auth0-deploy-cli 8.42.0 → 8.44.0

package/lib/tools/auth0/handlers/organizations.js

@@ -131,6 +131,19 @@ exports.schema = {
                 type: 'string',
                 enum: Object.values(auth0_1.Management.OrganizationThirdPartyClientAccessEnum),
             },
+            is_app_entitlement_active: { type: 'boolean' },
+            clients: {
+                type: 'array',
+                items: {
+                    type: 'object',
+                    properties: {
+                        client_id: { type: 'string' },
+                        use_for_member_access: { type: 'boolean' },
+                    },
+                    required: ['client_id', 'use_for_member_access'],
+                },
+                default: [],
+            },
         },
         required: ['name'],
     },
@@ -172,6 +185,7 @@ class OrganizationsHandler extends default_1.default {
         const organization = { ...org };
         delete organization.connections;
         delete organization.client_grants;
+        delete organization.clients;
         if ('discovery_domains' in organization) {
             delete organization.discovery_domains;
         }
@@ -180,8 +194,9 @@ class OrganizationsHandler extends default_1.default {
             throw new Error(`Organization "${organization.name}" was created but the response did not include an ID. Skipping connection/grant association.`);
         }
         const createdId = created.id;
+        const retryConfig = this.getRetryConfig();
         if (typeof org.connections !== 'undefined' && org.connections.length > 0) {
-            await Promise.all(org.connections.map((conn) => this.client.organizations.connections.create(createdId, conn)));
+            await Promise.all(org.connections.map((conn) => (0, default_1.retryWithExponentialBackoff)(() => this.client.organizations.connections.create(createdId, conn), retryConfig)));
         }
         if (typeof org.client_grants !== 'undefined' && org.client_grants.length > 0) {
             await Promise.all(org.client_grants.map((organizationClientGrants) => this.createOrganizationClientGrants(createdId, this.getClientGrantIDByClientName(organizationClientGrants.client_id))));
@@ -195,6 +210,19 @@ class OrganizationsHandler extends default_1.default {
                 throw new Error(`Problem creating discovery domain ${discoveryDomain?.domain} for organization ${createdId}\n${err}`);
             })));
         }
+        if (typeof org.clients !== 'undefined' && org.clients.length > 0) {
+            const clientsToCreate = org.clients
+                .map((oc) => ({
+                client_id: this.getClientIdByClientName(oc.client_id),
+                use_for_member_access: oc.use_for_member_access,
+            }))
+                .filter((oc) => !!oc.client_id);
+            if (clientsToCreate.length > 0) {
+                await this.createOrganizationClients(createdId, clientsToCreate).catch((err) => {
+                    throw new Error(`Problem creating org clients for organization ${createdId}\n${err}`);
+                });
+            }
+        }
         return created;
     }
     async createOrganizations(creates) {
@@ -213,15 +241,24 @@ class OrganizationsHandler extends default_1.default {
             .promise();
     }
     async updateOrganization(org, organizations) {
-        const { connections: existingConnections, client_grants: existingClientGrants, discovery_domains: existingDiscoveryDomains, } = await organizations.find((orgToUpdate) => orgToUpdate.name === org.name);
+        const existingOrg = organizations.find((orgToUpdate) => orgToUpdate.name === org.name);
+        const { connections: existingConnections, client_grants: existingClientGrants, discovery_domains: existingDiscoveryDomains, clients: existingOrgClients = [], } = existingOrg;
         const params = { id: org.id };
-        const { connections, client_grants: organizationClientGrants, discovery_domains: organizationDiscoveryDomains, } = org;
+        const { connections, client_grants: organizationClientGrants, discovery_domains: organizationDiscoveryDomains, clients: organizationClients, } = org;
         delete org.connections;
         delete org.name;
         delete org.id;
         delete org.client_grants;
         delete org.discovery_domains;
-        await this.client.organizations.update(params.id, org);
+        delete org.clients;
+        // Only PATCH if top-level properties actually differ from the existing state.
+        // Compare only the keys present in the desired config against those same keys
+        // on the remote org, so that fields the user didn't specify are not considered.
+        let changed = false;
+        if (!(0, lodash_1.isEqual)(org, (0, lodash_1.pick)(existingOrg, Object.keys(org)))) {
+            await this.client.organizations.update(params.id, org);
+            changed = true;
+        }
         // organization connections
         const connectionsToRemove = existingConnections.filter((c) => !connections.find((x) => x.connection_id === c.connection_id));
         const connectionsToAdd = connections.filter((c) => !existingConnections.find((x) => x.connection_id === c.connection_id));
@@ -232,27 +269,27 @@ class OrganizationsHandler extends default_1.default {
                 x.organization_access_level !== c.organization_access_level ||
                 x.organization_connection_name !== c.organization_connection_name ||
                 x.is_enabled !== (c.is_enabled ?? true))));
+        if (connectionsToUpdate.length > 0 ||
+            connectionsToAdd.length > 0 ||
+            connectionsToRemove.length > 0) {
+            changed = true;
+        }
+        const retryConfig = this.getRetryConfig();
         // Handle updates first
-        await Promise.all(connectionsToUpdate.map((conn) => this.client.organizations.connections
-            .update(params.id, conn.connection_id, {
+        await Promise.all(connectionsToUpdate.map((conn) => (0, default_1.retryWithExponentialBackoff)(() => this.client.organizations.connections.update(params.id, conn.connection_id, {
             organization_connection_name: conn.organization_connection_name,
             assign_membership_on_login: conn.assign_membership_on_login,
             show_as_button: conn.show_as_button,
             is_signup_enabled: conn.is_signup_enabled,
             is_enabled: conn.is_enabled,
             organization_access_level: conn.organization_access_level,
-        })
-            .catch(() => {
+        }), retryConfig).catch(() => {
             throw new Error(`Problem updating Enabled Connection ${conn.connection_id} for organizations ${params.id}`);
         })));
-        await Promise.all(connectionsToAdd.map((conn) => this.client.organizations.connections
-            .create(params.id, (0, lodash_1.omit)(conn, 'connection'))
-            .catch(() => {
+        await Promise.all(connectionsToAdd.map((conn) => (0, default_1.retryWithExponentialBackoff)(() => this.client.organizations.connections.create(params.id, (0, lodash_1.omit)(conn, 'connection')), retryConfig).catch(() => {
             throw new Error(`Problem adding Enabled Connection ${conn.connection_id} for organizations ${params.id}`);
         })));
-        await Promise.all(connectionsToRemove.map((conn) => this.client.organizations.connections
-            .delete(params.id, conn.connection_id)
-            .catch(() => {
+        await Promise.all(connectionsToRemove.map((conn) => (0, default_1.retryWithExponentialBackoff)(() => this.client.organizations.connections.delete(params.id, conn.connection_id), retryConfig).catch(() => {
             throw new Error(`Problem removing Enabled Connection ${conn.connection_id} for organizations ${params.id}`);
         })));
         // organization client_grants
@@ -266,6 +303,9 @@ class OrganizationsHandler extends default_1.default {
             ?.map((clientGrant) => ({
             grant_id: this.getClientGrantIDByClientName(clientGrant.client_id),
         })) || [];
+        if (orgClientGrantsToAdd.length > 0 || orgClientGrantsToRemove.length > 0) {
+            changed = true;
+        }
         // Handle updates first
         await Promise.all(orgClientGrantsToAdd.map((orgClientGrant) => this.createOrganizationClientGrants(params.id, orgClientGrant.grant_id).catch(() => {
             throw new Error(`Problem adding organization clientGrant ${orgClientGrant.grant_id} for organizations ${params.id}`);
@@ -287,6 +327,9 @@ class OrganizationsHandler extends default_1.default {
             };
         })
             .filter(Boolean) || [];
+        if (orgDiscoveryDomainsToUpdate.length > 0 || orgDiscoveryDomainsToAdd.length > 0) {
+            changed = true;
+        }
         for (const { id, domain, ...updateParams } of orgDiscoveryDomainsToUpdate) {
             try {
                 await this.updateOrganizationDiscoveryDomain(params.id, id, domain, updateParams);
@@ -310,6 +353,7 @@ class OrganizationsHandler extends default_1.default {
         if (orgDiscoveryDomainsToRemove.length > 0) {
             if (this.config('AUTH0_ALLOW_DELETE') === 'true' ||
                 this.config('AUTH0_ALLOW_DELETE') === true) {
+                changed = true;
                 for (const domain of orgDiscoveryDomainsToRemove) {
                     try {
                         await this.deleteOrganizationDiscoveryDomain(params.id, domain.domain, domain.id);
@@ -324,12 +368,66 @@ class OrganizationsHandler extends default_1.default {
       \n${orgDiscoveryDomainsToRemove.map((i) => this.objString(i)).join('\n')}`);
             }
         }
-        return params;
+        // organization clients
+        const orgClientsToAdd = (organizationClients || [])
+            .filter((c) => !existingOrgClients.find((x) => x.client_id === c.client_id))
+            .map((oc) => ({
+            client_id: this.getClientIdByClientName(oc.client_id),
+            use_for_member_access: oc.use_for_member_access,
+        }))
+            .filter((oc) => !!oc.client_id);
+        const orgClientsToRemove = (existingOrgClients || [])
+            .filter((c) => !(organizationClients || []).find((x) => x.client_id === c.client_id))
+            .map((oc) => this.getClientIdByClientName(oc.client_id))
+            .filter(Boolean);
+        const orgClientsToUpdate = (organizationClients || [])
+            .filter((c) => {
+            const existing = existingOrgClients.find((x) => x.client_id === c.client_id);
+            return existing && existing.use_for_member_access !== c.use_for_member_access;
+        })
+            .map((oc) => ({
+            client_id: this.getClientIdByClientName(oc.client_id),
+            use_for_member_access: oc.use_for_member_access,
+        }))
+            .filter((oc) => !!oc.client_id);
+        if (orgClientsToAdd.length > 0) {
+            changed = true;
+            await this.createOrganizationClients(params.id, orgClientsToAdd).catch((err) => {
+                throw new Error(`Problem adding org clients for organization ${params.id}\n${err}`);
+            });
+        }
+        if (orgClientsToRemove.length > 0) {
+            if (this.config('AUTH0_ALLOW_DELETE') === 'true' ||
+                this.config('AUTH0_ALLOW_DELETE') === true) {
+                changed = true;
+                await this.deleteOrganizationClients(params.id, orgClientsToRemove).catch((err) => {
+                    throw new Error(`Problem removing org clients for organization ${params.id}\n${err}`);
+                });
+            }
+            else {
+                logger_1.default.warn(`Detected the following organization client associations should be removed. Doing so may be destructive.\nYou can enable deletes by setting 'AUTH0_ALLOW_DELETE' to true in the config\n${orgClientsToRemove.join('\n')}`);
+            }
+        }
+        if (orgClientsToUpdate.length > 0) {
+            changed = true;
+        }
+        await Promise.all(orgClientsToUpdate.map((oc) => this.client.organizations.clients
+            .update(params.id, oc.client_id, {
+            use_for_member_access: oc.use_for_member_access,
+        })
+            .catch((err) => {
+            throw new Error(`Problem updating org client ${oc.client_id} for organization ${params.id}\n${err}`);
+        })));
+        return changed ? params : null;
     }
     getClientGrantIDByClientName(clientsName) {
         const found = this.formattedClientGrants.find((c) => c.client_id === clientsName);
         return found?.grant_id || '';
     }
+    getClientIdByClientName(clientName) {
+        const found = this.allClients?.find((c) => c.name === clientName);
+        return found?.client_id || '';
+    }
     async getFormattedClientGrants() {
         const [clients, clientGrants] = await Promise.all([
             (0, client_1.paginate)(this.client.clients.list, {
@@ -339,6 +437,8 @@ class OrganizationsHandler extends default_1.default {
                 paginate: true,
             }),
         ]);
+        // Store clients for org-client name→ID resolution
+        this.allClients = clients;
         // Convert clients by name to the id and store it in the formattedClientGrants
         const formattedClientGrantsMapping = clientGrants?.map((clientGrant) => {
             const { id, client_id: clientName } = clientGrant;
@@ -356,8 +456,10 @@ class OrganizationsHandler extends default_1.default {
             data: updates || [],
             generator: (item) => this.updateOrganization(item, orgs)
                 .then((data) => {
-                this.didUpdate(data);
-                this.updated += 1;
+                if (data) {
+                    this.didUpdate(data);
+                    this.updated += 1;
+                }
             })
                 .catch((err) => {
                 throw new Error(`Problem updating ${this.type} ${this.objString(item)}\n${err}`);
@@ -394,6 +496,14 @@ class OrganizationsHandler extends default_1.default {
                 if (organizationDiscoveryDomains) {
                     org.discovery_domains = organizationDiscoveryDomains;
                 }
+                // Get org-client associations
+                const orgClients = await this.getAllOrganizationClients(org.id);
+                if (orgClients) {
+                    org.clients = orgClients.map((oc) => ({
+                        client_id: (0, utils_1.convertClientIdToName)(oc.client_id, clients),
+                        use_for_member_access: oc.use_for_member_access,
+                    }));
+                }
             }
             this.existing = organizations;
             return this.existing;
@@ -539,6 +649,44 @@ class OrganizationsHandler extends default_1.default {
         logger_1.default.debug(`Deleting discovery domain ${discoveryDomain} for organization ${organizationId}`);
         await this.client.organizations.discoveryDomains.delete(organizationId, discoveryDomainId);
     }
+    async getAllOrganizationClients(organizationId) {
+        const allOrgClients = [];
+        try {
+            let orgClients = await this.client.organizations.clients.list(organizationId);
+            allOrgClients.push(...orgClients.data);
+            while (orgClients.hasNextPage()) {
+                orgClients = await orgClients.getNextPage();
+                allOrgClients.push(...orgClients.data);
+            }
+            return allOrgClients;
+        }
+        catch (err) {
+            if (err.statusCode === 404 || err.statusCode === 501) {
+                return null;
+            }
+            if (err.statusCode === 403 || err.errorCode === 'feature_not_enabled') {
+                logger_1.default.debug('Org-to-app entitlement is not enabled for this tenant. Skipping org-client associations.');
+                return null;
+            }
+            throw err;
+        }
+    }
+    async createOrganizationClients(organizationId, clients) {
+        const BATCH_SIZE = 10;
+        for (let i = 0; i < clients.length; i += BATCH_SIZE) {
+            const batch = clients.slice(i, i + BATCH_SIZE);
+            logger_1.default.debug(`Creating ${batch.length} org client(s) for organization ${organizationId}`);
+            await this.client.organizations.clients.create(organizationId, { clients: batch });
+        }
+    }
+    async deleteOrganizationClients(organizationId, clientIds) {
+        const BATCH_SIZE = 10;
+        for (let i = 0; i < clientIds.length; i += BATCH_SIZE) {
+            const batch = clientIds.slice(i, i + BATCH_SIZE);
+            logger_1.default.debug(`Deleting ${batch.length} org client(s) for organization ${organizationId}`);
+            await this.client.organizations.clients.delete(organizationId, { clients: batch });
+        }
+    }
 }
 exports.default = OrganizationsHandler;
 __decorate([

package/lib/tools/auth0/handlers/phoneProvider.js

@@ -202,12 +202,20 @@ class PhoneProviderHandler extends default_1.default {
         }
         const currentProviders = await this.getPhoneProviders();
         const providerReqPayload = (() => {
+            // Work on a shallow copy so we don't mutate the caller's asset (phoneProviders[0]).
+            // The SDK response type doesn't declare `credentials`, so widen it here.
+            const payload = { ...phoneProviders[0] };
             // Removing id from update and create payloads, otherwise API will error
             // id may be required to handle if `--export_ids=true`
-            const payload = phoneProviders[0];
-            if (payload && 'id' in payload) {
+            if ('id' in payload) {
                 delete payload.id;
             }
+            // The `custom` provider requires a `credentials` object in the payload even
+            // when it is empty. Exported configs omit credentials, so inject an empty
+            // object here to avoid a "Missing required property: credentials" 400 error.
+            if (payload.name === 'custom' && payload.credentials == null) {
+                payload.credentials = {};
+            }
             return payload;
         })();
         if (currentProviders === null || currentProviders.length === 0) {

package/lib/tools/auth0/handlers/phoneTemplates.d.ts

@@ -54,7 +54,10 @@ export default class PhoneTemplatesHandler extends DefaultHandler {
     objString(template: any): string;
     getType(): Promise<PhoneTemplate[]>;
     processChanges(assets: Assets): Promise<void>;
-    createPhoneTemplate(template: any): Promise<Asset>;
+    createPhoneTemplate(template: any): Promise<{
+        asset: Asset;
+        action: 'create' | 'update';
+    }>;
     createPhoneTemplates(creates: CalculatedChanges['create']): Promise<void>;
     updatePhoneTemplate(template: any): Promise<Asset>;
     updatePhoneTemplates(updates: CalculatedChanges['update']): Promise<void>;

package/lib/tools/auth0/handlers/phoneTemplates.js

@@ -44,6 +44,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.schema = void 0;
 const default_1 = __importStar(require("./default"));
+const utils_1 = require("../../utils");
 const logger_1 = __importDefault(require("../../../logger"));
 exports.schema = {
     type: 'array',
@@ -121,25 +122,77 @@ class PhoneTemplatesHandler extends default_1.default {
         if (del.length > 0) {
             await this.deletePhoneTemplates(del);
         }
-        if (create.length > 0) {
-            await this.createPhoneTemplates(create);
+        // On newly created tenants the phone templates returned by the API have no
+        // ID until they are explicitly created. calcChanges matches assets by `type`
+        // and routes them all to `update`, but PATCH requires an ID. Split out the
+        // templates whose existing counterpart has no ID yet and create them instead.
+        const missingId = [];
+        const hasId = [];
+        update.forEach((template) => {
+            const existing = this.existing?.find((t) => t.type === template.type);
+            if (existing?.id) {
+                hasId.push(template);
+            }
+            else {
+                missingId.push(template);
+            }
+        });
+        const toCreate = [...create, ...missingId];
+        if (toCreate.length > 0) {
+            await this.createPhoneTemplates(toCreate);
         }
-        if (update.length > 0) {
-            await this.updatePhoneTemplates(update);
+        if (hasId.length > 0) {
+            await this.updatePhoneTemplates(hasId);
         }
     }
     async createPhoneTemplate(template) {
-        const created = await this.client.branding.phone.templates.create(template);
-        return created;
+        // The create endpoint only accepts type/disabled/content; strip read-only
+        // fields (channel, customizable, tenant) that the API would reject.
+        const createPayload = (0, utils_1.stripFields)(template, this.stripCreateFields);
+        // The API rejects an empty `content.from`, which is what fresh tenants
+        // export. Drop it when blank (cloning `content`, which stripFields only
+        // shallow-copied, so the caller's original asset isn't mutated).
+        if (createPayload.content && !createPayload.content.from) {
+            createPayload.content = { ...createPayload.content };
+            delete createPayload.content.from;
+        }
+        try {
+            const created = await this.client.branding.phone.templates.create(createPayload);
+            return { asset: created, action: 'create' };
+        }
+        catch (err) {
+            // A 409 means the template already exists on the tenant (it was created
+            // between our list call and this create, or the list endpoint didn't
+            // surface its ID). Re-fetch to pick up the ID and fall back to an update.
+            if (err.statusCode === 409) {
+                logger_1.default.debug(`Phone template type '${template.type}' already exists, falling back to update`);
+                // Reassigns the shared `this.existing`; safe under concurrency since
+                // every re-fetch returns the same consistent list. If it still lacks an
+                // ID, updatePhoneTemplate warns and skips.
+                const response = await this.client.branding.phone.templates.list();
+                this.existing = response.templates ?? [];
+                const updated = await this.updatePhoneTemplate(template);
+                return { asset: updated, action: 'update' };
+            }
+            throw err;
+        }
     }
     async createPhoneTemplates(creates) {
         await this.client.pool
             .addEachTask({
             data: creates || [],
             generator: (item) => this.createPhoneTemplate(item)
-                .then((data) => {
-                this.didCreate(data);
-                this.created += 1;
+                .then(({ asset, action }) => {
+                // A 409 fallback actually performed an update; count it as such so
+                // the import summary doesn't report a phantom "create".
+                if (action === 'update') {
+                    this.didUpdate(asset);
+                    this.updated += 1;
+                }
+                else {
+                    this.didCreate(asset);
+                    this.created += 1;
+                }
             })
                 .catch((err) => {
                 throw new Error(`Problem creating ${this.type} ${this.objString(item)}\n${err}`);
@@ -160,7 +213,6 @@ class PhoneTemplatesHandler extends default_1.default {
         logger_1.default.debug(`Stripping ${this.type} create-only fields ${JSON.stringify(stripUpdateFields)}`);
         const updatePayload = {
             content: {
-                from: template.content?.from,
                 body: {
                     text: template.content?.body?.text,
                     voice: template.content?.body?.voice,
@@ -168,6 +220,11 @@ class PhoneTemplatesHandler extends default_1.default {
             },
             disabled: template.disabled,
         };
+        // `content.from` is optional but the API rejects an empty string, which is
+        // what fresh tenants export. Only include it when it has a value.
+        if (template.content?.from) {
+            updatePayload.content.from = template.content.from;
+        }
         const updated = await this.client.branding.phone.templates.update(existing.id, updatePayload);
         return updated;
     }

package/lib/tools/auth0/handlers/roles.d.ts

@@ -14,6 +14,10 @@ export declare const schema: {
             description: {
                 type: string;
             };
+            type: {
+                type: string;
+                enum: string[];
+            };
             permissions: {
                 type: string;
                 items: {

package/lib/tools/auth0/handlers/roles.js

@@ -56,6 +56,7 @@ exports.schema = {
             name: { type: 'string' },
             id: { type: 'string' },
             description: { type: 'string' },
+            type: { type: 'string', enum: ['tenant', 'organization'] },
             permissions: {
                 type: 'array',
                 items: {
@@ -81,6 +82,9 @@ class RolesHandler extends default_1.default {
     async createRole(data) {
         const role = { ...data };
         delete role.permissions;
+        // deploy-cli only manages tenant-level roles, so `type` is stripped on write; it
+        // defaults to `tenant` on create. This keeps exports (which carry `type`) round-trippable.
+        delete role.type;
         const created = await this.client.roles.create(role);
         if (created.id && typeof data.permissions !== 'undefined' && data.permissions.length > 0) {
             await this.client.roles.permissions.add(created.id, { permissions: data.permissions });
@@ -133,6 +137,9 @@ class RolesHandler extends default_1.default {
         const newPermissions = data.permissions;
         delete data.permissions;
         delete data.id;
+        // deploy-cli only manages tenant-level roles, so `type` is stripped on write; this
+        // lets files that already carry it (from a prior export) be imported cleanly.
+        delete data.type;
         await this.client.roles.update(params.id, data);
         if (typeof existingRole.permissions !== 'undefined' && existingRole.permissions.length > 0) {
             await this.client.roles.permissions.delete(params.id, {
@@ -164,9 +171,12 @@ class RolesHandler extends default_1.default {
             return this.existing;
         }
         try {
+            // Only manage tenant-level roles; exclude org-scoped roles surfaced when
+            // the api2_org_level_roles_ea flag is enabled.
             const roles = await (0, client_1.paginate)(this.client.roles.list, {
                 paginate: true,
                 include_totals: true,
+                type: 'tenant',
             });
             for (let index = 0; index < roles.length; index++) {
                 const allPermission = [];

package/lib/tools/calculateDryRunChanges.js

@@ -108,6 +108,13 @@ function normalizeArrayValues(values) {
         .map((value) => normalizeValue(value))
         .sort((left, right) => JSON.stringify(left).localeCompare(JSON.stringify(right)));
 }
+/**
+ * Serializes a value to a human-readable string for use in diff messages.
+ * Objects and arrays are JSON-stringified to avoid "[object Object]" output.
+ */
+function formatDiffValue(value) {
+    return typeof value === 'object' && value !== null ? JSON.stringify(value) : String(value);
+}
 /**
  * Writes the accumulated diff log to a JSON file on disk.
  * Useful for CI pipelines that want a machine-readable dry-run report.
@@ -179,7 +186,7 @@ function getObjectDifferences(localObj, remoteObj, keyObjPath = '', resourceType
                         differences.push(...nestedDifferences);
                     }
                     else if (item !== normalizedRemoteValue[index]) {
-                        const message = `Array item difference at [${currentPath}[${index}]]: local:${item} vs remote:${normalizedRemoteValue[index]}`;
+                        const message = `Array item difference at [${currentPath}[${index}]]: local:${formatDiffValue(item)} vs remote:${formatDiffValue(normalizedRemoteValue[index])}`;
                         differences.push(message);
                     }
                 });
@@ -204,13 +211,10 @@ function getObjectDifferences(localObj, remoteObj, keyObjPath = '', resourceType
             differences.push(...nestedDifferences);
             return;
         }
-        // Compare primitive values — omit array indices from path to reduce log noise
+        // Compare primitive values
         if (localValue !== remoteValue) {
-            let arrayPathRegex = new RegExp(/\[\d+\]/g);
-            if (!arrayPathRegex.test(currentPath)) {
-                const message = `Value difference for [${currentPath}]: local:${localValue} vs remote:${remoteValue}`;
-                differences.push(message);
-            }
+            const message = `Value difference for [${currentPath}]: local:${localValue} vs remote:${remoteValue}`;
+            differences.push(message);
         }
     });
     return differences;
@@ -242,7 +246,7 @@ function calculateDryRunChanges({ type, assets, existing, identifiers = ['id', '
     const create = [];
     const conflicts = [];
     const localAssets = (Array.isArray(assets) ? [...assets] : [assets]).map((asset) => type === 'tenant' ? normalizeTenantForDryRun(asset) : asset);
-    const remoteAssets = (Array.isArray(existing) ? [...existing] : [existing]).map((asset) => (type === 'tenant' ? normalizeTenantForDryRun(asset) : asset));
+    const remoteAssets = (Array.isArray(existing) ? [...existing] : existing ? [existing] : []).map((asset) => (type === 'tenant' ? normalizeTenantForDryRun(asset) : asset));
     // Helper: returns true if a local and remote asset share at least one identifier value
     const assetsMatch = (localAsset, remoteAsset) => identifiers.some((id) => {
         if (Array.isArray(id)) {

package/lib/types.d.ts

@@ -31,6 +31,7 @@ type SharedPaginationParams = {
     include_totals?: boolean;
     id?: string;
     strategy?: Management.ConnectionStrategyEnum[];
+    type?: Management.RoleTypeEnum;
 };
 export type CheckpointPaginationParams = SharedPaginationParams & {
     from?: string;

package/lib/utils.js

@@ -301,12 +301,15 @@ exports.decodeBase64ToCertString = decodeBase64ToCertString;
 // Format connection options by converting client IDs to client names for SAML connections
 const getFormattedOptions = (connection, clients) => {
     try {
+        const { idpinitiated } = connection.options;
         return {
             options: {
                 ...connection.options,
                 idpinitiated: {
-                    ...connection.options.idpinitiated,
-                    client_id: convertClientIdToName(connection.options.idpinitiated.client_id, clients),
+                    ...idpinitiated,
+                    ...(idpinitiated.client_id && {
+                        client_id: convertClientIdToName(idpinitiated.client_id, clients),
+                    }),
                 },
             },
         };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "auth0-deploy-cli",
-  "version": "8.42.0",
+  "version": "8.44.0",
   "description": "A command line tool for deploying updates to your Auth0 tenant",
   "main": "lib/index.js",
   "bin": {
@@ -35,7 +35,7 @@
   "dependencies": {
     "@clack/prompts": "1.4.0",
     "ajv": "^6.12.6",
-    "auth0": "^6.1.0",
+    "auth0": "^6.3.0",
     "chalk": "5.6.2",
     "dot-prop": "^5.3.0",
     "fs-extra": "^10.1.0",