsSync(unixPath)) {
-                // If the Unix-style path exists, load the file from that path
-                logger_1.default.warn(`Support for absolute paths and paths outside the config root will be deprecated in a future version to improve the security of the tool. ` +
-                    `Please update your configuration to use paths relative to the config directory. ` +
-                    `Current absolute path used: ["${action.code}"]`);
-                action.code = context.loadFile(unixPath, actionFolder);
-            }
-            else {
-                // Otherwise, load the file from the context's file path
-                action.code = context.loadFile(path_1.default.join(context.filePath, action.code), actionFolder);
+            const normalizedCode = action.code.replace(/\\/g, '/');
+            const configRoot = path_1.default.resolve(context.filePath);
+            const resolvedPath = path_1.default.resolve(context.filePath, normalizedCode);
+            if (!resolvedPath.startsWith(configRoot + path_1.default.sep)) {
+                logger_1.default.warn(`Path "${action.code}" resolves to "${resolvedPath}" which is outside the config directory "${configRoot}". ` +
+                    `This will be blocked as an error in the next major release. ` +
+                    `Move the file inside your config directory.`);
             }
+            action.code = (0, tools_1.loadFileAndReplaceKeywords)(resolvedPath, {
+                mappings: context.mappings,
+                disableKeywordReplacement: context.disableKeywordReplacement,
+            });
         }
         return action;
     });

package/lib/context/directory/handlers/databases.js

@@ -41,11 +41,11 @@ function getDatabase(folder, configRoot, mappingOpts) {
             }
             else {
                 const resolvedBase = path_1.default.resolve(configRoot);
-                const toLoad = path_1.default.resolve(folder, script);
+                const toLoad = path_1.default.resolve(folder, script.replace(/\\/g, '/'));
                 if (!toLoad.startsWith(resolvedBase + path_1.default.sep)) {
-                    logger_1.default.warn(`Support for absolute paths and paths outside the config root will be deprecated in a future version to improve the security of the tool. ` +
-                        `Please update your configuration to use paths relative to the config directory. ` +
-                        `Current absolute path used: ["${script}"]`);
+                    logger_1.default.warn(`Path "${script}" resolves to "${toLoad}" which is outside the config directory "${resolvedBase}". ` +
+                        `This will be blocked as an error in the next major release. ` +
+                        `Move the file inside your config directory.`);
                 }
                 database.options.customScripts[name] = (0, tools_1.loadFileAndReplaceKeywords)(toLoad, mappingOpts);
             }

package/lib/context/directory/handlers/hooks.js

@@ -21,7 +21,18 @@ function parse(context) {
             }),
         };
         if (hook.script) {
-            hook.script = context.loadFile(hook.script, tools_1.constants.HOOKS_DIRECTORY);
+            const normalizedScript = hook.script.replace(/\\/g, '/');
+            const configRoot = path_1.default.resolve(context.filePath);
+            const resolvedPath = path_1.default.resolve(context.filePath, tools_1.constants.HOOKS_DIRECTORY, normalizedScript);
+            if (!resolvedPath.startsWith(configRoot + path_1.default.sep)) {
+                logger_1.default.warn(`Path "${hook.script}" resolves to "${resolvedPath}" which is outside the config directory "${configRoot}". ` +
+                    `This will be blocked as an error in the next major release. ` +
+                    `Move the file inside your config directory.`);
+            }
+            hook.script = (0, tools_1.loadFileAndReplaceKeywords)(resolvedPath, {
+                mappings: context.mappings,
+                disableKeywordReplacement: context.disableKeywordReplacement,
+            });
         }
         hook.name = hook.name.toLowerCase().replace(/\s/g, '-');
         return hook;

package/lib/context/directory/handlers/rules.js

@@ -21,7 +21,18 @@ function parse(context) {
             }),
         };
         if (rule.script) {
-            rule.script = context.loadFile(rule.script, tools_1.constants.RULES_DIRECTORY);
+            const normalizedScript = rule.script.replace(/\\/g, '/');
+            const configRoot = path_1.default.resolve(context.filePath);
+            const resolvedPath = path_1.default.resolve(context.filePath, tools_1.constants.RULES_DIRECTORY, normalizedScript);
+            if (!resolvedPath.startsWith(configRoot + path_1.default.sep)) {
+                logger_1.default.warn(`Path "${rule.script}" resolves to "${resolvedPath}" which is outside the config directory "${configRoot}". ` +
+                    `This will be blocked as an error in the next major release. ` +
+                    `Move the file inside your config directory.`);
+            }
+            rule.script = (0, tools_1.loadFileAndReplaceKeywords)(resolvedPath, {
+                mappings: context.mappings,
+                disableKeywordReplacement: context.disableKeywordReplacement,
+            });
         }
         return rule;
     });

package/lib/context/directory/index.js

@@ -68,14 +68,13 @@ class DirectoryContext {
         };
     }
     loadFile(f, folder) {
-        const basePath = path.join(this.filePath, folder);
-        let toLoad = path.join(basePath, f);
-        if (!(0, utils_1.isFile)(toLoad)) {
-            // try load not relative to yaml file
-            toLoad = f;
-            logger_1.default.warn(`Support for absolute paths and paths outside the config root will be deprecated in a future version to improve the security of the tool. ` +
-                `Please update your configuration to use paths relative to the config directory. ` +
-                `Current absolute path used: ["${f}"]`);
+        const configRoot = path.resolve(this.filePath);
+        const basePath = path.resolve(this.filePath, folder);
+        const toLoad = path.resolve(basePath, f.replace(/\\/g, '/'));
+        if (!toLoad.startsWith(configRoot + path.sep)) {
+            logger_1.default.warn(`Path "${f}" resolves to "${toLoad}" which is outside the config directory "${configRoot}". ` +
+                `This will be blocked as an error in the next major release. ` +
+                `Move the file inside your config directory.`);
         }
         return (0, tools_1.loadFileAndReplaceKeywords)(toLoad, {
             mappings: this.mappings,

package/lib/context/yaml/index.js

@@ -43,15 +43,14 @@ class YAMLContext {
         })();
     }
     loadFile(f) {
-        let toLoad = path_1.default.join(this.basePath, f);
-        if (!(0, utils_1.isFile)(toLoad)) {
-            // try load not relative to yaml file
-            toLoad = f;
-            logger_1.default.warn(`Support for absolute paths and paths outside the config root will be deprecated in a future version to improve the security of the tool. ` +
-                `Please update your configuration to use paths relative to the config directory. ` +
-                `Current absolute path used: ["${f}"]`);
+        const configRoot = path_1.default.resolve(this.basePath);
+        const toLoad = path_1.default.resolve(this.basePath, f.replace(/\\/g, '/'));
+        if (!toLoad.startsWith(configRoot + path_1.default.sep)) {
+            logger_1.default.warn(`Path "${f}" resolves to "${toLoad}" which is outside the config directory "${configRoot}". ` +
+                `This will be blocked as an error in the next major release. ` +
+                `Move the file inside your config directory.`);
         }
-        return (0, tools_1.loadFileAndReplaceKeywords)(path_1.default.resolve(toLoad), {
+        return (0, tools_1.loadFileAndReplaceKeywords)(toLoad, {
             mappings: this.mappings,
             disableKeywordReplacement: this.disableKeywordReplacement,
         });

package/lib/tools/auth0/handlers/attackProtection.js

@@ -243,14 +243,25 @@ class AttackProtectionHandler extends default_1.default {
         let botDetection = null;
         let captcha = null;
         try {
-            [botDetection, captcha] = await Promise.all([
-                this.client.attackProtection.botDetection.get(),
-                this.client.attackProtection.captcha.get(),
-            ]);
+            botDetection = await this.client.attackProtection.botDetection.get();
         }
         catch (err) {
             if (err.statusCode === 403) {
-                logger_1.default.warn('Bot Detection API are not enabled for this tenant. Please verify `scope` or contact Auth0 support to enable this feature.');
+                logger_1.default.warn("Bot detection is not available on this tenant's current plan. Skipping bot detection settings.");
+            }
+            else {
+                throw err;
+            }
+        }
+        try {
+            captcha = await this.client.attackProtection.captcha.get();
+        }
+        catch (err) {
+            if (err.statusCode === 403) {
+                logger_1.default.warn("Captcha is not available on this tenant's current plan. Skipping captcha settings.");
+            }
+            else {
+                throw err;
             }
         }
         const attackProtection = {

package/lib/tools/auth0/handlers/clientAuthCredentials.d.ts

@@ -1,4 +1,4 @@
-import { Assets, Auth0APIClient } from '../../../types';
+import { Assets, Auth0APIClient, CalculatedChanges } from '../../../types';
 import { ConfigFunction } from '../../../configFactory';
 export declare const schema: {
     type: string;
@@ -20,6 +20,7 @@ export default class ClientAuthCredentialsHandler {
         [x: string]: null;
     }>;
     validate(): Promise<null>;
+    dryRunChanges(_assets: Assets): Promise<CalculatedChanges>;
     processChanges(assets: Assets): Promise<void>;
     private inferCredentialType;
     private inferMethodFromType;

package/lib/tools/auth0/handlers/clientAuthCredentials.js

@@ -39,6 +39,13 @@ class ClientAuthCredentialsHandler {
     async validate() {
         return null;
     }
+    // Credentials are per-client sub-resources with no top-level asset list, so they are not
+    // modeled in the dry-run diff. Return empty changes so the dry-run loop (which calls
+    // dryRunChanges on every handler) does not crash. Credential changes are still applied
+    // during a real import via processChanges.
+    async dryRunChanges(_assets) {
+        return { del: [], create: [], conflicts: [], update: [] };
+    }
     async processChanges(assets) {
         const { clients } = assets;
         if (!clients)

package/lib/tools/auth0/handlers/clientAuthCredentialsPre.d.ts

@@ -1,4 +1,4 @@
-import { Assets, Auth0APIClient } from '../../../types';
+import { Assets, Auth0APIClient, CalculatedChanges } from '../../../types';
 import { ConfigFunction } from '../../../configFactory';
 export declare const schema: {
     type: string;
@@ -33,5 +33,6 @@ export default class ClientAuthCredentialsPreHandler {
         [x: string]: null;
     }>;
     validate(): Promise<null>;
+    dryRunChanges(_assets: Assets): Promise<CalculatedChanges>;
     processChanges(assets: Assets): Promise<void>;
 }

package/lib/tools/auth0/handlers/clientAuthCredentialsPre.js

@@ -48,6 +48,11 @@ class ClientAuthCredentialsPreHandler {
     async validate() {
         return null;
     }
+    // Deploy-only pre-pass handler with no dry-run representation. Return empty changes so the
+    // dry-run loop (which calls dryRunChanges on every registered handler) does not crash.
+    async dryRunChanges(_assets) {
+        return { del: [], create: [], conflicts: [], update: [] };
+    }
     async processChanges(assets) {
         const { clients } = assets;
         if (!clients)

package/lib/tools/auth0/handlers/clientGrants.d.ts

@@ -22,7 +22,7 @@ export declare const schema: {
             };
             subject_type: {
                 type: string;
-                enum: ("client" | "user")[];
+                enum: ("client" | "user" | "anonymous_user")[];
                 description: string;
             };
             authorization_details_types: {

package/lib/tools/auth0/handlers/clients.d.ts

@@ -193,6 +193,18 @@ export declare const schema: {
                 };
                 additionalProperties: boolean;
             };
+            identity_assertion_authorization_grant: {
+                type: string;
+                description: string;
+                properties: {
+                    active: {
+                        type: string;
+                        description: string;
+                    };
+                };
+                required: string[];
+                additionalProperties: boolean;
+            };
             app_type: {
                 type: string;
                 description: string;
@@ -328,6 +340,40 @@ export declare const schema: {
                     };
                 };
             };
+            token_vault_privileged_access: {
+                type: string[];
+                description: string;
+                properties: {
+                    ip_allowlist: {
+                        type: string;
+                        description: string;
+                        items: {
+                            type: string;
+                        };
+                    };
+                    grants: {
+                        type: string;
+                        description: string;
+                        items: {
+                            type: string;
+                            properties: {
+                                connection: {
+                                    type: string;
+                                    description: string;
+                                };
+                                scopes: {
+                                    type: string;
+                                    description: string;
+                                    items: {
+                                        type: string;
+                                    };
+                                };
+                            };
+                            required: string[];
+                        };
+                    };
+                };
+            };
             third_party_security_mode: {
                 type: string;
                 enum: string[];

package/lib/tools/auth0/handlers/clients.js

@@ -66,6 +66,40 @@ const myOrganizationConfigurationSchema = {
     },
     required: ['allowed_strategies', 'connection_deletion_behavior'],
 };
+const tokenVaultPrivilegedAccessSchema = {
+    type: ['object', 'null'],
+    description: 'Settings for Token Vault Privileged Access, hardening a privileged client by restricting the caller IPs, connections, and scopes it may use at runtime. Early Access, gated by the token_vault_subject_type_jwt_ea_rollout feature flag. Export-only: this object is exported for visibility but is not deployed by the Deploy CLI (it is stripped from create/update payloads because the required credentials are tenant-specific ids). Manage it directly on the tenant.',
+    properties: {
+        ip_allowlist: {
+            type: 'array',
+            description: 'IPv4/IPv6 addresses or CIDR ranges permitted to call token exchange on behalf of this privileged client. When the EA flag is on, this is required (non-empty) on create if token_vault_privileged_access is being set.',
+            items: {
+                type: 'string',
+            },
+        },
+        grants: {
+            type: 'array',
+            description: 'Connection/scope pin objects restricting which federated connections and OAuth scopes the privileged client may use at runtime. Maximum 5 connections; maximum 20 scopes in total across all connections.',
+            items: {
+                type: 'object',
+                properties: {
+                    connection: {
+                        type: 'string',
+                        description: 'The connection name (e.g. google-oauth2). Validated at runtime; the connection need not exist at configuration time.',
+                    },
+                    scopes: {
+                        type: 'array',
+                        description: 'The OAuth scopes permitted for that connection.',
+                        items: {
+                            type: 'string',
+                        },
+                    },
+                },
+                required: ['connection', 'scopes'],
+            },
+        },
+    },
+};
 exports.schema = {
     type: 'array',
     items: {
@@ -221,6 +255,18 @@ exports.schema = {
                 },
                 additionalProperties: true,
             },
+            identity_assertion_authorization_grant: {
+                type: 'object',
+                description: 'Settings for Cross App Access (ID-JAG) token exchange. Early Access. Enables the client to request identity assertion authorization grants.',
+                properties: {
+                    active: {
+                        type: 'boolean',
+                        description: 'Indicates whether the client can request an identity assertion authorization grant (ID-JAG) via token exchange.',
+                    },
+                },
+                required: ['active'],
+                additionalProperties: false,
+            },
             app_type: {
                 type: 'string',
                 description: 'The type of application this client represents',
@@ -332,6 +378,7 @@ exports.schema = {
                     },
                 },
             },
+            token_vault_privileged_access: tokenVaultPrivilegedAccessSchema,
             third_party_security_mode: {
                 type: 'string',
                 enum: ['strict', 'permissive'],
@@ -460,6 +507,40 @@ const createClientSanitizer = (clients) => {
         },
     };
 };
+/**
+ * On export, remove `credentials` from `token_vault_privileged_access`.
+ *
+ * Auth0 returns these as tenant-specific credential references (`{ id }`) — never
+ * names or key material — so they are not portable across tenants and must never be
+ * written to disk. `ip_allowlist` and `grants` are kept for visibility. Mutates and
+ * returns the same client.
+ */
+const stripTokenVaultCredentialsOnExport = (client) => {
+    const tvpa = client
+        .token_vault_privileged_access;
+    if (tvpa && 'credentials' in tvpa) {
+        delete tvpa.credentials;
+    }
+    return client;
+};
+/**
+ * On write (create/update), remove the entire `token_vault_privileged_access` object.
+ *
+ * The Management API requires `credentials` whenever `token_vault_privileged_access`
+ * is present in the payload, but those credentials are tenant-specific ids that the
+ * Deploy CLI intentionally never persists (see stripTokenVaultCredentialsOnExport).
+ * Sending the object without `credentials` fails validation ("Missing required
+ * property: credentials"); sending it with exported ids would re-send stale ids on a
+ * cross-tenant deploy. The Deploy CLI therefore does not manage this field — it is
+ * export-only. Manage `token_vault_privileged_access` directly on the tenant.
+ * Mutates and returns the same client.
+ */
+const stripTokenVaultPrivilegedAccessOnWrite = (client) => {
+    if ('token_vault_privileged_access' in client) {
+        delete client.token_vault_privileged_access;
+    }
+    return client;
+};
 class ClientHandler extends default_1.default {
     constructor(config) {
         super({
@@ -577,6 +658,10 @@ class ClientHandler extends default_1.default {
                     delete item.token_endpoint_auth_method;
                 }
                 delete item.client_authentication_methods;
+                // token_vault_privileged_access requires tenant-specific credential ids that
+                // the Deploy CLI never persists. Strip the whole object on write so we neither
+                // re-send stale ids nor fail validation for the missing credentials property.
+                stripTokenVaultPrivilegedAccessOnWrite(item);
                 return item;
             });
         };
@@ -598,7 +683,12 @@ class ClientHandler extends default_1.default {
             is_global: false,
             ...((0, utils_1.shouldExcludeThirdPartyClients)(this.config) && { is_first_party: true }),
         });
-        const sanitized = createClientSanitizer(clients).sanitizeCrossOriginAuth(false).get();
+        const sanitized = createClientSanitizer(clients)
+            .sanitizeCrossOriginAuth(false)
+            .get()
+            // token_vault_privileged_access.credentials are returned as tenant-specific
+            // ids — strip them so they are never exported to disk.
+            .map(stripTokenVaultCredentialsOnExport);
         // Enrich credential stubs with name and credential_type for export.
         // Auth0 does not return pem on read — it is never exported.
         await Promise.all(sanitized.map(async (client) => {

package/lib/tools/auth0/handlers/connections.d.ts

@@ -103,6 +103,27 @@ export declare const schema: {
                 required: string[];
                 additionalProperties: boolean;
             };
+            cross_app_access_requesting_app: {
+                type: string;
+                properties: {
+                    active: {
+                        type: string;
+                    };
+                };
+                required: string[];
+                additionalProperties: boolean;
+            };
+            cross_app_access_resource_app: {
+                type: string;
+                properties: {
+                    status: {
+                        type: string;
+                        enum: string[];
+                    };
+                };
+                required: string[];
+                additionalProperties: boolean;
+            };
             directory_provisioning_configuration: {
                 type: string;
                 properties: {
@@ -138,6 +159,15 @@ export declare const schema: {
                                 id: {
                                     type: string;
                                 };
+                                name: {
+                                    type: string;
+                                };
+                                email: {
+                                    type: string;
+                                };
+                                direct_members_count: {
+                                    type: string;
+                                };
                             };
                             required: string[];
                         };
@@ -152,9 +182,7 @@ type DirectoryProvisioningConfig = Management.DirectoryProvisioning;
 export type Connection = Management.ConnectionForList & {
     enabled_clients?: string[];
     directory_provisioning_configuration?: Pick<DirectoryProvisioningConfig, 'mapping' | 'synchronize_automatically' | 'synchronize_groups'> & {
-        synchronized_groups?: Array<{
-            id: string;
-        }>;
+        synchronized_groups?: Management.SynchronizedGroupPayload[];
     };
 };
 export declare const addExcludedConnectionPropertiesToChanges: ({ proposedChanges, existingConnections, config, }: {
@@ -230,9 +258,7 @@ export default class ConnectionsHandler extends DefaultAPIHandler {
     /**
      * Retrieves all synchronized groups for a connection using checkpoint pagination.
      */
-    getConnectionSynchronizedGroups(connectionId: string): Promise<Array<{
-        id: string;
-    }> | null>;
+    getConnectionSynchronizedGroups(connectionId: string): Promise<Management.SynchronizedGroupPayload[] | null>;
     /**
      * Replaces the synchronized groups for a connection (PUT replace-all semantics).
      */