auth0-deploy-cli 8.42.0 → 8.43.0

package/CHANGELOG.md

@@ -7,6 +7,20 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [8.43.0] - 2026-08-12
+
+### Added
+
+- Add org-to-app entitlement (EA) support for organizations. [#1454]
+- Support full group metadata for Google Workspace directory sync (GA). [#1456]
+
+### Fixed
+
+- Create phone templates on import instead of skipping when they have no ID. [#1457]
+- Address path traversal vulnerability and false warnings in config file handlers. [#1449]
+- Exclude org-scoped roles from tenant export by filtering `type='tenant'`. [#1453]
+- Strip read-only field from roles to fix export/import round-trip. [#1445]
+
 ## [8.42.0] - 2026-07-30
 
 ### Added
@@ -1907,7 +1921,14 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 [#1436]: https://github.com/auth0/auth0-deploy-cli/issues/1436
 [#1437]: https://github.com/auth0/auth0-deploy-cli/issues/1437
 [#1438]: https://github.com/auth0/auth0-deploy-cli/issues/1438
-[Unreleased]: https://github.com/auth0/auth0-deploy-cli/compare/v8.42.0...HEAD
+[#1445]: https://github.com/auth0/auth0-deploy-cli/issues/1445
+[#1449]: https://github.com/auth0/auth0-deploy-cli/issues/1449
+[#1453]: https://github.com/auth0/auth0-deploy-cli/issues/1453
+[#1454]: https://github.com/auth0/auth0-deploy-cli/issues/1454
+[#1456]: https://github.com/auth0/auth0-deploy-cli/issues/1456
+[#1457]: https://github.com/auth0/auth0-deploy-cli/issues/1457
+[Unreleased]: https://github.com/auth0/auth0-deploy-cli/compare/v8.43.0...HEAD
+[8.43.0]: https://github.com/auth0/auth0-deploy-cli/compare/v8.42.0...v8.43.0
 [8.42.0]: https://github.com/auth0/auth0-deploy-cli/compare/v8.41.0...v8.42.0
 [8.41.0]: https://github.com/auth0/auth0-deploy-cli/compare/v8.40.0...v8.41.0
 [8.40.0]: https://github.com/auth0/auth0-deploy-cli/compare/v8.39.0...v8.40.0

package/lib/context/directory/handlers/actionModules.js

@@ -20,20 +20,19 @@ function parse(context) {
                 disableKeywordReplacement: context.disableKeywordReplacement,
             }),
         };
-        const moduleFolder = path_1.default.join(tools_1.constants.ACTION_MODULES_DIRECTORY, `${module.name}`);
         if (module.code) {
-            // The `module.code` can be a file path. It needs to be loaded.
-            // It can be a relative path, so we need to handle both cases.
-            const unixPath = module.code.replace(/[\\/]+/g, '/').replace(/^([a-zA-Z]+:|\.\/)/, '');
-            if (fs_extra_1.default.existsSync(unixPath)) {
-                logger_1.default.warn(`Support for absolute paths and paths outside the config root will be deprecated in a future version to improve the security of the tool. ` +
-                    `Please update your configuration to use paths relative to the config directory. ` +
-                    `Current absolute path used: ["${module.code}"]`);
-                module.code = context.loadFile(unixPath, moduleFolder);
-            }
-            else {
-                module.code = context.loadFile(path_1.default.join(context.filePath, module.code), moduleFolder);
+            const normalizedCode = module.code.replace(/\\/g, '/');
+            const configRoot = path_1.default.resolve(context.filePath);
+            const resolvedPath = path_1.default.resolve(context.filePath, normalizedCode);
+            if (!resolvedPath.startsWith(configRoot + path_1.default.sep)) {
+                logger_1.default.warn(`Path "${module.code}" resolves to "${resolvedPath}" which is outside the config directory "${configRoot}". ` +
+                    `This will be blocked as an error in the next major release. ` +
+                    `Move the file inside your config directory.`);
             }
+            module.code = (0, tools_1.loadFileAndReplaceKeywords)(resolvedPath, {
+                mappings: context.mappings,
+                disableKeywordReplacement: context.disableKeywordReplacement,
+            });
         }
         return module;
     });

package/lib/context/directory/handlers/actions.js

@@ -22,21 +22,19 @@ function parse(context) {
                 disableKeywordReplacement: context.disableKeywordReplacement,
             }),
         };
-        const actionFolder = path_1.default.join(tools_1.constants.ACTIONS_DIRECTORY, `${action.name}`);
         if (action.code) {
-            // Convert `action.code` path to Unix-style path by replacing backslashes and multiple slashes with a single forward slash, and remove leading drive letters or './'.
-            const unixPath = action.code.replace(/[\\/]+/g, '/').replace(/^([a-zA-Z]+:|\.\/)/, '');
-            if (fs_extra_1.default.existsSync(unixPath)) {
-                // If the Unix-style path exists, load the file from that path
-                logger_1.default.warn(`Support for absolute paths and paths outside the config root will be deprecated in a future version to improve the security of the tool. ` +
-                    `Please update your configuration to use paths relative to the config directory. ` +
-                    `Current absolute path used: ["${action.code}"]`);
-                action.code = context.loadFile(unixPath, actionFolder);
-            }
-            else {
-                // Otherwise, load the file from the context's file path
-                action.code = context.loadFile(path_1.default.join(context.filePath, action.code), actionFolder);
+            const normalizedCode = action.code.replace(/\\/g, '/');
+            const configRoot = path_1.default.resolve(context.filePath);
+            const resolvedPath = path_1.default.resolve(context.filePath, normalizedCode);
+            if (!resolvedPath.startsWith(configRoot + path_1.default.sep)) {
+                logger_1.default.warn(`Path "${action.code}" resolves to "${resolvedPath}" which is outside the config directory "${configRoot}". ` +
+                    `This will be blocked as an error in the next major release. ` +
+                    `Move the file inside your config directory.`);
             }
+            action.code = (0, tools_1.loadFileAndReplaceKeywords)(resolvedPath, {
+                mappings: context.mappings,
+                disableKeywordReplacement: context.disableKeywordReplacement,
+            });
         }
         return action;
     });

package/lib/context/directory/handlers/databases.js

@@ -41,11 +41,11 @@ function getDatabase(folder, configRoot, mappingOpts) {
             }
             else {
                 const resolvedBase = path_1.default.resolve(configRoot);
-                const toLoad = path_1.default.resolve(folder, script);
+                const toLoad = path_1.default.resolve(folder, script.replace(/\\/g, '/'));
                 if (!toLoad.startsWith(resolvedBase + path_1.default.sep)) {
-                    logger_1.default.warn(`Support for absolute paths and paths outside the config root will be deprecated in a future version to improve the security of the tool. ` +
-                        `Please update your configuration to use paths relative to the config directory. ` +
-                        `Current absolute path used: ["${script}"]`);
+                    logger_1.default.warn(`Path "${script}" resolves to "${toLoad}" which is outside the config directory "${resolvedBase}". ` +
+                        `This will be blocked as an error in the next major release. ` +
+                        `Move the file inside your config directory.`);
                 }
                 database.options.customScripts[name] = (0, tools_1.loadFileAndReplaceKeywords)(toLoad, mappingOpts);
             }

package/lib/context/directory/handlers/hooks.js

@@ -21,7 +21,18 @@ function parse(context) {
             }),
         };
         if (hook.script) {
-            hook.script = context.loadFile(hook.script, tools_1.constants.HOOKS_DIRECTORY);
+            const normalizedScript = hook.script.replace(/\\/g, '/');
+            const configRoot = path_1.default.resolve(context.filePath);
+            const resolvedPath = path_1.default.resolve(context.filePath, tools_1.constants.HOOKS_DIRECTORY, normalizedScript);
+            if (!resolvedPath.startsWith(configRoot + path_1.default.sep)) {
+                logger_1.default.warn(`Path "${hook.script}" resolves to "${resolvedPath}" which is outside the config directory "${configRoot}". ` +
+                    `This will be blocked as an error in the next major release. ` +
+                    `Move the file inside your config directory.`);
+            }
+            hook.script = (0, tools_1.loadFileAndReplaceKeywords)(resolvedPath, {
+                mappings: context.mappings,
+                disableKeywordReplacement: context.disableKeywordReplacement,
+            });
         }
         hook.name = hook.name.toLowerCase().replace(/\s/g, '-');
         return hook;

package/lib/context/directory/handlers/rules.js

@@ -21,7 +21,18 @@ function parse(context) {
             }),
         };
         if (rule.script) {
-            rule.script = context.loadFile(rule.script, tools_1.constants.RULES_DIRECTORY);
+            const normalizedScript = rule.script.replace(/\\/g, '/');
+            const configRoot = path_1.default.resolve(context.filePath);
+            const resolvedPath = path_1.default.resolve(context.filePath, tools_1.constants.RULES_DIRECTORY, normalizedScript);
+            if (!resolvedPath.startsWith(configRoot + path_1.default.sep)) {
+                logger_1.default.warn(`Path "${rule.script}" resolves to "${resolvedPath}" which is outside the config directory "${configRoot}". ` +
+                    `This will be blocked as an error in the next major release. ` +
+                    `Move the file inside your config directory.`);
+            }
+            rule.script = (0, tools_1.loadFileAndReplaceKeywords)(resolvedPath, {
+                mappings: context.mappings,
+                disableKeywordReplacement: context.disableKeywordReplacement,
+            });
         }
         return rule;
     });

package/lib/context/directory/index.js

@@ -68,14 +68,13 @@ class DirectoryContext {
         };
     }
     loadFile(f, folder) {
-        const basePath = path.join(this.filePath, folder);
-        let toLoad = path.join(basePath, f);
-        if (!(0, utils_1.isFile)(toLoad)) {
-            // try load not relative to yaml file
-            toLoad = f;
-            logger_1.default.warn(`Support for absolute paths and paths outside the config root will be deprecated in a future version to improve the security of the tool. ` +
-                `Please update your configuration to use paths relative to the config directory. ` +
-                `Current absolute path used: ["${f}"]`);
+        const configRoot = path.resolve(this.filePath);
+        const basePath = path.resolve(this.filePath, folder);
+        const toLoad = path.resolve(basePath, f.replace(/\\/g, '/'));
+        if (!toLoad.startsWith(configRoot + path.sep)) {
+            logger_1.default.warn(`Path "${f}" resolves to "${toLoad}" which is outside the config directory "${configRoot}". ` +
+                `This will be blocked as an error in the next major release. ` +
+                `Move the file inside your config directory.`);
         }
         return (0, tools_1.loadFileAndReplaceKeywords)(toLoad, {
             mappings: this.mappings,

package/lib/context/yaml/index.js

@@ -43,15 +43,14 @@ class YAMLContext {
         })();
     }
     loadFile(f) {
-        let toLoad = path_1.default.join(this.basePath, f);
-        if (!(0, utils_1.isFile)(toLoad)) {
-            // try load not relative to yaml file
-            toLoad = f;
-            logger_1.default.warn(`Support for absolute paths and paths outside the config root will be deprecated in a future version to improve the security of the tool. ` +
-                `Please update your configuration to use paths relative to the config directory. ` +
-                `Current absolute path used: ["${f}"]`);
+        const configRoot = path_1.default.resolve(this.basePath);
+        const toLoad = path_1.default.resolve(this.basePath, f.replace(/\\/g, '/'));
+        if (!toLoad.startsWith(configRoot + path_1.default.sep)) {
+            logger_1.default.warn(`Path "${f}" resolves to "${toLoad}" which is outside the config directory "${configRoot}". ` +
+                `This will be blocked as an error in the next major release. ` +
+                `Move the file inside your config directory.`);
         }
-        return (0, tools_1.loadFileAndReplaceKeywords)(path_1.default.resolve(toLoad), {
+        return (0, tools_1.loadFileAndReplaceKeywords)(toLoad, {
             mappings: this.mappings,
             disableKeywordReplacement: this.disableKeywordReplacement,
         });

package/lib/tools/auth0/handlers/connections.d.ts

@@ -159,6 +159,15 @@ export declare const schema: {
                                 id: {
                                     type: string;
                                 };
+                                name: {
+                                    type: string;
+                                };
+                                email: {
+                                    type: string;
+                                };
+                                direct_members_count: {
+                                    type: string;
+                                };
                             };
                             required: string[];
                         };
@@ -173,9 +182,7 @@ type DirectoryProvisioningConfig = Management.DirectoryProvisioning;
 export type Connection = Management.ConnectionForList & {
     enabled_clients?: string[];
     directory_provisioning_configuration?: Pick<DirectoryProvisioningConfig, 'mapping' | 'synchronize_automatically' | 'synchronize_groups'> & {
-        synchronized_groups?: Array<{
-            id: string;
-        }>;
+        synchronized_groups?: Management.SynchronizedGroupPayload[];
     };
 };
 export declare const addExcludedConnectionPropertiesToChanges: ({ proposedChanges, existingConnections, config, }: {
@@ -251,9 +258,7 @@ export default class ConnectionsHandler extends DefaultAPIHandler {
     /**
      * Retrieves all synchronized groups for a connection using checkpoint pagination.
      */
-    getConnectionSynchronizedGroups(connectionId: string): Promise<Array<{
-        id: string;
-    }> | null>;
+    getConnectionSynchronizedGroups(connectionId: string): Promise<Management.SynchronizedGroupPayload[] | null>;
     /**
      * Replaces the synchronized groups for a connection (PUT replace-all semantics).
      */

package/lib/tools/auth0/handlers/connections.js

@@ -172,6 +172,9 @@ exports.schema = {
                             type: 'object',
                             properties: {
                                 id: { type: 'string' },
+                                name: { type: 'string' },
+                                email: { type: 'string' },
+                                direct_members_count: { type: 'number' },
                             },
                             required: ['id'],
                         },
@@ -483,12 +486,28 @@ class ConnectionsHandler extends default_1.default {
         try {
             const groups = [];
             let page = await this.client.connections.directoryProvisioning.listSynchronizedGroups(connectionId, {});
-            for (const g of page.data ?? [])
-                groups.push({ id: g.id });
+            for (const g of page.data ?? []) {
+                groups.push({
+                    id: g.id,
+                    ...(g.name !== undefined && { name: g.name }),
+                    ...(g.email !== undefined && { email: g.email }),
+                    ...(g.direct_members_count !== undefined && {
+                        direct_members_count: g.direct_members_count,
+                    }),
+                });
+            }
             while (page.hasNextPage?.()) {
                 page = await page.getNextPage();
-                for (const g of page.data ?? [])
-                    groups.push({ id: g.id });
+                for (const g of page.data ?? []) {
+                    groups.push({
+                        id: g.id,
+                        ...(g.name !== undefined && { name: g.name }),
+                        ...(g.email !== undefined && { email: g.email }),
+                        ...(g.direct_members_count !== undefined && {
+                            direct_members_count: g.direct_members_count,
+                        }),
+                    });
+                }
             }
             return groups;
         }

package/lib/tools/auth0/handlers/databases.js

@@ -462,12 +462,21 @@ class DatabaseHandler extends default_1.default {
             }
             return connection;
         });
+        // A connection can return both legacy password fields and `password_options` on read, but
+        // they're mutually exclusive on write. Strip the legacy fields to keep the export deployable.
+        const dbConnectionsNormalized = dbConnectionsWithActionNames.map((connection) => {
+            if (connection.options && 'password_options' in connection.options) {
+                const { passwordPolicy, password_complexity_options, password_history, password_no_personal_info, password_dictionary, ...options } = connection.options;
+                return { ...connection, options };
+            }
+            return connection;
+        });
         // If options option is empty for all connection, log the missing options scope.
-        const isOptionExists = dbConnectionsWithActionNames.every((c) => c.options && Object.keys(c.options).length > 0);
+        const isOptionExists = dbConnectionsNormalized.every((c) => c.options && Object.keys(c.options).length > 0);
         if (!isOptionExists) {
             logger_1.default.warn(`Insufficient scope the read:connections_options scope is required to get ${this.type} options.`);
         }
-        this.existing = dbConnectionsWithActionNames;
+        this.existing = dbConnectionsNormalized;
         return this.existing;
     }
     async calcChanges(assets) {

package/lib/tools/auth0/handlers/organizations.d.ts

@@ -1,6 +1,7 @@
 import { Management } from 'auth0';
 import DefaultHandler from './default';
 import { Asset, Assets, CalculatedChanges } from '../../../types';
+import { Client } from './clients';
 export declare const schema: {
     type: string;
     items: {
@@ -108,6 +109,25 @@ export declare const schema: {
                 type: string;
                 enum: ("allow" | "block")[];
             };
+            is_app_entitlement_active: {
+                type: string;
+            };
+            clients: {
+                type: string;
+                items: {
+                    type: string;
+                    properties: {
+                        client_id: {
+                            type: string;
+                        };
+                        use_for_member_access: {
+                            type: string;
+                        };
+                    };
+                    required: string[];
+                };
+                default: never[];
+            };
         };
         required: string[];
     };
@@ -119,6 +139,7 @@ type FormattedClientGrants = {
 export default class OrganizationsHandler extends DefaultHandler {
     existing: Asset[];
     formattedClientGrants: FormattedClientGrants[];
+    allClients: Client[];
     constructor(config: DefaultHandler);
     deleteOrganization(org: any): Promise<void>;
     deleteOrganizations(data: Asset[]): Promise<void>;
@@ -128,6 +149,7 @@ export default class OrganizationsHandler extends DefaultHandler {
         id: any;
     }>;
     getClientGrantIDByClientName(clientsName: string): string;
+    getClientIdByClientName(clientName: string): string;
     getFormattedClientGrants(): Promise<FormattedClientGrants[]>;
     updateOrganizations(updates: CalculatedChanges['update'], orgs: Asset[]): Promise<void>;
     getType(): Promise<Asset[]>;
@@ -141,5 +163,11 @@ export default class OrganizationsHandler extends DefaultHandler {
     createOrganizationDiscoveryDomain(organizationId: string, discoveryDomain: Management.CreateOrganizationDiscoveryDomainRequestContent): Promise<Management.CreateOrganizationDiscoveryDomainResponseContent>;
     updateOrganizationDiscoveryDomain(organizationId: string, discoveryDomainId: string, discoveryDomain: string, discoveryDomainUpdate: Management.UpdateOrganizationDiscoveryDomainRequestContent): Promise<Management.UpdateOrganizationDiscoveryDomainResponseContent>;
     deleteOrganizationDiscoveryDomain(organizationId: string, discoveryDomain: string, discoveryDomainId: string): Promise<void>;
+    getAllOrganizationClients(organizationId: string): Promise<Management.OrganizationClient[] | null>;
+    createOrganizationClients(organizationId: string, clients: Array<{
+        client_id: string;
+        use_for_member_access: boolean;
+    }>): Promise<void>;
+    deleteOrganizationClients(organizationId: string, clientIds: string[]): Promise<void>;
 }
 export {};

package/lib/tools/auth0/handlers/organizations.js

@@ -131,6 +131,19 @@ exports.schema = {
                 type: 'string',
                 enum: Object.values(auth0_1.Management.OrganizationThirdPartyClientAccessEnum),
             },
+            is_app_entitlement_active: { type: 'boolean' },
+            clients: {
+                type: 'array',
+                items: {
+                    type: 'object',
+                    properties: {
+                        client_id: { type: 'string' },
+                        use_for_member_access: { type: 'boolean' },
+                    },
+                    required: ['client_id', 'use_for_member_access'],
+                },
+                default: [],
+            },
         },
         required: ['name'],
     },
@@ -172,6 +185,7 @@ class OrganizationsHandler extends default_1.default {
         const organization = { ...org };
         delete organization.connections;
         delete organization.client_grants;
+        delete organization.clients;
         if ('discovery_domains' in organization) {
             delete organization.discovery_domains;
         }
@@ -195,6 +209,19 @@ class OrganizationsHandler extends default_1.default {
                 throw new Error(`Problem creating discovery domain ${discoveryDomain?.domain} for organization ${createdId}\n${err}`);
             })));
         }
+        if (typeof org.clients !== 'undefined' && org.clients.length > 0) {
+            const clientsToCreate = org.clients
+                .map((oc) => ({
+                client_id: this.getClientIdByClientName(oc.client_id),
+                use_for_member_access: oc.use_for_member_access,
+            }))
+                .filter((oc) => !!oc.client_id);
+            if (clientsToCreate.length > 0) {
+                await this.createOrganizationClients(createdId, clientsToCreate).catch((err) => {
+                    throw new Error(`Problem creating org clients for organization ${createdId}\n${err}`);
+                });
+            }
+        }
         return created;
     }
     async createOrganizations(creates) {
@@ -213,14 +240,15 @@ class OrganizationsHandler extends default_1.default {
             .promise();
     }
     async updateOrganization(org, organizations) {
-        const { connections: existingConnections, client_grants: existingClientGrants, discovery_domains: existingDiscoveryDomains, } = await organizations.find((orgToUpdate) => orgToUpdate.name === org.name);
+        const { connections: existingConnections, client_grants: existingClientGrants, discovery_domains: existingDiscoveryDomains, clients: existingOrgClients = [], } = await organizations.find((orgToUpdate) => orgToUpdate.name === org.name);
         const params = { id: org.id };
-        const { connections, client_grants: organizationClientGrants, discovery_domains: organizationDiscoveryDomains, } = org;
+        const { connections, client_grants: organizationClientGrants, discovery_domains: organizationDiscoveryDomains, clients: organizationClients, } = org;
         delete org.connections;
         delete org.name;
         delete org.id;
         delete org.client_grants;
         delete org.discovery_domains;
+        delete org.clients;
         await this.client.organizations.update(params.id, org);
         // organization connections
         const connectionsToRemove = existingConnections.filter((c) => !connections.find((x) => x.connection_id === c.connection_id));
@@ -324,12 +352,61 @@ class OrganizationsHandler extends default_1.default {
       \n${orgDiscoveryDomainsToRemove.map((i) => this.objString(i)).join('\n')}`);
             }
         }
+        // organization clients
+        const orgClientsToAdd = (organizationClients || [])
+            .filter((c) => !existingOrgClients.find((x) => x.client_id === c.client_id))
+            .map((oc) => ({
+            client_id: this.getClientIdByClientName(oc.client_id),
+            use_for_member_access: oc.use_for_member_access,
+        }))
+            .filter((oc) => !!oc.client_id);
+        const orgClientsToRemove = (existingOrgClients || [])
+            .filter((c) => !(organizationClients || []).find((x) => x.client_id === c.client_id))
+            .map((oc) => this.getClientIdByClientName(oc.client_id))
+            .filter(Boolean);
+        const orgClientsToUpdate = (organizationClients || [])
+            .filter((c) => {
+            const existing = existingOrgClients.find((x) => x.client_id === c.client_id);
+            return existing && existing.use_for_member_access !== c.use_for_member_access;
+        })
+            .map((oc) => ({
+            client_id: this.getClientIdByClientName(oc.client_id),
+            use_for_member_access: oc.use_for_member_access,
+        }))
+            .filter((oc) => !!oc.client_id);
+        if (orgClientsToAdd.length > 0) {
+            await this.createOrganizationClients(params.id, orgClientsToAdd).catch((err) => {
+                throw new Error(`Problem adding org clients for organization ${params.id}\n${err}`);
+            });
+        }
+        if (orgClientsToRemove.length > 0) {
+            if (this.config('AUTH0_ALLOW_DELETE') === 'true' ||
+                this.config('AUTH0_ALLOW_DELETE') === true) {
+                await this.deleteOrganizationClients(params.id, orgClientsToRemove).catch((err) => {
+                    throw new Error(`Problem removing org clients for organization ${params.id}\n${err}`);
+                });
+            }
+            else {
+                logger_1.default.warn(`Detected the following organization client associations should be removed. Doing so may be destructive.\nYou can enable deletes by setting 'AUTH0_ALLOW_DELETE' to true in the config\n${orgClientsToRemove.join('\n')}`);
+            }
+        }
+        await Promise.all(orgClientsToUpdate.map((oc) => this.client.organizations.clients
+            .update(params.id, oc.client_id, {
+            use_for_member_access: oc.use_for_member_access,
+        })
+            .catch((err) => {
+            throw new Error(`Problem updating org client ${oc.client_id} for organization ${params.id}\n${err}`);
+        })));
         return params;
     }
     getClientGrantIDByClientName(clientsName) {
         const found = this.formattedClientGrants.find((c) => c.client_id === clientsName);
         return found?.grant_id || '';
     }
+    getClientIdByClientName(clientName) {
+        const found = this.allClients?.find((c) => c.name === clientName);
+        return found?.client_id || '';
+    }
     async getFormattedClientGrants() {
         const [clients, clientGrants] = await Promise.all([
             (0, client_1.paginate)(this.client.clients.list, {
@@ -339,6 +416,8 @@ class OrganizationsHandler extends default_1.default {
                 paginate: true,
             }),
         ]);
+        // Store clients for org-client name→ID resolution
+        this.allClients = clients;
         // Convert clients by name to the id and store it in the formattedClientGrants
         const formattedClientGrantsMapping = clientGrants?.map((clientGrant) => {
             const { id, client_id: clientName } = clientGrant;
@@ -394,6 +473,14 @@ class OrganizationsHandler extends default_1.default {
                 if (organizationDiscoveryDomains) {
                     org.discovery_domains = organizationDiscoveryDomains;
                 }
+                // Get org-client associations
+                const orgClients = await this.getAllOrganizationClients(org.id);
+                if (orgClients) {
+                    org.clients = orgClients.map((oc) => ({
+                        client_id: (0, utils_1.convertClientIdToName)(oc.client_id, clients),
+                        use_for_member_access: oc.use_for_member_access,
+                    }));
+                }
             }
             this.existing = organizations;
             return this.existing;
@@ -539,6 +626,44 @@ class OrganizationsHandler extends default_1.default {
         logger_1.default.debug(`Deleting discovery domain ${discoveryDomain} for organization ${organizationId}`);
         await this.client.organizations.discoveryDomains.delete(organizationId, discoveryDomainId);
     }
+    async getAllOrganizationClients(organizationId) {
+        const allOrgClients = [];
+        try {
+            let orgClients = await this.client.organizations.clients.list(organizationId);
+            allOrgClients.push(...orgClients.data);
+            while (orgClients.hasNextPage()) {
+                orgClients = await orgClients.getNextPage();
+                allOrgClients.push(...orgClients.data);
+            }
+            return allOrgClients;
+        }
+        catch (err) {
+            if (err.statusCode === 404 || err.statusCode === 501) {
+                return null;
+            }
+            if (err.statusCode === 403 || err.errorCode === 'feature_not_enabled') {
+                logger_1.default.debug('Org-to-app entitlement is not enabled for this tenant. Skipping org-client associations.');
+                return null;
+            }
+            throw err;
+        }
+    }
+    async createOrganizationClients(organizationId, clients) {
+        const BATCH_SIZE = 10;
+        for (let i = 0; i < clients.length; i += BATCH_SIZE) {
+            const batch = clients.slice(i, i + BATCH_SIZE);
+            logger_1.default.debug(`Creating ${batch.length} org client(s) for organization ${organizationId}`);
+            await this.client.organizations.clients.create(organizationId, { clients: batch });
+        }
+    }
+    async deleteOrganizationClients(organizationId, clientIds) {
+        const BATCH_SIZE = 10;
+        for (let i = 0; i < clientIds.length; i += BATCH_SIZE) {
+            const batch = clientIds.slice(i, i + BATCH_SIZE);
+            logger_1.default.debug(`Deleting ${batch.length} org client(s) for organization ${organizationId}`);
+            await this.client.organizations.clients.delete(organizationId, { clients: batch });
+        }
+    }
 }
 exports.default = OrganizationsHandler;
 __decorate([

package/lib/tools/auth0/handlers/phoneTemplates.d.ts

@@ -54,7 +54,10 @@ export default class PhoneTemplatesHandler extends DefaultHandler {
     objString(template: any): string;
     getType(): Promise<PhoneTemplate[]>;
     processChanges(assets: Assets): Promise<void>;
-    createPhoneTemplate(template: any): Promise<Asset>;
+    createPhoneTemplate(template: any): Promise<{
+        asset: Asset;
+        action: 'create' | 'update';
+    }>;
     createPhoneTemplates(creates: CalculatedChanges['create']): Promise<void>;
     updatePhoneTemplate(template: any): Promise<Asset>;
     updatePhoneTemplates(updates: CalculatedChanges['update']): Promise<void>;

package/lib/tools/auth0/handlers/phoneTemplates.js

@@ -44,6 +44,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.schema = void 0;
 const default_1 = __importStar(require("./default"));
+const utils_1 = require("../../utils");
 const logger_1 = __importDefault(require("../../../logger"));
 exports.schema = {
     type: 'array',
@@ -121,25 +122,77 @@ class PhoneTemplatesHandler extends default_1.default {
         if (del.length > 0) {
             await this.deletePhoneTemplates(del);
         }
-        if (create.length > 0) {
-            await this.createPhoneTemplates(create);
+        // On newly created tenants the phone templates returned by the API have no
+        // ID until they are explicitly created. calcChanges matches assets by `type`
+        // and routes them all to `update`, but PATCH requires an ID. Split out the
+        // templates whose existing counterpart has no ID yet and create them instead.
+        const missingId = [];
+        const hasId = [];
+        update.forEach((template) => {
+            const existing = this.existing?.find((t) => t.type === template.type);
+            if (existing?.id) {
+                hasId.push(template);
+            }
+            else {
+                missingId.push(template);
+            }
+        });
+        const toCreate = [...create, ...missingId];
+        if (toCreate.length > 0) {
+            await this.createPhoneTemplates(toCreate);
         }
-        if (update.length > 0) {
-            await this.updatePhoneTemplates(update);
+        if (hasId.length > 0) {
+            await this.updatePhoneTemplates(hasId);
         }
     }
     async createPhoneTemplate(template) {
-        const created = await this.client.branding.phone.templates.create(template);
-        return created;
+        // The create endpoint only accepts type/disabled/content; strip read-only
+        // fields (channel, customizable, tenant) that the API would reject.
+        const createPayload = (0, utils_1.stripFields)(template, this.stripCreateFields);
+        // The API rejects an empty `content.from`, which is what fresh tenants
+        // export. Drop it when blank (cloning `content`, which stripFields only
+        // shallow-copied, so the caller's original asset isn't mutated).
+        if (createPayload.content && !createPayload.content.from) {
+            createPayload.content = { ...createPayload.content };
+            delete createPayload.content.from;
+        }
+        try {
+            const created = await this.client.branding.phone.templates.create(createPayload);
+            return { asset: created, action: 'create' };
+        }
+        catch (err) {
+            // A 409 means the template already exists on the tenant (it was created
+            // between our list call and this create, or the list endpoint didn't
+            // surface its ID). Re-fetch to pick up the ID and fall back to an update.
+            if (err.statusCode === 409) {
+                logger_1.default.debug(`Phone template type '${template.type}' already exists, falling back to update`);
+                // Reassigns the shared `this.existing`; safe under concurrency since
+                // every re-fetch returns the same consistent list. If it still lacks an
+                // ID, updatePhoneTemplate warns and skips.
+                const response = await this.client.branding.phone.templates.list();
+                this.existing = response.templates ?? [];
+                const updated = await this.updatePhoneTemplate(template);
+                return { asset: updated, action: 'update' };
+            }
+            throw err;
+        }
     }
     async createPhoneTemplates(creates) {
         await this.client.pool
             .addEachTask({
             data: creates || [],
             generator: (item) => this.createPhoneTemplate(item)
-                .then((data) => {
-                this.didCreate(data);
-                this.created += 1;
+                .then(({ asset, action }) => {
+                // A 409 fallback actually performed an update; count it as such so
+                // the import summary doesn't report a phantom "create".
+                if (action === 'update') {
+                    this.didUpdate(asset);
+                    this.updated += 1;
+                }
+                else {
+                    this.didCreate(asset);
+                    this.created += 1;
+                }
             })
                 .catch((err) => {
                 throw new Error(`Problem creating ${this.type} ${this.objString(item)}\n${err}`);
@@ -160,7 +213,6 @@ class PhoneTemplatesHandler extends default_1.default {
         logger_1.default.debug(`Stripping ${this.type} create-only fields ${JSON.stringify(stripUpdateFields)}`);
         const updatePayload = {
             content: {
-                from: template.content?.from,
                 body: {
                     text: template.content?.body?.text,
                     voice: template.content?.body?.voice,
@@ -168,6 +220,11 @@ class PhoneTemplatesHandler extends default_1.default {
             },
             disabled: template.disabled,
         };
+        // `content.from` is optional but the API rejects an empty string, which is
+        // what fresh tenants export. Only include it when it has a value.
+        if (template.content?.from) {
+            updatePayload.content.from = template.content.from;
+        }
         const updated = await this.client.branding.phone.templates.update(existing.id, updatePayload);
         return updated;
     }

package/lib/tools/auth0/handlers/roles.d.ts

@@ -14,6 +14,10 @@ export declare const schema: {
             description: {
                 type: string;
             };
+            type: {
+                type: string;
+                enum: string[];
+            };
             permissions: {
                 type: string;
                 items: {

package/lib/tools/auth0/handlers/roles.js

@@ -56,6 +56,7 @@ exports.schema = {
             name: { type: 'string' },
             id: { type: 'string' },
             description: { type: 'string' },
+            type: { type: 'string', enum: ['tenant', 'organization'] },
             permissions: {
                 type: 'array',
                 items: {
@@ -81,6 +82,9 @@ class RolesHandler extends default_1.default {
     async createRole(data) {
         const role = { ...data };
         delete role.permissions;
+        // deploy-cli only manages tenant-level roles, so `type` is stripped on write; it
+        // defaults to `tenant` on create. This keeps exports (which carry `type`) round-trippable.
+        delete role.type;
         const created = await this.client.roles.create(role);
         if (created.id && typeof data.permissions !== 'undefined' && data.permissions.length > 0) {
             await this.client.roles.permissions.add(created.id, { permissions: data.permissions });
@@ -133,6 +137,9 @@ class RolesHandler extends default_1.default {
         const newPermissions = data.permissions;
         delete data.permissions;
         delete data.id;
+        // deploy-cli only manages tenant-level roles, so `type` is stripped on write; this
+        // lets files that already carry it (from a prior export) be imported cleanly.
+        delete data.type;
         await this.client.roles.update(params.id, data);
         if (typeof existingRole.permissions !== 'undefined' && existingRole.permissions.length > 0) {
             await this.client.roles.permissions.delete(params.id, {
@@ -164,9 +171,12 @@ class RolesHandler extends default_1.default {
             return this.existing;
         }
         try {
+            // Only manage tenant-level roles; exclude org-scoped roles surfaced when
+            // the api2_org_level_roles_ea flag is enabled.
             const roles = await (0, client_1.paginate)(this.client.roles.list, {
                 paginate: true,
                 include_totals: true,
+                type: 'tenant',
             });
             for (let index = 0; index < roles.length; index++) {
                 const allPermission = [];

package/lib/types.d.ts

@@ -31,6 +31,7 @@ type SharedPaginationParams = {
     include_totals?: boolean;
     id?: string;
     strategy?: Management.ConnectionStrategyEnum[];
+    type?: Management.RoleTypeEnum;
 };
 export type CheckpointPaginationParams = SharedPaginationParams & {
     from?: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "auth0-deploy-cli",
-  "version": "8.42.0",
+  "version": "8.43.0",
   "description": "A command line tool for deploying updates to your Auth0 tenant",
   "main": "lib/index.js",
   "bin": {
@@ -35,7 +35,7 @@
   "dependencies": {
     "@clack/prompts": "1.4.0",
     "ajv": "^6.12.6",
-    "auth0": "^6.1.0",
+    "auth0": "^6.2.0",
     "chalk": "5.6.2",
     "dot-prop": "^5.3.0",
     "fs-extra": "^10.1.0",