TypeError: Cannot read properties of undefined (reading 'flat') during export with AUTH0_PRESERVE_KEYWORDS and clientAuthCredentialsPre handler

[rdroe]

Description

When running a0deploy export with AUTH0_PRESERVE_KEYWORDS: true in the config, the export crashes:

error: Problem running command export
error: Problem loading tenant data from Auth0 TypeError: Cannot read properties of undefined (reading 'flat')

Root cause

In lib/keywordPreservation.js:167:

const resourceSpecificIdentifiers = auth0Handlers.reduce((acc, handler) => {
    acc[handler.type] = handler.identifiers.flat();  // crashes here
    return acc;
}, {});

The clientAuthCredentialsPre handler (a deploy-only pre-pass handler registered in lib/tools/auth0/handlers/index.js:129 via ...{ clientAuthCredentialsPre }) sets this.type = 'clientAuthCredentials' (in clientAuthCredentialsPre.js:37) but never sets this.identifiers and does not extend any base class that would set it. Therefore handler.identifiers is undefined, and calling .flat() on it throws.

The 8.42.0 release (#1438) fixed a dry-run crash on clientAuthCredentials, but the export path through preserveKeywords is a separate code path that remains unfixed.

Suggested fix

Option A — guard against undefined identifiers:

acc[handler.type] = (handler.identifiers || []).flat();

Option B — skip handlers without identifiers:

if (handler.identifiers === undefined) return acc;
acc[handler.type] = handler.identifiers.flat();

Reproduction

1. Use any config JSON with "AUTH0_PRESERVE_KEYWORDS": true
2. Run a0deploy export -c config.json --format=yaml --output_folder=./out
3. Observe crash

The crash occurs during handler iteration in preserveKeywords, before any tenant-specific data matters, so any tenant with keyword preservation enabled will trigger it.

Versions affected

• 8.40.0+ (introduced by feat: add client credential lifecycle management for Private Key JWT and mTLS #1417 which added clientAuthCredentialsPre)
• Confirmed in 8.42.0 (latest) and 9.0.0-beta.1

Versions not affected

• 8.39.0 and earlier (the clientAuthCredentialsPre handler did not exist yet; all handlers had identifiers set)

Minimal reproduction across versions

Version	Result
8.39.0	passes (no clientAuthCredentialsPre handler)
8.40.0+	crashes (handler exists, identifiers undefined)