auth0-deploy-cli 8.43.0 → 8.44.0

package/CHANGELOG.md

@@ -7,6 +7,24 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [8.44.0] - 2026-08-26
+
+### Added
+
+- Support `third_party_client_access` and `cross_app_access_resource_app` on clients and connections. [#1471]
+
+### Fixed
+
+- Warn on path traversal in file references and fix double-path resolution in YAML connections handler. [#1477]
+- Strip `form_submission_mode` and `form_submission_behavior` from `bruteForceProtection` on export and import. [#1476]
+- Include empty credentials for custom phone provider on import and export to prevent 400 errors. [#1474]
+- Preserve keyword placeholder strings for all email provider credentials. [#1470]
+- Preserve `idpinitiated.enabled:false` on SAML connection export instead of emitting `undefined_clientId`. [#1465]
+- Apply 429 backoff to organization connection writes to prevent rate-limit failures. [#1464]
+- Resolve dry-run reporting bugs across multiple asset types. [#1462]
+- Skip organization PATCH when no top-level properties have changed. [#1461]
+- Sort `attackProtection` arrays on export to prevent spurious diffs. [#1460]
+
 ## [8.43.0] - 2026-08-12
 
 ### Added
@@ -1927,7 +1945,18 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 [#1454]: https://github.com/auth0/auth0-deploy-cli/issues/1454
 [#1456]: https://github.com/auth0/auth0-deploy-cli/issues/1456
 [#1457]: https://github.com/auth0/auth0-deploy-cli/issues/1457
-[Unreleased]: https://github.com/auth0/auth0-deploy-cli/compare/v8.43.0...HEAD
+[#1460]: https://github.com/auth0/auth0-deploy-cli/issues/1460
+[#1461]: https://github.com/auth0/auth0-deploy-cli/issues/1461
+[#1462]: https://github.com/auth0/auth0-deploy-cli/issues/1462
+[#1464]: https://github.com/auth0/auth0-deploy-cli/issues/1464
+[#1465]: https://github.com/auth0/auth0-deploy-cli/issues/1465
+[#1470]: https://github.com/auth0/auth0-deploy-cli/issues/1470
+[#1471]: https://github.com/auth0/auth0-deploy-cli/issues/1471
+[#1474]: https://github.com/auth0/auth0-deploy-cli/issues/1474
+[#1476]: https://github.com/auth0/auth0-deploy-cli/issues/1476
+[#1477]: https://github.com/auth0/auth0-deploy-cli/issues/1477
+[Unreleased]: https://github.com/auth0/auth0-deploy-cli/compare/v8.44.0...HEAD
+[8.44.0]: https://github.com/auth0/auth0-deploy-cli/compare/v8.43.0...v8.44.0
 [8.43.0]: https://github.com/auth0/auth0-deploy-cli/compare/v8.42.0...v8.43.0
 [8.42.0]: https://github.com/auth0/auth0-deploy-cli/compare/v8.41.0...v8.42.0
 [8.41.0]: https://github.com/auth0/auth0-deploy-cli/compare/v8.40.0...v8.41.0

package/lib/context/defaults.d.ts

@@ -6,4 +6,11 @@ export declare function phoneTemplatesDefaults(phoneTemplate: any): any;
 export declare function connectionDefaults(connection: any, config?: Pick<Config, 'AUTH0_EXPORT_SECRETS'>): any;
 export declare function logStreamDefaults(logStreams: any, config?: Pick<Config, 'AUTH0_EXPORT_SECRETS'>): any;
 export declare function eventStreamDefaults(eventStreams: any[], config?: Pick<Config, 'AUTH0_EXPORT_SECRETS'>): any[];
+/**
+ * Sorts primitive arrays (e.g. `shields`, `admin_notification_frequency`) within the
+ * attackProtection subtree in place, so repeated exports produce deterministic output.
+ * These are unordered, string-typed enum sets — ordering is cosmetic. Object arrays are
+ * left as-is.
+ */
+export declare function sortAttackProtectionArrays(attackProtection: AttackProtection): AttackProtection;
 export declare function attackProtectionDefaults(attackProtection: AttackProtection, config?: Pick<Config, 'AUTH0_EXPORT_SECRETS'>): AttackProtection;

package/lib/context/defaults.js

@@ -6,6 +6,7 @@ exports.phoneTemplatesDefaults = phoneTemplatesDefaults;
 exports.connectionDefaults = connectionDefaults;
 exports.logStreamDefaults = logStreamDefaults;
 exports.eventStreamDefaults = eventStreamDefaults;
+exports.sortAttackProtectionArrays = sortAttackProtectionArrays;
 exports.attackProtectionDefaults = attackProtectionDefaults;
 const utils_1 = require("../tools/utils");
 // env vars arrive as strings, so check both forms
@@ -22,45 +23,57 @@ function emailProviderDefaults(emailProvider, config) {
     // Add placeholder for credentials as they cannot be exported
     const { name } = updated;
     if (apiKeyProviders.includes(name)) {
-        updated.credentials = {
-            api_key: `##${name.toUpperCase()}_API_KEY##`,
-            ...(updated.credentials || {}),
-        };
+        if (typeof updated.credentials !== 'string') {
+            updated.credentials = {
+                api_key: `##${name.toUpperCase()}_API_KEY##`,
+                ...(updated.credentials || {}),
+            };
+        }
     }
     if (name === 'smtp') {
-        // This is to mask smtp_user to '##SMTP_USER##'
-        if (updated.credentials && 'smtp_user' in updated.credentials) {
-            delete updated.credentials.smtp_user;
+        // If credentials is a keyword placeholder string (e.g. @@SMTP_CREDENTIALS@@), preserve it as-is.
+        // The `in` operator requires an object and would throw a TypeError on a string.
+        if (typeof updated.credentials !== 'string') {
+            // This is to mask smtp_user to '##SMTP_USER##'
+            if (updated.credentials && 'smtp_user' in updated.credentials) {
+                delete updated.credentials.smtp_user;
+            }
+            updated.credentials = {
+                smtp_host: '##SMTP_HOSTNAME##',
+                smtp_port: '##SMTP_PORT##',
+                smtp_user: '##SMTP_USER##',
+                smtp_pass: '##SMTP_PASS##',
+                ...(updated.credentials || {}),
+            };
         }
-        updated.credentials = {
-            smtp_host: '##SMTP_HOSTNAME##',
-            smtp_port: '##SMTP_PORT##',
-            smtp_user: '##SMTP_USER##',
-            smtp_pass: '##SMTP_PASS##',
-            ...(updated.credentials || {}),
-        };
     }
     if (name === 'ses') {
-        updated.credentials = {
-            accessKeyId: '##SES_ACCESS_KEY_ID##',
-            secretAccessKey: '##SES_ACCESS_SECRET_KEY##',
-            region: '##SES_AWS_REGION##',
-            ...(updated.credentials || {}),
-        };
+        if (typeof updated.credentials !== 'string') {
+            updated.credentials = {
+                accessKeyId: '##SES_ACCESS_KEY_ID##',
+                secretAccessKey: '##SES_ACCESS_SECRET_KEY##',
+                region: '##SES_AWS_REGION##',
+                ...(updated.credentials || {}),
+            };
+        }
     }
     if (name === 'azure_cs') {
-        updated.credentials = {
-            connectionString: '##AZURE_CS_CONNECTION_KEY##',
-            ...(updated.credentials || {}),
-        };
+        if (typeof updated.credentials !== 'string') {
+            updated.credentials = {
+                connectionString: '##AZURE_CS_CONNECTION_KEY##',
+                ...(updated.credentials || {}),
+            };
+        }
     }
     if (name === 'ms365') {
-        updated.credentials = {
-            tenantId: '##MS365_TENANT_ID##',
-            clientId: '##MS365_CLIENT_ID##',
-            clientSecret: '##MS365_CLIENT_SECRET##',
-            ...(updated.credentials || {}),
-        };
+        if (typeof updated.credentials !== 'string') {
+            updated.credentials = {
+                tenantId: '##MS365_TENANT_ID##',
+                clientId: '##MS365_CLIENT_ID##',
+                clientSecret: '##MS365_CLIENT_SECRET##',
+                ...(updated.credentials || {}),
+            };
+        }
     }
     return updated;
 }
@@ -87,6 +100,12 @@ function phoneProviderDefaults(phoneProvider) {
             auth_token: `##${name.toUpperCase()}_AUTH_TOKEN##`,
         };
     }
+    else if (name === 'custom') {
+        // The `custom` provider has no exportable secrets, but the API requires a
+        // `credentials` object on import even when empty. Emit an empty object so
+        // exported configs round-trip cleanly.
+        updated.credentials = {};
+    }
     return updated;
 }
 function phoneTemplatesDefaults(phoneTemplate) {
@@ -193,6 +212,31 @@ function eventStreamDefaults(eventStreams, config) {
         };
     });
 }
+/**
+ * Sorts primitive arrays (e.g. `shields`, `admin_notification_frequency`) within the
+ * attackProtection subtree in place, so repeated exports produce deterministic output.
+ * These are unordered, string-typed enum sets — ordering is cosmetic. Object arrays are
+ * left as-is.
+ */
+function sortAttackProtectionArrays(attackProtection) {
+    const sortArraysDeep = (value) => {
+        if (Array.isArray(value)) {
+            const isPrimitiveArray = value.every((item) => item === null || typeof item !== 'object');
+            if (isPrimitiveArray) {
+                value.sort();
+            }
+            else {
+                value.forEach(sortArraysDeep);
+            }
+            return;
+        }
+        if (value && typeof value === 'object') {
+            Object.values(value).forEach(sortArraysDeep);
+        }
+    };
+    sortArraysDeep(attackProtection);
+    return attackProtection;
+}
 function attackProtectionDefaults(attackProtection, config) {
     if (isExportSecrets(config))
         return attackProtection;

package/lib/context/directory/handlers/attackProtection.js

@@ -65,7 +65,7 @@ async function dump(context) {
         return;
     const files = attackProtectionFiles(context.filePath);
     fs_extra_1.default.ensureDirSync(files.directory);
-    const maskedAttackProtection = (0, defaults_1.attackProtectionDefaults)(attackProtection, context.config);
+    const maskedAttackProtection = (0, defaults_1.sortAttackProtectionArrays)((0, defaults_1.attackProtectionDefaults)(attackProtection, context.config));
     if (maskedAttackProtection.botDetection) {
         (0, utils_1.dumpJSON)(files.botDetection, maskedAttackProtection.botDetection);
     }

package/lib/context/directory/handlers/branding.js

@@ -6,6 +6,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 const path_1 = __importDefault(require("path"));
 const fs_extra_1 = __importDefault(require("fs-extra"));
 const tools_1 = require("../../../tools");
+const logger_1 = __importDefault(require("../../../logger"));
 const utils_1 = require("../../../utils");
 function parse(context) {
     const brandingDirectory = path_1.default.join(context.filePath, tools_1.constants.BRANDING_DIRECTORY);
@@ -31,7 +32,14 @@ function parse(context) {
             disableKeywordReplacement: context.disableKeywordReplacement,
         });
         const normalizedPathArray = (0, utils_1.nomalizedYAMLPath)(definition.body);
-        definition.body = (0, tools_1.loadFileAndReplaceKeywords)(path_1.default.join(brandingTemplatesFolder, ...normalizedPathArray), {
+        const resolvedBodyFile = path_1.default.resolve(brandingTemplatesFolder, ...normalizedPathArray);
+        const configRoot = path_1.default.resolve(context.filePath);
+        if (!resolvedBodyFile.startsWith(configRoot + path_1.default.sep)) {
+            logger_1.default.warn(`Branding template body path "${definition.body}" resolves to "${resolvedBodyFile}" which is outside the config directory "${configRoot}". ` +
+                `This will be blocked as an error in the next major release. ` +
+                `Move the file inside your config directory.`);
+        }
+        definition.body = (0, tools_1.loadFileAndReplaceKeywords)(resolvedBodyFile, {
             mappings: context.mappings,
             disableKeywordReplacement: context.disableKeywordReplacement,
         });

package/lib/context/directory/handlers/clients.js

@@ -20,9 +20,15 @@ function parse(context) {
             disableKeywordReplacement: context.disableKeywordReplacement,
         });
         if (client.custom_login_page) {
-            const htmlFileName = path_1.default.join(clientsFolder, client.custom_login_page);
-            if ((0, utils_1.isFile)(htmlFileName)) {
-                client.custom_login_page = (0, tools_1.loadFileAndReplaceKeywords)(htmlFileName, {
+            const configRoot = path_1.default.resolve(context.filePath);
+            const resolvedLoginPage = path_1.default.resolve(clientsFolder, client.custom_login_page);
+            if ((0, utils_1.isFile)(resolvedLoginPage)) {
+                if (!resolvedLoginPage.startsWith(configRoot + path_1.default.sep)) {
+                    logger_1.default.warn(`Path "${client.custom_login_page}" resolves to "${resolvedLoginPage}" which is outside the config directory "${configRoot}". ` +
+                        `This will be blocked as an error in the next major release. ` +
+                        `Move the file inside your config directory.`);
+                }
+                client.custom_login_page = (0, tools_1.loadFileAndReplaceKeywords)(resolvedLoginPage, {
                     mappings: context.mappings,
                     disableKeywordReplacement: context.disableKeywordReplacement,
                 });

package/lib/context/directory/handlers/connections.js

@@ -23,11 +23,17 @@ function parse(context) {
         });
         if (connection.strategy === 'email') {
             (0, utils_1.ensureProp)(connection, 'options.email.body');
-            const htmlFileName = path_1.default.join(connectionsFolder, connection.options.email.body);
-            if (!(0, utils_1.isFile)(htmlFileName)) {
-                throw new Error(`Passwordless email template purportedly located at ${htmlFileName} does not exist for connection. Ensure the existence of this file to proceed with deployment.`);
+            const configRoot = path_1.default.resolve(context.filePath);
+            const resolvedHtmlFile = path_1.default.resolve(connectionsFolder, connection.options.email.body);
+            if (!(0, utils_1.isFile)(resolvedHtmlFile)) {
+                throw new Error(`Passwordless email template purportedly located at ${resolvedHtmlFile} does not exist for connection. Ensure the existence of this file to proceed with deployment.`);
             }
-            connection.options.email.body = (0, tools_1.loadFileAndReplaceKeywords)(htmlFileName, {
+            if (!resolvedHtmlFile.startsWith(configRoot + path_1.default.sep)) {
+                logger_1.default.warn(`Path "${connection.options.email.body}" resolves to "${resolvedHtmlFile}" which is outside the config directory "${configRoot}". ` +
+                    `This will be blocked as an error in the next major release. ` +
+                    `Move the file inside your config directory.`);
+            }
+            connection.options.email.body = (0, tools_1.loadFileAndReplaceKeywords)(resolvedHtmlFile, {
                 mappings: context.mappings,
                 disableKeywordReplacement: context.disableKeywordReplacement,
             });

package/lib/context/directory/handlers/emailTemplates.js

@@ -34,6 +34,15 @@ function parse(context) {
             logger_1.default.warn(`Skipping email template file ${meta.body} as missing the corresponding '.json' file`);
             return [];
         }
+        if (meta.body !== undefined) {
+            const configRoot = path_1.default.resolve(context.filePath);
+            const resolvedTemplatePath = path_1.default.resolve(templateFilePath);
+            if (!resolvedTemplatePath.startsWith(configRoot + path_1.default.sep)) {
+                logger_1.default.warn(`Email template body path "${meta.body}" resolves to "${resolvedTemplatePath}" which is outside the config directory "${configRoot}". ` +
+                    `This will be blocked as an error in the next major release. ` +
+                    `Move the file inside your config directory.`);
+            }
+        }
         return {
             ...meta,
             body: (0, tools_1.loadFileAndReplaceKeywords)(templateFilePath, {

package/lib/context/directory/handlers/prompts.js

@@ -6,6 +6,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 const path_1 = __importDefault(require("path"));
 const fs_extra_1 = require("fs-extra");
 const tools_1 = require("../../../tools");
+const logger_1 = __importDefault(require("../../../logger"));
 const utils_1 = require("../../../utils");
 const getPromptsDirectory = (filePath) => path_1.default.join(filePath, tools_1.constants.PROMPTS_DIRECTORY);
 const getPromptsSettingsFile = (promptsDirectory) => path_1.default.join(promptsDirectory, 'prompts.json');
@@ -46,9 +47,16 @@ function parse(context) {
             const screensObject = screensArray[0];
             acc[promptName] = Object.entries(screensObject).reduce((screenAcc, [screenName, items]) => {
                 screenAcc[screenName] = items.reduce((insertionAcc, { name, template }) => {
-                    const templateFilePath = path_1.default.join(promptsDirectory, template);
-                    insertionAcc[name] = (0, utils_1.isFile)(templateFilePath)
-                        ? (0, tools_1.loadFileAndReplaceKeywords)(templateFilePath, {
+                    const configRoot = path_1.default.resolve(context.filePath);
+                    const resolvedTemplatePath = path_1.default.resolve(promptsDirectory, template);
+                    if ((0, utils_1.isFile)(resolvedTemplatePath) &&
+                        !resolvedTemplatePath.startsWith(configRoot + path_1.default.sep)) {
+                        logger_1.default.warn(`Prompt partial template "${template}" resolves to "${resolvedTemplatePath}" which is outside the config directory "${configRoot}". ` +
+                            `This will be blocked as an error in the next major release. ` +
+                            `Move the file inside your config directory.`);
+                    }
+                    insertionAcc[name] = (0, utils_1.isFile)(resolvedTemplatePath)
+                        ? (0, tools_1.loadFileAndReplaceKeywords)(resolvedTemplatePath, {
                             mappings: context.mappings,
                             disableKeywordReplacement: context.disableKeywordReplacement,
                         }).trim()

package/lib/context/yaml/handlers/attackProtection.js

@@ -27,7 +27,7 @@ async function dump(context) {
     }
     const maskedAttackProtection = (0, defaults_1.attackProtectionDefaults)(attackProtectionConfig, context.config);
     return {
-        attackProtection: maskedAttackProtection,
+        attackProtection: (0, defaults_1.sortAttackProtectionArrays)(maskedAttackProtection),
     };
 }
 const attackProtectionHandler = {

package/lib/context/yaml/handlers/branding.js

@@ -18,9 +18,16 @@ async function parse(context) {
     const parsedTemplates = templates.map((templateDefinition) => {
         const normalizedPathArray = (0, utils_1.nomalizedYAMLPath)(templateDefinition.body);
         const markupFile = path_1.default.join(context.basePath, ...normalizedPathArray);
+        const configRoot = path_1.default.resolve(context.basePath);
+        const resolvedMarkupFile = path_1.default.resolve(markupFile);
+        if (!resolvedMarkupFile.startsWith(configRoot + path_1.default.sep)) {
+            logger_1.default.warn(`Branding template body path "${templateDefinition.body}" resolves to "${resolvedMarkupFile}" which is outside the config directory "${configRoot}". ` +
+                `This will be blocked as an error in the next major release. ` +
+                `Move the file inside your config directory.`);
+        }
         return {
             template: templateDefinition.template,
-            body: (0, tools_1.loadFileAndReplaceKeywords)(markupFile, {
+            body: (0, tools_1.loadFileAndReplaceKeywords)(resolvedMarkupFile, {
                 mappings: context.mappings,
                 disableKeywordReplacement: context.disableKeywordReplacement,
             }),

package/lib/context/yaml/handlers/clients.js

@@ -21,7 +21,10 @@ async function parse(context) {
                 if (client.custom_login_page) {
                     const htmlFileName = path_1.default.join(clientsFolder, client.custom_login_page);
                     if ((0, utils_1.isFile)(htmlFileName)) {
-                        client.custom_login_page = context.loadFile(htmlFileName);
+                        // Pass a path relative to basePath so context.loadFile() resolves it correctly.
+                        // Passing htmlFileName (which already includes basePath) would cause double resolution
+                        // when basePath is a relative path (e.g. when AUTH0_INPUT_FILE is a relative path).
+                        client.custom_login_page = context.loadFile(path_1.default.join(tools_1.constants.CLIENTS_DIRECTORY, client.custom_login_page));
                     }
                 }
                 return client;

package/lib/context/yaml/handlers/connections.js

@@ -26,7 +26,9 @@ async function parse(context) {
                         logger_1.default.error(missingTemplateErrorMessage);
                         throw new Error(missingTemplateErrorMessage);
                     }
-                    connection.options.email.body = context.loadFile(htmlFileName);
+                    // Pass a path relative to basePath so context.loadFile() resolves it correctly.
+                    // Passing htmlFileName (which already includes basePath) would cause double resolution.
+                    connection.options.email.body = context.loadFile(path_1.default.join(tools_1.constants.CONNECTIONS_DIRECTORY, connection.options.email.body));
                 }
                 return connection;
             }),

package/lib/context/yaml/handlers/flows.js

@@ -14,6 +14,13 @@ async function parse(context) {
         return { flows: null };
     const parsedFlows = flows.map((flow) => {
         const flowFile = path_1.default.join(context.basePath, flow.body);
+        const configRoot = path_1.default.resolve(context.basePath);
+        const resolvedFlowFile = path_1.default.resolve(flowFile);
+        if (!resolvedFlowFile.startsWith(configRoot + path_1.default.sep)) {
+            logger_1.default.warn(`Flow body file "${flow.body}" resolves to "${resolvedFlowFile}" which is outside the config directory "${configRoot}". ` +
+                `This will be blocked as an error in the next major release. ` +
+                `Move the file inside your config directory.`);
+        }
         const parsedFlowBody = (0, utils_1.loadJSON)(flowFile, {
             mappings: context.mappings,
             disableKeywordReplacement: context.disableKeywordReplacement,

package/lib/context/yaml/handlers/forms.js

@@ -14,6 +14,13 @@ async function parse(context) {
         return { forms: null };
     const parsedForms = forms.map((form) => {
         const formFile = path_1.default.join(context.basePath, form.body);
+        const configRoot = path_1.default.resolve(context.basePath);
+        const resolvedFormFile = path_1.default.resolve(formFile);
+        if (!resolvedFormFile.startsWith(configRoot + path_1.default.sep)) {
+            logger_1.default.warn(`Form body file "${form.body}" resolves to "${resolvedFormFile}" which is outside the config directory "${configRoot}". ` +
+                `This will be blocked as an error in the next major release. ` +
+                `Move the file inside your config directory.`);
+        }
         const parsedFormBody = (0, utils_1.loadJSON)(formFile, {
             mappings: context.mappings,
             disableKeywordReplacement: context.disableKeywordReplacement,

package/lib/context/yaml/handlers/prompts.js

@@ -19,7 +19,13 @@ const loadScreenRenderers = (context, screenRenderArray) => {
         Object.entries(screens).forEach(([, fileName]) => {
             const filePath = fileName;
             try {
-                const rendererFile = path_1.default.join(context.basePath, filePath);
+                const configRoot = path_1.default.resolve(context.basePath);
+                const rendererFile = path_1.default.resolve(context.basePath, filePath);
+                if (!rendererFile.startsWith(configRoot + path_1.default.sep)) {
+                    logger_1.default.warn(`Screen renderer file "${filePath}" resolves to "${rendererFile}" which is outside the config directory "${configRoot}". ` +
+                        `This will be blocked as an error in the next major release. ` +
+                        `Move the file inside your config directory.`);
+                }
                 const rendererData = (0, utils_1.loadJSON)(rendererFile, {
                     mappings: context.mappings,
                     disableKeywordReplacement: context.disableKeywordReplacement,

package/lib/readonly.js

@@ -28,6 +28,11 @@ const readOnlyFields = {
         'config_route',
         'owners',
     ],
+    attackProtection: [
+        // Returned by GET but rejected by PATCH with "Additional properties not allowed"
+        'bruteForceProtection.form_submission_mode',
+        'bruteForceProtection.form_submission_behavior',
+    ],
 };
 function getExcludedFields(config) {
     const strippedFields = { ...readOnlyFields };

package/lib/tools/auth0/handlers/attackProtection.js

@@ -314,7 +314,9 @@ class AttackProtectionHandler extends default_1.default {
             updates.push(this.client.attackProtection.captcha.update(attackProtection.captcha));
         }
         if (attackProtection.bruteForceProtection) {
-            updates.push(this.client.attackProtection.bruteForceProtection.update(attackProtection.bruteForceProtection));
+            // Strip fields returned by GET but rejected by PATCH
+            const { form_submission_mode, form_submission_behavior, ...bruteForcePayload } = attackProtection.bruteForceProtection;
+            updates.push(this.client.attackProtection.bruteForceProtection.update(bruteForcePayload));
         }
         if (attackProtection.suspiciousIpThrottling) {
             updates.push(this.client.attackProtection.suspiciousIpThrottling.update(attackProtection.suspiciousIpThrottling));

package/lib/tools/auth0/handlers/clients.d.ts

@@ -254,6 +254,27 @@ export declare const schema: {
                         enum: ("allow" | "allow_if_empty")[];
                         description: string;
                     };
+                    third_party_client_access: {
+                        type: string;
+                        description: string;
+                        properties: {
+                            default_value: {
+                                type: string;
+                                enum: "block"[];
+                                description: string;
+                            };
+                            allowed_values: {
+                                type: string;
+                                items: {
+                                    type: string;
+                                    enum: ("allow" | "block")[];
+                                };
+                                uniqueItems: boolean;
+                                description: string;
+                            };
+                        };
+                        required: string[];
+                    };
                     invitation_landing_client_id: {
                         type: string;
                         description: string;

package/lib/tools/auth0/handlers/clients.js

@@ -59,6 +59,27 @@ const myOrganizationConfigurationSchema = {
             enum: Object.values(auth0_1.Management.ClientMyOrganizationDeletionBehaviorEnum),
             description: 'The deletion behavior for My Organization connections created by this client',
         },
+        third_party_client_access: {
+            type: 'object',
+            description: 'Controls whether third-party clients can access the organization via the My Organization API.',
+            properties: {
+                default_value: {
+                    type: 'string',
+                    enum: Object.values(auth0_1.Management.ClientMyOrganizationConfigurationThirdPartyClientAccessDefaultValueEnum),
+                    description: 'The default third-party client access value.',
+                },
+                allowed_values: {
+                    type: 'array',
+                    items: {
+                        type: 'string',
+                        enum: Object.values(auth0_1.Management.ClientMyOrganizationConfigurationThirdPartyClientAccessAllowedValuesEnum),
+                    },
+                    uniqueItems: true,
+                    description: 'The allowed third-party client access values.',
+                },
+            },
+            required: ['default_value', 'allowed_values'],
+        },
         invitation_landing_client_id: {
             type: 'string',
             description: 'The client ID of the invitation landing client for the My Organization configuration',

package/lib/tools/auth0/handlers/connectionProfiles.d.ts

@@ -36,6 +36,33 @@ export declare const schema: {
             connection_config: {
                 type: string[];
             };
+            cross_app_access_resource_app: {
+                type: string;
+                description: string;
+                properties: {
+                    status: {
+                        type: string;
+                        properties: {
+                            default_value: {
+                                type: string;
+                                enum: ("enabled" | "disabled")[];
+                                description: string;
+                            };
+                            allowed_values: {
+                                type: string;
+                                items: {
+                                    type: string;
+                                    enum: ("enabled" | "disabled")[];
+                                };
+                                uniqueItems: boolean;
+                                description: string;
+                            };
+                        };
+                        required: string[];
+                    };
+                };
+                required: string[];
+            };
             strategy_overrides: {
                 type: string[];
                 properties: {

package/lib/tools/auth0/handlers/connectionProfiles.js

@@ -4,6 +4,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.getConnectionProfile = exports.schema = void 0;
+const auth0_1 = require("auth0");
 const default_1 = __importDefault(require("./default"));
 const client_1 = require("../client");
 const logger_1 = __importDefault(require("../../../logger"));
@@ -42,6 +43,35 @@ exports.schema = {
             connection_config: {
                 type: ['object', 'null'],
             },
+            cross_app_access_resource_app: {
+                type: 'object',
+                description: 'Controls whether organization admins may enable Cross App Access (XAA) on their Identity Providers.',
+                properties: {
+                    status: {
+                        type: 'object',
+                        properties: {
+                            default_value: {
+                                type: 'string',
+                                enum: Object.values(auth0_1.Management.ConnectionProfileCrossAppAccessResourceAppStatusDefaultValueEnum),
+                                description: 'The default Cross App Access resource app status.',
+                            },
+                            allowed_values: {
+                                type: 'array',
+                                items: {
+                                    type: 'string',
+                                    enum: Object.values(auth0_1.Management.ConnectionProfileCrossAppAccessResourceAppStatusValueEnum),
+                                },
+                                uniqueItems: true,
+                                description: 'The allowed Cross App Access resource app status values.',
+                            },
+                        },
+                        // allowed_values is optional per the SDK type (unlike the client's
+                        // third_party_client_access, which requires both fields).
+                        required: ['default_value'],
+                    },
+                },
+                required: ['status'],
+            },
             strategy_overrides: {
                 type: ['object', 'null'],
                 properties: {

package/lib/tools/auth0/handlers/connections.js

@@ -380,12 +380,15 @@ class ConnectionsHandler extends default_1.default {
     }
     getFormattedOptions(connection, clients) {
         try {
+            const { idpinitiated } = connection.options;
             return {
                 options: {
                     ...connection.options,
                     idpinitiated: {
-                        ...connection.options.idpinitiated,
-                        client_id: (0, utils_1.convertClientNameToId)(connection.options.idpinitiated.client_id, clients),
+                        ...idpinitiated,
+                        ...(idpinitiated.client_id && {
+                            client_id: (0, utils_1.convertClientNameToId)(idpinitiated.client_id, clients),
+                        }),
                     },
                 },
             };
@@ -744,7 +747,11 @@ class ConnectionsHandler extends default_1.default {
                 ...(enabledClients !== undefined && { enabled_clients: enabledClients }),
             };
         });
-        const proposedChanges = await super.dryRunChanges({ ...assets, connections: formatted });
+        let proposedChanges = await super.dryRunChanges({ ...assets, connections: formatted });
+        const includedConnections = (assets.include && assets.include.connections) || [];
+        const excludedConnections = (assets.exclude && assets.exclude.connections) || [];
+        proposedChanges = (0, utils_1.filterExcluded)(proposedChanges, excludedConnections);
+        proposedChanges = (0, utils_1.filterIncluded)(proposedChanges, includedConnections);
         return (0, exports.addExcludedConnectionPropertiesToChanges)({
             proposedChanges,
             existingConnections,

package/lib/tools/auth0/handlers/databases.js

@@ -554,7 +554,7 @@ class DatabaseHandler extends default_1.default {
             assets: formatted,
             existing: existingDatabasesConnections,
             identifiers: this.identifiers,
-            ignoreDryRunFields: this.ignoreDryRunFields,
+            ignoreDryRunFields: this.getEffectiveIgnoreDryRunFields(),
         });
     }
     // Run after clients are updated so we can convert all the enabled_clients names to id's

package/lib/tools/auth0/handlers/default.d.ts

@@ -1,6 +1,20 @@
 import { Asset, Assets, Auth0APIClient, CalculatedChanges } from '../../../types';
 import { ConfigFunction } from '../../../configFactory';
 export declare function order(value: any): (t: any, n: any, descriptor: any) => any;
+export interface RetryOptions {
+    maxRetries?: number;
+    initialDelay?: number;
+    maxDelay?: number;
+    onRetry?: (error: any, attempt: number, delay: number) => void;
+}
+/**
+ * Executes a function with exponential backoff retry logic for rate limit errors (429).
+ *
+ * @param fn - The function to execute with retry logic
+ * @param options - Configuration options for retry behavior
+ * @returns Promise that resolves with the function result or rejects after max retries
+ */
+export declare function retryWithExponentialBackoff<T>(fn: () => Promise<T>, options?: RetryOptions): Promise<T>;
 type ApiMethodOverride = string | Function;
 export default class APIHandler {
     config: ConfigFunction;
@@ -50,6 +64,15 @@ export default class APIHandler {
      */
     getEffectiveIgnoreDryRunFields(): string[];
     getClientFN(fn: ApiMethodOverride): Function;
+    /**
+     * Builds the exponential-backoff retry configuration for this handler from the
+     * shared `AUTH0_MAX_RETRIES` / `AUTH0_RETRY_INITIAL_DELAY_MS` /
+     * `AUTH0_RETRY_MAX_DELAY_MS` config keys. Exposed so that handlers which issue
+     * writes outside the default `processChanges` flow (e.g. organizations, which
+     * writes nested connections/grants directly) can wrap those calls in the same
+     * 429 backoff behaviour as the base handler.
+     */
+    getRetryConfig(): RetryOptions;
     didDelete(item: Asset): void;
     didCreate(item: Asset): void;
     didUpdate(item: Asset): void;

package/lib/tools/auth0/handlers/default.js

@@ -4,6 +4,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.order = order;
+exports.retryWithExponentialBackoff = retryWithExponentialBackoff;
 const auth0_1 = require("auth0");
 const validationError_1 = __importDefault(require("../../validationError"));
 const utils_1 = require("../../utils");
@@ -114,6 +115,25 @@ class APIHandler {
         }
         return fn;
     }
+    /**
+     * Builds the exponential-backoff retry configuration for this handler from the
+     * shared `AUTH0_MAX_RETRIES` / `AUTH0_RETRY_INITIAL_DELAY_MS` /
+     * `AUTH0_RETRY_MAX_DELAY_MS` config keys. Exposed so that handlers which issue
+     * writes outside the default `processChanges` flow (e.g. organizations, which
+     * writes nested connections/grants directly) can wrap those calls in the same
+     * 429 backoff behaviour as the base handler.
+     */
+    getRetryConfig() {
+        const retryConfig = {
+            maxRetries: this.config('AUTH0_MAX_RETRIES') || DEFAULT_MAX_RETRIES,
+            initialDelay: this.config('AUTH0_RETRY_INITIAL_DELAY_MS') || DEFAULT_INITIAL_DELAY_MS,
+            maxDelay: this.config('AUTH0_RETRY_MAX_DELAY_MS') || DEFAULT_MAX_DELAY_MS,
+            onRetry: (error, attempt, delay) => {
+                logger_1.default.warn(`Rate limit hit for [${this.type}]. Retrying attempt ${attempt}/${retryConfig.maxRetries} after ${Math.round(delay / 1000)}s...`);
+            },
+        };
+        return retryConfig;
+    }
     didDelete(item) {
         logger_1.default.info(`Deleted [${this.type}]: ${this.objString(item)}`);
     }
@@ -210,7 +230,6 @@ class APIHandler {
             return (0, calculateDryRunChanges_1.calculateDryRunChanges)({
                 type: this.type,
                 assets: typeAssets,
-                // @ts-ignore TODO: investigate what happens when `existing` is null
                 existing,
                 identifiers: this.identifiers,
                 ignoreDryRunFields: this.getEffectiveIgnoreDryRunFields(),
@@ -243,7 +262,6 @@ class APIHandler {
         return (0, calculateDryRunChanges_1.calculateDryRunChanges)({
             type: this.type,
             assets: typeAssets,
-            // @ts-ignore TODO: investigate what happens when `existing` is null
             existing,
             identifiers: this.identifiers,
             ignoreDryRunFields: this.getEffectiveIgnoreDryRunFields(),
@@ -282,14 +300,7 @@ class APIHandler {
         const conflicts = changes.conflicts || [];
         logger_1.default.debug(`Start processChanges for ${this.type} [delete:${del.length}] [update:${update.length}], [create:${create.length}], [conflicts:${conflicts.length}]`);
         // Set retry configuration from config
-        const retryConfig = {
-            maxRetries: this.config('AUTH0_MAX_RETRIES') || DEFAULT_MAX_RETRIES,
-            initialDelay: this.config('AUTH0_RETRY_INITIAL_DELAY_MS') || DEFAULT_INITIAL_DELAY_MS,
-            maxDelay: this.config('AUTH0_RETRY_MAX_DELAY_MS') || DEFAULT_MAX_DELAY_MS,
-            onRetry: (error, attempt, delay) => {
-                logger_1.default.warn(`Rate limit hit for [${this.type}]. Retrying attempt ${attempt}/${retryConfig.maxRetries} after ${Math.round(delay / 1000)}s...`);
-            },
-        };
+        const retryConfig = this.getRetryConfig();
         // Process Deleted
         if (del.length > 0) {
             const allowDelete = this.config('AUTH0_ALLOW_DELETE') === 'true' || this.config('AUTH0_ALLOW_DELETE') === true;

package/lib/tools/auth0/handlers/organizations.d.ts

@@ -147,7 +147,7 @@ export default class OrganizationsHandler extends DefaultHandler {
     createOrganizations(creates: CalculatedChanges['create']): Promise<void>;
     updateOrganization(org: any, organizations: any): Promise<{
         id: any;
-    }>;
+    } | null>;
     getClientGrantIDByClientName(clientsName: string): string;
     getClientIdByClientName(clientName: string): string;
     getFormattedClientGrants(): Promise<FormattedClientGrants[]>;

package/lib/tools/auth0/handlers/organizations.js

@@ -194,8 +194,9 @@ class OrganizationsHandler extends default_1.default {
             throw new Error(`Organization "${organization.name}" was created but the response did not include an ID. Skipping connection/grant association.`);
         }
         const createdId = created.id;
+        const retryConfig = this.getRetryConfig();
         if (typeof org.connections !== 'undefined' && org.connections.length > 0) {
-            await Promise.all(org.connections.map((conn) => this.client.organizations.connections.create(createdId, conn)));
+            await Promise.all(org.connections.map((conn) => (0, default_1.retryWithExponentialBackoff)(() => this.client.organizations.connections.create(createdId, conn), retryConfig)));
         }
         if (typeof org.client_grants !== 'undefined' && org.client_grants.length > 0) {
             await Promise.all(org.client_grants.map((organizationClientGrants) => this.createOrganizationClientGrants(createdId, this.getClientGrantIDByClientName(organizationClientGrants.client_id))));
@@ -240,7 +241,8 @@ class OrganizationsHandler extends default_1.default {
             .promise();
     }
     async updateOrganization(org, organizations) {
-        const { connections: existingConnections, client_grants: existingClientGrants, discovery_domains: existingDiscoveryDomains, clients: existingOrgClients = [], } = await organizations.find((orgToUpdate) => orgToUpdate.name === org.name);
+        const existingOrg = organizations.find((orgToUpdate) => orgToUpdate.name === org.name);
+        const { connections: existingConnections, client_grants: existingClientGrants, discovery_domains: existingDiscoveryDomains, clients: existingOrgClients = [], } = existingOrg;
         const params = { id: org.id };
         const { connections, client_grants: organizationClientGrants, discovery_domains: organizationDiscoveryDomains, clients: organizationClients, } = org;
         delete org.connections;
@@ -249,7 +251,14 @@ class OrganizationsHandler extends default_1.default {
         delete org.client_grants;
         delete org.discovery_domains;
         delete org.clients;
-        await this.client.organizations.update(params.id, org);
+        // Only PATCH if top-level properties actually differ from the existing state.
+        // Compare only the keys present in the desired config against those same keys
+        // on the remote org, so that fields the user didn't specify are not considered.
+        let changed = false;
+        if (!(0, lodash_1.isEqual)(org, (0, lodash_1.pick)(existingOrg, Object.keys(org)))) {
+            await this.client.organizations.update(params.id, org);
+            changed = true;
+        }
         // organization connections
         const connectionsToRemove = existingConnections.filter((c) => !connections.find((x) => x.connection_id === c.connection_id));
         const connectionsToAdd = connections.filter((c) => !existingConnections.find((x) => x.connection_id === c.connection_id));
@@ -260,27 +269,27 @@ class OrganizationsHandler extends default_1.default {
                 x.organization_access_level !== c.organization_access_level ||
                 x.organization_connection_name !== c.organization_connection_name ||
                 x.is_enabled !== (c.is_enabled ?? true))));
+        if (connectionsToUpdate.length > 0 ||
+            connectionsToAdd.length > 0 ||
+            connectionsToRemove.length > 0) {
+            changed = true;
+        }
+        const retryConfig = this.getRetryConfig();
         // Handle updates first
-        await Promise.all(connectionsToUpdate.map((conn) => this.client.organizations.connections
-            .update(params.id, conn.connection_id, {
+        await Promise.all(connectionsToUpdate.map((conn) => (0, default_1.retryWithExponentialBackoff)(() => this.client.organizations.connections.update(params.id, conn.connection_id, {
             organization_connection_name: conn.organization_connection_name,
             assign_membership_on_login: conn.assign_membership_on_login,
             show_as_button: conn.show_as_button,
             is_signup_enabled: conn.is_signup_enabled,
             is_enabled: conn.is_enabled,
             organization_access_level: conn.organization_access_level,
-        })
-            .catch(() => {
+        }), retryConfig).catch(() => {
             throw new Error(`Problem updating Enabled Connection ${conn.connection_id} for organizations ${params.id}`);
         })));
-        await Promise.all(connectionsToAdd.map((conn) => this.client.organizations.connections
-            .create(params.id, (0, lodash_1.omit)(conn, 'connection'))
-            .catch(() => {
+        await Promise.all(connectionsToAdd.map((conn) => (0, default_1.retryWithExponentialBackoff)(() => this.client.organizations.connections.create(params.id, (0, lodash_1.omit)(conn, 'connection')), retryConfig).catch(() => {
             throw new Error(`Problem adding Enabled Connection ${conn.connection_id} for organizations ${params.id}`);
         })));
-        await Promise.all(connectionsToRemove.map((conn) => this.client.organizations.connections
-            .delete(params.id, conn.connection_id)
-            .catch(() => {
+        await Promise.all(connectionsToRemove.map((conn) => (0, default_1.retryWithExponentialBackoff)(() => this.client.organizations.connections.delete(params.id, conn.connection_id), retryConfig).catch(() => {
             throw new Error(`Problem removing Enabled Connection ${conn.connection_id} for organizations ${params.id}`);
         })));
         // organization client_grants
@@ -294,6 +303,9 @@ class OrganizationsHandler extends default_1.default {
             ?.map((clientGrant) => ({
             grant_id: this.getClientGrantIDByClientName(clientGrant.client_id),
         })) || [];
+        if (orgClientGrantsToAdd.length > 0 || orgClientGrantsToRemove.length > 0) {
+            changed = true;
+        }
         // Handle updates first
         await Promise.all(orgClientGrantsToAdd.map((orgClientGrant) => this.createOrganizationClientGrants(params.id, orgClientGrant.grant_id).catch(() => {
             throw new Error(`Problem adding organization clientGrant ${orgClientGrant.grant_id} for organizations ${params.id}`);
@@ -315,6 +327,9 @@ class OrganizationsHandler extends default_1.default {
             };
         })
             .filter(Boolean) || [];
+        if (orgDiscoveryDomainsToUpdate.length > 0 || orgDiscoveryDomainsToAdd.length > 0) {
+            changed = true;
+        }
         for (const { id, domain, ...updateParams } of orgDiscoveryDomainsToUpdate) {
             try {
                 await this.updateOrganizationDiscoveryDomain(params.id, id, domain, updateParams);
@@ -338,6 +353,7 @@ class OrganizationsHandler extends default_1.default {
         if (orgDiscoveryDomainsToRemove.length > 0) {
             if (this.config('AUTH0_ALLOW_DELETE') === 'true' ||
                 this.config('AUTH0_ALLOW_DELETE') === true) {
+                changed = true;
                 for (const domain of orgDiscoveryDomainsToRemove) {
                     try {
                         await this.deleteOrganizationDiscoveryDomain(params.id, domain.domain, domain.id);
@@ -375,6 +391,7 @@ class OrganizationsHandler extends default_1.default {
         }))
             .filter((oc) => !!oc.client_id);
         if (orgClientsToAdd.length > 0) {
+            changed = true;
             await this.createOrganizationClients(params.id, orgClientsToAdd).catch((err) => {
                 throw new Error(`Problem adding org clients for organization ${params.id}\n${err}`);
             });
@@ -382,6 +399,7 @@ class OrganizationsHandler extends default_1.default {
         if (orgClientsToRemove.length > 0) {
             if (this.config('AUTH0_ALLOW_DELETE') === 'true' ||
                 this.config('AUTH0_ALLOW_DELETE') === true) {
+                changed = true;
                 await this.deleteOrganizationClients(params.id, orgClientsToRemove).catch((err) => {
                     throw new Error(`Problem removing org clients for organization ${params.id}\n${err}`);
                 });
@@ -390,6 +408,9 @@ class OrganizationsHandler extends default_1.default {
                 logger_1.default.warn(`Detected the following organization client associations should be removed. Doing so may be destructive.\nYou can enable deletes by setting 'AUTH0_ALLOW_DELETE' to true in the config\n${orgClientsToRemove.join('\n')}`);
             }
         }
+        if (orgClientsToUpdate.length > 0) {
+            changed = true;
+        }
         await Promise.all(orgClientsToUpdate.map((oc) => this.client.organizations.clients
             .update(params.id, oc.client_id, {
             use_for_member_access: oc.use_for_member_access,
@@ -397,7 +418,7 @@ class OrganizationsHandler extends default_1.default {
             .catch((err) => {
             throw new Error(`Problem updating org client ${oc.client_id} for organization ${params.id}\n${err}`);
         })));
-        return params;
+        return changed ? params : null;
     }
     getClientGrantIDByClientName(clientsName) {
         const found = this.formattedClientGrants.find((c) => c.client_id === clientsName);
@@ -435,8 +456,10 @@ class OrganizationsHandler extends default_1.default {
             data: updates || [],
             generator: (item) => this.updateOrganization(item, orgs)
                 .then((data) => {
-                this.didUpdate(data);
-                this.updated += 1;
+                if (data) {
+                    this.didUpdate(data);
+                    this.updated += 1;
+                }
             })
                 .catch((err) => {
                 throw new Error(`Problem updating ${this.type} ${this.objString(item)}\n${err}`);

package/lib/tools/auth0/handlers/phoneProvider.js

@@ -202,12 +202,20 @@ class PhoneProviderHandler extends default_1.default {
         }
         const currentProviders = await this.getPhoneProviders();
         const providerReqPayload = (() => {
+            // Work on a shallow copy so we don't mutate the caller's asset (phoneProviders[0]).
+            // The SDK response type doesn't declare `credentials`, so widen it here.
+            const payload = { ...phoneProviders[0] };
             // Removing id from update and create payloads, otherwise API will error
             // id may be required to handle if `--export_ids=true`
-            const payload = phoneProviders[0];
-            if (payload && 'id' in payload) {
+            if ('id' in payload) {
                 delete payload.id;
             }
+            // The `custom` provider requires a `credentials` object in the payload even
+            // when it is empty. Exported configs omit credentials, so inject an empty
+            // object here to avoid a "Missing required property: credentials" 400 error.
+            if (payload.name === 'custom' && payload.credentials == null) {
+                payload.credentials = {};
+            }
             return payload;
         })();
         if (currentProviders === null || currentProviders.length === 0) {

package/lib/tools/calculateDryRunChanges.js

@@ -108,6 +108,13 @@ function normalizeArrayValues(values) {
         .map((value) => normalizeValue(value))
         .sort((left, right) => JSON.stringify(left).localeCompare(JSON.stringify(right)));
 }
+/**
+ * Serializes a value to a human-readable string for use in diff messages.
+ * Objects and arrays are JSON-stringified to avoid "[object Object]" output.
+ */
+function formatDiffValue(value) {
+    return typeof value === 'object' && value !== null ? JSON.stringify(value) : String(value);
+}
 /**
  * Writes the accumulated diff log to a JSON file on disk.
  * Useful for CI pipelines that want a machine-readable dry-run report.
@@ -179,7 +186,7 @@ function getObjectDifferences(localObj, remoteObj, keyObjPath = '', resourceType
                         differences.push(...nestedDifferences);
                     }
                     else if (item !== normalizedRemoteValue[index]) {
-                        const message = `Array item difference at [${currentPath}[${index}]]: local:${item} vs remote:${normalizedRemoteValue[index]}`;
+                        const message = `Array item difference at [${currentPath}[${index}]]: local:${formatDiffValue(item)} vs remote:${formatDiffValue(normalizedRemoteValue[index])}`;
                         differences.push(message);
                     }
                 });
@@ -204,13 +211,10 @@ function getObjectDifferences(localObj, remoteObj, keyObjPath = '', resourceType
             differences.push(...nestedDifferences);
             return;
         }
-        // Compare primitive values — omit array indices from path to reduce log noise
+        // Compare primitive values
         if (localValue !== remoteValue) {
-            let arrayPathRegex = new RegExp(/\[\d+\]/g);
-            if (!arrayPathRegex.test(currentPath)) {
-                const message = `Value difference for [${currentPath}]: local:${localValue} vs remote:${remoteValue}`;
-                differences.push(message);
-            }
+            const message = `Value difference for [${currentPath}]: local:${localValue} vs remote:${remoteValue}`;
+            differences.push(message);
         }
     });
     return differences;
@@ -242,7 +246,7 @@ function calculateDryRunChanges({ type, assets, existing, identifiers = ['id', '
     const create = [];
     const conflicts = [];
     const localAssets = (Array.isArray(assets) ? [...assets] : [assets]).map((asset) => type === 'tenant' ? normalizeTenantForDryRun(asset) : asset);
-    const remoteAssets = (Array.isArray(existing) ? [...existing] : [existing]).map((asset) => (type === 'tenant' ? normalizeTenantForDryRun(asset) : asset));
+    const remoteAssets = (Array.isArray(existing) ? [...existing] : existing ? [existing] : []).map((asset) => (type === 'tenant' ? normalizeTenantForDryRun(asset) : asset));
     // Helper: returns true if a local and remote asset share at least one identifier value
     const assetsMatch = (localAsset, remoteAsset) => identifiers.some((id) => {
         if (Array.isArray(id)) {

package/lib/utils.js

@@ -301,12 +301,15 @@ exports.decodeBase64ToCertString = decodeBase64ToCertString;
 // Format connection options by converting client IDs to client names for SAML connections
 const getFormattedOptions = (connection, clients) => {
     try {
+        const { idpinitiated } = connection.options;
         return {
             options: {
                 ...connection.options,
                 idpinitiated: {
-                    ...connection.options.idpinitiated,
-                    client_id: convertClientIdToName(connection.options.idpinitiated.client_id, clients),
+                    ...idpinitiated,
+                    ...(idpinitiated.client_id && {
+                        client_id: convertClientIdToName(idpinitiated.client_id, clients),
+                    }),
                 },
             },
         };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "auth0-deploy-cli",
-  "version": "8.43.0",
+  "version": "8.44.0",
   "description": "A command line tool for deploying updates to your Auth0 tenant",
   "main": "lib/index.js",
   "bin": {
@@ -35,7 +35,7 @@
   "dependencies": {
     "@clack/prompts": "1.4.0",
     "ajv": "^6.12.6",
-    "auth0": "^6.2.0",
+    "auth0": "^6.3.0",
     "chalk": "5.6.2",
     "dot-prop": "^5.3.0",
     "fs-extra": "^10.1.0",