[jacobovidal]

🔧 Changes

Second of three stacked PRs (on #1738). It changes only the TypeScript tool and adds its single-file build. Nothing in the CLI uses the file yet.

• auth0 api transport. The tool calls the Management API by running auth0 api instead of talking to a local proxy, so the CLI keeps the login and the token. Request bodies go to the command on stdin, because they carry client secrets and process arguments are visible to other processes. The first request runs alone and then up to four run together, so several processes never refresh an expired token at once.
• How the tool starts. It uses the proxy variables if they are set, then AUTH0_CLI_BIN and AUTH0_CLI_TENANT_DOMAIN if the CLI passes them, and otherwise auth0 on the PATH and the active tenant. The --tenant flag wins.
• Missing scopes. Every command now says how to get a missing scope, for both ways the CLI can be signed in: auth0 login --scopes for a user login, or adding the scope to the application's Management API grant for a client-credentials login. Only setup did this before, and it printed the login command twice.
• Parallel reads in the permission check and the audit. The CLI takes about a second and a half per call, so reading one thing after another was slow. The permission check also sends its seven create probes together; they send an empty body and are expected to be rejected, as before. Real writes during setup stay one at a time.
• Paging fix. The audit failed against a real tenant (Additional properties not allowed: per_page,page): the endpoint that lists an application's connections pages by checkpoint and rejects page numbers. It now has its own helper. The test double was too forgiving and accepted page numbers there; it now behaves like the real endpoint.
• Single-file build. npm run bundle builds one ES module with esbuild (new dev dependency, exact version, in _source only). The first lines record a hash of the sources, the lockfile and the build script; a test fails when the committed file is older than its sources. .gitattributes marks the file as generated so GitHub folds it.
• The unused auth0 npm package is removed. It was the source of two moderate audit findings and nothing imported it. The lockfile uses public registry URLs, and a test keeps it that way.
• A test that a request without a body still closes stdin: auth0 api waits for stdin to end on every method except GET, so a transport that left it open would hang.

Dependabot watches only gomod and bundler in this repository, so the TypeScript dependencies get no automated updates. Adding an npm ecosystem is a .github change that I left for a maintainer to decide.

📚 References

Stacked on #1738. Followed by #1740.

🔬 Testing

cd internal/cli/data/universal-portals/_source
npm test                  # 229 tests
npm run bundle            # rebuilding changes nothing in git

Beyond the unit tests, the built file was run by hand against a development tenant with the installed CLI (v1.32.0): an audit of two existing portals, a consumer setup and a second run that reused everything, a business setup that found its user by email, and an audit of each new portal (no errors, no warnings). Everything the runs created was deleted afterwards and checked.

That run found the paging bug above, which no unit test had caught. Flows that have not run against a real tenant yet: the interactive prompts (organization and role creation, the user picker) and audit --fix.

📝 Checklist

• All new/changed/fixed functionality is covered by tests (or N/A)
• I have added documentation for all new/changed functionality (or N/A)

🤖 Generated with Claude Code