dirigent-cli 0.26.1__tar.gz → 0.27.1__tar.gz

{dirigent_cli-0.26.1 → dirigent_cli-0.27.1}/PKG-INFO

@@ -1,19 +1,19 @@
 Metadata-Version: 2.4
 Name: dirigent-cli
-Version: 0.26.1
+Version: 0.27.1
 Summary: The dirigent command line interface (dirigent / dg).
 License-Expression: LicenseRef-Proprietary
 License-File: LICENSE
 Classifier: Programming Language :: Python :: 3
 Classifier: Programming Language :: Python :: 3.13
-Requires-Dist: dirigent-block-execute==0.26.1
-Requires-Dist: dirigent-blocks==0.26.1
-Requires-Dist: dirigent-client==0.26.1
-Requires-Dist: dirigent-common==0.26.1
-Requires-Dist: dirigent-core==0.26.1
-Requires-Dist: dirigent-examples==0.26.1
-Requires-Dist: dirigent-plugin==0.26.1
-Requires-Dist: dirigent-server==0.26.1
+Requires-Dist: dirigent-block-execute==0.27.1
+Requires-Dist: dirigent-blocks==0.27.1
+Requires-Dist: dirigent-client==0.27.1
+Requires-Dist: dirigent-common==0.27.1
+Requires-Dist: dirigent-core==0.27.1
+Requires-Dist: dirigent-examples==0.27.1
+Requires-Dist: dirigent-plugin==0.27.1
+Requires-Dist: dirigent-server==0.27.1
 Requires-Dist: httpx2>=2.12.0
 Requires-Dist: python-dotenv>=1.1.0
 Requires-Dist: pyyaml>=6.0.3

{dirigent_cli-0.26.1 → dirigent_cli-0.27.1}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "dirigent-cli"
-version = "0.26.1"
+version = "0.27.1"
 description = "The dirigent command line interface (dirigent / dg)."
 readme = "README.md"
 requires-python = ">=3.13"
@@ -11,14 +11,14 @@ classifiers = [
     "Programming Language :: Python :: 3.13",
 ]
 dependencies = [
-    "dirigent-block-execute==0.26.1",
-    "dirigent-blocks==0.26.1",
-    "dirigent-client==0.26.1",
-    "dirigent-common==0.26.1",
-    "dirigent-core==0.26.1",
-    "dirigent-examples==0.26.1",
-    "dirigent-plugin==0.26.1",
-    "dirigent-server==0.26.1",
+    "dirigent-block-execute==0.27.1",
+    "dirigent-blocks==0.27.1",
+    "dirigent-client==0.27.1",
+    "dirigent-common==0.27.1",
+    "dirigent-core==0.27.1",
+    "dirigent-examples==0.27.1",
+    "dirigent-plugin==0.27.1",
+    "dirigent-server==0.27.1",
     "httpx2>=2.12.0",
     "python-dotenv>=1.1.0",
     "pyyaml>=6.0.3",

{dirigent_cli-0.26.1 → dirigent_cli-0.27.1}/pyproject.toml.orig

@@ -1,6 +1,6 @@
 [project]
 name = "dirigent-cli"
-version = "0.26.1"
+version = "0.27.1"
 description = "The dirigent command line interface (dirigent / dg)."
 readme = "README.md"
 requires-python = ">=3.13"
@@ -11,14 +11,14 @@ classifiers = [
     "Programming Language :: Python :: 3.13",
 ]
 dependencies = [
-    "dirigent-block-execute==0.26.1",
-    "dirigent-blocks==0.26.1",
-    "dirigent-client==0.26.1",
-    "dirigent-common==0.26.1",
-    "dirigent-core==0.26.1",
-    "dirigent-examples==0.26.1",
-    "dirigent-plugin==0.26.1",
-    "dirigent-server==0.26.1",
+    "dirigent-block-execute==0.27.1",
+    "dirigent-blocks==0.27.1",
+    "dirigent-client==0.27.1",
+    "dirigent-common==0.27.1",
+    "dirigent-core==0.27.1",
+    "dirigent-examples==0.27.1",
+    "dirigent-plugin==0.27.1",
+    "dirigent-server==0.27.1",
     "httpx2>=2.12.0",
     "python-dotenv>=1.1.0",
     "pyyaml>=6.0.3",

{dirigent_cli-0.26.1 → dirigent_cli-0.27.1}/src/dirigent_cli/commands.py

@@ -136,10 +136,12 @@ from dirigent_cli.sources import (
     SourceError,
     looks_like_a_document,
     parse_document,
+    read_directory,
     read_document,
     read_path,
 )
 from dirigent_cli.stream import Sink, track_steps, use_scratch_prefix
+from dirigent_cli.summaries import credential_line
 from dirigent_cli.timing import RunProfile, attempt_timing, by_step, profile, step_timing
 from dirigent_client import (
     CLEAR,
@@ -315,15 +317,15 @@ def _print_plan(result: ApplyResult, origin: str) -> bool:
 
 
 def _print_source_tokens(result: ApplyResult, *, base_url: str) -> None:
-    """Print each token an apply minted for a source, once, with where it is presented.
+    """Print each token or signing secret an apply minted for a source, once, with how it is presented.
 
-    The instance stores only a token's hash; there is no second chance to read it.
+    There is no second chance to read either.
     """
     for minted in result.sources.tokens:
         console.print(f"\n  source [bold]{minted.code}[/]  {base_url.rstrip('/')}{minted.url_path}")
-        console.print(f"  Authorization: Bearer [bold]{minted.token}[/]")
+        console.print(f"  {credential_line(minted.auth, minted.header, minted.token)}")
     if result.sources.tokens:
-        console.print("\n[yellow]Each token is shown once.[/] The instance stores only its hash.\n")
+        console.print("\n[yellow]Each token and signing secret is shown once.[/]\n")
 
 
 def _print_graph(steps: Sequence[GraphStep], title: str = "steps") -> None:
@@ -374,9 +376,7 @@ def apply_command(
     as_code: Annotated[str | None, typer.Option("--as", help="Register under a different code.")] = None,
     paused: Annotated[
         bool,
-        typer.Option(
-            "--paused", help="Create the schedules and watches this apply mints paused; existing ones are untouched."
-        ),
+        typer.Option("--paused", help="Create the schedules this apply creates paused; existing ones are untouched."),
     ] = False,
     prune: Annotated[
         bool,
@@ -495,7 +495,9 @@ def export_command(
 
 def validate_command(
     ctx: typer.Context,
-    reference: Annotated[str | None, typer.Argument(help="A file, a URL, or - for standard input.")] = None,
+    reference: Annotated[
+        str | None, typer.Argument(help="A file, a directory of documents, a URL, or - for standard input.")
+    ] = None,
     server: Annotated[
         bool, typer.Option("--server", help="Also check it against a server's catalog and requirements.")
     ] = False,
@@ -512,12 +514,21 @@ def validate_command(
     pipelines it holds, the pipeline a triggers document names, and the parameters its
     schedules pin.
 
+    A directory is read at every depth, and each YAML or JSON file in it that declares a
+    `dirigent/` format is checked; the others are counted as skipped.
+
     `--explain` adds the shape of the work ahead for every pipeline document that is valid:
     the fan-out widths, the retry budgets and the waits. With `--server` too, a sensor that
     declares neither cadence nor deadline takes the block's own.
     """
     state = state_of(ctx)
-    documents = _documents_to_apply(reference, None)
+    skipped = 0
+    if reference is not None and Path(reference).is_dir():
+        documents, skipped = read_directory(Path(reference))
+        if not documents:
+            fail(PROJECT_IS_EMPTY, directory=reference)
+    else:
+        documents = _documents_to_apply(reference, None)
     failures = 0
     parsed: list[tuple[PipelineDefinition | TriggersDefinition, str]] = []
     for document in documents:
@@ -563,6 +574,7 @@ def validate_command(
             blocks=blocks,
             format_checker=checker,
             target=targets.get(definition.pipeline) if isinstance(definition, TriggersDefinition) else None,
+            source_kinds=host.sources,
         )
         if issues:
             emit_fact(
@@ -601,6 +613,7 @@ def validate_command(
         message="invalid" if failures else "valid",
         documents=len(documents),
         invalid=failures,
+        skipped=skipped,
     )
     if failures:
         raise typer.Exit(code=1)

{dirigent_cli-0.26.1 → dirigent_cli-0.27.1}/src/dirigent_cli/local.py

@@ -80,6 +80,7 @@ class ConnectionSpec(BaseModel):
     code: str
     name: str | None = None
     kind: str = "http"
+    description: str | None = None
     config: JsonMap = Field(default_factory=dict)
 
 
@@ -236,7 +237,16 @@ def connections_for(definitions: Sequence[PipelineDefinition], given: Sequence[C
     embedded: dict[str, ConnectionSpec] = {}
     for definition in definitions:
         for code, carried in definition.connections.items():
-            embedded.setdefault(code, ConnectionSpec(code=code, kind=carried.kind, config=carried.config))
+            embedded.setdefault(
+                code,
+                ConnectionSpec(
+                    code=code,
+                    name=carried.name,
+                    kind=carried.kind,
+                    description=carried.description,
+                    config=carried.config,
+                ),
+            )
     replaced = {spec.code for spec in given}
     return [spec for code, spec in embedded.items() if code not in replaced] + list(given)
 
@@ -349,6 +359,7 @@ async def _seed_connections(
                     code=spec.code,
                     name=spec.name,
                     kind=spec.kind,
+                    description=spec.description,
                     config=public,
                     secret_envelope=envelope,
                     secret_key_id=key_id,

{dirigent_cli-0.26.1 → dirigent_cli-0.27.1}/src/dirigent_cli/main.py

@@ -126,8 +126,6 @@ app.add_typer(commands.examples_app, rich_help_panel=DEFINE_PANEL)
 app.add_typer(commands.schema_app, rich_help_panel=DEFINE_PANEL)
 app.add_typer(commands.connection_app, rich_help_panel=CONNECT_PANEL)
 app.add_typer(triggers.schedule_app, rich_help_panel=TRIGGER_PANEL)
-app.add_typer(triggers.webhook_app, rich_help_panel=TRIGGER_PANEL)
-app.add_typer(triggers.watch_app, rich_help_panel=TRIGGER_PANEL)
 app.add_typer(source_commands.source_app, rich_help_panel=TRIGGER_PANEL)
 app.add_typer(triggers.trigger_document_app, rich_help_panel=TRIGGER_PANEL)
 app.add_typer(triggers.alerts_app, rich_help_panel=TRIGGER_PANEL)
@@ -627,7 +625,6 @@ def prune_command(
     ctx: typer.Context,
     runs: Annotated[str | None, typer.Option(help="Keep settled runs younger than this, such as 30d.")] = None,
     logs: Annotated[str | None, typer.Option(help="Keep log entries younger than this.")] = None,
-    deliveries: Annotated[str | None, typer.Option(help="Keep webhook deliveries younger than this.")] = None,
     inputs: Annotated[str | None, typer.Option(help="Keep the record of inputs to a source younger than this.")] = None,
     firings: Annotated[str | None, typer.Option(help="Keep schedule firings younger than this.")] = None,
     notifications: Annotated[str | None, typer.Option(help="Keep sent alerts younger than this.")] = None,
@@ -647,7 +644,7 @@ def prune_command(
     settings = get_settings()
     state = state_of(ctx)
     try:
-        policy = _prune_policy(settings, runs, logs, deliveries, inputs, firings, notifications, scratch=scratch)
+        policy = _prune_policy(settings, runs, logs, inputs, firings, notifications, scratch=scratch)
     except ValueError as error:
         refuse(INVALID_AGE, status=2, title="Invalid age", detail=str(error))
         raise typer.Exit(code=2) from error
@@ -658,7 +655,6 @@ def _prune_policy(
     settings: Settings,
     runs: str | None,
     logs: str | None,
-    deliveries: str | None,
     inputs: str | None,
     firings: str | None,
     notifications: str | None,
@@ -675,7 +671,6 @@ def _prune_policy(
     return retention.Policy(
         runs=age(runs, settings.retention_runs),
         logs=age(logs, settings.retention_logs),
-        deliveries=age(deliveries, settings.retention_deliveries),
         inputs=age(inputs, settings.retention_inputs),
         firings=age(firings, settings.retention_firings),
         notifications=age(notifications, settings.retention_notifications),
@@ -921,7 +916,7 @@ def dev(
         typer.Option(
             "--seed",
             help="Apply every dirigent/v1 document under this directory once the API answers, "
-            "with its schedules and watches paused; name it more than once to seed one directory after another.",
+            "with its schedules paused; name it more than once to seed one directory after another.",
         ),
     ] = None,
     seed_installed: Annotated[
@@ -944,7 +939,7 @@ def dev(
 
     --seed fills the instance from a directory of documents the moment it answers: the
     connections a file or a document declares and the standalone JSON Schema files are created
-    first, then every document is applied with its schedules and watches paused, and one refused
+    first, then every document is applied with its schedules paused, and one refused
     for naming something a later document supplies is applied again once the rest are in. A
     document an instance will not store is reported and passed over, because a corpus holds
     those on purpose.

{dirigent_cli-0.26.1 → dirigent_cli-0.27.1}/src/dirigent_cli/messages.py

@@ -232,11 +232,6 @@ ONE_CLOCK = CLI.define("one_clock", "a schedule takes exactly one of --cron, --i
 
 AT_TAKES_AN_INSTANT = CLI.define("at_takes_an_instant", "--at takes an ISO instant, and {value} is not one")
 
-MAP_TAKES_A_PATH = CLI.define(
-    "map_takes_a_path",
-    "--map takes param=$.path.into.payload, and {entry} has no '='",
-)
-
 NOT_AN_ALERT_EVENT = CLI.define("not_an_alert_event", "{event} is not an alert event ({allowed})")
 
 NOT_AN_IMPORTANCE = CLI.define("not_an_importance", "--importance {value} is not an importance ({allowed})")

{dirigent_cli-0.26.1 → dirigent_cli-0.27.1}/src/dirigent_cli/seeding.py

@@ -208,7 +208,9 @@ async def _connections(client: Dirigent, declared: Sequence[ConnectionSpec], ori
 async def _connection(client: Dirigent, spec: ConnectionSpec) -> str:
     """Store one connection and say whether it was new, letting a refusal through."""
     try:
-        await client.connections.create(spec.code, kind=spec.kind, config=spec.config, name=spec.name)
+        await client.connections.create(
+            spec.code, kind=spec.kind, config=spec.config, name=spec.name, description=spec.description
+        )
     except DirigentError:
         await client.connections.update(spec.code, config=spec.config)
         return "updated"
@@ -216,7 +218,7 @@ async def _connection(client: Dirigent, spec: ConnectionSpec) -> str:
 
 
 async def _apply(client: Dirigent, raw: JsonMap, origin: str) -> Record:
-    """Apply one document with its schedules and watches paused, without the sections it carries."""
+    """Apply one document with its schedules paused, without the sections it carries."""
     document = {name: value for name, value in raw.items() if name not in CARRIED}
     try:
         result = await client.pipelines.apply(
@@ -237,7 +239,6 @@ async def _apply(client: Dirigent, raw: JsonMap, origin: str) -> Record:
         pipeline=result.plan.code,
         action=result.plan.action.value,
         schedules_paused=result.triggers.schedules_created,
-        watches_paused=result.triggers.watches_created,
     )
 
 

{dirigent_cli-0.26.1 → dirigent_cli-0.27.1}/src/dirigent_cli/source_commands.py

@@ -1,8 +1,11 @@
 """The source command group: where a pipeline's inputs enter, what has arrived, and calling one."""
 
+import hashlib
+import hmac
 import json
 from pathlib import Path
 from typing import Annotated, Final
+from urllib.parse import urlencode
 
 import httpx2
 import typer
@@ -18,8 +21,11 @@ from dirigent_plugin.sources import Route
 #: Where ``dg source call`` reads the token a source was given when ``--source-token`` names none.
 TOKEN_ENV: Final = "DIRIGENT_SOURCE_TOKEN"
 
-#: How long a call waits for its answer: an endpoint answers once its run exists, not once it settles.
-CALL_TIMEOUT: Final = httpx2.Timeout(30.0, connect=DEFAULT_CONNECT_TIMEOUT)
+#: Where ``dg source call`` and ``dg source set-secret`` read a signing secret when no option names one.
+SECRET_ENV: Final = "DIRIGENT_SOURCE_SECRET"
+
+#: How long a call waits for its answer, past the longest an instance holds a caller by default.
+CALL_TIMEOUT: Final = httpx2.Timeout(90.0, connect=DEFAULT_CONNECT_TIMEOUT)
 
 source_app = typer.Typer(
     name="source",
@@ -80,10 +86,29 @@ def source_rotate(ctx: typer.Context, pipeline: PipelineArg, code: SourceArg) ->
         code=code,
         pipeline=pipeline,
         url=f"{base.rstrip('/')}{minted.url_path}",
+        auth=minted.auth,
+        header=minted.header,
         token=minted.token,
     )
 
 
+@source_app.command("set-secret")
+def source_set_secret(
+    ctx: typer.Context,
+    pipeline: PipelineArg,
+    code: SourceArg,
+    secret: Annotated[
+        str | None,
+        typer.Option("--secret", envvar=SECRET_ENV, help="The secret its sender issued; prompted for when unset."),
+    ] = None,
+) -> None:
+    """Replace a signed source's signing secret with one its sender issued, such as a provider's own."""
+    given = secret or typer.prompt("signing secret", hide_input=True)
+    with client_for(state_of(ctx)) as dg:
+        row = dg.call(dg.sources.set_secret(pipeline, code, given))
+    emit_fact("source.secret_set", message="secret set", code=code, pipeline=pipeline, prefix=row.token_prefix)
+
+
 @source_app.command("inputs")
 def source_inputs(
     ctx: typer.Context,
@@ -120,6 +145,10 @@ def source_call(
         str | None,
         typer.Option("--source-token", envvar=TOKEN_ENV, help="The source's own token, not the CLI's credential."),
     ] = None,
+    signing_secret: Annotated[
+        str | None,
+        typer.Option("--signing-secret", envvar=SECRET_ENV, help="The secret a signed source's body is signed with."),
+    ] = None,
 ) -> None:
     """Call a received source the way its callers do, and write down what it answered.
 
@@ -143,6 +172,12 @@ def source_call(
     elif text is not None:
         content = _read(text).encode()
         headers["Content-Type"] = "text/plain; charset=utf-8"
+    elif form is not None:
+        content = urlencode(_pairs(form)).encode()
+        headers["Content-Type"] = "application/x-www-form-urlencoded"
+    if signing_secret and row.signature_header:
+        digest = hmac.new(signing_secret.encode(), content or b"", hashlib.sha256).hexdigest()
+        headers[row.signature_header] = f"sha256={digest}"
     try:
         with httpx2.Client(timeout=CALL_TIMEOUT) as http:
             answered = http.request(
@@ -151,7 +186,6 @@ def source_call(
                 headers=headers,
                 params=_pairs(query),
                 content=content,
-                data=_pairs(form) if form is not None else None,
             )
     except httpx2.HTTPError as error:
         fail(SOURCE_UNREACHABLE, url=url, detail=str(error))

{dirigent_cli-0.26.1 → dirigent_cli-0.27.1}/src/dirigent_cli/sources.py

@@ -8,6 +8,7 @@ import httpx2
 import yaml
 from pydantic import BaseModel, ConfigDict
 
+from dirigent_cli.project import DOCUMENT_SUFFIXES
 from dirigent_client import DEFAULT_CONNECT_TIMEOUT
 from dirigent_client.enums import ProvenanceSource
 
@@ -71,6 +72,37 @@ def read_path(path: Path) -> Document:
     return Document(text=path.read_text(), source=ProvenanceSource.FILE, ref=str(path))
 
 
+def read_directory(directory: Path) -> tuple[list[Document], int]:
+    """Read every document under a directory, at any depth, and count the files that are not one.
+
+    A YAML or JSON file is a document when it declares a ``dirigent/`` format, or when it does
+    not parse at all, so a broken document is reported rather than passed over.
+    """
+    documents: list[Document] = []
+    skipped = 0
+    for path in sorted(directory.rglob("*")):
+        if not path.is_file() or path.suffix not in DOCUMENT_SUFFIXES:
+            continue
+        document = read_path(path)
+        if _declares_a_format(document.text):
+            documents.append(document)
+        else:
+            skipped += 1
+    return documents, skipped
+
+
+def _declares_a_format(text: str) -> bool:
+    """Whether a file names a dirigent format at its top, or cannot be read well enough to say."""
+    try:
+        parsed: object = yaml.safe_load(text)
+    except yaml.YAMLError:
+        return True
+    if not isinstance(parsed, dict):
+        return False
+    declared = cast("dict[str, Any]", parsed).get("format")
+    return isinstance(declared, str) and declared.startswith("dirigent/")
+
+
 def parse_document(document: Document) -> dict[str, Any]:
     """Parse a document's text, refusing what is plainly not a pipeline document, by name.
 

{dirigent_cli-0.26.1 → dirigent_cli-0.27.1}/src/dirigent_cli/summaries.py

@@ -256,15 +256,24 @@ def _source_token(record: Record) -> RenderableType | None:
     token = record.get("token")
     if not token:
         return None
+    auth = str(record.get("auth") or "token")
+    header = record.get("header")
     return Group(
         "",
         f"  [bold]{escape(str(record.get('url') or ''))}[/]",
-        f"  [bold]Authorization: Bearer {escape(str(token))}[/]",
+        f"  [bold]{credential_line(auth, str(header) if header else None, escape(str(token)))}[/]",
         "",
-        "[yellow]This is the only time the token is shown.[/] The instance stores only its hash.",
+        "[yellow]This is the only time it is shown.[/]",
     )
 
 
+def credential_line(auth: str, header: str | None, secret: str) -> str:
+    """Say how a caller presents a source's credential: a bearer token, or a signature keyed with a secret."""
+    if auth == "hmac":
+        return f"{header}: sha256=<HMAC-SHA256 of the body, hex>, keyed with {secret}"
+    return f"Authorization: Bearer {secret}"
+
+
 def _files(record: Record) -> list[RenderableType]:
     """List what was written, named against the directory it was written into."""
     written = _texts(record, "files")

{dirigent_cli-0.26.1 → dirigent_cli-0.27.1}/src/dirigent_cli/triggers.py

@@ -1,4 +1,4 @@
-"""The trigger and alerting command groups: schedules, webhooks, watches, and alert rules."""
+"""The trigger and alerting command groups: schedules and alert rules."""
 
 from pathlib import Path
 from typing import Annotated, Any, cast
@@ -9,7 +9,6 @@ from dirigent_cli.commands import paged, parse_importance, parse_log_levels, par
 from dirigent_cli.context import Session, client_for, state_of
 from dirigent_cli.messages import (
     AT_TAKES_AN_INSTANT,
-    MAP_TAKES_A_PATH,
     NOT_AN_ALERT_EVENT,
     ONE_BODY,
     ONE_CLOCK,
@@ -28,18 +27,12 @@ from dirigent_cli.output import (
     throttle_note,
     watching,
 )
-from dirigent_client import LOG_NOTIFIER, TEST_SUBJECT, AlertEvent, AlertScope, WebhookTokenOut
+from dirigent_client import LOG_NOTIFIER, TEST_SUBJECT, AlertEvent, AlertScope
 from dirigent_common import Message
 
 schedule_app = typer.Typer(
     name="schedule", help="A pipeline's clocks: cron, interval, or one-time.", no_args_is_help=True
 )
-webhook_app = typer.Typer(name="webhook", help="Inbound webhooks and their delivery history.", no_args_is_help=True)
-watch_app = typer.Typer(
-    name="watch",
-    help="Sensors kept waiting: one run always waiting on each, the next armed on success.",
-    no_args_is_help=True,
-)
 trigger_document_app = typer.Typer(
     name="trigger-document",
     help="Documents that declare clocks for a pipeline defined elsewhere.",
@@ -251,222 +244,6 @@ def schedule_delete(
     emit_fact("schedule.deleted", message="deleted", code=code, pipeline=pipeline)
 
 
-@watch_app.command("list")
-def watch_list(
-    ctx: typer.Context,
-    pipeline: Annotated[str, typer.Argument(help="The pipeline whose watches to list.")],
-) -> None:
-    """List a pipeline's watches, each with the run it has waiting and how its waits are going."""
-    with client_for(state_of(ctx)) as dg:
-        rows = list(paged(lambda after, size: dg.call(dg.watches.list(pipeline, after=after, limit=size)), None))
-    emit_records("watch", rows)
-
-
-@watch_app.command("show")
-def watch_show(
-    ctx: typer.Context,
-    pipeline: Annotated[str, typer.Argument(help="The pipeline the watch belongs to.")],
-    code: Annotated[str, typer.Argument(help="The watch to show.")],
-) -> None:
-    """Show one watch: the step it waits on, where it left off, and its last error."""
-    with client_for(state_of(ctx)) as dg:
-        row = dg.call(dg.watches.get(pipeline, code))
-    emit_one("watch", row)
-
-
-@watch_app.command("pause")
-def watch_pause(
-    ctx: typer.Context,
-    pipeline: Annotated[str, typer.Argument()],
-    code: Annotated[str, typer.Argument()],
-) -> None:
-    """Stop a watch, cancelling the run it has waiting, and keep where it left off."""
-    with client_for(state_of(ctx)) as dg:
-        row = dg.call(dg.watches.pause(pipeline, code))
-    emit_fact("watch.paused", message="paused", code=code, pipeline=pipeline, cursor=row.cursor)
-
-
-@watch_app.command("resume")
-def watch_resume(
-    ctx: typer.Context,
-    pipeline: Annotated[str, typer.Argument()],
-    code: Annotated[str, typer.Argument()],
-) -> None:
-    """Start a watch again, arming a run from where its last success left off."""
-    with client_for(state_of(ctx)) as dg:
-        row = dg.call(dg.watches.resume(pipeline, code))
-    emit_fact(
-        "watch.resumed",
-        message="resumed",
-        code=code,
-        pipeline=pipeline,
-        waiting_run_id=row.waiting_run_id,
-        cursor=row.cursor,
-    )
-
-
-def _print_token(minted: WebhookTokenOut, *, base_url: str) -> None:
-    """Print a minted token once, with the URL already assembled.
-
-    The instance stores only the token's hash; there is no second chance to read it.
-    """
-    console.print(f"\n  POST  [bold]{base_url.rstrip('/')}{minted.url_path}[/]")
-    console.print(f"  Token [bold]{minted.token}[/]")
-    console.print("\n[yellow]This token is shown once.[/] The instance stores only its hash.\n")
-
-
-@webhook_app.command("create")
-def webhook_create(
-    ctx: typer.Context,
-    pipeline: Annotated[str, typer.Argument(help="The pipeline this webhook starts.")],
-    code: Annotated[str, typer.Argument(help="What to call it; unique within the pipeline.")],
-    name: Annotated[str | None, typer.Option("--name", help="A human title for this webhook.")] = None,
-    description: Annotated[str | None, typer.Option("--description", help="What this webhook is for.")] = None,
-    map_value: Annotated[
-        list[str] | None,
-        typer.Option("--map", help="param=$.path.into.payload, repeatable."),
-    ] = None,
-    hmac_secret: Annotated[
-        str | None,
-        typer.Option("--hmac-secret", help="Require an X-Dirigent-Signature over the raw body."),
-    ] = None,
-    rate_limit: Annotated[int, typer.Option("--rate-limit", help="Deliveries a minute this token may make.")] = 60,
-    priority: Annotated[
-        str | None,
-        typer.Option(
-            "--priority",
-            help="How far ahead of other runs an accepted delivery's run is claimed: low, normal, or high. "
-            "Omitted takes the pipeline's own.",
-        ),
-    ] = None,
-) -> None:
-    """Declare a webhook and print its token once, with the URL to POST to."""
-    mapping: dict[str, str] = {}
-    for entry in map_value or []:
-        if "=" not in entry:
-            _fail(MAP_TAKES_A_PATH, entry=repr(entry))
-        key, path = entry.split("=", 1)
-        mapping[key.strip()] = path.strip()
-    with client_for(state_of(ctx)) as dg:
-        minted = dg.call(
-            dg.webhooks.create(
-                pipeline,
-                code,
-                name=name,
-                description=description,
-                params_from_payload=mapping,
-                hmac_secret=hmac_secret,
-                rate_limit_per_minute=rate_limit,
-                priority=parse_priority(priority),
-            )
-        )
-        base = dg.url
-    if state_of(ctx).json_output:
-        return emit_fact(
-            "webhook.created",
-            message="created",
-            code=minted.code,
-            pipeline=pipeline,
-            url=f"{base.rstrip('/')}{minted.url_path}",
-            token=minted.token,
-        )
-    console.print(f"[green]created[/] webhook [bold]{minted.code}[/] on {pipeline}")
-    _print_token(minted, base_url=base)
-
-
-@webhook_app.command("list")
-def webhook_list(
-    ctx: typer.Context,
-    pipeline: Annotated[str, typer.Argument(help="The pipeline whose webhooks to list.")],
-) -> None:
-    """List a pipeline's webhooks, with their mapping but never their tokens."""
-    with client_for(state_of(ctx)) as dg:
-        rows = list(paged(lambda after, size: dg.call(dg.webhooks.list(pipeline, after=after, limit=size)), None))
-    if state_of(ctx).json_output:
-        return emit_records("webhook", rows)
-    table(
-        f"webhooks of {pipeline}",
-        ["code", "name", "token", "signed", "active", "limit/min", "maps", "last delivery"],
-        [
-            [
-                row.code,
-                row.name or "-",
-                f"{row.token_prefix}...",
-                render_bool(row.signed),
-                render_bool(row.active),
-                str(row.rate_limit_per_minute),
-                ", ".join(sorted(row.params_from_payload)) or "-",
-                moment(row.last_delivery_at),
-            ]
-            for row in rows
-        ],
-    )
-
-
-@webhook_app.command("rotate-token")
-def webhook_rotate(
-    ctx: typer.Context,
-    pipeline: Annotated[str, typer.Argument()],
-    code: Annotated[str, typer.Argument()],
-) -> None:
-    """Mint a new token and forget the old one; every caller has to be updated."""
-    with client_for(state_of(ctx)) as dg:
-        minted = dg.call(dg.webhooks.rotate_token(pipeline, code))
-        base = dg.url
-    if state_of(ctx).json_output:
-        return emit_fact(
-            "webhook.token_rotated",
-            message="rotated",
-            code=code,
-            pipeline=pipeline,
-            url=f"{base.rstrip('/')}{minted.url_path}",
-            token=minted.token,
-        )
-    console.print(f"[green]rotated[/] the token of webhook [bold]{code}[/]; the previous one no longer works")
-    _print_token(minted, base_url=base)
-
-
-@webhook_app.command("deliveries")
-def webhook_deliveries(
-    ctx: typer.Context,
-    pipeline: Annotated[str, typer.Argument()],
-    code: Annotated[str, typer.Argument()],
-) -> None:
-    """Show what has arrived at a webhook, refusals included."""
-    with client_for(state_of(ctx)) as dg:
-        rows = list(
-            paged(lambda after, size: dg.call(dg.webhooks.deliveries(pipeline, code, after=after, limit=size)), None)
-        )
-    if state_of(ctx).json_output:
-        return emit_records("delivery", rows)
-    table(
-        f"deliveries to {code}",
-        ["received", "outcome", "run", "from", "detail"],
-        [
-            [
-                moment(row.created_at),
-                styled(row.outcome.value),
-                str(row.run_id or "-")[:8],
-                row.source or "-",
-                row.reason or "-",
-            ]
-            for row in rows
-        ],
-    )
-
-
-@webhook_app.command("delete")
-def webhook_delete(
-    ctx: typer.Context,
-    pipeline: Annotated[str, typer.Argument()],
-    code: Annotated[str, typer.Argument()],
-) -> None:
-    """Remove a webhook, its token, and its delivery history."""
-    with client_for(state_of(ctx)) as dg:
-        dg.call(dg.webhooks.delete(pipeline, code))
-    emit_fact("webhook.deleted", message="deleted", code=code, pipeline=pipeline)
-
-
 @alerts_rules_app.command("list")
 def alerts_rules_list(
     ctx: typer.Context,
@@ -680,7 +457,7 @@ def trigger_document_show(
     ctx: typer.Context,
     code: Annotated[str, typer.Argument(help="The triggers document to read.")],
 ) -> None:
-    """Show one triggers document and the schedules, webhooks and watches it owns."""
+    """Show one triggers document and the schedules it owns."""
     with client_for(state_of(ctx)) as dg:
         detail = dg.call(dg.trigger_documents.get(code))
     if state_of(ctx).json_output:
@@ -689,8 +466,6 @@ def trigger_document_show(
     console.print(f"  pipeline  [bold]{detail.pipeline}[/]")
     console.print(f"  digest    [dim]{detail.digest}[/]")
     console.print(f"  schedules {', '.join(detail.schedules) or '-'}")
-    console.print(f"  webhooks  {', '.join(detail.webhooks) or '-'}")
-    console.print(f"  watches   {', '.join(detail.watches) or '-'}")
     if detail.description:
         console.print(f"\n{detail.description}")
 
@@ -700,17 +475,10 @@ def trigger_document_delete(
     ctx: typer.Context,
     code: Annotated[str, typer.Argument(help="The triggers document to remove.")],
 ) -> None:
-    """Remove a triggers document and every schedule and webhook it declared."""
+    """Remove a triggers document and every schedule it declared."""
     with client_for(state_of(ctx)) as dg:
         dg.call(dg.trigger_documents.delete(code))
-    emit_fact(
-        "trigger_document.deleted",
-        message="deleted",
-        code=code,
-        schedules="deleted",
-        webhooks="deleted",
-        watches="deleted",
-    )
+    emit_fact("trigger_document.deleted", message="deleted", code=code, schedules="deleted")
 
 
 @alerts_app.command("retry")