auth0-deploy-cli 8.41.0 → 8.43.0

package/lib/tools/auth0/handlers/connections.js

@@ -129,6 +129,22 @@ exports.schema = {
                 required: ['active'],
                 additionalProperties: false,
             },
+            cross_app_access_requesting_app: {
+                type: 'object',
+                properties: {
+                    active: { type: 'boolean' },
+                },
+                required: ['active'],
+                additionalProperties: false,
+            },
+            cross_app_access_resource_app: {
+                type: 'object',
+                properties: {
+                    status: { type: 'string', enum: ['enabled', 'disabled'] },
+                },
+                required: ['status'],
+                additionalProperties: false,
+            },
             directory_provisioning_configuration: {
                 type: 'object',
                 properties: {
@@ -156,6 +172,9 @@ exports.schema = {
                             type: 'object',
                             properties: {
                                 id: { type: 'string' },
+                                name: { type: 'string' },
+                                email: { type: 'string' },
+                                direct_members_count: { type: 'number' },
                             },
                             required: ['id'],
                         },
@@ -467,12 +486,28 @@ class ConnectionsHandler extends default_1.default {
         try {
             const groups = [];
             let page = await this.client.connections.directoryProvisioning.listSynchronizedGroups(connectionId, {});
-            for (const g of page.data ?? [])
-                groups.push({ id: g.id });
+            for (const g of page.data ?? []) {
+                groups.push({
+                    id: g.id,
+                    ...(g.name !== undefined && { name: g.name }),
+                    ...(g.email !== undefined && { email: g.email }),
+                    ...(g.direct_members_count !== undefined && {
+                        direct_members_count: g.direct_members_count,
+                    }),
+                });
+            }
             while (page.hasNextPage?.()) {
                 page = await page.getNextPage();
-                for (const g of page.data ?? [])
-                    groups.push({ id: g.id });
+                for (const g of page.data ?? []) {
+                    groups.push({
+                        id: g.id,
+                        ...(g.name !== undefined && { name: g.name }),
+                        ...(g.email !== undefined && { email: g.email }),
+                        ...(g.direct_members_count !== undefined && {
+                            direct_members_count: g.direct_members_count,
+                        }),
+                    });
+                }
             }
             return groups;
         }

package/lib/tools/auth0/handlers/databases.js

@@ -462,12 +462,21 @@ class DatabaseHandler extends default_1.default {
             }
             return connection;
         });
+        // A connection can return both legacy password fields and `password_options` on read, but
+        // they're mutually exclusive on write. Strip the legacy fields to keep the export deployable.
+        const dbConnectionsNormalized = dbConnectionsWithActionNames.map((connection) => {
+            if (connection.options && 'password_options' in connection.options) {
+                const { passwordPolicy, password_complexity_options, password_history, password_no_personal_info, password_dictionary, ...options } = connection.options;
+                return { ...connection, options };
+            }
+            return connection;
+        });
         // If options option is empty for all connection, log the missing options scope.
-        const isOptionExists = dbConnectionsWithActionNames.every((c) => c.options && Object.keys(c.options).length > 0);
+        const isOptionExists = dbConnectionsNormalized.every((c) => c.options && Object.keys(c.options).length > 0);
         if (!isOptionExists) {
             logger_1.default.warn(`Insufficient scope the read:connections_options scope is required to get ${this.type} options.`);
         }
-        this.existing = dbConnectionsWithActionNames;
+        this.existing = dbConnectionsNormalized;
         return this.existing;
     }
     async calcChanges(assets) {

package/lib/tools/auth0/handlers/default.js

@@ -328,8 +328,8 @@ class APIHandler {
                 const updateFN = this.getClientFN(this.functions.update);
                 const updatePayload = (() => {
                     const data = (0, utils_1.stripFields)({ ...updateItem }, this.stripUpdateFields);
-                    const stripped = (0, utils_1.stripObfuscatedFieldsFromPayload)(data, this.sensitiveFieldsToObfuscate);
-                    return (0, utils_1.validateNoUnresolvedPlaceholders)(stripped, this.type, this.objString(updateItem));
+                    const obfuscatedStripped = (0, utils_1.stripObfuscatedFieldsFromPayload)(data, this.sensitiveFieldsToObfuscate);
+                    return (0, utils_1.stripUnresolvedPlaceholders)(obfuscatedStripped, this.type, this.objString(updateItem));
                 })();
                 return updateFN(updateItem[this.id], updatePayload);
             }, retryConfig)
@@ -347,8 +347,8 @@ class APIHandler {
                 const createFunction = this.getClientFN(this.functions.create);
                 const createPayload = (() => {
                     const strippedPayload = (0, utils_1.stripFields)(createItem, this.stripCreateFields);
-                    const stripped = (0, utils_1.stripObfuscatedFieldsFromPayload)(strippedPayload, this.sensitiveFieldsToObfuscate);
-                    return (0, utils_1.validateNoUnresolvedPlaceholders)(stripped, this.type, this.objString(createItem));
+                    const obfuscatedStripped = (0, utils_1.stripObfuscatedFieldsFromPayload)(strippedPayload, this.sensitiveFieldsToObfuscate);
+                    return (0, utils_1.stripUnresolvedPlaceholders)(obfuscatedStripped, this.type, this.objString(createItem));
                 })();
                 return createFunction(createPayload);
             }, retryConfig)
@@ -369,8 +369,8 @@ class APIHandler {
                 const updateFN = this.getClientFN(this.functions.update);
                 const updatePayload = (() => {
                     const data = (0, utils_1.stripFields)({ ...updateItem }, this.stripUpdateFields);
-                    const stripped = (0, utils_1.stripObfuscatedFieldsFromPayload)(data, this.sensitiveFieldsToObfuscate);
-                    return (0, utils_1.validateNoUnresolvedPlaceholders)(stripped, this.type, this.objString(updateItem));
+                    const obfuscatedStripped = (0, utils_1.stripObfuscatedFieldsFromPayload)(data, this.sensitiveFieldsToObfuscate);
+                    return (0, utils_1.stripUnresolvedPlaceholders)(obfuscatedStripped, this.type, this.objString(updateItem));
                 })();
                 return updateFN(updateItem[this.id], updatePayload);
             }, retryConfig)

package/lib/tools/auth0/handlers/guardianFactorTemplates.js

@@ -60,11 +60,20 @@ class GuardianFactorTemplatesHandler extends default_1.default {
         await Promise.all(guardianFactorTemplates.map(async (fatorTemplates) => {
             const { name, ...data } = fatorTemplates;
             const params = { name: fatorTemplates.name };
-            if (name === 'sms') {
-                await this.client.guardian.factors.sms.setTemplates(data);
+            try {
+                if (name === 'sms') {
+                    await this.client.guardian.factors.sms.setTemplates(data);
+                }
+                else if (name === 'phone') {
+                    await this.client.guardian.factors.phone.setTemplates(data);
+                }
             }
-            else if (name === 'phone') {
-                await this.client.guardian.factors.phone.setTemplates(data);
+            catch (err) {
+                if ((0, utils_1.isForbiddenFeatureError)(err, this.type)) {
+                    // Feature is deprecated/disabled on this tenant; warn and skip instead of failing the import.
+                    return;
+                }
+                throw err;
             }
             this.didUpdate(params);
             this.updated += 1;

package/lib/tools/auth0/handlers/guardianPhoneFactorMessageTypes.js

@@ -25,14 +25,7 @@ const isFeatureUnavailableError = (err) => {
         // Older Management API version where the endpoint is not available.
         return true;
     }
-    if (err.statusCode === 403 &&
-        err.originalError &&
-        err.originalError.response &&
-        err.originalError.response.body &&
-        err.originalError.response.body.errorCode === 'voice_mfa_not_allowed') {
-        // Recent Management API version, but with feature explicitly disabled.
-        return true;
-    }
+    // 403s (feature explicitly disabled) are handled by isForbiddenFeatureError.
     return false;
 };
 class GuardianPhoneMessageTypesHandler extends default_1.default {
@@ -75,7 +68,16 @@ class GuardianPhoneMessageTypesHandler extends default_1.default {
             }
         }
         const data = guardianPhoneFactorMessageTypes;
-        await this.client.guardian.factors.phone.setMessageTypes(data);
+        try {
+            await this.client.guardian.factors.phone.setMessageTypes(data);
+        }
+        catch (err) {
+            if (isFeatureUnavailableError(err) || (0, utils_1.isForbiddenFeatureError)(err, this.type)) {
+                // Feature is deprecated/disabled on this tenant; warn and skip instead of failing the import.
+                return;
+            }
+            throw err;
+        }
         this.updated += 1;
         this.didUpdate(guardianPhoneFactorMessageTypes);
     }

package/lib/tools/auth0/handlers/guardianPhoneFactorSelectedProvider.js

@@ -22,14 +22,7 @@ const isFeatureUnavailableError = (err) => {
         // Older Management API version where the endpoint is not available.
         return true;
     }
-    if (err.statusCode === 403 &&
-        err.originalError &&
-        err.originalError.response &&
-        err.originalError.response.body &&
-        err.originalError.response.body.errorCode === 'hooks_not_allowed') {
-        // Recent Management API version, but with feature explicitly disabled.
-        return true;
-    }
+    // 403s (feature explicitly disabled) are handled by isForbiddenFeatureError.
     return false;
 };
 class GuardianPhoneSelectedProviderHandler extends default_1.default {
@@ -72,7 +65,16 @@ class GuardianPhoneSelectedProviderHandler extends default_1.default {
             }
         }
         const data = guardianPhoneFactorSelectedProvider;
-        await this.client.guardian.factors.phone.setProvider(data);
+        try {
+            await this.client.guardian.factors.phone.setProvider(data);
+        }
+        catch (err) {
+            if (isFeatureUnavailableError(err) || (0, utils_1.isForbiddenFeatureError)(err, this.type)) {
+                // Feature is deprecated/disabled on this tenant; warn and skip instead of failing the import.
+                return;
+            }
+            throw err;
+        }
         this.updated += 1;
         this.didUpdate(guardianPhoneFactorSelectedProvider);
     }

package/lib/tools/auth0/handlers/hooks.js

@@ -151,7 +151,7 @@ class HooksHandler extends default_1.default {
                 .get(hook.id)
                 .then((hookWithCode) => this.client.hooks.secrets
                 .get(hook.id)
-                .then(({ data: secrets }) => ({ ...hookWithCode, secrets })))));
+                .then((secrets) => ({ ...hookWithCode, secrets })))));
             return this.existing;
         }
         catch (err) {

package/lib/tools/auth0/handlers/networkACLs.d.ts

@@ -85,6 +85,15 @@ export declare const schema: {
                                     uniqueItems: boolean;
                                     minItems: number;
                                 };
+                                auth0_managed: {
+                                    type: string;
+                                    items: {
+                                        type: string;
+                                        pattern: string;
+                                    };
+                                    uniqueItems: boolean;
+                                    minItems: number;
+                                };
                                 geo_country_codes: {
                                     type: string;
                                     items: {
@@ -176,6 +185,15 @@ export declare const schema: {
                                     uniqueItems: boolean;
                                     minItems: number;
                                 };
+                                auth0_managed: {
+                                    type: string;
+                                    items: {
+                                        type: string;
+                                        pattern: string;
+                                    };
+                                    uniqueItems: boolean;
+                                    minItems: number;
+                                };
                                 geo_country_codes: {
                                     type: string;
                                     items: {

package/lib/tools/auth0/handlers/networkACLs.js

@@ -69,6 +69,15 @@ const MatchSchema = {
             uniqueItems: true,
             minItems: 1,
         },
+        auth0_managed: {
+            type: 'array',
+            items: {
+                type: 'string',
+                pattern: '^auth0\\.[^.\\s]+$',
+            },
+            uniqueItems: true,
+            minItems: 1,
+        },
         geo_country_codes: {
             type: 'array',
             items: {

package/lib/tools/auth0/handlers/organizations.d.ts

@@ -1,6 +1,7 @@
 import { Management } from 'auth0';
 import DefaultHandler from './default';
 import { Asset, Assets, CalculatedChanges } from '../../../types';
+import { Client } from './clients';
 export declare const schema: {
     type: string;
     items: {
@@ -108,6 +109,25 @@ export declare const schema: {
                 type: string;
                 enum: ("allow" | "block")[];
             };
+            is_app_entitlement_active: {
+                type: string;
+            };
+            clients: {
+                type: string;
+                items: {
+                    type: string;
+                    properties: {
+                        client_id: {
+                            type: string;
+                        };
+                        use_for_member_access: {
+                            type: string;
+                        };
+                    };
+                    required: string[];
+                };
+                default: never[];
+            };
         };
         required: string[];
     };
@@ -119,6 +139,7 @@ type FormattedClientGrants = {
 export default class OrganizationsHandler extends DefaultHandler {
     existing: Asset[];
     formattedClientGrants: FormattedClientGrants[];
+    allClients: Client[];
     constructor(config: DefaultHandler);
     deleteOrganization(org: any): Promise<void>;
     deleteOrganizations(data: Asset[]): Promise<void>;
@@ -128,6 +149,7 @@ export default class OrganizationsHandler extends DefaultHandler {
         id: any;
     }>;
     getClientGrantIDByClientName(clientsName: string): string;
+    getClientIdByClientName(clientName: string): string;
     getFormattedClientGrants(): Promise<FormattedClientGrants[]>;
     updateOrganizations(updates: CalculatedChanges['update'], orgs: Asset[]): Promise<void>;
     getType(): Promise<Asset[]>;
@@ -141,5 +163,11 @@ export default class OrganizationsHandler extends DefaultHandler {
     createOrganizationDiscoveryDomain(organizationId: string, discoveryDomain: Management.CreateOrganizationDiscoveryDomainRequestContent): Promise<Management.CreateOrganizationDiscoveryDomainResponseContent>;
     updateOrganizationDiscoveryDomain(organizationId: string, discoveryDomainId: string, discoveryDomain: string, discoveryDomainUpdate: Management.UpdateOrganizationDiscoveryDomainRequestContent): Promise<Management.UpdateOrganizationDiscoveryDomainResponseContent>;
     deleteOrganizationDiscoveryDomain(organizationId: string, discoveryDomain: string, discoveryDomainId: string): Promise<void>;
+    getAllOrganizationClients(organizationId: string): Promise<Management.OrganizationClient[] | null>;
+    createOrganizationClients(organizationId: string, clients: Array<{
+        client_id: string;
+        use_for_member_access: boolean;
+    }>): Promise<void>;
+    deleteOrganizationClients(organizationId: string, clientIds: string[]): Promise<void>;
 }
 export {};

package/lib/tools/auth0/handlers/organizations.js

@@ -131,6 +131,19 @@ exports.schema = {
                 type: 'string',
                 enum: Object.values(auth0_1.Management.OrganizationThirdPartyClientAccessEnum),
             },
+            is_app_entitlement_active: { type: 'boolean' },
+            clients: {
+                type: 'array',
+                items: {
+                    type: 'object',
+                    properties: {
+                        client_id: { type: 'string' },
+                        use_for_member_access: { type: 'boolean' },
+                    },
+                    required: ['client_id', 'use_for_member_access'],
+                },
+                default: [],
+            },
         },
         required: ['name'],
     },
@@ -172,6 +185,7 @@ class OrganizationsHandler extends default_1.default {
         const organization = { ...org };
         delete organization.connections;
         delete organization.client_grants;
+        delete organization.clients;
         if ('discovery_domains' in organization) {
             delete organization.discovery_domains;
         }
@@ -195,6 +209,19 @@ class OrganizationsHandler extends default_1.default {
                 throw new Error(`Problem creating discovery domain ${discoveryDomain?.domain} for organization ${createdId}\n${err}`);
             })));
         }
+        if (typeof org.clients !== 'undefined' && org.clients.length > 0) {
+            const clientsToCreate = org.clients
+                .map((oc) => ({
+                client_id: this.getClientIdByClientName(oc.client_id),
+                use_for_member_access: oc.use_for_member_access,
+            }))
+                .filter((oc) => !!oc.client_id);
+            if (clientsToCreate.length > 0) {
+                await this.createOrganizationClients(createdId, clientsToCreate).catch((err) => {
+                    throw new Error(`Problem creating org clients for organization ${createdId}\n${err}`);
+                });
+            }
+        }
         return created;
     }
     async createOrganizations(creates) {
@@ -213,14 +240,15 @@ class OrganizationsHandler extends default_1.default {
             .promise();
     }
     async updateOrganization(org, organizations) {
-        const { connections: existingConnections, client_grants: existingClientGrants, discovery_domains: existingDiscoveryDomains, } = await organizations.find((orgToUpdate) => orgToUpdate.name === org.name);
+        const { connections: existingConnections, client_grants: existingClientGrants, discovery_domains: existingDiscoveryDomains, clients: existingOrgClients = [], } = await organizations.find((orgToUpdate) => orgToUpdate.name === org.name);
         const params = { id: org.id };
-        const { connections, client_grants: organizationClientGrants, discovery_domains: organizationDiscoveryDomains, } = org;
+        const { connections, client_grants: organizationClientGrants, discovery_domains: organizationDiscoveryDomains, clients: organizationClients, } = org;
         delete org.connections;
         delete org.name;
         delete org.id;
         delete org.client_grants;
         delete org.discovery_domains;
+        delete org.clients;
         await this.client.organizations.update(params.id, org);
         // organization connections
         const connectionsToRemove = existingConnections.filter((c) => !connections.find((x) => x.connection_id === c.connection_id));
@@ -324,12 +352,61 @@ class OrganizationsHandler extends default_1.default {
       \n${orgDiscoveryDomainsToRemove.map((i) => this.objString(i)).join('\n')}`);
             }
         }
+        // organization clients
+        const orgClientsToAdd = (organizationClients || [])
+            .filter((c) => !existingOrgClients.find((x) => x.client_id === c.client_id))
+            .map((oc) => ({
+            client_id: this.getClientIdByClientName(oc.client_id),
+            use_for_member_access: oc.use_for_member_access,
+        }))
+            .filter((oc) => !!oc.client_id);
+        const orgClientsToRemove = (existingOrgClients || [])
+            .filter((c) => !(organizationClients || []).find((x) => x.client_id === c.client_id))
+            .map((oc) => this.getClientIdByClientName(oc.client_id))
+            .filter(Boolean);
+        const orgClientsToUpdate = (organizationClients || [])
+            .filter((c) => {
+            const existing = existingOrgClients.find((x) => x.client_id === c.client_id);
+            return existing && existing.use_for_member_access !== c.use_for_member_access;
+        })
+            .map((oc) => ({
+            client_id: this.getClientIdByClientName(oc.client_id),
+            use_for_member_access: oc.use_for_member_access,
+        }))
+            .filter((oc) => !!oc.client_id);
+        if (orgClientsToAdd.length > 0) {
+            await this.createOrganizationClients(params.id, orgClientsToAdd).catch((err) => {
+                throw new Error(`Problem adding org clients for organization ${params.id}\n${err}`);
+            });
+        }
+        if (orgClientsToRemove.length > 0) {
+            if (this.config('AUTH0_ALLOW_DELETE') === 'true' ||
+                this.config('AUTH0_ALLOW_DELETE') === true) {
+                await this.deleteOrganizationClients(params.id, orgClientsToRemove).catch((err) => {
+                    throw new Error(`Problem removing org clients for organization ${params.id}\n${err}`);
+                });
+            }
+            else {
+                logger_1.default.warn(`Detected the following organization client associations should be removed. Doing so may be destructive.\nYou can enable deletes by setting 'AUTH0_ALLOW_DELETE' to true in the config\n${orgClientsToRemove.join('\n')}`);
+            }
+        }
+        await Promise.all(orgClientsToUpdate.map((oc) => this.client.organizations.clients
+            .update(params.id, oc.client_id, {
+            use_for_member_access: oc.use_for_member_access,
+        })
+            .catch((err) => {
+            throw new Error(`Problem updating org client ${oc.client_id} for organization ${params.id}\n${err}`);
+        })));
         return params;
     }
     getClientGrantIDByClientName(clientsName) {
         const found = this.formattedClientGrants.find((c) => c.client_id === clientsName);
         return found?.grant_id || '';
     }
+    getClientIdByClientName(clientName) {
+        const found = this.allClients?.find((c) => c.name === clientName);
+        return found?.client_id || '';
+    }
     async getFormattedClientGrants() {
         const [clients, clientGrants] = await Promise.all([
             (0, client_1.paginate)(this.client.clients.list, {
@@ -339,6 +416,8 @@ class OrganizationsHandler extends default_1.default {
                 paginate: true,
             }),
         ]);
+        // Store clients for org-client name→ID resolution
+        this.allClients = clients;
         // Convert clients by name to the id and store it in the formattedClientGrants
         const formattedClientGrantsMapping = clientGrants?.map((clientGrant) => {
             const { id, client_id: clientName } = clientGrant;
@@ -394,6 +473,14 @@ class OrganizationsHandler extends default_1.default {
                 if (organizationDiscoveryDomains) {
                     org.discovery_domains = organizationDiscoveryDomains;
                 }
+                // Get org-client associations
+                const orgClients = await this.getAllOrganizationClients(org.id);
+                if (orgClients) {
+                    org.clients = orgClients.map((oc) => ({
+                        client_id: (0, utils_1.convertClientIdToName)(oc.client_id, clients),
+                        use_for_member_access: oc.use_for_member_access,
+                    }));
+                }
             }
             this.existing = organizations;
             return this.existing;
@@ -539,6 +626,44 @@ class OrganizationsHandler extends default_1.default {
         logger_1.default.debug(`Deleting discovery domain ${discoveryDomain} for organization ${organizationId}`);
         await this.client.organizations.discoveryDomains.delete(organizationId, discoveryDomainId);
     }
+    async getAllOrganizationClients(organizationId) {
+        const allOrgClients = [];
+        try {
+            let orgClients = await this.client.organizations.clients.list(organizationId);
+            allOrgClients.push(...orgClients.data);
+            while (orgClients.hasNextPage()) {
+                orgClients = await orgClients.getNextPage();
+                allOrgClients.push(...orgClients.data);
+            }
+            return allOrgClients;
+        }
+        catch (err) {
+            if (err.statusCode === 404 || err.statusCode === 501) {
+                return null;
+            }
+            if (err.statusCode === 403 || err.errorCode === 'feature_not_enabled') {
+                logger_1.default.debug('Org-to-app entitlement is not enabled for this tenant. Skipping org-client associations.');
+                return null;
+            }
+            throw err;
+        }
+    }
+    async createOrganizationClients(organizationId, clients) {
+        const BATCH_SIZE = 10;
+        for (let i = 0; i < clients.length; i += BATCH_SIZE) {
+            const batch = clients.slice(i, i + BATCH_SIZE);
+            logger_1.default.debug(`Creating ${batch.length} org client(s) for organization ${organizationId}`);
+            await this.client.organizations.clients.create(organizationId, { clients: batch });
+        }
+    }
+    async deleteOrganizationClients(organizationId, clientIds) {
+        const BATCH_SIZE = 10;
+        for (let i = 0; i < clientIds.length; i += BATCH_SIZE) {
+            const batch = clientIds.slice(i, i + BATCH_SIZE);
+            logger_1.default.debug(`Deleting ${batch.length} org client(s) for organization ${organizationId}`);
+            await this.client.organizations.clients.delete(organizationId, { clients: batch });
+        }
+    }
 }
 exports.default = OrganizationsHandler;
 __decorate([

package/lib/tools/auth0/handlers/phoneTemplates.d.ts

@@ -54,7 +54,10 @@ export default class PhoneTemplatesHandler extends DefaultHandler {
     objString(template: any): string;
     getType(): Promise<PhoneTemplate[]>;
     processChanges(assets: Assets): Promise<void>;
-    createPhoneTemplate(template: any): Promise<Asset>;
+    createPhoneTemplate(template: any): Promise<{
+        asset: Asset;
+        action: 'create' | 'update';
+    }>;
     createPhoneTemplates(creates: CalculatedChanges['create']): Promise<void>;
     updatePhoneTemplate(template: any): Promise<Asset>;
     updatePhoneTemplates(updates: CalculatedChanges['update']): Promise<void>;

package/lib/tools/auth0/handlers/phoneTemplates.js

@@ -44,6 +44,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.schema = void 0;
 const default_1 = __importStar(require("./default"));
+const utils_1 = require("../../utils");
 const logger_1 = __importDefault(require("../../../logger"));
 exports.schema = {
     type: 'array',
@@ -121,25 +122,77 @@ class PhoneTemplatesHandler extends default_1.default {
         if (del.length > 0) {
             await this.deletePhoneTemplates(del);
         }
-        if (create.length > 0) {
-            await this.createPhoneTemplates(create);
+        // On newly created tenants the phone templates returned by the API have no
+        // ID until they are explicitly created. calcChanges matches assets by `type`
+        // and routes them all to `update`, but PATCH requires an ID. Split out the
+        // templates whose existing counterpart has no ID yet and create them instead.
+        const missingId = [];
+        const hasId = [];
+        update.forEach((template) => {
+            const existing = this.existing?.find((t) => t.type === template.type);
+            if (existing?.id) {
+                hasId.push(template);
+            }
+            else {
+                missingId.push(template);
+            }
+        });
+        const toCreate = [...create, ...missingId];
+        if (toCreate.length > 0) {
+            await this.createPhoneTemplates(toCreate);
         }
-        if (update.length > 0) {
-            await this.updatePhoneTemplates(update);
+        if (hasId.length > 0) {
+            await this.updatePhoneTemplates(hasId);
         }
     }
     async createPhoneTemplate(template) {
-        const created = await this.client.branding.phone.templates.create(template);
-        return created;
+        // The create endpoint only accepts type/disabled/content; strip read-only
+        // fields (channel, customizable, tenant) that the API would reject.
+        const createPayload = (0, utils_1.stripFields)(template, this.stripCreateFields);
+        // The API rejects an empty `content.from`, which is what fresh tenants
+        // export. Drop it when blank (cloning `content`, which stripFields only
+        // shallow-copied, so the caller's original asset isn't mutated).
+        if (createPayload.content && !createPayload.content.from) {
+            createPayload.content = { ...createPayload.content };
+            delete createPayload.content.from;
+        }
+        try {
+            const created = await this.client.branding.phone.templates.create(createPayload);
+            return { asset: created, action: 'create' };
+        }
+        catch (err) {
+            // A 409 means the template already exists on the tenant (it was created
+            // between our list call and this create, or the list endpoint didn't
+            // surface its ID). Re-fetch to pick up the ID and fall back to an update.
+            if (err.statusCode === 409) {
+                logger_1.default.debug(`Phone template type '${template.type}' already exists, falling back to update`);
+                // Reassigns the shared `this.existing`; safe under concurrency since
+                // every re-fetch returns the same consistent list. If it still lacks an
+                // ID, updatePhoneTemplate warns and skips.
+                const response = await this.client.branding.phone.templates.list();
+                this.existing = response.templates ?? [];
+                const updated = await this.updatePhoneTemplate(template);
+                return { asset: updated, action: 'update' };
+            }
+            throw err;
+        }
     }
     async createPhoneTemplates(creates) {
         await this.client.pool
             .addEachTask({
             data: creates || [],
             generator: (item) => this.createPhoneTemplate(item)
-                .then((data) => {
-                this.didCreate(data);
-                this.created += 1;
+                .then(({ asset, action }) => {
+                // A 409 fallback actually performed an update; count it as such so
+                // the import summary doesn't report a phantom "create".
+                if (action === 'update') {
+                    this.didUpdate(asset);
+                    this.updated += 1;
+                }
+                else {
+                    this.didCreate(asset);
+                    this.created += 1;
+                }
             })
                 .catch((err) => {
                 throw new Error(`Problem creating ${this.type} ${this.objString(item)}\n${err}`);
@@ -160,7 +213,6 @@ class PhoneTemplatesHandler extends default_1.default {
         logger_1.default.debug(`Stripping ${this.type} create-only fields ${JSON.stringify(stripUpdateFields)}`);
         const updatePayload = {
             content: {
-                from: template.content?.from,
                 body: {
                     text: template.content?.body?.text,
                     voice: template.content?.body?.voice,
@@ -168,6 +220,11 @@ class PhoneTemplatesHandler extends default_1.default {
             },
             disabled: template.disabled,
         };
+        // `content.from` is optional but the API rejects an empty string, which is
+        // what fresh tenants export. Only include it when it has a value.
+        if (template.content?.from) {
+            updatePayload.content.from = template.content.from;
+        }
         const updated = await this.client.branding.phone.templates.update(existing.id, updatePayload);
         return updated;
     }