auth0-deploy-cli 9.0.0-beta.2 → 9.0.0

package/lib/context/yaml/handlers/guardianSettings.js

@@ -0,0 +1,15 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+async function parseAndDump(context) {
+    const { guardianSettings } = context.assets;
+    if (!guardianSettings)
+        return { guardianSettings: null };
+    return {
+        guardianSettings,
+    };
+}
+const guardianSettingsHandler = {
+    parse: parseAndDump,
+    dump: parseAndDump,
+};
+exports.default = guardianSettingsHandler;

package/lib/context/yaml/handlers/index.js

@@ -17,6 +17,9 @@ const guardianFactorProviders_1 = __importDefault(require("./guardianFactorProvi
 const guardianFactorTemplates_1 = __importDefault(require("./guardianFactorTemplates"));
 const guardianPhoneFactorMessageTypes_1 = __importDefault(require("./guardianPhoneFactorMessageTypes"));
 const guardianPhoneFactorSelectedProvider_1 = __importDefault(require("./guardianPhoneFactorSelectedProvider"));
+const guardianPhoneFactorSettings_1 = __importDefault(require("./guardianPhoneFactorSettings"));
+const guardianEmailFactorSettings_1 = __importDefault(require("./guardianEmailFactorSettings"));
+const guardianSettings_1 = __importDefault(require("./guardianSettings"));
 const guardianPolicies_1 = __importDefault(require("./guardianPolicies"));
 const roles_1 = __importDefault(require("./roles"));
 const organizations_1 = __importDefault(require("./organizations"));
@@ -38,12 +41,15 @@ const hooks_1 = __importDefault(require("./hooks"));
 const forms_1 = __importDefault(require("./forms"));
 const flows_1 = __importDefault(require("./flows"));
 const flowVaultConnections_1 = __importDefault(require("./flowVaultConnections"));
+const networkACLKeys_1 = __importDefault(require("./networkACLKeys"));
 const networkACLs_1 = __importDefault(require("./networkACLs"));
 const userAttributeProfiles_1 = __importDefault(require("./userAttributeProfiles"));
 const connectionProfiles_1 = __importDefault(require("./connectionProfiles"));
 const tokenExchangeProfiles_1 = __importDefault(require("./tokenExchangeProfiles"));
 const supplementalSignals_1 = __importDefault(require("./supplementalSignals"));
+const rateLimitPolicies_1 = __importDefault(require("./rateLimitPolicies"));
 const eventStreams_1 = __importDefault(require("./eventStreams"));
+const clientAuthCredentials_1 = __importDefault(require("./clientAuthCredentials"));
 const selfServiceProfiles_1 = __importDefault(require("./selfServiceProfiles"));
 const yamlHandlers = {
     rules: rules_1.default,
@@ -64,6 +70,9 @@ const yamlHandlers = {
     roles: roles_1.default,
     guardianPhoneFactorMessageTypes: guardianPhoneFactorMessageTypes_1.default,
     guardianPhoneFactorSelectedProvider: guardianPhoneFactorSelectedProvider_1.default,
+    guardianPhoneFactorSettings: guardianPhoneFactorSettings_1.default,
+    guardianEmailFactorSettings: guardianEmailFactorSettings_1.default,
+    guardianSettings: guardianSettings_1.default,
     guardianPolicies: guardianPolicies_1.default,
     actions: actions_1.default,
     actionModules: actionModules_1.default,
@@ -82,11 +91,14 @@ const yamlHandlers = {
     flows: flows_1.default,
     flowVaultConnections: flowVaultConnections_1.default,
     selfServiceProfiles: selfServiceProfiles_1.default,
+    networkACLKeys: networkACLKeys_1.default,
     networkACLs: networkACLs_1.default,
     userAttributeProfiles: userAttributeProfiles_1.default,
     connectionProfiles: connectionProfiles_1.default,
     tokenExchangeProfiles: tokenExchangeProfiles_1.default,
     supplementalSignals: supplementalSignals_1.default,
+    rateLimitPolicies: rateLimitPolicies_1.default,
     eventStreams: eventStreams_1.default,
+    clientAuthCredentials: clientAuthCredentials_1.default,
 };
 exports.default = yamlHandlers;

package/lib/context/yaml/handlers/networkACLKeys.d.ts

@@ -0,0 +1,6 @@
+import { YAMLHandler } from '.';
+import { ParsedAsset } from '../../../types';
+import { NetworkAclKey } from '../../../tools/auth0/handlers/networkACLKeys';
+type ParsedNetworkACLKeys = ParsedAsset<'networkACLKeys', NetworkAclKey[]>;
+declare const networkACLKeysHandler: YAMLHandler<ParsedNetworkACLKeys>;
+export default networkACLKeysHandler;

package/lib/context/yaml/handlers/networkACLKeys.js

@@ -0,0 +1,42 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const logger_1 = __importDefault(require("../../../logger"));
+async function parse(context) {
+    const { networkACLKeys } = context.assets;
+    if (!networkACLKeys)
+        return { networkACLKeys: null };
+    return {
+        networkACLKeys,
+    };
+}
+async function dump(context) {
+    let { networkACLKeys } = context.assets;
+    if (!networkACLKeys)
+        return { networkACLKeys: null };
+    if (Array.isArray(networkACLKeys) && networkACLKeys.length === 0) {
+        logger_1.default.info('No network ACL keys available, skipping dump');
+        return { networkACLKeys: null };
+    }
+    // value is write-only — never returned by the API and must not be exported.
+    // created_at and updated_at are API-generated metadata; not needed in config.
+    const removeKeysFromOutput = ['value', 'created_at', 'updated_at'];
+    networkACLKeys = networkACLKeys.map((key) => {
+        const out = { ...key };
+        removeKeysFromOutput.forEach((k) => {
+            if (k in out)
+                delete out[k];
+        });
+        return out;
+    });
+    return {
+        networkACLKeys,
+    };
+}
+const networkACLKeysHandler = {
+    parse,
+    dump,
+};
+exports.default = networkACLKeysHandler;

package/lib/context/yaml/handlers/prompts.js

@@ -18,8 +18,10 @@ const loadScreenRenderers = (context, screenRenderArray) => {
         const screens = promptEntry[prompt];
         Object.entries(screens).forEach(([, fileName]) => {
             const filePath = fileName;
+            const configRoot = path_1.default.resolve(context.basePath);
+            const rendererFile = path_1.default.resolve(context.basePath, filePath);
+            (0, utils_1.assertInsideConfigRoot)(filePath, rendererFile, configRoot);
             try {
-                const rendererFile = path_1.default.join(context.basePath, filePath);
                 const rendererData = (0, utils_1.loadJSON)(rendererFile, {
                     mappings: context.mappings,
                     disableKeywordReplacement: context.disableKeywordReplacement,

package/lib/context/yaml/handlers/rateLimitPolicies.d.ts

@@ -0,0 +1,6 @@
+import { YAMLHandler } from '.';
+import { ParsedAsset } from '../../../types';
+import { RateLimitPolicy } from '../../../tools/auth0/handlers/rateLimitPolicies';
+type ParsedRateLimitPolicies = ParsedAsset<'rateLimitPolicies', RateLimitPolicy[]>;
+declare const rateLimitPoliciesHandler: YAMLHandler<ParsedRateLimitPolicies>;
+export default rateLimitPoliciesHandler;

package/lib/context/yaml/handlers/rateLimitPolicies.js

@@ -0,0 +1,27 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+async function parse(context) {
+    const { rateLimitPolicies } = context.assets;
+    if (!rateLimitPolicies)
+        return { rateLimitPolicies: null };
+    return { rateLimitPolicies };
+}
+async function dump(context) {
+    const { rateLimitPolicies } = context.assets;
+    if (!rateLimitPolicies)
+        return { rateLimitPolicies: null };
+    const removeKeysFromOutput = ['id', 'created_at', 'updated_at'];
+    const cleaned = rateLimitPolicies.map((policy) => {
+        const policyToWrite = { ...policy };
+        removeKeysFromOutput.forEach((key) => {
+            delete policyToWrite[key];
+        });
+        return policyToWrite;
+    });
+    return { rateLimitPolicies: cleaned };
+}
+const rateLimitPoliciesHandler = {
+    parse,
+    dump,
+};
+exports.default = rateLimitPoliciesHandler;

package/lib/context/yaml/index.js

@@ -45,10 +45,7 @@ class YAMLContext {
     loadFile(f) {
         const configRoot = path_1.default.resolve(this.basePath);
         const toLoad = path_1.default.resolve(this.basePath, f.replace(/\\/g, '/'));
-        if (!toLoad.startsWith(configRoot + path_1.default.sep)) {
-            throw new Error(`Path "${f}" resolves to "${toLoad}" which is outside the config directory "${configRoot}". ` +
-                `Move the file inside your config directory.`);
-        }
+        (0, utils_1.assertInsideConfigRoot)(f, toLoad, configRoot);
         return (0, tools_1.loadFileAndReplaceKeywords)(toLoad, {
             mappings: this.mappings,
             disableKeywordReplacement: this.disableKeywordReplacement,

package/lib/keywordPreservation.d.ts

@@ -10,6 +10,6 @@ export declare const preserveKeywords: ({ localAssets, remoteAssets, keywordMapp
     remoteAssets: object;
     keywordMappings: KeywordMappings;
     auth0Handlers: (Pick<APIHandler, "id" | "type"> & {
-        identifiers: (string | string[])[];
+        identifiers?: (string | string[])[];
     })[];
 }) => object;

package/lib/keywordPreservation.js

@@ -164,7 +164,8 @@ const preserveKeywords = ({ localAssets, remoteAssets, keywordMappings, auth0Han
     if (Object.keys(keywordMappings).length === 0)
         return remoteAssets;
     const resourceSpecificIdentifiers = auth0Handlers.reduce((acc, handler) => {
-        acc[handler.type] = handler.identifiers.flat();
+        // Standalone handlers (e.g. clientAuthCredentials) don't extend APIHandler and have no identifiers.
+        acc[handler.type] = (handler.identifiers ?? []).flat();
         return acc;
     }, {});
     const addresses = (0, exports.getPreservableFieldsFromAssets)(localAssets, keywordMappings, resourceSpecificIdentifiers, '');

package/lib/readonly.js

@@ -28,6 +28,11 @@ const readOnlyFields = {
         'config_route',
         'owners',
     ],
+    attackProtection: [
+        // Returned by GET but rejected by PATCH with "Additional properties not allowed"
+        'bruteForceProtection.form_submission_mode',
+        'bruteForceProtection.form_submission_behavior',
+    ],
 };
 function getExcludedFields(config) {
     const strippedFields = { ...readOnlyFields };

package/lib/tools/auth0/handlers/attackProtection.js

@@ -243,14 +243,25 @@ class AttackProtectionHandler extends default_1.default {
         let botDetection = null;
         let captcha = null;
         try {
-            [botDetection, captcha] = await Promise.all([
-                this.client.attackProtection.botDetection.get(),
-                this.client.attackProtection.captcha.get(),
-            ]);
+            botDetection = await this.client.attackProtection.botDetection.get();
         }
         catch (err) {
             if (err.statusCode === 403) {
-                logger_1.default.warn('Bot Detection API are not enabled for this tenant. Please verify `scope` or contact Auth0 support to enable this feature.');
+                logger_1.default.warn("Bot detection is not available on this tenant's current plan. Skipping bot detection settings.");
+            }
+            else {
+                throw err;
+            }
+        }
+        try {
+            captcha = await this.client.attackProtection.captcha.get();
+        }
+        catch (err) {
+            if (err.statusCode === 403) {
+                logger_1.default.warn("Captcha is not available on this tenant's current plan. Skipping captcha settings.");
+            }
+            else {
+                throw err;
             }
         }
         const attackProtection = {
@@ -303,7 +314,9 @@ class AttackProtectionHandler extends default_1.default {
             updates.push(this.client.attackProtection.captcha.update(attackProtection.captcha));
         }
         if (attackProtection.bruteForceProtection) {
-            updates.push(this.client.attackProtection.bruteForceProtection.update(attackProtection.bruteForceProtection));
+            // Strip fields returned by GET but rejected by PATCH
+            const { form_submission_mode, form_submission_behavior, ...bruteForcePayload } = attackProtection.bruteForceProtection;
+            updates.push(this.client.attackProtection.bruteForceProtection.update(bruteForcePayload));
         }
         if (attackProtection.suspiciousIpThrottling) {
             updates.push(this.client.attackProtection.suspiciousIpThrottling.update(attackProtection.suspiciousIpThrottling));

package/lib/tools/auth0/handlers/clientAuthCredentials.d.ts

@@ -0,0 +1,27 @@
+import { Assets, Auth0APIClient, CalculatedChanges } from '../../../types';
+import { ConfigFunction } from '../../../configFactory';
+export declare const schema: {
+    type: string;
+    items: {
+        type: string;
+    };
+};
+export default class ClientAuthCredentialsHandler {
+    client: Auth0APIClient;
+    config: ConfigFunction;
+    type: string;
+    existing: null;
+    constructor({ client, config }: {
+        client: Auth0APIClient;
+        config: ConfigFunction;
+    });
+    getType(): Promise<null>;
+    load(): Promise<{
+        [x: string]: null;
+    }>;
+    validate(): Promise<null>;
+    dryRunChanges(_assets: Assets): Promise<CalculatedChanges>;
+    processChanges(assets: Assets): Promise<void>;
+    private inferCredentialType;
+    private inferMethodFromType;
+}

package/lib/tools/auth0/handlers/clientAuthCredentials.js

@@ -0,0 +1,234 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.schema = void 0;
+const default_1 = require("./default");
+const client_1 = require("../client");
+const logger_1 = __importDefault(require("../../../logger"));
+exports.schema = {
+    type: 'array',
+    items: { type: 'object' },
+};
+const CREDENTIAL_TYPE_TO_METHOD = {
+    public_key: 'private_key_jwt',
+    x509_cert: 'self_signed_tls_client_auth',
+    cert_subject_dn: 'tls_client_auth',
+};
+class ClientAuthCredentialsHandler {
+    constructor({ client, config }) {
+        this.type = 'clientAuthCredentials';
+        this.existing = null;
+        this.client = client;
+        this.config = config;
+    }
+    async getType() {
+        return null;
+    }
+    async load() {
+        logger_1.default.info(`Retrieving ${this.type} data from Auth0`);
+        return { [this.type]: null };
+    }
+    async validate() {
+        return null;
+    }
+    // Credentials are per-client sub-resources with no top-level asset list, so they are not
+    // modeled in the dry-run diff. Return empty changes so the dry-run loop (which calls
+    // dryRunChanges on every handler) does not crash. Credential changes are still applied
+    // during a real import via processChanges.
+    async dryRunChanges(_assets) {
+        return { del: [], create: [], conflicts: [], update: [] };
+    }
+    async processChanges(assets) {
+        const { clients } = assets;
+        if (!clients)
+            return;
+        const allowDelete = this.config('AUTH0_ALLOW_DELETE') === true || this.config('AUTH0_ALLOW_DELETE') === 'true';
+        // Only process clients that have client_authentication_methods in config.
+        // Full deletion (absent field) is handled by ClientAuthCredentialsPreHandler at order 40,
+        // before clients.ts runs. This handler only manages create and partial delete.
+        const clientsWithCam = clients.filter((c) => c.client_authentication_methods !== undefined);
+        if (clientsWithCam.length === 0)
+            return;
+        // In directory mode client_id is stripped. Resolve names for PKI clients only.
+        const needsNameResolution = clientsWithCam.some((c) => !c.client_id);
+        let clientIdByName = new Map();
+        if (needsNameResolution) {
+            const existingClients = await (0, client_1.paginate)(this.client.clients.list, {
+                paginate: true,
+                is_global: false,
+            });
+            clientIdByName = new Map(existingClients.map((c) => [c.name, c.client_id]));
+        }
+        for (const client of clientsWithCam) {
+            const clientId = client.client_id || (client.name && clientIdByName.get(client.name));
+            if (!clientId)
+                continue;
+            client.client_id = clientId;
+            const clientName = client.name || clientId;
+            // Collect all desired credentials across all auth methods (only pem-bearing entries)
+            const desired = [];
+            if (client.client_authentication_methods) {
+                for (const [methodKey, methodVal] of Object.entries(client.client_authentication_methods)) {
+                    const credentials = methodVal?.credentials || [];
+                    for (const cred of credentials) {
+                        if (!cred.pem)
+                            continue;
+                        desired.push({
+                            name: cred.name,
+                            pem: cred.pem,
+                            credential_type: cred.credential_type || this.inferCredentialType(methodKey),
+                            method: methodKey,
+                            kid: cred.kid,
+                            alg: cred.alg,
+                            expires_at: cred.expires_at,
+                            parse_expiry_from_cert: cred.parse_expiry_from_cert,
+                        });
+                    }
+                }
+            }
+            // pem is the opt-in signal: present field with no pem = skip (safe export→deploy);
+            // absent field = fall through to delete path (intentional removal).
+            if (desired.length === 0 && client.client_authentication_methods)
+                continue;
+            let existing = [];
+            try {
+                existing = (await this.client.clients.credentials.list(clientId));
+            }
+            catch (err) {
+                logger_1.default.warn(`clientAuthCredentials: failed to list credentials for client "${clientName}": ${err}`);
+                continue;
+            }
+            // No credentials in Auth0 and none desired — nothing to do.
+            if (existing.length === 0 && desired.length === 0)
+                continue;
+            // Warn if duplicate names exist in Auth0 — we can't match safely
+            const existingNames = existing.map((c) => c.name);
+            const duplicateNames = existingNames.filter((n, i) => existingNames.indexOf(n) !== i);
+            if (duplicateNames.length > 0) {
+                logger_1.default.warn(`clientAuthCredentials: client "${clientName}" has duplicate credential names in Auth0 [${duplicateNames.join(', ')}] — skipping credential reconciliation for this client`);
+                continue;
+            }
+            const existingByName = new Map(existing.map((c) => [c.name, c]));
+            const desiredNames = new Set(desired.map((d) => d.name));
+            const toCreate = desired.filter((d) => !existingByName.has(d.name));
+            const toDelete = existing.filter((e) => !desiredNames.has(e.name));
+            // Creates first — Auth0 allows max 2 credentials; both must exist simultaneously during rotation
+            // Track name→id so we can correctly attribute each created credential to its method later.
+            const createdIdByName = new Map();
+            for (const cred of toCreate) {
+                try {
+                    // Forward all API-accepted fields. `!= null` drops unset (undefined) and empty
+                    // (YAML `kid:` → null) values the API rejects, while keeping an explicit `false`.
+                    const createPayload = Object.fromEntries(Object.entries({
+                        name: cred.name,
+                        pem: cred.pem,
+                        credential_type: cred.credential_type,
+                        kid: cred.kid,
+                        alg: cred.alg,
+                        expires_at: cred.expires_at,
+                        parse_expiry_from_cert: cred.parse_expiry_from_cert,
+                    }).filter(([, v]) => v != null));
+                    const created = await this.client.clients.credentials.create(clientId, createPayload);
+                    logger_1.default.info(`clientAuthCredentials: created credential "${cred.name}" on client "${clientName}"`);
+                    createdIdByName.set(cred.name, created.id);
+                }
+                catch (err) {
+                    logger_1.default.warn(`clientAuthCredentials: failed to create credential "${cred.name}" on client "${clientName}": ${err}`);
+                }
+            }
+            // Re-wire client_authentication_methods with final IDs (kept + newly created).
+            // This must happen BEFORE deletes — Auth0 rejects deleting a credential that
+            // is still referenced in client_authentication_methods.
+            const keptIds = existing.filter((e) => desiredNames.has(e.name)).map((e) => e.id);
+            const createdIds = [...createdIdByName.values()];
+            const finalIds = [...keptIds, ...createdIds];
+            let updatedAuthMethods = null;
+            if (finalIds.length > 0) {
+                // Build method→ids map. For kept credentials use Auth0's stored type to infer method;
+                // for created credentials use the method from the user's config entry (by name).
+                const methodToIds = {};
+                for (const id of finalIds) {
+                    const fromExisting = existing.find((e) => e.id === id);
+                    const createdName = [...createdIdByName.entries()].find(([, cid]) => cid === id)?.[0];
+                    const fromDesired = createdName ? desired.find((d) => d.name === createdName) : undefined;
+                    const methodKey = (fromExisting && this.inferMethodFromType(fromExisting.credential_type)) ||
+                        (fromDesired && fromDesired.method) ||
+                        Object.keys(client.client_authentication_methods)[0];
+                    if (!methodToIds[methodKey])
+                        methodToIds[methodKey] = [];
+                    methodToIds[methodKey].push(id);
+                }
+                updatedAuthMethods = {};
+                for (const [methodKey, ids] of Object.entries(methodToIds)) {
+                    updatedAuthMethods[methodKey] = { credentials: ids.map((id) => ({ id })) };
+                }
+            }
+            // Always update client_authentication_methods before deletes:
+            // - When finalIds > 0: re-wire to the remaining credentials
+            // - When finalIds === 0 but toDelete > 0: set to null so Auth0 de-references them first
+            if (finalIds.length > 0 || toDelete.length > 0) {
+                try {
+                    const payload = {
+                        client_authentication_methods: updatedAuthMethods ?? null,
+                    };
+                    // Auth0 requires token_endpoint_auth_method: null when setting client_authentication_methods,
+                    // and a non-null value when clearing it.
+                    if (updatedAuthMethods) {
+                        payload.token_endpoint_auth_method = null;
+                    }
+                    else {
+                        payload.token_endpoint_auth_method =
+                            client.token_endpoint_auth_method || 'client_secret_post';
+                    }
+                    await this.client.clients.update(clientId, payload);
+                    logger_1.default.info(`clientAuthCredentials: updated client_authentication_methods on client "${clientName}"`);
+                }
+                catch (err) {
+                    logger_1.default.warn(`clientAuthCredentials: failed to update client_authentication_methods on client "${clientName}": ${err}`);
+                }
+            }
+            // Deletes last — after client_authentication_methods no longer references them
+            if (toDelete.length > 0) {
+                if (!allowDelete) {
+                    logger_1.default.warn(`clientAuthCredentials: the following credentials on client "${clientName}" would be deleted but AUTH0_ALLOW_DELETE is not set:\n${toDelete
+                        .map((c) => `  ${c.name} (${c.id})`)
+                        .join('\n')}`);
+                }
+                else {
+                    for (const cred of toDelete) {
+                        try {
+                            await this.client.clients.credentials.delete(clientId, cred.id);
+                            logger_1.default.info(`clientAuthCredentials: deleted credential "${cred.name}" on client "${clientName}"`);
+                        }
+                        catch (err) {
+                            logger_1.default.warn(`clientAuthCredentials: failed to delete credential "${cred.name}" on client "${clientName}": ${err}`);
+                        }
+                    }
+                }
+            }
+        }
+    }
+    inferCredentialType(methodKey) {
+        const map = {
+            private_key_jwt: 'public_key',
+            self_signed_tls_client_auth: 'x509_cert',
+            tls_client_auth: 'cert_subject_dn',
+        };
+        return map[methodKey] || 'public_key';
+    }
+    inferMethodFromType(credentialType) {
+        return CREDENTIAL_TYPE_TO_METHOD[credentialType] || 'private_key_jwt';
+    }
+}
+exports.default = ClientAuthCredentialsHandler;
+__decorate([
+    (0, default_1.order)('70')
+], ClientAuthCredentialsHandler.prototype, "processChanges", null);

package/lib/tools/auth0/handlers/clientAuthCredentialsPre.d.ts

@@ -0,0 +1,38 @@
+import { Assets, Auth0APIClient, CalculatedChanges } from '../../../types';
+import { ConfigFunction } from '../../../configFactory';
+export declare const schema: {
+    type: string;
+    items: {
+        type: string;
+    };
+};
+/**
+ * Handles full credential deletion BEFORE clients.ts (order 50) patches the client.
+ *
+ * Auth0 rejects a client PATCH containing token_endpoint_auth_method while that client still
+ * has active credentials. By running at order 40, this handler clears credentials (and
+ * client_authentication_methods) for any client where the field is absent from config, so
+ * that clients.ts can safely include token_endpoint_auth_method in its PATCH.
+ *
+ * Partial deletion (some credentials removed, others kept) is handled by
+ * ClientAuthCredentialsHandler at order 70, because those clients still have
+ * client_authentication_methods present in config and clients.ts strips token_endpoint_auth_method
+ * for them anyway.
+ */
+export default class ClientAuthCredentialsPreHandler {
+    client: Auth0APIClient;
+    config: ConfigFunction;
+    type: string;
+    existing: null;
+    constructor({ client, config }: {
+        client: Auth0APIClient;
+        config: ConfigFunction;
+    });
+    getType(): Promise<null>;
+    load(): Promise<{
+        [x: string]: null;
+    }>;
+    validate(): Promise<null>;
+    dryRunChanges(_assets: Assets): Promise<CalculatedChanges>;
+    processChanges(assets: Assets): Promise<void>;
+}