auth0 6.4.0 → 7.1.0

package/dist/cjs/management/api/types/types.js

@@ -19,9 +19,9 @@ exports.FlowActionFlowDelayFlowParams = exports.FlowActionFlowDelayFlow = export
 exports.FlowsVaultConnectioSetupTypeApiKeyEnum = exports.FlowsVaultConnectioSetupJwtAlgorithmEnum = exports.FlowActionZapierTriggerWebhookParams = exports.FlowActionZapierTriggerWebhook = exports.FlowActionXmlSerializeXml = exports.FlowActionXmlParseXml = exports.FlowActionWhatsappSendMessageParams = exports.FlowActionWhatsappSendMessage = exports.FlowActionTwilioSendSms = exports.FlowActionTwilioMakeCall = exports.FlowActionTelegramSendMessage = exports.FlowActionStripeUpdateCustomer = exports.FlowActionStripeGetCustomer = exports.FlowActionStripeFindCustomers = exports.FlowActionStripeDeleteTaxId = exports.FlowActionStripeCreatePortalSession = exports.FlowActionStripeCreateCustomer = exports.FlowActionStripeAddTaxId = exports.FlowActionSlackPostMessageParamsAttachment = exports.FlowActionSlackPostMessage = exports.FlowActionSendgridSendEmail = exports.FlowActionSalesforceUpdateLead = exports.FlowActionSalesforceSearchLeadsParams = exports.FlowActionSalesforceSearchLeads = exports.FlowActionSalesforceGetLead = exports.FlowActionSalesforceCreateLead = exports.FlowActionPipedriveAddPerson = exports.FlowActionPipedriveAddOrganization = exports.FlowActionPipedriveAddDeal = exports.FlowActionOtpVerifyCode = exports.FlowActionOtpGenerateCode = exports.FlowActionMailjetSendEmail = exports.FlowActionMailchimpUpsertMember = exports.FlowActionJwtVerifyJwt = exports.FlowActionJwtSignJwt = exports.FlowActionJwtDecodeJwt = exports.FlowActionJsonSerializeJson = exports.FlowActionJsonParseJson = exports.FlowActionJsonCreateJson = exports.FlowActionHubspotUpsertContact = exports.FlowActionHubspotGetContact = exports.FlowActionHubspotEnrollContact = exports.FlowActionHttpSendRequestParams = exports.FlowActionHttpSendRequest = exports.FlowActionGoogleSheetsAddRow = exports.FlowActionFlowStoreVars = exports.FlowActionFlowReturnJson = exports.FlowActionFlowMapValue = exports.FlowActionFlowErrorMessage = exports.FlowActionFlowDoNothing = void 0;
 exports.FormFieldFileConfigCategoryEnum = exports.FormFieldDateConfigFormatEnum = exports.FormEndingNodeId = exports.FormComponentCategoryWidgetConst = exports.FormComponentCategoryFieldConst = exports.FormComponentCategoryBlockConst = exports.FormBlockTypeRichTextConst = exports.FormBlockTypeResendButtonConst = exports.FormBlockTypePreviousButtonConst = exports.FormBlockTypeNextButtonConst = exports.FormBlockTypeJumpButtonConst = exports.FormBlockTypeImageConst = exports.FormBlockTypeHtmlConst = exports.FormBlockTypeDividerConst = exports.FormBlockResendButtonConfigTextAlignmentEnum = exports.FormBlockImageConfigPositionEnum = exports.ForbiddenSchema = exports.FlowsVaultConnectionSetupTypeOauthClientCredentialsEnum = exports.FlowsVaultConnectionSetupTypeBasicAuthEnum = exports.FlowsVaultConnectionSetupTypeApiKeyEnum = exports.FlowsVaultConnectionHttpApiKeySetupInEnum = exports.FlowsVaultConnectionAppIdZapierEnum = exports.FlowsVaultConnectionAppIdWhatsappEnum = exports.FlowsVaultConnectionAppIdTwilioEnum = exports.FlowsVaultConnectionAppIdTelegramEnum = exports.FlowsVaultConnectionAppIdStripeEnum = exports.FlowsVaultConnectionAppIdSlackEnum = exports.FlowsVaultConnectionAppIdSendgridEnum = exports.FlowsVaultConnectionAppIdSalesforceEnum = exports.FlowsVaultConnectionAppIdPipedriveEnum = exports.FlowsVaultConnectionAppIdMailjetEnum = exports.FlowsVaultConnectionAppIdMailchimpEnum = exports.FlowsVaultConnectionAppIdJwtEnum = exports.FlowsVaultConnectionAppIdHubspotEnum = exports.FlowsVaultConnectionAppIdHttpEnum = exports.FlowsVaultConnectionAppIdGoogleSheetsEnum = exports.FlowsVaultConnectionAppIdDocusignEnum = exports.FlowsVaultConnectionAppIdClearbitEnum = exports.FlowsVaultConnectionAppIdBigqueryEnum = exports.FlowsVaultConnectionAppIdAuth0Enum = exports.FlowsVaultConnectionAppIdAirtableEnum = exports.FlowsVaultConnectionAppIdActivecampaignEnum = exports.FlowsVaultConnectioSetupTypeWebhookEnum = exports.FlowsVaultConnectioSetupTypeTokenEnum = exports.FlowsVaultConnectioSetupTypeOauthJwtEnum = exports.FlowsVaultConnectioSetupTypeOauthCodeEnum = exports.FlowsVaultConnectioSetupTypeOauthAppEnum = exports.FlowsVaultConnectioSetupTypeKeyPairEnum = exports.FlowsVaultConnectioSetupTypeJwtEnum = exports.FlowsVaultConnectioSetupTypeBearerEnum = void 0;
 exports.LogStreamEventBridgeSinkRegionEnum = exports.LogStreamEventBridgeEnum = exports.LogStreamDatadogRegionEnum = exports.LogStreamDatadogEnum = exports.ListFlowsRequestParametersHydrateEnum = exports.JobFileFormatEnum = exports.IntegrationRequiredParamTypeEnum = exports.IntegrationFeatureTypeEnum = exports.IdentityProviderOnlyAuth0Enum = exports.IdentityProviderEnum = exports.HookTriggerIdEnum = exports.GuardianFactorsProviderSmsProviderEnum = exports.GuardianFactorsProviderPushNotificationProviderDataEnum = exports.GuardianFactorPhoneFactorMessageTypeEnum = exports.GuardianFactorNameEnum = exports.GuardianEnrollmentStatus = exports.GuardianEnrollmentFactorEnum = exports.GroupTypeEnum = exports.GroupMemberTypeEnum = exports.GetFlowRequestParametersHydrateEnum = exports.GetFlowExecutionRequestParametersHydrateEnum = exports.FormsRequestParametersHydrateEnum = exports.FormWidgetTypeRecaptchaConst = exports.FormWidgetTypeGMapsAddressConst = exports.FormWidgetTypeAuth0VerifiableCredentialsConst = exports.FormNodeTypeStepConst = exports.FormNodeTypeRouterConst = exports.FormNodeTypeFlowConst = exports.FormFieldTypeUrlConst = exports.FormFieldTypeTextConst = exports.FormFieldTypeTelConst = exports.FormFieldTypeSocialConst = exports.FormFieldTypePaymentConst = exports.FormFieldTypePasswordConst = exports.FormFieldTypeNumberConst = exports.FormFieldTypeLegalConst = exports.FormFieldTypeFileConst = exports.FormFieldTypeEmailConst = exports.FormFieldTypeDropdownConst = exports.FormFieldTypeDateConst = exports.FormFieldTypeCustomConst = exports.FormFieldTypeChoiceConst = exports.FormFieldTypeCardsConst = exports.FormFieldTypeBooleanConst = exports.FormFieldPaymentConfigProviderEnum = exports.FormFieldPaymentConfigChargeTypeSubscriptionConst = exports.FormFieldPaymentConfigChargeTypeOneOffConst = exports.FormFieldPaymentConfigChargeOneOffCurrencyEnum = exports.FormFieldPasswordConfigHashEnum = exports.FormFieldFileConfigStorageTypeEnum = void 0;
-exports.RefreshTokenExpirationTypeEnum = exports.RateLimitPolicyResourceEnum = exports.RateLimitPolicyConsumerEnum = exports.PublicKeyCredentialTypeEnum = exports.PublicKeyCredentialAlgorithmEnum = exports.PromptLanguageEnum = exports.PromptGroupNameEnum = exports.PreferredAuthenticationMethodEnum = exports.PostConnectionKeysAlgEnum = exports.PhoneTemplateNotificationTypeEnum = exports.PhoneProviderProtectionBackoffStrategyEnum = exports.PhoneProviderNameEnum = exports.PhoneProviderDeliveryMethodEnum = exports.PhoneProviderChannelEnum = exports.PasswordSequentialCharactersPolicyEnum = exports.PasswordMaxLengthExceededPolicyEnum = exports.PasswordIdenticalCharactersPolicyEnum = exports.PasswordDefaultDictionariesEnum = exports.PasswordCharacterTypeRulePolicyEnum = exports.PasswordCharacterTypeEnum = exports.PartialGroupsEnum = exports.OrganizationUsageEnum = exports.OrganizationThirdPartyClientAccessEnum = exports.OrganizationTemplateRoleVisibilityEnum = exports.OrganizationTemplateAllowedStrategyEnum = exports.OrganizationMemberEffectiveRoleSource = exports.OrganizationDiscoveryDomainStatus = exports.OrganizationDeletionBehaviorEnum = exports.OrganizationClientMetadataOrganizationUsageEnum = exports.OrganizationAccessLevelEnumWithNull = exports.OrganizationAccessLevelEnum = exports.NotFoundSchema = exports.NetworkAclRuleScopeEnum = exports.NetworkAclKeyAlgorithmEnum = exports.MfaPolicyEnum = exports.LogStreamSumoEnum = exports.LogStreamStatusEnum = exports.LogStreamSplunkEnum = exports.LogStreamSegmentEnum = exports.LogStreamPiiMethodEnum = exports.LogStreamPiiLogFieldsEnum = exports.LogStreamPiiAlgorithmEnum = exports.LogStreamMixpanelRegionEnum = exports.LogStreamMixpanelEnum = exports.LogStreamHttpEnum = exports.LogStreamHttpContentFormatEnum = exports.LogStreamFilterTypeEnum = exports.LogStreamFilterGroupNameEnum = exports.LogStreamEventGridRegionEnum = exports.LogStreamEventGridEnum = void 0;
-exports.X509CertificateCredentialTypeEnum = exports.VerificationMethodEnum = exports.UserMultifactorProviderEnum = exports.UserIdentityProviderEnum = exports.UserEnrollmentStatusEnum = exports.UserEnrollmentAuthMethodEnum = exports.UserEffectiveRoleSource = exports.UserEffectivePermissionSourceEnum = exports.UserEffectivePermissionRoleSourceEnum = exports.UserAuthenticationMethodPropertiesEnum = exports.UserAttributeProfileUserIdOidcStrategyOverrideMapping = exports.UserAttributeProfileUserIdOidcMappingEnum = exports.UniversalLoginExperienceEnum = exports.UnauthorizedSchema = exports.TwilioProviderDeliveryMethodEnum = exports.TooManyRequestsSchema = exports.TokenExchangeProfileTypeEnum = exports.TenantSettingsSupportedLocalesEnum = exports.TenantSettingsResourceParameterProfile = exports.TenantSettingsDynamicClientRegistrationSecurityMode = exports.TenantSettingsDeviceFlowCharset = exports.TenantSettingsCountryCodesModeResponse = exports.TenantSettingsCountryCodesMode = exports.SynchronizeGroupsEnum = exports.SuspiciousIpThrottlingShieldsEnum = exports.SupportedLocales = exports.SignupStatusEnum = exports.SigningAlgorithmEnum = exports.SessionCookieModeEnum = exports.SessionCookieMetadataModeEnum = exports.SelfServiceProfileSsoTicketProvisioningScopeEnum = exports.SelfServiceProfileSsoTicketIdpInitiatedClientProtocolEnum = exports.SelfServiceProfileSsoTicketDomainVerificationEnum = exports.SelfServiceProfileCustomTextPageEnum = exports.SelfServiceProfileCustomTextLanguageEnum = exports.SelfServiceProfileAllowedStrategyEnum = exports.SearchEngineVersionsEnum = exports.ScreenGroupNameEnum = exports.RotateConnectionKeysSigningAlgEnum = exports.RoleTypeEnum = exports.ResourceServerTokenEncryptionFormatEnum = exports.ResourceServerTokenEncryptionAlgorithmEnum = exports.ResourceServerTokenDialectSchemaEnum = exports.ResourceServerTokenDialectResponseEnum = exports.ResourceServerSubjectTypeAuthorizationUserPolicyEnum = exports.ResourceServerSubjectTypeAuthorizationClientPolicyEnum = exports.ResourceServerProofOfPossessionRequiredForEnum = exports.ResourceServerProofOfPossessionMechanismEnum = exports.ResourceServerConsentPolicyEnum = exports.RefreshTokenRotationTypeEnum = void 0;
-exports.XssProtectionMode = void 0;
+exports.RateLimitPolicyResourceEnum = exports.RateLimitPolicyConsumerEnum = exports.PublicKeyCredentialTypeEnum = exports.PublicKeyCredentialAlgorithmEnum = exports.PromptLanguageEnum = exports.PromptGroupNameEnum = exports.PreferredAuthenticationMethodEnum = exports.PostConnectionKeysAlgEnum = exports.PhoneTemplateNotificationTypeEnum = exports.PhoneProviderProtectionBackoffStrategyEnum = exports.PhoneProviderNameEnum = exports.PhoneProviderDeliveryMethodEnum = exports.PhoneProviderChannelEnum = exports.PasswordSequentialCharactersPolicyEnum = exports.PasswordMaxLengthExceededPolicyEnum = exports.PasswordIdenticalCharactersPolicyEnum = exports.PasswordDefaultDictionariesEnum = exports.PasswordCharacterTypeRulePolicyEnum = exports.PasswordCharacterTypeEnum = exports.PartialGroupsEnum = exports.OrganizationUsageEnum = exports.OrganizationThirdPartyClientAccessEnum = exports.OrganizationTemplateRoleVisibilityEnum = exports.OrganizationTemplateAllowedStrategyEnum = exports.OrganizationSortFieldEnum = exports.OrganizationMemberEffectiveRoleSource = exports.OrganizationDiscoveryDomainStatus = exports.OrganizationDeletionBehaviorEnum = exports.OrganizationClientMetadataOrganizationUsageEnum = exports.OrganizationAccessLevelEnumWithNull = exports.OrganizationAccessLevelEnum = exports.NotFoundSchema = exports.NetworkAclRuleScopeEnum = exports.NetworkAclKeyAlgorithmEnum = exports.MfaPolicyEnum = exports.LogStreamSumoEnum = exports.LogStreamStatusEnum = exports.LogStreamSplunkEnum = exports.LogStreamSegmentEnum = exports.LogStreamPiiMethodEnum = exports.LogStreamPiiLogFieldsEnum = exports.LogStreamPiiAlgorithmEnum = exports.LogStreamMixpanelRegionEnum = exports.LogStreamMixpanelEnum = exports.LogStreamHttpEnum = exports.LogStreamHttpContentFormatEnum = exports.LogStreamFilterTypeEnum = exports.LogStreamFilterGroupNameEnum = exports.LogStreamEventGridRegionEnum = exports.LogStreamEventGridEnum = void 0;
+exports.UserEnrollmentStatusEnum = exports.UserEnrollmentAuthMethodEnum = exports.UserEffectiveRoleSource = exports.UserEffectivePermissionSourceEnum = exports.UserEffectivePermissionRoleSourceEnum = exports.UserAuthenticationMethodPropertiesEnum = exports.UserAttributeProfileUserIdOidcStrategyOverrideMapping = exports.UserAttributeProfileUserIdOidcMappingEnum = exports.UniversalLoginExperienceEnum = exports.UnauthorizedSchema = exports.TwilioProviderDeliveryMethodEnum = exports.TooManyRequestsSchema = exports.TokenExchangeProfileTypeEnum = exports.TenantSettingsSupportedLocalesEnum = exports.TenantSettingsResourceParameterProfile = exports.TenantSettingsDynamicClientRegistrationSecurityMode = exports.TenantSettingsDeviceFlowCharset = exports.TenantSettingsCountryCodesModeResponse = exports.TenantSettingsCountryCodesMode = exports.SynchronizeGroupsEnum = exports.SuspiciousIpThrottlingShieldsEnum = exports.SupportedLocales = exports.SignupStatusEnum = exports.SigningAlgorithmEnum = exports.SessionCookieModeEnum = exports.SessionCookieMetadataModeEnum = exports.SelfServiceProfileSsoTicketProvisioningScopeEnum = exports.SelfServiceProfileSsoTicketIdpInitiatedClientProtocolEnum = exports.SelfServiceProfileSsoTicketDomainVerificationEnum = exports.SelfServiceProfileCustomTextPageEnum = exports.SelfServiceProfileCustomTextLanguageEnum = exports.SelfServiceProfileAllowedStrategyEnum = exports.SearchParserEnum = exports.SearchEngineVersionsEnum = exports.ScreenGroupNameEnum = exports.RotateConnectionKeysSigningAlgEnum = exports.RoleTypeEnum = exports.ResourceServerTokenEncryptionFormatEnum = exports.ResourceServerTokenEncryptionAlgorithmEnum = exports.ResourceServerTokenDialectSchemaEnum = exports.ResourceServerTokenDialectResponseEnum = exports.ResourceServerSubjectTypeAuthorizationUserPolicyEnum = exports.ResourceServerSubjectTypeAuthorizationClientPolicyEnum = exports.ResourceServerSubjectTypeAuthorizationAnonymousUserPolicyEnum = exports.ResourceServerSortFieldEnum = exports.ResourceServerProofOfPossessionRequiredForEnum = exports.ResourceServerProofOfPossessionMechanismEnum = exports.ResourceServerConsentPolicyEnum = exports.RefreshTokenRotationTypeEnum = exports.RefreshTokenExpirationTypeEnum = void 0;
+exports.XssProtectionMode = exports.X509CertificateCredentialTypeEnum = exports.VerificationMethodEnum = exports.UserMultifactorProviderEnum = exports.UserIdentityProviderEnum = void 0;
 exports.OauthScope = {
     /**
      * Create Actions */
@@ -275,6 +275,9 @@ exports.OauthScope = {
     /**
      * Read Events */
     ReadEvents: "read:events",
+    /**
+     * Update Experimentation */
+    UpdateExperimentation: "update:experimentation",
     /**
      * Create Flows */
     CreateFlows: "create:flows",
@@ -755,15 +758,9 @@ exports.OauthScope = {
     /**
      * Delete Organization Client Associations */
     DeleteOrganizationClients: "delete:organization_clients",
-    /**
-     * Create Organization Templates */
-    CreateOrganizationTemplates: "create:organization_templates",
     /**
      * Read Organization Templates */
     ReadOrganizationTemplates: "read:organization_templates",
-    /**
-     * Update Organization Templates */
-    UpdateOrganizationTemplates: "update:organization_templates",
     /**
      * Create Network ACL Keys */
     CreateNetworkAclKeys: "create:network_acl_keys",
@@ -1379,23 +1376,14 @@ exports.ConnectionIdentityProviderEnum = {
     Yahoo: "yahoo",
     Yandex: "yandex",
     NotionMcp: "notion-mcp",
-    AsanaMcp: "asana-mcp",
-    AtlassianMcp: "atlassian-mcp",
+    Asana: "asana",
+    Atlassian: "atlassian",
     CloudflareMcp: "cloudflare-mcp",
-    DocusignMcp: "docusign-mcp",
-    FigmaMcp: "figma-mcp",
-    GitlabMcp: "gitlab-mcp",
-    GustoMcp: "gusto-mcp",
-    HerokuMcp: "heroku-mcp",
+    Gitlab: "gitlab",
     HubspotMcp: "hubspot-mcp",
-    IntercomMcp: "intercom-mcp",
     LinearMcp: "linear-mcp",
-    PagerdutyMcp: "pagerduty-mcp",
     SentryMcp: "sentry-mcp",
-    SlackMcp: "slack-mcp",
-    SupabaseMcp: "supabase-mcp",
-    VercelMcp: "vercel-mcp",
-    XeroMcp: "xero-mcp",
+    Slack: "slack",
 };
 /** Signing key use, whether for encryption or signing */
 exports.ConnectionKeyUseEnum = {
@@ -1889,23 +1877,14 @@ exports.ConnectionStrategyEnum = {
     Yahoo: "yahoo",
     Yandex: "yandex",
     NotionMcp: "notion-mcp",
-    AsanaMcp: "asana-mcp",
-    AtlassianMcp: "atlassian-mcp",
+    Asana: "asana",
+    Atlassian: "atlassian",
     CloudflareMcp: "cloudflare-mcp",
-    DocusignMcp: "docusign-mcp",
-    FigmaMcp: "figma-mcp",
-    GitlabMcp: "gitlab-mcp",
-    GustoMcp: "gusto-mcp",
-    HerokuMcp: "heroku-mcp",
+    Gitlab: "gitlab",
     HubspotMcp: "hubspot-mcp",
-    IntercomMcp: "intercom-mcp",
     LinearMcp: "linear-mcp",
-    PagerdutyMcp: "pagerduty-mcp",
     SentryMcp: "sentry-mcp",
-    SlackMcp: "slack-mcp",
-    SupabaseMcp: "supabase-mcp",
-    VercelMcp: "vercel-mcp",
-    XeroMcp: "xero-mcp",
+    Slack: "slack",
     Auth0Adldap: "auth0-adldap",
 };
 /** SMS template syntax type. Set to 'md_with_macros' to enable macro processing in templates. */
@@ -2413,7 +2392,7 @@ exports.DefaultMethodPhoneNumberIdentifierEnum = {
 exports.DeviceCredentialPublicKeyTypeEnum = {
     PublicKey: "public_key",
 };
-/** Type of credentials to retrieve. Must be `public_key`, `refresh_token` or `rotating_refresh_token`. The property will default to `refresh_token` when paging is requested */
+/** Type of credentials to retrieve. Must be `public_key`, `refresh_token` or `rotating_refresh_token`. If none is provided a combined list of `refresh_tokens` and `public_keys` will be returned (and no `rotating_refresh_token`), in this case `page`, `per_page` and `include_totals` will be ignored. */
 exports.DeviceCredentialTypeEnum = {
     PublicKey: "public_key",
     RefreshToken: "refresh_token",
@@ -6546,6 +6525,12 @@ exports.OrganizationMemberEffectiveRoleSource = {
     Direct: "direct",
     Groups: "groups",
 };
+/** Field name to sort results by in ascending order only. Defaults to insertion order (oldest first) if not provided. */
+exports.OrganizationSortFieldEnum = {
+    Name: "name",
+    DisplayName: "display_name",
+    CreatedAt: "created_at",
+};
 /** An allowed enterprise connection strategy. */
 exports.OrganizationTemplateAllowedStrategyEnum = {
     Adfs: "adfs",
@@ -6824,6 +6809,17 @@ exports.ResourceServerProofOfPossessionRequiredForEnum = {
     PublicClients: "public_clients",
     AllClients: "all_clients",
 };
+/** Field name to sort results by in ascending order only. Defaults to insertion order (oldest first) if not provided. */
+exports.ResourceServerSortFieldEnum = {
+    Identifier: "identifier",
+    Name: "name",
+    UpdatedAt: "updated_at",
+};
+/** Defines the anonymous user flows policy for the resource server */
+exports.ResourceServerSubjectTypeAuthorizationAnonymousUserPolicyEnum = {
+    DenyAll: "deny_all",
+    RequireClientGrant: "require_client_grant",
+};
 /** Defines the client flows policy for the resource server */
 exports.ResourceServerSubjectTypeAuthorizationClientPolicyEnum = {
     DenyAll: "deny_all",
@@ -6974,6 +6970,11 @@ exports.SearchEngineVersionsEnum = {
     V2: "v2",
     V3: "v3",
 };
+/** Query parser to use for the filter expression. Use "scim" for SCIM filter syntax or "lucene" for Lucene query syntax (default). */
+exports.SearchParserEnum = {
+    Scim: "scim",
+    Lucene: "lucene",
+};
 exports.SelfServiceProfileAllowedStrategyEnum = {
     Oidc: "oidc",
     Samlp: "samlp",

package/dist/cjs/management/version.d.ts

@@ -1 +1 @@
-export declare const SDK_VERSION = "6.4.0";
+export declare const SDK_VERSION = "7.1.0";

package/dist/cjs/management/version.js

@@ -1,4 +1,4 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.SDK_VERSION = void 0;
-exports.SDK_VERSION = "6.4.0";
+exports.SDK_VERSION = "7.1.0";

package/dist/cjs/management/wrapper/ManagementClient.d.ts

@@ -15,7 +15,7 @@ export declare namespace ManagementClient {
      * @group Management API
      * @public
      */
-    interface ManagementClientOptions extends Omit<FernClient.Options, "token" | "environment" | "fetcher" | "baseUrl" | "fetch"> {
+    interface ManagementClientOptions extends Omit<FernClient.Options, "token" | "environment" | "fetcher" | "baseUrl"> {
         /** Auth0 domain (e.g., 'your-tenant.auth0.com') */
         domain: string;
         /**
@@ -114,7 +114,14 @@ export declare namespace ManagementClient {
         clientAssertionSigningKey: string;
         /** Algorithm for signing the client assertion. Defaults to RS256 */
         clientAssertionSigningAlg?: string;
-        /** Enable mTLS for token endpoint calls */
+        /**
+         * Enable mTLS for token endpoint calls.
+         *
+         * mTLS (RFC 8705) is a transport-layer concern that is independent of the client
+         * authentication method: a client authenticating with `private_key_jwt` can still present a
+         * TLS client certificate to obtain a certificate-bound access token. This mirrors v6, which
+         * added the `mtls.` endpoint alias from `useMTLS` alone regardless of the auth method.
+         */
         useMTLS?: boolean;
     }
     /**

package/dist/cjs/management/wrapper/ManagementClient.js

@@ -74,7 +74,6 @@ class ManagementClient extends Client_js_1.ManagementClient {
         const token = (0, auth_helpers_js_1.createTokenSupplier)(_options);
         // Temporarily remove fetcher from options to avoid people passing it for now
         delete _options.fetcher;
-        delete _options.fetch;
         // Prepare the base client options
         let clientOptions = Object.assign(Object.assign({}, _options), { baseUrl,
             headers,

package/dist/cjs/management/wrapper/token-provider.d.ts

@@ -1,7 +1,6 @@
-import { ManagementClient } from "./ManagementClient.js";
+import type { ManagementClient } from "./ManagementClient.js";
 export declare class TokenProvider {
     private readonly options;
-    private authenticationClient;
     private expiresAt;
     private accessToken;
     private pending;
@@ -12,4 +11,7 @@ export declare class TokenProvider {
         audience: string;
     });
     getAccessToken(): Promise<string>;
+    private fetchToken;
+    private buildClientAssertion;
+    private buildTelemetryHeader;
 }

package/dist/cjs/management/wrapper/token-provider.js

@@ -10,31 +10,162 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.TokenProvider = void 0;
-const index_js_1 = require("../../auth/index.js");
-const LEEWAY = 10 * 1000;
+const jose_1 = require("jose");
+const utils_js_1 = require("../../utils.js");
+const ManagementError_js_1 = require("../errors/ManagementError.js");
+const LEEWAY = 10 * 1000; // 10s refresh-ahead in ms
 class TokenProvider {
     constructor(options) {
         this.options = options;
         this.expiresAt = 0;
         this.accessToken = "";
-        this.authenticationClient = new index_js_1.AuthenticationClient(Object.assign(Object.assign({}, options), { headers: options.headers }));
+        // Validate domain: must be a bare hostname, no slashes or query strings.
+        if (/[/?#]/.test(options.domain)) {
+            throw new Error(`ManagementClient: invalid domain "${options.domain}". Provide a bare hostname, e.g. "tenant.auth0.com".`);
+        }
+        if (options.useMTLS) {
+            const { fetch: customFetch } = options;
+            if (!customFetch) {
+                throw new Error("ManagementClient: useMTLS requires a custom fetch implementation. " +
+                    "Provide a `fetch` option configured with your mTLS client certificate.");
+            }
+            // mTLS (RFC 8705) is a transport-layer concern independent of the client authentication
+            // method. It combines with both `clientSecret` and `clientAssertionSigningKey`: the TLS
+            // client certificate yields a certificate-bound token regardless of how the client
+            // authenticates. v6 supported this, so no auth-method restriction is imposed here.
+        }
     }
     getAccessToken() {
         return __awaiter(this, void 0, void 0, function* () {
             if (!this.accessToken || Date.now() > this.expiresAt - LEEWAY) {
-                this.pending =
-                    this.pending ||
-                        this.authenticationClient.oauth.clientCredentialsGrant({
-                            audience: this.options.audience,
-                        });
-                const { data: { access_token: accessToken, expires_in: expiresIn }, } = yield this.pending.finally(() => {
+                this.pending = this.pending || this.fetchToken();
+                const result = yield this.pending.finally(() => {
                     delete this.pending;
                 });
-                this.expiresAt = Date.now() + expiresIn * 1000;
-                this.accessToken = accessToken;
+                this.expiresAt = result.expiresAt;
+                this.accessToken = result.accessToken;
             }
             return this.accessToken;
         });
     }
+    fetchToken() {
+        return __awaiter(this, void 0, void 0, function* () {
+            var _a;
+            const { domain, clientId, audience } = this.options;
+            const tokenUrl = this.options.useMTLS ? `https://mtls.${domain}/oauth/token` : `https://${domain}/oauth/token`;
+            const body = new URLSearchParams({
+                grant_type: "client_credentials",
+                client_id: clientId,
+                audience,
+            });
+            if ("clientSecret" in this.options) {
+                body.set("client_secret", this.options.clientSecret);
+            }
+            else if ("clientAssertionSigningKey" in this.options) {
+                const assertion = yield this.buildClientAssertion(domain, clientId);
+                body.set("client_assertion", assertion);
+                body.set("client_assertion_type", "urn:ietf:params:oauth:client-assertion-type:jwt-bearer");
+            }
+            // Build request headers. Start with user-supplied plain-string headers so they can be
+            // overridden by SDK-controlled values (Content-Type, Auth0-Client) set below.
+            // Supplier-function headers (Fern's Supplier<string | null | undefined> type) are skipped —
+            // they require async resolution and are not supported on the token endpoint path.
+            const userHeaders = (_a = this.options.headers) !== null && _a !== void 0 ? _a : {};
+            const headers = {};
+            for (const [key, value] of Object.entries(userHeaders)) {
+                if (typeof value === "string") {
+                    headers[key.toLowerCase()] = value;
+                }
+            }
+            headers["content-type"] = "application/x-www-form-urlencoded";
+            const telemetryHeader = this.buildTelemetryHeader();
+            if (telemetryHeader) {
+                headers["auth0-client"] = telemetryHeader;
+            }
+            // Use custom fetch for mTLS, else global fetch.
+            // `fetch` is defined on BaseClientOptions (src/management/BaseClient.ts) which is Fern-generated.
+            // If that file is regenerated, verify `fetch?: typeof fetch` is still present — token acquisition
+            // for mTLS depends on it being forwarded here.
+            const { fetch: customFetch } = this.options;
+            const fetcher = customFetch !== null && customFetch !== void 0 ? customFetch : fetch;
+            let response;
+            try {
+                response = yield fetcher(tokenUrl, {
+                    method: "POST",
+                    headers,
+                    body: body.toString(),
+                    signal: AbortSignal.timeout(10000),
+                });
+            }
+            catch (err) {
+                // Built-in fetch aborts with a "TimeoutError"; node-fetch (used on the mTLS path with a
+                // custom fetch) aborts with an "AbortError". Match both so a token-request timeout maps
+                // to a 408 regardless of the underlying fetch implementation.
+                if (err instanceof Error && (err.name === "TimeoutError" || err.name === "AbortError")) {
+                    throw new ManagementError_js_1.ManagementError({
+                        message: "ManagementClient: token request timed out",
+                        statusCode: 408,
+                    });
+                }
+                throw err;
+            }
+            if (!response.ok) {
+                // Read the body exactly once. `response.json()` followed by `response.text()` throws
+                // "Body has already been read", which would swallow non-JSON error payloads (e.g. proxy
+                // or WAF 502s). Read text, then attempt to parse it as JSON.
+                const raw = yield response.text().catch(() => "");
+                let errorBody;
+                try {
+                    errorBody = raw ? JSON.parse(raw) : response.statusText;
+                }
+                catch (_b) {
+                    errorBody = raw || response.statusText;
+                }
+                throw new ManagementError_js_1.ManagementError({
+                    message: "ManagementClient: token request failed",
+                    statusCode: response.status,
+                    body: errorBody,
+                });
+            }
+            const json = (yield response.json());
+            return {
+                accessToken: json.access_token,
+                expiresAt: Date.now() + json.expires_in * 1000,
+            };
+        });
+    }
+    buildClientAssertion(domain, clientId) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const { clientAssertionSigningKey, clientAssertionSigningAlg = "RS256" } = this
+                .options;
+            const key = yield (0, jose_1.importPKCS8)(clientAssertionSigningKey, clientAssertionSigningAlg);
+            const now = Math.floor(Date.now() / 1000);
+            return new jose_1.SignJWT({})
+                .setProtectedHeader({ alg: clientAssertionSigningAlg })
+                .setIssuedAt(now)
+                .setIssuer(clientId)
+                .setSubject(clientId)
+                .setAudience(`https://${domain}/`)
+                .setExpirationTime(now + 180) // 3 min lifetime
+                .setJti(crypto.randomUUID())
+                .sign(key);
+        });
+    }
+    buildTelemetryHeader() {
+        var _a;
+        const opts = this.options;
+        if (opts.telemetry === false)
+            return null;
+        const nodeAuth0Info = (0, utils_js_1.generateClientInfo)();
+        const info = opts.clientInfo
+            ? { name: opts.clientInfo.name, version: String((_a = opts.clientInfo.version) !== null && _a !== void 0 ? _a : nodeAuth0Info.version) }
+            : { name: nodeAuth0Info.name, version: nodeAuth0Info.version };
+        // NOTE: auth0-auth-js TelemetryConfig does not support env fields.
+        // The runtime fingerprint (env.node / env.cloudflare-workers) present in the
+        // original node-auth0 Auth0-Client header is intentionally omitted here.
+        // This is a known, accepted delta vs the pre-v7 token request telemetry shape.
+        // Use jose's base64url encoder for runtime portability (Buffer is Node-only).
+        return jose_1.base64url.encode(new TextEncoder().encode(JSON.stringify(info)));
+    }
 }
 exports.TokenProvider = TokenProvider;

package/dist/cjs/utils.d.ts

@@ -5,21 +5,3 @@ export declare const generateClientInfo: () => {
         [x: string]: string;
     };
 };
-/**
- * @private
- */
-export declare const mtlsPrefix = "mtls";
-type SyncGetter<T> = () => T;
-type AsyncGetter<T> = () => Promise<T>;
-/**
- * Resolves a value that can be a static value, a synchronous function, or an asynchronous function.
- *
- * @template T - The type of the value to be resolved.
- * @param {T | SyncGetter<T> | AsyncGetter<T>} value - The value to be resolved. It can be:
- *   - A static value of type T.
- *   - A synchronous function that returns a value of type T.
- *   - An asynchronous function that returns a Promise of type T.
- * @returns {Promise<T>} A promise that resolves to the value of type T.
- */
-export declare const resolveValueToPromise: <T>(value: T | SyncGetter<T> | AsyncGetter<T>) => Promise<T>;
-export {};

package/dist/cjs/utils.js

@@ -1,15 +1,6 @@
 "use strict";
-var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
-    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
-    return new (P || (P = Promise))(function (resolve, reject) {
-        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
-        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
-        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
-        step((generator = generator.apply(thisArg, _arguments || [])).next());
-    });
-};
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.resolveValueToPromise = exports.mtlsPrefix = exports.generateClientInfo = void 0;
+exports.generateClientInfo = void 0;
 const version_js_1 = require("./management/version.js");
 const index_js_1 = require("./management/core/index.js");
 const generateClientInfo = () => {
@@ -26,25 +17,3 @@ const generateClientInfo = () => {
     };
 };
 exports.generateClientInfo = generateClientInfo;
-/**
- * @private
- */
-exports.mtlsPrefix = "mtls";
-/**
- * Resolves a value that can be a static value, a synchronous function, or an asynchronous function.
- *
- * @template T - The type of the value to be resolved.
- * @param {T | SyncGetter<T> | AsyncGetter<T>} value - The value to be resolved. It can be:
- *   - A static value of type T.
- *   - A synchronous function that returns a value of type T.
- *   - An asynchronous function that returns a Promise of type T.
- * @returns {Promise<T>} A promise that resolves to the value of type T.
- */
-const resolveValueToPromise = (value) => __awaiter(void 0, void 0, void 0, function* () {
-    if (typeof value === "function") {
-        const result = value(); // Call the function
-        return result instanceof Promise ? result : Promise.resolve(result); // Handle sync/async
-    }
-    return Promise.resolve(value); // Static value
-});
-exports.resolveValueToPromise = resolveValueToPromise;

package/dist/esm/index.d.mts

@@ -1,6 +1,4 @@
 export * from "./management/index.mjs";
-export * from "./auth/index.mjs";
-export * from "./userinfo/index.mjs";
 export * from "./lib/errors.mjs";
 export * from "./lib/models.mjs";
 export * from "./lib/httpResponseHeadersUtils.mjs";

package/dist/esm/index.mjs

@@ -1,6 +1,4 @@
 export * from "./management/index.mjs";
-export * from "./auth/index.mjs";
-export * from "./userinfo/index.mjs";
 export * from "./lib/errors.mjs";
 export * from "./lib/models.mjs";
 export * from "./lib/httpResponseHeadersUtils.mjs";

package/dist/esm/lib/errors.d.mts

@@ -1,13 +1,3 @@
-/**
- * Error thrown when the API returns an error response that can't be parsed to a more specific Error instance.
- */
-export declare class ResponseError extends Error {
-    statusCode: number;
-    body: string;
-    headers: Headers;
-    name: "ResponseError";
-    constructor(statusCode: number, body: string, headers: Headers, msg?: string);
-}
 /**
  * Error thrown when the request is aborted due to a timeout.
  */
@@ -15,14 +5,6 @@ export declare class TimeoutError extends Error {
     name: "TimeoutError";
     constructor();
 }
-/**
- * Error thrown when there is a network error.
- */
-export declare class FetchError extends Error {
-    cause: Error;
-    name: "FetchError";
-    constructor(cause: Error, msg?: string);
-}
 /**
  * Error thrown when a required argument was not provided.
  */

package/dist/esm/lib/errors.mjs

@@ -1,15 +1,3 @@
-/**
- * Error thrown when the API returns an error response that can't be parsed to a more specific Error instance.
- */
-export class ResponseError extends Error {
-    constructor(statusCode, body, headers, msg) {
-        super(msg);
-        this.statusCode = statusCode;
-        this.body = body;
-        this.headers = headers;
-        this.name = "ResponseError";
-    }
-}
 /**
  * Error thrown when the request is aborted due to a timeout.
  */
@@ -19,16 +7,6 @@ export class TimeoutError extends Error {
         this.name = "TimeoutError";
     }
 }
-/**
- * Error thrown when there is a network error.
- */
-export class FetchError extends Error {
-    constructor(cause, msg) {
-        super(msg);
-        this.cause = cause;
-        this.name = "FetchError";
-    }
-}
 /**
  * Error thrown when a required argument was not provided.
  */

package/dist/esm/lib/middleware/auth0-client-telemetry.d.mts

@@ -1,10 +1,9 @@
-import { Middleware, ClientOptions, FetchParams, RequestContext } from "../runtime.mjs";
+import { ClientOptions } from "../models.mjs";
 /**
- * Handles Auth0 client telemetry functionality. Can be used both as middleware
- * for automatic header injection and as a standalone utility for manual telemetry header generation.
+ * Generates the Auth0-Client telemetry header value.
  * @private
  */
-export declare class Auth0ClientTelemetry implements Middleware {
+export declare class Auth0ClientTelemetry {
     clientInfo: {
         name: string;
         [key: string]: unknown;
@@ -12,9 +11,6 @@ export declare class Auth0ClientTelemetry implements Middleware {
     constructor(options: ClientOptions);
     /**
      * Get the Auth0-Client header value for telemetry.
-     * This method can be used when you need to manually add telemetry headers
-     * instead of using the middleware system.
      */
     getAuth0ClientHeader(): string | undefined;
-    pre?(context: RequestContext): Promise<FetchParams | void>;
 }

package/dist/esm/lib/middleware/auth0-client-telemetry.mjs

@@ -1,17 +1,7 @@
-var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
-    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
-    return new (P || (P = Promise))(function (resolve, reject) {
-        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
-        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
-        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
-        step((generator = generator.apply(thisArg, _arguments || [])).next());
-    });
-};
 import { generateClientInfo } from "../../utils.mjs";
 import { base64url } from "jose";
 /**
- * Handles Auth0 client telemetry functionality. Can be used both as middleware
- * for automatic header injection and as a standalone utility for manual telemetry header generation.
+ * Generates the Auth0-Client telemetry header value.
  * @private
  */
 export class Auth0ClientTelemetry {
@@ -20,8 +10,6 @@ export class Auth0ClientTelemetry {
     }
     /**
      * Get the Auth0-Client header value for telemetry.
-     * This method can be used when you need to manually add telemetry headers
-     * instead of using the middleware system.
      */
     getAuth0ClientHeader() {
         if ("string" === typeof this.clientInfo.name && this.clientInfo.name.length > 0) {
@@ -29,16 +17,4 @@ export class Auth0ClientTelemetry {
         }
         return undefined;
     }
-    pre(context) {
-        return __awaiter(this, void 0, void 0, function* () {
-            const headerValue = this.getAuth0ClientHeader();
-            if (headerValue) {
-                context.init.headers = Object.assign(Object.assign({}, context.init.headers), { "Auth0-Client": headerValue });
-            }
-            return {
-                url: context.url,
-                init: context.init,
-            };
-        });
-    }
 }

package/dist/esm/lib/models.d.mts

@@ -71,30 +71,6 @@ export interface ApiResponse<T> {
     status: number;
     statusText: string;
 }
-export declare class JSONApiResponse<T> implements ApiResponse<T> {
-    data: T;
-    headers: Headers;
-    readonly status: number;
-    readonly statusText: string;
-    constructor(data: T, headers: Headers, status: number, statusText: string);
-    static fromResponse<T = unknown>(raw: Response): Promise<JSONApiResponse<T>>;
-}
-export declare class VoidApiResponse implements ApiResponse<undefined> {
-    headers: Headers;
-    readonly status: number;
-    readonly statusText: string;
-    data: undefined;
-    constructor(headers: Headers, status: number, statusText: string);
-    static fromResponse(raw: Response): Promise<VoidApiResponse>;
-}
-export declare class TextApiResponse implements ApiResponse<string> {
-    data: string;
-    headers: Headers;
-    readonly status: number;
-    readonly statusText: string;
-    constructor(data: string, headers: Headers, status: number, statusText: string);
-    static fromResponse(raw: Response): Promise<TextApiResponse>;
-}
 export interface FetchParams {
     url: string | URL | Request;
     init: RequestInit;