improvement(forking): make webhook url mapping clear (#6272)

* improvement(forking): make webhook url mapping clear

* fix(forking): honour drops before the unmapped gate, match provider on URL adoption

Review round 1 on #6272.

- Drop was inert for required references: `postCopyUnmappedRequired` gates before
  the cleared-ref gate that honours acknowledgments, so a source-deleted reference
  on a required field still failed with "map all required ... first". Verified drops
  are now resolved once (`verifyForkDropAcknowledgments`) and subtracted from both
  gates. Verification is not optional: an unmapped reference of a non-blocking kind
  (credential, env-var) never re-blocks downstream, so subtracting raw
  acknowledgments would let a crafted payload skip the required gate.
- URL adoption now requires provider equality. A count-only 1:1 pairing could hand a
  GitHub URL to an arriving Slack trigger, keeping the endpoint alive while every
  request failed signature verification - and reporting the URL as preserved.
- `resolveTriggerId` moved from `lib/webhooks/deploy.ts` to `@/triggers/webhook-url`
  so the deploy path and the fork's provider check share one resolution.
- Trigger URL warnings render the full public URL in the heads-up section and name
  the URL in the overwrite confirm, where identical workflow names were ambiguous.
- The Drop control renders once per resource and states how many fields it covers;
  the remapper clears by reference, so a per-row control implied a choice the write
  path cannot honour.
- Export clears `workflow-selector`: nothing on the import path remaps workflow ids
  (`import-export.ts` re-creates each workflow under a fresh id), so a preserved
  reference dangled - bundle or not.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: icecrasher321

apps/sim/app/api/workspaces/[id]/fork/diff/route.ts

@@ -10,6 +10,7 @@ import { loadTargetDraftSubBlocks } from '@/ee/workspace-forking/lib/copy/copy-w
 import {
   listForkExcludedDeployedWorkflows,
   loadSourceDeployedStates,
+  loadTargetWebhookPathsByBlock,
 } from '@/ee/workspace-forking/lib/copy/deploy-bridge'
 import { assertCanPromote } from '@/ee/workspace-forking/lib/lineage/authz'
 import { loadForkBlockMap } from '@/ee/workspace-forking/lib/mapping/block-map-store'
@@ -27,6 +28,10 @@ import {
   collectForkClearedRefCandidates,
 } from '@/ee/workspace-forking/lib/promote/cleared-refs'
 import { computeForkPromotePlan } from '@/ee/workspace-forking/lib/promote/promote-plan'
+import {
+  buildForkTriggerPlan,
+  resolveForkTriggerPaths,
+} from '@/ee/workspace-forking/lib/promote/trigger-urls'
 import { buildForkBlockIdResolver } from '@/ee/workspace-forking/lib/remap/block-identity'
 import { readTargetDraftDependentValue } from '@/ee/workspace-forking/lib/remap/remap-references'
 
@@ -173,6 +178,36 @@ export const GET = withRouteHandler(
       })
     )
 
+    // Trigger URLs this sync decides in the target - the "we had to re-paste the Slack Request
+    // URL again" case, surfaced as an editable pairing before the overwrite instead of discovered
+    // after it. The preview reports the plan's DEFAULT resolution; the user's picks ride the
+    // promote call, where the same plan is rebuilt and validated against them.
+    const triggerPlan = buildForkTriggerPlan({
+      items: plan.items,
+      sourceStates,
+      resolveBlockId,
+      targetWebhooks: await loadTargetWebhookPathsByBlock(db, allTargetIds),
+    })
+    const { changes: triggerUrlChanges } = resolveForkTriggerPaths(triggerPlan)
+    // Every trigger that HAS a public URL, plus every one whose URL is up for decision - not just
+    // the decisions, so the section reads as a standing statement of each URL rather than an alert.
+    //
+    // A trigger with neither is deliberately absent: whether a block will serve a URL at all is
+    // only knowable from its webhook row, and a schedule / chat / manual / poller trigger never
+    // gets one. Claiming "gets a new URL" for those would be a straight lie, and no declarative
+    // flag separates them - `polling` is set on 10 of the trigger defs, while `webhook` is set on
+    // 345 including `slack_oauth`, which routes by `routingKey` with a NULL path.
+    const triggerMappings = triggerPlan.slots
+      .filter((slot) => slot.ownPath !== null || slot.adoptablePaths.length > 0)
+      .map((slot) => ({
+        sourceBlockId: slot.sourceBlockId,
+        blockName: slot.blockName,
+        workflowName: slot.workflowName,
+        ownPath: slot.ownPath,
+        adoptablePaths: slot.adoptablePaths,
+        defaultAdoptPath: slot.defaultAdoptPath,
+      }))
+
     const toRef = (reference: (typeof plan.unmappedRequired)[number]) => ({
       kind: reference.kind,
       sourceId: reference.sourceId,
@@ -224,6 +259,8 @@ export const GET = withRouteHandler(
       resourceUsages: collectForkResourceUsages(plan.items, sourceStates),
       copyableUnmapped: plan.copyableUnmapped,
       clearedRefs,
+      triggerUrlChanges,
+      triggerMappings,
     })
   }
 )

apps/sim/app/api/workspaces/[id]/fork/promote/route.ts

@@ -25,7 +25,14 @@ export const POST = withRouteHandler(
     const parsed = await parseRequest(promoteForkContract, req, context)
     if (!parsed.success) return parsed.response
     const { id } = parsed.data.params
-    const { otherWorkspaceId, direction, dependentValues, copyResources } = parsed.data.body
+    const {
+      otherWorkspaceId,
+      direction,
+      dependentValues,
+      copyResources,
+      dropReferences,
+      triggerMappings,
+    } = parsed.data.body
 
     const auth = await assertCanPromote(id, otherWorkspaceId, direction, session.user.id)
 
@@ -38,6 +45,8 @@ export const POST = withRouteHandler(
       actorName: session.user.name ?? undefined,
       dependentValues,
       copyResources,
+      dropReferences,
+      triggerMappings,
       requestId,
     })
 
@@ -52,6 +61,8 @@ export const POST = withRouteHandler(
       blockers: result.blockers,
       needsConfiguration: result.needsConfiguration,
       clearedOptional: result.clearedOptional,
+      droppedReferences: result.droppedReferences,
+      triggerUrlChanges: result.triggerUrlChanges,
     }
 
     if (result.blocked) {
@@ -91,7 +102,9 @@ export const POST = withRouteHandler(
       status:
         result.deployFailed > 0 ||
         result.needsConfiguration.length > 0 ||
-        result.clearedOptional.length > 0
+        result.clearedOptional.length > 0 ||
+        result.droppedReferences.length > 0 ||
+        result.triggerUrlChanges.length > 0
           ? 'completed_with_warnings'
           : 'completed',
       message: direction === 'pull' ? `Pulled from "${otherName}"` : `Pushed to "${otherName}"`,
@@ -110,6 +123,8 @@ export const POST = withRouteHandler(
         archivedNames: result.archivedNames,
         needsConfiguration: result.needsConfiguration,
         clearedOptional: result.clearedOptional,
+        droppedReferences: result.droppedReferences.length,
+        triggerUrlChanges: result.triggerUrlChanges.length,
       },
     }).catch((error) =>
       logger.error(`[${requestId}] Failed to record sync activity`, {

apps/sim/ee/workspace-forking/components/fork-sync/cleared-refs-list.ts

@@ -58,14 +58,20 @@ export function splitForkClearedRefs(visibleRefs: ForkClearedRef[]): {
   return { blockers, informational }
 }
 
-/** Human label per blocker kind for the resolution copy (singular, lowercase mid-sentence). */
-const BLOCKER_KIND_LABEL: Record<string, string> = {
+/**
+ * Human label per remap kind for the resolution copy (singular, lowercase mid-sentence). Shared
+ * with the Mappings section's source-deleted note so both phrase the same resolution identically.
+ * `credential` is reachable only from a mapping entry - credentials gate through the required
+ * check, never through the cleared-ref blockers.
+ */
+export const FORK_RESOURCE_KIND_LABEL: Record<string, string> = {
   table: 'table',
   'knowledge-base': 'knowledge base',
   file: 'file',
   'custom-tool': 'custom tool',
   skill: 'skill',
   'mcp-server': 'MCP server',
+  credential: 'credential',
 }
 
 /**
@@ -79,7 +85,7 @@ export function forkBlockerResolution(ref: ForkClearedRef): string | null {
     case 'unmapped-copyable':
       return 'map it to a target or select it for copy'
     case 'source-deleted':
-      return `deleted in the source — map it to an existing ${BLOCKER_KIND_LABEL[ref.kind] ?? 'resource'} in the target`
+      return `deleted in the source — map it to an existing ${FORK_RESOURCE_KIND_LABEL[ref.kind] ?? 'resource'} in the target`
     case 'workflow-missing':
       return `deploy "${ref.sourceLabel}" in the source or remove the reference`
   }

apps/sim/ee/workspace-forking/components/fork-sync/copy-reconciliation.ts

@@ -83,38 +83,39 @@ export function forkParentResolution(
 }
 
 /**
- * Whether every required reference is satisfied - it has a mapping target OR is selected for copy.
- * The server accepts a copy as resolving a required ref (promote.ts `willResolve`), so the client
- * gate must too. No double-count: a mapped copyable is excluded from the copy candidates, so the two
- * branches are mutually exclusive.
+ * Whether every required reference is satisfied - it has a mapping target, or its key is in
+ * `satisfiedKeys` (selected for copy, or acknowledged as a dropped source-deleted reference).
+ * The server accepts both as resolving a required ref, so the client gate must too. No
+ * double-count: a mapped copyable is excluded from the copy candidates, and a droppable reference
+ * is source-deleted, so it has no copy candidate either.
  */
 export function isForkRequiredComplete(
   entries: ForkMappingEntry[],
   targets: Record<string, string>,
-  copyingKeys: ReadonlySet<string>
+  satisfiedKeys: ReadonlySet<string>
 ): boolean {
   return entries.every(
     (entry) =>
       !entry.required ||
       effectiveForkTarget(entry, targets) !== '' ||
-      copyingKeys.has(forkRefKey(entry))
+      satisfiedKeys.has(forkRefKey(entry))
   )
 }
 
 /**
- * Whether any reference in a kind is required AND still unmapped AND not selected for copy - drives
- * the mapping summary's amber "pending" badge. Mirrors {@link isForkRequiredComplete}'s satisfied rule.
+ * Whether any reference in a kind is required AND still unmapped AND not satisfied another way -
+ * drives the mapping summary's amber "pending" badge. Mirrors {@link isForkRequiredComplete}.
  */
 export function forkRequiredPending(
   items: ForkMappingEntry[],
   targets: Record<string, string>,
-  copyingKeys: ReadonlySet<string>
+  satisfiedKeys: ReadonlySet<string>
 ): boolean {
   return items.some(
     (entry) =>
       entry.required &&
       effectiveForkTarget(entry, targets) === '' &&
-      !copyingKeys.has(forkRefKey(entry))
+      !satisfiedKeys.has(forkRefKey(entry))
   )
 }