feat: add Agents and Organization Clients clients, Organization Level Roles, and Org-to-App Entitlement

[fern-api]

Changes

SDK regeneration from the Auth0 OpenAPI spec via Fern. Adds a new Agents management client and an Organization Clients sub-client, organization-level roles (role type/owner and the org role-groups endpoint), org-to-application entitlement on organizations, Google Workspace directory-provisioning group selection endpoints, Guardian factor settings, and a set of new query parameters and enum members across list endpoints. Also fixes the Event Stream deliveries list, which previously returned nothing on success.

🆕 New endpoints / types:

• Agents - new top-level agents client with list/create/read/update/delete on agents, backed by AgentResponseContent, AgentMetadata, ListAgentsResponseContent, and the create:agents/read:agents/update:agents/delete:agents scopes
• Organization Clients - new organizations.clients sub-client with list/create/get/update/delete on organizations/{id}/clients, backed by OrganizationClient, OrganizationClientMetadata, OrganizationClientMetadataOrganizationUsageEnum, CreateOrganizationClientRequestItem, and response types, plus the create:organization_clients/read:organization_clients/update:organization_clients/delete:organization_clients scopes
• Organization Role Groups - new organizations.roles.groups sub-client with list on organizations/{id}/roles/{role_id}/groups, backed by RoleGroup and ListOrganizationRoleGroupsResponseContent
• Directory Provisioning group selections - add_synchronized_group_selections (POST) and delete_synchronized_group_selections (DELETE) on connections/{id}/directory-provisioning/synchronized-groups, backed by SynchronizedGroupSelectionId

✏️ Modified endpoints (new properties):

• Organization Level Roles - type (RoleTypeEnum, tenant/organization) and owner_id on role create/get/update/effective-permission-source responses, plus type and owner_id filters on role list
• Org-to-App Entitlement - is_app_entitlement_active and client (OrganizationClientAssociation) on organization create/get/get-by-name/update responses, plus an include_client_association_for filter on organizations list
• Guardian factor settings - settings (GuardianFactorSettings with otp_length and otp_expiration_time) on the Guardian factor response
• Self-service Google Workspace groups - sync_groups on SelfServiceProfileSsoTicketGoogleWorkspaceConfig
• Synchronized group metadata - name, email, and direct_members_count on SynchronizedGroupPayload, plus a q search filter on the synchronized-groups list
• Connected accounts - allow_missing_user_id on ConnectionConnectedAccountsPurpose and ConnectionConnectedAccountsPurposeXaa
• Event Stream delivery attempts - duration on EventStreamDeliveryAttempt
• ACUL country codes - country_codes member on AculContextEnum
• include_totals pagination - include_totals added to the connections, client-grants, client-grant-organizations, groups, roles-users, user-groups, organizations, organization-members, flow-executions, refresh-tokens, and user-sessions list endpoints

🐛 Bug Fix:

• Event Stream deliveries list - deliveries.list previously returned nil on success because the paginated response envelope was not modeled. It now returns a cursor-paginated iterator of EventStreamDelivery, backed by the new ListEventStreamDeliveriesResponseContent, and EventStreamCloudEvent.data is typed as Hash[String, Object] to match the payload the API returns

References

N/A

Testing

Existing wire tests were regenerated to match the updated client. The live-tenant integration test passes against a dev tenant, and the new types load correctly.

• This change adds unit test coverage
• This change has been tested on the latest version of Ruby

Checklist

• I have read the Auth0 general contribution guidelines
• I have read the Auth0 Code of Conduct
• All existing and new tests complete without errors
• Rubocop passes on all added/modified files
• All active GitHub checks have passed