auth0 5.14.0 → 6.1.0

package/dist/esm/management/core/fetcher/getResponseBody.mjs

@@ -9,6 +9,15 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
 };
 import { fromJson } from "../json.mjs";
 import { getBinaryResponse } from "./BinaryResponse.mjs";
+// Pins the upstream Response so undici's FinalizationRegistry can't GC it and cancel the body stream.
+function retainResponse(target, response) {
+    Object.defineProperty(target, "__fern_response_ref", {
+        value: response,
+        enumerable: false,
+        configurable: true,
+        writable: false,
+    });
+}
 export function getResponseBody(response, responseType) {
     return __awaiter(this, void 0, void 0, function* () {
         switch (responseType) {
@@ -28,6 +37,7 @@ export function getResponseBody(response, responseType) {
                         },
                     };
                 }
+                retainResponse(response.body, response);
                 return response.body;
             case "streaming":
                 if (response.body == null) {
@@ -39,6 +49,7 @@ export function getResponseBody(response, responseType) {
                         },
                     };
                 }
+                retainResponse(response.body, response);
                 return response.body;
             case "text":
                 return yield response.text();

package/dist/esm/management/core/fetcher/signals.mjs

@@ -10,11 +10,19 @@ export function anySignal(...args) {
     for (const signal of signals) {
         if (signal.aborted) {
             controller.abort(signal === null || signal === void 0 ? void 0 : signal.reason);
-            break;
+            return controller.signal;
         }
         signal.addEventListener("abort", () => controller.abort(signal === null || signal === void 0 ? void 0 : signal.reason), {
             signal: controller.signal,
         });
+        // Re-check after adding listener: the signal may have aborted
+        // between the initial `signal.aborted` check and the `addEventListener`
+        // call above. If it did, the abort event was already dispatched and
+        // the listener will never fire — we must manually abort.
+        if (signal.aborted) {
+            controller.abort(signal === null || signal === void 0 ? void 0 : signal.reason);
+            return controller.signal;
+        }
     }
     return controller.signal;
 }

package/dist/esm/management/errors/ManagementError.mjs

@@ -7,7 +7,7 @@ export class ManagementError extends Error {
         if (Error.captureStackTrace) {
             Error.captureStackTrace(this, this.constructor);
         }
-        this.name = this.constructor.name;
+        this.name = "ManagementError";
         this.statusCode = statusCode;
         this.body = body;
         this.rawResponse = rawResponse;

package/dist/esm/management/errors/ManagementTimeoutError.mjs

@@ -6,7 +6,7 @@ export class ManagementTimeoutError extends Error {
         if (Error.captureStackTrace) {
             Error.captureStackTrace(this, this.constructor);
         }
-        this.name = this.constructor.name;
+        this.name = "ManagementTimeoutError";
         if ((opts === null || opts === void 0 ? void 0 : opts.cause) != null) {
             this.cause = opts.cause;
         }

package/dist/esm/management/index.d.mts

@@ -1,6 +1,9 @@
 export * as Management from "./api/index.mjs";
 export { ManagementError, ManagementTimeoutError } from "./errors/index.mjs";
 export { ManagementClient } from "./wrapper/ManagementClient.mjs";
+export { TokenProvider } from "./wrapper/token-provider.mjs";
+export { createManagementAuth } from "./wrapper/management-auth.mjs";
+export type { ManagementAuth, ManagementAuthOptions } from "./wrapper/management-auth.mjs";
 export { ManagementEnvironment } from "./environments.mjs";
 export { CustomDomainHeader, withTimeout, withRetries, withHeaders, withAbortSignal } from "./request-options.mjs";
 export * from "./exports.mjs";

package/dist/esm/management/index.mjs

@@ -1,6 +1,8 @@
 export * as Management from "./api/index.mjs";
 export { ManagementError, ManagementTimeoutError } from "./errors/index.mjs";
 export { ManagementClient } from "./wrapper/ManagementClient.mjs";
+export { TokenProvider } from "./wrapper/token-provider.mjs";
+export { createManagementAuth } from "./wrapper/management-auth.mjs";
 export { ManagementEnvironment } from "./environments.mjs";
 export { CustomDomainHeader, withTimeout, withRetries, withHeaders, withAbortSignal } from "./request-options.mjs";
 export * from "./exports.mjs";

package/dist/esm/management/version.d.mts

@@ -1 +1 @@
-export declare const SDK_VERSION = "5.13.0";
+export declare const SDK_VERSION = "6.1.0";

package/dist/esm/management/version.mjs

@@ -1 +1 @@
-export const SDK_VERSION = "5.13.0";
+export const SDK_VERSION = "6.1.0";

package/dist/esm/management/wrapper/ManagementClient.mjs

@@ -1,7 +1,6 @@
 import { ManagementClient as FernClient } from "../Client.mjs";
-import { TokenProvider } from "./token-provider.mjs";
-import { Auth0ClientTelemetry } from "../../lib/middleware/auth0-client-telemetry.mjs";
 import { withCustomDomainHeader } from "../request-options.mjs";
+import { createTelemetryHeaders, createTokenSupplier } from "./auth-helpers.mjs";
 /**
  * Auth0 Management API client wrapper.
  *
@@ -84,82 +83,3 @@ export class ManagementClient extends FernClient {
         super(clientOptions);
     }
 }
-/**
- * Type guard to determine if options use token-based authentication.
- *
- * @param _options - The management client configuration options
- * @returns True if the options contain a token property
- * @group Management API
- * @namespace ManagementClient.Utils
- * @private
- */
-function isClientOptionsWithToken(_options) {
-    return "token" in _options;
-}
-/**
- * Creates telemetry headers for the Management Client.
- * Adds the Auth0-Client header when telemetry is enabled.
- *
- * @param _options - The management client configuration options
- * @returns Headers object including telemetry information
- * @group Management API
- * @namespace ManagementClient.Utils
- * @private
- */
-function createTelemetryHeaders(_options) {
-    var _a;
-    const headers = Object.assign({}, ((_a = _options.headers) !== null && _a !== void 0 ? _a : {}));
-    if (_options.telemetry !== false) {
-        const telemetry = new Auth0ClientTelemetry({
-            clientInfo: _options.clientInfo,
-        });
-        const auth0ClientHeader = telemetry.getAuth0ClientHeader();
-        if (auth0ClientHeader) {
-            headers["Auth0-Client"] = auth0ClientHeader;
-        }
-    }
-    return headers;
-}
-/**
- * Type guard to check if options contain client secret.
- *
- * @param _options - Client credentials configuration options
- * @returns True if the options contain a clientSecret property
- * @group Management API
- * @namespace ManagementClient.Utils
- * @private
- */
-function hasClientSecret(_options) {
-    return "clientSecret" in _options;
-}
-/**
- * Creates a token supplier based on the authentication method.
- * Returns the provided token for token-based auth, or creates a TokenProvider
- * for client credentials (secret or assertion) authentication.
- *
- * @param _options - The management client configuration options
- * @returns A function that returns an access token
- * @group Management API
- * @namespace ManagementClient.Utils
- * @private
- */
-function createTokenSupplier(_options) {
-    var _a;
-    if (isClientOptionsWithToken(_options)) {
-        return _options.token;
-    }
-    // Handle client credentials with proper type checking
-    const baseOptions = Object.assign(Object.assign({}, _options), { audience: (_a = _options.audience) !== null && _a !== void 0 ? _a : `https://${_options.domain}/api/v2/`, clientId: _options.clientId, useMTLS: _options.useMTLS });
-    if (hasClientSecret(_options)) {
-        // Client secret authentication
-        const tokenProviderOptions = Object.assign(Object.assign({}, baseOptions), { clientSecret: _options.clientSecret });
-        const tokenProvider = new TokenProvider(tokenProviderOptions);
-        return () => tokenProvider.getAccessToken();
-    }
-    else {
-        // Client assertion authentication
-        const tokenProviderOptions = Object.assign(Object.assign({}, baseOptions), { clientAssertionSigningKey: _options.clientAssertionSigningKey, clientAssertionSigningAlg: _options.clientAssertionSigningAlg });
-        const tokenProvider = new TokenProvider(tokenProviderOptions);
-        return () => tokenProvider.getAccessToken();
-    }
-}

package/dist/esm/management/wrapper/auth-helpers.d.mts

@@ -0,0 +1,50 @@
+import * as core from "../core/index.mjs";
+import type { ManagementClient } from "./ManagementClient.mjs";
+/**
+ * Headers accepted by the Management client and its sub-clients.
+ *
+ * @group Management API
+ * @internal
+ */
+export type ManagementHeaders = Record<string, string | core.Supplier<string | null | undefined> | null | undefined>;
+/**
+ * The full set of authentication configurations accepted by the Management client, either a
+ * static token or client credentials (client secret or client assertion).
+ *
+ * @group Management API
+ * @internal
+ */
+export type ManagementAuthConfig = ManagementClient.ManagementClientOptionsWithToken | ManagementClient.ManagementClientOptionsWithClientCredentials;
+/**
+ * Builds the Management API v2 base URL for a tenant domain.
+ *
+ * @group Management API
+ * @internal
+ */
+export declare function buildManagementBaseUrl(domain: string): string;
+/**
+ * Type guard that determines if options use static token authentication.
+ *
+ * @group Management API
+ * @internal
+ */
+export declare function isClientOptionsWithToken(options: ManagementAuthConfig): options is ManagementClient.ManagementClientOptionsWithToken;
+/**
+ * Creates a token supplier from the provided options.
+ *
+ * Returns the supplied token as-is for token-based auth, or a self-refreshing
+ * {@link TokenProvider}-backed supplier for client credentials (secret or assertion).
+ *
+ * @group Management API
+ * @internal
+ */
+export declare function createTokenSupplier(options: ManagementAuthConfig): core.Supplier<string>;
+/**
+ * Builds the request headers for the Management client, including the `Auth0-Client` telemetry
+ * header when telemetry is enabled. Respects `telemetry: false` and custom `clientInfo`, and
+ * preserves any user-supplied headers.
+ *
+ * @group Management API
+ * @internal
+ */
+export declare function createTelemetryHeaders(options: ManagementAuthConfig): ManagementHeaders;

package/dist/esm/management/wrapper/auth-helpers.mjs

@@ -0,0 +1,78 @@
+import { TokenProvider } from "./token-provider.mjs";
+import { Auth0ClientTelemetry } from "../../lib/middleware/auth0-client-telemetry.mjs";
+/**
+ * Builds the Management API v2 base URL for a tenant domain.
+ *
+ * @group Management API
+ * @internal
+ */
+export function buildManagementBaseUrl(domain) {
+    return `https://${domain}/api/v2`;
+}
+/**
+ * Type guard that determines if options use static token authentication.
+ *
+ * @group Management API
+ * @internal
+ */
+export function isClientOptionsWithToken(options) {
+    return "token" in options;
+}
+/**
+ * Type guard that narrows client credentials to the client-secret variant.
+ *
+ * @group Management API
+ * @internal
+ */
+function hasClientSecret(options) {
+    return "clientSecret" in options;
+}
+/**
+ * Creates a token supplier from the provided options.
+ *
+ * Returns the supplied token as-is for token-based auth, or a self-refreshing
+ * {@link TokenProvider}-backed supplier for client credentials (secret or assertion).
+ *
+ * @group Management API
+ * @internal
+ */
+export function createTokenSupplier(options) {
+    var _a;
+    if (isClientOptionsWithToken(options)) {
+        return options.token;
+    }
+    const audience = (_a = options.audience) !== null && _a !== void 0 ? _a : `${buildManagementBaseUrl(options.domain)}/`;
+    // The named type guard narrows the union so each branch matches one of TokenProvider's
+    // overloaded constructors (client secret vs client assertion). Both branches forward the
+    // full options object, which is what selects the signing method downstream.
+    if (hasClientSecret(options)) {
+        const tokenProviderOptions = Object.assign(Object.assign({}, options), { audience });
+        const tokenProvider = new TokenProvider(tokenProviderOptions);
+        return () => tokenProvider.getAccessToken();
+    }
+    else {
+        const tokenProviderOptions = Object.assign(Object.assign({}, options), { audience });
+        const tokenProvider = new TokenProvider(tokenProviderOptions);
+        return () => tokenProvider.getAccessToken();
+    }
+}
+/**
+ * Builds the request headers for the Management client, including the `Auth0-Client` telemetry
+ * header when telemetry is enabled. Respects `telemetry: false` and custom `clientInfo`, and
+ * preserves any user-supplied headers.
+ *
+ * @group Management API
+ * @internal
+ */
+export function createTelemetryHeaders(options) {
+    var _a;
+    const headers = Object.assign({}, ((_a = options.headers) !== null && _a !== void 0 ? _a : {}));
+    if (options.telemetry !== false) {
+        const telemetry = new Auth0ClientTelemetry({ clientInfo: options.clientInfo });
+        const auth0ClientHeader = telemetry.getAuth0ClientHeader();
+        if (auth0ClientHeader) {
+            headers["Auth0-Client"] = auth0ClientHeader;
+        }
+    }
+    return headers;
+}

package/dist/esm/management/wrapper/management-auth.d.mts

@@ -0,0 +1,109 @@
+import * as core from "../core/index.mjs";
+import type { ManagementClient } from "./ManagementClient.mjs";
+import { type ManagementHeaders } from "./auth-helpers.mjs";
+/**
+ * Options for {@link createManagementAuth}.
+ *
+ * Provide either a static `token`, or client credentials (`clientId` plus either
+ * `clientSecret` or `clientAssertionSigningKey`) to have a token fetched and refreshed
+ * automatically.
+ *
+ * @group Management API
+ * @public
+ */
+export type ManagementAuthOptions = ManagementClient.ManagementClientOptionsWithToken | ManagementClient.ManagementClientOptionsWithClientCredentials;
+/**
+ * Ready-to-spread options for any Management sub-client constructor.
+ *
+ * These mirror the options that the full {@link ManagementClient} passes to its sub-clients,
+ * so individually imported clients share the same base URL, self-refreshing token, telemetry
+ * headers, and request behaviour.
+ *
+ * @group Management API
+ * @public
+ */
+export interface ManagementAuthClientOptions {
+    /** The Management API v2 base URL for the tenant. */
+    baseUrl: string;
+    /** A supplier that returns a valid access token, fetching or refreshing it when needed. */
+    token: core.Supplier<string>;
+    /** Headers to send with every request, including the `Auth0-Client` telemetry header when enabled. */
+    headers?: ManagementHeaders;
+    /** The default maximum time to wait for a response in seconds. */
+    timeoutInSeconds?: number;
+    /** The default number of times to retry a request. */
+    maxRetries?: number;
+    /** Logging configuration for the client. */
+    logging?: core.logging.LogConfig | core.logging.Logger;
+    /** Custom fetcher, set automatically when a custom domain header is configured. */
+    fetcher?: (args: any) => Promise<any>;
+}
+/**
+ * A reusable authentication context for the Management API.
+ *
+ * Spread {@link ManagementAuth.clientOptions} into any Management sub-client constructor so
+ * every client shares the same base URL and self-refreshing token.
+ *
+ * @group Management API
+ * @public
+ */
+export interface ManagementAuth {
+    /** The Management API v2 base URL for the tenant, e.g. `https://tenant.auth0.com/api/v2`. */
+    baseUrl: string;
+    /** Returns a valid access token, fetching or refreshing it when needed. */
+    getToken: () => Promise<string>;
+    /** Ready-to-spread options for any Management sub-client constructor. */
+    clientOptions: ManagementAuthClientOptions;
+}
+/**
+ * Creates a shared authentication context for the Auth0 Management API without pulling in the
+ * full {@link ManagementClient}. This is useful for size-constrained runtimes (for example
+ * Cloudflare Workers) where you import individual sub-clients such as `auth0/clients` and
+ * `auth0/users` and want to handle auth once.
+ *
+ * When client credentials are provided, tokens are obtained via the client credentials grant
+ * and cached until shortly before they expire. When a static `token` is provided, it is used
+ * as-is.
+ *
+ * The returned {@link ManagementAuth.clientOptions} carry the same telemetry headers, request
+ * timeouts, retry counts, logging, and custom domain behaviour that the full `ManagementClient`
+ * applies, so individually imported sub-clients behave consistently.
+ *
+ * @group Management API
+ * @public
+ *
+ * @example Client credentials with individual sub-clients
+ * ```ts
+ * import { createManagementAuth } from "auth0/management";
+ * import { ClientsClient } from "auth0/clients";
+ * import { UsersClient } from "auth0/users";
+ *
+ * const auth = createManagementAuth({
+ *     domain: "your-tenant.auth0.com",
+ *     clientId: "your-client-id",
+ *     clientSecret: "your-client-secret",
+ * });
+ *
+ * const clients = new ClientsClient(auth.clientOptions);
+ * const users = new UsersClient(auth.clientOptions);
+ * ```
+ *
+ * @example Static token
+ * ```ts
+ * const auth = createManagementAuth({
+ *     domain: "your-tenant.auth0.com",
+ *     token: "your-api-v2-token",
+ * });
+ * ```
+ *
+ * @example Custom domain header (applied to whitelisted endpoints)
+ * ```ts
+ * const auth = createManagementAuth({
+ *     domain: "your-tenant.auth0.com",
+ *     clientId: "your-client-id",
+ *     clientSecret: "your-client-secret",
+ *     withCustomDomainHeader: "auth.example.com",
+ * });
+ * ```
+ */
+export declare function createManagementAuth(options: ManagementAuthOptions): ManagementAuth;

package/dist/esm/management/wrapper/management-auth.mjs

@@ -0,0 +1,70 @@
+import * as core from "../core/index.mjs";
+import { withCustomDomainHeader } from "../request-options.mjs";
+import { buildManagementBaseUrl, createTelemetryHeaders, createTokenSupplier, } from "./auth-helpers.mjs";
+/**
+ * Creates a shared authentication context for the Auth0 Management API without pulling in the
+ * full {@link ManagementClient}. This is useful for size-constrained runtimes (for example
+ * Cloudflare Workers) where you import individual sub-clients such as `auth0/clients` and
+ * `auth0/users` and want to handle auth once.
+ *
+ * When client credentials are provided, tokens are obtained via the client credentials grant
+ * and cached until shortly before they expire. When a static `token` is provided, it is used
+ * as-is.
+ *
+ * The returned {@link ManagementAuth.clientOptions} carry the same telemetry headers, request
+ * timeouts, retry counts, logging, and custom domain behaviour that the full `ManagementClient`
+ * applies, so individually imported sub-clients behave consistently.
+ *
+ * @group Management API
+ * @public
+ *
+ * @example Client credentials with individual sub-clients
+ * ```ts
+ * import { createManagementAuth } from "auth0/management";
+ * import { ClientsClient } from "auth0/clients";
+ * import { UsersClient } from "auth0/users";
+ *
+ * const auth = createManagementAuth({
+ *     domain: "your-tenant.auth0.com",
+ *     clientId: "your-client-id",
+ *     clientSecret: "your-client-secret",
+ * });
+ *
+ * const clients = new ClientsClient(auth.clientOptions);
+ * const users = new UsersClient(auth.clientOptions);
+ * ```
+ *
+ * @example Static token
+ * ```ts
+ * const auth = createManagementAuth({
+ *     domain: "your-tenant.auth0.com",
+ *     token: "your-api-v2-token",
+ * });
+ * ```
+ *
+ * @example Custom domain header (applied to whitelisted endpoints)
+ * ```ts
+ * const auth = createManagementAuth({
+ *     domain: "your-tenant.auth0.com",
+ *     clientId: "your-client-id",
+ *     clientSecret: "your-client-secret",
+ *     withCustomDomainHeader: "auth.example.com",
+ * });
+ * ```
+ */
+export function createManagementAuth(options) {
+    const baseUrl = buildManagementBaseUrl(options.domain);
+    const tokenSupplier = createTokenSupplier(options);
+    const getToken = () => core.Supplier.get(tokenSupplier);
+    const headers = createTelemetryHeaders(options);
+    let clientOptions = Object.assign(Object.assign(Object.assign(Object.assign({ baseUrl, token: getToken }, (Object.keys(headers).length > 0 ? { headers } : {})), (options.timeoutInSeconds !== undefined ? { timeoutInSeconds: options.timeoutInSeconds } : {})), (options.maxRetries !== undefined ? { maxRetries: options.maxRetries } : {})), (options.logging !== undefined ? { logging: options.logging } : {}));
+    // Apply custom domain header configuration if provided, matching the full ManagementClient.
+    if ("withCustomDomainHeader" in options && options.withCustomDomainHeader !== undefined) {
+        clientOptions = withCustomDomainHeader(options.withCustomDomainHeader, clientOptions);
+    }
+    return {
+        baseUrl,
+        getToken,
+        clientOptions,
+    };
+}