atmn 2.0.33 → 2.0.35

package/src/actions/push.ts

@@ -1,6 +1,7 @@
 import { loadConfig } from "../config/loadConfig";
 import { loadEnvFiles } from "../env/loadEnv";
 import type { AutumnClient } from "../generated/client";
+import type { LintIssue } from "../generated/lintRuntime";
 import { splitWire } from "../generated/wire";
 import { resolveProject } from "../project/resolveProject";
 import {
@@ -19,7 +20,11 @@ import {
 	deprecatedUsesIn,
 	renderDeprecatedUses,
 } from "./push/deprecatedFields";
+import { PushLanesError, settleLanes } from "./push/pushLanesError";
 import { withSettingsScopeHint } from "./sandbox/withSandboxScopeHint";
+import { applyWebhooks } from "./webhooks/applyWebhooks";
+import { previewWebhooks, type WebhooksLane } from "./webhooks/previewWebhooks";
+import type { WebhookEnv } from "./webhooks/types/webhookEnv";
 
 export type PushResult = {
 	configPath: string;
@@ -27,6 +32,8 @@ export type PushResult = {
 	/** Absent on a dry run, or when the preview showed nothing to do. */
 	applied?: unknown;
 	migrationIds: string[];
+	/** The catalog preview waits on settings: a dry run shows no catalog at all. */
+	catalogDeferred?: boolean;
 };
 
 /** The settings lane of one push: absent when the config states no `settings`. */
@@ -54,6 +61,8 @@ export type PushOptions = {
 	/** Where to write progress. Injected so tests can capture it. */
 	write?: (text: string) => void;
 	migrationLinkBase?: string;
+	/** The target env for the webhook lane; resolved only when the config states webhooks. */
+	webhookEnv?: () => Promise<WebhookEnv>;
 };
 
 type RewardBody = { id?: string; internal_id?: string };
@@ -185,71 +194,94 @@ export const configSearchDirs = ({
 	return [...new Set([project.configDir, cwd, ...project.envDirs])];
 };
 
+/** A preview that never saw the catalog must not read as clean. */
+export const pushExitCode = ({
+	apply,
+	result,
+}: {
+	apply: boolean;
+	result: Pick<PushResult, "catalogDeferred">;
+}): number => (!apply && result.catalogDeferred === true ? 1 : 0);
+
+/** Why the catalog is missing from the preview, and what `--yes` does about it. */
+const renderCatalogDeferral = ({ error }: { error: unknown }): string =>
+	[
+		"Catalog: not previewed yet. It depends on the settings above, so it is previewed again once they apply.",
+		`  Against the current settings it fails: ${error instanceof Error ? error.message : String(error)}`,
+		"  With --yes: settings apply, then the catalog is previewed again and applied if that preview passes.",
+	].join("\n");
+
+/** A lint warning never refuses the config; it is printed above the preview. */
+const renderLintWarnings = ({ warnings }: { warnings: LintIssue[] }): string =>
+	warnings
+		.map((warning) => `⚠ ${warning.path}\n  ${warning.message}`)
+		.join("\n");
+
 /**
- * Preview, then apply. The CLI decides nothing here — it sends the same
- * document twice and renders what comes back, which is why a clean preview is
- * a real guarantee rather than a guess.
+ * A flag like multi_currency changes what the catalog accepts, so after a
+ * settings write the catalog is previewed again against the settings as they
+ * now are. The catalog preview to apply comes back.
  */
-export const runPush = async ({
+const applySettings = async ({
 	client,
-	cwd = process.cwd(),
-	configPath: configFlag,
-	dryRun = false,
-	write = (text) => process.stdout.write(text),
+	settingsBody,
+	settings,
+	catalogPreview,
+	wire,
+	write,
 	migrationLinkBase,
-}: PushOptions): Promise<PushResult> => {
-	const project = resolveProject({ cwd, configFlag });
-	const dirs = configSearchDirs({ cwd, configPath: configFlag });
-	loadEnvFiles({ dirs: project.envDirs });
-
-	const { path: configPath, wire: document } = await loadConfig({
-		dirs,
-		...(project.configPath === null ? {} : { configPath: project.configPath }),
-	});
-	// One document, two operations: the catalog and each singleton go their own way.
-	const { catalog: wire, singletons } = splitWire(document);
-
-	const deprecated = deprecatedUsesIn({ wire });
-	if (deprecated.length > 0)
-		write(`${renderDeprecatedUses({ uses: deprecated })}\n\n`);
-
-	// Settings go first, on their own: a flag like multi_currency changes what
-	// the catalog accepts, so the catalog is previewed against the settings as
-	// they will be, and a settings write can never fail on the catalog's account.
-	const settingsBody = singletons.settings;
-	const settings = await previewSettings({ client, body: settingsBody });
-	const settingsWork =
-		settingsBody !== undefined && settingsHaveWork({ settings });
-	if (settingsWork) {
-		write(`${renderPreview({ preview: { settings } })}\n`);
-		if (!dryRun) {
-			try {
-				await client.updateOrganization(settingsBody);
-			} catch (error) {
-				throw withSettingsScopeHint({ error });
-			}
-			write("\nApplied settings.\n\n");
-		}
+	catalogDeferred,
+}: {
+	client: AutumnClient;
+	settingsBody: Record<string, unknown> | undefined;
+	settings: SettingsPreview | undefined;
+	catalogPreview: CatalogPreview;
+	wire: Record<string, unknown>;
+	write: (text: string) => void;
+	migrationLinkBase?: string;
+	/** The catalog was never shown: its re-preview is printed, and a failure names what was left unapplied. */
+	catalogDeferred: boolean;
+}): Promise<CatalogPreview> => {
+	if (settingsBody === undefined || !settingsHaveWork({ settings }))
+		return catalogPreview;
+	try {
+		await client.updateOrganization(settingsBody);
+	} catch (error) {
+		throw withSettingsScopeHint({ error });
 	}
-
-	const catalogPreview = (await client.previewUpdate(wire)) as CatalogPreview;
-	// The settings lane is already printed when it applied; the unmanaged
-	// notes still belong beside the catalog's own rows.
-	const preview: CatalogPreview = {
-		...catalogPreview,
-		...(settingsWork ? {} : { settings }),
-	};
-
-	write(`${renderPreview({ preview, migrationLinkBase })}\n`);
-
-	const renameHint = possibleRenameHint({ preview, wire: wire as WireLike });
-	if (renameHint !== null) write(`${renameHint}\n\n`);
-
-	const fullPreview: CatalogPreview = { ...catalogPreview, settings };
-	if (previewIsEmpty({ preview: catalogPreview })) {
-		return { configPath, preview: fullPreview, migrationIds: [] };
+	write("\nApplied settings.\n");
+	let preview: CatalogPreview;
+	try {
+		preview = (await client.previewUpdate(wire)) as CatalogPreview;
+	} catch (error) {
+		if (!catalogDeferred) throw error;
+		throw new Error(
+			`Applied settings, but the catalog still fails its preview, so the catalog and webhooks were not applied:\n  ${error instanceof Error ? error.message : String(error)}`,
+			{ cause: error },
+		);
 	}
-	if (dryRun) return { configPath, preview: fullPreview, migrationIds: [] };
+	if (catalogDeferred)
+		write(`\n${renderPreview({ preview, migrationLinkBase })}\n`);
+	return preview;
+};
+
+/** Apply the catalog preview settings left behind, when it has work. */
+const applyCatalog = async ({
+	client,
+	preview,
+	wire,
+	configPath,
+	write,
+	migrationLinkBase,
+}: {
+	client: AutumnClient;
+	preview: CatalogPreview;
+	wire: Record<string, unknown>;
+	configPath: string;
+	write: (text: string) => void;
+	migrationLinkBase?: string;
+}): Promise<{ applied?: unknown; migrationIds: string[] }> => {
+	if (previewIsEmpty({ preview })) return { migrationIds: [] };
 
 	const applied = (await client.update(wire)) as {
 		migrations?: { id?: string }[];
@@ -289,6 +321,134 @@ export const runPush = async ({
 	if (backfilled.length > 0 || slugged.length > 0) {
 		write(backfillSummary({ backfilled, slugged }));
 	}
+	return { applied, migrationIds };
+};
+
+/**
+ * Preview, then apply. The CLI decides nothing here — it sends the same
+ * document twice and renders what comes back, which is why a clean preview is
+ * a real guarantee rather than a guess.
+ *
+ * Settings, catalog and webhooks preview together and render as one; every
+ * failing lane is reported at once. Applying runs settings → catalog as one
+ * chain and webhooks → secrets beside it.
+ */
+export const runPush = async ({
+	client,
+	cwd = process.cwd(),
+	configPath: configFlag,
+	dryRun = false,
+	write = (text) => process.stdout.write(text),
+	migrationLinkBase,
+	webhookEnv,
+}: PushOptions): Promise<PushResult> => {
+	const project = resolveProject({ cwd, configFlag });
+	const dirs = configSearchDirs({ cwd, configPath: configFlag });
+	loadEnvFiles({ dirs: project.envDirs });
+
+	const { path: configPath, wire: document } = await loadConfig({
+		dirs,
+		...(project.configPath === null ? {} : { configPath: project.configPath }),
+	});
+	// One document, three destinations: the catalog, each singleton and each synced list.
+	const { catalog: wire, singletons, lists, warnings } = splitWire(document);
+	if (warnings.length > 0) write(`${renderLintWarnings({ warnings })}\n\n`);
+
+	const deprecated = deprecatedUsesIn({ wire });
+	if (deprecated.length > 0)
+		write(`${renderDeprecatedUses({ uses: deprecated })}\n\n`);
+
+	const settingsBody = singletons.settings;
+	const previews = await settleLanes<{
+		settings: SettingsPreview | undefined;
+		catalog: CatalogPreview;
+		webhooks: WebhooksLane | undefined;
+	}>({
+		settings: previewSettings({ client, body: settingsBody }),
+		catalog: client.previewUpdate(wire) as Promise<CatalogPreview>,
+		webhooks: previewWebhooks({
+			client,
+			rows: lists.webhooks,
+			webhookEnv,
+		}),
+	});
+	const { settings, webhooks } = previews.values;
+	// A catalog that needs a pending setting (multi_currency, say) can only be
+	// previewed once that setting applies: its error waits for the re-preview.
+	const catalogDeferral =
+		settingsBody !== undefined && settingsHaveWork({ settings })
+			? previews.failures.find((failure) => failure.lane === "catalog")
+			: undefined;
+	const failures = previews.failures.filter(
+		(failure) => failure !== catalogDeferral,
+	);
+	if (failures.length > 0)
+		throw new PushLanesError({ stage: "preview", failures });
+	const catalogPreview = previews.values.catalog ?? {};
 
-	return { configPath, preview: fullPreview, applied, migrationIds };
+	const preview: CatalogPreview = {
+		...catalogPreview,
+		settings,
+		...(webhooks === undefined ? {} : { webhooks: webhooks.preview }),
+	};
+	write(`${renderPreview({ preview, migrationLinkBase })}\n`);
+	if (catalogDeferral !== undefined)
+		write(`\n${renderCatalogDeferral({ error: catalogDeferral.error })}\n`);
+
+	const renameHint = possibleRenameHint({ preview, wire: wire as WireLike });
+	if (renameHint !== null) write(`${renameHint}\n\n`);
+
+	const catalogDeferred = catalogDeferral !== undefined;
+	if (dryRun || previewIsEmpty({ preview }))
+		return { configPath, preview, migrationIds: [], catalogDeferred };
+
+	const settingsStep = () =>
+		applySettings({
+			client,
+			settingsBody,
+			settings,
+			catalogPreview,
+			wire,
+			write,
+			migrationLinkBase,
+			catalogDeferred,
+		});
+	const catalogStep = (previewAfterSettings: CatalogPreview) =>
+		applyCatalog({
+			client,
+			preview: previewAfterSettings,
+			wire,
+			configPath,
+			write,
+			migrationLinkBase,
+		});
+	// A deferred catalog is unproven until settings apply: webhooks wait on its
+	// re-preview. Otherwise settings → catalog runs beside the webhooks sync.
+	const settled = catalogDeferred ? await settingsStep() : undefined;
+	const applied = await settleLanes<{
+		catalog: { applied?: unknown; migrationIds: string[] };
+		webhooks: unknown;
+	}>({
+		catalog:
+			settled === undefined
+				? settingsStep().then(catalogStep)
+				: catalogStep(settled),
+		webhooks: applyWebhooks({
+			client,
+			lane: webhooks,
+			envDirs: project.envDirs,
+			cwd,
+			write,
+		}),
+	});
+	if (applied.failures.length > 0)
+		throw new PushLanesError({ stage: "apply", failures: applied.failures });
+
+	return {
+		configPath,
+		preview,
+		applied: applied.values.catalog?.applied,
+		migrationIds: applied.values.catalog?.migrationIds ?? [],
+		catalogDeferred,
+	};
 };

package/src/actions/webhooks/applyWebhooks.ts

@@ -0,0 +1,52 @@
+import type { AutumnClient } from "../../generated/client";
+import { webhooksHaveWork } from "../../render/renderWebhooks";
+import type { WebhooksLane } from "./previewWebhooks";
+import { writeWebhookSecrets } from "./writeWebhookSecrets";
+
+/**
+ * Sync, then save every secret it returned — before reporting any per-item
+ * failure, since a created webhook's secret is shown once and only here.
+ */
+export const applyWebhooks = async ({
+	client,
+	lane,
+	envDirs,
+	cwd,
+	write,
+}: {
+	client: AutumnClient;
+	lane: WebhooksLane | undefined;
+	envDirs: string[];
+	cwd: string;
+	write: (text: string) => void;
+}): Promise<void> => {
+	if (lane === undefined || !webhooksHaveWork({ webhooks: lane.preview }))
+		return;
+	const result = await client.syncWebhooks(lane.body);
+	const saved = await writeWebhookSecrets({
+		secrets: result.secrets,
+		env: lane.env,
+		envDirs,
+		cwd,
+	});
+	// A secret means the server created the webhook after all (its dashboard
+	// twin moved since the preview): only the rest were adopted.
+	const failed = new Set([
+		...result.errors.map(({ id }) => id),
+		...result.secrets.map(({ id }) => id),
+	]);
+	// An adopted webhook keeps its signing secret, so nothing is written for it.
+	const adopted = lane.preview.changes
+		.filter((change) => change.action === "adopt" && !failed.has(change.id))
+		.map(
+			(change) =>
+				`Adopted ${change.id} (existing dashboard webhook); its signing secret is unchanged, nothing written`,
+		);
+	write(
+		`\nApplied webhooks.\n${[...adopted, ...saved].map((line) => `${line}\n`).join("")}`,
+	);
+	if (result.errors.length > 0)
+		throw new Error(
+			result.errors.map(({ id, message }) => `${id}: ${message}`).join("\n"),
+		);
+};

package/src/actions/webhooks/isDashboardWebhook.ts

@@ -0,0 +1,9 @@
+/** Svix's own endpoint id: `ep_` and a 27-character KSUID. */
+const SVIX_ENDPOINT_ID = /^ep_[0-9A-Za-z]{27}$/;
+
+/**
+ * A webhook made in the dashboard has no id of ours, so the API lists it under
+ * Svix's endpoint id. A config never manages one.
+ */
+export const isDashboardWebhook = ({ id }: { id: string }): boolean =>
+	SVIX_ENDPOINT_ID.test(id);

package/src/actions/webhooks/newWebhookId.ts

@@ -0,0 +1,4 @@
+import { generateKsuid } from "@autumn/ksuid";
+
+/** The shape the server's `generateId("wh")` mints: `wh_` and a KSUID. */
+export const newWebhookId = (): string => generateKsuid({ prefix: "wh_" });

package/src/actions/webhooks/previewWebhooks.ts

@@ -0,0 +1,40 @@
+import type { AutumnClient, SyncWebhooksParams } from "../../generated/client";
+import type { WebhooksPreview } from "../../render/renderWebhooks";
+import { resolveWebhooksForEnv } from "./resolveWebhooksForEnv";
+import type { WebhookEnv } from "./types/webhookEnv";
+
+export type WebhooksLane = {
+	preview: WebhooksPreview;
+	/** Exactly what the preview was asked about, so the sync applies the same set. */
+	body: SyncWebhooksParams;
+	env: WebhookEnv;
+};
+
+/** Absent when the config states no `webhooks`: an omitted list manages nothing. */
+export const previewWebhooks = async ({
+	client,
+	rows,
+	webhookEnv,
+}: {
+	client: AutumnClient;
+	rows: Record<string, unknown>[] | undefined;
+	webhookEnv: (() => Promise<WebhookEnv>) | undefined;
+}): Promise<WebhooksLane | undefined> => {
+	if (rows === undefined) return undefined;
+	if (webhookEnv === undefined)
+		throw new Error("webhooks need the target environment to pick each url.");
+	const env = await webhookEnv();
+	const webhooks = resolveWebhooksForEnv({
+		rows,
+		envKey: env.key,
+	});
+	const body = { webhooks };
+	const { changes, errors } = await client.previewSyncWebhooks(body);
+	// Refused items (several dashboard webhooks on one URL, say) fail the lane
+	// here, beside every other lane's errors, rather than at apply.
+	if (errors.length > 0)
+		throw new Error(
+			errors.map(({ id, message }) => `${id}: ${message}`).join("\n"),
+		);
+	return { preview: { changes }, body, env };
+};

package/src/actions/webhooks/resolveWebhookEnv.ts

@@ -0,0 +1,34 @@
+import type { Target } from "../../env/resolveTarget";
+import { sandboxSlug } from "../../generated/sandboxName";
+import type { FetchOrgInfo, OrgInfo } from "../env/types/orgInfo";
+import type { WebhookEnv } from "./types/webhookEnv";
+
+/** `/organization/me`, asked at most once per command. */
+const memoized = (fetchOrgInfo: FetchOrgInfo): FetchOrgInfo => {
+	let pending: Promise<OrgInfo> | undefined;
+	return () => {
+		pending ??= fetchOrgInfo();
+		return pending;
+	};
+};
+
+/**
+ * `-p` is `live` and the default sandbox is `sandbox`, with no lookup. A named
+ * sandbox is keyed by its slug, which only its name gives: one lookup.
+ */
+export const resolveWebhookEnv = async ({
+	target,
+	prod,
+	fetchOrgInfo,
+}: {
+	target: Target;
+	prod: boolean;
+	fetchOrgInfo: FetchOrgInfo;
+}): Promise<WebhookEnv> => {
+	const orgInfo = memoized(fetchOrgInfo);
+	const orgId = async () => (await orgInfo()).id;
+	if (prod) return { key: "live", live: true, orgId };
+	if (target.sandboxId === undefined)
+		return { key: "sandbox", live: false, orgId };
+	return { key: sandboxSlug((await orgInfo()).name), live: false, orgId };
+};

package/src/actions/webhooks/resolveWebhooksForEnv.ts

@@ -0,0 +1,29 @@
+import type { SyncWebhooksParams } from "../../generated/client";
+import { SYNCED_LISTS } from "../../generated/emit";
+
+type WebhookParams = SyncWebhooksParams["webhooks"][number];
+
+/** The config's webhooks as one environment sees them; a missing key skips the entry. */
+export const resolveWebhooksForEnv = ({
+	rows,
+	envKey,
+}: {
+	rows: Record<string, unknown>[];
+	envKey: string;
+}): WebhookParams[] => {
+	const { envKeyed } = SYNCED_LISTS.webhooks;
+	const webhooks: WebhookParams[] = [];
+	for (const row of rows) {
+		const values = envKeyed.map(
+			(field) => (row[field] as Record<string, unknown> | undefined)?.[envKey],
+		);
+		if (values.some((value) => typeof value !== "string")) continue;
+		webhooks.push({
+			...row,
+			...Object.fromEntries(
+				envKeyed.map((field, index) => [field, values[index]]),
+			),
+		} as WebhookParams);
+	}
+	return webhooks;
+};

package/src/actions/webhooks/types/webhookEnv.ts

@@ -0,0 +1,9 @@
+/** The environment a push or pull addresses, as the webhook lane needs it. */
+export type WebhookEnv = {
+	/** The `url` map key: `live`, `sandbox`, or the targeted sandbox's slug. */
+	key: string;
+	/** Prod secrets go to `.env.prod` without an org suffix. */
+	live: boolean;
+	/** The target org's id, looked up only when a secret needs naming. */
+	orgId: () => Promise<string>;
+};

package/src/actions/webhooks/webhookSecretName.ts

@@ -0,0 +1,22 @@
+/** `-` reads as `_`, so the lint refuses two ids that collide once uppercased. */
+const envNameSegment = (value: string): string =>
+	value.toUpperCase().replace(/-/g, "_");
+
+/**
+ * Prod: `AUTUMN_WEBHOOK_<ID>_SECRET`. A sandbox adds the first four characters
+ * of its org id after `org_`, so every sandbox's secret can sit in one `.env`.
+ */
+export const webhookSecretName = ({
+	id,
+	orgId,
+}: {
+	id: string;
+	/** Absent for prod. */
+	orgId?: string;
+}): string => {
+	const org4 =
+		orgId === undefined
+			? ""
+			: `_${envNameSegment(orgId.replace(/^org_/, "").slice(0, 4))}`;
+	return `AUTUMN_WEBHOOK_${envNameSegment(id)}${org4}_SECRET`;
+};

package/src/actions/webhooks/writeWebhookSecrets.ts

@@ -0,0 +1,55 @@
+import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { dirname, join, relative } from "node:path";
+import {
+	findEnvFile,
+	upsertEnvContent,
+	writeEnvValues,
+} from "../../env/loadEnv";
+import type { WebhookEnv } from "./types/webhookEnv";
+import { webhookSecretName } from "./webhookSecretName";
+
+const PROD_ENV_FILE = ".env.prod";
+
+/** Beside the env file atmn reads first, so a project keeps its env files together. */
+const prodEnvPath = ({ envDirs }: { envDirs: string[] }): string => {
+	const nearest = findEnvFile({ dirs: envDirs });
+	return join(
+		nearest === undefined ? (envDirs[0] ?? process.cwd()) : dirname(nearest),
+		PROD_ENV_FILE,
+	);
+};
+
+/**
+ * Prod secrets go to `.env.prod`; a sandbox's go where atmn writes its keys
+ * (`.env.local`, else `.env`). One printed line per secret: its name and file.
+ */
+export const writeWebhookSecrets = async ({
+	secrets,
+	env,
+	envDirs,
+	cwd,
+}: {
+	secrets: { id: string; secret: string }[];
+	env: WebhookEnv;
+	envDirs: string[];
+	cwd: string;
+}): Promise<string[]> => {
+	if (secrets.length === 0) return [];
+	const orgId = env.live ? undefined : await env.orgId();
+	const values = Object.fromEntries(
+		secrets.map(({ id, secret }) => [webhookSecretName({ id, orgId }), secret]),
+	);
+	let path: string;
+	if (env.live) {
+		path = prodEnvPath({ envDirs });
+		const content = existsSync(path) ? readFileSync(path, "utf8") : "";
+		// A new prod file holds a live signing secret: owner-only from the start.
+		writeFileSync(path, upsertEnvContent({ content, values }), { mode: 0o600 });
+	} else {
+		path = writeEnvValues({ dirs: envDirs, values });
+	}
+	const file = relative(cwd, path) || path;
+	return Object.keys(values).map(
+		(name) => `Saved webhook secret as ${name} in ${file}`,
+	);
+};

package/src/cli.ts

@@ -14,7 +14,7 @@ import {
 	runKeylessLogin,
 } from "./actions/login/keyless";
 import { runPull } from "./actions/pull";
-import { runPush } from "./actions/push";
+import { pushExitCode, runPush } from "./actions/push";
 import { runReset } from "./actions/reset/runReset";
 import { runSandboxCreate } from "./actions/sandbox/createSandbox";
 import { runSandboxDelete } from "./actions/sandbox/deleteSandbox";
@@ -31,6 +31,7 @@ import {
 	staleSkillsHint,
 	updateSkills,
 } from "./actions/skills/skills";
+import { resolveWebhookEnv } from "./actions/webhooks/resolveWebhookEnv";
 import { configPackageName } from "./config/configPackageName";
 import { assertSandboxTarget } from "./env/assertSandboxTarget";
 import { loadEnvFiles } from "./env/loadEnv";
@@ -204,6 +205,20 @@ const pinnedSandboxName = async ({
 	}
 };
 
+/** The env a push or pull's webhook lane addresses, resolved only when asked. */
+const webhookEnvFor =
+	({ target, command }: { target: Target; command: Command }) =>
+	() =>
+		resolveWebhookEnv({
+			target,
+			prod: command.optsWithGlobals<GlobalFlags>().prod === true,
+			fetchOrgInfo: () =>
+				fetchOrgInfo({
+					baseUrl: targetBaseUrl({ target }),
+					secretKey: requireSecretKey({ target }),
+				}),
+		});
+
 /** `/organization/me` for the main key: what `sandbox use` and `init` report the org as. */
 const mainOrgInfo = ({ target }: { target: Target }) => {
 	const main = managementTarget({ target });
@@ -389,7 +404,10 @@ Linking a keyless org to an account:
 					client: clientFor({ target }),
 					configPath: configFlagOf({ command }),
 					dryRun: !apply,
+					webhookEnv: webhookEnvFor({ target, command }),
 				});
+				// A dry run that never saw the catalog must not read as clean.
+				process.exitCode = pushExitCode({ apply, result });
 				if (!apply && !previewIsEmpty({ preview: result.preview }))
 					process.stdout.write(
 						options.dryRun === true
@@ -482,6 +500,7 @@ Linking a keyless org to an account:
 					overwrite: options.overwrite === true,
 					yes: options.yes === true,
 					prompter: prompterFor({ command }),
+					webhookEnv: webhookEnvFor({ target, command }),
 				});
 				writeStaleSkillsHint({ command });
 			},

package/src/config/loadConfig.ts

@@ -122,6 +122,9 @@ const importConfigModule = async ({
 	const result = spawnSync(process.execPath, importConfigArgs({ path }), {
 		cwd: dirname(path),
 		encoding: "utf8",
+		// Bun hands a child its startup env, not process.env: without this, a
+		// config reading a value atmn loaded from .env sees undefined.
+		env: process.env,
 	});
 	if (result.status !== 0 || result.stdout.length === 0) {
 		throw new Error(result.stderr.trim() || `Failed to load ${path}`);