atmn 2.0.32 → 2.0.34

package/src/generated/emit.ts

@@ -1,7 +1,11 @@
 // Generated by @autumn/atmn-generator from packages/openapi/openapi-internal.yml.
 // Do not edit — run `bun generate` in packages/atmn-generator instead.
 
-import type { CollectionSpec, SingletonSpec } from "./emitRuntime";
+import type {
+	CollectionSpec,
+	SingletonSpec,
+	SyncedListSpec,
+} from "./emitRuntime";
 
 export const COLLECTIONS: Readonly<Record<string, CollectionSpec>> = {
 	features: {
@@ -1203,6 +1207,21 @@ export const SINGLETONS: Readonly<Record<string, SingletonSpec>> = {
 	},
 };
 
+/** Lists keyed by id outside the catalog, emitted like collection items. */
+export const SYNCED_LISTS: Readonly<Record<string, SyncedListSpec>> = {
+	webhooks: {
+		wireKey: "webhooks",
+		builder: "webhook",
+		idField: "id",
+		responseIdField: "id",
+		keys: ["id", "url", "events", "description", "disabled"],
+		required: ["events", "id", "url"],
+		paths: ["description", "disabled", "events", "id", "url"],
+		pull: true,
+		envKeyed: ["url"],
+	},
+};
+
 /** Fixtures nested in a collection item: builder, id field, and where they live. */
 export const NESTED_FIXTURES: Readonly<
 	Record<

package/src/generated/emitRuntime.ts

@@ -93,6 +93,14 @@ export const branchSpecs = ({
 }): CollectionSpec[] =>
 	spec.branches?.map((branch) => branchSpecOf({ spec, branch })) ?? [spec];
 
+/** A list keyed by id outside the catalog: emitted like a collection item,
+ * with fields a config states once per environment. */
+export type SyncedListSpec = CollectionSpec & {
+	readonly wireKey: string;
+	/** Fixture fields holding `{ live?, sandbox?, [sandboxSlug]? }` maps. */
+	readonly envKeyed: readonly string[];
+};
+
 export type SingletonSpec = {
 	/** The request-body field the object is sent as. */
 	readonly wireKey: string;

package/src/generated/isLocalWebhookUrl.ts

@@ -0,0 +1,64 @@
+// Copied by @autumn/atmn-generator from shared/api/webhooks/endpoints/isLocalWebhookUrl.ts.
+// Do not edit — change that file and run `bun generate` instead.
+
+const PRIVATE_IPV4_RANGES: [base: number, prefixBits: number][] = [
+	[0x00000000, 32], // 0.0.0.0
+	[0x7f000000, 8], // 127.0.0.0/8
+	[0x0a000000, 8], // 10.0.0.0/8
+	[0xac100000, 12], // 172.16.0.0/12
+	[0xc0a80000, 16], // 192.168.0.0/16
+	[0xa9fe0000, 16], // 169.254.0.0/16
+];
+
+const parseIpv4 = (host: string): number | null => {
+	const parts = host.split(".");
+	if (parts.length !== 4) return null;
+	if (parts.some((part) => !/^\d+$/.test(part) || Number(part) > 255)) {
+		return null;
+	}
+	return parts.reduce((acc, part) => acc * 256 + Number(part), 0);
+};
+
+const isPrivateIpv4 = (address: number) =>
+	PRIVATE_IPV4_RANGES.some(([base, prefixBits]) => {
+		const mask = prefixBits === 0 ? 0 : (0xffffffff << (32 - prefixBits)) >>> 0;
+		return (address & mask) >>> 0 === base;
+	});
+
+const isLocalIpv6 = (host: string) => {
+	if (host === "::1" || host === "::") return true;
+	if (/^fe[89ab][0-9a-f]:/.test(host)) return true;
+	// Unique-local fc00::/7, IPv6's private ranges
+	if (/^f[cd][0-9a-f]{0,2}:/.test(host)) return true;
+	// WHATWG URL rewrites ::ffff:127.0.0.1 to ::ffff:7f00:1
+	const [, high, low] =
+		host.match(/^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/) ?? [];
+	if (!high || !low) return false;
+	return isPrivateIpv4(
+		Number.parseInt(high, 16) * 0x10000 + Number.parseInt(low, 16),
+	);
+};
+
+/** True when the URL literally points at this machine or a private network.
+ * Svix delivers from the internet, so such an endpoint could never be reached. */
+export const isLocalWebhookUrl = (url: string): boolean => {
+	let hostname: string;
+	try {
+		hostname = new URL(url).hostname.toLowerCase().replace(/\.$/, "");
+	} catch {
+		return false;
+	}
+
+	if (hostname.startsWith("[") && hostname.endsWith("]")) {
+		return isLocalIpv6(hostname.slice(1, -1));
+	}
+	if (
+		hostname === "localhost" ||
+		hostname.endsWith(".localhost") ||
+		hostname.endsWith(".local")
+	) {
+		return true;
+	}
+	const ipv4 = parseIpv4(hostname);
+	return ipv4 !== null && isPrivateIpv4(ipv4);
+};

package/src/generated/lintRules.ts

@@ -310,6 +310,10 @@ export const LINT_RULES: LintRules = {
 			minLength: 1,
 			maxLength: 64,
 		},
+		values: {
+			minLength: 1,
+			maxLength: 128,
+		},
 	},
 	"plans.billingControls.usageLimits": {
 		required: ["featureId", "interval", "limit"],
@@ -333,6 +337,10 @@ export const LINT_RULES: LintRules = {
 			minLength: 1,
 			maxLength: 64,
 		},
+		values: {
+			minLength: 1,
+			maxLength: 128,
+		},
 	},
 	"plans.freeTrial": {
 		required: ["durationLength"],
@@ -1315,6 +1323,10 @@ export const LINT_RULES: LintRules = {
 			minLength: 1,
 			maxLength: 64,
 		},
+		values: {
+			minLength: 1,
+			maxLength: 128,
+		},
 	},
 	"plans.variants.customize.billingControls.usageLimits": {
 		required: ["featureId", "interval", "limit"],
@@ -1338,6 +1350,10 @@ export const LINT_RULES: LintRules = {
 			minLength: 1,
 			maxLength: 64,
 		},
+		values: {
+			minLength: 1,
+			maxLength: 128,
+		},
 	},
 	"plans.variants.customize.freeTrial": {
 		required: ["durationLength"],
@@ -2187,4 +2203,83 @@ export const LINT_RULES: LintRules = {
 			},
 		},
 	},
+	webhooks: {
+		label: "webhook",
+		idField: "id",
+		required: ["events", "id", "url"],
+		fields: {
+			id: {
+				minLength: 1,
+				maxLength: 256,
+				pattern: "^[a-zA-Z0-9_-]+$",
+			},
+			events: {
+				minItems: 1,
+			},
+		},
+		rules: [
+			{
+				kind: "unique",
+				field: "id",
+				because:
+					"Two webhooks claiming one id race to define the same endpoint.",
+			},
+			{
+				kind: "unique",
+				field: "id",
+				asEnvName: true,
+				because:
+					"Each webhook's signing secret is saved as AUTUMN_WEBHOOK_<ID>_SECRET, so these two would overwrite each other's secret. Rename one.",
+			},
+			{
+				kind: "rejects",
+				field: "url",
+				check: "isLocalWebhookUrl",
+				because:
+					"Autumn delivers from the internet, so localhost and private-network addresses can never be reached. Use a public URL or a tunnel (e.g. ngrok).",
+			},
+			{
+				kind: "uniformPrefix",
+				field: "events",
+				prefix: "vercel.",
+				because:
+					"vercel.* events can't be mixed with other events in one webhook: they're delivered from a separate app. Make one webhook for each.",
+			},
+			{
+				kind: "nonEmpty",
+				field: "url",
+				warning: true,
+				because:
+					"With no environment key the webhook is registered nowhere. Add `live`, `sandbox` or a sandbox's slug.",
+			},
+			{
+				kind: "knownValues",
+				field: "events",
+				values: [
+					"customer.products.updated",
+					"customer.threshold_reached",
+					"balances.usage_alert_triggered",
+					"balances.limit_reached",
+					"billing.auto_topup_failed",
+					"billing.auto_topup_succeeded",
+					"billing.updated",
+					"invoice.finalized",
+					"vercel.resources.deleted",
+					"vercel.resources.provisioned",
+					"vercel.resources.rotate_secrets",
+					"vercel.webhooks.event",
+				],
+				warning: true,
+				because: "isn't known to this atmn version; the server will check it.",
+			},
+		],
+	},
+	"webhooks.url": {
+		keys: {
+			pattern: "^[a-z0-9_-]+$",
+		},
+		values: {
+			pattern: "^[Hh][Tt][Tt][Pp][Ss]:\\/\\/",
+		},
+	},
 };

package/src/generated/lintRuntime.ts

@@ -9,7 +9,8 @@
  * problem at once — a round trip per mistake is what makes one painful to write.
  */
 
-export type LintIssue = { path: string; message: string };
+/** A warning is reported but never refuses the config. */
+export type LintIssue = { path: string; message: string; warning?: true };
 
 export class ConfigError extends Error {
 	readonly issues: LintIssue[];
@@ -76,6 +77,8 @@ export type LintRule =
 			readonly field: string | readonly string[];
 			readonly alongside?: string;
 			readonly absentMeans?: string;
+			/** Compare as an env var name segment: uppercased, `-` read as `_`. */
+			readonly asEnvName?: true;
 			readonly because: string;
 	  }
 	| {
@@ -112,9 +115,35 @@ export type LintRule =
 			readonly because: string;
 	  }
 	| {
-			/** A stated `field` must be a non-empty list; `null` is not checked here. */
+			/** A stated `field` must be a non-empty list or map; `null` is not checked here. */
 			readonly kind: "nonEmpty";
 			readonly field: string;
+			/** Reported without refusing the config. */
+			readonly warning?: true;
+			readonly because: string;
+	  }
+	| {
+			/** Each name in list `field` should be one of `values`; any other is
+			 * reported, as a warning when `warning` is set. */
+			readonly kind: "knownValues";
+			readonly field: string;
+			readonly values: readonly string[];
+			readonly warning?: true;
+			readonly because: string;
+	  }
+	| {
+			/** List `field` holds names starting with `prefix` only, or none of them. */
+			readonly kind: "uniformPrefix";
+			readonly field: string;
+			readonly prefix: string;
+			readonly because: string;
+	  }
+	| {
+			/** A stated string `field`, or every value of a map `field`, must not
+			 * satisfy the named `check` the caller supplies to `lintDocument`. */
+			readonly kind: "rejects";
+			readonly field: string;
+			readonly check: string;
 			readonly because: string;
 	  }
 	| {
@@ -179,6 +208,8 @@ export type NodeRules = ShapeRules & {
 	readonly idField?: string;
 	/** Record keys are user data; the spec constrains them via `propertyNames`. */
 	readonly keys?: FieldConstraints;
+	/** A record's scalar values, constrained by its `additionalProperties`. */
+	readonly values?: FieldConstraints;
 	readonly rules?: readonly LintRule[];
 	/** anyOf/oneOf alternatives, chosen by the value of `on`. */
 	readonly variants?: {
@@ -192,6 +223,9 @@ export type NodeRules = ShapeRules & {
 /** Keyed by fixture path with array indices elided — `features.creditSchema`. */
 export type LintRules = Readonly<Record<string, NodeRules>>;
 
+/** Predicates a `rejects` rule names: code the serialised rules cannot carry. */
+export type LintChecks = Readonly<Record<string, (value: string) => boolean>>;
+
 export type LintHints = {
 	readonly recordPaths: ReadonlySet<string>;
 	readonly frozenPaths: ReadonlySet<string>;
@@ -203,6 +237,7 @@ type Walk = {
 	readonly document: Entry;
 	readonly rules: LintRules;
 	readonly hints: LintHints;
+	readonly checks: LintChecks;
 	readonly issues: LintIssue[];
 };
 
@@ -427,11 +462,13 @@ const entryRuleFailures = ({
 	rule,
 	document,
 	parent,
+	checks,
 }: {
 	entry: Entry;
 	rule: LintRule;
 	document: Entry;
 	parent?: Entry;
+	checks: LintChecks;
 }): string[] => {
 	switch (rule.kind) {
 		case "requiredWhen": {
@@ -486,8 +523,46 @@ const entryRuleFailures = ({
 		}
 		case "nonEmpty": {
 			const value = entry[rule.field];
-			if (!Array.isArray(value) || value.length > 0) return [];
-			return [`${rule.field} is empty. ${rule.because}`];
+			const empty = Array.isArray(value)
+				? value.length === 0
+				: isEntry(value) && Object.keys(value).length === 0;
+			return empty ? [`${rule.field} is empty. ${rule.because}`] : [];
+		}
+		case "knownValues": {
+			const value = entry[rule.field];
+			if (!Array.isArray(value)) return [];
+			return value
+				.filter(
+					(item): item is string =>
+						typeof item === "string" && !rule.values.includes(item),
+				)
+				.map((item) => `\`${item}\` ${rule.because}`);
+		}
+		case "uniformPrefix": {
+			const value = entry[rule.field];
+			if (!Array.isArray(value)) return [];
+			const prefixed = value.filter(
+				(item) => typeof item === "string" && item.startsWith(rule.prefix),
+			).length;
+			return prefixed === 0 || prefixed === value.length ? [] : [rule.because];
+		}
+		case "rejects": {
+			const value = entry[rule.field];
+			const check = checks[rule.check];
+			if (check === undefined) return [];
+			const stated =
+				typeof value === "string"
+					? [value]
+					: isEntry(value)
+						? Object.values(value).filter(
+								(item): item is string => typeof item === "string",
+							)
+						: [];
+			return stated
+				.filter((item) => check(item))
+				.map(
+					(item) => `${rule.field} ${show(item)} is refused. ${rule.because}`,
+				);
 		}
 		case "compare": {
 			const a = entry[rule.field];
@@ -558,7 +633,7 @@ const checkUnique = ({
 	trail,
 	issues,
 }: CollectionCheck<"unique">): void => {
-	const seen = new Set<string>();
+	const seen = new Map<string, string>();
 	for (const [index, entry] of entries.entries()) {
 		if (!isEntry(entry)) continue;
 		const value = firstValueAtPaths({ entry, paths: rule.field });
@@ -568,8 +643,22 @@ const checkUnique = ({
 		const pair =
 			rule.alongside === undefined ? undefined : entry[rule.alongside];
 		if (rule.alongside !== undefined && typeof pair !== "string") continue;
-		const composite = rule.alongside === undefined ? value : `${value}@${pair}`;
-		if (seen.has(composite)) {
+		const normalized = rule.asEnvName
+			? value.toUpperCase().replace(/-/g, "_")
+			: value;
+		const composite =
+			rule.alongside === undefined ? normalized : `${normalized}@${pair}`;
+		const first = seen.get(composite);
+		if (rule.asEnvName && first !== undefined) {
+			// Identical values are the plain unique rule's to report.
+			if (first !== value)
+				issues.push({
+					path: render([...trail, crumbFor({ node, key, entry, index })]),
+					message: `${fieldName} ${show(value)} and ${show(first)} both read as ${normalized} in an env var name. ${rule.because}`,
+				});
+			continue;
+		}
+		if (first !== undefined) {
 			const label =
 				rule.alongside === undefined
 					? `${fieldName} ${show(value)}`
@@ -579,7 +668,7 @@ const checkUnique = ({
 				message: `${label} is used more than once. ${rule.because}`,
 			});
 		}
-		seen.add(composite);
+		seen.set(composite, value);
 	}
 };
 
@@ -757,13 +846,15 @@ const checkEntry = ({
 		checkVariants({ entry, variants: node.variants, at, issues: walk.issues });
 	}
 	for (const rule of node.rules ?? []) {
+		const warning = "warning" in rule && rule.warning === true;
 		for (const message of entryRuleFailures({
 			entry,
 			rule,
 			document: walk.document,
 			parent,
+			checks: walk.checks,
 		})) {
-			walk.issues.push({ path: at, message });
+			walk.issues.push({ path: at, message, ...(warning ? { warning } : {}) });
 		}
 	}
 };
@@ -844,7 +935,17 @@ const walkValue = ({
 	// values are still ours, one level down at `path.*`.
 	if (walk.hints.recordPaths.has(path)) {
 		const keys = walk.rules[path]?.keys;
+		const values = walk.rules[path]?.values;
 		for (const [recordKey, child] of Object.entries(value)) {
+			if (values && !isEntry(child) && !Array.isArray(child)) {
+				for (const message of constraintFailures({
+					name: `${key}.${recordKey}`,
+					value: child,
+					constraints: values,
+				})) {
+					walk.issues.push({ path: render(trail), message });
+				}
+			}
 			if (keys) {
 				for (const message of constraintFailures({
 					name: `${key} key ${show(recordKey)}`,
@@ -874,12 +975,14 @@ export const lintDocument = ({
 	document,
 	rules,
 	hints,
+	checks = {},
 }: {
 	document: Record<string, unknown>;
 	rules: LintRules;
 	hints: LintHints;
+	checks?: LintChecks;
 }): LintIssue[] => {
-	const walk: Walk = { document, rules, hints, issues: [] };
+	const walk: Walk = { document, rules, hints, checks, issues: [] };
 	walkEntry({ entry: document, path: "", trail: [], walk });
 	return walk.issues;
 };

package/src/generated/sandboxName.ts

@@ -0,0 +1,52 @@
+// Copied by @autumn/atmn-generator from shared/models/orgModels/sandboxName.ts.
+// Do not edit — change that file and run `bun generate` instead.
+
+// Single source of truth for sandbox-name -> URL-slug rules, consumed by the
+// dashboard router and the server create/update guards. The reserved set mirrors
+// the top-level /sandbox/<page> route names so a slug can't shadow a real route.
+export const RESERVED_SANDBOX_SLUGS = new Set([
+	"products",
+	"customers",
+	"features",
+	"migrations",
+	"dev",
+	"analytics",
+	"settings",
+	"admin",
+	"chat",
+	"quickstart",
+	"onboarding",
+	"impersonate-redirect",
+	"trmnl",
+]);
+
+// A sandbox slug can stand in for an env name, so it must never read as one.
+const ENV_SANDBOX_SLUGS = new Set(["live", "sandbox"]);
+
+export const sandboxSlug = (name: string): string =>
+	name
+		.toLowerCase()
+		.replace(/ /g, "-")
+		.replace(/[^\w\s-]/g, "");
+
+export const SANDBOX_NAME_SPACES_MESSAGE =
+	"Name can't contain spaces. Use - or _ instead";
+
+/** Rules for a new name. Existing names that break the space rule stay valid,
+ * so callers skip this when a name is unchanged. */
+export const validateSandboxName = (name: string): string | null => {
+	if (/\s/.test(name)) {
+		return SANDBOX_NAME_SPACES_MESSAGE;
+	}
+	const slug = sandboxSlug(name);
+	if (!slug) {
+		return "Name must include at least one letter or number";
+	}
+	if (RESERVED_SANDBOX_SLUGS.has(slug)) {
+		return `"${name}" is a reserved name, pick another`;
+	}
+	if (ENV_SANDBOX_SLUGS.has(slug)) {
+		return `"${name}" is reserved for environment names, pick another`;
+	}
+	return null;
+};