auth0-deploy-cli 9.0.0 → 9.1.0

package/CHANGELOG.md

@@ -7,13 +7,24 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
-## [9.0.0] - 2026-09-18
+## [9.1.0] - 2026-10-07
 
-### Changed
+### Added
 
-- **⚠️ Breaking changes:**
-  - **Config file handlers (import): path traversal is now a hard error.** A file reference that resolves outside the config directory now aborts the import with an error instead of logging a deprecation warning (the warning shipped in 8.43.0 and 8.44.0). This applies to every file-backed field in both directory and YAML formats: action `code`, rule/hook `script`, database `customScripts`, client `custom_login_page`, connection/email-template/branding `body`, prompt partials, and flow/form bodies. Move any out-of-tree references (`../` relative paths or absolute paths) inside your config directory. Blocked references fail with `Path traversal blocked: "<input>" resolves to "<resolved>" which is outside the config directory "<root>".` before any Management API call. `a0deploy export` is unaffected. [#1498]
-  - **`AUTH0_DOMAIN` environment variable: must now be a bare host.** The `node-auth0` v7 upgrade validates the domain more strictly and rejects values that include a scheme or a trailing slash (for example `https://tenant.auth0.com/`); use a bare host such as `tenant.us.auth0.com`. This Management-API-only release also moves token acquisition to the SDK's managed auth, which auto-refreshes tokens during long-running import/export runs while preserving the previous fail-fast behavior on bad credentials. See the [node-auth0 v7 migration guide](https://github.com/auth0/node-auth0/blob/master/v7_MIGRATION_GUIDE.md). [#1491]
+- Add support for the `auth_email_by_code` email template. [#1500]
+- Add support for phone provider protection (`phoneProviderProtection`) to the `attackProtection` resource. [#1503]
+- Support the `require_consent_non_repudiation` resource server property and the `my-account` client `async_approval_notification_channels` value (EA). [#1508]
+- Support `!include` directives in YAML config files, including nested includes, so a large `tenant.yaml` can be split across multiple files. [#1252]
+- Add `AUTH0_EXPORT_CUSTOM_TEXT_LANGUAGES` config to limit which languages' prompts custom text is fetched, shortening exports on tenants with many languages enabled. Behaviour is unchanged when not set. [#1511]
+
+### Fixed
+
+- Speed up imports into large tenants by enriching connection `enabled_clients` only for connections in the local config and skipping the SCIM id map when SCIM is not enabled. [#1505]
+- Allow system resource servers other than the Auth0 My Account API (e.g. the Auth0 My Organization API) to be updated. [#1485]
+- Prevent roles from losing permissions on an interrupted import by diffing permissions instead of clearing and re-adding them, and retrying role updates on 429 responses. [#1510]
+- Reduce `deploy`/`import` memory use and startup time by defining the `prompts.customText` JSON schema once and referencing it per language and prompt, instead of expanding it for every language × prompt × screen combination. [#1509]
+
+## [9.0.0] - 2026-09-18
 
 ### Added
 
@@ -23,6 +34,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Support `enforce_permission_ceiling` and `enforce_self_assignment_restriction` on `my_organization_configuration` (EA). [#1495]
 - Support tenants without the `riskAssessment` and `guardianPolicies` entitlement by handling `insufficient_entitlement` 403 responses gracefully instead of failing the run. [#1493]
 
+### Changed
+
+- **⚠️ Breaking changes:**
+  - **Config file handlers (import): path traversal is now a hard error.** A file reference that resolves outside the config directory now aborts the import with an error instead of logging a deprecation warning (the warning shipped in 8.43.0 and 8.44.0). This applies to every file-backed field in both directory and YAML formats: action `code`, rule/hook `script`, database `customScripts`, client `custom_login_page`, connection/email-template/branding `body`, prompt partials, and flow/form bodies. Move any out-of-tree references (`../` relative paths or absolute paths) inside your config directory. Blocked references fail with `Path traversal blocked: "<input>" resolves to "<resolved>" which is outside the config directory "<root>".` before any Management API call. `a0deploy export` is unaffected. [#1498]
+  - **`AUTH0_DOMAIN` environment variable: must now be a bare host.** The `node-auth0` v7 upgrade validates the domain more strictly and rejects values that include a scheme or a trailing slash (for example `https://tenant.auth0.com/`); use a bare host such as `tenant.us.auth0.com`. This Management-API-only release also moves token acquisition to the SDK's managed auth, which auto-refreshes tokens during long-running import/export runs while preserving the previous fail-fast behavior on bad credentials. See the [node-auth0 v7 migration guide](https://github.com/auth0/node-auth0/blob/master/v7_MIGRATION_GUIDE.md). [#1491]
+
 ### Fixed
 
 - Surface the real API error on `tokenExchangeProfiles` 403 responses. [#1492]
@@ -1898,6 +1915,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 [#1242]: https://github.com/auth0/auth0-deploy-cli/issues/1242
 [#1244]: https://github.com/auth0/auth0-deploy-cli/issues/1244
 [#1246]: https://github.com/auth0/auth0-deploy-cli/issues/1246
+[#1252]: https://github.com/auth0/auth0-deploy-cli/issues/1252
 [#1253]: https://github.com/auth0/auth0-deploy-cli/issues/1253
 [#1261]: https://github.com/auth0/auth0-deploy-cli/issues/1261
 [#1263]: https://github.com/auth0/auth0-deploy-cli/issues/1263
@@ -2000,6 +2018,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 [#1481]: https://github.com/auth0/auth0-deploy-cli/issues/1481
 [#1482]: https://github.com/auth0/auth0-deploy-cli/issues/1482
 [#1483]: https://github.com/auth0/auth0-deploy-cli/issues/1483
+[#1485]: https://github.com/auth0/auth0-deploy-cli/issues/1485
 [#1486]: https://github.com/auth0/auth0-deploy-cli/issues/1486
 [#1487]: https://github.com/auth0/auth0-deploy-cli/issues/1487
 [#1489]: https://github.com/auth0/auth0-deploy-cli/issues/1489
@@ -2011,7 +2030,15 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 [#1496]: https://github.com/auth0/auth0-deploy-cli/issues/1496
 [#1497]: https://github.com/auth0/auth0-deploy-cli/issues/1497
 [#1498]: https://github.com/auth0/auth0-deploy-cli/issues/1498
-[Unreleased]: https://github.com/auth0/auth0-deploy-cli/compare/v9.0.0...HEAD
+[#1500]: https://github.com/auth0/auth0-deploy-cli/issues/1500
+[#1503]: https://github.com/auth0/auth0-deploy-cli/issues/1503
+[#1505]: https://github.com/auth0/auth0-deploy-cli/issues/1505
+[#1509]: https://github.com/auth0/auth0-deploy-cli/issues/1509
+[#1508]: https://github.com/auth0/auth0-deploy-cli/issues/1508
+[#1510]: https://github.com/auth0/auth0-deploy-cli/issues/1510
+[#1511]: https://github.com/auth0/auth0-deploy-cli/issues/1511
+[Unreleased]: https://github.com/auth0/auth0-deploy-cli/compare/v9.1.0...HEAD
+[9.1.0]: https://github.com/auth0/auth0-deploy-cli/compare/v9.0.0...v9.1.0
 [9.0.0]: https://github.com/auth0/auth0-deploy-cli/compare/v8.45.0...v9.0.0
 [8.45.0]: https://github.com/auth0/auth0-deploy-cli/compare/v8.44.0...v8.45.0
 [8.44.0]: https://github.com/auth0/auth0-deploy-cli/compare/v8.43.0...v8.44.0

package/lib/context/directory/handlers/attackProtection.js

@@ -17,6 +17,7 @@ function attackProtectionFiles(filePath) {
         bruteForceProtection: path_1.default.join(directory, 'brute-force-protection.json'),
         captcha: path_1.default.join(directory, 'captcha.json'),
         suspiciousIpThrottling: path_1.default.join(directory, 'suspicious-ip-throttling.json'),
+        phoneProviderProtection: path_1.default.join(directory, 'phone-provider-protection.json'),
     };
 }
 function parse(context) {
@@ -55,6 +56,12 @@ function parse(context) {
             disableKeywordReplacement: context.disableKeywordReplacement,
         });
     }
+    if ((0, utils_1.isFile)(files.phoneProviderProtection)) {
+        attackProtection.phoneProviderProtection = (0, utils_1.loadJSON)(files.phoneProviderProtection, {
+            mappings: context.mappings,
+            disableKeywordReplacement: context.disableKeywordReplacement,
+        });
+    }
     return {
         attackProtection,
     };
@@ -81,6 +88,9 @@ async function dump(context) {
     if (maskedAttackProtection.suspiciousIpThrottling) {
         (0, utils_1.dumpJSON)(files.suspiciousIpThrottling, maskedAttackProtection.suspiciousIpThrottling);
     }
+    if (maskedAttackProtection.phoneProviderProtection) {
+        (0, utils_1.dumpJSON)(files.phoneProviderProtection, maskedAttackProtection.phoneProviderProtection);
+    }
 }
 const attackProtectionHandler = {
     parse,

package/lib/context/index.js

@@ -27,6 +27,7 @@ const nonPrimitiveProps = [
     'EXCLUDED_PROPS',
     'INCLUDED_PROPS',
     'AUTH0_INCLUDED_CONNECTIONS',
+    'AUTH0_EXPORT_CUSTOM_TEXT_LANGUAGES',
 ];
 const EA_FEATURES = [];
 const setupContext = async (config, command) => {

package/lib/context/yaml/handlers/attackProtection.js

@@ -13,7 +13,7 @@ async function dump(context) {
     const { attackProtection } = context.assets;
     if (!attackProtection)
         return { attackProtection: null };
-    const { botDetection, suspiciousIpThrottling, breachedPasswordDetection, bruteForceProtection, captcha, } = attackProtection;
+    const { botDetection, suspiciousIpThrottling, breachedPasswordDetection, bruteForceProtection, captcha, phoneProviderProtection, } = attackProtection;
     const attackProtectionConfig = {
         suspiciousIpThrottling,
         breachedPasswordDetection,
@@ -25,6 +25,9 @@ async function dump(context) {
     if (captcha) {
         attackProtectionConfig.captcha = captcha;
     }
+    if (phoneProviderProtection) {
+        attackProtectionConfig.phoneProviderProtection = phoneProviderProtection;
+    }
     const maskedAttackProtection = (0, defaults_1.attackProtectionDefaults)(attackProtectionConfig, context.config);
     return {
         attackProtection: (0, defaults_1.sortAttackProtectionArrays)(maskedAttackProtection),

package/lib/context/yaml/index.js

@@ -6,6 +6,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 const fs_extra_1 = __importDefault(require("fs-extra"));
 const js_yaml_1 = __importDefault(require("js-yaml"));
 const path_1 = __importDefault(require("path"));
+const lodash_1 = require("lodash");
 const tools_1 = require("../../tools");
 const client_1 = __importDefault(require("../../tools/auth0/client"));
 const logger_1 = __importDefault(require("../../logger"));
@@ -14,6 +15,83 @@ const handlers_1 = __importDefault(require("./handlers"));
 const readonly_1 = __importDefault(require("../../readonly"));
 const __1 = require("..");
 const keywordPreservation_1 = require("../../keywordPreservation");
+// Symbol marker so a literal `__include` key in user YAML isn't read as a directive
+const INCLUDE = Symbol('include');
+// Custom YAML type for file includes
+const includeType = new js_yaml_1.default.Type('!include', {
+    kind: 'scalar',
+    resolve: (data) => typeof data === 'string',
+    construct: (data) => {
+        // This will be handled during the actual loading process
+        return { [INCLUDE]: data };
+    },
+});
+const schema = js_yaml_1.default.DEFAULT_SCHEMA.extend([includeType]);
+function prepareYamlContent(content, mappings, disableKeywordReplacement) {
+    return disableKeywordReplacement
+        ? (0, tools_1.wrapArrayReplaceMarkersInQuotes)(content, mappings)
+        : (0, tools_1.keywordReplace)(content, mappings);
+}
+function parseYaml(content) {
+    return js_yaml_1.default.load(content, { schema });
+}
+// Resolves !include directives. Keyword handling is applied by the caller before parse.
+// configRoot is threaded unchanged so chained `../` includes can't escape it.
+function resolveIncludes(obj, basePath, configRoot, loadIncludedYaml, visitedFiles = new Set()) {
+    if (Array.isArray(obj)) {
+        return obj.map((item) => resolveIncludes(item, basePath, configRoot, loadIncludedYaml, visitedFiles));
+    }
+    if (obj && typeof obj === 'object') {
+        const includePath = obj[INCLUDE];
+        if (includePath !== undefined) {
+            const filePath = path_1.default.resolve(basePath, includePath);
+            (0, utils_1.assertInsideConfigRoot)(includePath, filePath, configRoot);
+            if (visitedFiles.has(filePath)) {
+                throw new Error(`Circular include detected: ${filePath}`);
+            }
+            let stat;
+            try {
+                stat = fs_extra_1.default.statSync(filePath);
+            }
+            catch (err) {
+                if (err.code === 'ENOENT') {
+                    throw new Error(`Include file not found: ${filePath}`);
+                }
+                throw err;
+            }
+            if (stat.isDirectory()) {
+                throw new Error(`Include path is a directory, expected a file: ${filePath}`);
+            }
+            // visitedFiles backtracks (add before, delete after), so one shared set is enough
+            visitedFiles.add(filePath);
+            const result = resolveIncludes(loadIncludedYaml(filePath), path_1.default.dirname(filePath), configRoot, loadIncludedYaml, visitedFiles);
+            visitedFiles.delete(filePath);
+            return result;
+        }
+        // Only rebuild plain objects; pass others (e.g. a Date from a YAML timestamp) through untouched
+        if (!(0, lodash_1.isPlainObject)(obj)) {
+            return obj;
+        }
+        const result = {};
+        for (const [key, value] of Object.entries(obj)) {
+            const resolved = resolveIncludes(value, basePath, configRoot, loadIncludedYaml, visitedFiles);
+            // Define `__proto__` as an own property so an included file can't pollute the prototype
+            if (key === '__proto__') {
+                Object.defineProperty(result, key, {
+                    value: resolved,
+                    enumerable: true,
+                    writable: true,
+                    configurable: true,
+                });
+            }
+            else {
+                result[key] = resolved;
+            }
+        }
+        return result;
+    }
+    return obj;
+}
 class YAMLContext {
     constructor(config, mgmtClient) {
         this.configFile = config.AUTH0_INPUT_FILE;
@@ -61,9 +139,12 @@ class YAMLContext {
             try {
                 const fPath = path_1.default.resolve(this.configFile);
                 logger_1.default.debug(`Loading YAML from ${fPath}`);
-                Object.assign(this.assets, js_yaml_1.default.load(opts.disableKeywordReplacement
-                    ? (0, tools_1.wrapArrayReplaceMarkersInQuotes)(fs_extra_1.default.readFileSync(fPath, 'utf8'), this.mappings)
-                    : (0, tools_1.keywordReplace)(fs_extra_1.default.readFileSync(fPath, 'utf8'), this.mappings)) || {});
+                const prepareContent = (content) => prepareYamlContent(content, this.mappings, opts.disableKeywordReplacement);
+                const loadIncludedYaml = (filePath) => parseYaml(prepareContent(fs_extra_1.default.readFileSync(filePath, 'utf8')));
+                const parsed = parseYaml(prepareContent(fs_extra_1.default.readFileSync(fPath, 'utf8')));
+                // Bound includes by the same config root loadFile() enforces
+                const configRoot = path_1.default.resolve(this.basePath);
+                Object.assign(this.assets, resolveIncludes(parsed, path_1.default.dirname(fPath), configRoot, loadIncludedYaml) || {});
             }
             catch (err) {
                 logger_1.default.debug(err.stack);

package/lib/tools/auth0/handlers/attackProtection.d.ts

@@ -165,6 +165,17 @@ export declare const schema: {
         suspiciousIpThrottling: {
             type: string;
         };
+        phoneProviderProtection: {
+            type: string;
+            properties: {
+                type: {
+                    type: string;
+                    enum: string[];
+                    description: string;
+                };
+            };
+            required: string[];
+        };
     };
     additionalProperties: boolean;
 };
@@ -174,6 +185,7 @@ export type AttackProtection = {
     bruteForceProtection: Asset;
     captcha?: Asset | null;
     suspiciousIpThrottling: Asset;
+    phoneProviderProtection?: Asset | null;
 };
 export default class AttackProtectionHandler extends DefaultAPIHandler {
     existing: AttackProtection | null;

package/lib/tools/auth0/handlers/attackProtection.js

@@ -180,6 +180,17 @@ exports.schema = {
         suspiciousIpThrottling: {
             type: 'object',
         },
+        phoneProviderProtection: {
+            type: 'object',
+            properties: {
+                type: {
+                    type: 'string',
+                    enum: ['exponential', 'default'],
+                    description: 'The backoff strategy applied to Send SMS during MFA enrollment. Gated by the sms_exponential_backoff feature flag; when the flag is disabled the API returns 403 and this setting is skipped on export.',
+                },
+            },
+            required: ['type'],
+        },
     },
     additionalProperties: false,
 };
@@ -227,6 +238,11 @@ class AttackProtectionHandler extends default_1.default {
                     enabled: item.suspiciousIpThrottling.enabled,
                 };
             }
+            if (item.phoneProviderProtection?.type) {
+                obj['phone-provider-protection'] = {
+                    type: item.phoneProviderProtection.type,
+                };
+            }
             return obj;
         })();
         return super.objString(objectString);
@@ -242,6 +258,7 @@ class AttackProtectionHandler extends default_1.default {
         ]);
         let botDetection = null;
         let captcha = null;
+        let phoneProviderProtection = null;
         try {
             botDetection = await this.client.attackProtection.botDetection.get();
         }
@@ -264,6 +281,17 @@ class AttackProtectionHandler extends default_1.default {
                 throw err;
             }
         }
+        try {
+            phoneProviderProtection = await this.client.attackProtection.phoneProviderProtection.get();
+        }
+        catch (err) {
+            if (err.statusCode === 403) {
+                logger_1.default.warn('Phone provider protection is not enabled for this tenant (sms_exponential_backoff feature flag). Skipping phone provider protection settings.');
+            }
+            else {
+                throw err;
+            }
+        }
         const attackProtection = {
             breachedPasswordDetection: breachedPasswordDetection,
             bruteForceProtection: bruteForceProtection,
@@ -275,6 +303,9 @@ class AttackProtectionHandler extends default_1.default {
         if (captcha) {
             attackProtection.captcha = captcha;
         }
+        if (phoneProviderProtection) {
+            attackProtection.phoneProviderProtection = phoneProviderProtection;
+        }
         this.existing = attackProtection;
         return this.existing;
     }
@@ -321,6 +352,22 @@ class AttackProtectionHandler extends default_1.default {
         if (attackProtection.suspiciousIpThrottling) {
             updates.push(this.client.attackProtection.suspiciousIpThrottling.update(attackProtection.suspiciousIpThrottling));
         }
+        // Phone provider protection uses PATCH (not update) and requires `type` on every request.
+        // Guard the 403 (sms_exponential_backoff flag off) per-promise so a flag-off tenant does
+        // not fail the whole attackProtection stage — mirrors the 403-skip in getType().
+        if (attackProtection.phoneProviderProtection?.type) {
+            updates.push(this.client.attackProtection.phoneProviderProtection
+                .patch({
+                type: attackProtection.phoneProviderProtection.type,
+            })
+                .catch((err) => {
+                if (err.statusCode === 403) {
+                    logger_1.default.warn('Phone provider protection is not enabled for this tenant (sms_exponential_backoff feature flag). Skipping phone provider protection update.');
+                    return;
+                }
+                throw err;
+            }));
+        }
         if (!updates.length) {
             return;
         }

package/lib/tools/auth0/handlers/clients.js

@@ -354,7 +354,7 @@ exports.schema = {
                 description: 'An ordered array of notification channels enabled for CIBA (Client-Initiated Backchannel Authentication) requests. Channels are evaluated in the order specified.',
                 items: {
                     type: 'string',
-                    enum: ['guardian-push', 'email'],
+                    enum: ['guardian-push', 'email', 'my-account'],
                 },
             },
             skip_non_verifiable_callback_uri_confirmation_prompt: {

package/lib/tools/auth0/handlers/connections.d.ts

@@ -230,6 +230,7 @@ export declare const processConnectionEnabledClients: (auth0Client: Auth0APIClie
 export default class ConnectionsHandler extends DefaultAPIHandler {
     existing: Connection[] | null;
     scimHandler: ScimHandler;
+    private enabledClientsEnrichmentFilter;
     constructor(config: DefaultAPIHandler);
     objString(connection: any): string;
     getFormattedOptions(connection: any, clients: any): {
@@ -270,6 +271,7 @@ export default class ConnectionsHandler extends DefaultAPIHandler {
      * @param changes - Object containing arrays of connections to create, update, and resolve conflicts for
      */
     processConnectionDirectoryProvisioning(changes: CalculatedChanges): Promise<void>;
+    private setEnabledClientsEnrichmentFilter;
     getType(): Promise<Asset[] | null>;
     calcChanges(assets: Assets): Promise<CalculatedChanges>;
     dryRunChanges(assets: Assets): Promise<CalculatedChanges>;

package/lib/tools/auth0/handlers/connections.js

@@ -372,6 +372,10 @@ class ConnectionsHandler extends default_1.default {
                 create: async (bodyParams) => this.scimHandler.createOverride(bodyParams),
             },
         });
+        // On import, limits getType()'s enabled_clients enrichment to connections in
+        // the local config, skipping an API call per remote-only connection on large
+        // tenants. Null on export, where every connection is enriched.
+        this.enabledClientsEnrichmentFilter = null;
         // @ts-ignore
         this.scimHandler = new scimHandler_1.default(this.config, this.client.connections, this.client.pool);
     }
@@ -621,9 +625,19 @@ class ConnectionsHandler extends default_1.default {
         })
             .promise();
     }
+    // Scopes getType()'s enabled_clients enrichment to the local config's
+    // connection names. Called on import; export leaves it unset (enrich all).
+    setEnabledClientsEnrichmentFilter(connections) {
+        this.enabledClientsEnrichmentFilter = new Set(connections
+            .map((connection) => connection.name)
+            .filter((name) => typeof name === 'string'));
+    }
     async getType() {
         if (this.existing)
             return this.existing;
+        // Consume the import filter and reset it so it can't leak into a later call.
+        const enrichmentFilter = this.enabledClientsEnrichmentFilter;
+        this.enabledClientsEnrichmentFilter = null;
         const [connections, directoryProvisioningConfigs] = await Promise.all([
             (0, client_1.paginate)(this.client.connections.list, {
                 checkpoint: true,
@@ -640,7 +654,11 @@ class ConnectionsHandler extends default_1.default {
         this.existing = filteredConnections;
         if (this.existing === null)
             return [];
-        const connectionTasks = filteredConnections.map((con, index) => ({ con, index }));
+        // Import: enrich only local-config connections. Export (null): enrich all.
+        const shouldEnrich = (con) => enrichmentFilter === null || (con.name != null && enrichmentFilter.has(con.name));
+        const connectionTasks = filteredConnections
+            .map((con, index) => ({ con, index }))
+            .filter(({ con }) => shouldEnrich(con));
         const connectionsWithEnabledClients = await this.client.pool
             .addEachTask({
             data: connectionTasks,
@@ -676,9 +694,9 @@ class ConnectionsHandler extends default_1.default {
             },
         })
             .promise();
-        this.existing = connectionsWithEnabledClients
-            .sort((a, b) => a.index - b.index)
-            .map(({ connection }) => connection);
+        // Merge enriched connections back by index; skipped ones pass through.
+        const enrichedByIndex = new Map(connectionsWithEnabledClients.map(({ index, connection }) => [index, connection]));
+        this.existing = filteredConnections.map((con, index) => enrichedByIndex.get(index) ?? con);
         // Apply `scim_configuration` to all the relevant `SCIM` connections. This method mutates `this.existing`.
         await this.scimHandler.applyScimConfiguration(this.existing);
         return this.existing;
@@ -693,6 +711,8 @@ class ConnectionsHandler extends default_1.default {
                 update: [],
                 conflicts: [],
             };
+        // Scope getType() enrichment to the local config (see getType()).
+        this.setEnabledClientsEnrichmentFilter(connections);
         // Convert enabled_clients by name to the id
         const clients = await (0, client_1.paginate)(this.client.clients.list, {
             paginate: true,
@@ -730,6 +750,8 @@ class ConnectionsHandler extends default_1.default {
                 conflicts: [],
             };
         }
+        // Scope getType() enrichment to the local config (see getType()).
+        this.setEnabledClientsEnrichmentFilter(connections);
         const clients = await (0, client_1.paginate)(this.client.clients.list, {
             paginate: true,
             include_totals: true,

package/lib/tools/auth0/handlers/prompts.d.ts

@@ -47,7 +47,18 @@ export declare const schema: {
             type: string;
         };
         customText: {
+            $id: string;
             type: string;
+            definitions: {
+                promptType: {
+                    type: string;
+                    properties: {};
+                };
+                language: {
+                    type: string;
+                    properties: {};
+                };
+            };
             properties: {};
         };
         partials: {
@@ -87,6 +98,12 @@ export default class PromptsHandler extends DefaultHandler {
     constructor(options: DefaultHandler);
     objString({ customText, screenRenderers }: Prompts): string;
     getType(): Promise<Prompts | null>;
+    /**
+     * Narrows the tenant's enabled languages to those listed in AUTH0_EXPORT_CUSTOM_TEXT_LANGUAGES.
+     * Custom text is fetched with one rate-limited request per language and prompt type, so
+     * limiting languages is the only way to shorten this step on tenants with many languages.
+     */
+    getCustomTextLanguages<T extends string>(enabledLanguages: T[]): T[];
     getCustomTextSettings(): Promise<AllPromptsByLanguage>;
     /**
      * Error handler wrapper.

package/lib/tools/auth0/handlers/prompts.js

@@ -199,25 +199,35 @@ exports.schema = {
         identifier_first: {
             type: 'boolean',
         },
+        // Every language/prompt shares the same shape, so the per-prompt and per-language schemas are
+        // defined once and referenced. Inlining them multiplies the schema by
+        // languages x promptTypes x screenTypes (~184k subschemas), which costs ~1 GB and ~2.5s of
+        // Ajv compile time on every `deploy`. The `$id` scopes the `#/definitions/...` refs to this
+        // subschema so they resolve wherever it is embedded.
         customText: {
+            $id: 'prompts-custom-text',
             type: 'object',
-            properties: types_1.languages.reduce((acc, language) => ({
-                ...acc,
-                [language]: {
+            definitions: {
+                promptType: {
                     type: 'object',
-                    properties: promptTypes.reduce((promptAcc, promptType) => ({
-                        ...promptAcc,
-                        [promptType]: {
+                    properties: screenTypes.reduce((screenAcc, screenType) => ({
+                        ...screenAcc,
+                        [screenType]: {
                             type: 'object',
-                            properties: screenTypes.reduce((screenAcc, screenType) => ({
-                                ...screenAcc,
-                                [screenType]: {
-                                    type: 'object',
-                                },
-                            }), {}),
                         },
                     }), {}),
                 },
+                language: {
+                    type: 'object',
+                    properties: promptTypes.reduce((promptAcc, promptType) => ({
+                        ...promptAcc,
+                        [promptType]: { $ref: '#/definitions/promptType' },
+                    }), {}),
+                },
+            },
+            properties: types_1.languages.reduce((acc, language) => ({
+                ...acc,
+                [language]: { $ref: '#/definitions/language' },
             }), {}),
         },
         partials: {
@@ -306,12 +316,35 @@ class PromptsHandler extends default_1.default {
         }
         return prompts;
     }
+    /**
+     * Narrows the tenant's enabled languages to those listed in AUTH0_EXPORT_CUSTOM_TEXT_LANGUAGES.
+     * Custom text is fetched with one rate-limited request per language and prompt type, so
+     * limiting languages is the only way to shorten this step on tenants with many languages.
+     */
+    getCustomTextLanguages(enabledLanguages) {
+        const configuredLanguages = this.config('AUTH0_EXPORT_CUSTOM_TEXT_LANGUAGES');
+        if (configuredLanguages === undefined)
+            return enabledLanguages;
+        if (!Array.isArray(configuredLanguages) ||
+            !configuredLanguages.every((language) => typeof language === 'string')) {
+            throw new Error('AUTH0_EXPORT_CUSTOM_TEXT_LANGUAGES must be an array of language codes, e.g. ["en", "fr"].');
+        }
+        const notEnabledLanguages = configuredLanguages.filter((language) => !enabledLanguages.includes(language));
+        if (notEnabledLanguages.length > 0) {
+            logger_1.default.warn(`Skipping custom text for languages listed in AUTH0_EXPORT_CUSTOM_TEXT_LANGUAGES that are not enabled on the tenant: ${notEnabledLanguages.join(', ')}`);
+        }
+        const languages = enabledLanguages.filter((language) => configuredLanguages.includes(language));
+        logger_1.default.info(`Retrieving prompts custom text only for languages in AUTH0_EXPORT_CUSTOM_TEXT_LANGUAGES: ${languages.join(', ') || '(none)'}`);
+        return languages;
+    }
     async getCustomTextSettings() {
-        const supportedLanguages = await this.client.tenants.settings.get().then((res) => {
+        const enabledLanguages = await this.client.tenants.settings.get().then((res) => {
             if (res.enabled_locales === undefined)
                 return []; // In rare cases, private cloud tenants may not have `enabled_locales` defined
             return res.enabled_locales;
         });
+        const supportedLanguages = this.getCustomTextLanguages(enabledLanguages);
+        logger_1.default.debug(`Fetching prompts custom text for ${supportedLanguages.length} language(s) x ${promptTypes.length} prompt type(s) (${supportedLanguages.length * promptTypes.length} requests). This endpoint is rate-limited by Auth0, so this may take a while on tenants with many languages enabled; set AUTH0_EXPORT_CUSTOM_TEXT_LANGUAGES to limit which languages are fetched.`);
         return this.client.pool
             .addEachTask({
             data: supportedLanguages

package/lib/tools/auth0/handlers/resourceServers.d.ts

@@ -137,6 +137,10 @@ export declare const schema: {
                 description: string;
                 readOnly: boolean;
             };
+            require_consent_non_repudiation: {
+                type: string;
+                description: string;
+            };
         };
         required: string[];
     };

package/lib/tools/auth0/handlers/resourceServers.js

@@ -124,6 +124,10 @@ exports.schema = {
                 description: 'The client ID of the client that this resource server is linked to (readonly)',
                 readOnly: true,
             },
+            require_consent_non_repudiation: {
+                type: 'boolean',
+                description: 'When true, the authorization server rejects consent decisions that do not include a valid signature and kid. Requires the my_account_consents entitlement.',
+            },
         },
         required: ['name', 'identifier'],
     },
@@ -164,6 +168,7 @@ class ResourceServersHandler extends default_1.default {
                     'id',
                     'is_system',
                     'authorization_policy',
+                    'require_consent_non_repudiation',
                 ];
                 const sanitized = {};
                 allowedKeys.forEach((key) => {
@@ -208,14 +213,19 @@ class ResourceServersHandler extends default_1.default {
         });
     }
     async updateResourceServer(id, update) {
-        // Exclude name from update as it cannot be modified for system resource servers like Auth0 My Account API
-        if (update.is_system === true || update.name === 'Auth0 My Account API') {
+        // Exclude name from update as it cannot be modified for system resource servers like the
+        // Auth0 My Account API or the Auth0 My Organization API. `is_system` is listed in
+        // `stripUpdateFields`, so it has already been removed from `update` by the time this runs -
+        // read it off the existing resource server instead, which `getType()` retains it on.
+        const existing = this.existing?.find((resourceServer) => resourceServer.id === id);
+        if (existing?.is_system === true) {
             const updateFields = {
                 token_lifetime: update.token_lifetime,
                 proof_of_possession: update.proof_of_possession,
                 skip_consent_for_verifiable_first_party_clients: update.skip_consent_for_verifiable_first_party_clients,
                 subject_type_authorization: update.subject_type_authorization,
                 authorization_policy: update.authorization_policy,
+                require_consent_non_repudiation: update.require_consent_non_repudiation,
             };
             return this.client.resourceServers.update(id, updateFields);
         }

package/lib/tools/auth0/handlers/roles.js

@@ -132,22 +132,30 @@ class RolesHandler extends default_1.default {
         }
     }
     async updateRole(data, roles) {
-        const existingRole = await roles.find((roleDataForUpdate) => roleDataForUpdate.name === data.name);
+        // Match on id first so a renamed role (matched by id, new name) still resolves to its
+        // existing permissions; fall back to name for configs imported without ids.
+        const existingRole = roles.find((r) => r.id === data.id) || roles.find((r) => r.name === data.name);
         const params = { id: data.id };
-        const newPermissions = data.permissions;
+        const newPermissions = data.permissions || [];
         delete data.permissions;
         delete data.id;
         // deploy-cli only manages tenant-level roles, so `type` is stripped on write; this
         // lets files that already carry it (from a prior export) be imported cleanly.
         delete data.type;
-        await this.client.roles.update(params.id, data);
-        if (typeof existingRole.permissions !== 'undefined' && existingRole.permissions.length > 0) {
-            await this.client.roles.permissions.delete(params.id, {
-                permissions: existingRole.permissions,
-            });
+        const retryConfig = this.getRetryConfig();
+        await (0, default_1.retryWithExponentialBackoff)(() => this.client.roles.update(params.id, data), retryConfig);
+        // Only touch permissions that actually changed, and add before removing so an
+        // interrupted run can never leave a role with fewer permissions than it started with.
+        const existingPermissions = existingRole.permissions || [];
+        const samePermission = (a, b) => a.permission_name === b.permission_name &&
+            a.resource_server_identifier === b.resource_server_identifier;
+        const permissionsToAdd = newPermissions.filter((p) => !existingPermissions.some((e) => samePermission(e, p)));
+        const permissionsToRemove = existingPermissions.filter((e) => !newPermissions.some((p) => samePermission(e, p)));
+        if (permissionsToAdd.length > 0) {
+            await (0, default_1.retryWithExponentialBackoff)(() => this.client.roles.permissions.add(params.id, { permissions: permissionsToAdd }), retryConfig);
         }
-        if (typeof newPermissions !== 'undefined' && newPermissions.length > 0) {
-            await this.client.roles.permissions.add(params.id, { permissions: newPermissions });
+        if (permissionsToRemove.length > 0) {
+            await (0, default_1.retryWithExponentialBackoff)(() => this.client.roles.permissions.delete(params.id, { permissions: permissionsToRemove }), retryConfig);
         }
         return params;
     }

package/lib/tools/auth0/handlers/scimHandler.js

@@ -39,6 +39,10 @@ class ScimHandler {
      * @param connections
      */
     async createIdMap(connections) {
+        // No `read:scim_config` scope means nothing to fetch. Return before clearing
+        // to keep any existing map and skip a no-op pool task per connection.
+        if (!this.scimScopes.read)
+            return;
         this.idMap.clear();
         const logMsg = 'Reviewing connections for SCIM support. This may take a while...';
         if (nconf_1.default.get('AUTH0_DRY_RUN')) {
@@ -47,14 +51,15 @@ class ScimHandler {
         else {
             logger_1.default.info(logMsg);
         }
+        // Only SCIM-capable strategies can carry a SCIM configuration; filtering here
+        // keeps non-SCIM connections out of the throttled pool.
+        const scimConnections = (connections || []).filter((connection) => this.isScimStrategy(connection.strategy));
         await this.poolClient
             .addEachTask({
-            data: connections || [],
+            data: scimConnections,
             generator: (connection) => {
                 if (!this.scimScopes.read)
                     return Promise.resolve(null);
-                if (!this.isScimStrategy(connection.strategy))
-                    return Promise.resolve(null);
                 this.idMap.set(connection.id, { strategy: connection.strategy });
                 return this.getScimConfiguration(connection.id)
                     .then((response) => {

package/lib/tools/constants.d.ts

@@ -35,6 +35,7 @@ declare const constants: {
     EMAIL_MFA_OOB_CODE: string;
     EMAIL_USER_INVITATION: string;
     EMAIL_ASYNC_APPROVAL: string;
+    EMAIL_AUTH_BY_CODE: string;
     GUARDIAN_DIRECTORY: string;
     GUARDIAN_FACTORS_DIRECTORY: string;
     GUARDIAN_PROVIDERS_DIRECTORY: string;

package/lib/tools/constants.js

@@ -20,6 +20,7 @@ const EMAIL_PASSWORD_RESET = 'password_reset';
 const EMAIL_MFA_OOB_CODE = 'mfa_oob_code';
 const EMAIL_USER_INVITATION = 'user_invitation';
 const EMAIL_ASYNC_APPROVAL = 'async_approval';
+const EMAIL_AUTH_BY_CODE = 'auth_email_by_code';
 const UNIVERSAL_LOGIN_TEMPLATE = 'universal_login';
 const OBFUSCATED_SECRET_VALUE = '_VALUE_NOT_SHOWN_';
 const constants = {
@@ -56,6 +57,7 @@ const constants = {
         'password_reset',
         'user_invitation',
         'async_approval',
+        'auth_email_by_code',
     ],
     ACTIONS_TRIGGERS: [
         'post-login',
@@ -84,6 +86,7 @@ const constants = {
     EMAIL_MFA_OOB_CODE,
     EMAIL_USER_INVITATION,
     EMAIL_ASYNC_APPROVAL,
+    EMAIL_AUTH_BY_CODE,
     GUARDIAN_DIRECTORY: 'guardian',
     GUARDIAN_FACTORS_DIRECTORY: 'factors',
     GUARDIAN_PROVIDERS_DIRECTORY: 'providers',
@@ -181,6 +184,8 @@ const constants = {
         `${EMAIL_USER_INVITATION}.html`,
         `${EMAIL_ASYNC_APPROVAL}.json`,
         `${EMAIL_ASYNC_APPROVAL}.html`,
+        `${EMAIL_AUTH_BY_CODE}.json`,
+        `${EMAIL_AUTH_BY_CODE}.html`,
     ],
     SUPPORTED_BRANDING_TEMPLATES: [UNIVERSAL_LOGIN_TEMPLATE],
     LOG_STREAMS_DIRECTORY: 'log-streams',

package/lib/types.d.ts

@@ -77,6 +77,7 @@ export type Config = {
     AUTH0_EXPORT_IDENTIFIERS?: boolean;
     AUTH0_EXPORT_ORDERED?: boolean;
     AUTH0_EXPORT_SECRETS?: boolean;
+    AUTH0_EXPORT_CUSTOM_TEXT_LANGUAGES?: string[];
     AUTH0_CONNECTIONS_DIRECTORY?: string;
     AUTH0_DRY_RUN?: boolean | 'preview';
     AUTH0_DRY_RUN_INTERACTIVE?: boolean;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "auth0-deploy-cli",
-  "version": "9.0.0",
+  "version": "9.1.0",
   "description": "A command line tool for deploying updates to your Auth0 tenant",
   "main": "lib/index.js",
   "bin": {
@@ -35,7 +35,7 @@
   "dependencies": {
     "@clack/prompts": "1.4.0",
     "ajv": "^6.12.6",
-    "auth0": "^7.2.0",
+    "auth0": "^7.3.0",
     "chalk": "5.6.2",
     "dot-prop": "^5.3.0",
     "fs-extra": "^10.1.0",