atmn 2.0.42 → 2.0.43

package/dist/bin.js

@@ -6245,25 +6245,38 @@ var LINT_RULES = {
   webhooks: {
     label: "webhook",
     idField: "id",
-    required: ["id", "url"],
+    required: ["env", "id", "url"],
     fields: {
       id: {
         minLength: 1,
         maxLength: 256,
         pattern: "^[a-zA-Z0-9_-]+$"
+      },
+      env: {
+        pattern: "^[a-z0-9_-]+$"
+      },
+      url: {
+        pattern: "^[Hh][Tt][Tt][Pp][Ss]:\\/\\/"
       }
     },
     rules: [
+      {
+        kind: "notMap",
+        field: "url",
+        because: 'Each webhook() is one endpoint in one env: split into one webhook() per env, e.g. webhook({ id, env: "live", url }).'
+      },
       {
         kind: "unique",
         field: "id",
-        because: "Two webhooks claiming one id race to define the same endpoint."
+        alongside: "env",
+        because: "Two webhooks claiming one id in one env race to define the same endpoint."
       },
       {
         kind: "unique",
         field: "id",
+        alongside: "env",
         asEnvName: true,
-        because: "Each webhook's signing secret is saved as AUTUMN_WEBHOOK_<ID>_SECRET, so these two would overwrite each other's secret. Rename one."
+        because: "Each webhook's signing secret is saved under its id in an env var name, so these two would overwrite each other's secret. Rename one."
       },
       {
         kind: "rejects",
@@ -6277,12 +6290,6 @@ var LINT_RULES = {
         prefix: "vercel.",
         because: "vercel.* events can't be mixed with other events in one webhook: they're delivered from a separate app. Make one webhook for each."
       },
-      {
-        kind: "nonEmpty",
-        field: "url",
-        warning: true,
-        because: "With no environment key the webhook is registered nowhere. Add `live`, `sandbox` or a sandbox's slug."
-      },
       {
         kind: "knownValues",
         field: "events",
@@ -6304,14 +6311,6 @@ var LINT_RULES = {
         because: "isn't known to this atmn version; the server will check it."
       }
     ]
-  },
-  "webhooks.url": {
-    keys: {
-      pattern: "^[a-z0-9_-]+$"
-    },
-    values: {
-      pattern: "^[Hh][Tt][Tt][Pp][Ss]:\\/\\/"
-    }
   }
 };
 
@@ -6532,6 +6531,10 @@ var entryRuleFailures = ({
         return [];
       return value.filter((item) => typeof item === "string" && !rule.values.includes(item)).map((item) => `\`${item}\` ${rule.because}`);
     }
+    case "notMap": {
+      const value = entry[rule.field];
+      return isEntry(value) ? [`${rule.field} is a map. ${rule.because}`] : [];
+    }
     case "uniformPrefix": {
       const value = entry[rule.field];
       if (!Array.isArray(value))
@@ -7022,8 +7025,7 @@ var CATALOG_HINTS = hintsOf({
     "plans.variants.customize.upsertLicenses.customize.addItems.featureOverride.creditSchema.multipliers",
     "plans.variants.customize.upsertLicenses.customize.addItems.featureOverride.creditSchema.multipliers.*.match",
     "plans.variants.customize.upsertLicenses.customize.addItems.featureOverride.markups.modelMarkups",
-    "plans.variants.customize.upsertLicenses.customize.addItems.featureOverride.markups.providerMarkups",
-    "webhooks.url"
+    "plans.variants.customize.upsertLicenses.customize.addItems.featureOverride.markups.providerMarkups"
   ],
   frozenPaths: [
     "plans.licenses.metadata",
@@ -7321,7 +7323,7 @@ var createClient = (options) => ({
 });
 
 // src/version.ts
-var version = "2.0.42";
+var version = "2.0.43";
 
 // src/http/autumnFetch.ts
 var runtime = typeof Bun !== "undefined" ? `bun ${Bun.version}` : `node ${process.versions.node}`;
@@ -9459,11 +9461,11 @@ var SYNCED_LISTS = {
     builder: "webhook",
     idField: "id",
     responseIdField: "id",
-    keys: ["id", "url", "events", "description", "disabled"],
-    required: ["id", "url"],
-    paths: ["description", "disabled", "events", "id", "url"],
+    keys: ["id", "env", "url", "events", "description", "disabled"],
+    required: ["env", "id", "url"],
+    paths: ["description", "disabled", "env", "events", "id", "url"],
     pull: true,
-    envKeyed: ["url"]
+    envField: "env"
   }
 };
 var NESTED_FIXTURES = {
@@ -9578,16 +9580,16 @@ import { dirname as dirname4, join as join7 } from "node:path";
 import chalk3 from "chalk";
 
 // src/generated/skills.ts
-var SKILLS_VERSION = "2.0.42";
+var SKILLS_VERSION = "2.0.43";
 var SKILLS = [
   {
     name: "autumn-setup",
     description: "First-time Autumn setup — install the atmn CLI, connect to an org (sign in, or keyless with no account), turn the user's pricing into autumn.config.ts, and push it to a sandbox org. Use when the user is new to Autumn, pastes an Autumn setup prompt, or asks to set up Autumn, add billing, monetization, subscriptions, usage-based billing, pricing, or plans. If Autumn is already set up, use autumn-catalog instead.",
-    version: "2.0.42",
+    version: "2.0.43",
     markdown: `---
 name: autumn-setup
 description: First-time Autumn setup — install the atmn CLI, connect to an org (sign in, or keyless with no account), turn the user's pricing into autumn.config.ts, and push it to a sandbox org. Use when the user is new to Autumn, pastes an Autumn setup prompt, or asks to set up Autumn, add billing, monetization, subscriptions, usage-based billing, pricing, or plans. If Autumn is already set up, use autumn-catalog instead.
-version: 2.0.42
+version: 2.0.43
 ---
 
 # Setup
@@ -9745,11 +9747,11 @@ Then stop. Don't keep building, don't tour the dashboard, don't deploy anything.
   {
     name: "autumn-catalog",
     description: "Modeling a user's pricing into an Autumn catalog — deciding the structure (plans, variants, add-ons, licenses, credit systems, pooled balances) before writing config, then filling in the numbers. Use when the user describes their pricing or asks to model, change, or push a catalog.",
-    version: "2.0.42",
+    version: "2.0.43",
     markdown: `---
 name: autumn-catalog
 description: Modeling a user's pricing into an Autumn catalog — deciding the structure (plans, variants, add-ons, licenses, credit systems, pooled balances) before writing config, then filling in the numbers. Use when the user describes their pricing or asks to model, change, or push a catalog.
-version: 2.0.42
+version: 2.0.43
 ---
 
 # Catalog
@@ -13616,7 +13618,7 @@ Pitch: "Pro $20/mo or $200/yr — 1,000 messages per month either way."
       },
       {
         path: "references/atmn.md",
-        contents: "# atmn catalog flows\n\nContents: commands · when to use it · the config is the catalog's state (versions, renames, drafts) · variants and licenses · config shapes · splitting the config · update loop · pull · webhooks · sandboxes and keys · what to show the user.\n\nUse `atmn` when a project has or should have an `autumn.config.ts` source of truth.\n\nCommands — these two, not `atmn preview` (that does not exist):\n\n```sh\natmn push          # lints, then previews the diff; applies nothing\natmn push --yes    # apply exactly what the preview showed\n```\n\n`push` without `--yes` is always a dry run, on a clean org too, and it never asks anything: `--yes` is the only gate. The commands that do ask (`init`, `login --keyless`, `sandbox use`, `skills install`) print the flag to pass instead whenever there is no TTY, which is every agent run; `--headless` forces that in a terminal.\n\n## When to use it\n\n- New project: run `atmn init`. It connects (sign in, or keyless), places the config, pulls whatever the org already holds, and installs these skills beside it.\n- Existing project: if `autumn.config.ts` exists, run `atmn pull` first so every row carries its server ids, then edit and push. Never rewrite a config that predates you from scratch.\n- Use MCP/API directly when the user wants dashboard/API-first changes or there is no local config workflow.\n\n## The config is the catalog's state\n\nThe document is the whole desired catalog for every collection it states. A plan or feature missing from a stated `plans` / `features` is a deletion (archived when customers depend on it). A collection left out entirely is not managed. That rule reaches down to versions: **a version row missing from `plans` is deleted too**.\n\nEvery version of a plan is a row in `plans`. Rows of one plan share a `planId`; each names its version with `versionSlug`; exactly one is `active: true` and the rest `active: false`. There is no history collection and no timeline — array order means nothing. What a version *is* (a group of customers, not a step in time) is the `autumn-concepts` skill's: read `references/plan.md` in the `autumn-concepts` skill. This file owns how rows express it.\n\nTwo fields make a row addressable:\n\n- `planId` + `versionSlug` — what you write. The pair names exactly one version. `versionSlug` is required on every plan row and every variant row, including a plan's only version; an omitted slug is a lint error, never an implicit `v1`.\n- `internalId` — the server's stable id. It is minted on the first `push --yes` and written back into the fixture; `pull` writes it for every row that lacks one. A fixture carrying it can be renamed (`planId`, `featureId`, `versionSlug`) and the server treats that as a rename, not a delete plus create.\n\n**This is where atmn differs from the API and the dashboard.** Those send one plan entry plus flags — `versioning`, `active`, `propagate` — as `references/catalog-update.md` describes. A config has none of those flags. The intent is read off the rows — which rows exist, which one is active, which carry an `internalId` — and the preview reports what the server derived. If the preview says something other than what you meant, change the rows and preview again; never look for a flag.\n\n| You want | Row edit | Preview shows |\n|---|---|---|\n| Change a version in place (active or history) | edit that row; keep its `versionSlug` and `internalId` | `~ pro@v1`, a migration for its customers |\n| The same change on every version | make the edit on every row of the plan | one `~` per row |\n| A new version; customers stay on the old one | add a row: same `planId`, new `versionSlug`, `active: true`, **no `internalId`**; flip the old row to `active: false` | `+ pro@v2`, and `active: true -> false` on the old row |\n| A draft nobody can buy yet | add the row with `active: false` beside the active one | `+` with no pointer move |\n| Rename the plan id | change `planId` on **every** row of the plan (all carry `internalId`) | a rename, not `-` + `+` |\n| Rename a version | change `versionSlug` on a row that carries `internalId` | `Version slug` rename |\n| Retire a version | remove its row | `-`; refused while customers are on it (it names both exits: migrate them, or archive the whole plan) |\n\nGuards the lint applies before anything is sent: a plan with no active row or two active rows (`mark the one customers can buy active: true and the rest active: false`), a missing `versionSlug`, the same `planId` + `versionSlug` twice. A plan whose only row is `active: false` is refused — a draft needs an active sibling.\n\nNumbers vs slugs: the server numbers versions in creation order and the preview labels rows with that number (`pro@v2`). The config never states numbers, only slugs. Push a `v1` row after `v2` already exists and the server numbers it higher; the slug still says `v1`. Never read a preview number back as the slug.\n\n## Variants and licenses\n\nWhat a variant's customize can change, when a base edit reaches a variant, and how a license link anchors to a child version are catalog-wide: `references/catalog-update.md`. What is atmn's:\n\n- A variant is an entry in its base row's `variants` array and a license link an entry in the parent row's `licenses` array: `variant({...})` and `license({...})` fixtures, inline or imported from their own files, edited in place there. Pull writes new ones in that form. Every entry the config lists is a declared overlay; there is no `propagate` in a config, so a base edit reaches a variant through the entry you write, not a follow flag.\n- Minting a base version means listing the variant entries again under the new base row, each with the new `versionSlug` and no `internalId`. The old entries stay under the old base row. One variant version cannot serve two base rows; the lint names both rows and says to version and relink the variant.\n- To retire a variant, set `archived: true` on its entry. A variant left out of the array is a deletion, refused while customers hold it.\n- Every `license({...})` states `versionSlug` — the lint refuses one without it — because the link is pinned to that child version and a config that names it links the same version in every environment. Pull writes it back. Minting a child version moves no parent; relinking a parent is editing that slug.\n\n## Config shapes\n\n`autumn.config.ts` uses the atmn package types, not raw API JSON. Field names are camelCase: `featureId`, `planId`, `billingMethod`, `billingUnits`, `freeTrial`, `intervalCount`, `versionSlug`. Follow the exported types from the package when editing config. Amounts are plain dollars: $20 is `20`, never `2000`.\n\nBuilders — `feature`, `plan`, `variant`, `license`. Items are plain objects on the plan; there is no `item()` builder and fixtures expose `featureId` / `planId`, never `.id`. A plan with an active `v2`, its `v1` kept for the customers still on it, each with an annual variant:\n\n```ts\nimport { atmn, feature, plan, variant } from \"atmn\";\n\nexport const messages = feature({\n  featureId: \"messages\",\n  name: \"Messages\",\n  type: \"metered\",\n  consumable: true,\n});\n\nexport const proAnnualV2 = variant({\n  variantPlanId: \"pro_annual\",\n  versionSlug: \"v2\",\n  name: \"Pro Annual\",\n  customize: { price: { amount: 250, interval: \"year\" } },\n});\n\nexport const proAnnualV1 = variant({\n  variantPlanId: \"pro_annual\",\n  versionSlug: \"v1\",\n  name: \"Pro Annual\",\n  customize: { price: { amount: 200, interval: \"year\" } },\n});\n\nexport const proV2 = plan({\n  planId: \"pro\",\n  versionSlug: \"v2\",\n  active: true,\n  name: \"Pro\",\n  price: { amount: 25, interval: \"month\" },\n  items: [{ featureId: messages.featureId, included: 10000, reset: { interval: \"month\" } }],\n  variants: [proAnnualV2],\n});\n\nexport const proV1 = plan({\n  internalId: \"prod_…\", // written back by push --yes / pull\n  planId: \"pro\",\n  versionSlug: \"v1\",\n  active: false,\n  name: \"Pro\",\n  price: { amount: 20, interval: \"month\" },\n  items: [{ featureId: messages.featureId, included: 5000, reset: { interval: \"month\" } }],\n  variants: [proAnnualV1],\n});\n\nexport default atmn({ features: [messages], plans: [proV2, proV1] });\n```\n\nBefore `proV2` existed, `proV1` was the active row; minting `v2` was adding `proV2` without an `internalId` and flipping `proV1` to `active: false`.\n\nUsage-priced item:\n\n```ts\n{\n  featureId: messages.featureId,\n  included: 10000,\n  reset: { interval: \"month\" },\n  price: {\n    amount: 0.9,\n    billingMethod: \"usage_based\",\n    billingUnits: 1000,\n    interval: \"month\",\n  },\n}\n```\n\n## Splitting the config\n\n`atmn init` scaffolds four files: `autumn.config.ts` (the root, `export default atmn({...})`), `features.ts`, `plans.ts`, `rewards.ts`. Every version of every plan lives in the `plans` array — active and history rows side by side. The config is ordinary TypeScript, so a row can be lifted into its own file under any export name and referenced from the array; `pull` follows imports and edits each fixture where it lives, and appends rows it has to add to the imported array. What it cannot do is edit a fixture that is not a plain literal — a spread, a helper call, a `.map()` — and it says so and writes nothing rather than guess.\n\n## Update loop\n\n1. Inspect or create `autumn.config.ts`.\n2. Edit the config to represent the desired catalog.\n3. Run `atmn push` to preview changes.\n4. Show the user the plan diffs, the customer impact, which plans mint a new version, and the draft migrations it would create. If the versioning is not what they meant, change the rows (table above) and preview again.\n5. Rerun `atmn push --yes` to apply the same preview.\n6. Report created/updated/deleted/archived features and plans, and the draft migrations the output lists. `push --yes` also writes `internalId` (and any `versionSlug` the server assigned) back into the fixtures — say so; those edits are expected.\n\nTwo notes push prints that are worth relaying: a plan removed while an id-less plan appears looks like a rename — pull first so the fixture carries its id; and a config still stating a deprecated field (`entityFeatureId`) gets a note naming the replacement.\n\n## Pull\n\n`atmn pull` writes the server's catalog back into the config in place: it flips `active` where the dashboard promoted a version, appends versions the config never mentioned, and backfills `internalId` and `versionSlug`. Run it after anyone touches the dashboard, and before editing a config you did not write. With no config yet, `pull` asks which folder to create it in; headless, it prints the `-c <dir>` hint and stops, so run `atmn init` or pass `-c` instead.\n\n`atmn pull --overwrite` is different: it rewrites `autumn.config.ts` and the `features.ts`, `plans.ts` and `rewards.ts` beside it from the server. It never deletes a file, and it leaves alone any file that does not import the package. It needs `--yes`, and it is the right move only when the config describes a different org than the key — the tell is `Your config no longer matches this org's catalog`. Anywhere else, a plain `pull` is what you want.\n\n## Webhooks\n\n`webhooks` in the config lists the Autumn webhooks it manages, keyed by `id`. Unlike the catalog it is never a deletion list: `push` creates or updates the webhooks it states and leaves every other webhook alone (the preview shows them as `unmanaged`).\n\n`url` is a map keyed by environment, never one string. A missing key means \"don't register this webhook there\", which is not an error:\n\n```ts\nimport { atmn, webhook } from \"atmn\";\n\nexport default atmn({\n  webhooks: [\n    webhook({\n      id: \"billing\",\n      events: [\"billing.updated\", \"balances.limit_reached\"],\n      url: {\n        live: \"https://myapp.com/api/autumn\",            // atmn push -p\n        sandbox: \"https://staging.myapp.com/api/autumn\", // the default sandbox\n        \"qa-team\": \"https://qa.myapp.com/api/autumn\",    // atmn sandbox use qa-team\n      },\n    }),\n  ],\n});\n```\n\n- Keys: `live` for `-p`, `sandbox` for the default sandbox, or a named sandbox's slug (its name lowercased; no spaces). Never copy a sandbox URL into `live`: ask the user for the production URL, or leave `live` out.\n- Every URL must be https and publicly reachable; localhost and private networks are refused, tunnels such as ngrok work.\n- Leave `events` out to receive every event. Don't write `events: []`.\n- Vercel webhooks require their own distinct webhook and are a mutually exclusive variant to the rest. It can only listen to Vercel events and cannot later be changed to listen to non-Vercel events.\n- `id` is permanent: changing it registers a new webhook. Two ids that differ only by case or `-`/`_` are refused.\n- The preview gives a changed URL its own line (`billing url: old → new`). Read it out to the user before `--yes`.\n- `push --yes` writes each new webhook's signing secret once and prints exactly where: `AUTUMN_WEBHOOK_<ID>_SECRET` in `.env.prod` for `-p`, `AUTUMN_WEBHOOK_<ID>_<ORG4>_SECRET` in `.env.local` (or `.env`) for a sandbox. Relay the variable name and file; never print or read the secret.\n- `pull` reads webhooks from every env with a key in your env files (`AUTUMN_SECRET_KEY` → `sandbox`, `AUTUMN_PROD_SECRET_KEY` → `live`, each `AUTUMN_SANDBOX_<id>_SECRET_KEY` → its slug), whatever the target; a key that's rejected or belongs to another org skips its env with a warning and leaves that env's keys alone. Per env it adds webhooks it finds, sets a changed URL, removes the env's key when the server no longer has that webhook, and deletes a webhook whose map ends up empty. A URL written as code (`process.env.X`) is never rewritten; pull warns when it differs from the server. Webhooks already in the dashboard will be pulled and be editable in the config once you pull as usual. Since the dashboard doesn't let you set an ID, a permanent ID will be assigned to this for future reference.\n\n## Sandboxes and keys\n\n- `atmn sandbox use <name>` pins a named sandbox; every command after it targets that sandbox until `atmn sandbox use --clear`.\n- `atmn reset --yes` empties the pinned sandbox; `atmn push --yes` rebuilds it from the config.\n- `atmn env --json` says which org, sandbox and key a command would hit, with `notes` on what to do when something is off.\n- A missing key fails fast and names the fix: `AUTUMN_SECRET_KEY is not set. Run atmn login, or atmn login --keyless if you don't have an account.` — hand that to the setup flow, don't ask the user to paste a key.\n\n## What to show the user\n\n- Which plans mint a new version, and the draft migrations that come with them.\n- Feature/plan/version deletions that will archive instead because dependencies or customers exist.\n- Which sandbox is pinned before applying anything."
+        contents: "# atmn catalog flows\n\nContents: commands · when to use it · the config is the catalog's state (versions, renames, drafts) · variants and licenses · config shapes · splitting the config · update loop · pull · webhooks · sandboxes and keys · what to show the user.\n\nUse `atmn` when a project has or should have an `autumn.config.ts` source of truth.\n\nCommands — these two, not `atmn preview` (that does not exist):\n\n```sh\natmn push          # lints, then previews the diff; applies nothing\natmn push --yes    # apply exactly what the preview showed\n```\n\n`push` without `--yes` is always a dry run, on a clean org too, and it never asks anything: `--yes` is the only gate. The commands that do ask (`init`, `login --keyless`, `sandbox use`, `skills install`) print the flag to pass instead whenever there is no TTY, which is every agent run; `--headless` forces that in a terminal.\n\n## When to use it\n\n- New project: run `atmn init`. It connects (sign in, or keyless), places the config, pulls whatever the org already holds, and installs these skills beside it.\n- Existing project: if `autumn.config.ts` exists, run `atmn pull` first so every row carries its server ids, then edit and push. Never rewrite a config that predates you from scratch.\n- Use MCP/API directly when the user wants dashboard/API-first changes or there is no local config workflow.\n\n## The config is the catalog's state\n\nThe document is the whole desired catalog for every collection it states. A plan or feature missing from a stated `plans` / `features` is a deletion (archived when customers depend on it). A collection left out entirely is not managed. That rule reaches down to versions: **a version row missing from `plans` is deleted too**.\n\nEvery version of a plan is a row in `plans`. Rows of one plan share a `planId`; each names its version with `versionSlug`; exactly one is `active: true` and the rest `active: false`. There is no history collection and no timeline — array order means nothing. What a version *is* (a group of customers, not a step in time) is the `autumn-concepts` skill's: read `references/plan.md` in the `autumn-concepts` skill. This file owns how rows express it.\n\nTwo fields make a row addressable:\n\n- `planId` + `versionSlug` — what you write. The pair names exactly one version. `versionSlug` is required on every plan row and every variant row, including a plan's only version; an omitted slug is a lint error, never an implicit `v1`.\n- `internalId` — the server's stable id. It is minted on the first `push --yes` and written back into the fixture; `pull` writes it for every row that lacks one. A fixture carrying it can be renamed (`planId`, `featureId`, `versionSlug`) and the server treats that as a rename, not a delete plus create.\n\n**This is where atmn differs from the API and the dashboard.** Those send one plan entry plus flags — `versioning`, `active`, `propagate` — as `references/catalog-update.md` describes. A config has none of those flags. The intent is read off the rows — which rows exist, which one is active, which carry an `internalId` — and the preview reports what the server derived. If the preview says something other than what you meant, change the rows and preview again; never look for a flag.\n\n| You want | Row edit | Preview shows |\n|---|---|---|\n| Change a version in place (active or history) | edit that row; keep its `versionSlug` and `internalId` | `~ pro@v1`, a migration for its customers |\n| The same change on every version | make the edit on every row of the plan | one `~` per row |\n| A new version; customers stay on the old one | add a row: same `planId`, new `versionSlug`, `active: true`, **no `internalId`**; flip the old row to `active: false` | `+ pro@v2`, and `active: true -> false` on the old row |\n| A draft nobody can buy yet | add the row with `active: false` beside the active one | `+` with no pointer move |\n| Rename the plan id | change `planId` on **every** row of the plan (all carry `internalId`) | a rename, not `-` + `+` |\n| Rename a version | change `versionSlug` on a row that carries `internalId` | `Version slug` rename |\n| Retire a version | remove its row | `-`; refused while customers are on it (it names both exits: migrate them, or archive the whole plan) |\n\nGuards the lint applies before anything is sent: a plan with no active row or two active rows (`mark the one customers can buy active: true and the rest active: false`), a missing `versionSlug`, the same `planId` + `versionSlug` twice. A plan whose only row is `active: false` is refused — a draft needs an active sibling.\n\nNumbers vs slugs: the server numbers versions in creation order and the preview labels rows with that number (`pro@v2`). The config never states numbers, only slugs. Push a `v1` row after `v2` already exists and the server numbers it higher; the slug still says `v1`. Never read a preview number back as the slug.\n\n## Variants and licenses\n\nWhat a variant's customize can change, when a base edit reaches a variant, and how a license link anchors to a child version are catalog-wide: `references/catalog-update.md`. What is atmn's:\n\n- A variant is an entry in its base row's `variants` array and a license link an entry in the parent row's `licenses` array: `variant({...})` and `license({...})` fixtures, inline or imported from their own files, edited in place there. Pull writes new ones in that form. Every entry the config lists is a declared overlay; there is no `propagate` in a config, so a base edit reaches a variant through the entry you write, not a follow flag.\n- Minting a base version means listing the variant entries again under the new base row, each with the new `versionSlug` and no `internalId`. The old entries stay under the old base row. One variant version cannot serve two base rows; the lint names both rows and says to version and relink the variant.\n- To retire a variant, set `archived: true` on its entry. A variant left out of the array is a deletion, refused while customers hold it.\n- Every `license({...})` states `versionSlug` — the lint refuses one without it — because the link is pinned to that child version and a config that names it links the same version in every environment. Pull writes it back. Minting a child version moves no parent; relinking a parent is editing that slug.\n\n## Config shapes\n\n`autumn.config.ts` uses the atmn package types, not raw API JSON. Field names are camelCase: `featureId`, `planId`, `billingMethod`, `billingUnits`, `freeTrial`, `intervalCount`, `versionSlug`. Follow the exported types from the package when editing config. Amounts are plain dollars: $20 is `20`, never `2000`.\n\nBuilders — `feature`, `plan`, `variant`, `license`. Items are plain objects on the plan; there is no `item()` builder and fixtures expose `featureId` / `planId`, never `.id`. A plan with an active `v2`, its `v1` kept for the customers still on it, each with an annual variant:\n\n```ts\nimport { atmn, feature, plan, variant } from \"atmn\";\n\nexport const messages = feature({\n  featureId: \"messages\",\n  name: \"Messages\",\n  type: \"metered\",\n  consumable: true,\n});\n\nexport const proAnnualV2 = variant({\n  variantPlanId: \"pro_annual\",\n  versionSlug: \"v2\",\n  name: \"Pro Annual\",\n  customize: { price: { amount: 250, interval: \"year\" } },\n});\n\nexport const proAnnualV1 = variant({\n  variantPlanId: \"pro_annual\",\n  versionSlug: \"v1\",\n  name: \"Pro Annual\",\n  customize: { price: { amount: 200, interval: \"year\" } },\n});\n\nexport const proV2 = plan({\n  planId: \"pro\",\n  versionSlug: \"v2\",\n  active: true,\n  name: \"Pro\",\n  price: { amount: 25, interval: \"month\" },\n  items: [{ featureId: messages.featureId, included: 10000, reset: { interval: \"month\" } }],\n  variants: [proAnnualV2],\n});\n\nexport const proV1 = plan({\n  internalId: \"prod_…\", // written back by push --yes / pull\n  planId: \"pro\",\n  versionSlug: \"v1\",\n  active: false,\n  name: \"Pro\",\n  price: { amount: 20, interval: \"month\" },\n  items: [{ featureId: messages.featureId, included: 5000, reset: { interval: \"month\" } }],\n  variants: [proAnnualV1],\n});\n\nexport default atmn({ features: [messages], plans: [proV2, proV1] });\n```\n\nBefore `proV2` existed, `proV1` was the active row; minting `v2` was adding `proV2` without an `internalId` and flipping `proV1` to `active: false`.\n\nUsage-priced item:\n\n```ts\n{\n  featureId: messages.featureId,\n  included: 10000,\n  reset: { interval: \"month\" },\n  price: {\n    amount: 0.9,\n    billingMethod: \"usage_based\",\n    billingUnits: 1000,\n    interval: \"month\",\n  },\n}\n```\n\n## Splitting the config\n\n`atmn init` scaffolds four files: `autumn.config.ts` (the root, `export default atmn({...})`), `features.ts`, `plans.ts`, `rewards.ts`. Every version of every plan lives in the `plans` array — active and history rows side by side. The config is ordinary TypeScript, so a row can be lifted into its own file under any export name and referenced from the array; `pull` follows imports and edits each fixture where it lives, and appends rows it has to add to the imported array. What it cannot do is edit a fixture that is not a plain literal — a spread, a helper call, a `.map()` — and it says so and writes nothing rather than guess.\n\n## Update loop\n\n1. Inspect or create `autumn.config.ts`.\n2. Edit the config to represent the desired catalog.\n3. Run `atmn push` to preview changes.\n4. Show the user the plan diffs, the customer impact, which plans mint a new version, and the draft migrations it would create. If the versioning is not what they meant, change the rows (table above) and preview again.\n5. Rerun `atmn push --yes` to apply the same preview.\n6. Report created/updated/deleted/archived features and plans, and the draft migrations the output lists. `push --yes` also writes `internalId` (and any `versionSlug` the server assigned) back into the fixtures — say so; those edits are expected.\n\nTwo notes push prints that are worth relaying: a plan removed while an id-less plan appears looks like a rename — pull first so the fixture carries its id; and a config still stating a deprecated field (`entityFeatureId`) gets a note naming the replacement.\n\n## Pull\n\n`atmn pull` writes the server's catalog back into the config in place: it flips `active` where the dashboard promoted a version, appends versions the config never mentioned, and backfills `internalId` and `versionSlug`. Run it after anyone touches the dashboard, and before editing a config you did not write. With no config yet, `pull` asks which folder to create it in; headless, it prints the `-c <dir>` hint and stops, so run `atmn init` or pass `-c` instead.\n\n`atmn pull --overwrite` is different: it rewrites `autumn.config.ts` and the `features.ts`, `plans.ts` and `rewards.ts` beside it from the server. It never deletes a file, and it leaves alone any file that does not import the package. It needs `--yes`, and it is the right move only when the config describes a different org than the key — the tell is `Your config no longer matches this org's catalog`. Anywhere else, a plain `pull` is what you want.\n\n## Webhooks\n\n`webhooks` in the config lists the Autumn webhooks it manages. Each `webhook()` is one endpoint in one environment, keyed by `env` and `id`. Unlike the catalog it is never a deletion list: `push` creates or updates the webhooks it states and leaves every other webhook alone (the preview shows them as `unmanaged`).\n\nTo register a webhook in several environments, write one `webhook()` per environment. The same `id` may repeat across environments:\n\n```ts\nimport { atmn, webhook } from \"atmn\";\n\nconst events = [\"billing.updated\", \"balances.limit_reached\"];\n\nexport default atmn({\n  webhooks: [\n    webhook({ id: \"billing\", env: \"live\", url: \"https://myapp.com/api/autumn\", events }),              // atmn push -p\n    webhook({ id: \"billing\", env: \"sandbox\", url: \"https://staging.myapp.com/api/autumn\", events }),   // the default sandbox\n    webhook({ id: \"billing\", env: \"qa-team\", url: \"https://qa.myapp.com/api/autumn\", events }),        // the sandbox named qa-team\n  ],\n});\n```\n\n- `env`: `live` for `-p`, `sandbox` for the default sandbox, or a named sandbox's slug (its name lowercased; no spaces). An environment with no entry has nothing registered. Never copy a sandbox URL into a `live` entry: ask the user for the production URL, or leave `live` out.\n- One `id` may appear once per `env`; a repeat in the same env is refused.\n- Configs from atmn 2.0.36–2.0.42 stated `url` as a map (`url: { live, sandbox }`). That shape is refused: split it into one `webhook()` per env.\n- Every URL must be https and publicly reachable; localhost and private networks are refused, tunnels such as ngrok work.\n- Leave `events` out to receive every event. Don't write `events: []`.\n- Vercel webhooks require their own distinct webhook and are a mutually exclusive variant to the rest. It can only listen to Vercel events and cannot later be changed to listen to non-Vercel events.\n- `id` is permanent: changing it registers a new webhook. In one env, two ids that differ only by case or `-`/`_` are refused.\n- A webhook made in the dashboard has no id of its own, so its entry uses the `ep_…` id `pull` writes. Keep that id: push updates that endpoint by it.\n- `push` syncs webhooks to every sandbox with a key in your env files (`AUTUMN_SECRET_KEY` → `sandbox`, each `AUTUMN_SANDBOX_<id>_SECRET_KEY` → its slug), each through its own key, whichever sandbox is pinned. The preview shows one `Webhooks · <env>` block per env with changes. A key that's rejected or belongs to another org skips its env with a warning. The catalog and settings still go to the targeted env only.\n- Production webhooks change only with `-p`, which syncs `live` and no sandbox. When `AUTUMN_PROD_SECRET_KEY` is set, a plain push also previews `live` read-only, and if production would change it prints `Production webhooks differ from your config (<ids>). Run atmn push -p to update production.` Relay that line, and run `-p` only when the user asks.\n- The preview gives a changed URL its own line (`billing url: old → new`). Read it out to the user before `--yes`.\n- `push --yes` writes each new webhook's signing secret once and prints exactly where: `AUTUMN_WEBHOOK_<ID>_SECRET` in `.env.prod` for `-p`, `AUTUMN_WEBHOOK_<ID>_<SANDBOX_SLUG>_SECRET` in `.env.local` (or `.env`) for each sandbox (`AUTUMN_WEBHOOK_BILLING_SANDBOX_SECRET` for the default sandbox, `AUTUMN_WEBHOOK_BILLING_QA_TEAM_SECRET` for `qa-team`). Secrets saved earlier keep their existing names. If two sandboxes' names differ only by punctuation (`qa-team`, `qa_team`), they would share a variable, so push refuses before writing; ask the user to rename one. Relay the variable name and file; never print or read the secret.\n- `pull` reads webhooks from every env with a key in your env files (`AUTUMN_SECRET_KEY` → `sandbox`, `AUTUMN_PROD_SECRET_KEY` → `live`, each `AUTUMN_SANDBOX_<id>_SECRET_KEY` → its slug), whatever the target. A key that's rejected, belongs to another org, or whose sandbox is gone skips its env with a warning, and that env's entries stay. For each env it read, pull writes one entry per endpoint: it adds new ones (dashboard ones under their `ep_…` id), updates changed fields, and deletes an entry the server no longer has in that env. A value written as code (`process.env.X`) is never rewritten; pull warns when it differs from the server.\n\n## Sandboxes and keys\n\n- `atmn sandbox use <name>` pins a named sandbox; every command after it targets that sandbox until `atmn sandbox use --clear`.\n- `atmn reset --yes` empties the pinned sandbox; `atmn push --yes` rebuilds it from the config.\n- `atmn env --json` says which org, sandbox and key a command would hit, with `notes` on what to do when something is off.\n- A missing key fails fast and names the fix: `AUTUMN_SECRET_KEY is not set. Run atmn login, or atmn login --keyless if you don't have an account.` — hand that to the setup flow, don't ask the user to paste a key.\n\n## What to show the user\n\n- Which plans mint a new version, and the draft migrations that come with them.\n- Feature/plan/version deletions that will archive instead because dependencies or customers exist.\n- Which sandbox is pinned before applying anything."
       },
       {
         path: "references/catalog-update.md",
@@ -13631,11 +13633,11 @@ Pitch: "Pro $20/mo or $200/yr — 1,000 messages per month either way."
   {
     name: "autumn-integrate",
     description: "Integrating Autumn into an app's backend — creating customers, billing flows (attach, checkout, upgrade, cancel), gating features with check, recording usage with track, and exposing billing data to the frontend. Use when the user asks to integrate Autumn, add billing/payments to their app, gate features, meter usage, or build checkout/upgrade flows. Requires a pushed catalog; use autumn-catalog first if plans don't exist yet.",
-    version: "2.0.42",
+    version: "2.0.43",
     markdown: `---
 name: autumn-integrate
 description: Integrating Autumn into an app's backend — creating customers, billing flows (attach, checkout, upgrade, cancel), gating features with check, recording usage with track, and exposing billing data to the frontend. Use when the user asks to integrate Autumn, add billing/payments to their app, gate features, meter usage, or build checkout/upgrade flows. Requires a pushed catalog; use autumn-catalog first if plans don't exist yet.
-version: 2.0.42
+version: 2.0.43
 ---
 
 # Integrate
@@ -18237,11 +18239,11 @@ Monitor your logs for this message. If you see it, check [status.useautumn.com](
   {
     name: "autumn-concepts",
     description: "Understanding Autumn's billing objects before acting on them — what a plan version is and what active means, when a trial starts or ends billing, how entity- and seat-scoped subscriptions differ from the customer's own, what a customize diff actually changes, and how caps, overage, and top-ups behave. Load before versioning, editing, or drafting a plan, or when a customer's state does not match the plain reading of their plan.",
-    version: "2.0.42",
+    version: "2.0.43",
     markdown: `---
 name: autumn-concepts
 description: Understanding Autumn's billing objects before acting on them — what a plan version is and what active means, when a trial starts or ends billing, how entity- and seat-scoped subscriptions differ from the customer's own, what a customize diff actually changes, and how caps, overage, and top-ups behave. Load before versioning, editing, or drafting a plan, or when a customer's state does not match the plain reading of their plan.
-version: 2.0.42
+version: 2.0.43
 ---
 
 # Concepts
@@ -19429,7 +19431,7 @@ var runOAuthFlow = async ({
     if (outcome)
       return outcome;
   }
-  throw new Error(`All OAuth callback ports (${OAUTH_PORTS.at(0)}-${OAUTH_PORTS.at(-1)}) are in use.`);
+  throw new Error(`All OAuth callback ports (${OAUTH_PORTS[0]}-${OAUTH_PORTS[OAUTH_PORTS.length - 1]}) are in use.`);
 };
 
 // src/actions/login.ts
@@ -22493,65 +22495,6 @@ var rewriteConfig = ({
   return { rewritten: [configPath, ...rewritten], kept };
 };
 
-// src/actions/webhooks/isDashboardWebhook.ts
-var SVIX_ENDPOINT_ID = /^ep_[0-9A-Za-z]{27}$/;
-var isDashboardWebhook = ({ id }) => SVIX_ENDPOINT_ID.test(id);
-
-// ../ksuid/src/base62.ts
-var ALPHABET = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
-var base62Encode = ({
-  bytes,
-  padTo
-}) => {
-  const digits = [];
-  const working = new Uint8Array(bytes);
-  let allZero = false;
-  while (!allZero) {
-    allZero = true;
-    let remainder = 0;
-    for (let i = 0;i < working.length; i++) {
-      const accumulator = remainder * 256 + working[i];
-      working[i] = Math.floor(accumulator / 62);
-      remainder = accumulator % 62;
-      if (working[i] !== 0)
-        allZero = false;
-    }
-    digits.push(remainder);
-  }
-  digits.reverse();
-  while (digits.length < padTo) {
-    digits.unshift(0);
-  }
-  return digits.map((d) => ALPHABET[d]).join("");
-};
-
-// ../ksuid/src/random.ts
-var getRandomBytes = ({ size }) => {
-  const buffer = new Uint8Array(size);
-  globalThis.crypto.getRandomValues(buffer);
-  return buffer;
-};
-
-// ../ksuid/src/index.ts
-var KSUID_EPOCH = 1400000000;
-var PAYLOAD_BYTES = 20;
-var ENCODED_LENGTH = 27;
-var generateKsuid = ({ prefix = "" } = {}) => {
-  const payload = new Uint8Array(PAYLOAD_BYTES);
-  const timestamp = Math.floor(Date.now() / 1000) - KSUID_EPOCH;
-  payload[0] = timestamp >>> 24 & 255;
-  payload[1] = timestamp >>> 16 & 255;
-  payload[2] = timestamp >>> 8 & 255;
-  payload[3] = timestamp & 255;
-  const randomBytes = getRandomBytes({ size: 16 });
-  payload.set(randomBytes, 4);
-  const encoded = base62Encode({ bytes: payload, padTo: ENCODED_LENGTH });
-  return `${prefix}${encoded}`;
-};
-
-// src/actions/webhooks/newWebhookId.ts
-var newWebhookId = () => generateKsuid({ prefix: "wh_" });
-
 // src/actions/pull/webhooks/appendWebhook.ts
 var SPEC = SYNCED_LISTS.webhooks;
 var COLLECTION = "webhooks";
@@ -22560,7 +22503,8 @@ var fixtureRowOf = ({
   envKey
 }) => ({
   id: webhook.id,
-  url: { [envKey]: webhook.url },
+  [SPEC.envField]: envKey,
+  url: webhook.url,
   ...webhook.events.length > 0 ? { events: webhook.events } : {},
   ...webhook.description ? { description: webhook.description } : {},
   ...webhook.disabled ? { disabled: true } : {}
@@ -22611,19 +22555,67 @@ var appendWebhook = ({
 var SPEC2 = SYNCED_LISTS.webhooks;
 var locateWebhook = ({
   pull,
-  id
+  id,
+  envKey
 }) => locateFixture({
   configPath: pull.configPath,
   files: pull.files,
   builder: SPEC2.builder,
   idField: SPEC2.idField,
   id,
+  where: webhookWhere({ envKey }),
   allowDynamic: true
 });
+var webhookWhere = ({ envKey }) => [
+  { field: SPEC2.envField, equals: envKey }
+];
+
+// src/actions/pull/webhooks/deleteWebhook.ts
+var SPEC3 = SYNCED_LISTS.webhooks;
+var deleteWebhook = ({
+  pull,
+  stated: stated2,
+  envKey
+}) => {
+  const result = { lines: [], warnings: [], unlocated: [] };
+  const located = locateWebhook({ pull, id: stated2.id, envKey });
+  const removed = located === null ? null : deleteFixtureLiteral({
+    source: located.source,
+    builder: SPEC3.builder,
+    idField: SPEC3.idField,
+    id: stated2.id,
+    where: webhookWhere({ envKey })
+  });
+  if (located === null || removed === null) {
+    result.unlocated.push({
+      id: stated2.id,
+      action: `delete the ${envKey} webhook by hand`
+    });
+    return result;
+  }
+  pull.files.set(located.file, removed.source);
+  if (removed.exportedName !== undefined) {
+    const referenceFiles = new Set([pull.configPath]);
+    const target = resolveCollectionTarget({
+      configPath: pull.configPath,
+      files: pull.files,
+      collection: "webhooks"
+    });
+    if (target !== null)
+      referenceFiles.add(target.file);
+    for (const file of referenceFiles)
+      pull.files.set(file, deleteReference({
+        source: pull.files.get(file) ?? "",
+        name: removed.exportedName
+      }));
+  }
+  result.lines.push(`- webhook ${stated2.id} (${envKey})`);
+  return result;
+};
 
 // src/actions/pull/webhooks/updateWebhook.ts
 import { isDeepStrictEqual as isDeepStrictEqual2 } from "node:util";
-var SPEC3 = SYNCED_LISTS.webhooks;
+var SPEC4 = SYNCED_LISTS.webhooks;
 var sameEvents = (left, right) => Array.isArray(left) && isDeepStrictEqual2([...left].sort(), [...right].sort());
 var fieldAssignments = ({
   webhook,
@@ -22658,8 +22650,8 @@ var nonLiteralUrlWarning = ({
 }) => {
   const pad = " ".repeat(id.length + 4);
   return [
-    `⚠ ${id}  url.${envKey} isn't a plain string, so pull left it untouched`,
-    `${pad}server:      ${server ?? "(not registered)"}`,
+    `⚠ ${id} (${envKey})  url isn't a plain string, so pull left it untouched`,
+    `${pad}server:      ${server}`,
     `${pad}your config: ${typeof config === "string" ? config : "(no value)"}`,
     `${pad}Update it by hand, or make it a string and pull will manage it.`
   ].join(`
@@ -22672,161 +22664,57 @@ var updateWebhook = ({
   envKey
 }) => {
   const result = { lines: [], warnings: [], unlocated: [] };
-  const located = locateWebhook({ pull, id: webhook.id });
-  if (located === null) {
-    result.unlocated.push({
-      id: webhook.id,
-      action: "update from the server by hand"
-    });
-    return result;
-  }
-  const patched = patchFixturePaths({
+  const label = `${webhook.id} (${envKey})`;
+  const located = locateWebhook({ pull, id: webhook.id, envKey });
+  const patched = located === null ? null : patchFixturePaths({
     source: located.source,
-    builder: SPEC3.builder,
-    idField: SPEC3.idField,
+    builder: SPEC4.builder,
+    idField: SPEC4.idField,
     id: webhook.id,
+    where: webhookWhere({ envKey }),
     assignments: [
-      { path: ["url", envKey], text: JSON.stringify(webhook.url) },
+      { path: ["url"], text: JSON.stringify(webhook.url) },
       ...fieldAssignments({ webhook, stated: stated2 })
     ],
     bareKeys: true
   });
-  if (patched === null) {
+  if (located === null || patched === null) {
     result.unlocated.push({
       id: webhook.id,
-      action: "update from the server by hand"
+      action: `update the ${envKey} webhook from the server by hand`
     });
     return result;
   }
   for (const { path } of patched.skipped) {
     const field = path.join(".");
-    if (field !== `url.${envKey}`) {
-      result.warnings.push(`⚠ ${webhook.id}  ${field} isn't a plain literal, so pull left it untouched`);
+    if (field !== "url") {
+      result.warnings.push(`⚠ ${label}  ${field} isn't a plain literal, so pull left it untouched`);
       continue;
     }
-    const config = stated2.url?.[envKey];
-    if (config === webhook.url)
+    if (stated2.url === webhook.url)
       continue;
     result.warnings.push(nonLiteralUrlWarning({
       id: webhook.id,
       envKey,
       server: webhook.url,
-      config
-    }));
-  }
-  if (patched.source === located.source)
-    return result;
-  pull.files.set(located.file, patched.source);
-  result.lines.push(`~ webhook ${webhook.id}`);
-  return result;
-};
-
-// src/actions/pull/webhooks/removeWebhookEnv.ts
-var SPEC4 = SYNCED_LISTS.webhooks;
-var urlMapIsEmpty = ({
-  pull,
-  id
-}) => {
-  const located = locateWebhook({ pull, id });
-  const object = located === null ? null : fixtureObjectOf(located.node);
-  const member = object?.namedChildren().find((child) => child.kind() === "pair" && child.field("key") !== null && fixtureKeyOf({ node: child.field("key") }) === "url");
-  const value = member?.field("value");
-  if (value === null || value === undefined)
-    return false;
-  const read = readFixtureValue({ node: value });
-  return typeof read === "object" && read !== null && Object.keys(read).length === 0;
-};
-var deleteWebhook = ({
-  pull,
-  id
-}) => {
-  const located = locateWebhook({ pull, id });
-  if (located === null)
-    return false;
-  const removed = deleteFixtureLiteral({
-    source: located.source,
-    builder: SPEC4.builder,
-    idField: SPEC4.idField,
-    id
-  });
-  if (removed === null)
-    return false;
-  pull.files.set(located.file, removed.source);
-  if (removed.exportedName !== undefined) {
-    const referenceFiles = new Set([pull.configPath]);
-    const target = resolveCollectionTarget({
-      configPath: pull.configPath,
-      files: pull.files,
-      collection: "webhooks"
-    });
-    if (target !== null)
-      referenceFiles.add(target.file);
-    for (const file of referenceFiles)
-      pull.files.set(file, deleteReference({
-        source: pull.files.get(file) ?? "",
-        name: removed.exportedName
-      }));
-  }
-  return true;
-};
-var removeWebhookEnv = ({
-  pull,
-  stated: stated2,
-  envKey
-}) => {
-  const result = { lines: [], warnings: [], unlocated: [] };
-  const located = locateWebhook({ pull, id: stated2.id });
-  const patched = located === null ? null : patchFixturePaths({
-    source: located.source,
-    builder: SPEC4.builder,
-    idField: SPEC4.idField,
-    id: stated2.id,
-    assignments: [{ path: ["url", envKey], text: null }]
-  });
-  if (located === null || patched === null) {
-    result.unlocated.push({
-      id: stated2.id,
-      action: `remove url.${envKey} by hand`
-    });
-    return result;
-  }
-  if (patched.skipped.length > 0) {
-    result.warnings.push(nonLiteralUrlWarning({
-      id: stated2.id,
-      envKey,
-      server: undefined,
-      config: stated2.url?.[envKey]
+      config: stated2.url
     }));
-    return result;
   }
   if (patched.source === located.source)
     return result;
   pull.files.set(located.file, patched.source);
-  if (urlMapIsEmpty({ pull, id: stated2.id })) {
-    if (deleteWebhook({ pull, id: stated2.id })) {
-      result.lines.push(`- webhook ${stated2.id}`);
-      return result;
-    }
-    result.unlocated.push({
-      id: stated2.id,
-      action: "delete the webhook by hand: its url map is now empty"
-    });
-    return result;
-  }
-  result.lines.push(`- webhook ${stated2.id} url.${envKey}`);
+  result.lines.push(`~ webhook ${label}`);
   return result;
 };
 
 // src/actions/pull/webhooks/applyWebhooksPull.ts
-var isVercelWebhook = (events) => Array.isArray(events) && events.length > 0 && events.every((event) => typeof event === "string" && event.startsWith("vercel."));
 var statedFrom = ({
-  row,
   webhook,
   envKey
 }) => ({
-  ...row,
   id: webhook.id,
-  url: { ...row?.url, [envKey]: webhook.url },
+  env: envKey,
+  url: webhook.url,
   events: webhook.events.length > 0 ? webhook.events : undefined,
   description: webhook.description,
   disabled: webhook.disabled
@@ -22840,73 +22728,37 @@ var applyWebhooksPull = ({
   pull,
   remote,
   stated: stated2,
-  envKey,
-  newId = newWebhookId
+  envKey
 }) => {
   const result = { lines: [], warnings: [], unlocated: [] };
-  const statedById = new Map((stated2 ?? []).map((row) => [row.id, row]));
-  const next = new Map(statedById);
-  const fromDashboard = (webhook) => !statedById.has(webhook.id) && isDashboardWebhook(webhook);
-  const present = new Set;
+  const rows = stated2 ?? [];
+  const inEnv = new Map(rows.filter((row) => row.env === envKey).map((row) => [row.id, row]));
+  const next = rows.filter((row) => row.env !== envKey);
   for (const webhook of remote) {
-    if (fromDashboard(webhook)) {
-      const sameApp = (row2) => isVercelWebhook(row2.events) === isVercelWebhook(webhook.events);
-      const represented = (stated2 ?? []).find((row2) => row2.url?.[envKey] === webhook.url && sameApp(row2)) ?? (stated2 ?? []).find((row2) => row2.url?.[envKey] === undefined && Object.values(row2.url ?? {}).includes(webhook.url) && sameApp(row2));
-      if (represented !== undefined) {
-        present.add(represented.id);
-        next.set(represented.id, statedFrom({
-          row: represented,
-          webhook: { ...webhook, id: represented.id },
-          envKey
-        }));
-        merge(result, updateWebhook({
-          pull,
-          webhook: { ...webhook, id: represented.id },
-          stated: represented,
-          envKey
-        }));
-        continue;
-      }
-      const id = newId();
-      const failure2 = appendWebhook({
-        pull,
-        webhook: { ...webhook, id },
-        envKey
-      });
-      if (failure2 === null) {
-        next.set(id, statedFrom({ row: undefined, webhook: { ...webhook, id }, envKey }));
-        result.lines.push(`+ webhook ${id} (made in the dashboard; push adopts it by URL)`);
-      } else
-        result.unlocated.push({ id, action: failure2 });
-      continue;
-    }
-    present.add(webhook.id);
-    const row = statedById.get(webhook.id);
-    next.set(webhook.id, statedFrom({ row, webhook, envKey }));
+    const row = inEnv.get(webhook.id);
     if (row !== undefined) {
       merge(result, updateWebhook({ pull, webhook, stated: row, envKey }));
+      next.push(statedFrom({ webhook, envKey }));
       continue;
     }
     const failure = appendWebhook({ pull, webhook, envKey });
-    if (failure === null)
-      result.lines.push(`+ webhook ${webhook.id}`);
-    else
+    if (failure !== null) {
       result.unlocated.push({ id: webhook.id, action: failure });
+      continue;
+    }
+    result.lines.push(`+ webhook ${webhook.id} (${envKey})`);
+    next.push(statedFrom({ webhook, envKey }));
   }
-  for (const row of stated2 ?? []) {
-    if (present.has(row.id) || row.url?.[envKey] === undefined)
+  const remoteIds = new Set(remote.map(({ id }) => id));
+  for (const row of inEnv.values()) {
+    if (remoteIds.has(row.id))
       continue;
-    const removed = removeWebhookEnv({ pull, stated: row, envKey });
+    const removed = deleteWebhook({ pull, stated: row, envKey });
     merge(result, removed);
     if (removed.lines.length === 0)
-      continue;
-    const { [envKey]: _removed, ...url } = row.url;
-    if (Object.keys(url).length === 0)
-      next.delete(row.id);
-    else
-      next.set(row.id, { ...row, url });
+      next.push(row);
   }
-  return { ...result, stated: [...next.values()] };
+  return { ...result, stated: next };
 };
 
 // src/generated/sandboxName.ts
@@ -22974,6 +22826,7 @@ var webhookPullEnvs = ({
       {
         keyName,
         label,
+        secretKey,
         envKey,
         listWebhooks: () => listWebhooks({ secretKey })
       }
@@ -22981,8 +22834,28 @@ var webhookPullEnvs = ({
   });
 };
 
+// src/actions/pull/webhooks/webhookEnvSkipWarning.ts
+var skipReason = (error) => {
+  if (error instanceof ForeignOrgKeyError)
+    return "belongs to another org";
+  if (!(error instanceof AutumnApiError))
+    return null;
+  if (error.status === 401 || error.status === 403)
+    return "was rejected";
+  if (error.status !== 404)
+    return null;
+  const { message } = error.body ?? {};
+  return `failed: ${typeof message === "string" ? message : error.status}`;
+};
+var webhookEnvSkipWarning = ({
+  env,
+  error
+}) => {
+  const reason = skipReason(error);
+  return reason === null ? undefined : `⚠ webhooks: skipped ${env.label} (${env.keyName} ${reason})`;
+};
+
 // src/actions/pull/webhooks/readWebhookEnvs.ts
-var isRejectedKey = (error) => error instanceof AutumnApiError && (error.status === 401 || error.status === 403);
 var readWebhookEnvs = async ({
   envs
 }) => {
@@ -22994,11 +22867,10 @@ var readWebhookEnvs = async ({
       ]);
       return { envKey, list: list2 };
     } catch (error) {
-      if (error instanceof ForeignOrgKeyError)
-        return `⚠ webhooks: skipped ${env.label} (${env.keyName} belongs to another org)`;
-      if (!isRejectedKey(error))
+      const warning = webhookEnvSkipWarning({ env, error });
+      if (warning === undefined)
         throw error;
-      return `⚠ webhooks: skipped ${env.label} (${env.keyName} was rejected)`;
+      return warning;
     }
   }));
   return {
@@ -23095,7 +22967,8 @@ var renderWebhooks = ({
   if (rows.length === 0)
     return null;
   const count = webhooks.changes.filter((change) => change.action !== "unmanaged").length;
-  return [chalk4.bold(`Webhooks (${count})`), ...rows].join(`
+  const heading = webhooks.env === undefined ? `Webhooks (${count})` : `Webhooks · ${webhooks.env} (${count})`;
+  return [chalk4.bold(heading), ...rows].join(`
 `);
 };
 
@@ -23522,8 +23395,10 @@ var renderPreview = ({
   const referralPrograms = (preview.referralPrograms ?? []).filter(rowHasWork);
   const migrations = preview.migrations ?? [];
   const settings = settingChanges(preview.settings);
-  const webhooks = preview.webhooks === undefined ? null : renderWebhooks({ webhooks: preview.webhooks });
-  if (features.length === 0 && plans.length === 0 && rewards.length === 0 && referralPrograms.length === 0 && settings.length === 0 && webhooks === null) {
+  const webhooks = (preview.webhooks ?? []).map((lane) => renderWebhooks({ webhooks: lane })).filter((block) => block !== null);
+  const productionWebhooks = preview.productionWebhooks ?? [];
+  const productionHint = productionWebhooks.length > 0 ? chalk5.yellow(`Production webhooks differ from your config (${productionWebhooks.join(", ")}). Run atmn push -p to update production.`) : preview.productionWebhooksUnchecked === true ? chalk5.yellow("Production webhooks weren't checked, so this push can't say they match your config.") : null;
+  if (features.length === 0 && plans.length === 0 && rewards.length === 0 && referralPrograms.length === 0 && settings.length === 0 && webhooks.length === 0 && productionHint === null) {
     return chalk5.dim("No changes. Your catalog matches your config.");
   }
   const sections = [];
@@ -23592,8 +23467,9 @@ var renderPreview = ({
     ].join(`
 `));
   }
-  if (webhooks !== null)
-    sections.push(webhooks);
+  sections.push(...webhooks);
+  if (productionHint !== null)
+    sections.push(productionHint);
   if (migrations.length > 0) {
     sections.push(renderPlannedMigrations({ migrations, plans }));
   }
@@ -23603,7 +23479,7 @@ var renderPreview = ({
 };
 var previewIsEmpty = ({
   preview
-}) => !(preview.features ?? []).some(rowHasWork) && !(preview.plans ?? []).some(rowHasWork) && !(preview.rewards ?? []).some(rowHasWork) && !(preview.referralPrograms ?? []).some(rowHasWork) && !settingsHaveWork({ settings: preview.settings }) && !webhooksHaveWork({ webhooks: preview.webhooks });
+}) => !(preview.features ?? []).some(rowHasWork) && !(preview.plans ?? []).some(rowHasWork) && !(preview.rewards ?? []).some(rowHasWork) && !(preview.referralPrograms ?? []).some(rowHasWork) && !settingsHaveWork({ settings: preview.settings }) && !(preview.webhooks ?? []).some((webhooks) => webhooksHaveWork({ webhooks }));
 
 // src/actions/push/backfillInternalIds.ts
 import { readFileSync as readFileSync12, writeFileSync as writeFileSync8 } from "node:fs";
@@ -24059,18 +23935,35 @@ var withScopeHint = ({
   hint: hint2
 }) => error instanceof AutumnApiError && error.message.includes(SCOPE_REFUSAL) ? new Error(hint2, { cause: error }) : error;
 
+// src/actions/webhooks/webhookEnvFailures.ts
+var throwWebhookEnvFailures = ({
+  failures,
+  envCount,
+  warnings = []
+}) => {
+  if (failures.length === 0)
+    return;
+  throw new Error([
+    ...failures.map(({ env, message }) => envCount > 1 ? message.replace(/^/gm, `${env}: `) : message),
+    ...warnings
+  ].join(`
+`));
+};
+var messageOf2 = (error) => error instanceof Error ? error.message : String(error);
+
 // src/actions/webhooks/writeWebhookSecrets.ts
 import { existsSync as existsSync12, readFileSync as readFileSync13, writeFileSync as writeFileSync9 } from "node:fs";
 import { dirname as dirname11, join as join13, relative as relative6 } from "node:path";
 
 // src/actions/webhooks/webhookSecretName.ts
 var envNameSegment = (value) => value.toUpperCase().replace(/-/g, "_");
+var envKeySegment = (envKey) => envKey.toUpperCase().replace(/[^A-Z0-9]+/g, "_");
 var webhookSecretName = ({
   id,
-  orgId
+  envKey
 }) => {
-  const org4 = orgId === undefined ? "" : `_${envNameSegment(orgId.replace(/^org_/, "").slice(0, 4))}`;
-  return `AUTUMN_WEBHOOK_${envNameSegment(id)}${org4}_SECRET`;
+  const suffix = envKey === undefined ? "" : `_${envKeySegment(envKey)}`;
+  return `AUTUMN_WEBHOOK_${envNameSegment(id)}${suffix}_SECRET`;
 };
 
 // src/actions/webhooks/writeWebhookSecrets.ts
@@ -24087,8 +23980,11 @@ var writeWebhookSecrets = async ({
 }) => {
   if (secrets.length === 0)
     return [];
-  const orgId = env.live ? undefined : await env.orgId();
-  const values = Object.fromEntries(secrets.map(({ id, secret }) => [webhookSecretName({ id, orgId }), secret]));
+  const envKey = env.live ? undefined : env.key;
+  const values = Object.fromEntries(secrets.map(({ id, secret }) => [
+    webhookSecretName({ id, envKey }),
+    secret
+  ]));
   let path;
   if (env.live) {
     path = prodEnvPath({ envDirs });
@@ -24102,16 +23998,13 @@ var writeWebhookSecrets = async ({
 };
 
 // src/actions/webhooks/applyWebhooks.ts
-var applyWebhooks = async ({
-  client,
+var applyLane = async ({
   lane,
   envDirs,
   cwd,
   write
 }) => {
-  if (lane === undefined || !webhooksHaveWork({ webhooks: lane.preview }))
-    return;
-  const result = await client.syncWebhooks(lane.body);
+  const result = await lane.client.syncWebhooks(lane.body);
   const saved = await writeWebhookSecrets({
     secrets: result.secrets,
     env: lane.env,
@@ -24124,54 +24017,168 @@ var applyWebhooks = async ({
   ]);
   const adopted = lane.preview.changes.filter((change) => change.action === "adopt" && !failed.has(change.id)).map((change) => `Adopted ${change.id} (existing dashboard webhook); its signing secret is unchanged, nothing written`);
   write(`
-Applied webhooks.
+Applied webhooks to ${lane.env.key}.
 ${[...adopted, ...saved].map((line2) => `${line2}
 `).join("")}`);
   if (result.errors.length > 0)
     throw new Error(result.errors.map(({ id, message }) => `${id}: ${message}`).join(`
 `));
 };
+var applyWebhooks = async ({
+  lanes,
+  envDirs,
+  cwd,
+  write
+}) => {
+  const withWork = lanes.filter((lane) => webhooksHaveWork({ webhooks: lane.preview }));
+  const results = await Promise.allSettled(withWork.map((lane) => applyLane({ lane, envDirs, cwd, write })));
+  const failures = results.flatMap((result, index) => result.status === "rejected" ? [
+    {
+      env: withWork[index]?.env.key ?? "",
+      message: messageOf2(result.reason)
+    }
+  ] : []);
+  throwWebhookEnvFailures({ failures, envCount: withWork.length });
+};
 
 // src/actions/webhooks/resolveWebhooksForEnv.ts
 var resolveWebhooksForEnv = ({
   rows,
   envKey
 }) => {
-  const { envKeyed } = SYNCED_LISTS.webhooks;
-  const webhooks = [];
-  for (const row of rows) {
-    const values = envKeyed.map((field) => row[field]?.[envKey]);
-    if (values.some((value) => typeof value !== "string"))
-      continue;
-    webhooks.push({
-      ...row,
-      ...Object.fromEntries(envKeyed.map((field, index) => [field, values[index]]))
-    });
-  }
-  return webhooks;
+  const { envField } = SYNCED_LISTS.webhooks;
+  return rows.filter((row) => row[envField] === envKey).map(({ [envField]: _env, ...row }) => row);
 };
 
-// src/actions/webhooks/previewWebhooks.ts
-var previewWebhooks = async ({
-  client,
+// src/actions/webhooks/previewWebhookEnvs.ts
+var isLive = (env) => env.keyName === "AUTUMN_PROD_SECRET_KEY";
+var assertDistinctSecretNames = ({
+  lanes
+}) => {
+  const secretName = ({ lane, id }) => webhookSecretName({
+    id,
+    ...lane.env.live ? {} : { envKey: lane.env.key }
+  });
+  const clashes = new Map;
+  for (const lane of lanes) {
+    for (const change of lane.preview.changes) {
+      if (change.action !== "create")
+        continue;
+      const name = secretName({ lane, id: change.id });
+      for (const other of lanes) {
+        if (other === lane)
+          continue;
+        const shares = other.body.webhooks.some((webhook) => secretName({ lane: other, id: webhook.id }) === name);
+        if (!shares)
+          continue;
+        const [first, second] = [other.env.key, lane.env.key].sort();
+        clashes.set(`${first}|${second}|${name}`, `${first} and ${second} would both save ${change.id}'s signing secret as ${name}. Rename one of those sandboxes so their names differ by more than punctuation.`);
+      }
+    }
+  }
+  if (clashes.size > 0)
+    throw new Error([...clashes.values()].join(`
+`));
+};
+var previewEnv = async ({
+  env,
+  rows,
+  clientFor
+}) => {
+  try {
+    const key = await env.envKey();
+    const webhooks = resolveWebhooksForEnv({ rows, envKey: key });
+    if (webhooks.length === 0)
+      return;
+    const client = clientFor({ secretKey: env.secretKey });
+    const body = { webhooks };
+    const { changes, errors } = await client.previewSyncWebhooks(body);
+    return {
+      lane: {
+        preview: { env: key, changes },
+        body,
+        env: { key, live: isLive(env) },
+        client
+      },
+      errors
+    };
+  } catch (error) {
+    const skipped = webhookEnvSkipWarning({ env, error });
+    if (skipped === undefined)
+      throw error;
+    return { skipped };
+  }
+};
+var previewWebhookEnvs = async ({
   rows,
-  webhookEnv
+  envs,
+  prod,
+  clientFor
 }) => {
   if (rows === undefined)
     return;
-  if (webhookEnv === undefined)
-    throw new Error("webhooks need the target environment to pick each url.");
-  const env = await webhookEnv();
-  const webhooks = resolveWebhooksForEnv({
-    rows,
-    envKey: env.key
+  if (envs === undefined || clientFor === undefined)
+    throw new Error("webhooks need the env keys to pick each url.");
+  const all = envs();
+  const synced = all.filter((env) => isLive(env) === prod);
+  const probed = prod ? [] : all.filter(isLive);
+  const [syncedResults, probedResults] = await Promise.all([
+    Promise.allSettled(synced.map((env) => previewEnv({ env, rows, clientFor }))),
+    Promise.allSettled(probed.map((env) => previewEnv({ env, rows, clientFor })))
+  ]);
+  const lanes = [];
+  const skipped = [];
+  probedResults.forEach((result, index) => {
+    if (result.status === "rejected")
+      skipped.push(`⚠ webhooks: couldn't check ${probed[index]?.label ?? "live"} for changes (${messageOf2(result.reason)})`);
   });
-  const body = { webhooks };
-  const { changes, errors } = await client.previewSyncWebhooks(body);
-  if (errors.length > 0)
-    throw new Error(errors.map(({ id, message }) => `${id}: ${message}`).join(`
-`));
-  return { preview: { changes }, body, env };
+  const productionUnchecked = probedResults.some((result) => result.status === "rejected" || result.value !== undefined && ("skipped" in result.value));
+  const failures = [];
+  syncedResults.forEach((result, index) => {
+    const label = synced[index]?.label ?? "";
+    if (result.status === "rejected") {
+      failures.push({ env: label, message: messageOf2(result.reason) });
+      return;
+    }
+    const preview = result.value;
+    if (preview === undefined)
+      return;
+    if ("skipped" in preview) {
+      skipped.push(preview.skipped);
+      return;
+    }
+    lanes.push(preview.lane);
+    if (preview.errors.length > 0)
+      failures.push({
+        env: preview.lane.env.key,
+        message: preview.errors.map(({ id, message }) => `${id}: ${message}`).join(`
+`)
+      });
+  });
+  throwWebhookEnvFailures({
+    failures,
+    envCount: synced.length,
+    warnings: skipped
+  });
+  assertDistinctSecretNames({ lanes });
+  const productionDiffers = [];
+  for (const result of probedResults) {
+    if (result.status === "rejected")
+      continue;
+    const preview = result.value;
+    if (preview === undefined)
+      continue;
+    if ("skipped" in preview) {
+      skipped.push(preview.skipped);
+      continue;
+    }
+    const changed = preview.lane.preview.changes.filter((change) => change.action !== "unmanaged");
+    productionDiffers.push(...new Set([
+      ...changed.map((change) => change.id),
+      ...preview.errors.map((error) => error.id)
+    ]));
+  }
+  return { lanes, productionDiffers, productionUnchecked, skipped };
 };
 
 // src/actions/push.ts
@@ -24337,7 +24344,9 @@ var runPush = async ({
   dryRun = false,
   write = (text) => process.stdout.write(text),
   migrationLinkBase,
-  webhookEnv
+  prod = false,
+  webhookEnvs,
+  webhookClientFor
 }) => {
   const project = resolveProject({ cwd, configFlag });
   const dirs = configSearchDirs({ cwd, configPath: configFlag });
@@ -24360,10 +24369,11 @@ var runPush = async ({
   const previews = await settleLanes({
     settings: previewSettings({ client, body: settingsBody }),
     catalog: client.previewUpdate(wire),
-    webhooks: previewWebhooks({
-      client,
+    webhooks: previewWebhookEnvs({
       rows: lists.webhooks,
-      webhookEnv
+      envs: webhookEnvs,
+      prod,
+      clientFor: webhookClientFor
     })
   });
   const { settings, webhooks } = previews.values;
@@ -24375,8 +24385,17 @@ var runPush = async ({
   const preview = {
     ...catalogPreview,
     settings,
-    ...webhooks === undefined ? {} : { webhooks: webhooks.preview }
+    ...webhooks === undefined ? {} : {
+      webhooks: webhooks.lanes.map((lane) => lane.preview),
+      productionWebhooks: webhooks.productionDiffers,
+      productionWebhooksUnchecked: webhooks.productionUnchecked
+    }
   };
+  if (webhooks !== undefined && webhooks.skipped.length > 0)
+    write(`${webhooks.skipped.join(`
+`)}
+
+`);
   write(`${renderPreview({ preview, migrationLinkBase })}
 `);
   if (catalogDeferral !== undefined)
@@ -24413,8 +24432,7 @@ ${renderCatalogDeferral({ error: catalogDeferral.error })}
   const applied = await settleLanes({
     catalog: settled === undefined ? settingsStep().then(catalogStep) : catalogStep(settled),
     webhooks: applyWebhooks({
-      client,
-      lane: webhooks,
+      lanes: webhooks?.lanes ?? [],
       envDirs: project.envDirs,
       cwd,
       write
@@ -25163,28 +25181,6 @@ var runSandboxUse = async ({
   return result;
 };
 
-// src/actions/webhooks/resolveWebhookEnv.ts
-var memoized = (fetchOrgInfo2) => {
-  let pending;
-  return () => {
-    pending ??= fetchOrgInfo2();
-    return pending;
-  };
-};
-var resolveWebhookEnv = async ({
-  target,
-  prod,
-  fetchOrgInfo: fetchOrgInfo2
-}) => {
-  const orgInfo = memoized(fetchOrgInfo2);
-  const orgId = async () => (await orgInfo()).id;
-  if (prod)
-    return { key: "live", live: true, orgId };
-  if (target.sandboxId === undefined)
-    return { key: "sandbox", live: false, orgId };
-  return { key: sandboxSlug((await orgInfo()).name), live: false, orgId };
-};
-
 // src/cli.ts
 var normalizeVersionFlag = ({ argv }) => argv.map((token) => token === "-v" ? "--version" : token);
 var withTargetFlags = (program) => program.option("-p, --prod", "target production instead of sandbox").option("--sandbox <sandboxId>", "target a specific sandbox").option("-l, --local", "target a local server (default port 8080)").option("--port <port>", "port of a local server (implies --local)").option("-b, --base-url <url>", "send to this URL instead").option("--client-id <id>", "OAuth client id the CLI identifies as").option("-c, --config <path>", "autumn.config.ts, or the folder holding it (default: found from cwd or the root package.json)").option("--headless", "never prompt: print what a command needs and stop (default when not a TTY)");
@@ -25276,13 +25272,15 @@ var pinnedSandboxName = async ({
     return {};
   }
 };
-var webhookEnvFor = ({ target, command }) => () => resolveWebhookEnv({
-  target,
-  prod: command.optsWithGlobals().prod === true,
-  fetchOrgInfo: () => fetchOrgInfo({
-    baseUrl: targetBaseUrl({ target }),
-    secretKey: requireSecretKey({ target })
-  })
+var webhookClientFor = ({ target }) => ({ secretKey }) => createClient({
+  secretKey,
+  fetch: autumnFetch,
+  ...target.baseUrl ? { baseUrl: target.baseUrl } : {}
+});
+var webhookEnvsFor = ({ target }) => () => webhookPullEnvs({
+  targetKeyName: target.secretKeyName,
+  listWebhooks: ({ secretKey }) => webhookClientFor({ target })({ secretKey }).listWebhooks({}),
+  fetchOrgInfo: ({ secretKey }) => fetchOrgInfo({ baseUrl: targetBaseUrl({ target }), secretKey })
 });
 var mainOrgInfo = ({ target }) => {
   const main = managementTarget({ target });
@@ -25382,7 +25380,9 @@ Linking a keyless org to an account:
       client: clientFor({ target }),
       configPath: configFlagOf({ command }),
       dryRun: !apply,
-      webhookEnv: webhookEnvFor({ target, command })
+      prod: command.optsWithGlobals().prod === true,
+      webhookEnvs: webhookEnvsFor({ target }),
+      webhookClientFor: webhookClientFor({ target })
     });
     process.exitCode = pushExitCode({ apply, result });
     if (!apply && !previewIsEmpty({ preview: result.preview }))
@@ -25432,15 +25432,7 @@ Nothing applied. Re-run with --yes to apply these changes.
       overwrite: options.overwrite === true,
       yes: options.yes === true,
       prompter: prompterFor({ command }),
-      webhookEnvs: () => webhookPullEnvs({
-        targetKeyName: target.secretKeyName,
-        listWebhooks: ({ secretKey }) => createClient({
-          secretKey,
-          fetch: autumnFetch,
-          ...target.baseUrl ? { baseUrl: target.baseUrl } : {}
-        }).listWebhooks({}),
-        fetchOrgInfo: ({ secretKey }) => fetchOrgInfo({ baseUrl: targetBaseUrl({ target }), secretKey })
-      })
+      webhookEnvs: webhookEnvsFor({ target })
     });
     writeStaleSkillsHint({ command });
   });