atmn 2.0.41 → 2.0.43

package/dist/index.js

@@ -2234,28 +2234,38 @@ var LINT_RULES = {
   webhooks: {
     label: "webhook",
     idField: "id",
-    required: ["events", "id", "url"],
+    required: ["env", "id", "url"],
     fields: {
       id: {
         minLength: 1,
         maxLength: 256,
         pattern: "^[a-zA-Z0-9_-]+$"
       },
-      events: {
-        minItems: 1
+      env: {
+        pattern: "^[a-z0-9_-]+$"
+      },
+      url: {
+        pattern: "^[Hh][Tt][Tt][Pp][Ss]:\\/\\/"
       }
     },
     rules: [
+      {
+        kind: "notMap",
+        field: "url",
+        because: 'Each webhook() is one endpoint in one env: split into one webhook() per env, e.g. webhook({ id, env: "live", url }).'
+      },
       {
         kind: "unique",
         field: "id",
-        because: "Two webhooks claiming one id race to define the same endpoint."
+        alongside: "env",
+        because: "Two webhooks claiming one id in one env race to define the same endpoint."
       },
       {
         kind: "unique",
         field: "id",
+        alongside: "env",
         asEnvName: true,
-        because: "Each webhook's signing secret is saved as AUTUMN_WEBHOOK_<ID>_SECRET, so these two would overwrite each other's secret. Rename one."
+        because: "Each webhook's signing secret is saved under its id in an env var name, so these two would overwrite each other's secret. Rename one."
       },
       {
         kind: "rejects",
@@ -2269,12 +2279,6 @@ var LINT_RULES = {
         prefix: "vercel.",
         because: "vercel.* events can't be mixed with other events in one webhook: they're delivered from a separate app. Make one webhook for each."
       },
-      {
-        kind: "nonEmpty",
-        field: "url",
-        warning: true,
-        because: "With no environment key the webhook is registered nowhere. Add `live`, `sandbox` or a sandbox's slug."
-      },
       {
         kind: "knownValues",
         field: "events",
@@ -2296,14 +2300,6 @@ var LINT_RULES = {
         because: "isn't known to this atmn version; the server will check it."
       }
     ]
-  },
-  "webhooks.url": {
-    keys: {
-      pattern: "^[a-z0-9_-]+$"
-    },
-    values: {
-      pattern: "^[Hh][Tt][Tt][Pp][Ss]:\\/\\/"
-    }
   }
 };
 
@@ -2524,6 +2520,10 @@ var entryRuleFailures = ({
         return [];
       return value.filter((item) => typeof item === "string" && !rule.values.includes(item)).map((item) => `\`${item}\` ${rule.because}`);
     }
+    case "notMap": {
+      const value = entry[rule.field];
+      return isEntry(value) ? [`${rule.field} is a map. ${rule.because}`] : [];
+    }
     case "uniformPrefix": {
       const value = entry[rule.field];
       if (!Array.isArray(value))
@@ -3014,8 +3014,7 @@ var CATALOG_HINTS = hintsOf({
     "plans.variants.customize.upsertLicenses.customize.addItems.featureOverride.creditSchema.multipliers",
     "plans.variants.customize.upsertLicenses.customize.addItems.featureOverride.creditSchema.multipliers.*.match",
     "plans.variants.customize.upsertLicenses.customize.addItems.featureOverride.markups.modelMarkups",
-    "plans.variants.customize.upsertLicenses.customize.addItems.featureOverride.markups.providerMarkups",
-    "webhooks.url"
+    "plans.variants.customize.upsertLicenses.customize.addItems.featureOverride.markups.providerMarkups"
   ],
   frozenPaths: [
     "plans.licenses.metadata",

package/dist/tsconfig.tsbuildinfo

@@ -1 +1 @@
-{"version":"7.0.0-dev.20260511.1","root":["../src/bin.ts","../src/cli.ts","../src/index.ts","../src/version.ts","../src/actions/env.ts","../src/actions/login.ts","../src/actions/pull.ts","../src/actions/push.ts","../src/actions/api/callApi.ts","../src/actions/api/registerApiCommands.ts","../src/actions/env/fetchOrgInfo.ts","../src/actions/env/types/orgInfo.ts","../src/actions/init/runInit.ts","../src/actions/login/keyless.ts","../src/actions/pull/appendPlanVersionFixture.ts","../src/actions/pull/applyMappings.ts","../src/actions/pull/applyPreview.ts","../src/actions/pull/applySettingsPreview.ts","../src/actions/pull/changedFixtureKeys.ts","../src/actions/pull/elementStatesPlanId.ts","../src/actions/pull/listSourceFiles.ts","../src/actions/pull/locateFixture.ts","../src/actions/pull/pruneUnpulledPlanIds.ts","../src/actions/pull/resolveCollectionTarget.ts","../src/actions/pull/rewriteConfig.ts","../src/actions/pull/scaffoldConfig.ts","../src/actions/pull/webhooks/appendWebhook.ts","../src/actions/pull/webhooks/applyWebhooksPull.ts","../src/actions/pull/webhooks/locateWebhook.ts","../src/actions/pull/webhooks/readWebhookEnvs.ts","../src/actions/pull/webhooks/removeWebhookEnv.ts","../src/actions/pull/webhooks/types.ts","../src/actions/pull/webhooks/updateWebhook.ts","../src/actions/pull/webhooks/webhookPullEnvs.ts","../src/actions/push/backfillInternalIds.ts","../src/actions/push/deprecatedFields.ts","../src/actions/push/pushLanesError.ts","../src/actions/reset/runReset.ts","../src/actions/sandbox/createSandbox.ts","../src/actions/sandbox/deleteSandbox.ts","../src/actions/sandbox/listSandboxes.ts","../src/actions/sandbox/useSandbox.ts","../src/actions/sandbox/withSandboxScopeHint.ts","../src/actions/sandbox/types/sandboxClient.ts","../src/actions/skills/ignoreBundledSkills.ts","../src/actions/skills/skills.ts","../src/actions/webhooks/applyWebhooks.ts","../src/actions/webhooks/isDashboardWebhook.ts","../src/actions/webhooks/newWebhookId.ts","../src/actions/webhooks/previewWebhooks.ts","../src/actions/webhooks/resolveWebhookEnv.ts","../src/actions/webhooks/resolveWebhooksForEnv.ts","../src/actions/webhooks/webhookSecretName.ts","../src/actions/webhooks/writeWebhookSecrets.ts","../src/actions/webhooks/types/webhookEnv.ts","../src/auth/announceAuthorizationUrl.ts","../src/auth/buildAuthorizationUrl.ts","../src/auth/callbackPages.ts","../src/auth/createOrgApiKeys.ts","../src/auth/keyless.ts","../src/auth/oauthConfig.ts","../src/auth/runOAuthFlow.ts","../src/auth/browser/openSystemBrowser.ts","../src/auth/browser/tryOpenBrowser.ts","../src/auth/browser/watchLauncher.ts","../src/auth/types/browserOpener.ts","../src/auth/types/impersonationTokens.ts","../src/auth/types/oauthTokens.ts","../src/auth/types/orgApiKeys.ts","../src/config/configPackageName.ts","../src/config/legacyConfig.ts","../src/config/loadConfig.ts","../src/env/assertSandboxTarget.ts","../src/env/loadEnv.ts","../src/env/resolveTarget.ts","../src/env/sandboxKeyName.ts","../src/generated/apiRoutes.ts","../src/generated/client.ts","../src/generated/emit.ts","../src/generated/emitRuntime.ts","../src/generated/features.ts","../src/generated/isLocalWebhookUrl.ts","../src/generated/labels.ts","../src/generated/licenses.ts","../src/generated/lintRules.ts","../src/generated/lintRuntime.ts","../src/generated/mappingAssignments.ts","../src/generated/plans.ts","../src/generated/referralPrograms.ts","../src/generated/rewards.ts","../src/generated/sandboxName.ts","../src/generated/settings.ts","../src/generated/skills.ts","../src/generated/variants.ts","../src/generated/webhooks.ts","../src/generated/wire.ts","../src/http/autumnFetch.ts","../src/project/chooseConfigDir.ts","../src/project/resolveProject.ts","../src/project/rootMarker.ts","../src/prompt/prompt.ts","../src/prompt/select.ts","../src/render/renderEnv.ts","../src/render/renderPreview.ts","../src/render/renderSandboxes.ts","../src/render/renderWebhooks.ts","../src/render/stripTerminalControls.ts","../src/repo/findRepoRoot.ts","../src/surgery/appendPropertyEdit.ts","../src/surgery/appendToArray.ts","../src/surgery/appendToBinding.ts","../src/surgery/appendToCollection.ts","../src/surgery/appendToFixtureArray.ts","../src/surgery/arrayBinding.ts","../src/surgery/deleteFixtureLiteral.ts","../src/surgery/deleteReference.ts","../src/surgery/ensureBuilderImport.ts","../src/surgery/findFixture.ts","../src/surgery/fixtureEdit.ts","../src/surgery/fixtureLocation.ts","../src/surgery/insertCollection.ts","../src/surgery/insertFirstProperty.ts","../src/surgery/patchFixturePaths.ts","../src/surgery/patchFixtureProperty.ts","../src/surgery/patchSingletonProperty.ts","../src/surgery/readFixtureValue.ts","../src/surgery/replaceFixture.ts","../src/surgery/setFixtureProperty.ts","../src/surgery/staticFixtureRule.ts","../test/apiCommand.test.ts","../test/authorizationUrl.test.ts","../test/autumnFetch.test.ts","../test/backfill.test.ts","../test/backfillInlineVariants.test.ts","../test/backfillSlug.test.ts","../test/backfillVariants.test.ts","../test/chooseConfigDir.test.ts","../test/cliTargetFlags.test.ts","../test/client.test.ts","../test/configPackageName.test.ts","../test/emitFixture.test.ts","../test/env.test.ts","../test/envWriter.test.ts","../test/ignoreBundledSkills.test.ts","../test/init.test.ts","../test/keyless.test.ts","../test/legacyConfig.test.ts","../test/lintDocument.test.ts","../test/loadConfigNode.test.ts","../test/loadConfigV2.test.ts","../test/locateFixtureUnique.test.ts","../test/login.test.ts","../test/nodeNextTypes.test.ts","../test/patchFixturePaths.test.ts","../test/plans.test.ts","../test/previewIsEmpty.test.ts","../test/prompt.test.ts","../test/pull.test.ts","../test/pullByReference.test.ts","../test/pullFieldLevel.test.ts","../test/pullMappings.test.ts","../test/pullOmitDefaults.test.ts","../test/pullPlans.test.ts","../test/pullStatesSlugs.test.ts","../test/pullTwoCollections.test.ts","../test/readFixtureValue.test.ts","../test/renameHint.test.ts","../test/renderPreview.test.ts","../test/renderSandboxes.test.ts","../test/renderSettings.test.ts","../test/reset.test.ts","../test/resolveCollectionTarget.test.ts","../test/resolveProject.test.ts","../test/resolveTarget.test.ts","../test/sandboxActions.test.ts","../test/sandboxKeyName.test.ts","../test/sandboxUse.test.ts","../test/settingsActions.test.ts","../test/settingsWire.test.ts","../test/skills.test.ts","../test/watchLauncher.test.ts","../test/wireDocument.test.ts","../test/helpers/targetFor.ts","../test/surgery/appendToCollection.test.ts","../test/surgery/deleteFixtureLiteral.test.ts","../test/surgery/deleteReference.test.ts","../test/surgery/findFixture.test.ts","../test/surgery/fixtureLocation.test.ts","../test/surgery/insertCollection.test.ts","../test/surgery/insertFirstProperty.test.ts","../test/surgery/patchFixtureProperty.test.ts","../test/surgery/patchSingletonProperty.test.ts","../test/surgery/replaceFixture.test.ts","../test/surgery/staticFixtureRule.test.ts","../test/webhooks/webhooksEnv.test.ts","../test/webhooks/webhooksLint.test.ts","../test/webhooks/webhooksPull.test.ts","../test/webhooks/webhooksPullEnvs.test.ts","../test/webhooks/webhooksPush.test.ts"]}
+{"version":"7.0.0-dev.20260511.1","root":["../src/bin.ts","../src/cli.ts","../src/index.ts","../src/version.ts","../src/actions/env.ts","../src/actions/login.ts","../src/actions/pull.ts","../src/actions/push.ts","../src/actions/api/callApi.ts","../src/actions/api/registerApiCommands.ts","../src/actions/env/fetchOrgInfo.ts","../src/actions/env/types/orgInfo.ts","../src/actions/init/runInit.ts","../src/actions/login/keyless.ts","../src/actions/pull/appendPlanVersionFixture.ts","../src/actions/pull/applyMappings.ts","../src/actions/pull/applyPreview.ts","../src/actions/pull/applySettingsPreview.ts","../src/actions/pull/changedFixtureKeys.ts","../src/actions/pull/elementStatesPlanId.ts","../src/actions/pull/listSourceFiles.ts","../src/actions/pull/locateFixture.ts","../src/actions/pull/pruneUnpulledPlanIds.ts","../src/actions/pull/resolveCollectionTarget.ts","../src/actions/pull/rewriteConfig.ts","../src/actions/pull/scaffoldConfig.ts","../src/actions/pull/webhooks/appendWebhook.ts","../src/actions/pull/webhooks/applyWebhooksPull.ts","../src/actions/pull/webhooks/deleteWebhook.ts","../src/actions/pull/webhooks/locateWebhook.ts","../src/actions/pull/webhooks/readWebhookEnvs.ts","../src/actions/pull/webhooks/types.ts","../src/actions/pull/webhooks/updateWebhook.ts","../src/actions/pull/webhooks/webhookEnvSkipWarning.ts","../src/actions/pull/webhooks/webhookPullEnvs.ts","../src/actions/push/backfillInternalIds.ts","../src/actions/push/deprecatedFields.ts","../src/actions/push/pushLanesError.ts","../src/actions/reset/runReset.ts","../src/actions/sandbox/createSandbox.ts","../src/actions/sandbox/deleteSandbox.ts","../src/actions/sandbox/listSandboxes.ts","../src/actions/sandbox/useSandbox.ts","../src/actions/sandbox/withSandboxScopeHint.ts","../src/actions/sandbox/types/sandboxClient.ts","../src/actions/skills/ignoreBundledSkills.ts","../src/actions/skills/skills.ts","../src/actions/webhooks/applyWebhooks.ts","../src/actions/webhooks/previewWebhookEnvs.ts","../src/actions/webhooks/resolveWebhooksForEnv.ts","../src/actions/webhooks/webhookEnvFailures.ts","../src/actions/webhooks/webhookSecretName.ts","../src/actions/webhooks/writeWebhookSecrets.ts","../src/actions/webhooks/types/webhookEnv.ts","../src/auth/announceAuthorizationUrl.ts","../src/auth/buildAuthorizationUrl.ts","../src/auth/callbackPages.ts","../src/auth/createOrgApiKeys.ts","../src/auth/keyless.ts","../src/auth/oauthConfig.ts","../src/auth/runOAuthFlow.ts","../src/auth/browser/openSystemBrowser.ts","../src/auth/browser/tryOpenBrowser.ts","../src/auth/browser/watchLauncher.ts","../src/auth/types/browserOpener.ts","../src/auth/types/impersonationTokens.ts","../src/auth/types/oauthTokens.ts","../src/auth/types/orgApiKeys.ts","../src/config/configPackageName.ts","../src/config/legacyConfig.ts","../src/config/loadConfig.ts","../src/env/assertSandboxTarget.ts","../src/env/loadEnv.ts","../src/env/resolveTarget.ts","../src/env/sandboxKeyName.ts","../src/generated/apiRoutes.ts","../src/generated/client.ts","../src/generated/emit.ts","../src/generated/emitRuntime.ts","../src/generated/features.ts","../src/generated/isLocalWebhookUrl.ts","../src/generated/labels.ts","../src/generated/licenses.ts","../src/generated/lintRules.ts","../src/generated/lintRuntime.ts","../src/generated/mappingAssignments.ts","../src/generated/plans.ts","../src/generated/referralPrograms.ts","../src/generated/rewards.ts","../src/generated/sandboxName.ts","../src/generated/settings.ts","../src/generated/skills.ts","../src/generated/variants.ts","../src/generated/webhooks.ts","../src/generated/wire.ts","../src/http/autumnFetch.ts","../src/project/chooseConfigDir.ts","../src/project/resolveProject.ts","../src/project/rootMarker.ts","../src/prompt/prompt.ts","../src/prompt/select.ts","../src/render/renderEnv.ts","../src/render/renderPreview.ts","../src/render/renderSandboxes.ts","../src/render/renderWebhooks.ts","../src/render/stripTerminalControls.ts","../src/repo/findRepoRoot.ts","../src/surgery/appendPropertyEdit.ts","../src/surgery/appendToArray.ts","../src/surgery/appendToBinding.ts","../src/surgery/appendToCollection.ts","../src/surgery/appendToFixtureArray.ts","../src/surgery/arrayBinding.ts","../src/surgery/deleteFixtureLiteral.ts","../src/surgery/deleteReference.ts","../src/surgery/ensureBuilderImport.ts","../src/surgery/findFixture.ts","../src/surgery/fixtureEdit.ts","../src/surgery/fixtureLocation.ts","../src/surgery/insertCollection.ts","../src/surgery/insertFirstProperty.ts","../src/surgery/patchFixturePaths.ts","../src/surgery/patchFixtureProperty.ts","../src/surgery/patchSingletonProperty.ts","../src/surgery/readFixtureValue.ts","../src/surgery/replaceFixture.ts","../src/surgery/setFixtureProperty.ts","../src/surgery/staticFixtureRule.ts","../test/apiCommand.test.ts","../test/authorizationUrl.test.ts","../test/autumnFetch.test.ts","../test/backfill.test.ts","../test/backfillInlineVariants.test.ts","../test/backfillSlug.test.ts","../test/backfillVariants.test.ts","../test/chooseConfigDir.test.ts","../test/cliTargetFlags.test.ts","../test/client.test.ts","../test/configPackageName.test.ts","../test/emitFixture.test.ts","../test/env.test.ts","../test/envWriter.test.ts","../test/ignoreBundledSkills.test.ts","../test/init.test.ts","../test/keyless.test.ts","../test/legacyConfig.test.ts","../test/lintDocument.test.ts","../test/loadConfigNode.test.ts","../test/loadConfigV2.test.ts","../test/locateFixtureUnique.test.ts","../test/login.test.ts","../test/nodeNextTypes.test.ts","../test/patchFixturePaths.test.ts","../test/plans.test.ts","../test/previewIsEmpty.test.ts","../test/prompt.test.ts","../test/pull.test.ts","../test/pullByReference.test.ts","../test/pullFieldLevel.test.ts","../test/pullMappings.test.ts","../test/pullOmitDefaults.test.ts","../test/pullPlans.test.ts","../test/pullStatesSlugs.test.ts","../test/pullTwoCollections.test.ts","../test/readFixtureValue.test.ts","../test/renameHint.test.ts","../test/renderPreview.test.ts","../test/renderSandboxes.test.ts","../test/renderSettings.test.ts","../test/reset.test.ts","../test/resolveCollectionTarget.test.ts","../test/resolveProject.test.ts","../test/resolveTarget.test.ts","../test/sandboxActions.test.ts","../test/sandboxKeyName.test.ts","../test/sandboxUse.test.ts","../test/settingsActions.test.ts","../test/settingsWire.test.ts","../test/skills.test.ts","../test/watchLauncher.test.ts","../test/wireDocument.test.ts","../test/helpers/targetFor.ts","../test/surgery/appendToCollection.test.ts","../test/surgery/deleteFixtureLiteral.test.ts","../test/surgery/deleteReference.test.ts","../test/surgery/findFixture.test.ts","../test/surgery/fixtureLocation.test.ts","../test/surgery/insertCollection.test.ts","../test/surgery/insertFirstProperty.test.ts","../test/surgery/patchFixtureProperty.test.ts","../test/surgery/patchSingletonProperty.test.ts","../test/surgery/replaceFixture.test.ts","../test/surgery/staticFixtureRule.test.ts","../test/webhooks/webhooksEnv.test.ts","../test/webhooks/webhooksLint.test.ts","../test/webhooks/webhooksPull.test.ts","../test/webhooks/webhooksPullEnvs.test.ts","../test/webhooks/webhooksPush.test.ts","../test/webhooks/webhooksRender.test.ts"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "atmn",
-  "version": "2.0.41",
+  "version": "2.0.43",
   "license": "MIT",
   "description": "The CLI for Autumn — define your pricing in code, sync it to Autumn, and keep everything in version control.",
   "bin": {
@@ -49,5 +49,5 @@
     "open": "10.2.0",
     "yaml": "2.9.0"
   },
-  "gitHead": "bbfad2d5f31b4fb3d1ce9df14ef2654fe12b8a7d"
+  "gitHead": "f52f8ea6a3ce297f99e4ec2cde6218fdcb73f80b"
 }

package/src/actions/pull/webhooks/appendWebhook.ts

@@ -13,7 +13,7 @@ import type { PullFiles, RemoteWebhook } from "./types";
 const SPEC = SYNCED_LISTS.webhooks;
 const COLLECTION = "webhooks";
 
-/** The fixture a remote webhook reads as from one env: its url under that env alone. */
+/** The fixture one env's remote endpoint reads as. */
 const fixtureRowOf = ({
 	webhook,
 	envKey,
@@ -22,13 +22,15 @@ const fixtureRowOf = ({
 	envKey: string;
 }): Record<string, unknown> => ({
 	id: webhook.id,
-	url: { [envKey]: webhook.url },
-	events: webhook.events,
+	[SPEC.envField]: envKey,
+	url: webhook.url,
+	// No list is every event; `events` is left out rather than written as `[]`.
+	...(webhook.events.length > 0 ? { events: webhook.events } : {}),
 	...(webhook.description ? { description: webhook.description } : {}),
 	...(webhook.disabled ? { disabled: true } : {}),
 });
 
-/** Rule 1: a remote webhook the config never names is appended for this env. */
+/** An endpoint the config never names is appended as this env's entry. */
 export const appendWebhook = ({
 	pull,
 	webhook,

package/src/actions/pull/webhooks/applyWebhooksPull.ts

@@ -1,7 +1,5 @@
-import { isDashboardWebhook } from "../../webhooks/isDashboardWebhook";
-import { newWebhookId } from "../../webhooks/newWebhookId";
 import { appendWebhook } from "./appendWebhook";
-import { removeWebhookEnv } from "./removeWebhookEnv";
+import { deleteWebhook } from "./deleteWebhook";
 import type {
 	PullFiles,
 	RemoteWebhook,
@@ -10,27 +8,18 @@ import type {
 } from "./types";
 import { updateWebhook } from "./updateWebhook";
 
-const isVercelWebhook = (events: unknown): boolean =>
-	Array.isArray(events) &&
-	events.length > 0 &&
-	events.every(
-		(event) => typeof event === "string" && event.startsWith("vercel."),
-	);
-
-/** The config as it reads once this env's remote webhook is written into it. */
+/** The config entry as it reads once this env's endpoint is written into it. */
 const statedFrom = ({
-	row,
 	webhook,
 	envKey,
 }: {
-	row: StatedWebhook | undefined;
 	webhook: RemoteWebhook;
 	envKey: string;
 }): StatedWebhook => ({
-	...row,
 	id: webhook.id,
-	url: { ...row?.url, [envKey]: webhook.url },
-	events: webhook.events.length > 0 ? webhook.events : row?.events,
+	env: envKey,
+	url: webhook.url,
+	events: webhook.events.length > 0 ? webhook.events : undefined,
 	description: webhook.description,
 	disabled: webhook.disabled,
 });
@@ -42,118 +31,52 @@ const merge = (target: WebhookEditResult, source: WebhookEditResult): void => {
 };
 
 /**
- * One env's webhooks written back into the config. Only `url[envKey]` is
- * touched on the url map; every other env's key, comment and ordering stays.
- * A dashboard webhook is matched to the config by URL, never duplicated: the
- * next push adopts it by that URL, keeping its signing secret.
+ * One env's endpoints written back into the config, one entry each, found by
+ * `(env, id)`. A dashboard endpoint is its own `ep_` id; other envs' entries,
+ * comments and ordering stay.
  */
 export const applyWebhooksPull = ({
 	pull,
 	remote,
 	stated,
 	envKey,
-	newId = newWebhookId,
 }: {
 	pull: PullFiles;
 	remote: RemoteWebhook[];
 	/** The config's webhooks as evaluated; absent when it states none. */
 	stated: StatedWebhook[] | undefined;
 	envKey: string;
-	/** Mints the id a dashboard webhook is written under. */
-	newId?: () => string;
 }): WebhookEditResult & { stated: StatedWebhook[] } => {
 	const result: WebhookEditResult = { lines: [], warnings: [], unlocated: [] };
-	const statedById = new Map((stated ?? []).map((row) => [row.id, row]));
-	// What the next env pulled into the same files sees as the config.
-	const next = new Map(statedById);
-	// An id the config states is the config's, whatever its shape.
-	const fromDashboard = (webhook: RemoteWebhook): boolean =>
-		!statedById.has(webhook.id) && isDashboardWebhook(webhook);
-	const present = new Set<string>();
+	const rows = stated ?? [];
+	const inEnv = new Map(
+		rows.filter((row) => row.env === envKey).map((row) => [row.id, row]),
+	);
+	const next = rows.filter((row) => row.env !== envKey);
 
 	for (const webhook of remote) {
-		if (fromDashboard(webhook)) {
-			// Vercel and other webhooks live in separate apps: a URL only
-			// matches within one.
-			const sameApp = (row: StatedWebhook) =>
-				isVercelWebhook(row.events) === isVercelWebhook(webhook.events);
-			// Another env's copy of this URL fills in this env's key rather than
-			// becoming a second webhook.
-			const represented =
-				(stated ?? []).find(
-					(row) => row.url?.[envKey] === webhook.url && sameApp(row),
-				) ??
-				(stated ?? []).find(
-					(row) =>
-						row.url?.[envKey] === undefined &&
-						Object.values(row.url ?? {}).includes(webhook.url) &&
-						sameApp(row),
-				);
-			if (represented !== undefined) {
-				present.add(represented.id);
-				next.set(
-					represented.id,
-					statedFrom({
-						row: represented,
-						webhook: { ...webhook, id: represented.id },
-						envKey,
-					}),
-				);
-				merge(
-					result,
-					updateWebhook({
-						pull,
-						webhook: { ...webhook, id: represented.id },
-						stated: represented,
-						envKey,
-					}),
-				);
-				continue;
-			}
-			if (webhook.events.length === 0) {
-				result.lines.push(
-					`· webhook ${webhook.id} receives every event; give it an event list in the dashboard, or add it to your config, to manage it here`,
-				);
-				continue;
-			}
-			const id = newId();
-			const failure = appendWebhook({
-				pull,
-				webhook: { ...webhook, id },
-				envKey,
-			});
-			if (failure === null) {
-				next.set(
-					id,
-					statedFrom({ row: undefined, webhook: { ...webhook, id }, envKey }),
-				);
-				result.lines.push(
-					`+ webhook ${id} (made in the dashboard; push adopts it by URL)`,
-				);
-			} else result.unlocated.push({ id, action: failure });
-			continue;
-		}
-		present.add(webhook.id);
-		const row = statedById.get(webhook.id);
-		next.set(webhook.id, statedFrom({ row, webhook, envKey }));
+		const row = inEnv.get(webhook.id);
 		if (row !== undefined) {
 			merge(result, updateWebhook({ pull, webhook, stated: row, envKey }));
+			next.push(statedFrom({ webhook, envKey }));
 			continue;
 		}
 		const failure = appendWebhook({ pull, webhook, envKey });
-		if (failure === null) result.lines.push(`+ webhook ${webhook.id}`);
-		else result.unlocated.push({ id: webhook.id, action: failure });
+		if (failure !== null) {
+			result.unlocated.push({ id: webhook.id, action: failure });
+			continue;
+		}
+		result.lines.push(`+ webhook ${webhook.id} (${envKey})`);
+		next.push(statedFrom({ webhook, envKey }));
 	}
 
-	for (const row of stated ?? []) {
-		if (present.has(row.id) || row.url?.[envKey] === undefined) continue;
-		const removed = removeWebhookEnv({ pull, stated: row, envKey });
+	const remoteIds = new Set(remote.map(({ id }) => id));
+	for (const row of inEnv.values()) {
+		if (remoteIds.has(row.id)) continue;
+		const removed = deleteWebhook({ pull, stated: row, envKey });
 		merge(result, removed);
-		// A key left in the source (code, or unlocated) is still the config's.
-		if (removed.lines.length === 0) continue;
-		const { [envKey]: _removed, ...url } = row.url;
-		if (Object.keys(url).length === 0) next.delete(row.id);
-		else next.set(row.id, { ...row, url });
+		// An entry left in the source (unlocated) is still the config's.
+		if (removed.lines.length === 0) next.push(row);
 	}
-	return { ...result, stated: [...next.values()] };
+	return { ...result, stated: next };
 };

package/src/actions/pull/webhooks/deleteWebhook.ts

@@ -0,0 +1,59 @@
+import { SYNCED_LISTS } from "../../../generated/emit";
+import { deleteFixtureLiteral } from "../../../surgery/deleteFixtureLiteral";
+import { deleteReference } from "../../../surgery/deleteReference";
+import { resolveCollectionTarget } from "../resolveCollectionTarget";
+import { locateWebhook, webhookWhere } from "./locateWebhook";
+import type { PullFiles, StatedWebhook, WebhookEditResult } from "./types";
+
+const SPEC = SYNCED_LISTS.webhooks;
+
+/** The server has no such endpoint in this env: its entry goes, with any export reference left pointing at it. */
+export const deleteWebhook = ({
+	pull,
+	stated,
+	envKey,
+}: {
+	pull: PullFiles;
+	stated: StatedWebhook;
+	envKey: string;
+}): WebhookEditResult => {
+	const result: WebhookEditResult = { lines: [], warnings: [], unlocated: [] };
+	const located = locateWebhook({ pull, id: stated.id, envKey });
+	const removed =
+		located === null
+			? null
+			: deleteFixtureLiteral({
+					source: located.source,
+					builder: SPEC.builder,
+					idField: SPEC.idField,
+					id: stated.id,
+					where: webhookWhere({ envKey }),
+				});
+	if (located === null || removed === null) {
+		result.unlocated.push({
+			id: stated.id,
+			action: `delete the ${envKey} webhook by hand`,
+		});
+		return result;
+	}
+	pull.files.set(located.file, removed.source);
+	if (removed.exportedName !== undefined) {
+		const referenceFiles = new Set([pull.configPath]);
+		const target = resolveCollectionTarget({
+			configPath: pull.configPath,
+			files: pull.files,
+			collection: "webhooks",
+		});
+		if (target !== null) referenceFiles.add(target.file);
+		for (const file of referenceFiles)
+			pull.files.set(
+				file,
+				deleteReference({
+					source: pull.files.get(file) ?? "",
+					name: removed.exportedName,
+				}),
+			);
+	}
+	result.lines.push(`- webhook ${stated.id} (${envKey})`);
+	return result;
+};

package/src/actions/pull/webhooks/locateWebhook.ts

@@ -4,13 +4,15 @@ import type { PullFiles } from "./types";
 
 const SPEC = SYNCED_LISTS.webhooks;
 
-/** A `webhook({...})` call with this id, even when some values are code. */
+/** The `webhook({...})` with this id in this env, even when some values are code. */
 export const locateWebhook = ({
 	pull,
 	id,
+	envKey,
 }: {
 	pull: PullFiles;
 	id: string;
+	envKey: string;
 }): LocatedFixture | null =>
 	locateFixture({
 		configPath: pull.configPath,
@@ -18,5 +20,11 @@ export const locateWebhook = ({
 		builder: SPEC.builder,
 		idField: SPEC.idField,
 		id,
+		where: webhookWhere({ envKey }),
 		allowDynamic: true,
 	});
+
+/** Narrows a lookup of one id to the entry in this env. */
+export const webhookWhere = ({ envKey }: { envKey: string }) => [
+	{ field: SPEC.envField, equals: envKey },
+];

package/src/actions/pull/webhooks/readWebhookEnvs.ts

@@ -1,14 +1,10 @@
-import { AutumnApiError } from "../../../generated/client";
 import type { RemoteWebhook } from "./types";
-import { ForeignOrgKeyError, type WebhookPullEnv } from "./webhookPullEnvs";
-
-const isRejectedKey = (error: unknown): boolean =>
-	error instanceof AutumnApiError &&
-	(error.status === 401 || error.status === 403);
+import { webhookEnvSkipWarning } from "./webhookEnvSkipWarning";
+import type { WebhookPullEnv } from "./webhookPullEnvs";
 
 /**
- * Lists every env in parallel. A rejected key, or one for another org, skips
- * its env with one warning; any other failure fails the pull.
+ * Lists every env in parallel. A rejected key, one for another org, or a 404
+ * (a deleted sandbox) skips its env with one warning; anything else fails the pull.
  */
 export const readWebhookEnvs = async ({
 	envs,
@@ -27,10 +23,9 @@ export const readWebhookEnvs = async ({
 				]);
 				return { envKey, list };
 			} catch (error) {
-				if (error instanceof ForeignOrgKeyError)
-					return `⚠ webhooks: skipped ${env.label} (${env.keyName} belongs to another org)`;
-				if (!isRejectedKey(error)) throw error;
-				return `⚠ webhooks: skipped ${env.label} (${env.keyName} was rejected)`;
+				const warning = webhookEnvSkipWarning({ env, error });
+				if (warning === undefined) throw error;
+				return warning;
 			}
 		}),
 	);

package/src/actions/pull/webhooks/types.ts

@@ -2,10 +2,11 @@ import type { ListWebhooksResponse } from "../../../generated/client";
 
 export type RemoteWebhook = ListWebhooksResponse["list"][number];
 
-/** A config webhook as evaluated: `url` still holds every env's value. */
+/** A config webhook as evaluated: one endpoint in one env. */
 export type StatedWebhook = Record<string, unknown> & {
 	id: string;
-	url?: Record<string, unknown>;
+	env?: unknown;
+	url?: unknown;
 };
 
 /** The in-memory sources a pull edits, plus where the config lives. */

package/src/actions/pull/webhooks/updateWebhook.ts

@@ -1,7 +1,7 @@
 import { isDeepStrictEqual } from "node:util";
 import { SYNCED_LISTS } from "../../../generated/emit";
 import { patchFixturePaths } from "../../../surgery/patchFixturePaths";
-import { locateWebhook } from "./locateWebhook";
+import { locateWebhook, webhookWhere } from "./locateWebhook";
 import type {
 	PullFiles,
 	RemoteWebhook,
@@ -25,8 +25,11 @@ const fieldAssignments = ({
 	stated: StatedWebhook;
 }): Assignment[] => {
 	const assignments: Assignment[] = [];
-	// `[]` is a dashboard webhook receiving every event: not a list a config can state.
-	if (webhook.events.length > 0 && !sameEvents(stated.events, webhook.events))
+	// No list is every event, which a config states by leaving `events` out.
+	if (webhook.events.length === 0) {
+		if (stated.events !== undefined)
+			assignments.push({ path: ["events"], text: null });
+	} else if (!sameEvents(stated.events, webhook.events))
 		assignments.push({
 			path: ["events"],
 			text: `[${webhook.events.map((event) => JSON.stringify(event)).join(", ")}]`,
@@ -44,8 +47,8 @@ const fieldAssignments = ({
 	return assignments;
 };
 
-/** Rule 3's wording: what the server holds against what the code evaluates to. */
-export const nonLiteralUrlWarning = ({
+/** What the server holds against what the code evaluates to. */
+const nonLiteralUrlWarning = ({
 	id,
 	envKey,
 	server,
@@ -53,22 +56,21 @@ export const nonLiteralUrlWarning = ({
 }: {
 	id: string;
 	envKey: string;
-	server: string | undefined;
+	server: string;
 	config: unknown;
 }): string => {
 	const pad = " ".repeat(id.length + 4);
 	return [
-		`⚠ ${id}  url.${envKey} isn't a plain string, so pull left it untouched`,
-		`${pad}server:      ${server ?? "(not registered)"}`,
+		`⚠ ${id} (${envKey})  url isn't a plain string, so pull left it untouched`,
+		`${pad}server:      ${server}`,
 		`${pad}your config: ${typeof config === "string" ? config : "(no value)"}`,
 		`${pad}Update it by hand, or make it a string and pull will manage it.`,
 	].join("\n");
 };
 
 /**
- * Rules 2 and 3: set or replace `url[envKey]` when it is a string literal (or
- * absent), and bring the other fields in line. Code is never rewritten; a
- * value that evaluates differently from the server earns a warning instead.
+ * Set a string-literal url and bring the other fields in line with the server.
+ * Code is never rewritten; a value that evaluates differently earns a warning.
  */
 export const updateWebhook = ({
 	pull,
@@ -82,57 +84,50 @@ export const updateWebhook = ({
 	envKey: string;
 }): WebhookEditResult => {
 	const result: WebhookEditResult = { lines: [], warnings: [], unlocated: [] };
-	if (webhook.events.length === 0 && Array.isArray(stated.events))
-		result.warnings.push(
-			`⚠ ${webhook.id}  the dashboard webhook at this url receives every event; your next push narrows it to ${stated.events.join(", ")}`,
-		);
-	const located = locateWebhook({ pull, id: webhook.id });
-	if (located === null) {
-		result.unlocated.push({
-			id: webhook.id,
-			action: "update from the server by hand",
-		});
-		return result;
-	}
-	const patched = patchFixturePaths({
-		source: located.source,
-		builder: SPEC.builder,
-		idField: SPEC.idField,
-		id: webhook.id,
-		assignments: [
-			{ path: ["url", envKey], text: JSON.stringify(webhook.url) },
-			...fieldAssignments({ webhook, stated }),
-		],
-		bareKeys: true,
-	});
-	if (patched === null) {
+	const label = `${webhook.id} (${envKey})`;
+	const located = locateWebhook({ pull, id: webhook.id, envKey });
+	const patched =
+		located === null
+			? null
+			: patchFixturePaths({
+					source: located.source,
+					builder: SPEC.builder,
+					idField: SPEC.idField,
+					id: webhook.id,
+					where: webhookWhere({ envKey }),
+					assignments: [
+						{ path: ["url"], text: JSON.stringify(webhook.url) },
+						...fieldAssignments({ webhook, stated }),
+					],
+					bareKeys: true,
+				});
+	if (located === null || patched === null) {
 		result.unlocated.push({
 			id: webhook.id,
-			action: "update from the server by hand",
+			action: `update the ${envKey} webhook from the server by hand`,
 		});
 		return result;
 	}
 	for (const { path } of patched.skipped) {
 		const field = path.join(".");
-		if (field !== `url.${envKey}`) {
+		if (field !== "url") {
 			result.warnings.push(
-				`⚠ ${webhook.id}  ${field} isn't a plain literal, so pull left it untouched`,
+				`⚠ ${label}  ${field} isn't a plain literal, so pull left it untouched`,
 			);
 			continue;
 		}
-		const config = stated.url?.[envKey];
-		if (config === webhook.url) continue;
+		if (stated.url === webhook.url) continue;
 		result.warnings.push(
 			nonLiteralUrlWarning({
 				id: webhook.id,
 				envKey,
 				server: webhook.url,
-				config,
+				config: stated.url,
 			}),
 		);
 	}
 	if (patched.source === located.source) return result;
 	pull.files.set(located.file, patched.source);
-	result.lines.push(`~ webhook ${webhook.id}`);
+	result.lines.push(`~ webhook ${label}`);
 	return result;
 };