fixes from code review

Author: carderne

apps/webapp/app/services/apiAuth.server.ts

@@ -539,10 +539,7 @@ export async function authenticatedEnvironmentForAuthentication(
       const environment = await $replica.runtimeEnvironment.findFirst({
         where: {
           projectId: project.id,
-          slug: slug,
-          type: {
-            in: ["PREVIEW", "DEVELOPMENT"],
-          },
+          type: slug === "dev" ? "DEVELOPMENT" : "PREVIEW",
           branchName: resolvedBranch,
           ...(slug === "dev"
             ? {
@@ -613,7 +610,6 @@ export async function authenticatedEnvironmentForAuthentication(
       const environment = await $replica.runtimeEnvironment.findFirst({
         where: {
           projectId: project.id,
-          slug: slug,
           // No Development branches for OAT
           type: "PREVIEW",
           branchName: resolvedBranch,

apps/webapp/app/services/upsertBranch.server.ts

@@ -236,6 +236,7 @@ export async function checkBranchLimit({
   const baseLimit = await getLimit(organizationId, limitName, 100_000_000);
   const currentPlan = await getCurrentPlan(organizationId);
   const purchasedBranches = currentPlan?.v3Subscription?.addOns?.branches?.purchased ?? 0;
+  // We deliberately include purchased PREVIEW branches in DEV limits... (not documented anywhere)
   const limit = baseLimit + purchasedBranches;
 
   return {

apps/webapp/app/utils/environmentSort.ts

@@ -26,17 +26,19 @@ export function sortEnvironments<T extends SortType>(
     const difference = aIndex - bIndex;
 
     if (difference === 0) {
-      // Within the same env type, order by recency: most-recent dev activity
-      // first, falling back to updatedAt when there's no recorded activity,
-      // then to username when we have no timestamps at all.
-      const aTime = (a.lastActivity ?? a.updatedAt)?.getTime();
-      const bTime = (b.lastActivity ?? b.updatedAt)?.getTime();
+      if (a.type === "DEVELOPMENT" && b.type === "DEVELOPMENT") {
+        // Within the same env type, order by recency: most-recent dev activity
+        // first, falling back to updatedAt when there's no recorded activity,
+        // then to username when we have no timestamps at all.
+        const aTime = (a.lastActivity ?? a.updatedAt)?.getTime();
+        const bTime = (b.lastActivity ?? b.updatedAt)?.getTime();
 
-      if (aTime !== undefined && bTime !== undefined) {
-        return bTime - aTime;
+        if (aTime !== undefined && bTime !== undefined) {
+          return bTime - aTime;
+        }
+        if (aTime !== undefined) return -1;
+        if (bTime !== undefined) return 1;
       }
-      if (aTime !== undefined) return -1;
-      if (bTime !== undefined) return 1;
 
       const usernameA = a.userName || "";
       const usernameB = b.userName || "";