auth0-deploy-cli 8.44.0 → 8.45.0

package/CHANGELOG.md

@@ -7,6 +7,21 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [8.45.0] - 2026-09-09
+
+### Added
+
+- Support `b2b_integration_configuration` for Enterprise Connect (EA). [#1486]
+- Add `networkACLKeys` handler for HMAC signature key management. [#1480]
+- Support `match_all` in network ACL rules for unconditional block/allow. [#1483]
+- Add `otp_settings` support for database connections. [#1481]
+
+### Fixed
+
+- Prevent export crash when a handler has no identifiers during keyword preservation. [#1487]
+- Catch `feature_not_enabled` via `err.body.errorCode` and 400 status in organizations handler. [#1482]
+- Prevent false `enabled_clients` diff in database dry-run. [#1479]
+
 ## [8.44.0] - 2026-08-26
 
 ### Added
@@ -1955,7 +1970,15 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 [#1474]: https://github.com/auth0/auth0-deploy-cli/issues/1474
 [#1476]: https://github.com/auth0/auth0-deploy-cli/issues/1476
 [#1477]: https://github.com/auth0/auth0-deploy-cli/issues/1477
-[Unreleased]: https://github.com/auth0/auth0-deploy-cli/compare/v8.44.0...HEAD
+[#1479]: https://github.com/auth0/auth0-deploy-cli/issues/1479
+[#1480]: https://github.com/auth0/auth0-deploy-cli/issues/1480
+[#1481]: https://github.com/auth0/auth0-deploy-cli/issues/1481
+[#1482]: https://github.com/auth0/auth0-deploy-cli/issues/1482
+[#1483]: https://github.com/auth0/auth0-deploy-cli/issues/1483
+[#1486]: https://github.com/auth0/auth0-deploy-cli/issues/1486
+[#1487]: https://github.com/auth0/auth0-deploy-cli/issues/1487
+[Unreleased]: https://github.com/auth0/auth0-deploy-cli/compare/v8.45.0...HEAD
+[8.45.0]: https://github.com/auth0/auth0-deploy-cli/compare/v8.44.0...v8.45.0
 [8.44.0]: https://github.com/auth0/auth0-deploy-cli/compare/v8.43.0...v8.44.0
 [8.43.0]: https://github.com/auth0/auth0-deploy-cli/compare/v8.42.0...v8.43.0
 [8.42.0]: https://github.com/auth0/auth0-deploy-cli/compare/v8.41.0...v8.42.0

package/README.md

@@ -8,7 +8,7 @@
 
 The Auth0 Deploy CLI is a tool that helps you manage your Auth0 tenant configuration. It integrates into your development workflows as a standalone CLI or as a node module.
 
-**Supported resource types:** actions, branding, client grants, clients (applications), connections, databases, custom domains, email templates, emails, grants, guardian, hook secrets, log streams, organizations, pages, prompts, resource servers (APIs), roles, tenant settings, themes, forms, flows, self-service profiles, network ACLs.
+**Supported resource types:** actions, branding, client grants, clients (applications), connections, databases, custom domains, email templates, emails, grants, guardian, hook secrets, log streams, organizations, pages, prompts, resource servers (APIs), roles, tenant settings, themes, forms, flows, self-service profiles, network ACLs, network ACL keys.
 
 🎢 [Highlights](#highlights) • 📚 [Documentation](#documentation) • 🚀 [Getting Started](#getting-started) • 📝 [Feedback](#feedback) • 💬 [Discussions](https://github.com/auth0/auth0-deploy-cli/discussions)
 

package/lib/context/directory/handlers/index.js

@@ -38,6 +38,7 @@ const rulesConfigs_1 = __importDefault(require("./rulesConfigs"));
 const forms_1 = __importDefault(require("./forms"));
 const flows_1 = __importDefault(require("./flows"));
 const flowVaultConnections_1 = __importDefault(require("./flowVaultConnections"));
+const networkACLKeys_1 = __importDefault(require("./networkACLKeys"));
 const networkACLs_1 = __importDefault(require("./networkACLs"));
 const userAttributeProfiles_1 = __importDefault(require("./userAttributeProfiles"));
 const connectionProfiles_1 = __importDefault(require("./connectionProfiles"));
@@ -84,6 +85,7 @@ const directoryHandlers = {
     flows: flows_1.default,
     flowVaultConnections: flowVaultConnections_1.default,
     selfServiceProfiles: selfServiceProfiles_1.default,
+    networkACLKeys: networkACLKeys_1.default,
     networkACLs: networkACLs_1.default,
     userAttributeProfiles: userAttributeProfiles_1.default,
     connectionProfiles: connectionProfiles_1.default,

package/lib/context/directory/handlers/networkACLKeys.d.ts

@@ -0,0 +1,6 @@
+import { DirectoryHandler } from '.';
+import { ParsedAsset } from '../../../types';
+import { NetworkAclKey } from '../../../tools/auth0/handlers/networkACLKeys';
+type ParsedNetworkACLKeys = ParsedAsset<'networkACLKeys', NetworkAclKey[]>;
+declare const networkACLKeysHandler: DirectoryHandler<ParsedNetworkACLKeys>;
+export default networkACLKeysHandler;

package/lib/context/directory/handlers/networkACLKeys.js

@@ -0,0 +1,54 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const path_1 = __importDefault(require("path"));
+const fs_extra_1 = __importDefault(require("fs-extra"));
+const tools_1 = require("../../../tools");
+const utils_1 = require("../../../utils");
+const logger_1 = __importDefault(require("../../../logger"));
+function parse(context) {
+    const networkACLKeysDirectory = path_1.default.join(context.filePath, tools_1.constants.NETWORK_ACL_KEYS_DIRECTORY);
+    if (!(0, utils_1.existsMustBeDir)(networkACLKeysDirectory))
+        return { networkACLKeys: null }; // Skip
+    const foundFiles = (0, utils_1.getFiles)(networkACLKeysDirectory, ['.json']);
+    const networkACLKeys = foundFiles
+        .map((f) => (0, utils_1.loadJSON)(f, {
+        mappings: context.mappings,
+        disableKeywordReplacement: context.disableKeywordReplacement,
+    }))
+        .filter((p) => Object.keys(p).length > 0); // Filter out empty configs
+    return {
+        networkACLKeys,
+    };
+}
+async function dump(context) {
+    const { networkACLKeys } = context.assets;
+    if (!networkACLKeys)
+        return; // Skip, nothing to dump
+    if (Array.isArray(networkACLKeys) && networkACLKeys.length === 0) {
+        logger_1.default.info('No network ACL keys available, skipping dump');
+        return;
+    }
+    const networkACLKeysDirectory = path_1.default.join(context.filePath, tools_1.constants.NETWORK_ACL_KEYS_DIRECTORY);
+    fs_extra_1.default.ensureDirSync(networkACLKeysDirectory);
+    // value is write-only — never returned by the API and must not be exported.
+    // created_at and updated_at are API-generated metadata; not needed in config.
+    const removeKeysFromOutput = ['value', 'created_at', 'updated_at'];
+    networkACLKeys.forEach((networkACLKey) => {
+        const out = { ...networkACLKey };
+        removeKeysFromOutput.forEach((key) => {
+            if (key in out)
+                delete out[key];
+        });
+        const fileName = (0, utils_1.sanitize)(networkACLKey.name);
+        const filePath = path_1.default.join(networkACLKeysDirectory, `${fileName}.json`);
+        (0, utils_1.dumpJSON)(filePath, out);
+    });
+}
+const networkACLKeysHandler = {
+    parse,
+    dump,
+};
+exports.default = networkACLKeysHandler;

package/lib/context/yaml/handlers/index.js

@@ -38,6 +38,7 @@ const hooks_1 = __importDefault(require("./hooks"));
 const forms_1 = __importDefault(require("./forms"));
 const flows_1 = __importDefault(require("./flows"));
 const flowVaultConnections_1 = __importDefault(require("./flowVaultConnections"));
+const networkACLKeys_1 = __importDefault(require("./networkACLKeys"));
 const networkACLs_1 = __importDefault(require("./networkACLs"));
 const userAttributeProfiles_1 = __importDefault(require("./userAttributeProfiles"));
 const connectionProfiles_1 = __importDefault(require("./connectionProfiles"));
@@ -84,6 +85,7 @@ const yamlHandlers = {
     flows: flows_1.default,
     flowVaultConnections: flowVaultConnections_1.default,
     selfServiceProfiles: selfServiceProfiles_1.default,
+    networkACLKeys: networkACLKeys_1.default,
     networkACLs: networkACLs_1.default,
     userAttributeProfiles: userAttributeProfiles_1.default,
     connectionProfiles: connectionProfiles_1.default,

package/lib/context/yaml/handlers/networkACLKeys.d.ts

@@ -0,0 +1,6 @@
+import { YAMLHandler } from '.';
+import { ParsedAsset } from '../../../types';
+import { NetworkAclKey } from '../../../tools/auth0/handlers/networkACLKeys';
+type ParsedNetworkACLKeys = ParsedAsset<'networkACLKeys', NetworkAclKey[]>;
+declare const networkACLKeysHandler: YAMLHandler<ParsedNetworkACLKeys>;
+export default networkACLKeysHandler;

package/lib/context/yaml/handlers/networkACLKeys.js

@@ -0,0 +1,42 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const logger_1 = __importDefault(require("../../../logger"));
+async function parse(context) {
+    const { networkACLKeys } = context.assets;
+    if (!networkACLKeys)
+        return { networkACLKeys: null };
+    return {
+        networkACLKeys,
+    };
+}
+async function dump(context) {
+    let { networkACLKeys } = context.assets;
+    if (!networkACLKeys)
+        return { networkACLKeys: null };
+    if (Array.isArray(networkACLKeys) && networkACLKeys.length === 0) {
+        logger_1.default.info('No network ACL keys available, skipping dump');
+        return { networkACLKeys: null };
+    }
+    // value is write-only — never returned by the API and must not be exported.
+    // created_at and updated_at are API-generated metadata; not needed in config.
+    const removeKeysFromOutput = ['value', 'created_at', 'updated_at'];
+    networkACLKeys = networkACLKeys.map((key) => {
+        const out = { ...key };
+        removeKeysFromOutput.forEach((k) => {
+            if (k in out)
+                delete out[k];
+        });
+        return out;
+    });
+    return {
+        networkACLKeys,
+    };
+}
+const networkACLKeysHandler = {
+    parse,
+    dump,
+};
+exports.default = networkACLKeysHandler;

package/lib/keywordPreservation.d.ts

@@ -10,6 +10,6 @@ export declare const preserveKeywords: ({ localAssets, remoteAssets, keywordMapp
     remoteAssets: object;
     keywordMappings: KeywordMappings;
     auth0Handlers: (Pick<APIHandler, "id" | "type"> & {
-        identifiers: (string | string[])[];
+        identifiers?: (string | string[])[];
     })[];
 }) => object;

package/lib/keywordPreservation.js

@@ -164,7 +164,8 @@ const preserveKeywords = ({ localAssets, remoteAssets, keywordMappings, auth0Han
     if (Object.keys(keywordMappings).length === 0)
         return remoteAssets;
     const resourceSpecificIdentifiers = auth0Handlers.reduce((acc, handler) => {
-        acc[handler.type] = handler.identifiers.flat();
+        // Standalone handlers (e.g. clientAuthCredentials) don't extend APIHandler and have no identifiers.
+        acc[handler.type] = (handler.identifiers ?? []).flat();
         return acc;
     }, {});
     const addresses = (0, exports.getPreservableFieldsFromAssets)(localAssets, keywordMappings, resourceSpecificIdentifiers, '');

package/lib/tools/auth0/handlers/clients.d.ts

@@ -209,6 +209,25 @@ export declare const schema: {
                 type: string;
                 description: string;
             };
+            b2b_integration_configuration: {
+                type: string[];
+                description: string;
+                properties: {
+                    integration_type: {
+                        type: string;
+                        enum: string[];
+                        description: string;
+                    };
+                    sso_profiles: {
+                        type: string;
+                        description: string;
+                        items: {
+                            type: string;
+                        };
+                    };
+                };
+                additionalProperties: boolean;
+            };
             resource_server_identifier: {
                 type: string;
                 description: string;

package/lib/tools/auth0/handlers/clients.js

@@ -292,6 +292,23 @@ exports.schema = {
                 type: 'string',
                 description: 'The type of application this client represents',
             },
+            b2b_integration_configuration: {
+                type: ['object', 'null'],
+                description: 'B2B integration configuration. Early Access. Required feature flag: enterprise_connect_entitled.',
+                properties: {
+                    integration_type: {
+                        type: 'string',
+                        enum: ['custom_auth_server', 'third_party', 'application'],
+                        description: 'The type of integration used to connect to this B2B integration client.',
+                    },
+                    sso_profiles: {
+                        type: 'array',
+                        description: 'List of SSO profile IDs linked to this B2B integration client. Maximum 1 entry.',
+                        items: { type: 'string' },
+                    },
+                },
+                additionalProperties: false,
+            },
             resource_server_identifier: {
                 type: 'string',
                 description: 'The identifier of a resource server in your tenant. This property links a client to a resource server indicating that the client IS that resource server. Can only be set when app_type=resource_server.',
@@ -584,6 +601,9 @@ class ClientHandler extends default_1.default {
                 'jwks_uri',
                 // third_party_security_mode is immutable after creation; PATCH returns 400
                 'third_party_security_mode',
+                // API-generated timestamps; PATCH returns 400 if present
+                'created_at',
+                'updated_at',
             ],
             functions: {
                 create: (client) => this.createClient(client),
@@ -773,7 +793,23 @@ class ClientHandler extends default_1.default {
     async updateClient(clientId, client) {
         // For non-CIMD clients
         if (!this.isCimdClient(client)) {
-            return this.client.clients.update(clientId, client);
+            const payload = { ...client };
+            // b2b_integration_configuration: PATCH only allowed if client already has the object.
+            // Sending it to a client that lacks it returns 400 invalid_body.
+            // null clears the object — but only for clients that already have it; stripping
+            // null for a client without the field is a safe no-op.
+            if ('b2b_integration_configuration' in payload) {
+                const existing = (this.existing || []).find((c) => c.client_id === (client.client_id || clientId));
+                if (!existing?.b2b_integration_configuration) {
+                    if (payload.b2b_integration_configuration !== null) {
+                        logger_1.default.warn(`b2b_integration_configuration cannot be added to an existing client via PATCH ` +
+                            `(client: ${client.name || clientId}). Skipping field. ` +
+                            `Re-create the client to set this field.`);
+                    }
+                    delete payload.b2b_integration_configuration;
+                }
+            }
+            return this.client.clients.update(clientId, payload);
         }
         const updatePayload = this.getCIMDEditableFields(client);
         const registrationClientId = client.client_id || clientId;

package/lib/tools/auth0/handlers/databases.d.ts

@@ -195,6 +195,33 @@ export declare const schema: {
                             };
                         };
                     };
+                    otp_settings: {
+                        type: string;
+                        properties: {
+                            email: {
+                                type: string;
+                                properties: {
+                                    otp_length: {
+                                        type: string;
+                                    };
+                                    otp_expiry: {
+                                        type: string;
+                                    };
+                                };
+                            };
+                            phone: {
+                                type: string;
+                                properties: {
+                                    otp_length: {
+                                        type: string;
+                                    };
+                                    otp_expiry: {
+                                        type: string;
+                                    };
+                                };
+                            };
+                        };
+                    };
                     password_options: {
                         type: string;
                         properties: {
@@ -295,6 +322,7 @@ export default class DatabaseHandler extends DefaultAPIHandler {
     private validatePasswordlessSettings;
     private validateEmailUniqueConstraints;
     getClientFN(fn: 'create' | 'delete' | 'getAll' | 'update'): Function;
+    private enrichConnectionsWithEnabledClients;
     getType(): Promise<Connection[]>;
     calcChanges(assets: Assets): Promise<CalculatedChanges>;
     dryRunChanges(assets: Assets): Promise<CalculatedChanges>;

package/lib/tools/auth0/handlers/databases.js

@@ -181,6 +181,25 @@ exports.schema = {
                             action_id: { type: 'string' },
                         },
                     },
+                    otp_settings: {
+                        type: 'object',
+                        properties: {
+                            email: {
+                                type: 'object',
+                                properties: {
+                                    otp_length: { type: 'integer' },
+                                    otp_expiry: { type: 'integer' },
+                                },
+                            },
+                            phone: {
+                                type: 'object',
+                                properties: {
+                                    otp_length: { type: 'integer' },
+                                    otp_expiry: { type: 'integer' },
+                                },
+                            },
+                        },
+                    },
                     password_options: {
                         type: 'object',
                         properties: {
@@ -419,6 +438,22 @@ class DatabaseHandler extends default_1.default {
         }
         return this.client.connections[fn].bind(this.client.connections);
     }
+    // `enabled_clients` is no longer returned by connections.list; it must be fetched from the
+    // dedicated enabled-clients endpoint. Enriching the remote connections keeps the diff and the
+    // excluded-client preservation in `getEnabledClients` correct. Without it the dry-run diff
+    // reports a false "found in localObj but not in remoteObj" and a real import can silently
+    // disable an excluded-but-enabled client.
+    async enrichConnectionsWithEnabledClients(connections) {
+        return Promise.all(connections.map(async (con) => {
+            if (!con?.id)
+                return con;
+            const enabledClients = await (0, connections_1.getConnectionEnabledClients)(this.client, con.id);
+            if (enabledClients?.length) {
+                return { ...con, enabled_clients: enabledClients };
+            }
+            return con;
+        }));
+    }
     async getType() {
         if (this.existing)
             return this.existing;
@@ -433,16 +468,7 @@ class DatabaseHandler extends default_1.default {
                 include_totals: true,
             }),
         ]);
-        const dbConnectionsWithEnabledClients = await Promise.all(connections.map(async (con) => {
-            if (!con?.id)
-                return con;
-            const enabledClients = await (0, connections_1.getConnectionEnabledClients)(this.client, con.id);
-            const connection = { ...con };
-            if (enabledClients && enabledClients?.length) {
-                connection.enabled_clients = enabledClients;
-            }
-            return connection;
-        }));
+        const dbConnectionsWithEnabledClients = await this.enrichConnectionsWithEnabledClients(connections);
         // Convert action ID back to action name for export
         const dbConnectionsWithActionNames = dbConnectionsWithEnabledClients.map((connection) => {
             if (connection.options && 'custom_password_hash' in connection.options) {
@@ -489,28 +515,26 @@ class DatabaseHandler extends default_1.default {
                 update: [],
                 conflicts: [],
             };
-        // Convert enabled_clients by name to the id
-        // Fetch clients, connections, and actions concurrently
-        const [clients, existingDatabasesConnections, actions] = await Promise.all([
+        // Convert enabled_clients by name to the id. `getType()` fetches and enriches the existing
+        // connections with `enabled_clients` and caches the result in `this.existing`, so the
+        // `super.calcChanges()` call below reuses it instead of fetching again.
+        const [clients, actions, existingWithEnabledClients] = await Promise.all([
             (0, client_1.paginate)(this.client.clients.list, {
                 paginate: true,
             }),
-            (0, client_1.paginate)(this.client.connections.list, {
-                strategy: [auth0_1.Management.ConnectionStrategyEnum.Auth0],
-                checkpoint: true,
-                include_totals: true,
-            }),
             (0, client_1.paginate)(this.client.actions.list, {
                 paginate: true,
                 include_totals: true,
             }),
+            this.getType(),
         ]);
+        const existingConnections = existingWithEnabledClients || [];
         const formatted = databases.map((db) => {
             const { options, ...rest } = db;
             const formattedOptions = this.getFormattedOptions(options, actions);
             const formattedDb = { ...rest, options: formattedOptions };
             if (db.enabled_clients) {
-                formattedDb.enabled_clients = (0, utils_1.getEnabledClients)(assets, db, existingDatabasesConnections, clients);
+                formattedDb.enabled_clients = (0, utils_1.getEnabledClients)(assets, db, existingConnections, clients);
             }
             return formattedDb;
         });
@@ -540,19 +564,20 @@ class DatabaseHandler extends default_1.default {
                 include_totals: true,
             }),
         ]);
+        const existingWithEnabledClients = await this.enrichConnectionsWithEnabledClients(existingDatabasesConnections);
         const formatted = databases.map((db) => {
             const { options, ...rest } = db;
             const formattedOptions = this.getFormattedOptions(options, actions);
             const formattedDb = { ...rest, options: formattedOptions };
             if (db.enabled_clients) {
-                formattedDb.enabled_clients = (0, utils_1.getEnabledClients)(assets, db, existingDatabasesConnections, clients);
+                formattedDb.enabled_clients = (0, utils_1.getEnabledClients)(assets, db, existingWithEnabledClients, clients);
             }
             return formattedDb;
         });
         return (0, calculateDryRunChanges_1.calculateDryRunChanges)({
             type: this.type,
             assets: formatted,
-            existing: existingDatabasesConnections,
+            existing: existingWithEnabledClients,
             identifiers: this.identifiers,
             ignoreDryRunFields: this.getEffectiveIgnoreDryRunFields(),
         });

package/lib/tools/auth0/handlers/index.js

@@ -69,6 +69,7 @@ const forms = __importStar(require("./forms"));
 const flows = __importStar(require("./flows"));
 const flowVaultConnections = __importStar(require("./flowVaultConnections"));
 const selfServiceProfiles = __importStar(require("./selfServiceProfiles"));
+const networkACLKeys = __importStar(require("./networkACLKeys"));
 const networkACLs = __importStar(require("./networkACLs"));
 const userAttributeProfiles = __importStar(require("./userAttributeProfiles"));
 const connectionProfiles = __importStar(require("./connectionProfiles"));
@@ -116,6 +117,7 @@ const auth0ApiHandlers = {
     flows,
     flowVaultConnections,
     selfServiceProfiles,
+    networkACLKeys,
     networkACLs,
     userAttributeProfiles,
     connectionProfiles,

package/lib/tools/auth0/handlers/networkACLKeys.d.ts

@@ -0,0 +1,45 @@
+import { Management } from 'auth0';
+import DefaultAPIHandler from './default';
+import { Asset, Assets, CalculatedChanges } from '../../../types';
+export type NetworkAclKey = Management.NetworkAclKey & {
+    value?: string;
+};
+export declare const schema: {
+    type: string;
+    description: string;
+    items: {
+        type: string;
+        required: string[];
+        properties: {
+            id: {
+                type: string;
+            };
+            name: {
+                type: string;
+                maxLength: number;
+            };
+            alg: {
+                type: string;
+                enum: string[];
+            };
+            value: {
+                type: string;
+            };
+            fingerprint: {
+                type: string;
+            };
+        };
+        additionalProperties: boolean;
+    };
+};
+export default class NetworkACLKeysHandler extends DefaultAPIHandler {
+    existing: NetworkAclKey[] | null;
+    constructor(config: DefaultAPIHandler);
+    objString(key: NetworkAclKey): string;
+    getType(): Promise<Asset | null>;
+    processChanges(assets: Assets): Promise<void>;
+    createNetworkACLKey(key: NetworkAclKey): Promise<void>;
+    createNetworkACLKeys(creates: CalculatedChanges['create']): Promise<void>;
+    deleteNetworkACLKey(key: NetworkAclKey): Promise<void>;
+    deleteNetworkACLKeys(data: Asset[]): Promise<void>;
+}

package/lib/tools/auth0/handlers/networkACLKeys.js

@@ -0,0 +1,177 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.schema = void 0;
+const default_1 = __importStar(require("./default"));
+const logger_1 = __importDefault(require("../../../logger"));
+exports.schema = {
+    type: 'array',
+    description: 'List of Network ACL keys for HMAC signature verification',
+    items: {
+        type: 'object',
+        required: ['name', 'alg'],
+        properties: {
+            id: { type: 'string' },
+            name: { type: 'string', maxLength: 255 },
+            alg: { type: 'string', enum: ['hmac-sha256'] },
+            // value is write-only and never returned by the API.
+            // Provide it at deploy time via keyword replacement (e.g. ##HMAC_KEY_VALUE##).
+            // It is not exported and is omitted from exported configs.
+            value: { type: 'string' },
+            fingerprint: { type: 'string' },
+        },
+        additionalProperties: false,
+    },
+};
+class NetworkACLKeysHandler extends default_1.default {
+    constructor(config) {
+        super({
+            ...config,
+            type: 'networkACLKeys',
+            id: 'id',
+            identifiers: ['name'],
+            // value is write-only (never returned by API) and fingerprint/timestamps are
+            // API-generated — ignore all of them when computing dry-run diffs so keys
+            // with a local `value` don't show phantom UPDATEs.
+            ignoreDryRunFields: ['value', 'fingerprint', 'created_at', 'updated_at'],
+        });
+    }
+    objString(key) {
+        return super.objString({ name: key.name, alg: key.alg });
+    }
+    async getType() {
+        if (this.existing)
+            return this.existing;
+        try {
+            // Not paginated — tenant cap is 10 keys. Returns { keys: [...] }.
+            const result = await this.client.keys.networkAcls.list();
+            this.existing = result.keys;
+            return this.existing;
+        }
+        catch (err) {
+            if (err.statusCode === 404 || err.statusCode === 501) {
+                return null;
+            }
+            if (err.statusCode === 403) {
+                logger_1.default.debug('Network ACL key management is not enabled for this tenant. Please verify `scope` or contact Auth0 support.');
+                return null;
+            }
+            throw err;
+        }
+    }
+    async processChanges(assets) {
+        const { networkACLKeys } = assets;
+        // Do nothing if not set
+        if (!networkACLKeys)
+            return;
+        const { del, create } = await this.calcChanges(assets);
+        // Keys are immutable after creation — there is no update operation.
+        // A detected "update" (same name, different config) is a no-op: the existing key is kept as-is.
+        logger_1.default.debug(`Start processChanges for networkACLKeys [delete:${del.length}] [create:${create.length}]`);
+        await Promise.all([this.deleteNetworkACLKeys(del), this.createNetworkACLKeys(create)]);
+    }
+    async createNetworkACLKey(key) {
+        if (!key.value) {
+            logger_1.default.warn(`Skipping creation of Network ACL key "${key.name}": ` +
+                `'value' is required to create a key but is not present in the config. ` +
+                `Supply the key material via keyword replacement (e.g. ##HMAC_KEY_VALUE##) or create the key out-of-band.`);
+            return;
+        }
+        await this.client.keys.networkAcls.create({
+            name: key.name,
+            alg: key.alg,
+            value: key.value,
+        });
+        this.didCreate(key);
+        this.created += 1;
+    }
+    async createNetworkACLKeys(creates) {
+        await this.client.pool
+            .addEachTask({
+            data: creates || [],
+            generator: (item) => this.createNetworkACLKey(item).catch((err) => {
+                throw new Error(`Problem creating ${this.type} ${this.objString(item)}\n${err}`);
+            }),
+        })
+            .promise();
+    }
+    async deleteNetworkACLKey(key) {
+        if (!key.id) {
+            throw new Error(`Missing id for ${this.type} ${this.objString(key)}`);
+        }
+        await this.client.keys.networkAcls.delete(key.id);
+    }
+    async deleteNetworkACLKeys(data) {
+        if (!data || data.length === 0)
+            return;
+        if (this.config('AUTH0_ALLOW_DELETE') === 'true' ||
+            this.config('AUTH0_ALLOW_DELETE') === true) {
+            await this.client.pool
+                .addEachTask({
+                data: data || [],
+                generator: (item) => this.deleteNetworkACLKey(item)
+                    .then(() => {
+                    this.didDelete(item);
+                    this.deleted += 1;
+                })
+                    .catch((err) => {
+                    if (err.statusCode === 409) {
+                        throw new Error(`Cannot delete Network ACL key "${item.name}" — it is still referenced by one or more ACL rules. ` +
+                            `Remove the key reference from all ACL rules first.\n${err}`);
+                    }
+                    throw new Error(`Problem deleting ${this.type} ${this.objString(item)}\n${err}`);
+                }),
+            })
+                .promise();
+        }
+        else {
+            logger_1.default.warn(`Detected the following ${this.type} should be deleted. Doing so may be destructive.\nYou can enable deletes by setting 'AUTH0_ALLOW_DELETE' to true in the config
+      \n${data.map((i) => this.objString(i)).join('\n')}`);
+        }
+    }
+}
+exports.default = NetworkACLKeysHandler;
+__decorate([
+    (0, default_1.order)(60)
+], NetworkACLKeysHandler.prototype, "processChanges", null);

package/lib/tools/auth0/handlers/networkACLs.d.ts

@@ -21,7 +21,7 @@ export declare const schema: {
                 minimum: number;
             };
             rule: {
-                anyOf: {
+                anyOf: ({
                     type: string;
                     required: string[];
                     properties: {
@@ -171,6 +171,29 @@ export declare const schema: {
                                     };
                                     uniqueItems: boolean;
                                 };
+                                http_message_signature: {
+                                    type: string;
+                                    properties: {
+                                        keys: {
+                                            type: string;
+                                            minItems: number;
+                                            maxItems: number;
+                                            uniqueItems: boolean;
+                                            items: {
+                                                type: string;
+                                                properties: {
+                                                    id: {
+                                                        type: string;
+                                                    };
+                                                };
+                                                required: string[];
+                                                additionalProperties: boolean;
+                                            };
+                                        };
+                                    };
+                                    required: string[];
+                                    additionalProperties: boolean;
+                                };
                             };
                             additionalProperties: boolean;
                         };
@@ -271,6 +294,29 @@ export declare const schema: {
                                     };
                                     uniqueItems: boolean;
                                 };
+                                http_message_signature: {
+                                    type: string;
+                                    properties: {
+                                        keys: {
+                                            type: string;
+                                            minItems: number;
+                                            maxItems: number;
+                                            uniqueItems: boolean;
+                                            items: {
+                                                type: string;
+                                                properties: {
+                                                    id: {
+                                                        type: string;
+                                                    };
+                                                };
+                                                required: string[];
+                                                additionalProperties: boolean;
+                                            };
+                                        };
+                                    };
+                                    required: string[];
+                                    additionalProperties: boolean;
+                                };
                             };
                             additionalProperties: boolean;
                         };
@@ -278,9 +324,75 @@ export declare const schema: {
                             enum: string[];
                             type: string;
                         };
+                        match_all?: undefined;
+                    };
+                    additionalProperties: boolean;
+                } | {
+                    type: string;
+                    required: string[];
+                    properties: {
+                        action: {
+                            type: string;
+                            anyOf: ({
+                                type: string;
+                                required: string[];
+                                properties: {
+                                    block: {
+                                        type: string;
+                                        enum: boolean[];
+                                    };
+                                };
+                                additionalProperties: boolean;
+                            } | {
+                                type: string;
+                                required: string[];
+                                properties: {
+                                    allow: {
+                                        type: string;
+                                        enum: boolean[];
+                                    };
+                                };
+                                additionalProperties: boolean;
+                            } | {
+                                type: string;
+                                required: string[];
+                                properties: {
+                                    log: {
+                                        type: string;
+                                        enum: boolean[];
+                                    };
+                                };
+                                additionalProperties: boolean;
+                            } | {
+                                type: string;
+                                required: string[];
+                                properties: {
+                                    redirect: {
+                                        type: string;
+                                        enum: boolean[];
+                                    };
+                                    redirect_uri: {
+                                        type: string;
+                                        minLength: number;
+                                        maxLength: number;
+                                    };
+                                };
+                                additionalProperties: boolean;
+                            })[];
+                        };
+                        match_all: {
+                            type: string;
+                            enum: boolean[];
+                        };
+                        scope: {
+                            enum: string[];
+                            type: string;
+                        };
+                        match?: undefined;
+                        not_match?: undefined;
                     };
                     additionalProperties: boolean;
-                }[];
+                })[];
             };
         };
         additionalProperties: boolean;

package/lib/tools/auth0/handlers/networkACLs.js

@@ -1,10 +1,49 @@
 "use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.schema = void 0;
-const default_1 = __importDefault(require("./default"));
+const default_1 = __importStar(require("./default"));
 const client_1 = require("../client");
 const logger_1 = __importDefault(require("../../../logger"));
 // Define action types
@@ -57,6 +96,15 @@ const RedirectAction = {
     },
     additionalProperties: false,
 };
+// Shared sub-schemas reused across every rule branch below.
+const ActionSchema = {
+    type: 'object',
+    anyOf: [BlockAction, AllowAction, LogAction, RedirectAction],
+};
+const ScopeSchema = {
+    enum: ['management', 'authentication', 'tenant'],
+    type: 'string',
+};
 // Define MatchSchema
 const MatchSchema = {
     type: 'object',
@@ -155,6 +203,27 @@ const MatchSchema = {
             },
             uniqueItems: true,
         },
+        http_message_signature: {
+            type: 'object',
+            properties: {
+                keys: {
+                    type: 'array',
+                    minItems: 1,
+                    maxItems: 10,
+                    uniqueItems: true,
+                    items: {
+                        type: 'object',
+                        properties: {
+                            id: { type: 'string' },
+                        },
+                        required: ['id'],
+                        additionalProperties: false,
+                    },
+                },
+            },
+            required: ['keys'],
+            additionalProperties: false,
+        },
     },
     additionalProperties: false,
 };
@@ -182,16 +251,10 @@ exports.schema = {
                         type: 'object',
                         required: ['action', 'scope', 'match'],
                         properties: {
-                            action: {
-                                type: 'object',
-                                anyOf: [BlockAction, AllowAction, LogAction, RedirectAction],
-                            },
+                            action: ActionSchema,
                             match: MatchSchema,
                             not_match: MatchSchema,
-                            scope: {
-                                enum: ['management', 'authentication', 'tenant'],
-                                type: 'string',
-                            },
+                            scope: ScopeSchema,
                         },
                         additionalProperties: false,
                     },
@@ -199,16 +262,25 @@ exports.schema = {
                         type: 'object',
                         required: ['action', 'scope', 'not_match'],
                         properties: {
-                            action: {
-                                type: 'object',
-                                anyOf: [BlockAction, AllowAction, LogAction, RedirectAction],
-                            },
+                            action: ActionSchema,
                             not_match: MatchSchema,
                             match: MatchSchema,
-                            scope: {
-                                enum: ['management', 'authentication', 'tenant'],
-                                type: 'string',
+                            scope: ScopeSchema,
+                        },
+                        additionalProperties: false,
+                    },
+                    {
+                        // Unconditional match: `match_all` is mutually exclusive with `match`/`not_match`.
+                        type: 'object',
+                        required: ['action', 'scope', 'match_all'],
+                        properties: {
+                            action: ActionSchema,
+                            match_all: {
+                                // Schema only permits `true`; omit the property instead of sending `false`.
+                                type: 'boolean',
+                                enum: [true],
                             },
+                            scope: ScopeSchema,
                         },
                         additionalProperties: false,
                     },
@@ -355,3 +427,6 @@ class NetworkACLsHandler extends default_1.default {
     }
 }
 exports.default = NetworkACLsHandler;
+__decorate([
+    (0, default_1.order)(65)
+], NetworkACLsHandler.prototype, "processChanges", null);

package/lib/tools/auth0/handlers/organizations.js

@@ -51,6 +51,12 @@ const logger_1 = __importDefault(require("../../../logger"));
 const client_1 = require("../client");
 const utils_1 = require("../../../utils");
 const utils_2 = require("../../utils");
+// Org sub-resources are skipped when the tenant can't read them: the EA feature is off
+// (feature_not_enabled, returned as 400 or 403) or the token lacks scope (403). The SDK
+// puts the API code on `err.body.errorCode`, not `err.errorCode`.
+function isOrgSubresourceUnavailable(err) {
+    return err?.statusCode === 403 || err?.body?.errorCode === 'feature_not_enabled';
+}
 exports.schema = {
     type: 'array',
     items: {
@@ -618,8 +624,8 @@ class OrganizationsHandler extends default_1.default {
             if (err.statusCode === 404 || err.statusCode === 501) {
                 return null;
             }
-            if (err.statusCode === 403 || err.errorCode === 'feature_not_enabled') {
-                logger_1.default.debug('Organization Discovery domains are not enabled for this tenant. Please verify `scope` or contact Auth0 support to enable this feature.');
+            if (isOrgSubresourceUnavailable(err)) {
+                logger_1.default.debug(`Skipping organization discovery domains (${err?.body?.errorCode ?? err.statusCode}).`);
                 return null;
             }
             throw err;
@@ -664,8 +670,8 @@ class OrganizationsHandler extends default_1.default {
             if (err.statusCode === 404 || err.statusCode === 501) {
                 return null;
             }
-            if (err.statusCode === 403 || err.errorCode === 'feature_not_enabled') {
-                logger_1.default.debug('Org-to-app entitlement is not enabled for this tenant. Skipping org-client associations.');
+            if (isOrgSubresourceUnavailable(err)) {
+                logger_1.default.debug(`Skipping org-client associations (${err?.body?.errorCode ?? err.statusCode}).`);
                 return null;
             }
             throw err;

package/lib/tools/constants.d.ts

@@ -86,6 +86,7 @@ declare const constants: {
     FLOWS_VAULT_DIRECTORY: string;
     SELF_SERVICE_PROFILE_DIRECTORY: string;
     NETWORK_ACLS_DIRECTORY: string;
+    NETWORK_ACL_KEYS_DIRECTORY: string;
     USER_ATTRIBUTE_PROFILES_DIRECTORY: string;
     CONNECTION_PROFILES_DIRECTORY: string;
     TOKEN_EXCHANGE_PROFILES_DIRECTORY: string;

package/lib/tools/constants.js

@@ -216,6 +216,7 @@ const constants = {
     FLOWS_VAULT_DIRECTORY: 'flow-vault-connections',
     SELF_SERVICE_PROFILE_DIRECTORY: 'self-service-profiles',
     NETWORK_ACLS_DIRECTORY: 'network-acls',
+    NETWORK_ACL_KEYS_DIRECTORY: 'network-acl-keys',
     USER_ATTRIBUTE_PROFILES_DIRECTORY: 'user-attribute-profiles',
     CONNECTION_PROFILES_DIRECTORY: 'connection-profiles',
     TOKEN_EXCHANGE_PROFILES_DIRECTORY: 'token-exchange-profiles',

package/lib/types.d.ts

@@ -16,6 +16,7 @@ import { SsProfileWithCustomText } from './tools/auth0/handlers/selfServiceProfi
 import { PhoneProvider } from './tools/auth0/handlers/phoneProvider';
 import { PhoneTemplate } from './tools/auth0/handlers/phoneTemplates';
 import { NetworkACL } from './tools/auth0/handlers/networkACLs';
+import { NetworkAclKey } from './tools/auth0/handlers/networkACLKeys';
 import { UserAttributeProfile } from './tools/auth0/handlers/userAttributeProfiles';
 import { AttackProtection } from './tools/auth0/handlers/attackProtection';
 import { TokenExchangeProfile } from './tools/auth0/handlers/tokenExchangeProfiles';
@@ -156,6 +157,7 @@ export type Assets = Partial<{
     flows: Flow[] | null;
     flowVaultConnections: FlowVaultConnection[] | null;
     selfServiceProfiles: SsProfileWithCustomText[] | null;
+    networkACLKeys: NetworkAclKey[] | null;
     networkACLs: NetworkACL[] | null;
     userAttributeProfiles: UserAttributeProfile[] | null;
     userAttributeProfilesWithId: UserAttributeProfile[] | null;
@@ -183,7 +185,7 @@ export type DetailedDryRunChanges = {
         changes: DetailedDryRunChange[];
     };
 };
-export type AssetTypes = 'rules' | 'rulesConfigs' | 'hooks' | 'pages' | 'databases' | 'clientGrants' | 'resourceServers' | 'clients' | 'connections' | 'tenant' | 'emailProvider' | 'emailTemplates' | 'guardianFactors' | 'guardianFactorProviders' | 'guardianFactorTemplates' | 'guardianPhoneFactorMessageTypes' | 'guardianPhoneFactorSelectedProvider' | 'guardianPolicies' | 'roles' | 'actions' | 'actionModules' | 'organizations' | 'triggers' | 'attackProtection' | 'riskAssessment' | 'branding' | 'phoneProviders' | 'phoneTemplates' | 'logStreams' | 'prompts' | 'customDomains' | 'themes' | 'forms' | 'flows' | 'flowVaultConnections' | 'selfServiceProfiles' | 'networkACLs' | 'userAttributeProfiles' | 'connectionProfiles' | 'tokenExchangeProfiles' | 'supplementalSignals' | 'rateLimitPolicies' | 'eventStreams' | 'clientAuthCredentials';
+export type AssetTypes = 'rules' | 'rulesConfigs' | 'hooks' | 'pages' | 'databases' | 'clientGrants' | 'resourceServers' | 'clients' | 'connections' | 'tenant' | 'emailProvider' | 'emailTemplates' | 'guardianFactors' | 'guardianFactorProviders' | 'guardianFactorTemplates' | 'guardianPhoneFactorMessageTypes' | 'guardianPhoneFactorSelectedProvider' | 'guardianPolicies' | 'roles' | 'actions' | 'actionModules' | 'organizations' | 'triggers' | 'attackProtection' | 'riskAssessment' | 'branding' | 'phoneProviders' | 'phoneTemplates' | 'logStreams' | 'prompts' | 'customDomains' | 'themes' | 'forms' | 'flows' | 'flowVaultConnections' | 'selfServiceProfiles' | 'networkACLKeys' | 'networkACLs' | 'userAttributeProfiles' | 'connectionProfiles' | 'tokenExchangeProfiles' | 'supplementalSignals' | 'rateLimitPolicies' | 'eventStreams' | 'clientAuthCredentials';
 export type KeywordMappings = {
     [key: string]: (string | number)[] | string | number;
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "auth0-deploy-cli",
-  "version": "8.44.0",
+  "version": "8.45.0",
   "description": "A command line tool for deploying updates to your Auth0 tenant",
   "main": "lib/index.js",
   "bin": {
@@ -35,7 +35,7 @@
   "dependencies": {
     "@clack/prompts": "1.4.0",
     "ajv": "^6.12.6",
-    "auth0": "^6.3.0",
+    "auth0": "^6.4.0",
     "chalk": "5.6.2",
     "dot-prop": "^5.3.0",
     "fs-extra": "^10.1.0",