auth0-deploy-cli 8.42.0 → 9.0.0-beta.2

package/lib/tools/utils.js

@@ -36,7 +36,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.shouldExcludeThirdPartyClients = exports.isForbiddenFeatureError = exports.isDeprecatedError = exports.detectInsufficientScopeError = exports.stripUnresolvedPlaceholders = exports.stripObfuscatedFieldsFromPayload = exports.validateNoUnresolvedPlaceholders = exports.obfuscateSensitiveValues = exports.keywordReplaceStringRegExp = exports.keywordReplaceArrayRegExp = void 0;
+exports.shouldExcludeThirdPartyClients = exports.isForbiddenFeatureError = exports.isDeprecatedError = exports.detectInsufficientScopeError = exports.stripObfuscatedFieldsFromPayload = exports.validateNoUnresolvedPlaceholders = exports.obfuscateSensitiveValues = exports.keywordReplaceStringRegExp = exports.keywordReplaceArrayRegExp = void 0;
 exports.keywordArrayReplace = keywordArrayReplace;
 exports.keywordStringReplace = keywordStringReplace;
 exports.keywordReplace = keywordReplace;
@@ -309,24 +309,6 @@ const stripObfuscatedFieldsFromPayload = (data, obfuscatedFields) => {
     return newAsset;
 };
 exports.stripObfuscatedFieldsFromPayload = stripObfuscatedFieldsFromPayload;
-// Strips unresolved ##...## / @@...@@ placeholders before sending to Auth0.
-// Keyword replacement runs first; any remaining placeholder means no mapping was
-// provided. The field is dropped so Auth0 preserves its existing value.
-const stripUnresolvedPlaceholders = (data, resourceType, resourceName) => {
-    if (data === null)
-        return data;
-    const unresolved = collectUnresolvedPlaceholders(data);
-    if (unresolved.length === 0)
-        return data;
-    const newAsset = { ...data };
-    unresolved.forEach(({ path, value }) => {
-        logger_1.default.warn(`Stripping unresolved placeholder for ${resourceType} "${resourceName}" field "${path}": ${value}. ` +
-            `To use this value, define ${value.replace(/^##|##$|^@@|@@$/g, '')} in AUTH0_KEYWORD_REPLACE_MAPPINGS. The existing value on Auth0 will be preserved.`);
-        dot_prop_1.default.delete(newAsset, path);
-    });
-    return newAsset;
-};
-exports.stripUnresolvedPlaceholders = stripUnresolvedPlaceholders;
 const detectInsufficientScopeError = async (fn) => {
     try {
         const data = await fn();
@@ -360,12 +342,7 @@ const isDeprecatedError = (err) => {
 exports.isDeprecatedError = isDeprecatedError;
 const isForbiddenFeatureError = (err, type) => {
     if (err.statusCode === 403) {
-        // The SDK error's top-level `message` is the full serialized response body; the clean,
-        // human-readable message and errorCode live on the response body itself.
-        const body = err.originalError?.response?.body ?? {};
-        const message = body.message ?? err.message;
-        const errorCode = body.errorCode ?? err.errorCode ?? '';
-        logger_1.default.warn(`${message}${errorCode ? ` (${errorCode})` : ''} - Skipping ${type}`);
+        logger_1.default.warn(`${err.message};${err.errorCode ?? ''} - Skipping ${type}`);
         return true;
     }
     return false;

package/lib/types.d.ts

@@ -21,7 +21,6 @@ import { AttackProtection } from './tools/auth0/handlers/attackProtection';
 import { TokenExchangeProfile } from './tools/auth0/handlers/tokenExchangeProfiles';
 import { RiskAssessment } from './tools/auth0/handlers/riskAssessment';
 import { SupplementalSignals } from './tools/auth0/handlers/supplementalSignals';
-import { RateLimitPolicy } from './tools/auth0/handlers/rateLimitPolicies';
 import { EventStream } from './tools/auth0/handlers/eventStreams';
 type SharedPaginationParams = {
     checkpoint?: boolean;
@@ -160,7 +159,6 @@ export type Assets = Partial<{
     userAttributeProfilesWithId: UserAttributeProfile[] | null;
     connectionProfiles: Asset[] | null;
     tokenExchangeProfiles: TokenExchangeProfile[] | null;
-    rateLimitPolicies: RateLimitPolicy[] | null;
     eventStreams: EventStream[] | null;
 }>;
 export type CalculatedChanges = {
@@ -182,7 +180,7 @@ export type DetailedDryRunChanges = {
         changes: DetailedDryRunChange[];
     };
 };
-export type AssetTypes = 'rules' | 'rulesConfigs' | 'hooks' | 'pages' | 'databases' | 'clientGrants' | 'resourceServers' | 'clients' | 'connections' | 'tenant' | 'emailProvider' | 'emailTemplates' | 'guardianFactors' | 'guardianFactorProviders' | 'guardianFactorTemplates' | 'guardianPhoneFactorMessageTypes' | 'guardianPhoneFactorSelectedProvider' | 'guardianPolicies' | 'roles' | 'actions' | 'actionModules' | 'organizations' | 'triggers' | 'attackProtection' | 'riskAssessment' | 'branding' | 'phoneProviders' | 'phoneTemplates' | 'logStreams' | 'prompts' | 'customDomains' | 'themes' | 'forms' | 'flows' | 'flowVaultConnections' | 'selfServiceProfiles' | 'networkACLs' | 'userAttributeProfiles' | 'connectionProfiles' | 'tokenExchangeProfiles' | 'supplementalSignals' | 'rateLimitPolicies' | 'eventStreams' | 'clientAuthCredentials';
+export type AssetTypes = 'rules' | 'rulesConfigs' | 'hooks' | 'pages' | 'databases' | 'clientGrants' | 'resourceServers' | 'clients' | 'connections' | 'tenant' | 'emailProvider' | 'emailTemplates' | 'guardianFactors' | 'guardianFactorProviders' | 'guardianFactorTemplates' | 'guardianPhoneFactorMessageTypes' | 'guardianPhoneFactorSelectedProvider' | 'guardianPolicies' | 'roles' | 'actions' | 'actionModules' | 'organizations' | 'triggers' | 'attackProtection' | 'riskAssessment' | 'branding' | 'phoneProviders' | 'phoneTemplates' | 'logStreams' | 'prompts' | 'customDomains' | 'themes' | 'forms' | 'flows' | 'flowVaultConnections' | 'selfServiceProfiles' | 'networkACLs' | 'userAttributeProfiles' | 'connectionProfiles' | 'tokenExchangeProfiles' | 'supplementalSignals' | 'eventStreams';
 export type KeywordMappings = {
     [key: string]: (string | number)[] | string | number;
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "auth0-deploy-cli",
-  "version": "8.42.0",
+  "version": "9.0.0-beta.2",
   "description": "A command line tool for deploying updates to your Auth0 tenant",
   "main": "lib/index.js",
   "bin": {
@@ -35,7 +35,7 @@
   "dependencies": {
     "@clack/prompts": "1.4.0",
     "ajv": "^6.12.6",
-    "auth0": "^6.1.0",
+    "auth0": "^5.13.0",
     "chalk": "5.6.2",
     "dot-prop": "^5.3.0",
     "fs-extra": "^10.1.0",

package/lib/context/directory/handlers/clientAuthCredentials.d.ts

@@ -1,5 +0,0 @@
-import { DirectoryHandler } from '.';
-import { ParsedAsset } from '../../../types';
-type ParsedClientAuthCredentials = ParsedAsset<'clientAuthCredentials', null>;
-declare const clientAuthCredentialsHandler: DirectoryHandler<ParsedClientAuthCredentials>;
-export default clientAuthCredentialsHandler;

package/lib/context/directory/handlers/clientAuthCredentials.js

@@ -1,13 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-function parse(_context) {
-    return { clientAuthCredentials: null };
-}
-async function dump(_context) {
-    // Credentials are embedded inside each client's JSON file — nothing to dump separately.
-}
-const clientAuthCredentialsHandler = {
-    parse,
-    dump,
-};
-exports.default = clientAuthCredentialsHandler;

package/lib/context/directory/handlers/rateLimitPolicies.d.ts

@@ -1,6 +0,0 @@
-import { DirectoryHandler } from '.';
-import { ParsedAsset } from '../../../types';
-import { RateLimitPolicy } from '../../../tools/auth0/handlers/rateLimitPolicies';
-type ParsedRateLimitPolicies = ParsedAsset<'rateLimitPolicies', RateLimitPolicy[]>;
-declare const rateLimitPoliciesHandler: DirectoryHandler<ParsedRateLimitPolicies>;
-export default rateLimitPoliciesHandler;

package/lib/context/directory/handlers/rateLimitPolicies.js

@@ -1,53 +0,0 @@
-"use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-const path_1 = __importDefault(require("path"));
-const fs_extra_1 = __importDefault(require("fs-extra"));
-const tools_1 = require("../../../tools");
-const utils_1 = require("../../../utils");
-function parse(context) {
-    const rateLimitPoliciesDirectory = path_1.default.join(context.filePath, tools_1.constants.RATE_LIMIT_POLICIES_DIRECTORY);
-    if (!(0, utils_1.existsMustBeDir)(rateLimitPoliciesDirectory))
-        return { rateLimitPolicies: null }; // Skip
-    const foundFiles = (0, utils_1.getFiles)(rateLimitPoliciesDirectory, ['.json']);
-    const rateLimitPolicies = foundFiles
-        .map((f) => (0, utils_1.loadJSON)(f, {
-        mappings: context.mappings,
-        disableKeywordReplacement: context.disableKeywordReplacement,
-    }))
-        .filter((p) => Object.keys(p).length > 0);
-    return { rateLimitPolicies };
-}
-async function dump(context) {
-    const { rateLimitPolicies } = context.assets;
-    if (!rateLimitPolicies)
-        return; // Skip, nothing to dump
-    const rateLimitPoliciesDirectory = path_1.default.join(context.filePath, tools_1.constants.RATE_LIMIT_POLICIES_DIRECTORY);
-    fs_extra_1.default.ensureDirSync(rateLimitPoliciesDirectory);
-    const removeKeysFromOutput = ['id', 'created_at', 'updated_at'];
-    const expectedFiles = new Set();
-    rateLimitPolicies.forEach((policy) => {
-        const policyToWrite = { ...policy };
-        removeKeysFromOutput.forEach((key) => {
-            delete policyToWrite[key];
-        });
-        const fileName = (0, utils_1.sanitize)(policy.consumer_selector);
-        const filePath = path_1.default.join(rateLimitPoliciesDirectory, `${fileName}.json`);
-        expectedFiles.add(`${fileName}.json`);
-        (0, utils_1.dumpJSON)(filePath, policyToWrite);
-    });
-    // Remove files for policies that no longer exist in the tenant
-    for (const existing of fs_extra_1.default.readdirSync(rateLimitPoliciesDirectory)) {
-        const fullPath = path_1.default.join(rateLimitPoliciesDirectory, existing);
-        if (fs_extra_1.default.statSync(fullPath).isFile() && !expectedFiles.has(existing)) {
-            fs_extra_1.default.removeSync(fullPath);
-        }
-    }
-}
-const rateLimitPoliciesHandler = {
-    parse,
-    dump,
-};
-exports.default = rateLimitPoliciesHandler;

package/lib/context/yaml/handlers/clientAuthCredentials.d.ts

@@ -1,5 +0,0 @@
-import { YAMLHandler } from '.';
-import { ParsedAsset } from '../../../types';
-type ParsedClientAuthCredentials = ParsedAsset<'clientAuthCredentials', null>;
-declare const clientAuthCredentialsHandler: YAMLHandler<ParsedClientAuthCredentials>;
-export default clientAuthCredentialsHandler;

package/lib/context/yaml/handlers/clientAuthCredentials.js

@@ -1,13 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-async function parse(_context) {
-    return { clientAuthCredentials: null };
-}
-async function dump(_context) {
-    return { clientAuthCredentials: null };
-}
-const clientAuthCredentialsHandler = {
-    parse,
-    dump,
-};
-exports.default = clientAuthCredentialsHandler;

package/lib/context/yaml/handlers/rateLimitPolicies.d.ts

@@ -1,6 +0,0 @@
-import { YAMLHandler } from '.';
-import { ParsedAsset } from '../../../types';
-import { RateLimitPolicy } from '../../../tools/auth0/handlers/rateLimitPolicies';
-type ParsedRateLimitPolicies = ParsedAsset<'rateLimitPolicies', RateLimitPolicy[]>;
-declare const rateLimitPoliciesHandler: YAMLHandler<ParsedRateLimitPolicies>;
-export default rateLimitPoliciesHandler;

package/lib/context/yaml/handlers/rateLimitPolicies.js

@@ -1,27 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-async function parse(context) {
-    const { rateLimitPolicies } = context.assets;
-    if (!rateLimitPolicies)
-        return { rateLimitPolicies: null };
-    return { rateLimitPolicies };
-}
-async function dump(context) {
-    const { rateLimitPolicies } = context.assets;
-    if (!rateLimitPolicies)
-        return { rateLimitPolicies: null };
-    const removeKeysFromOutput = ['id', 'created_at', 'updated_at'];
-    const cleaned = rateLimitPolicies.map((policy) => {
-        const policyToWrite = { ...policy };
-        removeKeysFromOutput.forEach((key) => {
-            delete policyToWrite[key];
-        });
-        return policyToWrite;
-    });
-    return { rateLimitPolicies: cleaned };
-}
-const rateLimitPoliciesHandler = {
-    parse,
-    dump,
-};
-exports.default = rateLimitPoliciesHandler;

package/lib/tools/auth0/handlers/clientAuthCredentials.d.ts

@@ -1,27 +0,0 @@
-import { Assets, Auth0APIClient, CalculatedChanges } from '../../../types';
-import { ConfigFunction } from '../../../configFactory';
-export declare const schema: {
-    type: string;
-    items: {
-        type: string;
-    };
-};
-export default class ClientAuthCredentialsHandler {
-    client: Auth0APIClient;
-    config: ConfigFunction;
-    type: string;
-    existing: null;
-    constructor({ client, config }: {
-        client: Auth0APIClient;
-        config: ConfigFunction;
-    });
-    getType(): Promise<null>;
-    load(): Promise<{
-        [x: string]: null;
-    }>;
-    validate(): Promise<null>;
-    dryRunChanges(_assets: Assets): Promise<CalculatedChanges>;
-    processChanges(assets: Assets): Promise<void>;
-    private inferCredentialType;
-    private inferMethodFromType;
-}

package/lib/tools/auth0/handlers/clientAuthCredentials.js

@@ -1,223 +0,0 @@
-"use strict";
-var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-};
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.schema = void 0;
-const default_1 = require("./default");
-const client_1 = require("../client");
-const logger_1 = __importDefault(require("../../../logger"));
-exports.schema = {
-    type: 'array',
-    items: { type: 'object' },
-};
-const CREDENTIAL_TYPE_TO_METHOD = {
-    public_key: 'private_key_jwt',
-    x509_cert: 'self_signed_tls_client_auth',
-    cert_subject_dn: 'tls_client_auth',
-};
-class ClientAuthCredentialsHandler {
-    constructor({ client, config }) {
-        this.type = 'clientAuthCredentials';
-        this.existing = null;
-        this.client = client;
-        this.config = config;
-    }
-    async getType() {
-        return null;
-    }
-    async load() {
-        logger_1.default.info(`Retrieving ${this.type} data from Auth0`);
-        return { [this.type]: null };
-    }
-    async validate() {
-        return null;
-    }
-    // Credentials are per-client sub-resources with no top-level asset list, so they are not
-    // modeled in the dry-run diff. Return empty changes so the dry-run loop (which calls
-    // dryRunChanges on every handler) does not crash. Credential changes are still applied
-    // during a real import via processChanges.
-    async dryRunChanges(_assets) {
-        return { del: [], create: [], conflicts: [], update: [] };
-    }
-    async processChanges(assets) {
-        const { clients } = assets;
-        if (!clients)
-            return;
-        const allowDelete = this.config('AUTH0_ALLOW_DELETE') === true || this.config('AUTH0_ALLOW_DELETE') === 'true';
-        // Only process clients that have client_authentication_methods in config.
-        // Full deletion (absent field) is handled by ClientAuthCredentialsPreHandler at order 40,
-        // before clients.ts runs. This handler only manages create and partial delete.
-        const clientsWithCam = clients.filter((c) => c.client_authentication_methods !== undefined);
-        if (clientsWithCam.length === 0)
-            return;
-        // In directory mode client_id is stripped. Resolve names for PKI clients only.
-        const needsNameResolution = clientsWithCam.some((c) => !c.client_id);
-        let clientIdByName = new Map();
-        if (needsNameResolution) {
-            const existingClients = await (0, client_1.paginate)(this.client.clients.list, {
-                paginate: true,
-                is_global: false,
-            });
-            clientIdByName = new Map(existingClients.map((c) => [c.name, c.client_id]));
-        }
-        for (const client of clientsWithCam) {
-            const clientId = client.client_id || (client.name && clientIdByName.get(client.name));
-            if (!clientId)
-                continue;
-            client.client_id = clientId;
-            const clientName = client.name || clientId;
-            // Collect all desired credentials across all auth methods (only pem-bearing entries)
-            const desired = [];
-            if (client.client_authentication_methods) {
-                for (const [methodKey, methodVal] of Object.entries(client.client_authentication_methods)) {
-                    const credentials = methodVal?.credentials || [];
-                    for (const cred of credentials) {
-                        if (!cred.pem)
-                            continue;
-                        desired.push({
-                            name: cred.name,
-                            pem: cred.pem,
-                            credential_type: cred.credential_type || this.inferCredentialType(methodKey),
-                            method: methodKey,
-                        });
-                    }
-                }
-            }
-            // pem is the opt-in signal: present field with no pem = skip (safe export→deploy);
-            // absent field = fall through to delete path (intentional removal).
-            if (desired.length === 0 && client.client_authentication_methods)
-                continue;
-            let existing = [];
-            try {
-                existing = (await this.client.clients.credentials.list(clientId));
-            }
-            catch (err) {
-                logger_1.default.warn(`clientAuthCredentials: failed to list credentials for client "${clientName}": ${err}`);
-                continue;
-            }
-            // No credentials in Auth0 and none desired — nothing to do.
-            if (existing.length === 0 && desired.length === 0)
-                continue;
-            // Warn if duplicate names exist in Auth0 — we can't match safely
-            const existingNames = existing.map((c) => c.name);
-            const duplicateNames = existingNames.filter((n, i) => existingNames.indexOf(n) !== i);
-            if (duplicateNames.length > 0) {
-                logger_1.default.warn(`clientAuthCredentials: client "${clientName}" has duplicate credential names in Auth0 [${duplicateNames.join(', ')}] — skipping credential reconciliation for this client`);
-                continue;
-            }
-            const existingByName = new Map(existing.map((c) => [c.name, c]));
-            const desiredNames = new Set(desired.map((d) => d.name));
-            const toCreate = desired.filter((d) => !existingByName.has(d.name));
-            const toDelete = existing.filter((e) => !desiredNames.has(e.name));
-            // Creates first — Auth0 allows max 2 credentials; both must exist simultaneously during rotation
-            // Track name→id so we can correctly attribute each created credential to its method later.
-            const createdIdByName = new Map();
-            for (const cred of toCreate) {
-                try {
-                    const created = await this.client.clients.credentials.create(clientId, {
-                        name: cred.name,
-                        pem: cred.pem,
-                        credential_type: cred.credential_type,
-                    });
-                    logger_1.default.info(`clientAuthCredentials: created credential "${cred.name}" on client "${clientName}"`);
-                    createdIdByName.set(cred.name, created.id);
-                }
-                catch (err) {
-                    logger_1.default.warn(`clientAuthCredentials: failed to create credential "${cred.name}" on client "${clientName}": ${err}`);
-                }
-            }
-            // Re-wire client_authentication_methods with final IDs (kept + newly created).
-            // This must happen BEFORE deletes — Auth0 rejects deleting a credential that
-            // is still referenced in client_authentication_methods.
-            const keptIds = existing.filter((e) => desiredNames.has(e.name)).map((e) => e.id);
-            const createdIds = [...createdIdByName.values()];
-            const finalIds = [...keptIds, ...createdIds];
-            let updatedAuthMethods = null;
-            if (finalIds.length > 0) {
-                // Build method→ids map. For kept credentials use Auth0's stored type to infer method;
-                // for created credentials use the method from the user's config entry (by name).
-                const methodToIds = {};
-                for (const id of finalIds) {
-                    const fromExisting = existing.find((e) => e.id === id);
-                    const createdName = [...createdIdByName.entries()].find(([, cid]) => cid === id)?.[0];
-                    const fromDesired = createdName ? desired.find((d) => d.name === createdName) : undefined;
-                    const methodKey = (fromExisting && this.inferMethodFromType(fromExisting.credential_type)) ||
-                        (fromDesired && fromDesired.method) ||
-                        Object.keys(client.client_authentication_methods)[0];
-                    if (!methodToIds[methodKey])
-                        methodToIds[methodKey] = [];
-                    methodToIds[methodKey].push(id);
-                }
-                updatedAuthMethods = {};
-                for (const [methodKey, ids] of Object.entries(methodToIds)) {
-                    updatedAuthMethods[methodKey] = { credentials: ids.map((id) => ({ id })) };
-                }
-            }
-            // Always update client_authentication_methods before deletes:
-            // - When finalIds > 0: re-wire to the remaining credentials
-            // - When finalIds === 0 but toDelete > 0: set to null so Auth0 de-references them first
-            if (finalIds.length > 0 || toDelete.length > 0) {
-                try {
-                    const payload = {
-                        client_authentication_methods: updatedAuthMethods ?? null,
-                    };
-                    // Auth0 requires token_endpoint_auth_method: null when setting client_authentication_methods,
-                    // and a non-null value when clearing it.
-                    if (updatedAuthMethods) {
-                        payload.token_endpoint_auth_method = null;
-                    }
-                    else {
-                        payload.token_endpoint_auth_method =
-                            client.token_endpoint_auth_method || 'client_secret_post';
-                    }
-                    await this.client.clients.update(clientId, payload);
-                    logger_1.default.info(`clientAuthCredentials: updated client_authentication_methods on client "${clientName}"`);
-                }
-                catch (err) {
-                    logger_1.default.warn(`clientAuthCredentials: failed to update client_authentication_methods on client "${clientName}": ${err}`);
-                }
-            }
-            // Deletes last — after client_authentication_methods no longer references them
-            if (toDelete.length > 0) {
-                if (!allowDelete) {
-                    logger_1.default.warn(`clientAuthCredentials: the following credentials on client "${clientName}" would be deleted but AUTH0_ALLOW_DELETE is not set:\n${toDelete
-                        .map((c) => `  ${c.name} (${c.id})`)
-                        .join('\n')}`);
-                }
-                else {
-                    for (const cred of toDelete) {
-                        try {
-                            await this.client.clients.credentials.delete(clientId, cred.id);
-                            logger_1.default.info(`clientAuthCredentials: deleted credential "${cred.name}" on client "${clientName}"`);
-                        }
-                        catch (err) {
-                            logger_1.default.warn(`clientAuthCredentials: failed to delete credential "${cred.name}" on client "${clientName}": ${err}`);
-                        }
-                    }
-                }
-            }
-        }
-    }
-    inferCredentialType(methodKey) {
-        const map = {
-            private_key_jwt: 'public_key',
-            self_signed_tls_client_auth: 'x509_cert',
-            tls_client_auth: 'cert_subject_dn',
-        };
-        return map[methodKey] || 'public_key';
-    }
-    inferMethodFromType(credentialType) {
-        return CREDENTIAL_TYPE_TO_METHOD[credentialType] || 'private_key_jwt';
-    }
-}
-exports.default = ClientAuthCredentialsHandler;
-__decorate([
-    (0, default_1.order)('70')
-], ClientAuthCredentialsHandler.prototype, "processChanges", null);

package/lib/tools/auth0/handlers/clientAuthCredentialsPre.d.ts

@@ -1,38 +0,0 @@
-import { Assets, Auth0APIClient, CalculatedChanges } from '../../../types';
-import { ConfigFunction } from '../../../configFactory';
-export declare const schema: {
-    type: string;
-    items: {
-        type: string;
-    };
-};
-/**
- * Handles full credential deletion BEFORE clients.ts (order 50) patches the client.
- *
- * Auth0 rejects a client PATCH containing token_endpoint_auth_method while that client still
- * has active credentials. By running at order 40, this handler clears credentials (and
- * client_authentication_methods) for any client where the field is absent from config, so
- * that clients.ts can safely include token_endpoint_auth_method in its PATCH.
- *
- * Partial deletion (some credentials removed, others kept) is handled by
- * ClientAuthCredentialsHandler at order 70, because those clients still have
- * client_authentication_methods present in config and clients.ts strips token_endpoint_auth_method
- * for them anyway.
- */
-export default class ClientAuthCredentialsPreHandler {
-    client: Auth0APIClient;
-    config: ConfigFunction;
-    type: string;
-    existing: null;
-    constructor({ client, config }: {
-        client: Auth0APIClient;
-        config: ConfigFunction;
-    });
-    getType(): Promise<null>;
-    load(): Promise<{
-        [x: string]: null;
-    }>;
-    validate(): Promise<null>;
-    dryRunChanges(_assets: Assets): Promise<CalculatedChanges>;
-    processChanges(assets: Assets): Promise<void>;
-}

package/lib/tools/auth0/handlers/clientAuthCredentialsPre.js

@@ -1,123 +0,0 @@
-"use strict";
-var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
-    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
-    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
-    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
-    return c > 3 && r && Object.defineProperty(target, key, r), r;
-};
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.schema = void 0;
-const default_1 = require("./default");
-const client_1 = require("../client");
-const logger_1 = __importDefault(require("../../../logger"));
-exports.schema = {
-    type: 'array',
-    items: { type: 'object' },
-};
-/**
- * Handles full credential deletion BEFORE clients.ts (order 50) patches the client.
- *
- * Auth0 rejects a client PATCH containing token_endpoint_auth_method while that client still
- * has active credentials. By running at order 40, this handler clears credentials (and
- * client_authentication_methods) for any client where the field is absent from config, so
- * that clients.ts can safely include token_endpoint_auth_method in its PATCH.
- *
- * Partial deletion (some credentials removed, others kept) is handled by
- * ClientAuthCredentialsHandler at order 70, because those clients still have
- * client_authentication_methods present in config and clients.ts strips token_endpoint_auth_method
- * for them anyway.
- */
-class ClientAuthCredentialsPreHandler {
-    constructor({ client, config }) {
-        // Same type as ClientAuthCredentialsHandler so AUTH0_EXCLUDED / AUTH0_INCLUDED_ONLY
-        // applies to both handlers together without needing a separate AssetTypes entry.
-        this.type = 'clientAuthCredentials';
-        this.existing = null;
-        this.client = client;
-        this.config = config;
-    }
-    async getType() {
-        return null;
-    }
-    async load() {
-        return { [this.type]: null };
-    }
-    async validate() {
-        return null;
-    }
-    // Deploy-only pre-pass handler with no dry-run representation. Return empty changes so the
-    // dry-run loop (which calls dryRunChanges on every registered handler) does not crash.
-    async dryRunChanges(_assets) {
-        return { del: [], create: [], conflicts: [], update: [] };
-    }
-    async processChanges(assets) {
-        const { clients } = assets;
-        if (!clients)
-            return;
-        const allowDelete = this.config('AUTH0_ALLOW_DELETE') === true || this.config('AUTH0_ALLOW_DELETE') === 'true';
-        // When allowDelete is false no deletion will happen — skip entirely to avoid
-        // unnecessary GET /credentials calls for every client.
-        if (!allowDelete)
-            return;
-        // Only act on clients where client_authentication_methods is absent from config.
-        // Absent = intentional full deletion. Clients with the field present (including partial
-        // deletion) are fully handled by ClientAuthCredentialsHandler at order 70.
-        const deletionCandidates = clients.filter((c) => c.client_authentication_methods === undefined);
-        if (deletionCandidates.length === 0)
-            return;
-        // In directory mode client_id is stripped. Resolve names once for all candidates.
-        const needsNameResolution = deletionCandidates.some((c) => !c.client_id);
-        let clientIdByName = new Map();
-        if (needsNameResolution) {
-            const existingClients = await (0, client_1.paginate)(this.client.clients.list, {
-                paginate: true,
-                is_global: false,
-            });
-            clientIdByName = new Map(existingClients.map((c) => [c.name, c.client_id]));
-        }
-        for (const client of deletionCandidates) {
-            const clientId = client.client_id || (client.name && clientIdByName.get(client.name));
-            if (!clientId)
-                continue;
-            const clientName = client.name || clientId;
-            let existing = [];
-            try {
-                existing = (await this.client.clients.credentials.list(clientId));
-            }
-            catch (err) {
-                logger_1.default.warn(`clientAuthCredentials: failed to list credentials for client "${clientName}": ${err}`);
-                continue;
-            }
-            if (existing.length === 0)
-                continue;
-            // De-reference credentials from client_authentication_methods before deleting them —
-            // Auth0 rejects deleting a credential that is still referenced.
-            try {
-                await this.client.clients.update(clientId, {
-                    client_authentication_methods: null,
-                    token_endpoint_auth_method: client.token_endpoint_auth_method || 'client_secret_post',
-                });
-            }
-            catch (err) {
-                logger_1.default.warn(`clientAuthCredentials: failed to clear client_authentication_methods on client "${clientName}": ${err}`);
-                continue;
-            }
-            for (const cred of existing) {
-                try {
-                    await this.client.clients.credentials.delete(clientId, cred.id);
-                    logger_1.default.info(`clientAuthCredentials: deleted credential "${cred.name}" on client "${clientName}"`);
-                }
-                catch (err) {
-                    logger_1.default.warn(`clientAuthCredentials: failed to delete credential "${cred.name}" on client "${clientName}": ${err}`);
-                }
-            }
-        }
-    }
-}
-exports.default = ClientAuthCredentialsPreHandler;
-__decorate([
-    (0, default_1.order)('40')
-], ClientAuthCredentialsPreHandler.prototype, "processChanges", null);