auth0-deploy-cli 9.0.0-beta.2 → 9.1.0

package/lib/tools/auth0/handlers/databases.js

@@ -181,6 +181,25 @@ exports.schema = {
                             action_id: { type: 'string' },
                         },
                     },
+                    otp_settings: {
+                        type: 'object',
+                        properties: {
+                            email: {
+                                type: 'object',
+                                properties: {
+                                    otp_length: { type: 'integer' },
+                                    otp_expiry: { type: 'integer' },
+                                },
+                            },
+                            phone: {
+                                type: 'object',
+                                properties: {
+                                    otp_length: { type: 'integer' },
+                                    otp_expiry: { type: 'integer' },
+                                },
+                            },
+                        },
+                    },
                     password_options: {
                         type: 'object',
                         properties: {
@@ -419,6 +438,22 @@ class DatabaseHandler extends default_1.default {
         }
         return this.client.connections[fn].bind(this.client.connections);
     }
+    // `enabled_clients` is no longer returned by connections.list; it must be fetched from the
+    // dedicated enabled-clients endpoint. Enriching the remote connections keeps the diff and the
+    // excluded-client preservation in `getEnabledClients` correct. Without it the dry-run diff
+    // reports a false "found in localObj but not in remoteObj" and a real import can silently
+    // disable an excluded-but-enabled client.
+    async enrichConnectionsWithEnabledClients(connections) {
+        return Promise.all(connections.map(async (con) => {
+            if (!con?.id)
+                return con;
+            const enabledClients = await (0, connections_1.getConnectionEnabledClients)(this.client, con.id);
+            if (enabledClients?.length) {
+                return { ...con, enabled_clients: enabledClients };
+            }
+            return con;
+        }));
+    }
     async getType() {
         if (this.existing)
             return this.existing;
@@ -433,16 +468,7 @@ class DatabaseHandler extends default_1.default {
                 include_totals: true,
             }),
         ]);
-        const dbConnectionsWithEnabledClients = await Promise.all(connections.map(async (con) => {
-            if (!con?.id)
-                return con;
-            const enabledClients = await (0, connections_1.getConnectionEnabledClients)(this.client, con.id);
-            const connection = { ...con };
-            if (enabledClients && enabledClients?.length) {
-                connection.enabled_clients = enabledClients;
-            }
-            return connection;
-        }));
+        const dbConnectionsWithEnabledClients = await this.enrichConnectionsWithEnabledClients(connections);
         // Convert action ID back to action name for export
         const dbConnectionsWithActionNames = dbConnectionsWithEnabledClients.map((connection) => {
             if (connection.options && 'custom_password_hash' in connection.options) {
@@ -462,12 +488,21 @@ class DatabaseHandler extends default_1.default {
             }
             return connection;
         });
+        // A connection can return both legacy password fields and `password_options` on read, but
+        // they're mutually exclusive on write. Strip the legacy fields to keep the export deployable.
+        const dbConnectionsNormalized = dbConnectionsWithActionNames.map((connection) => {
+            if (connection.options && 'password_options' in connection.options) {
+                const { passwordPolicy, password_complexity_options, password_history, password_no_personal_info, password_dictionary, ...options } = connection.options;
+                return { ...connection, options };
+            }
+            return connection;
+        });
         // If options option is empty for all connection, log the missing options scope.
-        const isOptionExists = dbConnectionsWithActionNames.every((c) => c.options && Object.keys(c.options).length > 0);
+        const isOptionExists = dbConnectionsNormalized.every((c) => c.options && Object.keys(c.options).length > 0);
         if (!isOptionExists) {
             logger_1.default.warn(`Insufficient scope the read:connections_options scope is required to get ${this.type} options.`);
         }
-        this.existing = dbConnectionsWithActionNames;
+        this.existing = dbConnectionsNormalized;
         return this.existing;
     }
     async calcChanges(assets) {
@@ -480,28 +515,26 @@ class DatabaseHandler extends default_1.default {
                 update: [],
                 conflicts: [],
             };
-        // Convert enabled_clients by name to the id
-        // Fetch clients, connections, and actions concurrently
-        const [clients, existingDatabasesConnections, actions] = await Promise.all([
+        // Convert enabled_clients by name to the id. `getType()` fetches and enriches the existing
+        // connections with `enabled_clients` and caches the result in `this.existing`, so the
+        // `super.calcChanges()` call below reuses it instead of fetching again.
+        const [clients, actions, existingWithEnabledClients] = await Promise.all([
             (0, client_1.paginate)(this.client.clients.list, {
                 paginate: true,
             }),
-            (0, client_1.paginate)(this.client.connections.list, {
-                strategy: [auth0_1.Management.ConnectionStrategyEnum.Auth0],
-                checkpoint: true,
-                include_totals: true,
-            }),
             (0, client_1.paginate)(this.client.actions.list, {
                 paginate: true,
                 include_totals: true,
             }),
+            this.getType(),
         ]);
+        const existingConnections = existingWithEnabledClients || [];
         const formatted = databases.map((db) => {
             const { options, ...rest } = db;
             const formattedOptions = this.getFormattedOptions(options, actions);
             const formattedDb = { ...rest, options: formattedOptions };
             if (db.enabled_clients) {
-                formattedDb.enabled_clients = (0, utils_1.getEnabledClients)(assets, db, existingDatabasesConnections, clients);
+                formattedDb.enabled_clients = (0, utils_1.getEnabledClients)(assets, db, existingConnections, clients);
             }
             return formattedDb;
         });
@@ -531,21 +564,22 @@ class DatabaseHandler extends default_1.default {
                 include_totals: true,
             }),
         ]);
+        const existingWithEnabledClients = await this.enrichConnectionsWithEnabledClients(existingDatabasesConnections);
         const formatted = databases.map((db) => {
             const { options, ...rest } = db;
             const formattedOptions = this.getFormattedOptions(options, actions);
             const formattedDb = { ...rest, options: formattedOptions };
             if (db.enabled_clients) {
-                formattedDb.enabled_clients = (0, utils_1.getEnabledClients)(assets, db, existingDatabasesConnections, clients);
+                formattedDb.enabled_clients = (0, utils_1.getEnabledClients)(assets, db, existingWithEnabledClients, clients);
             }
             return formattedDb;
         });
         return (0, calculateDryRunChanges_1.calculateDryRunChanges)({
             type: this.type,
             assets: formatted,
-            existing: existingDatabasesConnections,
+            existing: existingWithEnabledClients,
             identifiers: this.identifiers,
-            ignoreDryRunFields: this.ignoreDryRunFields,
+            ignoreDryRunFields: this.getEffectiveIgnoreDryRunFields(),
         });
     }
     // Run after clients are updated so we can convert all the enabled_clients names to id's

package/lib/tools/auth0/handlers/default.d.ts

@@ -1,6 +1,20 @@
 import { Asset, Assets, Auth0APIClient, CalculatedChanges } from '../../../types';
 import { ConfigFunction } from '../../../configFactory';
 export declare function order(value: any): (t: any, n: any, descriptor: any) => any;
+export interface RetryOptions {
+    maxRetries?: number;
+    initialDelay?: number;
+    maxDelay?: number;
+    onRetry?: (error: any, attempt: number, delay: number) => void;
+}
+/**
+ * Executes a function with exponential backoff retry logic for rate limit errors (429).
+ *
+ * @param fn - The function to execute with retry logic
+ * @param options - Configuration options for retry behavior
+ * @returns Promise that resolves with the function result or rejects after max retries
+ */
+export declare function retryWithExponentialBackoff<T>(fn: () => Promise<T>, options?: RetryOptions): Promise<T>;
 type ApiMethodOverride = string | Function;
 export default class APIHandler {
     config: ConfigFunction;
@@ -50,6 +64,15 @@ export default class APIHandler {
      */
     getEffectiveIgnoreDryRunFields(): string[];
     getClientFN(fn: ApiMethodOverride): Function;
+    /**
+     * Builds the exponential-backoff retry configuration for this handler from the
+     * shared `AUTH0_MAX_RETRIES` / `AUTH0_RETRY_INITIAL_DELAY_MS` /
+     * `AUTH0_RETRY_MAX_DELAY_MS` config keys. Exposed so that handlers which issue
+     * writes outside the default `processChanges` flow (e.g. organizations, which
+     * writes nested connections/grants directly) can wrap those calls in the same
+     * 429 backoff behaviour as the base handler.
+     */
+    getRetryConfig(): RetryOptions;
     didDelete(item: Asset): void;
     didCreate(item: Asset): void;
     didUpdate(item: Asset): void;

package/lib/tools/auth0/handlers/default.js

@@ -4,7 +4,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.order = order;
-const auth0_1 = require("auth0");
+exports.retryWithExponentialBackoff = retryWithExponentialBackoff;
 const validationError_1 = __importDefault(require("../../validationError"));
 const utils_1 = require("../../utils");
 const logger_1 = __importDefault(require("../../../logger"));
@@ -20,6 +20,19 @@ function order(value) {
         return descriptor;
     };
 }
+/**
+ * node-auth0 v7 removed the exported `JSONApiResponse` class, so we can no
+ * longer use `instanceof` to tell an SDK response envelope apart from a plain
+ * asset. Duck-type the `ApiResponse<T>` shape ({ data, status, headers })
+ * instead.
+ */
+function isApiResponseEnvelope(item) {
+    return (typeof item === 'object' &&
+        item !== null &&
+        'data' in item &&
+        'status' in item &&
+        'headers' in item);
+}
 // Retry configuration constants
 const DEFAULT_MAX_RETRIES = 3;
 const DEFAULT_INITIAL_DELAY_MS = 1000; // 1 second
@@ -114,24 +127,35 @@ class APIHandler {
         }
         return fn;
     }
+    /**
+     * Builds the exponential-backoff retry configuration for this handler from the
+     * shared `AUTH0_MAX_RETRIES` / `AUTH0_RETRY_INITIAL_DELAY_MS` /
+     * `AUTH0_RETRY_MAX_DELAY_MS` config keys. Exposed so that handlers which issue
+     * writes outside the default `processChanges` flow (e.g. organizations, which
+     * writes nested connections/grants directly) can wrap those calls in the same
+     * 429 backoff behaviour as the base handler.
+     */
+    getRetryConfig() {
+        const retryConfig = {
+            maxRetries: this.config('AUTH0_MAX_RETRIES') || DEFAULT_MAX_RETRIES,
+            initialDelay: this.config('AUTH0_RETRY_INITIAL_DELAY_MS') || DEFAULT_INITIAL_DELAY_MS,
+            maxDelay: this.config('AUTH0_RETRY_MAX_DELAY_MS') || DEFAULT_MAX_DELAY_MS,
+            onRetry: (error, attempt, delay) => {
+                logger_1.default.warn(`Rate limit hit for [${this.type}]. Retrying attempt ${attempt}/${retryConfig.maxRetries} after ${Math.round(delay / 1000)}s...`);
+            },
+        };
+        return retryConfig;
+    }
     didDelete(item) {
         logger_1.default.info(`Deleted [${this.type}]: ${this.objString(item)}`);
     }
     didCreate(item) {
-        if (typeof item === 'object' && item instanceof auth0_1.JSONApiResponse) {
-            logger_1.default.info(`Created [${this.type}]: ${this.objString(item?.data)}`);
-        }
-        else {
-            logger_1.default.info(`Created [${this.type}]: ${this.objString(item)}`);
-        }
+        const payload = isApiResponseEnvelope(item) ? item.data : item;
+        logger_1.default.info(`Created [${this.type}]: ${this.objString(payload)}`);
     }
     didUpdate(item) {
-        if (typeof item === 'object' && item instanceof auth0_1.JSONApiResponse) {
-            logger_1.default.info(`Updated [${this.type}]: ${this.objString(item?.data)}`);
-        }
-        else {
-            logger_1.default.info(`Updated [${this.type}]: ${this.objString(item)}`);
-        }
+        const payload = isApiResponseEnvelope(item) ? item.data : item;
+        logger_1.default.info(`Updated [${this.type}]: ${this.objString(payload)}`);
     }
     objString(item) {
         return (0, utils_1.convertJsonToString)(item);
@@ -168,6 +192,9 @@ class APIHandler {
             this.type === 'branding' ||
             this.type === 'emailProvider' ||
             this.type === 'guardianPhoneFactorSelectedProvider' ||
+            this.type === 'guardianPhoneFactorSettings' ||
+            this.type === 'guardianEmailFactorSettings' ||
+            this.type === 'guardianSettings' ||
             this.type === 'guardianPolicies' ||
             this.type === 'riskAssessment') {
             return `${this.type} settings`;
@@ -210,7 +237,6 @@ class APIHandler {
             return (0, calculateDryRunChanges_1.calculateDryRunChanges)({
                 type: this.type,
                 assets: typeAssets,
-                // @ts-ignore TODO: investigate what happens when `existing` is null
                 existing,
                 identifiers: this.identifiers,
                 ignoreDryRunFields: this.getEffectiveIgnoreDryRunFields(),
@@ -243,7 +269,6 @@ class APIHandler {
         return (0, calculateDryRunChanges_1.calculateDryRunChanges)({
             type: this.type,
             assets: typeAssets,
-            // @ts-ignore TODO: investigate what happens when `existing` is null
             existing,
             identifiers: this.identifiers,
             ignoreDryRunFields: this.getEffectiveIgnoreDryRunFields(),
@@ -282,14 +307,7 @@ class APIHandler {
         const conflicts = changes.conflicts || [];
         logger_1.default.debug(`Start processChanges for ${this.type} [delete:${del.length}] [update:${update.length}], [create:${create.length}], [conflicts:${conflicts.length}]`);
         // Set retry configuration from config
-        const retryConfig = {
-            maxRetries: this.config('AUTH0_MAX_RETRIES') || DEFAULT_MAX_RETRIES,
-            initialDelay: this.config('AUTH0_RETRY_INITIAL_DELAY_MS') || DEFAULT_INITIAL_DELAY_MS,
-            maxDelay: this.config('AUTH0_RETRY_MAX_DELAY_MS') || DEFAULT_MAX_DELAY_MS,
-            onRetry: (error, attempt, delay) => {
-                logger_1.default.warn(`Rate limit hit for [${this.type}]. Retrying attempt ${attempt}/${retryConfig.maxRetries} after ${Math.round(delay / 1000)}s...`);
-            },
-        };
+        const retryConfig = this.getRetryConfig();
         // Process Deleted
         if (del.length > 0) {
             const allowDelete = this.config('AUTH0_ALLOW_DELETE') === 'true' || this.config('AUTH0_ALLOW_DELETE') === true;
@@ -328,8 +346,8 @@ class APIHandler {
                 const updateFN = this.getClientFN(this.functions.update);
                 const updatePayload = (() => {
                     const data = (0, utils_1.stripFields)({ ...updateItem }, this.stripUpdateFields);
-                    const stripped = (0, utils_1.stripObfuscatedFieldsFromPayload)(data, this.sensitiveFieldsToObfuscate);
-                    return (0, utils_1.validateNoUnresolvedPlaceholders)(stripped, this.type, this.objString(updateItem));
+                    const obfuscatedStripped = (0, utils_1.stripObfuscatedFieldsFromPayload)(data, this.sensitiveFieldsToObfuscate);
+                    return (0, utils_1.stripUnresolvedPlaceholders)(obfuscatedStripped, this.type, this.objString(updateItem));
                 })();
                 return updateFN(updateItem[this.id], updatePayload);
             }, retryConfig)
@@ -347,8 +365,8 @@ class APIHandler {
                 const createFunction = this.getClientFN(this.functions.create);
                 const createPayload = (() => {
                     const strippedPayload = (0, utils_1.stripFields)(createItem, this.stripCreateFields);
-                    const stripped = (0, utils_1.stripObfuscatedFieldsFromPayload)(strippedPayload, this.sensitiveFieldsToObfuscate);
-                    return (0, utils_1.validateNoUnresolvedPlaceholders)(stripped, this.type, this.objString(createItem));
+                    const obfuscatedStripped = (0, utils_1.stripObfuscatedFieldsFromPayload)(strippedPayload, this.sensitiveFieldsToObfuscate);
+                    return (0, utils_1.stripUnresolvedPlaceholders)(obfuscatedStripped, this.type, this.objString(createItem));
                 })();
                 return createFunction(createPayload);
             }, retryConfig)
@@ -369,8 +387,8 @@ class APIHandler {
                 const updateFN = this.getClientFN(this.functions.update);
                 const updatePayload = (() => {
                     const data = (0, utils_1.stripFields)({ ...updateItem }, this.stripUpdateFields);
-                    const stripped = (0, utils_1.stripObfuscatedFieldsFromPayload)(data, this.sensitiveFieldsToObfuscate);
-                    return (0, utils_1.validateNoUnresolvedPlaceholders)(stripped, this.type, this.objString(updateItem));
+                    const obfuscatedStripped = (0, utils_1.stripObfuscatedFieldsFromPayload)(data, this.sensitiveFieldsToObfuscate);
+                    return (0, utils_1.stripUnresolvedPlaceholders)(obfuscatedStripped, this.type, this.objString(updateItem));
                 })();
                 return updateFN(updateItem[this.id], updatePayload);
             }, retryConfig)

package/lib/tools/auth0/handlers/eventStreams.js

@@ -38,10 +38,14 @@ var __importStar = (this && this.__importStar) || (function () {
         return result;
     };
 })();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.schema = void 0;
 const default_1 = __importStar(require("./default"));
 const client_1 = require("../client");
+const logger_1 = __importDefault(require("../../../logger"));
 exports.schema = {
     type: 'array',
     items: {
@@ -161,8 +165,12 @@ class EventStreamsHandler extends default_1.default {
             create: changesResponse.create.map((stream) => this.resolveActionId(stream)),
             update: changesResponse.update.map((stream) => {
                 const resolved = this.resolveActionId(stream);
-                // EventBridge destinations cannot be patched — the API rejects destination on PATCH
-                if (resolved.destination?.type === 'eventbridge') {
+                // A destination's type cannot be changed once an event stream is created. The API
+                // rejects the destination on PATCH for eventbridge and action streams, so strip it
+                // from the update payload and only apply the other mutable fields.
+                if (resolved.destination?.type === 'eventbridge' ||
+                    resolved.destination?.type === 'action') {
+                    logger_1.default.info(`Skipping destination update for event stream "${resolved.name}": ${resolved.destination.type} destinations cannot be changed after creation.`);
                     const { destination: _dest, ...rest } = resolved;
                     return rest;
                 }

package/lib/tools/auth0/handlers/guardianEmailFactorSettings.d.ts

@@ -0,0 +1,22 @@
+import DefaultHandler from './default';
+import { Asset, Assets } from '../../../types';
+export declare const schema: {
+    type: string;
+    properties: {
+        otp_length: {
+            type: string;
+            description: string;
+        };
+        otp_expiration_time: {
+            type: string;
+            description: string;
+        };
+    };
+    additionalProperties: boolean;
+};
+export default class GuardianEmailFactorSettingsHandler extends DefaultHandler {
+    existing: Asset;
+    constructor(options: any);
+    getType(): Promise<Asset | null>;
+    processChanges(assets: Assets): Promise<void>;
+}

package/lib/tools/auth0/handlers/guardianEmailFactorSettings.js

@@ -0,0 +1,77 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.schema = void 0;
+const default_1 = __importDefault(require("./default"));
+const utils_1 = require("../../utils");
+exports.schema = {
+    type: 'object',
+    properties: {
+        otp_length: {
+            type: 'number',
+            description: 'The length of the OTP code.',
+        },
+        otp_expiration_time: {
+            type: 'number',
+            description: 'The OTP expiration time in seconds.',
+        },
+    },
+    additionalProperties: false,
+};
+class GuardianEmailFactorSettingsHandler extends default_1.default {
+    constructor(options) {
+        super({
+            ...options,
+            type: 'guardianEmailFactorSettings',
+        });
+    }
+    async getType() {
+        if (this.existing)
+            return this.existing;
+        try {
+            const data = await this.client.guardian.factors.email.get();
+            this.existing = data;
+        }
+        catch (err) {
+            if ((0, utils_1.isFeatureUnavailableError)(err)) {
+                // Gracefully skip processing this configuration value.
+                return null;
+            }
+            if ((0, utils_1.isForbiddenFeatureError)(err, this.type)) {
+                return null;
+            }
+            throw err;
+        }
+        return this.existing;
+    }
+    async processChanges(assets) {
+        // No API to delete or create guardianEmailFactorSettings, we can only update.
+        const { guardianEmailFactorSettings } = assets;
+        // Do nothing if not set
+        if (!guardianEmailFactorSettings) {
+            return;
+        }
+        if ((0, utils_1.isDryRun)(this.config)) {
+            const { del, update, create } = await this.calcChanges(assets);
+            if (create.length === 0 && update.length === 0 && del.length === 0) {
+                return;
+            }
+        }
+        try {
+            await this.client.guardian.factors.email.set(guardianEmailFactorSettings);
+        }
+        catch (err) {
+            if ((0, utils_1.isFeatureUnavailableError)(err) || (0, utils_1.isForbiddenFeatureError)(err, this.type)) {
+                // Feature is unavailable (404) or disabled (403) on this tenant; skip instead of failing
+                // the import. The 403 path logs a warning via isForbiddenFeatureError; the 404 path is silent.
+                return;
+            }
+            throw err;
+        }
+        this.updated += 1;
+        this.didUpdate(guardianEmailFactorSettings);
+    }
+}
+exports.default = GuardianEmailFactorSettingsHandler;

package/lib/tools/auth0/handlers/guardianFactorTemplates.js

@@ -60,11 +60,20 @@ class GuardianFactorTemplatesHandler extends default_1.default {
         await Promise.all(guardianFactorTemplates.map(async (fatorTemplates) => {
             const { name, ...data } = fatorTemplates;
             const params = { name: fatorTemplates.name };
-            if (name === 'sms') {
-                await this.client.guardian.factors.sms.setTemplates(data);
+            try {
+                if (name === 'sms') {
+                    await this.client.guardian.factors.sms.setTemplates(data);
+                }
+                else if (name === 'phone') {
+                    await this.client.guardian.factors.phone.setTemplates(data);
+                }
             }
-            else if (name === 'phone') {
-                await this.client.guardian.factors.phone.setTemplates(data);
+            catch (err) {
+                if ((0, utils_1.isForbiddenFeatureError)(err, this.type)) {
+                    // Feature is deprecated/disabled on this tenant; warn and skip instead of failing the import.
+                    return;
+                }
+                throw err;
             }
             this.didUpdate(params);
             this.updated += 1;

package/lib/tools/auth0/handlers/guardianPhoneFactorMessageTypes.js

@@ -25,14 +25,7 @@ const isFeatureUnavailableError = (err) => {
         // Older Management API version where the endpoint is not available.
         return true;
     }
-    if (err.statusCode === 403 &&
-        err.originalError &&
-        err.originalError.response &&
-        err.originalError.response.body &&
-        err.originalError.response.body.errorCode === 'voice_mfa_not_allowed') {
-        // Recent Management API version, but with feature explicitly disabled.
-        return true;
-    }
+    // 403s (feature explicitly disabled) are handled by isForbiddenFeatureError.
     return false;
 };
 class GuardianPhoneMessageTypesHandler extends default_1.default {
@@ -75,7 +68,16 @@ class GuardianPhoneMessageTypesHandler extends default_1.default {
             }
         }
         const data = guardianPhoneFactorMessageTypes;
-        await this.client.guardian.factors.phone.setMessageTypes(data);
+        try {
+            await this.client.guardian.factors.phone.setMessageTypes(data);
+        }
+        catch (err) {
+            if (isFeatureUnavailableError(err) || (0, utils_1.isForbiddenFeatureError)(err, this.type)) {
+                // Feature is deprecated/disabled on this tenant; warn and skip instead of failing the import.
+                return;
+            }
+            throw err;
+        }
         this.updated += 1;
         this.didUpdate(guardianPhoneFactorMessageTypes);
     }

package/lib/tools/auth0/handlers/guardianPhoneFactorSelectedProvider.js

@@ -22,14 +22,7 @@ const isFeatureUnavailableError = (err) => {
         // Older Management API version where the endpoint is not available.
         return true;
     }
-    if (err.statusCode === 403 &&
-        err.originalError &&
-        err.originalError.response &&
-        err.originalError.response.body &&
-        err.originalError.response.body.errorCode === 'hooks_not_allowed') {
-        // Recent Management API version, but with feature explicitly disabled.
-        return true;
-    }
+    // 403s (feature explicitly disabled) are handled by isForbiddenFeatureError.
     return false;
 };
 class GuardianPhoneSelectedProviderHandler extends default_1.default {
@@ -72,7 +65,16 @@ class GuardianPhoneSelectedProviderHandler extends default_1.default {
             }
         }
         const data = guardianPhoneFactorSelectedProvider;
-        await this.client.guardian.factors.phone.setProvider(data);
+        try {
+            await this.client.guardian.factors.phone.setProvider(data);
+        }
+        catch (err) {
+            if (isFeatureUnavailableError(err) || (0, utils_1.isForbiddenFeatureError)(err, this.type)) {
+                // Feature is deprecated/disabled on this tenant; warn and skip instead of failing the import.
+                return;
+            }
+            throw err;
+        }
         this.updated += 1;
         this.didUpdate(guardianPhoneFactorSelectedProvider);
     }

package/lib/tools/auth0/handlers/guardianPhoneFactorSettings.d.ts

@@ -0,0 +1,22 @@
+import DefaultHandler from './default';
+import { Asset, Assets } from '../../../types';
+export declare const schema: {
+    type: string;
+    properties: {
+        otp_length: {
+            type: string;
+            description: string;
+        };
+        otp_expiration_time: {
+            type: string;
+            description: string;
+        };
+    };
+    additionalProperties: boolean;
+};
+export default class GuardianPhoneFactorSettingsHandler extends DefaultHandler {
+    existing: Asset;
+    constructor(options: any);
+    getType(): Promise<Asset | null>;
+    processChanges(assets: Assets): Promise<void>;
+}

package/lib/tools/auth0/handlers/guardianPhoneFactorSettings.js

@@ -0,0 +1,77 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.schema = void 0;
+const default_1 = __importDefault(require("./default"));
+const utils_1 = require("../../utils");
+exports.schema = {
+    type: 'object',
+    properties: {
+        otp_length: {
+            type: 'number',
+            description: 'The length of the OTP code.',
+        },
+        otp_expiration_time: {
+            type: 'number',
+            description: 'The OTP expiration time in seconds.',
+        },
+    },
+    additionalProperties: false,
+};
+class GuardianPhoneFactorSettingsHandler extends default_1.default {
+    constructor(options) {
+        super({
+            ...options,
+            type: 'guardianPhoneFactorSettings',
+        });
+    }
+    async getType() {
+        if (this.existing)
+            return this.existing;
+        try {
+            const data = await this.client.guardian.factors.phone.get();
+            this.existing = data;
+        }
+        catch (err) {
+            if ((0, utils_1.isFeatureUnavailableError)(err)) {
+                // Gracefully skip processing this configuration value.
+                return null;
+            }
+            if ((0, utils_1.isForbiddenFeatureError)(err, this.type)) {
+                return null;
+            }
+            throw err;
+        }
+        return this.existing;
+    }
+    async processChanges(assets) {
+        // No API to delete or create guardianPhoneFactorSettings, we can only update.
+        const { guardianPhoneFactorSettings } = assets;
+        // Do nothing if not set
+        if (!guardianPhoneFactorSettings) {
+            return;
+        }
+        if ((0, utils_1.isDryRun)(this.config)) {
+            const { del, update, create } = await this.calcChanges(assets);
+            if (create.length === 0 && update.length === 0 && del.length === 0) {
+                return;
+            }
+        }
+        try {
+            await this.client.guardian.factors.phone.set(guardianPhoneFactorSettings);
+        }
+        catch (err) {
+            if ((0, utils_1.isFeatureUnavailableError)(err) || (0, utils_1.isForbiddenFeatureError)(err, this.type)) {
+                // Feature is unavailable (404) or disabled (403) on this tenant; skip instead of failing
+                // the import. The 403 path logs a warning via isForbiddenFeatureError; the 404 path is silent.
+                return;
+            }
+            throw err;
+        }
+        this.updated += 1;
+        this.didUpdate(guardianPhoneFactorSettings);
+    }
+}
+exports.default = GuardianPhoneFactorSettingsHandler;