atmn 2.0.41 → 2.0.43

package/src/actions/pull/webhooks/webhookEnvSkipWarning.ts

@@ -0,0 +1,29 @@
+import { AutumnApiError } from "../../../generated/client";
+import { ForeignOrgKeyError, type WebhookPullEnv } from "./webhookPullEnvs";
+
+/** Why a failure skips its env; null when it should fail the command. */
+const skipReason = (error: unknown): string | null => {
+	if (error instanceof ForeignOrgKeyError) return "belongs to another org";
+	if (!(error instanceof AutumnApiError)) return null;
+	if (error.status === 401 || error.status === 403) return "was rejected";
+	if (error.status !== 404) return null;
+	const { message } = (error.body ?? {}) as { message?: unknown };
+	return `failed: ${typeof message === "string" ? message : error.status}`;
+};
+
+/**
+ * A rejected key, one for another org, or a 404 (a deleted sandbox) skips its
+ * env with this warning; anything else is a real failure.
+ */
+export const webhookEnvSkipWarning = ({
+	env,
+	error,
+}: {
+	env: Pick<WebhookPullEnv, "label" | "keyName">;
+	error: unknown;
+}): string | undefined => {
+	const reason = skipReason(error);
+	return reason === null
+		? undefined
+		: `⚠ webhooks: skipped ${env.label} (${env.keyName} ${reason})`;
+};

package/src/actions/pull/webhooks/webhookPullEnvs.ts

@@ -4,11 +4,13 @@ import { sandboxSlug } from "../../../generated/sandboxName";
 import type { OrgInfo } from "../../env/types/orgInfo";
 import type { RemoteWebhook } from "./types";
 
-/** One env a pull reads webhooks from, through that env's own key. */
+/** One env a pull reads webhooks from, or a push syncs them to, through that env's own key. */
 export type WebhookPullEnv = {
 	keyName: SecretKeyName;
 	/** How a skipped-env warning names it, before its key is known to work. */
 	label: string;
+	/** This env's own key: push syncs each env through it. */
+	secretKey: string;
 	/** The `url` map key; a named sandbox's slug costs one lookup. */
 	envKey: () => Promise<string>;
 	listWebhooks: () => Promise<{ list: RemoteWebhook[] }>;
@@ -21,10 +23,7 @@ export class ForeignOrgKeyError extends Error {}
 const mainOrgIdOf = (info: OrgInfo): string =>
 	info.is_sandbox && info.created_by ? info.created_by : info.id;
 
-/**
- * Every env the loaded env files hold a key for. Live comes last, so when envs
- * disagree on shared fields like `events`, prod's value is the one written.
- */
+/** Every env the loaded env files hold a key for, live last. */
 export const webhookPullEnvs = ({
 	env = process.env,
 	targetKeyName,
@@ -76,6 +75,7 @@ export const webhookPullEnvs = ({
 			{
 				keyName,
 				label,
+				secretKey,
 				envKey,
 				listWebhooks: () => listWebhooks({ secretKey }),
 			},

package/src/actions/pull.ts

@@ -375,7 +375,7 @@ export const runPull = async ({
 
 	const webhookWarnings = [...webhooks.skipped];
 	let stated = lists.webhooks as StatedWebhook[] | undefined;
-	// Only an env whose list succeeded may remove its urls from the config.
+	// Only an env whose list succeeded may remove its entries from the config.
 	for (const { envKey, list } of webhooks.read) {
 		const applied = applyWebhooksPull({
 			pull: { configPath, files },

package/src/actions/push.ts

@@ -12,6 +12,7 @@ import {
 	type SettingsPreview,
 	settingsHaveWork,
 } from "../render/renderPreview";
+import type { WebhookPullEnv } from "./pull/webhooks/webhookPullEnvs";
 import {
 	backfillInternalIds,
 	identityRowsFromApplied,
@@ -23,8 +24,11 @@ import {
 import { PushLanesError, settleLanes } from "./push/pushLanesError";
 import { withSettingsScopeHint } from "./sandbox/withSandboxScopeHint";
 import { applyWebhooks } from "./webhooks/applyWebhooks";
-import { previewWebhooks, type WebhooksLane } from "./webhooks/previewWebhooks";
-import type { WebhookEnv } from "./webhooks/types/webhookEnv";
+import {
+	previewWebhookEnvs,
+	type WebhookClientFor,
+	type WebhookLanes,
+} from "./webhooks/previewWebhookEnvs";
 
 export type PushResult = {
 	configPath: string;
@@ -61,8 +65,12 @@ export type PushOptions = {
 	/** Where to write progress. Injected so tests can capture it. */
 	write?: (text: string) => void;
 	migrationLinkBase?: string;
-	/** The target env for the webhook lane; resolved only when the config states webhooks. */
-	webhookEnv?: () => Promise<WebhookEnv>;
+	/** `-p`: the catalog and webhooks go to live, and no sandbox is touched. */
+	prod?: boolean;
+	/** Every env with a key; listed only when the config states webhooks. */
+	webhookEnvs?: () => WebhookPullEnv[];
+	/** A client for one env's own key. */
+	webhookClientFor?: WebhookClientFor;
 };
 
 type RewardBody = { id?: string; internal_id?: string };
@@ -340,7 +348,9 @@ export const runPush = async ({
 	dryRun = false,
 	write = (text) => process.stdout.write(text),
 	migrationLinkBase,
-	webhookEnv,
+	prod = false,
+	webhookEnvs,
+	webhookClientFor,
 }: PushOptions): Promise<PushResult> => {
 	const project = resolveProject({ cwd, configFlag });
 	const dirs = configSearchDirs({ cwd, configPath: configFlag });
@@ -362,14 +372,15 @@ export const runPush = async ({
 	const previews = await settleLanes<{
 		settings: SettingsPreview | undefined;
 		catalog: CatalogPreview;
-		webhooks: WebhooksLane | undefined;
+		webhooks: WebhookLanes | undefined;
 	}>({
 		settings: previewSettings({ client, body: settingsBody }),
 		catalog: client.previewUpdate(wire) as Promise<CatalogPreview>,
-		webhooks: previewWebhooks({
-			client,
+		webhooks: previewWebhookEnvs({
 			rows: lists.webhooks,
-			webhookEnv,
+			envs: webhookEnvs,
+			prod,
+			clientFor: webhookClientFor,
 		}),
 	});
 	const { settings, webhooks } = previews.values;
@@ -389,8 +400,16 @@ export const runPush = async ({
 	const preview: CatalogPreview = {
 		...catalogPreview,
 		settings,
-		...(webhooks === undefined ? {} : { webhooks: webhooks.preview }),
+		...(webhooks === undefined
+			? {}
+			: {
+					webhooks: webhooks.lanes.map((lane) => lane.preview),
+					productionWebhooks: webhooks.productionDiffers,
+					productionWebhooksUnchecked: webhooks.productionUnchecked,
+				}),
 	};
+	if (webhooks !== undefined && webhooks.skipped.length > 0)
+		write(`${webhooks.skipped.join("\n")}\n\n`);
 	write(`${renderPreview({ preview, migrationLinkBase })}\n`);
 	if (catalogDeferral !== undefined)
 		write(`\n${renderCatalogDeferral({ error: catalogDeferral.error })}\n`);
@@ -434,8 +453,7 @@ export const runPush = async ({
 				? settingsStep().then(catalogStep)
 				: catalogStep(settled),
 		webhooks: applyWebhooks({
-			client,
-			lane: webhooks,
+			lanes: webhooks?.lanes ?? [],
 			envDirs: project.envDirs,
 			cwd,
 			write,

package/src/actions/webhooks/applyWebhooks.ts

@@ -1,28 +1,28 @@
-import type { AutumnClient } from "../../generated/client";
 import { webhooksHaveWork } from "../../render/renderWebhooks";
-import type { WebhooksLane } from "./previewWebhooks";
+import type { WebhooksLane } from "./previewWebhookEnvs";
+import {
+	messageOf,
+	throwWebhookEnvFailures,
+	type WebhookEnvFailure,
+} from "./webhookEnvFailures";
 import { writeWebhookSecrets } from "./writeWebhookSecrets";
 
 /**
  * Sync, then save every secret it returned — before reporting any per-item
  * failure, since a created webhook's secret is shown once and only here.
  */
-export const applyWebhooks = async ({
-	client,
+const applyLane = async ({
 	lane,
 	envDirs,
 	cwd,
 	write,
 }: {
-	client: AutumnClient;
-	lane: WebhooksLane | undefined;
+	lane: WebhooksLane;
 	envDirs: string[];
 	cwd: string;
 	write: (text: string) => void;
 }): Promise<void> => {
-	if (lane === undefined || !webhooksHaveWork({ webhooks: lane.preview }))
-		return;
-	const result = await client.syncWebhooks(lane.body);
+	const result = await lane.client.syncWebhooks(lane.body);
 	const saved = await writeWebhookSecrets({
 		secrets: result.secrets,
 		env: lane.env,
@@ -43,10 +43,41 @@ export const applyWebhooks = async ({
 				`Adopted ${change.id} (existing dashboard webhook); its signing secret is unchanged, nothing written`,
 		);
 	write(
-		`\nApplied webhooks.\n${[...adopted, ...saved].map((line) => `${line}\n`).join("")}`,
+		`\nApplied webhooks to ${lane.env.key}.\n${[...adopted, ...saved].map((line) => `${line}\n`).join("")}`,
 	);
 	if (result.errors.length > 0)
 		throw new Error(
 			result.errors.map(({ id, message }) => `${id}: ${message}`).join("\n"),
 		);
 };
+
+/** Every env with work syncs in parallel; one env failing never stops another saving its secrets. */
+export const applyWebhooks = async ({
+	lanes,
+	envDirs,
+	cwd,
+	write,
+}: {
+	lanes: WebhooksLane[];
+	envDirs: string[];
+	cwd: string;
+	write: (text: string) => void;
+}): Promise<void> => {
+	const withWork = lanes.filter((lane) =>
+		webhooksHaveWork({ webhooks: lane.preview }),
+	);
+	const results = await Promise.allSettled(
+		withWork.map((lane) => applyLane({ lane, envDirs, cwd, write })),
+	);
+	const failures: WebhookEnvFailure[] = results.flatMap((result, index) =>
+		result.status === "rejected"
+			? [
+					{
+						env: withWork[index]?.env.key ?? "",
+						message: messageOf(result.reason),
+					},
+				]
+			: [],
+	);
+	throwWebhookEnvFailures({ failures, envCount: withWork.length });
+};

package/src/actions/webhooks/previewWebhookEnvs.ts

@@ -0,0 +1,213 @@
+import type { AutumnClient, SyncWebhooksParams } from "../../generated/client";
+import type { WebhooksPreview } from "../../render/renderWebhooks";
+import { webhookEnvSkipWarning } from "../pull/webhooks/webhookEnvSkipWarning";
+import type { WebhookPullEnv } from "../pull/webhooks/webhookPullEnvs";
+import { resolveWebhooksForEnv } from "./resolveWebhooksForEnv";
+import type { WebhookEnv } from "./types/webhookEnv";
+import {
+	messageOf,
+	throwWebhookEnvFailures,
+	type WebhookEnvFailure,
+} from "./webhookEnvFailures";
+import { webhookSecretName } from "./webhookSecretName";
+
+export type WebhookClient = Pick<
+	AutumnClient,
+	"previewSyncWebhooks" | "syncWebhooks"
+>;
+
+export type WebhookClientFor = (args: { secretKey: string }) => WebhookClient;
+
+/** One env's share of a push: its preview, and exactly what the sync will send. */
+export type WebhooksLane = {
+	preview: WebhooksPreview;
+	body: SyncWebhooksParams;
+	env: WebhookEnv;
+	client: WebhookClient;
+};
+
+export type WebhookLanes = {
+	lanes: WebhooksLane[];
+	/** Live webhooks a `-p` push would change; a plain push only reads them. */
+	productionDiffers: string[];
+	/** The read-only live check failed, so the preview can't claim production matches. */
+	productionUnchecked: boolean;
+	/** One warning per env whose key was rejected or belongs to another org. */
+	skipped: string[];
+};
+
+type EnvPreview =
+	| { lane: WebhooksLane; errors: { id: string; message: string }[] }
+	| { skipped: string }
+	| undefined;
+
+const isLive = (env: WebhookPullEnv): boolean =>
+	env.keyName === "AUTUMN_PROD_SECRET_KEY";
+
+/**
+ * Two slugs like `qa-team` and `qa_team` name one variable. A create in one
+ * refuses when another synced env states the same id: its saved secret would be overwritten.
+ */
+const assertDistinctSecretNames = ({
+	lanes,
+}: {
+	lanes: WebhooksLane[];
+}): void => {
+	const secretName = ({ lane, id }: { lane: WebhooksLane; id: string }) =>
+		webhookSecretName({
+			id,
+			...(lane.env.live ? {} : { envKey: lane.env.key }),
+		});
+	const clashes = new Map<string, string>();
+	for (const lane of lanes) {
+		for (const change of lane.preview.changes) {
+			if (change.action !== "create") continue;
+			const name = secretName({ lane, id: change.id });
+			for (const other of lanes) {
+				if (other === lane) continue;
+				const shares = other.body.webhooks.some(
+					(webhook) => secretName({ lane: other, id: webhook.id }) === name,
+				);
+				if (!shares) continue;
+				const [first, second] = [other.env.key, lane.env.key].sort();
+				clashes.set(
+					`${first}|${second}|${name}`,
+					`${first} and ${second} would both save ${change.id}'s signing secret as ${name}. Rename one of those sandboxes so their names differ by more than punctuation.`,
+				);
+			}
+		}
+	}
+	if (clashes.size > 0) throw new Error([...clashes.values()].join("\n"));
+};
+
+/** Undefined when the config registers nothing in this env: there is nothing to preview. */
+const previewEnv = async ({
+	env,
+	rows,
+	clientFor,
+}: {
+	env: WebhookPullEnv;
+	rows: Record<string, unknown>[];
+	clientFor: WebhookClientFor;
+}): Promise<EnvPreview> => {
+	try {
+		const key = await env.envKey();
+		const webhooks = resolveWebhooksForEnv({ rows, envKey: key });
+		if (webhooks.length === 0) return undefined;
+		const client = clientFor({ secretKey: env.secretKey });
+		const body = { webhooks };
+		const { changes, errors } = await client.previewSyncWebhooks(body);
+		return {
+			lane: {
+				preview: { env: key, changes },
+				body,
+				env: { key, live: isLive(env) },
+				client,
+			},
+			errors,
+		};
+	} catch (error) {
+		const skipped = webhookEnvSkipWarning({ env, error });
+		if (skipped === undefined) throw error;
+		return { skipped };
+	}
+};
+
+/**
+ * A plain push syncs every sandbox env with a key, and previews live read-only
+ * so a production diff is named rather than hidden; `-p` syncs live alone.
+ * Absent when the config states no `webhooks`.
+ */
+export const previewWebhookEnvs = async ({
+	rows,
+	envs,
+	prod,
+	clientFor,
+}: {
+	rows: Record<string, unknown>[] | undefined;
+	envs: (() => WebhookPullEnv[]) | undefined;
+	prod: boolean;
+	clientFor: WebhookClientFor | undefined;
+}): Promise<WebhookLanes | undefined> => {
+	if (rows === undefined) return undefined;
+	if (envs === undefined || clientFor === undefined)
+		throw new Error("webhooks need the env keys to pick each url.");
+	const all = envs();
+	const synced = all.filter((env) => isLive(env) === prod);
+	const probed = prod ? [] : all.filter(isLive);
+	const [syncedResults, probedResults] = await Promise.all([
+		Promise.allSettled(
+			synced.map((env) => previewEnv({ env, rows, clientFor })),
+		),
+		Promise.allSettled(
+			probed.map((env) => previewEnv({ env, rows, clientFor })),
+		),
+	]);
+
+	const lanes: WebhooksLane[] = [];
+	const skipped: string[] = [];
+	// Live is only read here, so its failure is a warning, never a blocked sandbox push.
+	probedResults.forEach((result, index) => {
+		if (result.status === "rejected")
+			skipped.push(
+				`⚠ webhooks: couldn't check ${probed[index]?.label ?? "live"} for changes (${messageOf(result.reason)})`,
+			);
+	});
+	// A skipped live key (rejected, deleted, another org's) leaves production unchecked too.
+	const productionUnchecked = probedResults.some(
+		(result) =>
+			result.status === "rejected" ||
+			(result.value !== undefined && "skipped" in result.value),
+	);
+	// Refused items (several dashboard webhooks on one URL, say) fail the lane
+	// here, beside every other lane's errors, rather than at apply.
+	const failures: WebhookEnvFailure[] = [];
+	syncedResults.forEach((result, index) => {
+		const label = synced[index]?.label ?? "";
+		if (result.status === "rejected") {
+			failures.push({ env: label, message: messageOf(result.reason) });
+			return;
+		}
+		const preview = result.value;
+		if (preview === undefined) return;
+		if ("skipped" in preview) {
+			skipped.push(preview.skipped);
+			return;
+		}
+		lanes.push(preview.lane);
+		if (preview.errors.length > 0)
+			failures.push({
+				env: preview.lane.env.key,
+				message: preview.errors
+					.map(({ id, message }) => `${id}: ${message}`)
+					.join("\n"),
+			});
+	});
+	throwWebhookEnvFailures({
+		failures,
+		envCount: synced.length,
+		warnings: skipped,
+	});
+	assertDistinctSecretNames({ lanes });
+
+	const productionDiffers: string[] = [];
+	for (const result of probedResults) {
+		if (result.status === "rejected") continue;
+		const preview = result.value;
+		if (preview === undefined) continue;
+		if ("skipped" in preview) {
+			skipped.push(preview.skipped);
+			continue;
+		}
+		const changed = preview.lane.preview.changes.filter(
+			(change) => change.action !== "unmanaged",
+		);
+		productionDiffers.push(
+			...new Set([
+				...changed.map((change) => change.id),
+				...preview.errors.map((error) => error.id),
+			]),
+		);
+	}
+	return { lanes, productionDiffers, productionUnchecked, skipped };
+};

package/src/actions/webhooks/resolveWebhooksForEnv.ts

@@ -3,7 +3,7 @@ import { SYNCED_LISTS } from "../../generated/emit";
 
 type WebhookParams = SyncWebhooksParams["webhooks"][number];
 
-/** The config's webhooks as one environment sees them; a missing key skips the entry. */
+/** The config's entries for one environment, as the sync body takes them. */
 export const resolveWebhooksForEnv = ({
 	rows,
 	envKey,
@@ -11,19 +11,8 @@ export const resolveWebhooksForEnv = ({
 	rows: Record<string, unknown>[];
 	envKey: string;
 }): WebhookParams[] => {
-	const { envKeyed } = SYNCED_LISTS.webhooks;
-	const webhooks: WebhookParams[] = [];
-	for (const row of rows) {
-		const values = envKeyed.map(
-			(field) => (row[field] as Record<string, unknown> | undefined)?.[envKey],
-		);
-		if (values.some((value) => typeof value !== "string")) continue;
-		webhooks.push({
-			...row,
-			...Object.fromEntries(
-				envKeyed.map((field, index) => [field, values[index]]),
-			),
-		} as WebhookParams);
-	}
-	return webhooks;
+	const { envField } = SYNCED_LISTS.webhooks;
+	return rows
+		.filter((row) => row[envField] === envKey)
+		.map(({ [envField]: _env, ...row }) => row as WebhookParams);
 };

package/src/actions/webhooks/types/webhookEnv.ts

@@ -2,8 +2,6 @@
 export type WebhookEnv = {
 	/** The `url` map key: `live`, `sandbox`, or the targeted sandbox's slug. */
 	key: string;
-	/** Prod secrets go to `.env.prod` without an org suffix. */
+	/** Prod secrets go to `.env.prod` without an env suffix. */
 	live: boolean;
-	/** The target org's id, looked up only when a secret needs naming. */
-	orgId: () => Promise<string>;
 };

package/src/actions/webhooks/webhookEnvFailures.ts

@@ -0,0 +1,27 @@
+/** One env's failed webhook preview or sync. */
+export type WebhookEnvFailure = { env: string; message: string };
+
+/** Names each env only when several were in play, so a lone env reads as it always has. */
+export const throwWebhookEnvFailures = ({
+	failures,
+	envCount,
+	warnings = [],
+}: {
+	failures: WebhookEnvFailure[];
+	envCount: number;
+	/** Skipped-env warnings the failure would otherwise swallow. */
+	warnings?: string[];
+}): void => {
+	if (failures.length === 0) return;
+	throw new Error(
+		[
+			...failures.map(({ env, message }) =>
+				envCount > 1 ? message.replace(/^/gm, `${env}: `) : message,
+			),
+			...warnings,
+		].join("\n"),
+	);
+};
+
+export const messageOf = (error: unknown): string =>
+	error instanceof Error ? error.message : String(error);

package/src/actions/webhooks/webhookSecretName.ts

@@ -2,21 +2,22 @@
 const envNameSegment = (value: string): string =>
 	value.toUpperCase().replace(/-/g, "_");
 
+/** A sandbox slug as an env-var segment: every non-alphanumeric run becomes `_`. */
+const envKeySegment = (envKey: string): string =>
+	envKey.toUpperCase().replace(/[^A-Z0-9]+/g, "_");
+
 /**
- * Prod: `AUTUMN_WEBHOOK_<ID>_SECRET`. A sandbox adds the first four characters
- * of its org id after `org_`, so every sandbox's secret can sit in one `.env`.
+ * Prod: `AUTUMN_WEBHOOK_<ID>_SECRET`. A sandbox adds its `url` key (`SANDBOX`,
+ * or its slug), so every sandbox's secret can sit in one `.env`.
  */
 export const webhookSecretName = ({
 	id,
-	orgId,
+	envKey,
 }: {
 	id: string;
 	/** Absent for prod. */
-	orgId?: string;
+	envKey?: string;
 }): string => {
-	const org4 =
-		orgId === undefined
-			? ""
-			: `_${envNameSegment(orgId.replace(/^org_/, "").slice(0, 4))}`;
-	return `AUTUMN_WEBHOOK_${envNameSegment(id)}${org4}_SECRET`;
+	const suffix = envKey === undefined ? "" : `_${envKeySegment(envKey)}`;
+	return `AUTUMN_WEBHOOK_${envNameSegment(id)}${suffix}_SECRET`;
 };

package/src/actions/webhooks/writeWebhookSecrets.ts

@@ -35,9 +35,12 @@ export const writeWebhookSecrets = async ({
 	cwd: string;
 }): Promise<string[]> => {
 	if (secrets.length === 0) return [];
-	const orgId = env.live ? undefined : await env.orgId();
+	const envKey = env.live ? undefined : env.key;
 	const values = Object.fromEntries(
-		secrets.map(({ id, secret }) => [webhookSecretName({ id, orgId }), secret]),
+		secrets.map(({ id, secret }) => [
+			webhookSecretName({ id, envKey }),
+			secret,
+		]),
 	);
 	let path: string;
 	if (env.live) {

package/src/auth/runOAuthFlow.ts

@@ -225,6 +225,6 @@ export const runOAuthFlow = async ({
 	}
 
 	throw new Error(
-		`All OAuth callback ports (${OAUTH_PORTS.at(0)}-${OAUTH_PORTS.at(-1)}) are in use.`,
+		`All OAuth callback ports (${OAUTH_PORTS[0]}-${OAUTH_PORTS[OAUTH_PORTS.length - 1]}) are in use.`,
 	);
 };

package/src/cli.ts

@@ -32,7 +32,6 @@ import {
 	staleSkillsHint,
 	updateSkills,
 } from "./actions/skills/skills";
-import { resolveWebhookEnv } from "./actions/webhooks/resolveWebhookEnv";
 import { configPackageName } from "./config/configPackageName";
 import { assertSandboxTarget } from "./env/assertSandboxTarget";
 import { loadEnvFiles } from "./env/loadEnv";
@@ -206,18 +205,26 @@ const pinnedSandboxName = async ({
 	}
 };
 
-/** The env a push or pull's webhook lane addresses, resolved only when asked. */
-const webhookEnvFor =
-	({ target, command }: { target: Target; command: Command }) =>
+/** A client for one env's own key, at the target's base URL. */
+const webhookClientFor =
+	({ target }: { target: Target }) =>
+	({ secretKey }: { secretKey: string }) =>
+		createClient({
+			secretKey,
+			fetch: autumnFetch,
+			...(target.baseUrl ? { baseUrl: target.baseUrl } : {}),
+		});
+
+/** Every env the env files hold a key for, listed only when a webhook lane asks. */
+const webhookEnvsFor =
+	({ target }: { target: Target }) =>
 	() =>
-		resolveWebhookEnv({
-			target,
-			prod: command.optsWithGlobals<GlobalFlags>().prod === true,
-			fetchOrgInfo: () =>
-				fetchOrgInfo({
-					baseUrl: targetBaseUrl({ target }),
-					secretKey: requireSecretKey({ target }),
-				}),
+		webhookPullEnvs({
+			targetKeyName: target.secretKeyName,
+			listWebhooks: ({ secretKey }) =>
+				webhookClientFor({ target })({ secretKey }).listWebhooks({}),
+			fetchOrgInfo: ({ secretKey }) =>
+				fetchOrgInfo({ baseUrl: targetBaseUrl({ target }), secretKey }),
 		});
 
 /** `/organization/me` for the main key: what `sandbox use` and `init` report the org as. */
@@ -405,7 +412,9 @@ Linking a keyless org to an account:
 					client: clientFor({ target }),
 					configPath: configFlagOf({ command }),
 					dryRun: !apply,
-					webhookEnv: webhookEnvFor({ target, command }),
+					prod: command.optsWithGlobals<GlobalFlags>().prod === true,
+					webhookEnvs: webhookEnvsFor({ target }),
+					webhookClientFor: webhookClientFor({ target }),
 				});
 				// A dry run that never saw the catalog must not read as clean.
 				process.exitCode = pushExitCode({ apply, result });
@@ -501,18 +510,7 @@ Linking a keyless org to an account:
 					overwrite: options.overwrite === true,
 					yes: options.yes === true,
 					prompter: prompterFor({ command }),
-					webhookEnvs: () =>
-						webhookPullEnvs({
-							targetKeyName: target.secretKeyName,
-							listWebhooks: ({ secretKey }) =>
-								createClient({
-									secretKey,
-									fetch: autumnFetch,
-									...(target.baseUrl ? { baseUrl: target.baseUrl } : {}),
-								}).listWebhooks({}),
-							fetchOrgInfo: ({ secretKey }) =>
-								fetchOrgInfo({ baseUrl: targetBaseUrl({ target }), secretKey }),
-						}),
+					webhookEnvs: webhookEnvsFor({ target }),
 				});
 				writeStaleSkillsHint({ command });
 			},