auth0-deploy-cli 8.38.0 → 8.40.0

package/lib/tools/auth0/handlers/clientAuthCredentials.js

@@ -0,0 +1,216 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.schema = void 0;
+const default_1 = require("./default");
+const client_1 = require("../client");
+const logger_1 = __importDefault(require("../../../logger"));
+exports.schema = {
+    type: 'array',
+    items: { type: 'object' },
+};
+const CREDENTIAL_TYPE_TO_METHOD = {
+    public_key: 'private_key_jwt',
+    x509_cert: 'self_signed_tls_client_auth',
+    cert_subject_dn: 'tls_client_auth',
+};
+class ClientAuthCredentialsHandler {
+    constructor({ client, config }) {
+        this.type = 'clientAuthCredentials';
+        this.existing = null;
+        this.client = client;
+        this.config = config;
+    }
+    async getType() {
+        return null;
+    }
+    async load() {
+        logger_1.default.info(`Retrieving ${this.type} data from Auth0`);
+        return { [this.type]: null };
+    }
+    async validate() {
+        return null;
+    }
+    async processChanges(assets) {
+        const { clients } = assets;
+        if (!clients)
+            return;
+        const allowDelete = this.config('AUTH0_ALLOW_DELETE') === true || this.config('AUTH0_ALLOW_DELETE') === 'true';
+        // Only process clients that have client_authentication_methods in config.
+        // Full deletion (absent field) is handled by ClientAuthCredentialsPreHandler at order 40,
+        // before clients.ts runs. This handler only manages create and partial delete.
+        const clientsWithCam = clients.filter((c) => c.client_authentication_methods !== undefined);
+        if (clientsWithCam.length === 0)
+            return;
+        // In directory mode client_id is stripped. Resolve names for PKI clients only.
+        const needsNameResolution = clientsWithCam.some((c) => !c.client_id);
+        let clientIdByName = new Map();
+        if (needsNameResolution) {
+            const existingClients = await (0, client_1.paginate)(this.client.clients.list, {
+                paginate: true,
+                is_global: false,
+            });
+            clientIdByName = new Map(existingClients.map((c) => [c.name, c.client_id]));
+        }
+        for (const client of clientsWithCam) {
+            const clientId = client.client_id || (client.name && clientIdByName.get(client.name));
+            if (!clientId)
+                continue;
+            client.client_id = clientId;
+            const clientName = client.name || clientId;
+            // Collect all desired credentials across all auth methods (only pem-bearing entries)
+            const desired = [];
+            if (client.client_authentication_methods) {
+                for (const [methodKey, methodVal] of Object.entries(client.client_authentication_methods)) {
+                    const credentials = methodVal?.credentials || [];
+                    for (const cred of credentials) {
+                        if (!cred.pem)
+                            continue;
+                        desired.push({
+                            name: cred.name,
+                            pem: cred.pem,
+                            credential_type: cred.credential_type || this.inferCredentialType(methodKey),
+                            method: methodKey,
+                        });
+                    }
+                }
+            }
+            // pem is the opt-in signal: present field with no pem = skip (safe export→deploy);
+            // absent field = fall through to delete path (intentional removal).
+            if (desired.length === 0 && client.client_authentication_methods)
+                continue;
+            let existing = [];
+            try {
+                existing = (await this.client.clients.credentials.list(clientId));
+            }
+            catch (err) {
+                logger_1.default.warn(`clientAuthCredentials: failed to list credentials for client "${clientName}": ${err}`);
+                continue;
+            }
+            // No credentials in Auth0 and none desired — nothing to do.
+            if (existing.length === 0 && desired.length === 0)
+                continue;
+            // Warn if duplicate names exist in Auth0 — we can't match safely
+            const existingNames = existing.map((c) => c.name);
+            const duplicateNames = existingNames.filter((n, i) => existingNames.indexOf(n) !== i);
+            if (duplicateNames.length > 0) {
+                logger_1.default.warn(`clientAuthCredentials: client "${clientName}" has duplicate credential names in Auth0 [${duplicateNames.join(', ')}] — skipping credential reconciliation for this client`);
+                continue;
+            }
+            const existingByName = new Map(existing.map((c) => [c.name, c]));
+            const desiredNames = new Set(desired.map((d) => d.name));
+            const toCreate = desired.filter((d) => !existingByName.has(d.name));
+            const toDelete = existing.filter((e) => !desiredNames.has(e.name));
+            // Creates first — Auth0 allows max 2 credentials; both must exist simultaneously during rotation
+            // Track name→id so we can correctly attribute each created credential to its method later.
+            const createdIdByName = new Map();
+            for (const cred of toCreate) {
+                try {
+                    const created = await this.client.clients.credentials.create(clientId, {
+                        name: cred.name,
+                        pem: cred.pem,
+                        credential_type: cred.credential_type,
+                    });
+                    logger_1.default.info(`clientAuthCredentials: created credential "${cred.name}" on client "${clientName}"`);
+                    createdIdByName.set(cred.name, created.id);
+                }
+                catch (err) {
+                    logger_1.default.warn(`clientAuthCredentials: failed to create credential "${cred.name}" on client "${clientName}": ${err}`);
+                }
+            }
+            // Re-wire client_authentication_methods with final IDs (kept + newly created).
+            // This must happen BEFORE deletes — Auth0 rejects deleting a credential that
+            // is still referenced in client_authentication_methods.
+            const keptIds = existing.filter((e) => desiredNames.has(e.name)).map((e) => e.id);
+            const createdIds = [...createdIdByName.values()];
+            const finalIds = [...keptIds, ...createdIds];
+            let updatedAuthMethods = null;
+            if (finalIds.length > 0) {
+                // Build method→ids map. For kept credentials use Auth0's stored type to infer method;
+                // for created credentials use the method from the user's config entry (by name).
+                const methodToIds = {};
+                for (const id of finalIds) {
+                    const fromExisting = existing.find((e) => e.id === id);
+                    const createdName = [...createdIdByName.entries()].find(([, cid]) => cid === id)?.[0];
+                    const fromDesired = createdName ? desired.find((d) => d.name === createdName) : undefined;
+                    const methodKey = (fromExisting && this.inferMethodFromType(fromExisting.credential_type)) ||
+                        (fromDesired && fromDesired.method) ||
+                        Object.keys(client.client_authentication_methods)[0];
+                    if (!methodToIds[methodKey])
+                        methodToIds[methodKey] = [];
+                    methodToIds[methodKey].push(id);
+                }
+                updatedAuthMethods = {};
+                for (const [methodKey, ids] of Object.entries(methodToIds)) {
+                    updatedAuthMethods[methodKey] = { credentials: ids.map((id) => ({ id })) };
+                }
+            }
+            // Always update client_authentication_methods before deletes:
+            // - When finalIds > 0: re-wire to the remaining credentials
+            // - When finalIds === 0 but toDelete > 0: set to null so Auth0 de-references them first
+            if (finalIds.length > 0 || toDelete.length > 0) {
+                try {
+                    const payload = {
+                        client_authentication_methods: updatedAuthMethods ?? null,
+                    };
+                    // Auth0 requires token_endpoint_auth_method: null when setting client_authentication_methods,
+                    // and a non-null value when clearing it.
+                    if (updatedAuthMethods) {
+                        payload.token_endpoint_auth_method = null;
+                    }
+                    else {
+                        payload.token_endpoint_auth_method =
+                            client.token_endpoint_auth_method || 'client_secret_post';
+                    }
+                    await this.client.clients.update(clientId, payload);
+                    logger_1.default.info(`clientAuthCredentials: updated client_authentication_methods on client "${clientName}"`);
+                }
+                catch (err) {
+                    logger_1.default.warn(`clientAuthCredentials: failed to update client_authentication_methods on client "${clientName}": ${err}`);
+                }
+            }
+            // Deletes last — after client_authentication_methods no longer references them
+            if (toDelete.length > 0) {
+                if (!allowDelete) {
+                    logger_1.default.warn(`clientAuthCredentials: the following credentials on client "${clientName}" would be deleted but AUTH0_ALLOW_DELETE is not set:\n${toDelete
+                        .map((c) => `  ${c.name} (${c.id})`)
+                        .join('\n')}`);
+                }
+                else {
+                    for (const cred of toDelete) {
+                        try {
+                            await this.client.clients.credentials.delete(clientId, cred.id);
+                            logger_1.default.info(`clientAuthCredentials: deleted credential "${cred.name}" on client "${clientName}"`);
+                        }
+                        catch (err) {
+                            logger_1.default.warn(`clientAuthCredentials: failed to delete credential "${cred.name}" on client "${clientName}": ${err}`);
+                        }
+                    }
+                }
+            }
+        }
+    }
+    inferCredentialType(methodKey) {
+        const map = {
+            private_key_jwt: 'public_key',
+            self_signed_tls_client_auth: 'x509_cert',
+            tls_client_auth: 'cert_subject_dn',
+        };
+        return map[methodKey] || 'public_key';
+    }
+    inferMethodFromType(credentialType) {
+        return CREDENTIAL_TYPE_TO_METHOD[credentialType] || 'private_key_jwt';
+    }
+}
+exports.default = ClientAuthCredentialsHandler;
+__decorate([
+    (0, default_1.order)('70')
+], ClientAuthCredentialsHandler.prototype, "processChanges", null);

package/lib/tools/auth0/handlers/clientAuthCredentialsPre.d.ts

@@ -0,0 +1,37 @@
+import { Assets, Auth0APIClient } from '../../../types';
+import { ConfigFunction } from '../../../configFactory';
+export declare const schema: {
+    type: string;
+    items: {
+        type: string;
+    };
+};
+/**
+ * Handles full credential deletion BEFORE clients.ts (order 50) patches the client.
+ *
+ * Auth0 rejects a client PATCH containing token_endpoint_auth_method while that client still
+ * has active credentials. By running at order 40, this handler clears credentials (and
+ * client_authentication_methods) for any client where the field is absent from config, so
+ * that clients.ts can safely include token_endpoint_auth_method in its PATCH.
+ *
+ * Partial deletion (some credentials removed, others kept) is handled by
+ * ClientAuthCredentialsHandler at order 70, because those clients still have
+ * client_authentication_methods present in config and clients.ts strips token_endpoint_auth_method
+ * for them anyway.
+ */
+export default class ClientAuthCredentialsPreHandler {
+    client: Auth0APIClient;
+    config: ConfigFunction;
+    type: string;
+    existing: null;
+    constructor({ client, config }: {
+        client: Auth0APIClient;
+        config: ConfigFunction;
+    });
+    getType(): Promise<null>;
+    load(): Promise<{
+        [x: string]: null;
+    }>;
+    validate(): Promise<null>;
+    processChanges(assets: Assets): Promise<void>;
+}

package/lib/tools/auth0/handlers/clientAuthCredentialsPre.js

@@ -0,0 +1,118 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.schema = void 0;
+const default_1 = require("./default");
+const client_1 = require("../client");
+const logger_1 = __importDefault(require("../../../logger"));
+exports.schema = {
+    type: 'array',
+    items: { type: 'object' },
+};
+/**
+ * Handles full credential deletion BEFORE clients.ts (order 50) patches the client.
+ *
+ * Auth0 rejects a client PATCH containing token_endpoint_auth_method while that client still
+ * has active credentials. By running at order 40, this handler clears credentials (and
+ * client_authentication_methods) for any client where the field is absent from config, so
+ * that clients.ts can safely include token_endpoint_auth_method in its PATCH.
+ *
+ * Partial deletion (some credentials removed, others kept) is handled by
+ * ClientAuthCredentialsHandler at order 70, because those clients still have
+ * client_authentication_methods present in config and clients.ts strips token_endpoint_auth_method
+ * for them anyway.
+ */
+class ClientAuthCredentialsPreHandler {
+    constructor({ client, config }) {
+        // Same type as ClientAuthCredentialsHandler so AUTH0_EXCLUDED / AUTH0_INCLUDED_ONLY
+        // applies to both handlers together without needing a separate AssetTypes entry.
+        this.type = 'clientAuthCredentials';
+        this.existing = null;
+        this.client = client;
+        this.config = config;
+    }
+    async getType() {
+        return null;
+    }
+    async load() {
+        return { [this.type]: null };
+    }
+    async validate() {
+        return null;
+    }
+    async processChanges(assets) {
+        const { clients } = assets;
+        if (!clients)
+            return;
+        const allowDelete = this.config('AUTH0_ALLOW_DELETE') === true || this.config('AUTH0_ALLOW_DELETE') === 'true';
+        // When allowDelete is false no deletion will happen — skip entirely to avoid
+        // unnecessary GET /credentials calls for every client.
+        if (!allowDelete)
+            return;
+        // Only act on clients where client_authentication_methods is absent from config.
+        // Absent = intentional full deletion. Clients with the field present (including partial
+        // deletion) are fully handled by ClientAuthCredentialsHandler at order 70.
+        const deletionCandidates = clients.filter((c) => c.client_authentication_methods === undefined);
+        if (deletionCandidates.length === 0)
+            return;
+        // In directory mode client_id is stripped. Resolve names once for all candidates.
+        const needsNameResolution = deletionCandidates.some((c) => !c.client_id);
+        let clientIdByName = new Map();
+        if (needsNameResolution) {
+            const existingClients = await (0, client_1.paginate)(this.client.clients.list, {
+                paginate: true,
+                is_global: false,
+            });
+            clientIdByName = new Map(existingClients.map((c) => [c.name, c.client_id]));
+        }
+        for (const client of deletionCandidates) {
+            const clientId = client.client_id || (client.name && clientIdByName.get(client.name));
+            if (!clientId)
+                continue;
+            const clientName = client.name || clientId;
+            let existing = [];
+            try {
+                existing = (await this.client.clients.credentials.list(clientId));
+            }
+            catch (err) {
+                logger_1.default.warn(`clientAuthCredentials: failed to list credentials for client "${clientName}": ${err}`);
+                continue;
+            }
+            if (existing.length === 0)
+                continue;
+            // De-reference credentials from client_authentication_methods before deleting them —
+            // Auth0 rejects deleting a credential that is still referenced.
+            try {
+                await this.client.clients.update(clientId, {
+                    client_authentication_methods: null,
+                    token_endpoint_auth_method: client.token_endpoint_auth_method || 'client_secret_post',
+                });
+            }
+            catch (err) {
+                logger_1.default.warn(`clientAuthCredentials: failed to clear client_authentication_methods on client "${clientName}": ${err}`);
+                continue;
+            }
+            for (const cred of existing) {
+                try {
+                    await this.client.clients.credentials.delete(clientId, cred.id);
+                    logger_1.default.info(`clientAuthCredentials: deleted credential "${cred.name}" on client "${clientName}"`);
+                }
+                catch (err) {
+                    logger_1.default.warn(`clientAuthCredentials: failed to delete credential "${cred.name}" on client "${clientName}": ${err}`);
+                }
+            }
+        }
+    }
+}
+exports.default = ClientAuthCredentialsPreHandler;
+__decorate([
+    (0, default_1.order)('40')
+], ClientAuthCredentialsPreHandler.prototype, "processChanges", null);

package/lib/tools/auth0/handlers/clients.js

@@ -566,6 +566,17 @@ class ClientHandler extends default_1.default {
                         delete item.refresh_token;
                     }
                 }
+                // Strip client_authentication_methods — the clientAuthCredentials handler (order 70)
+                // owns this field entirely. Auth0 rejects credential objects with name/credential_type in PATCH.
+                // Strip token_endpoint_auth_method only when client_authentication_methods is present in config:
+                // Auth0 rejects it in PATCH while a client has active credentials. For these clients the
+                // clientAuthCredentials handler (order 70) owns token_endpoint_auth_method too.
+                // For clients without client_authentication_methods, credentials were already cleared by
+                // clientAuthCredentialsPre (order 40), so token_endpoint_auth_method passes through safely.
+                if (item.client_authentication_methods) {
+                    delete item.token_endpoint_auth_method;
+                }
+                delete item.client_authentication_methods;
                 return item;
             });
         };
@@ -587,7 +598,33 @@ class ClientHandler extends default_1.default {
             is_global: false,
             ...((0, utils_1.shouldExcludeThirdPartyClients)(this.config) && { is_first_party: true }),
         });
-        this.existing = createClientSanitizer(clients).sanitizeCrossOriginAuth(false).get();
+        const sanitized = createClientSanitizer(clients).sanitizeCrossOriginAuth(false).get();
+        // Enrich credential stubs with name and credential_type for export.
+        // Auth0 does not return pem on read — it is never exported.
+        await Promise.all(sanitized.map(async (client) => {
+            if (!client.client_authentication_methods)
+                return;
+            try {
+                const creds = await this.client.clients.credentials.list(client.client_id);
+                const credMap = new Map(creds.map((c) => [c.id, c]));
+                Object.values(client.client_authentication_methods).forEach((method) => {
+                    if (method?.credentials) {
+                        method.credentials = method.credentials
+                            .map((stub) => {
+                            const full = credMap.get(stub.id);
+                            if (!full?.name)
+                                return null;
+                            return { name: full.name, credential_type: full.credential_type };
+                        })
+                            .filter(Boolean);
+                    }
+                });
+            }
+            catch (_) {
+                // leave stubs as-is if the credentials API call fails
+            }
+        }));
+        this.existing = sanitized;
         return this.existing;
     }
     isCimdClient(client) {

package/lib/tools/auth0/handlers/connections.js

@@ -85,6 +85,7 @@ const oidcOktaOnlyConnectionOptionFields = [
     'token_endpoint_auth_signing_alg',
     'id_token_signed_response_algs',
     'token_endpoint_jwtca_aud_format',
+    'id_token_session_expiry_supported',
 ];
 exports.schema = {
     type: 'array',

package/lib/tools/auth0/handlers/eventStreams.d.ts

@@ -0,0 +1,58 @@
+import { Management } from 'auth0';
+import DefaultAPIHandler from './default';
+import { Asset, Assets } from '../../../types';
+import { Action } from './actions';
+export declare const schema: {
+    type: string;
+    items: {
+        type: string;
+        properties: {
+            id: {
+                type: string;
+            };
+            name: {
+                type: string;
+            };
+            status: {
+                type: string;
+                enum: string[];
+            };
+            subscriptions: {
+                type: string;
+                items: {
+                    type: string;
+                    properties: {
+                        event_type: {
+                            type: string;
+                        };
+                    };
+                };
+            };
+            destination: {
+                type: string;
+                properties: {
+                    type: {
+                        type: string;
+                        enum: string[];
+                    };
+                    configuration: {
+                        type: string;
+                    };
+                };
+                required: string[];
+            };
+        };
+        required: string[];
+    };
+};
+export type EventStream = Management.EventStreamResponseContent;
+export default class EventStreamsHandler extends DefaultAPIHandler {
+    existing: Asset[] | null;
+    private actions;
+    constructor(config: DefaultAPIHandler);
+    objString(item: Asset): string;
+    getActions(): Promise<Action[]>;
+    getType(): Promise<Asset[]>;
+    private resolveActionId;
+    processChanges(assets: Assets): Promise<void>;
+}

package/lib/tools/auth0/handlers/eventStreams.js

@@ -0,0 +1,186 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.schema = void 0;
+const default_1 = __importStar(require("./default"));
+const client_1 = require("../client");
+const logger_1 = __importDefault(require("../../../logger"));
+exports.schema = {
+    type: 'array',
+    items: {
+        type: 'object',
+        properties: {
+            id: { type: 'string' },
+            name: { type: 'string' },
+            status: { type: 'string', enum: ['enabled', 'disabled'] },
+            subscriptions: {
+                type: 'array',
+                items: {
+                    type: 'object',
+                    properties: {
+                        event_type: { type: 'string' },
+                    },
+                },
+            },
+            destination: {
+                type: 'object',
+                properties: {
+                    type: { type: 'string', enum: ['webhook', 'eventbridge', 'action'] },
+                    configuration: { type: 'object' },
+                },
+                required: ['type', 'configuration'],
+            },
+        },
+        required: ['name', 'destination'],
+    },
+};
+class EventStreamsHandler extends default_1.default {
+    constructor(config) {
+        super({
+            ...config,
+            type: 'eventStreams',
+            identifiers: ['id', 'name'],
+            // aws_partner_event_source is auto-populated by AWS after creation; sending it on create fails
+            stripCreateFields: [
+                'destination.configuration.aws_partner_event_source',
+                'created_at',
+                'updated_at',
+            ],
+            stripUpdateFields: ['created_at', 'updated_at'],
+        });
+        this.actions = null;
+    }
+    objString(item) {
+        return super.objString(item.name);
+    }
+    async getActions() {
+        if (this.actions)
+            return this.actions;
+        this.actions = await (0, client_1.paginate)(this.client.actions.list, { paginate: true });
+        return this.actions;
+    }
+    async getType() {
+        if (this.existing) {
+            return this.existing;
+        }
+        const eventStreams = [];
+        let page = await this.client.eventStreams.list();
+        eventStreams.push(...page.data);
+        while (page.hasNextPage()) {
+            page = await page.getNextPage();
+            eventStreams.push(...page.data);
+        }
+        // For action-destination streams, replace action_id with the action name for export
+        const actions = await this.getActions();
+        this.existing = eventStreams.map((stream) => {
+            if (stream.destination?.type === 'action' && stream.destination.configuration?.action_id) {
+                const action = actions.find((a) => a.id === stream.destination.configuration.action_id);
+                if (action) {
+                    return {
+                        ...stream,
+                        destination: {
+                            ...stream.destination,
+                            configuration: {
+                                ...stream.destination.configuration,
+                                action_id: action.name,
+                            },
+                        },
+                    };
+                }
+            }
+            return stream;
+        });
+        return this.existing;
+    }
+    resolveActionId(stream) {
+        if (stream.destination?.type !== 'action' || !stream.destination.configuration?.action_id) {
+            return stream;
+        }
+        const name = stream.destination.configuration.action_id;
+        const action = (this.actions ?? []).find((a) => a.name === name);
+        if (!action) {
+            throw new Error(`Event stream "${stream.name}" references action "${name}" which was not found`);
+        }
+        return {
+            ...stream,
+            destination: {
+                ...stream.destination,
+                configuration: {
+                    ...stream.destination.configuration,
+                    action_id: action.id,
+                },
+            },
+        };
+    }
+    async processChanges(assets) {
+        const { eventStreams } = assets;
+        if (!eventStreams)
+            return;
+        if (!this.actions) {
+            this.actions = await this.getActions();
+        }
+        const changes = await this.calcChanges(assets).then((changesResponse) => ({
+            ...changesResponse,
+            create: changesResponse.create.map((stream) => this.resolveActionId(stream)),
+            update: changesResponse.update.map((stream) => {
+                const resolved = this.resolveActionId(stream);
+                // A destination's type cannot be changed once an event stream is created. The API
+                // rejects the destination on PATCH for eventbridge and action streams, so strip it
+                // from the update payload and only apply the other mutable fields.
+                if (resolved.destination?.type === 'eventbridge' ||
+                    resolved.destination?.type === 'action') {
+                    logger_1.default.info(`Skipping destination update for event stream "${resolved.name}": ${resolved.destination.type} destinations cannot be changed after creation.`);
+                    const { destination: _dest, ...rest } = resolved;
+                    return rest;
+                }
+                return resolved;
+            }),
+        }));
+        await super.processChanges(assets, changes);
+    }
+}
+exports.default = EventStreamsHandler;
+__decorate([
+    (0, default_1.order)('75')
+], EventStreamsHandler.prototype, "processChanges", null);