auth0-deploy-cli 9.0.0-beta.2 → 9.1.0

package/lib/tools/auth0/handlers/riskAssessment.d.ts

@@ -34,6 +34,6 @@ export type RiskAssessment = {
 export default class RiskAssessmentHandler extends DefaultAPIHandler {
     existing: RiskAssessment;
     constructor(config: DefaultAPIHandler);
-    getType(): Promise<RiskAssessment>;
+    getType(): Promise<RiskAssessment | null>;
     processChanges(assets: Assets): Promise<void>;
 }

package/lib/tools/auth0/handlers/riskAssessment.js

@@ -6,6 +6,8 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.schema = void 0;
 const default_1 = __importDefault(require("./default"));
 const auth0_1 = require("auth0");
+const logger_1 = __importDefault(require("../../../logger"));
+const utils_1 = require("../../utils");
 exports.schema = {
     type: 'object',
     properties: {
@@ -50,6 +52,9 @@ class RiskAssessmentHandler extends default_1.default {
                     if (err instanceof auth0_1.ManagementError && err?.statusCode === 404) {
                         return { remember_for: 0 };
                     }
+                    if ((0, utils_1.isInsufficientEntitlementError)(err)) {
+                        return { remember_for: 0 };
+                    }
                     throw err;
                 }),
             ]);
@@ -71,6 +76,10 @@ class RiskAssessmentHandler extends default_1.default {
                 this.existing = riskAssessment;
                 return this.existing;
             }
+            if ((0, utils_1.isInsufficientEntitlementError)(err)) {
+                logger_1.default.warn('Skipping riskAssessment export: tenant does not have Adaptive MFA entitlement');
+                return null;
+            }
             throw err;
         }
     }
@@ -87,7 +96,16 @@ class RiskAssessmentHandler extends default_1.default {
         if (riskAssessment.new_device) {
             updates.push(this.client.riskAssessments.settings.newDevice.update(riskAssessment.new_device));
         }
-        await Promise.all(updates);
+        try {
+            await Promise.all(updates);
+        }
+        catch (err) {
+            if ((0, utils_1.isInsufficientEntitlementError)(err)) {
+                logger_1.default.warn('Skipping riskAssessment deploy: tenant does not have Adaptive MFA entitlement');
+                return;
+            }
+            throw err;
+        }
         this.updated += 1;
         this.didUpdate(riskAssessment);
     }

package/lib/tools/auth0/handlers/roles.d.ts

@@ -14,6 +14,10 @@ export declare const schema: {
             description: {
                 type: string;
             };
+            type: {
+                type: string;
+                enum: string[];
+            };
             permissions: {
                 type: string;
                 items: {

package/lib/tools/auth0/handlers/roles.js

@@ -56,6 +56,7 @@ exports.schema = {
             name: { type: 'string' },
             id: { type: 'string' },
             description: { type: 'string' },
+            type: { type: 'string', enum: ['tenant', 'organization'] },
             permissions: {
                 type: 'array',
                 items: {
@@ -81,6 +82,9 @@ class RolesHandler extends default_1.default {
     async createRole(data) {
         const role = { ...data };
         delete role.permissions;
+        // deploy-cli only manages tenant-level roles, so `type` is stripped on write; it
+        // defaults to `tenant` on create. This keeps exports (which carry `type`) round-trippable.
+        delete role.type;
         const created = await this.client.roles.create(role);
         if (created.id && typeof data.permissions !== 'undefined' && data.permissions.length > 0) {
             await this.client.roles.permissions.add(created.id, { permissions: data.permissions });
@@ -128,19 +132,30 @@ class RolesHandler extends default_1.default {
         }
     }
     async updateRole(data, roles) {
-        const existingRole = await roles.find((roleDataForUpdate) => roleDataForUpdate.name === data.name);
+        // Match on id first so a renamed role (matched by id, new name) still resolves to its
+        // existing permissions; fall back to name for configs imported without ids.
+        const existingRole = roles.find((r) => r.id === data.id) || roles.find((r) => r.name === data.name);
         const params = { id: data.id };
-        const newPermissions = data.permissions;
+        const newPermissions = data.permissions || [];
         delete data.permissions;
         delete data.id;
-        await this.client.roles.update(params.id, data);
-        if (typeof existingRole.permissions !== 'undefined' && existingRole.permissions.length > 0) {
-            await this.client.roles.permissions.delete(params.id, {
-                permissions: existingRole.permissions,
-            });
+        // deploy-cli only manages tenant-level roles, so `type` is stripped on write; this
+        // lets files that already carry it (from a prior export) be imported cleanly.
+        delete data.type;
+        const retryConfig = this.getRetryConfig();
+        await (0, default_1.retryWithExponentialBackoff)(() => this.client.roles.update(params.id, data), retryConfig);
+        // Only touch permissions that actually changed, and add before removing so an
+        // interrupted run can never leave a role with fewer permissions than it started with.
+        const existingPermissions = existingRole.permissions || [];
+        const samePermission = (a, b) => a.permission_name === b.permission_name &&
+            a.resource_server_identifier === b.resource_server_identifier;
+        const permissionsToAdd = newPermissions.filter((p) => !existingPermissions.some((e) => samePermission(e, p)));
+        const permissionsToRemove = existingPermissions.filter((e) => !newPermissions.some((p) => samePermission(e, p)));
+        if (permissionsToAdd.length > 0) {
+            await (0, default_1.retryWithExponentialBackoff)(() => this.client.roles.permissions.add(params.id, { permissions: permissionsToAdd }), retryConfig);
         }
-        if (typeof newPermissions !== 'undefined' && newPermissions.length > 0) {
-            await this.client.roles.permissions.add(params.id, { permissions: newPermissions });
+        if (permissionsToRemove.length > 0) {
+            await (0, default_1.retryWithExponentialBackoff)(() => this.client.roles.permissions.delete(params.id, { permissions: permissionsToRemove }), retryConfig);
         }
         return params;
     }
@@ -164,9 +179,12 @@ class RolesHandler extends default_1.default {
             return this.existing;
         }
         try {
+            // Only manage tenant-level roles; exclude org-scoped roles surfaced when
+            // the api2_org_level_roles_ea flag is enabled.
             const roles = await (0, client_1.paginate)(this.client.roles.list, {
                 paginate: true,
                 include_totals: true,
+                type: 'tenant',
             });
             for (let index = 0; index < roles.length; index++) {
                 const allPermission = [];

package/lib/tools/auth0/handlers/rules.js

@@ -9,6 +9,7 @@ const utils_1 = require("../../utils");
 const default_1 = __importDefault(require("./default"));
 const logger_1 = __importDefault(require("../../../logger"));
 const calculateChanges_1 = require("../../calculateChanges");
+const calculateDryRunChanges_1 = require("../../calculateDryRunChanges");
 const client_1 = require("../client");
 exports.excludeSchema = {
     type: 'array',
@@ -135,13 +136,24 @@ class RulesHandler extends default_1.default {
         };
     }
     async dryRunChanges(assets) {
-        const { del, update, create, conflicts } = await this.calcChanges(assets);
-        return {
-            del,
-            update,
-            create,
-            conflicts,
-        };
+        let { rules } = assets;
+        if (!rules) {
+            return { del: [], create: [], conflicts: [], update: [] };
+        }
+        const excludedRules = (assets.exclude && assets.exclude.rules) || [];
+        rules = rules.filter((r) => !excludedRules.includes(r.name));
+        let existing = await this.getType();
+        if (existing === null) {
+            return { del: [], create: [], conflicts: [], update: [] };
+        }
+        existing = existing.filter((r) => !excludedRules.includes(r.name));
+        return (0, calculateDryRunChanges_1.calculateDryRunChanges)({
+            type: this.type,
+            assets: rules,
+            existing,
+            identifiers: this.identifiers,
+            ignoreDryRunFields: this.getEffectiveIgnoreDryRunFields(),
+        });
     }
     async validate(assets) {
         const { rules } = assets;

package/lib/tools/auth0/handlers/scimHandler.js

@@ -39,6 +39,10 @@ class ScimHandler {
      * @param connections
      */
     async createIdMap(connections) {
+        // No `read:scim_config` scope means nothing to fetch. Return before clearing
+        // to keep any existing map and skip a no-op pool task per connection.
+        if (!this.scimScopes.read)
+            return;
         this.idMap.clear();
         const logMsg = 'Reviewing connections for SCIM support. This may take a while...';
         if (nconf_1.default.get('AUTH0_DRY_RUN')) {
@@ -47,14 +51,15 @@ class ScimHandler {
         else {
             logger_1.default.info(logMsg);
         }
+        // Only SCIM-capable strategies can carry a SCIM configuration; filtering here
+        // keeps non-SCIM connections out of the throttled pool.
+        const scimConnections = (connections || []).filter((connection) => this.isScimStrategy(connection.strategy));
         await this.poolClient
             .addEachTask({
-            data: connections || [],
+            data: scimConnections,
             generator: (connection) => {
                 if (!this.scimScopes.read)
                     return Promise.resolve(null);
-                if (!this.isScimStrategy(connection.strategy))
-                    return Promise.resolve(null);
                 this.idMap.set(connection.id, { strategy: connection.strategy });
                 return this.getScimConfiguration(connection.id)
                     .then((response) => {

package/lib/tools/auth0/handlers/tenant.d.ts

@@ -79,6 +79,51 @@ export declare const schema: {
             enum: string[];
             description: string;
         };
+        country_codes: {
+            type: string[];
+            description: string;
+            properties: {
+                list: {
+                    type: string;
+                    description: string;
+                    items: {
+                        type: string;
+                        pattern: string;
+                    };
+                    minItems: number;
+                    uniqueItems: boolean;
+                };
+                mode: {
+                    type: string;
+                    enum: string[];
+                    description: string;
+                };
+            };
+            required: string[];
+            additionalProperties: boolean;
+        };
+        sessions: {
+            type: string;
+            description: string;
+            properties: {
+                anonymous: {
+                    type: string;
+                    description: string;
+                    properties: {
+                        lifetime_in_minutes: {
+                            type: string;
+                            description: string;
+                        };
+                        activate_cookie: {
+                            type: string;
+                            description: string;
+                        };
+                    };
+                    additionalProperties: boolean;
+                };
+            };
+            additionalProperties: boolean;
+        };
     };
 };
 export interface Tenant extends Management.GetTenantSettingsResponseContent {

package/lib/tools/auth0/handlers/tenant.js

@@ -106,6 +106,53 @@ exports.schema = {
             enum: ['strict', 'permissive'],
             description: 'Indicates the security mode for new clients created through the Dynamic Client Registration endpoint.',
         },
+        country_codes: {
+            type: ['object', 'null'],
+            description: 'Phone country code configuration for identifier input. Set to `null` to remove filtering (allow all countries). Requires the `tenant_country_codes_filtering` feature flag to be enabled on the tenant.',
+            properties: {
+                list: {
+                    type: 'array',
+                    description: 'ISO 3166-1 alpha-2 country codes (e.g. `US`, `GB`).',
+                    items: {
+                        type: 'string',
+                        pattern: '^[A-Z]{2}$',
+                    },
+                    minItems: 1,
+                    uniqueItems: true,
+                },
+                mode: {
+                    type: 'string',
+                    enum: ['allow', 'deny'],
+                    description: 'Whether the list is an allowlist or denylist.',
+                },
+            },
+            required: ['list', 'mode'],
+            additionalProperties: false,
+        },
+        sessions: {
+            type: 'object',
+            description: 'Sessions related settings for the tenant.',
+            properties: {
+                anonymous: {
+                    type: 'object',
+                    description: 'Anonymous session settings for the tenant.',
+                    properties: {
+                        lifetime_in_minutes: {
+                            type: 'integer',
+                            description: 'The lifetime of an anonymous session, in minutes.',
+                        },
+                        activate_cookie: {
+                            type: 'boolean',
+                            description: 'Whether to activate the anonymous session cookie.',
+                        },
+                    },
+                    // Permissive to match the parent `sessions` object so new Management API
+                    // session fields round-trip through export/import without validation failure.
+                    additionalProperties: true,
+                },
+            },
+            additionalProperties: true,
+        },
     },
 };
 const blockPageKeys = [
@@ -147,6 +194,7 @@ exports.allowedTenantFlags = [
     'require_pushed_authorization_requests',
     'mfa_show_factor_list_on_enrollment',
     'improved_signup_bot_detection_in_classic',
+    'use_scope_descriptions_for_consent',
 ];
 const removeUnallowedTenantFlags = (proposedFlags) => {
     if (proposedFlags === undefined)

package/lib/tools/auth0/handlers/themes.d.ts

@@ -1,5 +1,5 @@
 import { Management } from 'auth0';
-import { Assets } from '../../../types';
+import { Assets, CalculatedChanges } from '../../../types';
 import DefaultHandler from './default';
 /**
  * Schema
@@ -179,6 +179,41 @@ export declare const schema: {
                 pattern: string;
                 type: string;
             };
+            identifiers: {
+                additionalProperties: boolean;
+                description: string;
+                properties: {
+                    login_display: {
+                        description: string;
+                        enum: string[];
+                        type: string;
+                    };
+                    otp_autocomplete: {
+                        description: string;
+                        type: string;
+                    };
+                    phone_display: {
+                        additionalProperties: boolean;
+                        description: string;
+                        properties: {
+                            formatting: {
+                                description: string;
+                                enum: string[];
+                                type: string;
+                            };
+                            masking: {
+                                description: string;
+                                enum: string[];
+                                type: string;
+                            };
+                        };
+                        required: string[];
+                        type: string;
+                    };
+                };
+                required: string[];
+                type: string;
+            };
             fonts: {
                 additionalProperties: boolean;
                 properties: {
@@ -375,6 +410,7 @@ export default class ThemesHandler extends DefaultHandler {
     existing: Theme[] | null;
     constructor(options: DefaultHandler);
     objString(theme: Theme): string;
+    dryRunChanges(assets: Assets): Promise<CalculatedChanges>;
     getType(): Promise<Theme[] | null>;
     processChanges(assets: Assets): Promise<void>;
     deleteThemes(): Promise<void>;

package/lib/tools/auth0/handlers/themes.js

@@ -46,6 +46,7 @@ exports.schema = void 0;
 const logger_1 = __importDefault(require("../../../logger"));
 const default_1 = __importStar(require("./default"));
 const utils_1 = require("../../utils");
+const calculateDryRunChanges_1 = require("../../calculateDryRunChanges");
 /**
  * Schema
  */
@@ -251,6 +252,41 @@ exports.schema = {
                 pattern: '^[^<>]*$',
                 type: 'string',
             },
+            identifiers: {
+                additionalProperties: false,
+                description: 'Identifier display settings on the theme. Requires the `universal_login_theme_identifiers` feature flag to be enabled on the tenant.',
+                properties: {
+                    login_display: {
+                        description: 'Login display mode',
+                        enum: ['separate', 'unified'],
+                        type: 'string',
+                    },
+                    otp_autocomplete: {
+                        description: 'Whether OTP autocomplete is enabled',
+                        type: 'boolean',
+                    },
+                    phone_display: {
+                        additionalProperties: false,
+                        description: 'Phone number display settings',
+                        properties: {
+                            formatting: {
+                                description: 'Phone number formatting style',
+                                enum: ['international', 'regional'],
+                                type: 'string',
+                            },
+                            masking: {
+                                description: 'Phone number masking strategy',
+                                enum: ['hide_country_code', 'mask_digits', 'show_all'],
+                                type: 'string',
+                            },
+                        },
+                        required: ['formatting', 'masking'],
+                        type: 'object',
+                    },
+                },
+                required: ['login_display', 'otp_autocomplete', 'phone_display'],
+                type: 'object',
+            },
             fonts: {
                 additionalProperties: false,
                 properties: {
@@ -470,6 +506,34 @@ class ThemesHandler extends default_1.default {
     objString(theme) {
         return theme.displayName || JSON.stringify(theme);
     }
+    async dryRunChanges(assets) {
+        const { themes } = assets;
+        if (!themes) {
+            return { del: [], create: [], conflicts: [], update: [] };
+        }
+        const existing = await this.getType();
+        // getType() returns null when Universal Login customizations are not enabled
+        // on the tenant (the 400 "no-code not enabled" path in getThemes).
+        if (existing === null) {
+            return { del: [], create: [], conflicts: [], update: [] };
+        }
+        // Themes are singletons — at most one per tenant. If the local theme has no
+        // themeId (stripped during export when --export_ids is not set), backfill it
+        // from the remote so the matcher can find a match without requiring --export_ids.
+        const normalizedThemes = themes.map((theme) => {
+            if (!theme.themeId && existing.length > 0 && existing[0].themeId) {
+                return { ...theme, themeId: existing[0].themeId };
+            }
+            return theme;
+        });
+        return (0, calculateDryRunChanges_1.calculateDryRunChanges)({
+            type: this.type,
+            assets: normalizedThemes,
+            existing,
+            identifiers: this.identifiers,
+            ignoreDryRunFields: this.getEffectiveIgnoreDryRunFields(),
+        });
+    }
     async getType() {
         if (!this.existing) {
             this.existing = await this.getThemes();

package/lib/tools/auth0/handlers/tokenExchangeProfiles.js

@@ -138,7 +138,9 @@ class TokenExchangeProfilesHandler extends default_1.default {
         }
         catch (err) {
             if (err.statusCode === 403) {
-                logger_1.default.warn('Token Exchange Profiles feature is not available on this tenant. Please contact Auth0 support to enable this feature.');
+                logger_1.default.warn(`Cannot retrieve tokenExchangeProfiles: ${err.message}. ` +
+                    `Verify the M2M application has the 'read:token_exchange_profiles' scope and ` +
+                    `your subscription plan includes Token Exchange Profiles.`);
                 return [];
             }
             throw err;

package/lib/tools/auth0/index.js

@@ -11,13 +11,10 @@ const promise_pool_executor_1 = require("promise-pool-executor");
 const client_1 = __importDefault(require("./client"));
 const schema_1 = __importDefault(require("./schema"));
 const handlers_1 = __importDefault(require("./handlers"));
-// Cache the compiled AJV validator to avoid recompiling the schema on every validate() call.
-// Schema compilation is expensive (~5s) due to the complexity of the combined resource schema.
-const ajv = new ajv_1.default({ useDefaults: true, nullable: true });
-const validateSchema = ajv.compile(schema_1.default);
 const calculateDryRunChanges_1 = require("../calculateDryRunChanges");
 const utils_1 = require("../../utils");
 const utils_2 = require("../utils");
+const logger_1 = __importDefault(require("../../logger"));
 /**
  * Sorts handlers by their @order decorator metadata for a given stage.
  * Handlers are sorted in ascending order (lower values execute first).
@@ -109,12 +106,13 @@ class Auth0 {
         }
     }
     async validate() {
+        const ajv = new ajv_1.default({ useDefaults: true, nullable: true });
         const nonNullAssets = Object.keys(this.assets)
             .filter((k) => this.assets[k] != null)
             .reduce((a, k) => ({ ...a, [k]: this.assets[k] }), {});
-        const valid = validateSchema(nonNullAssets);
+        const valid = ajv.validate(schema_1.default, nonNullAssets);
         if (!valid) {
-            throw new Error(`Schema validation failed loading ${JSON.stringify(validateSchema.errors, null, 4)}`);
+            throw new Error(`Schema validation failed loading ${JSON.stringify(ajv.errors, null, 4)}`);
         }
         await this.runStage('validate');
     }
@@ -148,6 +146,14 @@ class Auth0 {
             data: this.handlers,
             generator: (handler) => (async () => {
                 try {
+                    // Every handler in the dry-run loop is expected to implement dryRunChanges.
+                    // Guard against non-conforming handlers (e.g. deploy-only handlers that don't
+                    // extend the base APIHandler) so a missing method skips the handler instead of
+                    // crashing the whole dry run. Logged loudly so an omitted preview is visible.
+                    if (typeof handler.dryRunChanges !== 'function') {
+                        logger_1.default.warn(`Handler "${handler.type}" does not implement dryRunChanges; skipping it in the dry-run preview. Changes for this resource will still be applied during a real import.`);
+                        return;
+                    }
                     const detailedChanges = [];
                     let created = 0;
                     let updated = 0;

package/lib/tools/calculateDryRunChanges.js

@@ -108,6 +108,13 @@ function normalizeArrayValues(values) {
         .map((value) => normalizeValue(value))
         .sort((left, right) => JSON.stringify(left).localeCompare(JSON.stringify(right)));
 }
+/**
+ * Serializes a value to a human-readable string for use in diff messages.
+ * Objects and arrays are JSON-stringified to avoid "[object Object]" output.
+ */
+function formatDiffValue(value) {
+    return typeof value === 'object' && value !== null ? JSON.stringify(value) : String(value);
+}
 /**
  * Writes the accumulated diff log to a JSON file on disk.
  * Useful for CI pipelines that want a machine-readable dry-run report.
@@ -179,7 +186,7 @@ function getObjectDifferences(localObj, remoteObj, keyObjPath = '', resourceType
                         differences.push(...nestedDifferences);
                     }
                     else if (item !== normalizedRemoteValue[index]) {
-                        const message = `Array item difference at [${currentPath}[${index}]]: local:${item} vs remote:${normalizedRemoteValue[index]}`;
+                        const message = `Array item difference at [${currentPath}[${index}]]: local:${formatDiffValue(item)} vs remote:${formatDiffValue(normalizedRemoteValue[index])}`;
                         differences.push(message);
                     }
                 });
@@ -204,13 +211,10 @@ function getObjectDifferences(localObj, remoteObj, keyObjPath = '', resourceType
             differences.push(...nestedDifferences);
             return;
         }
-        // Compare primitive values — omit array indices from path to reduce log noise
+        // Compare primitive values
         if (localValue !== remoteValue) {
-            let arrayPathRegex = new RegExp(/\[\d+\]/g);
-            if (!arrayPathRegex.test(currentPath)) {
-                const message = `Value difference for [${currentPath}]: local:${localValue} vs remote:${remoteValue}`;
-                differences.push(message);
-            }
+            const message = `Value difference for [${currentPath}]: local:${localValue} vs remote:${remoteValue}`;
+            differences.push(message);
         }
     });
     return differences;
@@ -242,7 +246,7 @@ function calculateDryRunChanges({ type, assets, existing, identifiers = ['id', '
     const create = [];
     const conflicts = [];
     const localAssets = (Array.isArray(assets) ? [...assets] : [assets]).map((asset) => type === 'tenant' ? normalizeTenantForDryRun(asset) : asset);
-    const remoteAssets = (Array.isArray(existing) ? [...existing] : [existing]).map((asset) => (type === 'tenant' ? normalizeTenantForDryRun(asset) : asset));
+    const remoteAssets = (Array.isArray(existing) ? [...existing] : existing ? [existing] : []).map((asset) => (type === 'tenant' ? normalizeTenantForDryRun(asset) : asset));
     // Helper: returns true if a local and remote asset share at least one identifier value
     const assetsMatch = (localAsset, remoteAsset) => identifiers.some((id) => {
         if (Array.isArray(id)) {

package/lib/tools/constants.d.ts

@@ -35,6 +35,7 @@ declare const constants: {
     EMAIL_MFA_OOB_CODE: string;
     EMAIL_USER_INVITATION: string;
     EMAIL_ASYNC_APPROVAL: string;
+    EMAIL_AUTH_BY_CODE: string;
     GUARDIAN_DIRECTORY: string;
     GUARDIAN_FACTORS_DIRECTORY: string;
     GUARDIAN_PROVIDERS_DIRECTORY: string;
@@ -86,10 +87,12 @@ declare const constants: {
     FLOWS_VAULT_DIRECTORY: string;
     SELF_SERVICE_PROFILE_DIRECTORY: string;
     NETWORK_ACLS_DIRECTORY: string;
+    NETWORK_ACL_KEYS_DIRECTORY: string;
     USER_ATTRIBUTE_PROFILES_DIRECTORY: string;
     CONNECTION_PROFILES_DIRECTORY: string;
     TOKEN_EXCHANGE_PROFILES_DIRECTORY: string;
     SUPPLEMENTAL_SIGNALS_DIRECTORY: string;
+    RATE_LIMIT_POLICIES_DIRECTORY: string;
     EVENT_STREAMS_DIRECTORY: string;
 };
 export default constants;

package/lib/tools/constants.js

@@ -20,6 +20,7 @@ const EMAIL_PASSWORD_RESET = 'password_reset';
 const EMAIL_MFA_OOB_CODE = 'mfa_oob_code';
 const EMAIL_USER_INVITATION = 'user_invitation';
 const EMAIL_ASYNC_APPROVAL = 'async_approval';
+const EMAIL_AUTH_BY_CODE = 'auth_email_by_code';
 const UNIVERSAL_LOGIN_TEMPLATE = 'universal_login';
 const OBFUSCATED_SECRET_VALUE = '_VALUE_NOT_SHOWN_';
 const constants = {
@@ -56,6 +57,7 @@ const constants = {
         'password_reset',
         'user_invitation',
         'async_approval',
+        'auth_email_by_code',
     ],
     ACTIONS_TRIGGERS: [
         'post-login',
@@ -68,6 +70,7 @@ const constants = {
         'custom-token-exchange',
         'login-post-identifier',
         'signup-post-identifier',
+        'post-credential-validation',
     ],
     EMAIL_TEMPLATES_DIRECTORY: 'emails',
     EMAIL_VERIFY,
@@ -83,6 +86,7 @@ const constants = {
     EMAIL_MFA_OOB_CODE,
     EMAIL_USER_INVITATION,
     EMAIL_ASYNC_APPROVAL,
+    EMAIL_AUTH_BY_CODE,
     GUARDIAN_DIRECTORY: 'guardian',
     GUARDIAN_FACTORS_DIRECTORY: 'factors',
     GUARDIAN_PROVIDERS_DIRECTORY: 'providers',
@@ -180,6 +184,8 @@ const constants = {
         `${EMAIL_USER_INVITATION}.html`,
         `${EMAIL_ASYNC_APPROVAL}.json`,
         `${EMAIL_ASYNC_APPROVAL}.html`,
+        `${EMAIL_AUTH_BY_CODE}.json`,
+        `${EMAIL_AUTH_BY_CODE}.html`,
     ],
     SUPPORTED_BRANDING_TEMPLATES: [UNIVERSAL_LOGIN_TEMPLATE],
     LOG_STREAMS_DIRECTORY: 'log-streams',
@@ -216,10 +222,12 @@ const constants = {
     FLOWS_VAULT_DIRECTORY: 'flow-vault-connections',
     SELF_SERVICE_PROFILE_DIRECTORY: 'self-service-profiles',
     NETWORK_ACLS_DIRECTORY: 'network-acls',
+    NETWORK_ACL_KEYS_DIRECTORY: 'network-acl-keys',
     USER_ATTRIBUTE_PROFILES_DIRECTORY: 'user-attribute-profiles',
     CONNECTION_PROFILES_DIRECTORY: 'connection-profiles',
     TOKEN_EXCHANGE_PROFILES_DIRECTORY: 'token-exchange-profiles',
     SUPPLEMENTAL_SIGNALS_DIRECTORY: 'supplemental-signals',
+    RATE_LIMIT_POLICIES_DIRECTORY: 'rate-limit-policies',
     EVENT_STREAMS_DIRECTORY: 'event-streams',
 };
 exports.default = constants;