dirigent-cli 0.26.0__tar.gz → 0.27.0__tar.gz

{dirigent_cli-0.26.0 → dirigent_cli-0.27.0}/PKG-INFO

@@ -1,19 +1,19 @@
 Metadata-Version: 2.4
 Name: dirigent-cli
-Version: 0.26.0
+Version: 0.27.0
 Summary: The dirigent command line interface (dirigent / dg).
 License-Expression: LicenseRef-Proprietary
 License-File: LICENSE
 Classifier: Programming Language :: Python :: 3
 Classifier: Programming Language :: Python :: 3.13
-Requires-Dist: dirigent-block-execute==0.26.0
-Requires-Dist: dirigent-blocks==0.26.0
-Requires-Dist: dirigent-client==0.26.0
-Requires-Dist: dirigent-common==0.26.0
-Requires-Dist: dirigent-core==0.26.0
-Requires-Dist: dirigent-examples==0.26.0
-Requires-Dist: dirigent-plugin==0.26.0
-Requires-Dist: dirigent-server==0.26.0
+Requires-Dist: dirigent-block-execute==0.27.0
+Requires-Dist: dirigent-blocks==0.27.0
+Requires-Dist: dirigent-client==0.27.0
+Requires-Dist: dirigent-common==0.27.0
+Requires-Dist: dirigent-core==0.27.0
+Requires-Dist: dirigent-examples==0.27.0
+Requires-Dist: dirigent-plugin==0.27.0
+Requires-Dist: dirigent-server==0.27.0
 Requires-Dist: httpx2>=2.12.0
 Requires-Dist: python-dotenv>=1.1.0
 Requires-Dist: pyyaml>=6.0.3

{dirigent_cli-0.26.0 → dirigent_cli-0.27.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "dirigent-cli"
-version = "0.26.0"
+version = "0.27.0"
 description = "The dirigent command line interface (dirigent / dg)."
 readme = "README.md"
 requires-python = ">=3.13"
@@ -11,14 +11,14 @@ classifiers = [
     "Programming Language :: Python :: 3.13",
 ]
 dependencies = [
-    "dirigent-block-execute==0.26.0",
-    "dirigent-blocks==0.26.0",
-    "dirigent-client==0.26.0",
-    "dirigent-common==0.26.0",
-    "dirigent-core==0.26.0",
-    "dirigent-examples==0.26.0",
-    "dirigent-plugin==0.26.0",
-    "dirigent-server==0.26.0",
+    "dirigent-block-execute==0.27.0",
+    "dirigent-blocks==0.27.0",
+    "dirigent-client==0.27.0",
+    "dirigent-common==0.27.0",
+    "dirigent-core==0.27.0",
+    "dirigent-examples==0.27.0",
+    "dirigent-plugin==0.27.0",
+    "dirigent-server==0.27.0",
     "httpx2>=2.12.0",
     "python-dotenv>=1.1.0",
     "pyyaml>=6.0.3",

{dirigent_cli-0.26.0 → dirigent_cli-0.27.0}/pyproject.toml.orig

@@ -1,6 +1,6 @@
 [project]
 name = "dirigent-cli"
-version = "0.26.0"
+version = "0.27.0"
 description = "The dirigent command line interface (dirigent / dg)."
 readme = "README.md"
 requires-python = ">=3.13"
@@ -11,14 +11,14 @@ classifiers = [
     "Programming Language :: Python :: 3.13",
 ]
 dependencies = [
-    "dirigent-block-execute==0.26.0",
-    "dirigent-blocks==0.26.0",
-    "dirigent-client==0.26.0",
-    "dirigent-common==0.26.0",
-    "dirigent-core==0.26.0",
-    "dirigent-examples==0.26.0",
-    "dirigent-plugin==0.26.0",
-    "dirigent-server==0.26.0",
+    "dirigent-block-execute==0.27.0",
+    "dirigent-blocks==0.27.0",
+    "dirigent-client==0.27.0",
+    "dirigent-common==0.27.0",
+    "dirigent-core==0.27.0",
+    "dirigent-examples==0.27.0",
+    "dirigent-plugin==0.27.0",
+    "dirigent-server==0.27.0",
     "httpx2>=2.12.0",
     "python-dotenv>=1.1.0",
     "pyyaml>=6.0.3",

{dirigent_cli-0.26.0 → dirigent_cli-0.27.0}/src/dirigent_cli/commands.py

@@ -140,6 +140,7 @@ from dirigent_cli.sources import (
     read_path,
 )
 from dirigent_cli.stream import Sink, track_steps, use_scratch_prefix
+from dirigent_cli.summaries import credential_line
 from dirigent_cli.timing import RunProfile, attempt_timing, by_step, profile, step_timing
 from dirigent_client import (
     CLEAR,
@@ -315,15 +316,15 @@ def _print_plan(result: ApplyResult, origin: str) -> bool:
 
 
 def _print_source_tokens(result: ApplyResult, *, base_url: str) -> None:
-    """Print each token an apply minted for a source, once, with where it is presented.
+    """Print each token or signing secret an apply minted for a source, once, with how it is presented.
 
-    The instance stores only a token's hash; there is no second chance to read it.
+    There is no second chance to read either.
     """
     for minted in result.sources.tokens:
         console.print(f"\n  source [bold]{minted.code}[/]  {base_url.rstrip('/')}{minted.url_path}")
-        console.print(f"  Authorization: Bearer [bold]{minted.token}[/]")
+        console.print(f"  {credential_line(minted.auth, minted.header, minted.token)}")
     if result.sources.tokens:
-        console.print("\n[yellow]Each token is shown once.[/] The instance stores only its hash.\n")
+        console.print("\n[yellow]Each token and signing secret is shown once.[/]\n")
 
 
 def _print_graph(steps: Sequence[GraphStep], title: str = "steps") -> None:
@@ -374,9 +375,7 @@ def apply_command(
     as_code: Annotated[str | None, typer.Option("--as", help="Register under a different code.")] = None,
     paused: Annotated[
         bool,
-        typer.Option(
-            "--paused", help="Create the schedules and watches this apply mints paused; existing ones are untouched."
-        ),
+        typer.Option("--paused", help="Create the schedules this apply creates paused; existing ones are untouched."),
     ] = False,
     prune: Annotated[
         bool,
@@ -563,6 +562,7 @@ def validate_command(
             blocks=blocks,
             format_checker=checker,
             target=targets.get(definition.pipeline) if isinstance(definition, TriggersDefinition) else None,
+            source_kinds=host.sources,
         )
         if issues:
             emit_fact(

{dirigent_cli-0.26.0 → dirigent_cli-0.27.0}/src/dirigent_cli/main.py

@@ -126,8 +126,6 @@ app.add_typer(commands.examples_app, rich_help_panel=DEFINE_PANEL)
 app.add_typer(commands.schema_app, rich_help_panel=DEFINE_PANEL)
 app.add_typer(commands.connection_app, rich_help_panel=CONNECT_PANEL)
 app.add_typer(triggers.schedule_app, rich_help_panel=TRIGGER_PANEL)
-app.add_typer(triggers.webhook_app, rich_help_panel=TRIGGER_PANEL)
-app.add_typer(triggers.watch_app, rich_help_panel=TRIGGER_PANEL)
 app.add_typer(source_commands.source_app, rich_help_panel=TRIGGER_PANEL)
 app.add_typer(triggers.trigger_document_app, rich_help_panel=TRIGGER_PANEL)
 app.add_typer(triggers.alerts_app, rich_help_panel=TRIGGER_PANEL)
@@ -627,7 +625,6 @@ def prune_command(
     ctx: typer.Context,
     runs: Annotated[str | None, typer.Option(help="Keep settled runs younger than this, such as 30d.")] = None,
     logs: Annotated[str | None, typer.Option(help="Keep log entries younger than this.")] = None,
-    deliveries: Annotated[str | None, typer.Option(help="Keep webhook deliveries younger than this.")] = None,
     inputs: Annotated[str | None, typer.Option(help="Keep the record of inputs to a source younger than this.")] = None,
     firings: Annotated[str | None, typer.Option(help="Keep schedule firings younger than this.")] = None,
     notifications: Annotated[str | None, typer.Option(help="Keep sent alerts younger than this.")] = None,
@@ -647,7 +644,7 @@ def prune_command(
     settings = get_settings()
     state = state_of(ctx)
     try:
-        policy = _prune_policy(settings, runs, logs, deliveries, inputs, firings, notifications, scratch=scratch)
+        policy = _prune_policy(settings, runs, logs, inputs, firings, notifications, scratch=scratch)
     except ValueError as error:
         refuse(INVALID_AGE, status=2, title="Invalid age", detail=str(error))
         raise typer.Exit(code=2) from error
@@ -658,7 +655,6 @@ def _prune_policy(
     settings: Settings,
     runs: str | None,
     logs: str | None,
-    deliveries: str | None,
     inputs: str | None,
     firings: str | None,
     notifications: str | None,
@@ -675,7 +671,6 @@ def _prune_policy(
     return retention.Policy(
         runs=age(runs, settings.retention_runs),
         logs=age(logs, settings.retention_logs),
-        deliveries=age(deliveries, settings.retention_deliveries),
         inputs=age(inputs, settings.retention_inputs),
         firings=age(firings, settings.retention_firings),
         notifications=age(notifications, settings.retention_notifications),
@@ -921,7 +916,7 @@ def dev(
         typer.Option(
             "--seed",
             help="Apply every dirigent/v1 document under this directory once the API answers, "
-            "with its schedules and watches paused; name it more than once to seed one directory after another.",
+            "with its schedules paused; name it more than once to seed one directory after another.",
         ),
     ] = None,
     seed_installed: Annotated[
@@ -944,7 +939,7 @@ def dev(
 
     --seed fills the instance from a directory of documents the moment it answers: the
     connections a file or a document declares and the standalone JSON Schema files are created
-    first, then every document is applied with its schedules and watches paused, and one refused
+    first, then every document is applied with its schedules paused, and one refused
     for naming something a later document supplies is applied again once the rest are in. A
     document an instance will not store is reported and passed over, because a corpus holds
     those on purpose.

{dirigent_cli-0.26.0 → dirigent_cli-0.27.0}/src/dirigent_cli/messages.py

@@ -232,11 +232,6 @@ ONE_CLOCK = CLI.define("one_clock", "a schedule takes exactly one of --cron, --i
 
 AT_TAKES_AN_INSTANT = CLI.define("at_takes_an_instant", "--at takes an ISO instant, and {value} is not one")
 
-MAP_TAKES_A_PATH = CLI.define(
-    "map_takes_a_path",
-    "--map takes param=$.path.into.payload, and {entry} has no '='",
-)
-
 NOT_AN_ALERT_EVENT = CLI.define("not_an_alert_event", "{event} is not an alert event ({allowed})")
 
 NOT_AN_IMPORTANCE = CLI.define("not_an_importance", "--importance {value} is not an importance ({allowed})")

{dirigent_cli-0.26.0 → dirigent_cli-0.27.0}/src/dirigent_cli/seeding.py

@@ -216,7 +216,7 @@ async def _connection(client: Dirigent, spec: ConnectionSpec) -> str:
 
 
 async def _apply(client: Dirigent, raw: JsonMap, origin: str) -> Record:
-    """Apply one document with its schedules and watches paused, without the sections it carries."""
+    """Apply one document with its schedules paused, without the sections it carries."""
     document = {name: value for name, value in raw.items() if name not in CARRIED}
     try:
         result = await client.pipelines.apply(
@@ -237,7 +237,6 @@ async def _apply(client: Dirigent, raw: JsonMap, origin: str) -> Record:
         pipeline=result.plan.code,
         action=result.plan.action.value,
         schedules_paused=result.triggers.schedules_created,
-        watches_paused=result.triggers.watches_created,
     )
 
 

{dirigent_cli-0.26.0 → dirigent_cli-0.27.0}/src/dirigent_cli/source_commands.py

@@ -1,8 +1,11 @@
 """The source command group: where a pipeline's inputs enter, what has arrived, and calling one."""
 
+import hashlib
+import hmac
 import json
 from pathlib import Path
 from typing import Annotated, Final
+from urllib.parse import urlencode
 
 import httpx2
 import typer
@@ -18,8 +21,11 @@ from dirigent_plugin.sources import Route
 #: Where ``dg source call`` reads the token a source was given when ``--source-token`` names none.
 TOKEN_ENV: Final = "DIRIGENT_SOURCE_TOKEN"
 
-#: How long a call waits for its answer: an endpoint answers once its run exists, not once it settles.
-CALL_TIMEOUT: Final = httpx2.Timeout(30.0, connect=DEFAULT_CONNECT_TIMEOUT)
+#: Where ``dg source call`` and ``dg source set-secret`` read a signing secret when no option names one.
+SECRET_ENV: Final = "DIRIGENT_SOURCE_SECRET"
+
+#: How long a call waits for its answer, past the longest an instance holds a caller by default.
+CALL_TIMEOUT: Final = httpx2.Timeout(90.0, connect=DEFAULT_CONNECT_TIMEOUT)
 
 source_app = typer.Typer(
     name="source",
@@ -80,10 +86,29 @@ def source_rotate(ctx: typer.Context, pipeline: PipelineArg, code: SourceArg) ->
         code=code,
         pipeline=pipeline,
         url=f"{base.rstrip('/')}{minted.url_path}",
+        auth=minted.auth,
+        header=minted.header,
         token=minted.token,
     )
 
 
+@source_app.command("set-secret")
+def source_set_secret(
+    ctx: typer.Context,
+    pipeline: PipelineArg,
+    code: SourceArg,
+    secret: Annotated[
+        str | None,
+        typer.Option("--secret", envvar=SECRET_ENV, help="The secret its sender issued; prompted for when unset."),
+    ] = None,
+) -> None:
+    """Replace a signed source's signing secret with one its sender issued, such as a provider's own."""
+    given = secret or typer.prompt("signing secret", hide_input=True)
+    with client_for(state_of(ctx)) as dg:
+        row = dg.call(dg.sources.set_secret(pipeline, code, given))
+    emit_fact("source.secret_set", message="secret set", code=code, pipeline=pipeline, prefix=row.token_prefix)
+
+
 @source_app.command("inputs")
 def source_inputs(
     ctx: typer.Context,
@@ -120,6 +145,10 @@ def source_call(
         str | None,
         typer.Option("--source-token", envvar=TOKEN_ENV, help="The source's own token, not the CLI's credential."),
     ] = None,
+    signing_secret: Annotated[
+        str | None,
+        typer.Option("--signing-secret", envvar=SECRET_ENV, help="The secret a signed source's body is signed with."),
+    ] = None,
 ) -> None:
     """Call a received source the way its callers do, and write down what it answered.
 
@@ -143,6 +172,12 @@ def source_call(
     elif text is not None:
         content = _read(text).encode()
         headers["Content-Type"] = "text/plain; charset=utf-8"
+    elif form is not None:
+        content = urlencode(_pairs(form)).encode()
+        headers["Content-Type"] = "application/x-www-form-urlencoded"
+    if signing_secret and row.signature_header:
+        digest = hmac.new(signing_secret.encode(), content or b"", hashlib.sha256).hexdigest()
+        headers[row.signature_header] = f"sha256={digest}"
     try:
         with httpx2.Client(timeout=CALL_TIMEOUT) as http:
             answered = http.request(
@@ -151,7 +186,6 @@ def source_call(
                 headers=headers,
                 params=_pairs(query),
                 content=content,
-                data=_pairs(form) if form is not None else None,
             )
     except httpx2.HTTPError as error:
         fail(SOURCE_UNREACHABLE, url=url, detail=str(error))

{dirigent_cli-0.26.0 → dirigent_cli-0.27.0}/src/dirigent_cli/summaries.py

@@ -256,15 +256,24 @@ def _source_token(record: Record) -> RenderableType | None:
     token = record.get("token")
     if not token:
         return None
+    auth = str(record.get("auth") or "token")
+    header = record.get("header")
     return Group(
         "",
         f"  [bold]{escape(str(record.get('url') or ''))}[/]",
-        f"  [bold]Authorization: Bearer {escape(str(token))}[/]",
+        f"  [bold]{credential_line(auth, str(header) if header else None, escape(str(token)))}[/]",
         "",
-        "[yellow]This is the only time the token is shown.[/] The instance stores only its hash.",
+        "[yellow]This is the only time it is shown.[/]",
     )
 
 
+def credential_line(auth: str, header: str | None, secret: str) -> str:
+    """Say how a caller presents a source's credential: a bearer token, or a signature keyed with a secret."""
+    if auth == "hmac":
+        return f"{header}: sha256=<HMAC-SHA256 of the body, hex>, keyed with {secret}"
+    return f"Authorization: Bearer {secret}"
+
+
 def _files(record: Record) -> list[RenderableType]:
     """List what was written, named against the directory it was written into."""
     written = _texts(record, "files")

{dirigent_cli-0.26.0 → dirigent_cli-0.27.0}/src/dirigent_cli/triggers.py

@@ -1,4 +1,4 @@
-"""The trigger and alerting command groups: schedules, webhooks, watches, and alert rules."""
+"""The trigger and alerting command groups: schedules and alert rules."""
 
 from pathlib import Path
 from typing import Annotated, Any, cast
@@ -9,7 +9,6 @@ from dirigent_cli.commands import paged, parse_importance, parse_log_levels, par
 from dirigent_cli.context import Session, client_for, state_of
 from dirigent_cli.messages import (
     AT_TAKES_AN_INSTANT,
-    MAP_TAKES_A_PATH,
     NOT_AN_ALERT_EVENT,
     ONE_BODY,
     ONE_CLOCK,
@@ -28,18 +27,12 @@ from dirigent_cli.output import (
     throttle_note,
     watching,
 )
-from dirigent_client import LOG_NOTIFIER, TEST_SUBJECT, AlertEvent, AlertScope, WebhookTokenOut
+from dirigent_client import LOG_NOTIFIER, TEST_SUBJECT, AlertEvent, AlertScope
 from dirigent_common import Message
 
 schedule_app = typer.Typer(
     name="schedule", help="A pipeline's clocks: cron, interval, or one-time.", no_args_is_help=True
 )
-webhook_app = typer.Typer(name="webhook", help="Inbound webhooks and their delivery history.", no_args_is_help=True)
-watch_app = typer.Typer(
-    name="watch",
-    help="Sensors kept waiting: one run always waiting on each, the next armed on success.",
-    no_args_is_help=True,
-)
 trigger_document_app = typer.Typer(
     name="trigger-document",
     help="Documents that declare clocks for a pipeline defined elsewhere.",
@@ -251,222 +244,6 @@ def schedule_delete(
     emit_fact("schedule.deleted", message="deleted", code=code, pipeline=pipeline)
 
 
-@watch_app.command("list")
-def watch_list(
-    ctx: typer.Context,
-    pipeline: Annotated[str, typer.Argument(help="The pipeline whose watches to list.")],
-) -> None:
-    """List a pipeline's watches, each with the run it has waiting and how its waits are going."""
-    with client_for(state_of(ctx)) as dg:
-        rows = list(paged(lambda after, size: dg.call(dg.watches.list(pipeline, after=after, limit=size)), None))
-    emit_records("watch", rows)
-
-
-@watch_app.command("show")
-def watch_show(
-    ctx: typer.Context,
-    pipeline: Annotated[str, typer.Argument(help="The pipeline the watch belongs to.")],
-    code: Annotated[str, typer.Argument(help="The watch to show.")],
-) -> None:
-    """Show one watch: the step it waits on, where it left off, and its last error."""
-    with client_for(state_of(ctx)) as dg:
-        row = dg.call(dg.watches.get(pipeline, code))
-    emit_one("watch", row)
-
-
-@watch_app.command("pause")
-def watch_pause(
-    ctx: typer.Context,
-    pipeline: Annotated[str, typer.Argument()],
-    code: Annotated[str, typer.Argument()],
-) -> None:
-    """Stop a watch, cancelling the run it has waiting, and keep where it left off."""
-    with client_for(state_of(ctx)) as dg:
-        row = dg.call(dg.watches.pause(pipeline, code))
-    emit_fact("watch.paused", message="paused", code=code, pipeline=pipeline, cursor=row.cursor)
-
-
-@watch_app.command("resume")
-def watch_resume(
-    ctx: typer.Context,
-    pipeline: Annotated[str, typer.Argument()],
-    code: Annotated[str, typer.Argument()],
-) -> None:
-    """Start a watch again, arming a run from where its last success left off."""
-    with client_for(state_of(ctx)) as dg:
-        row = dg.call(dg.watches.resume(pipeline, code))
-    emit_fact(
-        "watch.resumed",
-        message="resumed",
-        code=code,
-        pipeline=pipeline,
-        waiting_run_id=row.waiting_run_id,
-        cursor=row.cursor,
-    )
-
-
-def _print_token(minted: WebhookTokenOut, *, base_url: str) -> None:
-    """Print a minted token once, with the URL already assembled.
-
-    The instance stores only the token's hash; there is no second chance to read it.
-    """
-    console.print(f"\n  POST  [bold]{base_url.rstrip('/')}{minted.url_path}[/]")
-    console.print(f"  Token [bold]{minted.token}[/]")
-    console.print("\n[yellow]This token is shown once.[/] The instance stores only its hash.\n")
-
-
-@webhook_app.command("create")
-def webhook_create(
-    ctx: typer.Context,
-    pipeline: Annotated[str, typer.Argument(help="The pipeline this webhook starts.")],
-    code: Annotated[str, typer.Argument(help="What to call it; unique within the pipeline.")],
-    name: Annotated[str | None, typer.Option("--name", help="A human title for this webhook.")] = None,
-    description: Annotated[str | None, typer.Option("--description", help="What this webhook is for.")] = None,
-    map_value: Annotated[
-        list[str] | None,
-        typer.Option("--map", help="param=$.path.into.payload, repeatable."),
-    ] = None,
-    hmac_secret: Annotated[
-        str | None,
-        typer.Option("--hmac-secret", help="Require an X-Dirigent-Signature over the raw body."),
-    ] = None,
-    rate_limit: Annotated[int, typer.Option("--rate-limit", help="Deliveries a minute this token may make.")] = 60,
-    priority: Annotated[
-        str | None,
-        typer.Option(
-            "--priority",
-            help="How far ahead of other runs an accepted delivery's run is claimed: low, normal, or high. "
-            "Omitted takes the pipeline's own.",
-        ),
-    ] = None,
-) -> None:
-    """Declare a webhook and print its token once, with the URL to POST to."""
-    mapping: dict[str, str] = {}
-    for entry in map_value or []:
-        if "=" not in entry:
-            _fail(MAP_TAKES_A_PATH, entry=repr(entry))
-        key, path = entry.split("=", 1)
-        mapping[key.strip()] = path.strip()
-    with client_for(state_of(ctx)) as dg:
-        minted = dg.call(
-            dg.webhooks.create(
-                pipeline,
-                code,
-                name=name,
-                description=description,
-                params_from_payload=mapping,
-                hmac_secret=hmac_secret,
-                rate_limit_per_minute=rate_limit,
-                priority=parse_priority(priority),
-            )
-        )
-        base = dg.url
-    if state_of(ctx).json_output:
-        return emit_fact(
-            "webhook.created",
-            message="created",
-            code=minted.code,
-            pipeline=pipeline,
-            url=f"{base.rstrip('/')}{minted.url_path}",
-            token=minted.token,
-        )
-    console.print(f"[green]created[/] webhook [bold]{minted.code}[/] on {pipeline}")
-    _print_token(minted, base_url=base)
-
-
-@webhook_app.command("list")
-def webhook_list(
-    ctx: typer.Context,
-    pipeline: Annotated[str, typer.Argument(help="The pipeline whose webhooks to list.")],
-) -> None:
-    """List a pipeline's webhooks, with their mapping but never their tokens."""
-    with client_for(state_of(ctx)) as dg:
-        rows = list(paged(lambda after, size: dg.call(dg.webhooks.list(pipeline, after=after, limit=size)), None))
-    if state_of(ctx).json_output:
-        return emit_records("webhook", rows)
-    table(
-        f"webhooks of {pipeline}",
-        ["code", "name", "token", "signed", "active", "limit/min", "maps", "last delivery"],
-        [
-            [
-                row.code,
-                row.name or "-",
-                f"{row.token_prefix}...",
-                render_bool(row.signed),
-                render_bool(row.active),
-                str(row.rate_limit_per_minute),
-                ", ".join(sorted(row.params_from_payload)) or "-",
-                moment(row.last_delivery_at),
-            ]
-            for row in rows
-        ],
-    )
-
-
-@webhook_app.command("rotate-token")
-def webhook_rotate(
-    ctx: typer.Context,
-    pipeline: Annotated[str, typer.Argument()],
-    code: Annotated[str, typer.Argument()],
-) -> None:
-    """Mint a new token and forget the old one; every caller has to be updated."""
-    with client_for(state_of(ctx)) as dg:
-        minted = dg.call(dg.webhooks.rotate_token(pipeline, code))
-        base = dg.url
-    if state_of(ctx).json_output:
-        return emit_fact(
-            "webhook.token_rotated",
-            message="rotated",
-            code=code,
-            pipeline=pipeline,
-            url=f"{base.rstrip('/')}{minted.url_path}",
-            token=minted.token,
-        )
-    console.print(f"[green]rotated[/] the token of webhook [bold]{code}[/]; the previous one no longer works")
-    _print_token(minted, base_url=base)
-
-
-@webhook_app.command("deliveries")
-def webhook_deliveries(
-    ctx: typer.Context,
-    pipeline: Annotated[str, typer.Argument()],
-    code: Annotated[str, typer.Argument()],
-) -> None:
-    """Show what has arrived at a webhook, refusals included."""
-    with client_for(state_of(ctx)) as dg:
-        rows = list(
-            paged(lambda after, size: dg.call(dg.webhooks.deliveries(pipeline, code, after=after, limit=size)), None)
-        )
-    if state_of(ctx).json_output:
-        return emit_records("delivery", rows)
-    table(
-        f"deliveries to {code}",
-        ["received", "outcome", "run", "from", "detail"],
-        [
-            [
-                moment(row.created_at),
-                styled(row.outcome.value),
-                str(row.run_id or "-")[:8],
-                row.source or "-",
-                row.reason or "-",
-            ]
-            for row in rows
-        ],
-    )
-
-
-@webhook_app.command("delete")
-def webhook_delete(
-    ctx: typer.Context,
-    pipeline: Annotated[str, typer.Argument()],
-    code: Annotated[str, typer.Argument()],
-) -> None:
-    """Remove a webhook, its token, and its delivery history."""
-    with client_for(state_of(ctx)) as dg:
-        dg.call(dg.webhooks.delete(pipeline, code))
-    emit_fact("webhook.deleted", message="deleted", code=code, pipeline=pipeline)
-
-
 @alerts_rules_app.command("list")
 def alerts_rules_list(
     ctx: typer.Context,
@@ -680,7 +457,7 @@ def trigger_document_show(
     ctx: typer.Context,
     code: Annotated[str, typer.Argument(help="The triggers document to read.")],
 ) -> None:
-    """Show one triggers document and the schedules, webhooks and watches it owns."""
+    """Show one triggers document and the schedules it owns."""
     with client_for(state_of(ctx)) as dg:
         detail = dg.call(dg.trigger_documents.get(code))
     if state_of(ctx).json_output:
@@ -689,8 +466,6 @@ def trigger_document_show(
     console.print(f"  pipeline  [bold]{detail.pipeline}[/]")
     console.print(f"  digest    [dim]{detail.digest}[/]")
     console.print(f"  schedules {', '.join(detail.schedules) or '-'}")
-    console.print(f"  webhooks  {', '.join(detail.webhooks) or '-'}")
-    console.print(f"  watches   {', '.join(detail.watches) or '-'}")
     if detail.description:
         console.print(f"\n{detail.description}")
 
@@ -700,17 +475,10 @@ def trigger_document_delete(
     ctx: typer.Context,
     code: Annotated[str, typer.Argument(help="The triggers document to remove.")],
 ) -> None:
-    """Remove a triggers document and every schedule and webhook it declared."""
+    """Remove a triggers document and every schedule it declared."""
     with client_for(state_of(ctx)) as dg:
         dg.call(dg.trigger_documents.delete(code))
-    emit_fact(
-        "trigger_document.deleted",
-        message="deleted",
-        code=code,
-        schedules="deleted",
-        webhooks="deleted",
-        watches="deleted",
-    )
+    emit_fact("trigger_document.deleted", message="deleted", code=code, schedules="deleted")
 
 
 @alerts_app.command("retry")