auth0-deploy-cli 9.0.0-beta.2 → 9.0.0

package/lib/tools/auth0/handlers/connections.d.ts

@@ -103,6 +103,27 @@ export declare const schema: {
                 required: string[];
                 additionalProperties: boolean;
             };
+            cross_app_access_requesting_app: {
+                type: string;
+                properties: {
+                    active: {
+                        type: string;
+                    };
+                };
+                required: string[];
+                additionalProperties: boolean;
+            };
+            cross_app_access_resource_app: {
+                type: string;
+                properties: {
+                    status: {
+                        type: string;
+                        enum: string[];
+                    };
+                };
+                required: string[];
+                additionalProperties: boolean;
+            };
             directory_provisioning_configuration: {
                 type: string;
                 properties: {
@@ -138,6 +159,15 @@ export declare const schema: {
                                 id: {
                                     type: string;
                                 };
+                                name: {
+                                    type: string;
+                                };
+                                email: {
+                                    type: string;
+                                };
+                                direct_members_count: {
+                                    type: string;
+                                };
                             };
                             required: string[];
                         };
@@ -152,9 +182,7 @@ type DirectoryProvisioningConfig = Management.DirectoryProvisioning;
 export type Connection = Management.ConnectionForList & {
     enabled_clients?: string[];
     directory_provisioning_configuration?: Pick<DirectoryProvisioningConfig, 'mapping' | 'synchronize_automatically' | 'synchronize_groups'> & {
-        synchronized_groups?: Array<{
-            id: string;
-        }>;
+        synchronized_groups?: Management.SynchronizedGroupPayload[];
     };
 };
 export declare const addExcludedConnectionPropertiesToChanges: ({ proposedChanges, existingConnections, config, }: {
@@ -230,9 +258,7 @@ export default class ConnectionsHandler extends DefaultAPIHandler {
     /**
      * Retrieves all synchronized groups for a connection using checkpoint pagination.
      */
-    getConnectionSynchronizedGroups(connectionId: string): Promise<Array<{
-        id: string;
-    }> | null>;
+    getConnectionSynchronizedGroups(connectionId: string): Promise<Management.SynchronizedGroupPayload[] | null>;
     /**
      * Replaces the synchronized groups for a connection (PUT replace-all semantics).
      */

package/lib/tools/auth0/handlers/connections.js

@@ -129,6 +129,22 @@ exports.schema = {
                 required: ['active'],
                 additionalProperties: false,
             },
+            cross_app_access_requesting_app: {
+                type: 'object',
+                properties: {
+                    active: { type: 'boolean' },
+                },
+                required: ['active'],
+                additionalProperties: false,
+            },
+            cross_app_access_resource_app: {
+                type: 'object',
+                properties: {
+                    status: { type: 'string', enum: ['enabled', 'disabled'] },
+                },
+                required: ['status'],
+                additionalProperties: false,
+            },
             directory_provisioning_configuration: {
                 type: 'object',
                 properties: {
@@ -156,6 +172,9 @@ exports.schema = {
                             type: 'object',
                             properties: {
                                 id: { type: 'string' },
+                                name: { type: 'string' },
+                                email: { type: 'string' },
+                                direct_members_count: { type: 'number' },
                             },
                             required: ['id'],
                         },
@@ -361,12 +380,15 @@ class ConnectionsHandler extends default_1.default {
     }
     getFormattedOptions(connection, clients) {
         try {
+            const { idpinitiated } = connection.options;
             return {
                 options: {
                     ...connection.options,
                     idpinitiated: {
-                        ...connection.options.idpinitiated,
-                        client_id: (0, utils_1.convertClientNameToId)(connection.options.idpinitiated.client_id, clients),
+                        ...idpinitiated,
+                        ...(idpinitiated.client_id && {
+                            client_id: (0, utils_1.convertClientNameToId)(idpinitiated.client_id, clients),
+                        }),
                     },
                 },
             };
@@ -467,12 +489,28 @@ class ConnectionsHandler extends default_1.default {
         try {
             const groups = [];
             let page = await this.client.connections.directoryProvisioning.listSynchronizedGroups(connectionId, {});
-            for (const g of page.data ?? [])
-                groups.push({ id: g.id });
+            for (const g of page.data ?? []) {
+                groups.push({
+                    id: g.id,
+                    ...(g.name !== undefined && { name: g.name }),
+                    ...(g.email !== undefined && { email: g.email }),
+                    ...(g.direct_members_count !== undefined && {
+                        direct_members_count: g.direct_members_count,
+                    }),
+                });
+            }
             while (page.hasNextPage?.()) {
                 page = await page.getNextPage();
-                for (const g of page.data ?? [])
-                    groups.push({ id: g.id });
+                for (const g of page.data ?? []) {
+                    groups.push({
+                        id: g.id,
+                        ...(g.name !== undefined && { name: g.name }),
+                        ...(g.email !== undefined && { email: g.email }),
+                        ...(g.direct_members_count !== undefined && {
+                            direct_members_count: g.direct_members_count,
+                        }),
+                    });
+                }
             }
             return groups;
         }
@@ -709,7 +747,11 @@ class ConnectionsHandler extends default_1.default {
                 ...(enabledClients !== undefined && { enabled_clients: enabledClients }),
             };
         });
-        const proposedChanges = await super.dryRunChanges({ ...assets, connections: formatted });
+        let proposedChanges = await super.dryRunChanges({ ...assets, connections: formatted });
+        const includedConnections = (assets.include && assets.include.connections) || [];
+        const excludedConnections = (assets.exclude && assets.exclude.connections) || [];
+        proposedChanges = (0, utils_1.filterExcluded)(proposedChanges, excludedConnections);
+        proposedChanges = (0, utils_1.filterIncluded)(proposedChanges, includedConnections);
         return (0, exports.addExcludedConnectionPropertiesToChanges)({
             proposedChanges,
             existingConnections,

package/lib/tools/auth0/handlers/databases.d.ts

@@ -195,6 +195,33 @@ export declare const schema: {
                             };
                         };
                     };
+                    otp_settings: {
+                        type: string;
+                        properties: {
+                            email: {
+                                type: string;
+                                properties: {
+                                    otp_length: {
+                                        type: string;
+                                    };
+                                    otp_expiry: {
+                                        type: string;
+                                    };
+                                };
+                            };
+                            phone: {
+                                type: string;
+                                properties: {
+                                    otp_length: {
+                                        type: string;
+                                    };
+                                    otp_expiry: {
+                                        type: string;
+                                    };
+                                };
+                            };
+                        };
+                    };
                     password_options: {
                         type: string;
                         properties: {
@@ -295,6 +322,7 @@ export default class DatabaseHandler extends DefaultAPIHandler {
     private validatePasswordlessSettings;
     private validateEmailUniqueConstraints;
     getClientFN(fn: 'create' | 'delete' | 'getAll' | 'update'): Function;
+    private enrichConnectionsWithEnabledClients;
     getType(): Promise<Connection[]>;
     calcChanges(assets: Assets): Promise<CalculatedChanges>;
     dryRunChanges(assets: Assets): Promise<CalculatedChanges>;

package/lib/tools/auth0/handlers/databases.js

@@ -181,6 +181,25 @@ exports.schema = {
                             action_id: { type: 'string' },
                         },
                     },
+                    otp_settings: {
+                        type: 'object',
+                        properties: {
+                            email: {
+                                type: 'object',
+                                properties: {
+                                    otp_length: { type: 'integer' },
+                                    otp_expiry: { type: 'integer' },
+                                },
+                            },
+                            phone: {
+                                type: 'object',
+                                properties: {
+                                    otp_length: { type: 'integer' },
+                                    otp_expiry: { type: 'integer' },
+                                },
+                            },
+                        },
+                    },
                     password_options: {
                         type: 'object',
                         properties: {
@@ -419,6 +438,22 @@ class DatabaseHandler extends default_1.default {
         }
         return this.client.connections[fn].bind(this.client.connections);
     }
+    // `enabled_clients` is no longer returned by connections.list; it must be fetched from the
+    // dedicated enabled-clients endpoint. Enriching the remote connections keeps the diff and the
+    // excluded-client preservation in `getEnabledClients` correct. Without it the dry-run diff
+    // reports a false "found in localObj but not in remoteObj" and a real import can silently
+    // disable an excluded-but-enabled client.
+    async enrichConnectionsWithEnabledClients(connections) {
+        return Promise.all(connections.map(async (con) => {
+            if (!con?.id)
+                return con;
+            const enabledClients = await (0, connections_1.getConnectionEnabledClients)(this.client, con.id);
+            if (enabledClients?.length) {
+                return { ...con, enabled_clients: enabledClients };
+            }
+            return con;
+        }));
+    }
     async getType() {
         if (this.existing)
             return this.existing;
@@ -433,16 +468,7 @@ class DatabaseHandler extends default_1.default {
                 include_totals: true,
             }),
         ]);
-        const dbConnectionsWithEnabledClients = await Promise.all(connections.map(async (con) => {
-            if (!con?.id)
-                return con;
-            const enabledClients = await (0, connections_1.getConnectionEnabledClients)(this.client, con.id);
-            const connection = { ...con };
-            if (enabledClients && enabledClients?.length) {
-                connection.enabled_clients = enabledClients;
-            }
-            return connection;
-        }));
+        const dbConnectionsWithEnabledClients = await this.enrichConnectionsWithEnabledClients(connections);
         // Convert action ID back to action name for export
         const dbConnectionsWithActionNames = dbConnectionsWithEnabledClients.map((connection) => {
             if (connection.options && 'custom_password_hash' in connection.options) {
@@ -462,12 +488,21 @@ class DatabaseHandler extends default_1.default {
             }
             return connection;
         });
+        // A connection can return both legacy password fields and `password_options` on read, but
+        // they're mutually exclusive on write. Strip the legacy fields to keep the export deployable.
+        const dbConnectionsNormalized = dbConnectionsWithActionNames.map((connection) => {
+            if (connection.options && 'password_options' in connection.options) {
+                const { passwordPolicy, password_complexity_options, password_history, password_no_personal_info, password_dictionary, ...options } = connection.options;
+                return { ...connection, options };
+            }
+            return connection;
+        });
         // If options option is empty for all connection, log the missing options scope.
-        const isOptionExists = dbConnectionsWithActionNames.every((c) => c.options && Object.keys(c.options).length > 0);
+        const isOptionExists = dbConnectionsNormalized.every((c) => c.options && Object.keys(c.options).length > 0);
         if (!isOptionExists) {
             logger_1.default.warn(`Insufficient scope the read:connections_options scope is required to get ${this.type} options.`);
         }
-        this.existing = dbConnectionsWithActionNames;
+        this.existing = dbConnectionsNormalized;
         return this.existing;
     }
     async calcChanges(assets) {
@@ -480,28 +515,26 @@ class DatabaseHandler extends default_1.default {
                 update: [],
                 conflicts: [],
             };
-        // Convert enabled_clients by name to the id
-        // Fetch clients, connections, and actions concurrently
-        const [clients, existingDatabasesConnections, actions] = await Promise.all([
+        // Convert enabled_clients by name to the id. `getType()` fetches and enriches the existing
+        // connections with `enabled_clients` and caches the result in `this.existing`, so the
+        // `super.calcChanges()` call below reuses it instead of fetching again.
+        const [clients, actions, existingWithEnabledClients] = await Promise.all([
             (0, client_1.paginate)(this.client.clients.list, {
                 paginate: true,
             }),
-            (0, client_1.paginate)(this.client.connections.list, {
-                strategy: [auth0_1.Management.ConnectionStrategyEnum.Auth0],
-                checkpoint: true,
-                include_totals: true,
-            }),
             (0, client_1.paginate)(this.client.actions.list, {
                 paginate: true,
                 include_totals: true,
             }),
+            this.getType(),
         ]);
+        const existingConnections = existingWithEnabledClients || [];
         const formatted = databases.map((db) => {
             const { options, ...rest } = db;
             const formattedOptions = this.getFormattedOptions(options, actions);
             const formattedDb = { ...rest, options: formattedOptions };
             if (db.enabled_clients) {
-                formattedDb.enabled_clients = (0, utils_1.getEnabledClients)(assets, db, existingDatabasesConnections, clients);
+                formattedDb.enabled_clients = (0, utils_1.getEnabledClients)(assets, db, existingConnections, clients);
             }
             return formattedDb;
         });
@@ -531,21 +564,22 @@ class DatabaseHandler extends default_1.default {
                 include_totals: true,
             }),
         ]);
+        const existingWithEnabledClients = await this.enrichConnectionsWithEnabledClients(existingDatabasesConnections);
         const formatted = databases.map((db) => {
             const { options, ...rest } = db;
             const formattedOptions = this.getFormattedOptions(options, actions);
             const formattedDb = { ...rest, options: formattedOptions };
             if (db.enabled_clients) {
-                formattedDb.enabled_clients = (0, utils_1.getEnabledClients)(assets, db, existingDatabasesConnections, clients);
+                formattedDb.enabled_clients = (0, utils_1.getEnabledClients)(assets, db, existingWithEnabledClients, clients);
             }
             return formattedDb;
         });
         return (0, calculateDryRunChanges_1.calculateDryRunChanges)({
             type: this.type,
             assets: formatted,
-            existing: existingDatabasesConnections,
+            existing: existingWithEnabledClients,
             identifiers: this.identifiers,
-            ignoreDryRunFields: this.ignoreDryRunFields,
+            ignoreDryRunFields: this.getEffectiveIgnoreDryRunFields(),
         });
     }
     // Run after clients are updated so we can convert all the enabled_clients names to id's

package/lib/tools/auth0/handlers/default.d.ts

@@ -1,6 +1,20 @@
 import { Asset, Assets, Auth0APIClient, CalculatedChanges } from '../../../types';
 import { ConfigFunction } from '../../../configFactory';
 export declare function order(value: any): (t: any, n: any, descriptor: any) => any;
+export interface RetryOptions {
+    maxRetries?: number;
+    initialDelay?: number;
+    maxDelay?: number;
+    onRetry?: (error: any, attempt: number, delay: number) => void;
+}
+/**
+ * Executes a function with exponential backoff retry logic for rate limit errors (429).
+ *
+ * @param fn - The function to execute with retry logic
+ * @param options - Configuration options for retry behavior
+ * @returns Promise that resolves with the function result or rejects after max retries
+ */
+export declare function retryWithExponentialBackoff<T>(fn: () => Promise<T>, options?: RetryOptions): Promise<T>;
 type ApiMethodOverride = string | Function;
 export default class APIHandler {
     config: ConfigFunction;
@@ -50,6 +64,15 @@ export default class APIHandler {
      */
     getEffectiveIgnoreDryRunFields(): string[];
     getClientFN(fn: ApiMethodOverride): Function;
+    /**
+     * Builds the exponential-backoff retry configuration for this handler from the
+     * shared `AUTH0_MAX_RETRIES` / `AUTH0_RETRY_INITIAL_DELAY_MS` /
+     * `AUTH0_RETRY_MAX_DELAY_MS` config keys. Exposed so that handlers which issue
+     * writes outside the default `processChanges` flow (e.g. organizations, which
+     * writes nested connections/grants directly) can wrap those calls in the same
+     * 429 backoff behaviour as the base handler.
+     */
+    getRetryConfig(): RetryOptions;
     didDelete(item: Asset): void;
     didCreate(item: Asset): void;
     didUpdate(item: Asset): void;

package/lib/tools/auth0/handlers/default.js

@@ -4,7 +4,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.order = order;
-const auth0_1 = require("auth0");
+exports.retryWithExponentialBackoff = retryWithExponentialBackoff;
 const validationError_1 = __importDefault(require("../../validationError"));
 const utils_1 = require("../../utils");
 const logger_1 = __importDefault(require("../../../logger"));
@@ -20,6 +20,19 @@ function order(value) {
         return descriptor;
     };
 }
+/**
+ * node-auth0 v7 removed the exported `JSONApiResponse` class, so we can no
+ * longer use `instanceof` to tell an SDK response envelope apart from a plain
+ * asset. Duck-type the `ApiResponse<T>` shape ({ data, status, headers })
+ * instead.
+ */
+function isApiResponseEnvelope(item) {
+    return (typeof item === 'object' &&
+        item !== null &&
+        'data' in item &&
+        'status' in item &&
+        'headers' in item);
+}
 // Retry configuration constants
 const DEFAULT_MAX_RETRIES = 3;
 const DEFAULT_INITIAL_DELAY_MS = 1000; // 1 second
@@ -114,24 +127,35 @@ class APIHandler {
         }
         return fn;
     }
+    /**
+     * Builds the exponential-backoff retry configuration for this handler from the
+     * shared `AUTH0_MAX_RETRIES` / `AUTH0_RETRY_INITIAL_DELAY_MS` /
+     * `AUTH0_RETRY_MAX_DELAY_MS` config keys. Exposed so that handlers which issue
+     * writes outside the default `processChanges` flow (e.g. organizations, which
+     * writes nested connections/grants directly) can wrap those calls in the same
+     * 429 backoff behaviour as the base handler.
+     */
+    getRetryConfig() {
+        const retryConfig = {
+            maxRetries: this.config('AUTH0_MAX_RETRIES') || DEFAULT_MAX_RETRIES,
+            initialDelay: this.config('AUTH0_RETRY_INITIAL_DELAY_MS') || DEFAULT_INITIAL_DELAY_MS,
+            maxDelay: this.config('AUTH0_RETRY_MAX_DELAY_MS') || DEFAULT_MAX_DELAY_MS,
+            onRetry: (error, attempt, delay) => {
+                logger_1.default.warn(`Rate limit hit for [${this.type}]. Retrying attempt ${attempt}/${retryConfig.maxRetries} after ${Math.round(delay / 1000)}s...`);
+            },
+        };
+        return retryConfig;
+    }
     didDelete(item) {
         logger_1.default.info(`Deleted [${this.type}]: ${this.objString(item)}`);
     }
     didCreate(item) {
-        if (typeof item === 'object' && item instanceof auth0_1.JSONApiResponse) {
-            logger_1.default.info(`Created [${this.type}]: ${this.objString(item?.data)}`);
-        }
-        else {
-            logger_1.default.info(`Created [${this.type}]: ${this.objString(item)}`);
-        }
+        const payload = isApiResponseEnvelope(item) ? item.data : item;
+        logger_1.default.info(`Created [${this.type}]: ${this.objString(payload)}`);
     }
     didUpdate(item) {
-        if (typeof item === 'object' && item instanceof auth0_1.JSONApiResponse) {
-            logger_1.default.info(`Updated [${this.type}]: ${this.objString(item?.data)}`);
-        }
-        else {
-            logger_1.default.info(`Updated [${this.type}]: ${this.objString(item)}`);
-        }
+        const payload = isApiResponseEnvelope(item) ? item.data : item;
+        logger_1.default.info(`Updated [${this.type}]: ${this.objString(payload)}`);
     }
     objString(item) {
         return (0, utils_1.convertJsonToString)(item);
@@ -168,6 +192,9 @@ class APIHandler {
             this.type === 'branding' ||
             this.type === 'emailProvider' ||
             this.type === 'guardianPhoneFactorSelectedProvider' ||
+            this.type === 'guardianPhoneFactorSettings' ||
+            this.type === 'guardianEmailFactorSettings' ||
+            this.type === 'guardianSettings' ||
             this.type === 'guardianPolicies' ||
             this.type === 'riskAssessment') {
             return `${this.type} settings`;
@@ -210,7 +237,6 @@ class APIHandler {
             return (0, calculateDryRunChanges_1.calculateDryRunChanges)({
                 type: this.type,
                 assets: typeAssets,
-                // @ts-ignore TODO: investigate what happens when `existing` is null
                 existing,
                 identifiers: this.identifiers,
                 ignoreDryRunFields: this.getEffectiveIgnoreDryRunFields(),
@@ -243,7 +269,6 @@ class APIHandler {
         return (0, calculateDryRunChanges_1.calculateDryRunChanges)({
             type: this.type,
             assets: typeAssets,
-            // @ts-ignore TODO: investigate what happens when `existing` is null
             existing,
             identifiers: this.identifiers,
             ignoreDryRunFields: this.getEffectiveIgnoreDryRunFields(),
@@ -282,14 +307,7 @@ class APIHandler {
         const conflicts = changes.conflicts || [];
         logger_1.default.debug(`Start processChanges for ${this.type} [delete:${del.length}] [update:${update.length}], [create:${create.length}], [conflicts:${conflicts.length}]`);
         // Set retry configuration from config
-        const retryConfig = {
-            maxRetries: this.config('AUTH0_MAX_RETRIES') || DEFAULT_MAX_RETRIES,
-            initialDelay: this.config('AUTH0_RETRY_INITIAL_DELAY_MS') || DEFAULT_INITIAL_DELAY_MS,
-            maxDelay: this.config('AUTH0_RETRY_MAX_DELAY_MS') || DEFAULT_MAX_DELAY_MS,
-            onRetry: (error, attempt, delay) => {
-                logger_1.default.warn(`Rate limit hit for [${this.type}]. Retrying attempt ${attempt}/${retryConfig.maxRetries} after ${Math.round(delay / 1000)}s...`);
-            },
-        };
+        const retryConfig = this.getRetryConfig();
         // Process Deleted
         if (del.length > 0) {
             const allowDelete = this.config('AUTH0_ALLOW_DELETE') === 'true' || this.config('AUTH0_ALLOW_DELETE') === true;
@@ -328,8 +346,8 @@ class APIHandler {
                 const updateFN = this.getClientFN(this.functions.update);
                 const updatePayload = (() => {
                     const data = (0, utils_1.stripFields)({ ...updateItem }, this.stripUpdateFields);
-                    const stripped = (0, utils_1.stripObfuscatedFieldsFromPayload)(data, this.sensitiveFieldsToObfuscate);
-                    return (0, utils_1.validateNoUnresolvedPlaceholders)(stripped, this.type, this.objString(updateItem));
+                    const obfuscatedStripped = (0, utils_1.stripObfuscatedFieldsFromPayload)(data, this.sensitiveFieldsToObfuscate);
+                    return (0, utils_1.stripUnresolvedPlaceholders)(obfuscatedStripped, this.type, this.objString(updateItem));
                 })();
                 return updateFN(updateItem[this.id], updatePayload);
             }, retryConfig)
@@ -347,8 +365,8 @@ class APIHandler {
                 const createFunction = this.getClientFN(this.functions.create);
                 const createPayload = (() => {
                     const strippedPayload = (0, utils_1.stripFields)(createItem, this.stripCreateFields);
-                    const stripped = (0, utils_1.stripObfuscatedFieldsFromPayload)(strippedPayload, this.sensitiveFieldsToObfuscate);
-                    return (0, utils_1.validateNoUnresolvedPlaceholders)(stripped, this.type, this.objString(createItem));
+                    const obfuscatedStripped = (0, utils_1.stripObfuscatedFieldsFromPayload)(strippedPayload, this.sensitiveFieldsToObfuscate);
+                    return (0, utils_1.stripUnresolvedPlaceholders)(obfuscatedStripped, this.type, this.objString(createItem));
                 })();
                 return createFunction(createPayload);
             }, retryConfig)
@@ -369,8 +387,8 @@ class APIHandler {
                 const updateFN = this.getClientFN(this.functions.update);
                 const updatePayload = (() => {
                     const data = (0, utils_1.stripFields)({ ...updateItem }, this.stripUpdateFields);
-                    const stripped = (0, utils_1.stripObfuscatedFieldsFromPayload)(data, this.sensitiveFieldsToObfuscate);
-                    return (0, utils_1.validateNoUnresolvedPlaceholders)(stripped, this.type, this.objString(updateItem));
+                    const obfuscatedStripped = (0, utils_1.stripObfuscatedFieldsFromPayload)(data, this.sensitiveFieldsToObfuscate);
+                    return (0, utils_1.stripUnresolvedPlaceholders)(obfuscatedStripped, this.type, this.objString(updateItem));
                 })();
                 return updateFN(updateItem[this.id], updatePayload);
             }, retryConfig)

package/lib/tools/auth0/handlers/eventStreams.js

@@ -38,10 +38,14 @@ var __importStar = (this && this.__importStar) || (function () {
         return result;
     };
 })();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.schema = void 0;
 const default_1 = __importStar(require("./default"));
 const client_1 = require("../client");
+const logger_1 = __importDefault(require("../../../logger"));
 exports.schema = {
     type: 'array',
     items: {
@@ -161,8 +165,12 @@ class EventStreamsHandler extends default_1.default {
             create: changesResponse.create.map((stream) => this.resolveActionId(stream)),
             update: changesResponse.update.map((stream) => {
                 const resolved = this.resolveActionId(stream);
-                // EventBridge destinations cannot be patched — the API rejects destination on PATCH
-                if (resolved.destination?.type === 'eventbridge') {
+                // A destination's type cannot be changed once an event stream is created. The API
+                // rejects the destination on PATCH for eventbridge and action streams, so strip it
+                // from the update payload and only apply the other mutable fields.
+                if (resolved.destination?.type === 'eventbridge' ||
+                    resolved.destination?.type === 'action') {
+                    logger_1.default.info(`Skipping destination update for event stream "${resolved.name}": ${resolved.destination.type} destinations cannot be changed after creation.`);
                     const { destination: _dest, ...rest } = resolved;
                     return rest;
                 }

package/lib/tools/auth0/handlers/guardianEmailFactorSettings.d.ts

@@ -0,0 +1,22 @@
+import DefaultHandler from './default';
+import { Asset, Assets } from '../../../types';
+export declare const schema: {
+    type: string;
+    properties: {
+        otp_length: {
+            type: string;
+            description: string;
+        };
+        otp_expiration_time: {
+            type: string;
+            description: string;
+        };
+    };
+    additionalProperties: boolean;
+};
+export default class GuardianEmailFactorSettingsHandler extends DefaultHandler {
+    existing: Asset;
+    constructor(options: any);
+    getType(): Promise<Asset | null>;
+    processChanges(assets: Assets): Promise<void>;
+}