deepline 0.2.48 → 0.2.50

package/dist/bundling-sources/shared_libs/plays/user-code-safety.ts

@@ -0,0 +1,61 @@
+// Compile-time safety gate for user-authored play code (enrich `extract_js`,
+// `run_if_js`, and `run_javascript` step `code`).
+//
+// Plays replay deterministically under Worker Loader, and the step code runs
+// with provider data in scope. So user code may NOT be non-deterministic
+// (Math.random, Date.now, ...) — replay would diverge — and may NOT reach out
+// of the sandbox (fetch, require, process, ...). We reject those at compile
+// time with a clear, named error (fail loud, per the repo non-negotiables).
+//
+// This is a fast static scan, not a security boundary on its own: the play
+// runtime is the real boundary (it executes step code in an isolate that does
+// not expose these globals). The scan exists to fail authoring early with a
+// readable message instead of producing a play that silently misbehaves at run
+// time. The `(?<!\.)` guards keep it from flagging harmless property access on
+// user objects (e.g. `row.process_date`, `data.fetch`).
+
+type ForbiddenRule = { readonly pattern: RegExp; readonly reason: string };
+
+const FORBIDDEN: readonly ForbiddenRule[] = [
+  // Non-deterministic — breaks replay.
+  { pattern: /\bMath\s*\.\s*random\b/, reason: 'Math.random()' },
+  { pattern: /\bDate\s*\.\s*now\b/, reason: 'Date.now()' },
+  { pattern: /\bnew\s+Date\s*\(\s*\)/, reason: 'new Date() with no argument' },
+  { pattern: /\bperformance\s*\.\s*now\b/, reason: 'performance.now()' },
+  {
+    pattern: /\bcrypto\s*\.\s*(?:randomUUID|getRandomValues)\b/,
+    reason: 'crypto random',
+  },
+  // Sandbox escape / I/O.
+  { pattern: /(?<!\.)\bfetch\s*\(/, reason: 'fetch()' },
+  { pattern: /(?<!\.)\bimport\s*\(/, reason: 'dynamic import()' },
+  { pattern: /(?<!\.)\brequire\s*\(/, reason: 'require()' },
+  { pattern: /(?<!\.)\beval\s*\(/, reason: 'eval()' },
+  {
+    pattern: /(?<!\.)\bnew\s+Function\b|(?<!\.)\bFunction\s*\(/,
+    reason: 'the Function constructor',
+  },
+  { pattern: /(?<!\.)\bprocess\b/, reason: 'process' },
+  { pattern: /(?<!\.)\bglobalThis\b/, reason: 'globalThis' },
+  { pattern: /(?<!\.)\b(?:window|self)\b/, reason: 'window/self' },
+  { pattern: /(?<!\.)\bXMLHttpRequest\b/, reason: 'XMLHttpRequest' },
+  { pattern: /(?<!\.)\bWebAssembly\b/, reason: 'WebAssembly' },
+];
+
+/**
+ * Throw if `code` references a forbidden (non-deterministic or sandbox-escaping)
+ * construct. `label` describes where the code came from for the error message,
+ * e.g. `extract_js for "email"` or `run_javascript step "enrich"`.
+ */
+export function assertUserCodeIsSafe(code: string, label: string): void {
+  if (typeof code !== 'string' || !code.trim()) return;
+  for (const { pattern, reason } of FORBIDDEN) {
+    if (pattern.test(code)) {
+      throw new Error(
+        `${label} uses ${reason}, which is not allowed in play code: it ` +
+          `breaks deterministic replay or escapes the sandbox. Remove it and ` +
+          `compute the value from the row/result instead.`,
+      );
+    }
+  }
+}

package/dist/cli/index.js

@@ -1044,7 +1044,7 @@ var SDK_RELEASE = {
   // 0.2.0 makes Dataset Handles uniformly async-only after 0.1.320 briefly
   // exposed storage-dependent synchronous access. This deliberate minor
   // release keeps lazy paging semantics independent of row residency.
-  version: "0.2.48",
+  version: "0.2.50",
   contracts: {
     api: {
       name: "sdk-http-api",
@@ -3879,7 +3879,7 @@ var DeeplineClient = class {
       deploy: (definition, options2) => this.deployMonitor(definition, options2),
       list: (options2) => this.listMonitors(options2),
       get: (key) => this.getMonitor(key),
-      test: (key, payload) => this.testMonitorWebhook(key, payload),
+      test: (key, payload, options2) => this.testMonitorWebhook(key, payload, options2),
       validate: (key) => this.validateMonitor(key),
       dependents: (key) => this.getMonitorDependents(key),
       update: (key, patch) => this.updateMonitor(key, patch),
@@ -6048,10 +6048,16 @@ var DeeplineClient = class {
       { method: "GET" }
     );
   }
-  async testMonitorWebhook(key, payload) {
+  async testMonitorWebhook(key, payload, options) {
     return this.http.request(
       `/api/v2/monitors/deployed/${encodeURIComponent(key)}/test`,
-      { method: "POST", body: { payload } }
+      {
+        method: "POST",
+        body: {
+          payload,
+          ...options?.validationOnly ? { mode: "validation_only" } : {}
+        }
+      }
     );
   }
   async setupMonitor(tool, payload) {
@@ -15021,6 +15027,76 @@ var PLAY_AUTHORING_FIELD_REGISTRY = {
     description: "HTTP header containing the webhook signature.",
     errorMessage: "bindings.webhook.hmac.header must be a non-empty static string."
   },
+  "bindings.webhook.auth.type": {
+    schema: Type.Literal("standard-webhooks"),
+    fixtures: {
+      valid: "standard-webhooks",
+      invalid: "svix",
+      absent: void 0,
+      unresolved: { expression: "type" },
+      edition1: void 0
+    },
+    referenceType: "'standard-webhooks'",
+    // auth itself is optional; once present, the AST adapter requires this
+    // field together with headerFamily and signingSecrets.
+    required: false,
+    resolution: "static-required",
+    issueCode: "play_authoring_standard_webhooks_invalid",
+    description: "Uses the Standard Webhooks v1 symmetric signing scheme.",
+    errorMessage: 'bindings.webhook.auth.type must be the static literal "standard-webhooks".'
+  },
+  "bindings.webhook.auth.headerFamily": {
+    schema: Type.Union([Type.Literal("standard"), Type.Literal("svix")]),
+    fixtures: {
+      valid: "svix",
+      invalid: "webhook",
+      absent: void 0,
+      unresolved: { expression: "headerFamily" },
+      edition1: void 0
+    },
+    referenceType: "'standard' | 'svix'",
+    // auth itself is optional; once present, the AST adapter requires this
+    // field together with type and signingSecrets.
+    required: false,
+    resolution: "static-required",
+    issueCode: "play_authoring_standard_webhooks_invalid",
+    description: "Header namespace expected from the webhook provider.",
+    errorMessage: 'bindings.webhook.auth.headerFamily must be the static literal "standard" or "svix".'
+  },
+  "bindings.webhook.auth.signingSecrets[]": {
+    schema: SecretEnvironmentNameSchema,
+    fixtures: {
+      valid: "VECTOR_WEBHOOK_SECRET",
+      invalid: "vector_webhook_secret",
+      absent: void 0,
+      unresolved: { expression: "secret" },
+      edition1: void 0
+    },
+    referenceType: "string",
+    // auth itself is optional; once present, the AST adapter requires this
+    // field together with type and headerFamily.
+    required: false,
+    resolution: "static-required",
+    issueCode: "play_authoring_standard_webhooks_invalid",
+    description: "Deepline Secret name used to verify Standard Webhooks.",
+    errorMessage: "bindings.webhook.auth.signingSecrets entries must be uppercase Deepline Secret names beginning with a letter."
+  },
+  "bindings.webhook.auth.toleranceSeconds": {
+    schema: Type.Integer({ minimum: 1, maximum: 3600 }),
+    fixtures: {
+      valid: 300,
+      invalid: 0,
+      absent: void 0,
+      unresolved: { expression: "toleranceSeconds" },
+      edition1: void 0
+    },
+    referenceType: "number",
+    required: false,
+    resolution: "static-required",
+    issueCode: "play_authoring_standard_webhooks_invalid",
+    description: "Accepted delivery timestamp skew in seconds, from 1 through 3600.",
+    errorMessage: "bindings.webhook.auth.toleranceSeconds must be a static whole number from 1 through 3600."
+  },
   "bindings.cron.schedule": {
     schema: Type.String({ minLength: 1 }),
     fixtures: {
@@ -16045,7 +16121,7 @@ var PLAY_AUTHORING_CLOUD_TYPE_DECLARATIONS = [
   `  inline?: ${cloudReferenceType("inline")};`,
   `  billing?: { maxCreditsPerRun?: ${cloudReferenceType("billing.maxCreditsPerRun")} };`,
   `  runtime?: { timeout?: ${cloudReferenceType("runtime.timeout")}; size?: ${cloudReferenceType("runtime.size")} };`,
-  `  webhook?: { hmac?: { algorithm?: ${cloudReferenceType("bindings.webhook.hmac.algorithm")}; header?: ${cloudReferenceType("bindings.webhook.hmac.header")}; secretEnv: ${cloudReferenceType("bindings.webhook.hmac.secretEnv")} } };`,
+  `  webhook?: { hmac?: { algorithm?: ${cloudReferenceType("bindings.webhook.hmac.algorithm")}; header?: ${cloudReferenceType("bindings.webhook.hmac.header")}; secretEnv: ${cloudReferenceType("bindings.webhook.hmac.secretEnv")} }; auth?: { type: ${cloudReferenceType("bindings.webhook.auth.type")}; headerFamily: ${cloudReferenceType("bindings.webhook.auth.headerFamily")}; signingSecrets: readonly ${cloudReferenceType("bindings.webhook.auth.signingSecrets[]")}[]; toleranceSeconds?: ${cloudReferenceType("bindings.webhook.auth.toleranceSeconds")} } };`,
   `  cron?: { schedule: ${cloudReferenceType("bindings.cron.schedule")}; timezone?: ${cloudReferenceType("bindings.cron.timezone")} };`,
   "  sqlListeners?: readonly SqlListenerDeclaration[];",
   `  secrets?: readonly ${cloudReferenceType("bindings.secrets[]")}[];`,
@@ -24587,7 +24663,7 @@ function getterFromLegacyExtractJs(extractJs, fallbackAlias) {
   return null;
 }
 
-// src/cli/enrich-compat-adapter.ts
+// ../shared_libs/plays/enrich-compat-adapter.ts
 var ENRICH_COMPAT_DEFAULT_PLAY_NAME = "deepline-enrich-v1-compat";
 var ENRICH_COMPAT_DEFAULT_MAP_NAME = "deepline_enrich_rows";
 function buildEnrichCompatibilityPlan(options = {}) {
@@ -24597,7 +24673,7 @@ function buildEnrichCompatibilityPlan(options = {}) {
   };
 }
 
-// src/cli/user-code-safety.ts
+// ../shared_libs/plays/user-code-safety.ts
 var FORBIDDEN = [
   // Non-deterministic — breaks replay.
   { pattern: /\bMath\s*\.\s*random\b/, reason: "Math.random()" },
@@ -24634,7 +24710,7 @@ function assertUserCodeIsSafe(code, label) {
   }
 }
 
-// src/cli/enrich-play-compiler.ts
+// ../shared_libs/plays/enrich-play-compiler.ts
 function isWaterfall(command) {
   return "with_waterfall" in command;
 }
@@ -25065,7 +25141,9 @@ function compileEnrichConfigToPlaySource(config, options = {}) {
   const generatedAliases = collectGeneratedAliases(config.commands);
   const runOptionsSource = options.failFast ? `{ key: (row, index) => __dlEnrichRowKey(row, index + rowStart), onRowError: 'fail' as const }` : `{ key: (row, index) => __dlEnrichRowKey(row, index + rowStart) }`;
   const playOptionsSource = [
-    `description: ${stringLiteral("Read a CSV file, run the configured Deepline enrich commands, and return enriched rows.")}`,
+    `description: ${stringLiteral(
+      "Read a CSV file, run the configured Deepline enrich commands, and return enriched rows."
+    )}`,
     ...options.maxCreditsPerRun === void 0 ? [] : [`billing: { maxCreditsPerRun: ${String(options.maxCreditsPerRun)} }`]
   ].join(", ");
   const body = [
@@ -30757,6 +30835,31 @@ function readDeployOutputContract(payload) {
   });
   return { tool: asString(contract.tool), streams };
 }
+function renderDeployReplacementWarning(input2) {
+  const summary = asRecord2(input2.payload.change_summary);
+  const upstream = summary ? asRecord2(summary.upstream) : void 0;
+  if (!summary || !upstream || upstream.resource_replaced !== true) return [];
+  const definition = asRecord2(summary.definition);
+  const changed = definition && Array.isArray(definition.changed) ? definition.changed : [];
+  const lines = [
+    input2.completed ? "WARNING: this deploy replaced the existing upstream monitor." : "WARNING: this deploy replaces the existing upstream monitor.",
+    "Existing Customer DB rows are preserved. Provider backfill is not implied."
+  ];
+  for (const raw of changed) {
+    const item = asRecord2(raw);
+    const path = item ? asString(item.path) : void 0;
+    if (!item || !path) continue;
+    lines.push(
+      `  ${path}: ${JSON.stringify(item.before ?? null)} \u2192 ${JSON.stringify(
+        item.after ?? null
+      )}`
+    );
+  }
+  lines.push(
+    input2.monitorKey ? `Use \`deepline monitors update ${input2.monitorKey} <patch>\` for a patch-style change.` : "Use `deepline monitors update <key> <patch>` for a patch-style change."
+  );
+  return lines;
+}
 function renderMonitorDeployCompletion(payload) {
   const monitor = asRecord2(payload.monitor);
   const key = monitor ? asString(monitor.key) : void 0;
@@ -30784,6 +30887,12 @@ function renderMonitorDeployCompletion(payload) {
   if (pricingLine) {
     lines.push("", `Pricing: ${pricingLine}`);
   }
+  const replacementWarning = renderDeployReplacementWarning({
+    payload,
+    completed: true,
+    monitorKey: key
+  });
+  if (replacementWarning.length) lines.push("", ...replacementWarning);
   const guidance = asRecord2(payload.setup_guidance);
   if (guidance) {
     const callbackUrl = asString(guidance.callback_url);
@@ -30835,6 +30944,11 @@ function renderMonitorDeployPlan(payload) {
       if (message) lines.push(`  - ${path ? `${path}: ` : ""}${message}`);
     }
   }
+  const replacementWarning = renderDeployReplacementWarning({
+    payload,
+    completed: false
+  });
+  if (replacementWarning.length) lines.push("", ...replacementWarning);
   const estimate = asRecord2(payload.deploy_cost_estimate);
   const credits = estimate ? asFiniteNumber(estimate.credits) : void 0;
   if (credits !== void 0) {
@@ -31201,10 +31315,17 @@ async function handleMonitorsGet(key, options) {
 }
 async function handleMonitorsTest(key, payload, options) {
   const explicitPayload = parseJsonObjectArg(payload, "<payload>");
-  const result = await new DeeplineClient().monitors.test(key, explicitPayload);
-  const text = `Webhook test for ${key}: ${result.accepted === true ? "accepted" : "rejected"}
-  persisted rows: ${asFiniteNumber(result.persisted_rows) ?? 0}
-  bound Plays dispatched: ${asFiniteNumber(result.dispatched_bound_plays) ?? 0}
+  const result = await new DeeplineClient().monitors.test(
+    key,
+    explicitPayload,
+    {
+      validationOnly: options.dispatch !== true
+    }
+  );
+  const dispatch = options.dispatch === true;
+  const text = `Monitor diagnostic for ${key}: ${result.accepted === true ? "accepted" : "rejected"}
+` + (dispatch ? "  mode: dispatch (writes rows and may dispatch bound Plays)\n" : "  mode: validation_only (no rows written, credits spent, or Plays dispatched)\n") + `${dispatch ? "persisted" : "would persist"} rows: ${asFiniteNumber(result.persisted_rows) ?? 0}
+${dispatch ? "dispatched" : "would dispatch"} bound Plays: ${asFiniteNumber(result.dispatched_bound_plays) ?? 0}
 `;
   printCommandEnvelope(result, { json: options.json, text });
 }
@@ -31416,12 +31537,18 @@ Examples:
   withJsonOption(
     monitors.command("test <key> <payload>").description(
       "Send an explicit payload through a monitor\u2019s webhook ingestion path."
+    ).option(
+      "--dispatch",
+      "Inject the test event through normal ingestion (writes rows and may dispatch bound Plays)"
     ).addHelpText(
       "after",
       `
 Notes:
   <payload> must be an explicit JSON object. The command uses the deployed
-  monitor\u2019s real validation, persistence, and inline Play dispatch path; it does
+  monitor\u2019s real binding and payload validation, but is a side-effect-free
+  diagnostic: it does not persist rows, spend credits, dispatch Plays, or alter
+  monitor state. Pass --dispatch only when you deliberately need the historic
+  full-ingestion test event; it can write rows and trigger bound Plays. It does
   not synthesize a provider event or accept an omitted payload.
 
 Examples:
@@ -31442,7 +31569,9 @@ Notes:
   via --file <path>, or
   from stdin with --file -. Does not deploy or spend credits.
   For Deepline Native Company Radar monitors, check validates persona-filter enums and the
-  job_titles Boolean-expression grammar locally. Inspect the exact schema with
+  job_titles Boolean-expression grammar locally (parentheses are unsupported;
+  NOT > AND > OR).
+  Inspect the exact schema with
   \`deepline monitors available deepline_native.company_radar --json\`.
 
 Examples:
@@ -31466,6 +31595,9 @@ Notes:
   --dry-run validates the definition and shows the plan (deploy cost in Deepline
   credits when the server reports it, plus any existing monitors that may
   already cover this scope) WITHOUT deploying. Exits 0 when valid, 7 when not.
+  Deploy is a full desired definition for its key: omitting a previously stored
+  field removes it and can replace the upstream resource. Use \`monitors update\`
+  for a patch-style change.
 
 Examples:
   deepline monitors deploy '{"key":"job-openings","tool":"deepline_native.company_radar","payload":{"domain":"stripe.com","radar_type":"company_job_openings"}}'

package/dist/cli/index.mjs

@@ -1030,7 +1030,7 @@ var SDK_RELEASE = {
   // 0.2.0 makes Dataset Handles uniformly async-only after 0.1.320 briefly
   // exposed storage-dependent synchronous access. This deliberate minor
   // release keeps lazy paging semantics independent of row residency.
-  version: "0.2.48",
+  version: "0.2.50",
   contracts: {
     api: {
       name: "sdk-http-api",
@@ -3865,7 +3865,7 @@ var DeeplineClient = class {
       deploy: (definition, options2) => this.deployMonitor(definition, options2),
       list: (options2) => this.listMonitors(options2),
       get: (key) => this.getMonitor(key),
-      test: (key, payload) => this.testMonitorWebhook(key, payload),
+      test: (key, payload, options2) => this.testMonitorWebhook(key, payload, options2),
       validate: (key) => this.validateMonitor(key),
       dependents: (key) => this.getMonitorDependents(key),
       update: (key, patch) => this.updateMonitor(key, patch),
@@ -6034,10 +6034,16 @@ var DeeplineClient = class {
       { method: "GET" }
     );
   }
-  async testMonitorWebhook(key, payload) {
+  async testMonitorWebhook(key, payload, options) {
     return this.http.request(
       `/api/v2/monitors/deployed/${encodeURIComponent(key)}/test`,
-      { method: "POST", body: { payload } }
+      {
+        method: "POST",
+        body: {
+          payload,
+          ...options?.validationOnly ? { mode: "validation_only" } : {}
+        }
+      }
     );
   }
   async setupMonitor(tool, payload) {
@@ -12307,7 +12313,9 @@ import {
   extname,
   isAbsolute as isAbsolute3,
   join as join7,
-  resolve as resolve8
+  relative as relative2,
+  resolve as resolve8,
+  sep
 } from "path";
 import { builtinModules } from "module";
 import { Parser } from "acorn";
@@ -15058,6 +15066,76 @@ var PLAY_AUTHORING_FIELD_REGISTRY = {
     description: "HTTP header containing the webhook signature.",
     errorMessage: "bindings.webhook.hmac.header must be a non-empty static string."
   },
+  "bindings.webhook.auth.type": {
+    schema: Type.Literal("standard-webhooks"),
+    fixtures: {
+      valid: "standard-webhooks",
+      invalid: "svix",
+      absent: void 0,
+      unresolved: { expression: "type" },
+      edition1: void 0
+    },
+    referenceType: "'standard-webhooks'",
+    // auth itself is optional; once present, the AST adapter requires this
+    // field together with headerFamily and signingSecrets.
+    required: false,
+    resolution: "static-required",
+    issueCode: "play_authoring_standard_webhooks_invalid",
+    description: "Uses the Standard Webhooks v1 symmetric signing scheme.",
+    errorMessage: 'bindings.webhook.auth.type must be the static literal "standard-webhooks".'
+  },
+  "bindings.webhook.auth.headerFamily": {
+    schema: Type.Union([Type.Literal("standard"), Type.Literal("svix")]),
+    fixtures: {
+      valid: "svix",
+      invalid: "webhook",
+      absent: void 0,
+      unresolved: { expression: "headerFamily" },
+      edition1: void 0
+    },
+    referenceType: "'standard' | 'svix'",
+    // auth itself is optional; once present, the AST adapter requires this
+    // field together with type and signingSecrets.
+    required: false,
+    resolution: "static-required",
+    issueCode: "play_authoring_standard_webhooks_invalid",
+    description: "Header namespace expected from the webhook provider.",
+    errorMessage: 'bindings.webhook.auth.headerFamily must be the static literal "standard" or "svix".'
+  },
+  "bindings.webhook.auth.signingSecrets[]": {
+    schema: SecretEnvironmentNameSchema,
+    fixtures: {
+      valid: "VECTOR_WEBHOOK_SECRET",
+      invalid: "vector_webhook_secret",
+      absent: void 0,
+      unresolved: { expression: "secret" },
+      edition1: void 0
+    },
+    referenceType: "string",
+    // auth itself is optional; once present, the AST adapter requires this
+    // field together with type and headerFamily.
+    required: false,
+    resolution: "static-required",
+    issueCode: "play_authoring_standard_webhooks_invalid",
+    description: "Deepline Secret name used to verify Standard Webhooks.",
+    errorMessage: "bindings.webhook.auth.signingSecrets entries must be uppercase Deepline Secret names beginning with a letter."
+  },
+  "bindings.webhook.auth.toleranceSeconds": {
+    schema: Type.Integer({ minimum: 1, maximum: 3600 }),
+    fixtures: {
+      valid: 300,
+      invalid: 0,
+      absent: void 0,
+      unresolved: { expression: "toleranceSeconds" },
+      edition1: void 0
+    },
+    referenceType: "number",
+    required: false,
+    resolution: "static-required",
+    issueCode: "play_authoring_standard_webhooks_invalid",
+    description: "Accepted delivery timestamp skew in seconds, from 1 through 3600.",
+    errorMessage: "bindings.webhook.auth.toleranceSeconds must be a static whole number from 1 through 3600."
+  },
   "bindings.cron.schedule": {
     schema: Type.String({ minLength: 1 }),
     fixtures: {
@@ -16082,7 +16160,7 @@ var PLAY_AUTHORING_CLOUD_TYPE_DECLARATIONS = [
   `  inline?: ${cloudReferenceType("inline")};`,
   `  billing?: { maxCreditsPerRun?: ${cloudReferenceType("billing.maxCreditsPerRun")} };`,
   `  runtime?: { timeout?: ${cloudReferenceType("runtime.timeout")}; size?: ${cloudReferenceType("runtime.size")} };`,
-  `  webhook?: { hmac?: { algorithm?: ${cloudReferenceType("bindings.webhook.hmac.algorithm")}; header?: ${cloudReferenceType("bindings.webhook.hmac.header")}; secretEnv: ${cloudReferenceType("bindings.webhook.hmac.secretEnv")} } };`,
+  `  webhook?: { hmac?: { algorithm?: ${cloudReferenceType("bindings.webhook.hmac.algorithm")}; header?: ${cloudReferenceType("bindings.webhook.hmac.header")}; secretEnv: ${cloudReferenceType("bindings.webhook.hmac.secretEnv")} }; auth?: { type: ${cloudReferenceType("bindings.webhook.auth.type")}; headerFamily: ${cloudReferenceType("bindings.webhook.auth.headerFamily")}; signingSecrets: readonly ${cloudReferenceType("bindings.webhook.auth.signingSecrets[]")}[]; toleranceSeconds?: ${cloudReferenceType("bindings.webhook.auth.toleranceSeconds")} } };`,
   `  cron?: { schedule: ${cloudReferenceType("bindings.cron.schedule")}; timezone?: ${cloudReferenceType("bindings.cron.timezone")} };`,
   "  sqlListeners?: readonly SqlListenerDeclaration[];",
   `  secrets?: readonly ${cloudReferenceType("bindings.secrets[]")}[];`,
@@ -24631,7 +24709,7 @@ function getterFromLegacyExtractJs(extractJs, fallbackAlias) {
   return null;
 }
 
-// src/cli/enrich-compat-adapter.ts
+// ../shared_libs/plays/enrich-compat-adapter.ts
 var ENRICH_COMPAT_DEFAULT_PLAY_NAME = "deepline-enrich-v1-compat";
 var ENRICH_COMPAT_DEFAULT_MAP_NAME = "deepline_enrich_rows";
 function buildEnrichCompatibilityPlan(options = {}) {
@@ -24641,7 +24719,7 @@ function buildEnrichCompatibilityPlan(options = {}) {
   };
 }
 
-// src/cli/user-code-safety.ts
+// ../shared_libs/plays/user-code-safety.ts
 var FORBIDDEN = [
   // Non-deterministic — breaks replay.
   { pattern: /\bMath\s*\.\s*random\b/, reason: "Math.random()" },
@@ -24678,7 +24756,7 @@ function assertUserCodeIsSafe(code, label) {
   }
 }
 
-// src/cli/enrich-play-compiler.ts
+// ../shared_libs/plays/enrich-play-compiler.ts
 function isWaterfall(command) {
   return "with_waterfall" in command;
 }
@@ -25109,7 +25187,9 @@ function compileEnrichConfigToPlaySource(config, options = {}) {
   const generatedAliases = collectGeneratedAliases(config.commands);
   const runOptionsSource = options.failFast ? `{ key: (row, index) => __dlEnrichRowKey(row, index + rowStart), onRowError: 'fail' as const }` : `{ key: (row, index) => __dlEnrichRowKey(row, index + rowStart) }`;
   const playOptionsSource = [
-    `description: ${stringLiteral("Read a CSV file, run the configured Deepline enrich commands, and return enriched rows.")}`,
+    `description: ${stringLiteral(
+      "Read a CSV file, run the configured Deepline enrich commands, and return enriched rows."
+    )}`,
     ...options.maxCreditsPerRun === void 0 ? [] : [`billing: { maxCreditsPerRun: ${String(options.maxCreditsPerRun)} }`]
   ].join(", ");
   const body = [
@@ -30808,6 +30888,31 @@ function readDeployOutputContract(payload) {
   });
   return { tool: asString(contract.tool), streams };
 }
+function renderDeployReplacementWarning(input2) {
+  const summary = asRecord2(input2.payload.change_summary);
+  const upstream = summary ? asRecord2(summary.upstream) : void 0;
+  if (!summary || !upstream || upstream.resource_replaced !== true) return [];
+  const definition = asRecord2(summary.definition);
+  const changed = definition && Array.isArray(definition.changed) ? definition.changed : [];
+  const lines = [
+    input2.completed ? "WARNING: this deploy replaced the existing upstream monitor." : "WARNING: this deploy replaces the existing upstream monitor.",
+    "Existing Customer DB rows are preserved. Provider backfill is not implied."
+  ];
+  for (const raw of changed) {
+    const item = asRecord2(raw);
+    const path = item ? asString(item.path) : void 0;
+    if (!item || !path) continue;
+    lines.push(
+      `  ${path}: ${JSON.stringify(item.before ?? null)} \u2192 ${JSON.stringify(
+        item.after ?? null
+      )}`
+    );
+  }
+  lines.push(
+    input2.monitorKey ? `Use \`deepline monitors update ${input2.monitorKey} <patch>\` for a patch-style change.` : "Use `deepline monitors update <key> <patch>` for a patch-style change."
+  );
+  return lines;
+}
 function renderMonitorDeployCompletion(payload) {
   const monitor = asRecord2(payload.monitor);
   const key = monitor ? asString(monitor.key) : void 0;
@@ -30835,6 +30940,12 @@ function renderMonitorDeployCompletion(payload) {
   if (pricingLine) {
     lines.push("", `Pricing: ${pricingLine}`);
   }
+  const replacementWarning = renderDeployReplacementWarning({
+    payload,
+    completed: true,
+    monitorKey: key
+  });
+  if (replacementWarning.length) lines.push("", ...replacementWarning);
   const guidance = asRecord2(payload.setup_guidance);
   if (guidance) {
     const callbackUrl = asString(guidance.callback_url);
@@ -30886,6 +30997,11 @@ function renderMonitorDeployPlan(payload) {
       if (message) lines.push(`  - ${path ? `${path}: ` : ""}${message}`);
     }
   }
+  const replacementWarning = renderDeployReplacementWarning({
+    payload,
+    completed: false
+  });
+  if (replacementWarning.length) lines.push("", ...replacementWarning);
   const estimate = asRecord2(payload.deploy_cost_estimate);
   const credits = estimate ? asFiniteNumber(estimate.credits) : void 0;
   if (credits !== void 0) {
@@ -31252,10 +31368,17 @@ async function handleMonitorsGet(key, options) {
 }
 async function handleMonitorsTest(key, payload, options) {
   const explicitPayload = parseJsonObjectArg(payload, "<payload>");
-  const result = await new DeeplineClient().monitors.test(key, explicitPayload);
-  const text = `Webhook test for ${key}: ${result.accepted === true ? "accepted" : "rejected"}
-  persisted rows: ${asFiniteNumber(result.persisted_rows) ?? 0}
-  bound Plays dispatched: ${asFiniteNumber(result.dispatched_bound_plays) ?? 0}
+  const result = await new DeeplineClient().monitors.test(
+    key,
+    explicitPayload,
+    {
+      validationOnly: options.dispatch !== true
+    }
+  );
+  const dispatch = options.dispatch === true;
+  const text = `Monitor diagnostic for ${key}: ${result.accepted === true ? "accepted" : "rejected"}
+` + (dispatch ? "  mode: dispatch (writes rows and may dispatch bound Plays)\n" : "  mode: validation_only (no rows written, credits spent, or Plays dispatched)\n") + `${dispatch ? "persisted" : "would persist"} rows: ${asFiniteNumber(result.persisted_rows) ?? 0}
+${dispatch ? "dispatched" : "would dispatch"} bound Plays: ${asFiniteNumber(result.dispatched_bound_plays) ?? 0}
 `;
   printCommandEnvelope(result, { json: options.json, text });
 }
@@ -31467,12 +31590,18 @@ Examples:
   withJsonOption(
     monitors.command("test <key> <payload>").description(
       "Send an explicit payload through a monitor\u2019s webhook ingestion path."
+    ).option(
+      "--dispatch",
+      "Inject the test event through normal ingestion (writes rows and may dispatch bound Plays)"
     ).addHelpText(
       "after",
       `
 Notes:
   <payload> must be an explicit JSON object. The command uses the deployed
-  monitor\u2019s real validation, persistence, and inline Play dispatch path; it does
+  monitor\u2019s real binding and payload validation, but is a side-effect-free
+  diagnostic: it does not persist rows, spend credits, dispatch Plays, or alter
+  monitor state. Pass --dispatch only when you deliberately need the historic
+  full-ingestion test event; it can write rows and trigger bound Plays. It does
   not synthesize a provider event or accept an omitted payload.
 
 Examples:
@@ -31493,7 +31622,9 @@ Notes:
   via --file <path>, or
   from stdin with --file -. Does not deploy or spend credits.
   For Deepline Native Company Radar monitors, check validates persona-filter enums and the
-  job_titles Boolean-expression grammar locally. Inspect the exact schema with
+  job_titles Boolean-expression grammar locally (parentheses are unsupported;
+  NOT > AND > OR).
+  Inspect the exact schema with
   \`deepline monitors available deepline_native.company_radar --json\`.
 
 Examples:
@@ -31517,6 +31648,9 @@ Notes:
   --dry-run validates the definition and shows the plan (deploy cost in Deepline
   credits when the server reports it, plus any existing monitors that may
   already cover this scope) WITHOUT deploying. Exits 0 when valid, 7 when not.
+  Deploy is a full desired definition for its key: omitting a previously stored
+  field removes it and can replace the upstream resource. Use \`monitors update\`
+  for a patch-style change.
 
 Examples:
   deepline monitors deploy '{"key":"job-openings","tool":"deepline_native.company_radar","payload":{"domain":"stripe.com","radar_type":"company_job_openings"}}'