auth0-deploy-cli 8.43.0 → 8.45.0

package/CHANGELOG.md

@@ -7,6 +7,39 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [8.45.0] - 2026-09-09
+
+### Added
+
+- Support `b2b_integration_configuration` for Enterprise Connect (EA). [#1486]
+- Add `networkACLKeys` handler for HMAC signature key management. [#1480]
+- Support `match_all` in network ACL rules for unconditional block/allow. [#1483]
+- Add `otp_settings` support for database connections. [#1481]
+
+### Fixed
+
+- Prevent export crash when a handler has no identifiers during keyword preservation. [#1487]
+- Catch `feature_not_enabled` via `err.body.errorCode` and 400 status in organizations handler. [#1482]
+- Prevent false `enabled_clients` diff in database dry-run. [#1479]
+
+## [8.44.0] - 2026-08-26
+
+### Added
+
+- Support `third_party_client_access` and `cross_app_access_resource_app` on clients and connections. [#1471]
+
+### Fixed
+
+- Warn on path traversal in file references and fix double-path resolution in YAML connections handler. [#1477]
+- Strip `form_submission_mode` and `form_submission_behavior` from `bruteForceProtection` on export and import. [#1476]
+- Include empty credentials for custom phone provider on import and export to prevent 400 errors. [#1474]
+- Preserve keyword placeholder strings for all email provider credentials. [#1470]
+- Preserve `idpinitiated.enabled:false` on SAML connection export instead of emitting `undefined_clientId`. [#1465]
+- Apply 429 backoff to organization connection writes to prevent rate-limit failures. [#1464]
+- Resolve dry-run reporting bugs across multiple asset types. [#1462]
+- Skip organization PATCH when no top-level properties have changed. [#1461]
+- Sort `attackProtection` arrays on export to prevent spurious diffs. [#1460]
+
 ## [8.43.0] - 2026-08-12
 
 ### Added
@@ -1927,7 +1960,26 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 [#1454]: https://github.com/auth0/auth0-deploy-cli/issues/1454
 [#1456]: https://github.com/auth0/auth0-deploy-cli/issues/1456
 [#1457]: https://github.com/auth0/auth0-deploy-cli/issues/1457
-[Unreleased]: https://github.com/auth0/auth0-deploy-cli/compare/v8.43.0...HEAD
+[#1460]: https://github.com/auth0/auth0-deploy-cli/issues/1460
+[#1461]: https://github.com/auth0/auth0-deploy-cli/issues/1461
+[#1462]: https://github.com/auth0/auth0-deploy-cli/issues/1462
+[#1464]: https://github.com/auth0/auth0-deploy-cli/issues/1464
+[#1465]: https://github.com/auth0/auth0-deploy-cli/issues/1465
+[#1470]: https://github.com/auth0/auth0-deploy-cli/issues/1470
+[#1471]: https://github.com/auth0/auth0-deploy-cli/issues/1471
+[#1474]: https://github.com/auth0/auth0-deploy-cli/issues/1474
+[#1476]: https://github.com/auth0/auth0-deploy-cli/issues/1476
+[#1477]: https://github.com/auth0/auth0-deploy-cli/issues/1477
+[#1479]: https://github.com/auth0/auth0-deploy-cli/issues/1479
+[#1480]: https://github.com/auth0/auth0-deploy-cli/issues/1480
+[#1481]: https://github.com/auth0/auth0-deploy-cli/issues/1481
+[#1482]: https://github.com/auth0/auth0-deploy-cli/issues/1482
+[#1483]: https://github.com/auth0/auth0-deploy-cli/issues/1483
+[#1486]: https://github.com/auth0/auth0-deploy-cli/issues/1486
+[#1487]: https://github.com/auth0/auth0-deploy-cli/issues/1487
+[Unreleased]: https://github.com/auth0/auth0-deploy-cli/compare/v8.45.0...HEAD
+[8.45.0]: https://github.com/auth0/auth0-deploy-cli/compare/v8.44.0...v8.45.0
+[8.44.0]: https://github.com/auth0/auth0-deploy-cli/compare/v8.43.0...v8.44.0
 [8.43.0]: https://github.com/auth0/auth0-deploy-cli/compare/v8.42.0...v8.43.0
 [8.42.0]: https://github.com/auth0/auth0-deploy-cli/compare/v8.41.0...v8.42.0
 [8.41.0]: https://github.com/auth0/auth0-deploy-cli/compare/v8.40.0...v8.41.0

package/README.md

@@ -8,7 +8,7 @@
 
 The Auth0 Deploy CLI is a tool that helps you manage your Auth0 tenant configuration. It integrates into your development workflows as a standalone CLI or as a node module.
 
-**Supported resource types:** actions, branding, client grants, clients (applications), connections, databases, custom domains, email templates, emails, grants, guardian, hook secrets, log streams, organizations, pages, prompts, resource servers (APIs), roles, tenant settings, themes, forms, flows, self-service profiles, network ACLs.
+**Supported resource types:** actions, branding, client grants, clients (applications), connections, databases, custom domains, email templates, emails, grants, guardian, hook secrets, log streams, organizations, pages, prompts, resource servers (APIs), roles, tenant settings, themes, forms, flows, self-service profiles, network ACLs, network ACL keys.
 
 🎢 [Highlights](#highlights) • 📚 [Documentation](#documentation) • 🚀 [Getting Started](#getting-started) • 📝 [Feedback](#feedback) • 💬 [Discussions](https://github.com/auth0/auth0-deploy-cli/discussions)
 

package/lib/context/defaults.d.ts

@@ -6,4 +6,11 @@ export declare function phoneTemplatesDefaults(phoneTemplate: any): any;
 export declare function connectionDefaults(connection: any, config?: Pick<Config, 'AUTH0_EXPORT_SECRETS'>): any;
 export declare function logStreamDefaults(logStreams: any, config?: Pick<Config, 'AUTH0_EXPORT_SECRETS'>): any;
 export declare function eventStreamDefaults(eventStreams: any[], config?: Pick<Config, 'AUTH0_EXPORT_SECRETS'>): any[];
+/**
+ * Sorts primitive arrays (e.g. `shields`, `admin_notification_frequency`) within the
+ * attackProtection subtree in place, so repeated exports produce deterministic output.
+ * These are unordered, string-typed enum sets — ordering is cosmetic. Object arrays are
+ * left as-is.
+ */
+export declare function sortAttackProtectionArrays(attackProtection: AttackProtection): AttackProtection;
 export declare function attackProtectionDefaults(attackProtection: AttackProtection, config?: Pick<Config, 'AUTH0_EXPORT_SECRETS'>): AttackProtection;

package/lib/context/defaults.js

@@ -6,6 +6,7 @@ exports.phoneTemplatesDefaults = phoneTemplatesDefaults;
 exports.connectionDefaults = connectionDefaults;
 exports.logStreamDefaults = logStreamDefaults;
 exports.eventStreamDefaults = eventStreamDefaults;
+exports.sortAttackProtectionArrays = sortAttackProtectionArrays;
 exports.attackProtectionDefaults = attackProtectionDefaults;
 const utils_1 = require("../tools/utils");
 // env vars arrive as strings, so check both forms
@@ -22,45 +23,57 @@ function emailProviderDefaults(emailProvider, config) {
     // Add placeholder for credentials as they cannot be exported
     const { name } = updated;
     if (apiKeyProviders.includes(name)) {
-        updated.credentials = {
-            api_key: `##${name.toUpperCase()}_API_KEY##`,
-            ...(updated.credentials || {}),
-        };
+        if (typeof updated.credentials !== 'string') {
+            updated.credentials = {
+                api_key: `##${name.toUpperCase()}_API_KEY##`,
+                ...(updated.credentials || {}),
+            };
+        }
     }
     if (name === 'smtp') {
-        // This is to mask smtp_user to '##SMTP_USER##'
-        if (updated.credentials && 'smtp_user' in updated.credentials) {
-            delete updated.credentials.smtp_user;
+        // If credentials is a keyword placeholder string (e.g. @@SMTP_CREDENTIALS@@), preserve it as-is.
+        // The `in` operator requires an object and would throw a TypeError on a string.
+        if (typeof updated.credentials !== 'string') {
+            // This is to mask smtp_user to '##SMTP_USER##'
+            if (updated.credentials && 'smtp_user' in updated.credentials) {
+                delete updated.credentials.smtp_user;
+            }
+            updated.credentials = {
+                smtp_host: '##SMTP_HOSTNAME##',
+                smtp_port: '##SMTP_PORT##',
+                smtp_user: '##SMTP_USER##',
+                smtp_pass: '##SMTP_PASS##',
+                ...(updated.credentials || {}),
+            };
         }
-        updated.credentials = {
-            smtp_host: '##SMTP_HOSTNAME##',
-            smtp_port: '##SMTP_PORT##',
-            smtp_user: '##SMTP_USER##',
-            smtp_pass: '##SMTP_PASS##',
-            ...(updated.credentials || {}),
-        };
     }
     if (name === 'ses') {
-        updated.credentials = {
-            accessKeyId: '##SES_ACCESS_KEY_ID##',
-            secretAccessKey: '##SES_ACCESS_SECRET_KEY##',
-            region: '##SES_AWS_REGION##',
-            ...(updated.credentials || {}),
-        };
+        if (typeof updated.credentials !== 'string') {
+            updated.credentials = {
+                accessKeyId: '##SES_ACCESS_KEY_ID##',
+                secretAccessKey: '##SES_ACCESS_SECRET_KEY##',
+                region: '##SES_AWS_REGION##',
+                ...(updated.credentials || {}),
+            };
+        }
     }
     if (name === 'azure_cs') {
-        updated.credentials = {
-            connectionString: '##AZURE_CS_CONNECTION_KEY##',
-            ...(updated.credentials || {}),
-        };
+        if (typeof updated.credentials !== 'string') {
+            updated.credentials = {
+                connectionString: '##AZURE_CS_CONNECTION_KEY##',
+                ...(updated.credentials || {}),
+            };
+        }
     }
     if (name === 'ms365') {
-        updated.credentials = {
-            tenantId: '##MS365_TENANT_ID##',
-            clientId: '##MS365_CLIENT_ID##',
-            clientSecret: '##MS365_CLIENT_SECRET##',
-            ...(updated.credentials || {}),
-        };
+        if (typeof updated.credentials !== 'string') {
+            updated.credentials = {
+                tenantId: '##MS365_TENANT_ID##',
+                clientId: '##MS365_CLIENT_ID##',
+                clientSecret: '##MS365_CLIENT_SECRET##',
+                ...(updated.credentials || {}),
+            };
+        }
     }
     return updated;
 }
@@ -87,6 +100,12 @@ function phoneProviderDefaults(phoneProvider) {
             auth_token: `##${name.toUpperCase()}_AUTH_TOKEN##`,
         };
     }
+    else if (name === 'custom') {
+        // The `custom` provider has no exportable secrets, but the API requires a
+        // `credentials` object on import even when empty. Emit an empty object so
+        // exported configs round-trip cleanly.
+        updated.credentials = {};
+    }
     return updated;
 }
 function phoneTemplatesDefaults(phoneTemplate) {
@@ -193,6 +212,31 @@ function eventStreamDefaults(eventStreams, config) {
         };
     });
 }
+/**
+ * Sorts primitive arrays (e.g. `shields`, `admin_notification_frequency`) within the
+ * attackProtection subtree in place, so repeated exports produce deterministic output.
+ * These are unordered, string-typed enum sets — ordering is cosmetic. Object arrays are
+ * left as-is.
+ */
+function sortAttackProtectionArrays(attackProtection) {
+    const sortArraysDeep = (value) => {
+        if (Array.isArray(value)) {
+            const isPrimitiveArray = value.every((item) => item === null || typeof item !== 'object');
+            if (isPrimitiveArray) {
+                value.sort();
+            }
+            else {
+                value.forEach(sortArraysDeep);
+            }
+            return;
+        }
+        if (value && typeof value === 'object') {
+            Object.values(value).forEach(sortArraysDeep);
+        }
+    };
+    sortArraysDeep(attackProtection);
+    return attackProtection;
+}
 function attackProtectionDefaults(attackProtection, config) {
     if (isExportSecrets(config))
         return attackProtection;

package/lib/context/directory/handlers/attackProtection.js

@@ -65,7 +65,7 @@ async function dump(context) {
         return;
     const files = attackProtectionFiles(context.filePath);
     fs_extra_1.default.ensureDirSync(files.directory);
-    const maskedAttackProtection = (0, defaults_1.attackProtectionDefaults)(attackProtection, context.config);
+    const maskedAttackProtection = (0, defaults_1.sortAttackProtectionArrays)((0, defaults_1.attackProtectionDefaults)(attackProtection, context.config));
     if (maskedAttackProtection.botDetection) {
         (0, utils_1.dumpJSON)(files.botDetection, maskedAttackProtection.botDetection);
     }

package/lib/context/directory/handlers/branding.js

@@ -6,6 +6,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 const path_1 = __importDefault(require("path"));
 const fs_extra_1 = __importDefault(require("fs-extra"));
 const tools_1 = require("../../../tools");
+const logger_1 = __importDefault(require("../../../logger"));
 const utils_1 = require("../../../utils");
 function parse(context) {
     const brandingDirectory = path_1.default.join(context.filePath, tools_1.constants.BRANDING_DIRECTORY);
@@ -31,7 +32,14 @@ function parse(context) {
             disableKeywordReplacement: context.disableKeywordReplacement,
         });
         const normalizedPathArray = (0, utils_1.nomalizedYAMLPath)(definition.body);
-        definition.body = (0, tools_1.loadFileAndReplaceKeywords)(path_1.default.join(brandingTemplatesFolder, ...normalizedPathArray), {
+        const resolvedBodyFile = path_1.default.resolve(brandingTemplatesFolder, ...normalizedPathArray);
+        const configRoot = path_1.default.resolve(context.filePath);
+        if (!resolvedBodyFile.startsWith(configRoot + path_1.default.sep)) {
+            logger_1.default.warn(`Branding template body path "${definition.body}" resolves to "${resolvedBodyFile}" which is outside the config directory "${configRoot}". ` +
+                `This will be blocked as an error in the next major release. ` +
+                `Move the file inside your config directory.`);
+        }
+        definition.body = (0, tools_1.loadFileAndReplaceKeywords)(resolvedBodyFile, {
             mappings: context.mappings,
             disableKeywordReplacement: context.disableKeywordReplacement,
         });

package/lib/context/directory/handlers/clients.js

@@ -20,9 +20,15 @@ function parse(context) {
             disableKeywordReplacement: context.disableKeywordReplacement,
         });
         if (client.custom_login_page) {
-            const htmlFileName = path_1.default.join(clientsFolder, client.custom_login_page);
-            if ((0, utils_1.isFile)(htmlFileName)) {
-                client.custom_login_page = (0, tools_1.loadFileAndReplaceKeywords)(htmlFileName, {
+            const configRoot = path_1.default.resolve(context.filePath);
+            const resolvedLoginPage = path_1.default.resolve(clientsFolder, client.custom_login_page);
+            if ((0, utils_1.isFile)(resolvedLoginPage)) {
+                if (!resolvedLoginPage.startsWith(configRoot + path_1.default.sep)) {
+                    logger_1.default.warn(`Path "${client.custom_login_page}" resolves to "${resolvedLoginPage}" which is outside the config directory "${configRoot}". ` +
+                        `This will be blocked as an error in the next major release. ` +
+                        `Move the file inside your config directory.`);
+                }
+                client.custom_login_page = (0, tools_1.loadFileAndReplaceKeywords)(resolvedLoginPage, {
                     mappings: context.mappings,
                     disableKeywordReplacement: context.disableKeywordReplacement,
                 });

package/lib/context/directory/handlers/connections.js

@@ -23,11 +23,17 @@ function parse(context) {
         });
         if (connection.strategy === 'email') {
             (0, utils_1.ensureProp)(connection, 'options.email.body');
-            const htmlFileName = path_1.default.join(connectionsFolder, connection.options.email.body);
-            if (!(0, utils_1.isFile)(htmlFileName)) {
-                throw new Error(`Passwordless email template purportedly located at ${htmlFileName} does not exist for connection. Ensure the existence of this file to proceed with deployment.`);
+            const configRoot = path_1.default.resolve(context.filePath);
+            const resolvedHtmlFile = path_1.default.resolve(connectionsFolder, connection.options.email.body);
+            if (!(0, utils_1.isFile)(resolvedHtmlFile)) {
+                throw new Error(`Passwordless email template purportedly located at ${resolvedHtmlFile} does not exist for connection. Ensure the existence of this file to proceed with deployment.`);
             }
-            connection.options.email.body = (0, tools_1.loadFileAndReplaceKeywords)(htmlFileName, {
+            if (!resolvedHtmlFile.startsWith(configRoot + path_1.default.sep)) {
+                logger_1.default.warn(`Path "${connection.options.email.body}" resolves to "${resolvedHtmlFile}" which is outside the config directory "${configRoot}". ` +
+                    `This will be blocked as an error in the next major release. ` +
+                    `Move the file inside your config directory.`);
+            }
+            connection.options.email.body = (0, tools_1.loadFileAndReplaceKeywords)(resolvedHtmlFile, {
                 mappings: context.mappings,
                 disableKeywordReplacement: context.disableKeywordReplacement,
             });

package/lib/context/directory/handlers/emailTemplates.js

@@ -34,6 +34,15 @@ function parse(context) {
             logger_1.default.warn(`Skipping email template file ${meta.body} as missing the corresponding '.json' file`);
             return [];
         }
+        if (meta.body !== undefined) {
+            const configRoot = path_1.default.resolve(context.filePath);
+            const resolvedTemplatePath = path_1.default.resolve(templateFilePath);
+            if (!resolvedTemplatePath.startsWith(configRoot + path_1.default.sep)) {
+                logger_1.default.warn(`Email template body path "${meta.body}" resolves to "${resolvedTemplatePath}" which is outside the config directory "${configRoot}". ` +
+                    `This will be blocked as an error in the next major release. ` +
+                    `Move the file inside your config directory.`);
+            }
+        }
         return {
             ...meta,
             body: (0, tools_1.loadFileAndReplaceKeywords)(templateFilePath, {

package/lib/context/directory/handlers/index.js

@@ -38,6 +38,7 @@ const rulesConfigs_1 = __importDefault(require("./rulesConfigs"));
 const forms_1 = __importDefault(require("./forms"));
 const flows_1 = __importDefault(require("./flows"));
 const flowVaultConnections_1 = __importDefault(require("./flowVaultConnections"));
+const networkACLKeys_1 = __importDefault(require("./networkACLKeys"));
 const networkACLs_1 = __importDefault(require("./networkACLs"));
 const userAttributeProfiles_1 = __importDefault(require("./userAttributeProfiles"));
 const connectionProfiles_1 = __importDefault(require("./connectionProfiles"));
@@ -84,6 +85,7 @@ const directoryHandlers = {
     flows: flows_1.default,
     flowVaultConnections: flowVaultConnections_1.default,
     selfServiceProfiles: selfServiceProfiles_1.default,
+    networkACLKeys: networkACLKeys_1.default,
     networkACLs: networkACLs_1.default,
     userAttributeProfiles: userAttributeProfiles_1.default,
     connectionProfiles: connectionProfiles_1.default,

package/lib/context/directory/handlers/networkACLKeys.d.ts

@@ -0,0 +1,6 @@
+import { DirectoryHandler } from '.';
+import { ParsedAsset } from '../../../types';
+import { NetworkAclKey } from '../../../tools/auth0/handlers/networkACLKeys';
+type ParsedNetworkACLKeys = ParsedAsset<'networkACLKeys', NetworkAclKey[]>;
+declare const networkACLKeysHandler: DirectoryHandler<ParsedNetworkACLKeys>;
+export default networkACLKeysHandler;

package/lib/context/directory/handlers/networkACLKeys.js

@@ -0,0 +1,54 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const path_1 = __importDefault(require("path"));
+const fs_extra_1 = __importDefault(require("fs-extra"));
+const tools_1 = require("../../../tools");
+const utils_1 = require("../../../utils");
+const logger_1 = __importDefault(require("../../../logger"));
+function parse(context) {
+    const networkACLKeysDirectory = path_1.default.join(context.filePath, tools_1.constants.NETWORK_ACL_KEYS_DIRECTORY);
+    if (!(0, utils_1.existsMustBeDir)(networkACLKeysDirectory))
+        return { networkACLKeys: null }; // Skip
+    const foundFiles = (0, utils_1.getFiles)(networkACLKeysDirectory, ['.json']);
+    const networkACLKeys = foundFiles
+        .map((f) => (0, utils_1.loadJSON)(f, {
+        mappings: context.mappings,
+        disableKeywordReplacement: context.disableKeywordReplacement,
+    }))
+        .filter((p) => Object.keys(p).length > 0); // Filter out empty configs
+    return {
+        networkACLKeys,
+    };
+}
+async function dump(context) {
+    const { networkACLKeys } = context.assets;
+    if (!networkACLKeys)
+        return; // Skip, nothing to dump
+    if (Array.isArray(networkACLKeys) && networkACLKeys.length === 0) {
+        logger_1.default.info('No network ACL keys available, skipping dump');
+        return;
+    }
+    const networkACLKeysDirectory = path_1.default.join(context.filePath, tools_1.constants.NETWORK_ACL_KEYS_DIRECTORY);
+    fs_extra_1.default.ensureDirSync(networkACLKeysDirectory);
+    // value is write-only — never returned by the API and must not be exported.
+    // created_at and updated_at are API-generated metadata; not needed in config.
+    const removeKeysFromOutput = ['value', 'created_at', 'updated_at'];
+    networkACLKeys.forEach((networkACLKey) => {
+        const out = { ...networkACLKey };
+        removeKeysFromOutput.forEach((key) => {
+            if (key in out)
+                delete out[key];
+        });
+        const fileName = (0, utils_1.sanitize)(networkACLKey.name);
+        const filePath = path_1.default.join(networkACLKeysDirectory, `${fileName}.json`);
+        (0, utils_1.dumpJSON)(filePath, out);
+    });
+}
+const networkACLKeysHandler = {
+    parse,
+    dump,
+};
+exports.default = networkACLKeysHandler;

package/lib/context/directory/handlers/prompts.js

@@ -6,6 +6,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 const path_1 = __importDefault(require("path"));
 const fs_extra_1 = require("fs-extra");
 const tools_1 = require("../../../tools");
+const logger_1 = __importDefault(require("../../../logger"));
 const utils_1 = require("../../../utils");
 const getPromptsDirectory = (filePath) => path_1.default.join(filePath, tools_1.constants.PROMPTS_DIRECTORY);
 const getPromptsSettingsFile = (promptsDirectory) => path_1.default.join(promptsDirectory, 'prompts.json');
@@ -46,9 +47,16 @@ function parse(context) {
             const screensObject = screensArray[0];
             acc[promptName] = Object.entries(screensObject).reduce((screenAcc, [screenName, items]) => {
                 screenAcc[screenName] = items.reduce((insertionAcc, { name, template }) => {
-                    const templateFilePath = path_1.default.join(promptsDirectory, template);
-                    insertionAcc[name] = (0, utils_1.isFile)(templateFilePath)
-                        ? (0, tools_1.loadFileAndReplaceKeywords)(templateFilePath, {
+                    const configRoot = path_1.default.resolve(context.filePath);
+                    const resolvedTemplatePath = path_1.default.resolve(promptsDirectory, template);
+                    if ((0, utils_1.isFile)(resolvedTemplatePath) &&
+                        !resolvedTemplatePath.startsWith(configRoot + path_1.default.sep)) {
+                        logger_1.default.warn(`Prompt partial template "${template}" resolves to "${resolvedTemplatePath}" which is outside the config directory "${configRoot}". ` +
+                            `This will be blocked as an error in the next major release. ` +
+                            `Move the file inside your config directory.`);
+                    }
+                    insertionAcc[name] = (0, utils_1.isFile)(resolvedTemplatePath)
+                        ? (0, tools_1.loadFileAndReplaceKeywords)(resolvedTemplatePath, {
                             mappings: context.mappings,
                             disableKeywordReplacement: context.disableKeywordReplacement,
                         }).trim()

package/lib/context/yaml/handlers/attackProtection.js

@@ -27,7 +27,7 @@ async function dump(context) {
     }
     const maskedAttackProtection = (0, defaults_1.attackProtectionDefaults)(attackProtectionConfig, context.config);
     return {
-        attackProtection: maskedAttackProtection,
+        attackProtection: (0, defaults_1.sortAttackProtectionArrays)(maskedAttackProtection),
     };
 }
 const attackProtectionHandler = {

package/lib/context/yaml/handlers/branding.js

@@ -18,9 +18,16 @@ async function parse(context) {
     const parsedTemplates = templates.map((templateDefinition) => {
         const normalizedPathArray = (0, utils_1.nomalizedYAMLPath)(templateDefinition.body);
         const markupFile = path_1.default.join(context.basePath, ...normalizedPathArray);
+        const configRoot = path_1.default.resolve(context.basePath);
+        const resolvedMarkupFile = path_1.default.resolve(markupFile);
+        if (!resolvedMarkupFile.startsWith(configRoot + path_1.default.sep)) {
+            logger_1.default.warn(`Branding template body path "${templateDefinition.body}" resolves to "${resolvedMarkupFile}" which is outside the config directory "${configRoot}". ` +
+                `This will be blocked as an error in the next major release. ` +
+                `Move the file inside your config directory.`);
+        }
         return {
             template: templateDefinition.template,
-            body: (0, tools_1.loadFileAndReplaceKeywords)(markupFile, {
+            body: (0, tools_1.loadFileAndReplaceKeywords)(resolvedMarkupFile, {
                 mappings: context.mappings,
                 disableKeywordReplacement: context.disableKeywordReplacement,
             }),

package/lib/context/yaml/handlers/clients.js

@@ -21,7 +21,10 @@ async function parse(context) {
                 if (client.custom_login_page) {
                     const htmlFileName = path_1.default.join(clientsFolder, client.custom_login_page);
                     if ((0, utils_1.isFile)(htmlFileName)) {
-                        client.custom_login_page = context.loadFile(htmlFileName);
+                        // Pass a path relative to basePath so context.loadFile() resolves it correctly.
+                        // Passing htmlFileName (which already includes basePath) would cause double resolution
+                        // when basePath is a relative path (e.g. when AUTH0_INPUT_FILE is a relative path).
+                        client.custom_login_page = context.loadFile(path_1.default.join(tools_1.constants.CLIENTS_DIRECTORY, client.custom_login_page));
                     }
                 }
                 return client;

package/lib/context/yaml/handlers/connections.js

@@ -26,7 +26,9 @@ async function parse(context) {
                         logger_1.default.error(missingTemplateErrorMessage);
                         throw new Error(missingTemplateErrorMessage);
                     }
-                    connection.options.email.body = context.loadFile(htmlFileName);
+                    // Pass a path relative to basePath so context.loadFile() resolves it correctly.
+                    // Passing htmlFileName (which already includes basePath) would cause double resolution.
+                    connection.options.email.body = context.loadFile(path_1.default.join(tools_1.constants.CONNECTIONS_DIRECTORY, connection.options.email.body));
                 }
                 return connection;
             }),

package/lib/context/yaml/handlers/flows.js

@@ -14,6 +14,13 @@ async function parse(context) {
         return { flows: null };
     const parsedFlows = flows.map((flow) => {
         const flowFile = path_1.default.join(context.basePath, flow.body);
+        const configRoot = path_1.default.resolve(context.basePath);
+        const resolvedFlowFile = path_1.default.resolve(flowFile);
+        if (!resolvedFlowFile.startsWith(configRoot + path_1.default.sep)) {
+            logger_1.default.warn(`Flow body file "${flow.body}" resolves to "${resolvedFlowFile}" which is outside the config directory "${configRoot}". ` +
+                `This will be blocked as an error in the next major release. ` +
+                `Move the file inside your config directory.`);
+        }
         const parsedFlowBody = (0, utils_1.loadJSON)(flowFile, {
             mappings: context.mappings,
             disableKeywordReplacement: context.disableKeywordReplacement,

package/lib/context/yaml/handlers/forms.js

@@ -14,6 +14,13 @@ async function parse(context) {
         return { forms: null };
     const parsedForms = forms.map((form) => {
         const formFile = path_1.default.join(context.basePath, form.body);
+        const configRoot = path_1.default.resolve(context.basePath);
+        const resolvedFormFile = path_1.default.resolve(formFile);
+        if (!resolvedFormFile.startsWith(configRoot + path_1.default.sep)) {
+            logger_1.default.warn(`Form body file "${form.body}" resolves to "${resolvedFormFile}" which is outside the config directory "${configRoot}". ` +
+                `This will be blocked as an error in the next major release. ` +
+                `Move the file inside your config directory.`);
+        }
         const parsedFormBody = (0, utils_1.loadJSON)(formFile, {
             mappings: context.mappings,
             disableKeywordReplacement: context.disableKeywordReplacement,

package/lib/context/yaml/handlers/index.js

@@ -38,6 +38,7 @@ const hooks_1 = __importDefault(require("./hooks"));
 const forms_1 = __importDefault(require("./forms"));
 const flows_1 = __importDefault(require("./flows"));
 const flowVaultConnections_1 = __importDefault(require("./flowVaultConnections"));
+const networkACLKeys_1 = __importDefault(require("./networkACLKeys"));
 const networkACLs_1 = __importDefault(require("./networkACLs"));
 const userAttributeProfiles_1 = __importDefault(require("./userAttributeProfiles"));
 const connectionProfiles_1 = __importDefault(require("./connectionProfiles"));
@@ -84,6 +85,7 @@ const yamlHandlers = {
     flows: flows_1.default,
     flowVaultConnections: flowVaultConnections_1.default,
     selfServiceProfiles: selfServiceProfiles_1.default,
+    networkACLKeys: networkACLKeys_1.default,
     networkACLs: networkACLs_1.default,
     userAttributeProfiles: userAttributeProfiles_1.default,
     connectionProfiles: connectionProfiles_1.default,

package/lib/context/yaml/handlers/networkACLKeys.d.ts

@@ -0,0 +1,6 @@
+import { YAMLHandler } from '.';
+import { ParsedAsset } from '../../../types';
+import { NetworkAclKey } from '../../../tools/auth0/handlers/networkACLKeys';
+type ParsedNetworkACLKeys = ParsedAsset<'networkACLKeys', NetworkAclKey[]>;
+declare const networkACLKeysHandler: YAMLHandler<ParsedNetworkACLKeys>;
+export default networkACLKeysHandler;

package/lib/context/yaml/handlers/networkACLKeys.js

@@ -0,0 +1,42 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const logger_1 = __importDefault(require("../../../logger"));
+async function parse(context) {
+    const { networkACLKeys } = context.assets;
+    if (!networkACLKeys)
+        return { networkACLKeys: null };
+    return {
+        networkACLKeys,
+    };
+}
+async function dump(context) {
+    let { networkACLKeys } = context.assets;
+    if (!networkACLKeys)
+        return { networkACLKeys: null };
+    if (Array.isArray(networkACLKeys) && networkACLKeys.length === 0) {
+        logger_1.default.info('No network ACL keys available, skipping dump');
+        return { networkACLKeys: null };
+    }
+    // value is write-only — never returned by the API and must not be exported.
+    // created_at and updated_at are API-generated metadata; not needed in config.
+    const removeKeysFromOutput = ['value', 'created_at', 'updated_at'];
+    networkACLKeys = networkACLKeys.map((key) => {
+        const out = { ...key };
+        removeKeysFromOutput.forEach((k) => {
+            if (k in out)
+                delete out[k];
+        });
+        return out;
+    });
+    return {
+        networkACLKeys,
+    };
+}
+const networkACLKeysHandler = {
+    parse,
+    dump,
+};
+exports.default = networkACLKeysHandler;

package/lib/context/yaml/handlers/prompts.js

@@ -19,7 +19,13 @@ const loadScreenRenderers = (context, screenRenderArray) => {
         Object.entries(screens).forEach(([, fileName]) => {
             const filePath = fileName;
             try {
-                const rendererFile = path_1.default.join(context.basePath, filePath);
+                const configRoot = path_1.default.resolve(context.basePath);
+                const rendererFile = path_1.default.resolve(context.basePath, filePath);
+                if (!rendererFile.startsWith(configRoot + path_1.default.sep)) {
+                    logger_1.default.warn(`Screen renderer file "${filePath}" resolves to "${rendererFile}" which is outside the config directory "${configRoot}". ` +
+                        `This will be blocked as an error in the next major release. ` +
+                        `Move the file inside your config directory.`);
+                }
                 const rendererData = (0, utils_1.loadJSON)(rendererFile, {
                     mappings: context.mappings,
                     disableKeywordReplacement: context.disableKeywordReplacement,

package/lib/keywordPreservation.d.ts

@@ -10,6 +10,6 @@ export declare const preserveKeywords: ({ localAssets, remoteAssets, keywordMapp
     remoteAssets: object;
     keywordMappings: KeywordMappings;
     auth0Handlers: (Pick<APIHandler, "id" | "type"> & {
-        identifiers: (string | string[])[];
+        identifiers?: (string | string[])[];
     })[];
 }) => object;

package/lib/keywordPreservation.js

@@ -164,7 +164,8 @@ const preserveKeywords = ({ localAssets, remoteAssets, keywordMappings, auth0Han
     if (Object.keys(keywordMappings).length === 0)
         return remoteAssets;
     const resourceSpecificIdentifiers = auth0Handlers.reduce((acc, handler) => {
-        acc[handler.type] = handler.identifiers.flat();
+        // Standalone handlers (e.g. clientAuthCredentials) don't extend APIHandler and have no identifiers.
+        acc[handler.type] = (handler.identifiers ?? []).flat();
         return acc;
     }, {});
     const addresses = (0, exports.getPreservableFieldsFromAssets)(localAssets, keywordMappings, resourceSpecificIdentifiers, '');