feat: add Network ACL Keys, 3P client access, and XAA connection profile support

[fern-api]

Summary

Automated SDK regeneration adding support for Network ACL Keys management, Third-Party (3P) Client Access configuration for Organizations, and Cross-App Access (XAA) resource app configuration for Connection Profiles.

Changes

Network ACL Keys

• Add new keys.networkAcls sub-resource: list, create, get
  • GET /keys/network-acls - retrieve all keys, ordered by creation time descending
  • POST /keys/network-acls - create a new key
  • GET /keys/network-acls/{id} - retrieve a specific key
• Add NetworkAclKey, NetworkAclKeyAlgorithmEnum types (currently only hmac-sha256 supported)
• Add read:network_acl_keys and create:network_acl_keys OAuth scopes
• Add match_all?: boolean to NetworkAclRule - when true, unconditionally matches all traffic regardless of other signals; mutually exclusive with match and not_match

Third-Party (3P) Client Access - Organizations (EA)

• Add my_organization_configuration.third_party_client_access to POST/GET/PATCH /api/v2/clients requests and responses
• Shape: { default_value: "block", allowed_values: ("block" | "allow")[] }

Cross-App Access (XAA) - Connection Profiles (EA)

• Add cross_app_access_resource_app to POST/GET/PATCH /api/v2/connection-profiles requests and responses
• Shape: { status: { default_value: "enabled" | "disabled", allowed_values: ("enabled" | "disabled")[] } }

Connection Options

• Add useOauthSpecScope?: boolean to OIDC connection options - uses space-delimited scopes per OAuth 2.0 spec instead of comma-delimited when calling the IdP's authorization endpoint

Error Handling Improvements

• Add ConflictError (409) handling to flows.delete()
• Add BadRequestError (400) handling to flows.update() and forms.update()

Documentation Fixes

• Fix custom_login_page_off → custom_login_page_on in JSDoc for clients.create() and clients.update() - the field was never custom_login_page_off, corrected to the actual Auth0 API field name
• Clarify connections.update() docs: "If any options are unspecified, the default will be used, even if it differs from the existing value"

Type Corrections

Fields on tokens, sessions, custom domains, forms, and self-service profiles that were typed as T | undefined are now correctly typed as (T | null) | undefined to accurately reflect what the API already returns at runtime. No runtime behavior change.

Affected types:

• GetRefreshTokenResponseContent, RefreshTokenResponseContent, UpdateRefreshTokenResponseContent - created_at, idle_expires_at, expires_at, last_exchanged_at
• GetSessionResponseContent, SessionResponseContent, UpdateSessionResponseContent - created_at, updated_at, authenticated_at, idle_expires_at, expires_at, last_interacted_at
• SessionAuthenticationSignal - timestamp
• UpdateFormRequestContent - messages, languages, translations, nodes, start, ending, style
• CreateCustomDomainRequestContent / UpdateCustomDomainRequestContent — custom_client_ip_header
• UpdateSelfServiceProfileRequestContent - branding
• UpdateUserAttributeProfileRequestContent - user_id
• FlowActionFlowMapValueParams - fallback

Testing

• Wire tests added for keys/networkAcls (365 lines) and flows/executions (38 lines)
• Updated wire tests for flows, forms, and networkAcls with new error case coverage
• This change adds unit test coverage

Checklist

• I have read the Auth0 general contribution guidelines
• I have read the Auth0 Code of Conduct

[codecov]

Codecov Report

❌ Patch coverage is 90.97744% with 12 lines in your changes missing coverage. Please review.
✅ Project coverage is 89.73%. Comparing base (4fcb39a) to head (f393756).

Files with missing lines	Patch %	Lines
...ources/keys/resources/networkAcls/client/Client.ts	88.99%	12 Missing ⚠️

Additional details and impacted files

@@           Coverage Diff            @@
##           master    #1391    +/-   ##
========================================
  Coverage   89.72%   89.73%            
========================================
  Files         439      441     +2     
  Lines       20668    20799   +131     
  Branches     9742     9809    +67     
========================================
+ Hits        18544    18663   +119     
- Misses       2124     2136    +12     

Flag	Coverage Δ
alltests	89.73% <90.97%> (+<0.01%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
.../management/api/resources/clients/client/Client.ts	88.85% <ø> (ø)
...agement/api/resources/connections/client/Client.ts	89.11% <ø> (ø)
...rc/management/api/resources/flows/client/Client.ts	89.15% <100.00%> (+0.20%)	⬆️
...ources/flows/resources/executions/client/Client.ts	89.60% <100.00%> (+0.34%)	⬆️
...rc/management/api/resources/forms/client/Client.ts	88.44% <100.00%> (+0.23%)	⬆️
src/management/api/resources/keys/client/Client.ts	100.00% <100.00%> (ø)
...c/management/api/resources/keys/resources/index.ts	100.00% <100.00%> (ø)
.../api/resources/keys/resources/networkAcls/index.ts	100.00% <100.00%> (ø)
src/management/api/types/types.ts	100.00% <100.00%> (ø)
...ources/keys/resources/networkAcls/client/Client.ts	88.99% <88.99%> (ø)

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.