auth0-deploy-cli 8.42.0 → 9.0.0-beta.2

package/CHANGELOG.md

@@ -7,42 +7,17 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
-## [8.42.0] - 2026-07-30
-
-### Added
-
-- Add UL identifier input support for themes and tenant settings. [#1433]
-- Add `token_vault_privileged_access` support for clients. [#1430]
-- Add `auth0_managed` field support for network ACLs (Curated Blocklists - EA). [#1435]
-- Add Cross App Access (XAA) resource app support for connections and clients. [#1431]
-- Add `cross_app_access_requesting_app` support for connections (EA). [#1422]
+## [9.0.0-beta.2] - 2026-08-11
 
 ### Fixed
 
-- Prevent dry-run crash on `clientAuthCredentials` handler. [#1438]
-- Resolve spurious dry-run diffs for rules, themes, and hooks. [#1437]
-- Strip unresolved placeholders on deploy instead of throwing. [#1436]
-- Handle 403 entitlement errors for bot detection and captcha on export. [#1434]
-- Warn and skip deprecated guardian phone provider on 403 during import. [#1429]
-- Add `use_scope_descriptions_for_consent` to allowed tenant flags. [#1428]
-
-## [8.41.0] - 2026-07-16
-
-### Added
-
-- Add `third_party_client_access` support for organizations. [#1421]
-
-## [8.40.0] - 2026-07-09
-
-### Added
+- Enforce path traversal protection for actions, rules, hooks, and databases. [#1448]
 
-- Add client credential lifecycle management for Private Key JWT and mTLS authentication methods. [#1417]
-- Add Rate Limit Policies (EA) support. [#1395]
+## [9.0.0-beta.1] - 2026-07-02
 
-### Fixed
+### Security
 
-- Preserve `false` value for `default_head_tags_disabled` in screen renderer update. [#1416]
-- Skip destination update for action event streams as the destination type cannot be changed after creation. [#1425]
+- Prevent path traversal attacks in config file handlers for directory and YAML contexts. [#1418]
 
 ## [8.39.0] - 2026-06-30
 
@@ -1879,7 +1854,6 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 [#1389]: https://github.com/auth0/auth0-deploy-cli/issues/1389
 [#1391]: https://github.com/auth0/auth0-deploy-cli/issues/1391
 [#1392]: https://github.com/auth0/auth0-deploy-cli/issues/1392
-[#1395]: https://github.com/auth0/auth0-deploy-cli/issues/1395
 [#1396]: https://github.com/auth0/auth0-deploy-cli/issues/1396
 [#1398]: https://github.com/auth0/auth0-deploy-cli/issues/1398
 [#1400]: https://github.com/auth0/auth0-deploy-cli/issues/1400
@@ -1892,25 +1866,11 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 [#1409]: https://github.com/auth0/auth0-deploy-cli/issues/1409
 [#1411]: https://github.com/auth0/auth0-deploy-cli/issues/1411
 [#1412]: https://github.com/auth0/auth0-deploy-cli/issues/1412
-[#1416]: https://github.com/auth0/auth0-deploy-cli/issues/1416
-[#1417]: https://github.com/auth0/auth0-deploy-cli/issues/1417
-[#1421]: https://github.com/auth0/auth0-deploy-cli/issues/1421
-[#1422]: https://github.com/auth0/auth0-deploy-cli/issues/1422
-[#1425]: https://github.com/auth0/auth0-deploy-cli/issues/1425
-[#1428]: https://github.com/auth0/auth0-deploy-cli/issues/1428
-[#1429]: https://github.com/auth0/auth0-deploy-cli/issues/1429
-[#1430]: https://github.com/auth0/auth0-deploy-cli/issues/1430
-[#1431]: https://github.com/auth0/auth0-deploy-cli/issues/1431
-[#1433]: https://github.com/auth0/auth0-deploy-cli/issues/1433
-[#1434]: https://github.com/auth0/auth0-deploy-cli/issues/1434
-[#1435]: https://github.com/auth0/auth0-deploy-cli/issues/1435
-[#1436]: https://github.com/auth0/auth0-deploy-cli/issues/1436
-[#1437]: https://github.com/auth0/auth0-deploy-cli/issues/1437
-[#1438]: https://github.com/auth0/auth0-deploy-cli/issues/1438
-[Unreleased]: https://github.com/auth0/auth0-deploy-cli/compare/v8.42.0...HEAD
-[8.42.0]: https://github.com/auth0/auth0-deploy-cli/compare/v8.41.0...v8.42.0
-[8.41.0]: https://github.com/auth0/auth0-deploy-cli/compare/v8.40.0...v8.41.0
-[8.40.0]: https://github.com/auth0/auth0-deploy-cli/compare/v8.39.0...v8.40.0
+[#1418]: https://github.com/auth0/auth0-deploy-cli/issues/1418
+[#1448]: https://github.com/auth0/auth0-deploy-cli/issues/1448
+[Unreleased]: https://github.com/auth0/auth0-deploy-cli/compare/v9.0.0-beta.2...HEAD
+[9.0.0-beta.2]: https://github.com/auth0/auth0-deploy-cli/compare/v9.0.0-beta.1...v9.0.0-beta.2
+[9.0.0-beta.1]: https://github.com/auth0/auth0-deploy-cli/compare/v8.39.0...v9.0.0-beta.1
 [8.39.0]: https://github.com/auth0/auth0-deploy-cli/compare/v8.38.0...v8.39.0
 [8.38.0]: https://github.com/auth0/auth0-deploy-cli/compare/v8.37.0...v8.38.0
 [8.37.0]: https://github.com/auth0/auth0-deploy-cli/compare/v8.36.0...v8.37.0

package/lib/context/directory/handlers/actionModules.js

@@ -20,20 +20,18 @@ function parse(context) {
                 disableKeywordReplacement: context.disableKeywordReplacement,
             }),
         };
-        const moduleFolder = path_1.default.join(tools_1.constants.ACTION_MODULES_DIRECTORY, `${module.name}`);
         if (module.code) {
-            // The `module.code` can be a file path. It needs to be loaded.
-            // It can be a relative path, so we need to handle both cases.
-            const unixPath = module.code.replace(/[\\/]+/g, '/').replace(/^([a-zA-Z]+:|\.\/)/, '');
-            if (fs_extra_1.default.existsSync(unixPath)) {
-                logger_1.default.warn(`Support for absolute paths and paths outside the config root will be deprecated in a future version to improve the security of the tool. ` +
-                    `Please update your configuration to use paths relative to the config directory. ` +
-                    `Current absolute path used: ["${module.code}"]`);
-                module.code = context.loadFile(unixPath, moduleFolder);
-            }
-            else {
-                module.code = context.loadFile(path_1.default.join(context.filePath, module.code), moduleFolder);
+            const normalizedCode = module.code.replace(/\\/g, '/');
+            const configRoot = path_1.default.resolve(context.filePath);
+            const resolvedPath = path_1.default.resolve(context.filePath, normalizedCode);
+            if (!resolvedPath.startsWith(configRoot + path_1.default.sep)) {
+                throw new Error(`Path "${module.code}" resolves to "${resolvedPath}" which is outside the config directory "${configRoot}". ` +
+                    `Move the file inside your config directory.`);
             }
+            module.code = (0, tools_1.loadFileAndReplaceKeywords)(resolvedPath, {
+                mappings: context.mappings,
+                disableKeywordReplacement: context.disableKeywordReplacement,
+            });
         }
         return module;
     });

package/lib/context/directory/handlers/actions.js

@@ -22,21 +22,18 @@ function parse(context) {
                 disableKeywordReplacement: context.disableKeywordReplacement,
             }),
         };
-        const actionFolder = path_1.default.join(tools_1.constants.ACTIONS_DIRECTORY, `${action.name}`);
         if (action.code) {
-            // Convert `action.code` path to Unix-style path by replacing backslashes and multiple slashes with a single forward slash, and remove leading drive letters or './'.
-            const unixPath = action.code.replace(/[\\/]+/g, '/').replace(/^([a-zA-Z]+:|\.\/)/, '');
-            if (fs_extra_1.default.existsSync(unixPath)) {
-                // If the Unix-style path exists, load the file from that path
-                logger_1.default.warn(`Support for absolute paths and paths outside the config root will be deprecated in a future version to improve the security of the tool. ` +
-                    `Please update your configuration to use paths relative to the config directory. ` +
-                    `Current absolute path used: ["${action.code}"]`);
-                action.code = context.loadFile(unixPath, actionFolder);
-            }
-            else {
-                // Otherwise, load the file from the context's file path
-                action.code = context.loadFile(path_1.default.join(context.filePath, action.code), actionFolder);
+            const normalizedCode = action.code.replace(/\\/g, '/');
+            const configRoot = path_1.default.resolve(context.filePath);
+            const resolvedPath = path_1.default.resolve(context.filePath, normalizedCode);
+            if (!resolvedPath.startsWith(configRoot + path_1.default.sep)) {
+                throw new Error(`Path "${action.code}" resolves to "${resolvedPath}" which is outside the config directory "${configRoot}". ` +
+                    `Move the file inside your config directory.`);
             }
+            action.code = (0, tools_1.loadFileAndReplaceKeywords)(resolvedPath, {
+                mappings: context.mappings,
+                disableKeywordReplacement: context.disableKeywordReplacement,
+            });
         }
         return action;
     });

package/lib/context/directory/handlers/clients.js

@@ -106,21 +106,6 @@ async function dump(context) {
                 organization_require_behavior: client.organization_require_behavior,
             };
         }
-        else {
-            // strip id-only credentials and remove client_authentication_methods entirely
-            // if no named credentials remain — an absent field is treated as deletion on deploy
-            if (client.client_authentication_methods) {
-                Object.values(client.client_authentication_methods).forEach((method) => {
-                    if (method?.credentials) {
-                        method.credentials = method.credentials.filter((c) => c.name);
-                    }
-                });
-                const hasAnyCredentials = Object.values(client.client_authentication_methods).some((method) => method?.credentials?.length > 0);
-                if (!hasAnyCredentials) {
-                    delete client.client_authentication_methods;
-                }
-            }
-        }
         (0, utils_1.dumpJSON)(clientFile, (0, utils_1.clearClientArrays)(client));
     });
 }

package/lib/context/directory/handlers/databases.js

@@ -41,11 +41,10 @@ function getDatabase(folder, configRoot, mappingOpts) {
             }
             else {
                 const resolvedBase = path_1.default.resolve(configRoot);
-                const toLoad = path_1.default.resolve(folder, script);
+                const toLoad = path_1.default.resolve(folder, script.replace(/\\/g, '/'));
                 if (!toLoad.startsWith(resolvedBase + path_1.default.sep)) {
-                    logger_1.default.warn(`Support for absolute paths and paths outside the config root will be deprecated in a future version to improve the security of the tool. ` +
-                        `Please update your configuration to use paths relative to the config directory. ` +
-                        `Current absolute path used: ["${script}"]`);
+                    throw new Error(`Path "${script}" resolves to "${toLoad}" which is outside the config directory "${resolvedBase}". ` +
+                        `Move the file inside your config directory.`);
                 }
                 database.options.customScripts[name] = (0, tools_1.loadFileAndReplaceKeywords)(toLoad, mappingOpts);
             }

package/lib/context/directory/handlers/hooks.js

@@ -21,7 +21,17 @@ function parse(context) {
             }),
         };
         if (hook.script) {
-            hook.script = context.loadFile(hook.script, tools_1.constants.HOOKS_DIRECTORY);
+            const normalizedScript = hook.script.replace(/\\/g, '/');
+            const configRoot = path_1.default.resolve(context.filePath);
+            const resolvedPath = path_1.default.resolve(context.filePath, tools_1.constants.HOOKS_DIRECTORY, normalizedScript);
+            if (!resolvedPath.startsWith(configRoot + path_1.default.sep)) {
+                throw new Error(`Path "${hook.script}" resolves to "${resolvedPath}" which is outside the config directory "${configRoot}". ` +
+                    `Move the file inside your config directory.`);
+            }
+            hook.script = (0, tools_1.loadFileAndReplaceKeywords)(resolvedPath, {
+                mappings: context.mappings,
+                disableKeywordReplacement: context.disableKeywordReplacement,
+            });
         }
         hook.name = hook.name.toLowerCase().replace(/\s/g, '-');
         return hook;

package/lib/context/directory/handlers/index.js

@@ -43,9 +43,7 @@ const userAttributeProfiles_1 = __importDefault(require("./userAttributeProfiles
 const connectionProfiles_1 = __importDefault(require("./connectionProfiles"));
 const tokenExchangeProfiles_1 = __importDefault(require("./tokenExchangeProfiles"));
 const supplementalSignals_1 = __importDefault(require("./supplementalSignals"));
-const rateLimitPolicies_1 = __importDefault(require("./rateLimitPolicies"));
 const eventStreams_1 = __importDefault(require("./eventStreams"));
-const clientAuthCredentials_1 = __importDefault(require("./clientAuthCredentials"));
 const selfServiceProfiles_1 = __importDefault(require("./selfServiceProfiles"));
 const directoryHandlers = {
     rules: rules_1.default,
@@ -89,8 +87,6 @@ const directoryHandlers = {
     connectionProfiles: connectionProfiles_1.default,
     tokenExchangeProfiles: tokenExchangeProfiles_1.default,
     supplementalSignals: supplementalSignals_1.default,
-    rateLimitPolicies: rateLimitPolicies_1.default,
     eventStreams: eventStreams_1.default,
-    clientAuthCredentials: clientAuthCredentials_1.default,
 };
 exports.default = directoryHandlers;

package/lib/context/directory/handlers/rules.js

@@ -21,7 +21,17 @@ function parse(context) {
             }),
         };
         if (rule.script) {
-            rule.script = context.loadFile(rule.script, tools_1.constants.RULES_DIRECTORY);
+            const normalizedScript = rule.script.replace(/\\/g, '/');
+            const configRoot = path_1.default.resolve(context.filePath);
+            const resolvedPath = path_1.default.resolve(context.filePath, tools_1.constants.RULES_DIRECTORY, normalizedScript);
+            if (!resolvedPath.startsWith(configRoot + path_1.default.sep)) {
+                throw new Error(`Path "${rule.script}" resolves to "${resolvedPath}" which is outside the config directory "${configRoot}". ` +
+                    `Move the file inside your config directory.`);
+            }
+            rule.script = (0, tools_1.loadFileAndReplaceKeywords)(resolvedPath, {
+                mappings: context.mappings,
+                disableKeywordReplacement: context.disableKeywordReplacement,
+            });
         }
         return rule;
     });

package/lib/context/directory/index.js

@@ -68,14 +68,12 @@ class DirectoryContext {
         };
     }
     loadFile(f, folder) {
-        const basePath = path.join(this.filePath, folder);
-        let toLoad = path.join(basePath, f);
-        if (!(0, utils_1.isFile)(toLoad)) {
-            // try load not relative to yaml file
-            toLoad = f;
-            logger_1.default.warn(`Support for absolute paths and paths outside the config root will be deprecated in a future version to improve the security of the tool. ` +
-                `Please update your configuration to use paths relative to the config directory. ` +
-                `Current absolute path used: ["${f}"]`);
+        const configRoot = path.resolve(this.filePath);
+        const basePath = path.resolve(this.filePath, folder);
+        const toLoad = path.resolve(basePath, f.replace(/\\/g, '/'));
+        if (!toLoad.startsWith(configRoot + path.sep)) {
+            throw new Error(`Path "${f}" resolves to "${toLoad}" which is outside the config directory "${configRoot}". ` +
+                `Move the file inside your config directory.`);
         }
         return (0, tools_1.loadFileAndReplaceKeywords)(toLoad, {
             mappings: this.mappings,

package/lib/context/yaml/handlers/clients.js

@@ -99,21 +99,6 @@ async function dump(context) {
                         organization_require_behavior: client.organization_require_behavior,
                     };
                 }
-                else {
-                    // strip id-only credentials and remove client_authentication_methods entirely
-                    // if no named credentials remain — an absent field is treated as deletion on deploy
-                    if (client.client_authentication_methods) {
-                        Object.values(client.client_authentication_methods).forEach((method) => {
-                            if (method?.credentials) {
-                                method.credentials = method.credentials.filter((c) => c.name);
-                            }
-                        });
-                        const hasAnyCredentials = Object.values(client.client_authentication_methods).some((method) => method?.credentials?.length > 0);
-                        if (!hasAnyCredentials) {
-                            delete client.client_authentication_methods;
-                        }
-                    }
-                }
                 return (0, utils_1.clearClientArrays)(client);
             }),
         ],

package/lib/context/yaml/handlers/index.js

@@ -43,9 +43,7 @@ const userAttributeProfiles_1 = __importDefault(require("./userAttributeProfiles
 const connectionProfiles_1 = __importDefault(require("./connectionProfiles"));
 const tokenExchangeProfiles_1 = __importDefault(require("./tokenExchangeProfiles"));
 const supplementalSignals_1 = __importDefault(require("./supplementalSignals"));
-const rateLimitPolicies_1 = __importDefault(require("./rateLimitPolicies"));
 const eventStreams_1 = __importDefault(require("./eventStreams"));
-const clientAuthCredentials_1 = __importDefault(require("./clientAuthCredentials"));
 const selfServiceProfiles_1 = __importDefault(require("./selfServiceProfiles"));
 const yamlHandlers = {
     rules: rules_1.default,
@@ -89,8 +87,6 @@ const yamlHandlers = {
     connectionProfiles: connectionProfiles_1.default,
     tokenExchangeProfiles: tokenExchangeProfiles_1.default,
     supplementalSignals: supplementalSignals_1.default,
-    rateLimitPolicies: rateLimitPolicies_1.default,
     eventStreams: eventStreams_1.default,
-    clientAuthCredentials: clientAuthCredentials_1.default,
 };
 exports.default = yamlHandlers;

package/lib/context/yaml/index.js

@@ -43,15 +43,13 @@ class YAMLContext {
         })();
     }
     loadFile(f) {
-        let toLoad = path_1.default.join(this.basePath, f);
-        if (!(0, utils_1.isFile)(toLoad)) {
-            // try load not relative to yaml file
-            toLoad = f;
-            logger_1.default.warn(`Support for absolute paths and paths outside the config root will be deprecated in a future version to improve the security of the tool. ` +
-                `Please update your configuration to use paths relative to the config directory. ` +
-                `Current absolute path used: ["${f}"]`);
+        const configRoot = path_1.default.resolve(this.basePath);
+        const toLoad = path_1.default.resolve(this.basePath, f.replace(/\\/g, '/'));
+        if (!toLoad.startsWith(configRoot + path_1.default.sep)) {
+            throw new Error(`Path "${f}" resolves to "${toLoad}" which is outside the config directory "${configRoot}". ` +
+                `Move the file inside your config directory.`);
         }
-        return (0, tools_1.loadFileAndReplaceKeywords)(path_1.default.resolve(toLoad), {
+        return (0, tools_1.loadFileAndReplaceKeywords)(toLoad, {
             mappings: this.mappings,
             disableKeywordReplacement: this.disableKeywordReplacement,
         });

package/lib/tools/auth0/handlers/attackProtection.js

@@ -243,25 +243,14 @@ class AttackProtectionHandler extends default_1.default {
         let botDetection = null;
         let captcha = null;
         try {
-            botDetection = await this.client.attackProtection.botDetection.get();
+            [botDetection, captcha] = await Promise.all([
+                this.client.attackProtection.botDetection.get(),
+                this.client.attackProtection.captcha.get(),
+            ]);
         }
         catch (err) {
             if (err.statusCode === 403) {
-                logger_1.default.warn("Bot detection is not available on this tenant's current plan. Skipping bot detection settings.");
-            }
-            else {
-                throw err;
-            }
-        }
-        try {
-            captcha = await this.client.attackProtection.captcha.get();
-        }
-        catch (err) {
-            if (err.statusCode === 403) {
-                logger_1.default.warn("Captcha is not available on this tenant's current plan. Skipping captcha settings.");
-            }
-            else {
-                throw err;
+                logger_1.default.warn('Bot Detection API are not enabled for this tenant. Please verify `scope` or contact Auth0 support to enable this feature.');
             }
         }
         const attackProtection = {

package/lib/tools/auth0/handlers/clientGrants.d.ts

@@ -22,7 +22,7 @@ export declare const schema: {
             };
             subject_type: {
                 type: string;
-                enum: ("client" | "user" | "anonymous_user")[];
+                enum: ("client" | "user")[];
                 description: string;
             };
             authorization_details_types: {

package/lib/tools/auth0/handlers/clients.d.ts

@@ -193,18 +193,6 @@ export declare const schema: {
                 };
                 additionalProperties: boolean;
             };
-            identity_assertion_authorization_grant: {
-                type: string;
-                description: string;
-                properties: {
-                    active: {
-                        type: string;
-                        description: string;
-                    };
-                };
-                required: string[];
-                additionalProperties: boolean;
-            };
             app_type: {
                 type: string;
                 description: string;
@@ -340,40 +328,6 @@ export declare const schema: {
                     };
                 };
             };
-            token_vault_privileged_access: {
-                type: string[];
-                description: string;
-                properties: {
-                    ip_allowlist: {
-                        type: string;
-                        description: string;
-                        items: {
-                            type: string;
-                        };
-                    };
-                    grants: {
-                        type: string;
-                        description: string;
-                        items: {
-                            type: string;
-                            properties: {
-                                connection: {
-                                    type: string;
-                                    description: string;
-                                };
-                                scopes: {
-                                    type: string;
-                                    description: string;
-                                    items: {
-                                        type: string;
-                                    };
-                                };
-                            };
-                            required: string[];
-                        };
-                    };
-                };
-            };
             third_party_security_mode: {
                 type: string;
                 enum: string[];

package/lib/tools/auth0/handlers/clients.js

@@ -66,40 +66,6 @@ const myOrganizationConfigurationSchema = {
     },
     required: ['allowed_strategies', 'connection_deletion_behavior'],
 };
-const tokenVaultPrivilegedAccessSchema = {
-    type: ['object', 'null'],
-    description: 'Settings for Token Vault Privileged Access, hardening a privileged client by restricting the caller IPs, connections, and scopes it may use at runtime. Early Access, gated by the token_vault_subject_type_jwt_ea_rollout feature flag. Export-only: this object is exported for visibility but is not deployed by the Deploy CLI (it is stripped from create/update payloads because the required credentials are tenant-specific ids). Manage it directly on the tenant.',
-    properties: {
-        ip_allowlist: {
-            type: 'array',
-            description: 'IPv4/IPv6 addresses or CIDR ranges permitted to call token exchange on behalf of this privileged client. When the EA flag is on, this is required (non-empty) on create if token_vault_privileged_access is being set.',
-            items: {
-                type: 'string',
-            },
-        },
-        grants: {
-            type: 'array',
-            description: 'Connection/scope pin objects restricting which federated connections and OAuth scopes the privileged client may use at runtime. Maximum 5 connections; maximum 20 scopes in total across all connections.',
-            items: {
-                type: 'object',
-                properties: {
-                    connection: {
-                        type: 'string',
-                        description: 'The connection name (e.g. google-oauth2). Validated at runtime; the connection need not exist at configuration time.',
-                    },
-                    scopes: {
-                        type: 'array',
-                        description: 'The OAuth scopes permitted for that connection.',
-                        items: {
-                            type: 'string',
-                        },
-                    },
-                },
-                required: ['connection', 'scopes'],
-            },
-        },
-    },
-};
 exports.schema = {
     type: 'array',
     items: {
@@ -255,18 +221,6 @@ exports.schema = {
                 },
                 additionalProperties: true,
             },
-            identity_assertion_authorization_grant: {
-                type: 'object',
-                description: 'Settings for Cross App Access (ID-JAG) token exchange. Early Access. Enables the client to request identity assertion authorization grants.',
-                properties: {
-                    active: {
-                        type: 'boolean',
-                        description: 'Indicates whether the client can request an identity assertion authorization grant (ID-JAG) via token exchange.',
-                    },
-                },
-                required: ['active'],
-                additionalProperties: false,
-            },
             app_type: {
                 type: 'string',
                 description: 'The type of application this client represents',
@@ -378,7 +332,6 @@ exports.schema = {
                     },
                 },
             },
-            token_vault_privileged_access: tokenVaultPrivilegedAccessSchema,
             third_party_security_mode: {
                 type: 'string',
                 enum: ['strict', 'permissive'],
@@ -507,40 +460,6 @@ const createClientSanitizer = (clients) => {
         },
     };
 };
-/**
- * On export, remove `credentials` from `token_vault_privileged_access`.
- *
- * Auth0 returns these as tenant-specific credential references (`{ id }`) — never
- * names or key material — so they are not portable across tenants and must never be
- * written to disk. `ip_allowlist` and `grants` are kept for visibility. Mutates and
- * returns the same client.
- */
-const stripTokenVaultCredentialsOnExport = (client) => {
-    const tvpa = client
-        .token_vault_privileged_access;
-    if (tvpa && 'credentials' in tvpa) {
-        delete tvpa.credentials;
-    }
-    return client;
-};
-/**
- * On write (create/update), remove the entire `token_vault_privileged_access` object.
- *
- * The Management API requires `credentials` whenever `token_vault_privileged_access`
- * is present in the payload, but those credentials are tenant-specific ids that the
- * Deploy CLI intentionally never persists (see stripTokenVaultCredentialsOnExport).
- * Sending the object without `credentials` fails validation ("Missing required
- * property: credentials"); sending it with exported ids would re-send stale ids on a
- * cross-tenant deploy. The Deploy CLI therefore does not manage this field — it is
- * export-only. Manage `token_vault_privileged_access` directly on the tenant.
- * Mutates and returns the same client.
- */
-const stripTokenVaultPrivilegedAccessOnWrite = (client) => {
-    if ('token_vault_privileged_access' in client) {
-        delete client.token_vault_privileged_access;
-    }
-    return client;
-};
 class ClientHandler extends default_1.default {
     constructor(config) {
         super({
@@ -647,21 +566,6 @@ class ClientHandler extends default_1.default {
                         delete item.refresh_token;
                     }
                 }
-                // Strip client_authentication_methods — the clientAuthCredentials handler (order 70)
-                // owns this field entirely. Auth0 rejects credential objects with name/credential_type in PATCH.
-                // Strip token_endpoint_auth_method only when client_authentication_methods is present in config:
-                // Auth0 rejects it in PATCH while a client has active credentials. For these clients the
-                // clientAuthCredentials handler (order 70) owns token_endpoint_auth_method too.
-                // For clients without client_authentication_methods, credentials were already cleared by
-                // clientAuthCredentialsPre (order 40), so token_endpoint_auth_method passes through safely.
-                if (item.client_authentication_methods) {
-                    delete item.token_endpoint_auth_method;
-                }
-                delete item.client_authentication_methods;
-                // token_vault_privileged_access requires tenant-specific credential ids that
-                // the Deploy CLI never persists. Strip the whole object on write so we neither
-                // re-send stale ids nor fail validation for the missing credentials property.
-                stripTokenVaultPrivilegedAccessOnWrite(item);
                 return item;
             });
         };
@@ -683,38 +587,7 @@ class ClientHandler extends default_1.default {
             is_global: false,
             ...((0, utils_1.shouldExcludeThirdPartyClients)(this.config) && { is_first_party: true }),
         });
-        const sanitized = createClientSanitizer(clients)
-            .sanitizeCrossOriginAuth(false)
-            .get()
-            // token_vault_privileged_access.credentials are returned as tenant-specific
-            // ids — strip them so they are never exported to disk.
-            .map(stripTokenVaultCredentialsOnExport);
-        // Enrich credential stubs with name and credential_type for export.
-        // Auth0 does not return pem on read — it is never exported.
-        await Promise.all(sanitized.map(async (client) => {
-            if (!client.client_authentication_methods)
-                return;
-            try {
-                const creds = await this.client.clients.credentials.list(client.client_id);
-                const credMap = new Map(creds.map((c) => [c.id, c]));
-                Object.values(client.client_authentication_methods).forEach((method) => {
-                    if (method?.credentials) {
-                        method.credentials = method.credentials
-                            .map((stub) => {
-                            const full = credMap.get(stub.id);
-                            if (!full?.name)
-                                return null;
-                            return { name: full.name, credential_type: full.credential_type };
-                        })
-                            .filter(Boolean);
-                    }
-                });
-            }
-            catch (_) {
-                // leave stubs as-is if the credentials API call fails
-            }
-        }));
-        this.existing = sanitized;
+        this.existing = createClientSanitizer(clients).sanitizeCrossOriginAuth(false).get();
         return this.existing;
     }
     isCimdClient(client) {

package/lib/tools/auth0/handlers/connections.d.ts

@@ -103,27 +103,6 @@ export declare const schema: {
                 required: string[];
                 additionalProperties: boolean;
             };
-            cross_app_access_requesting_app: {
-                type: string;
-                properties: {
-                    active: {
-                        type: string;
-                    };
-                };
-                required: string[];
-                additionalProperties: boolean;
-            };
-            cross_app_access_resource_app: {
-                type: string;
-                properties: {
-                    status: {
-                        type: string;
-                        enum: string[];
-                    };
-                };
-                required: string[];
-                additionalProperties: boolean;
-            };
             directory_provisioning_configuration: {
                 type: string;
                 properties: {