@secondlayer/cli 3.2.1 → 3.3.0

package/dist/cli.js

@@ -13927,7 +13927,7 @@ __export(exports_node_impl, {
   runSetupWizard: () => runSetupWizard,
   restartNode: () => restartNode
 });
-import { confirm as confirm3, input as input2, select as select3 } from "@inquirer/prompts";
+import { confirm as confirm4, input as input2, select as select3 } from "@inquirer/prompts";
 async function runSetupWizard() {
   console.log("");
   console.log(blue("Stacks Node Setup Wizard"));
@@ -13964,13 +13964,13 @@ async function runSetupWizard() {
     ],
     default: "mainnet"
   });
-  const autoStartIndexer = await confirm3({
+  const autoStartIndexer = await confirm4({
     message: "Auto-start indexer when node starts?",
     default: true
   });
   let indexerPort = 3700;
   if (autoStartIndexer) {
-    const customPort = await confirm3({
+    const customPort = await confirm4({
       message: "Use default indexer port (3700)?",
       default: true
     });
@@ -14076,7 +14076,7 @@ async function stopNode(_pathOverride, force, _wait) {
     return;
   }
   if (!force) {
-    const proceed = await confirm3({
+    const proceed = await confirm4({
       message: "Stop the Stacks node?",
       default: false
     });
@@ -14106,7 +14106,7 @@ async function restartNode(pathOverride, force, _wait) {
   const wasRunning = await isNodeRunning();
   if (wasRunning) {
     if (!force) {
-      const proceed = await confirm3({
+      const proceed = await confirm4({
         message: "Restart the Stacks node?",
         default: false
       });
@@ -14555,7 +14555,7 @@ function _supportsColor(haveStream, { streamIsTTY, sniffFlags = true } = {}) {
     if (["GITHUB_ACTIONS", "GITEA_ACTIONS", "CIRCLECI"].some((key) => (key in env))) {
       return 3;
     }
-    if (["TRAVIS", "APPVEYOR", "GITLAB_CI", "BUILDKITE", "DRONE"].some((sign) => (sign in env)) || env.CI_NAME === "codeship") {
+    if (["TRAVIS", "APPVEYOR", "GITLAB_CI", "BUILDKITE", "DRONE"].some((sign2) => (sign2 in env)) || env.CI_NAME === "codeship") {
       return 1;
     }
     return min;
@@ -24264,7 +24264,7 @@ Filtered results for: ${this.inputValue ? this.inputValue : color.gray("Enter so
 }
 function requireConfirm() {
   if (hasRequiredConfirm)
-    return confirm5;
+    return confirm6;
   hasRequiredConfirm = 1;
   const color = requireKleur();
   const Prompt = requirePrompt();
@@ -24337,8 +24337,8 @@ function requireConfirm() {
       this.out.write(erase.line + cursor.to(0) + this.outputText);
     }
   }
-  confirm5 = ConfirmPrompt;
-  return confirm5;
+  confirm6 = ConfirmPrompt;
+  return confirm6;
 }
 function requireElements() {
   if (hasRequiredElements)
@@ -24575,7 +24575,7 @@ function requireSupportsColor() {
       return 1;
     }
     if ("CI" in env2) {
-      if (["TRAVIS", "CIRCLECI", "APPVEYOR", "GITLAB_CI", "GITHUB_ACTIONS", "BUILDKITE"].some((sign) => (sign in env2)) || env2.CI_NAME === "codeship") {
+      if (["TRAVIS", "CIRCLECI", "APPVEYOR", "GITLAB_CI", "GITHUB_ACTIONS", "BUILDKITE"].some((sign2) => (sign2 in env2)) || env2.CI_NAME === "codeship") {
         return 1;
       }
       return min;
@@ -25018,7 +25018,7 @@ async function detect2({ autoInstall, programmatic, cwd } = {}) {
   }
   return agent;
 }
-var ini$1, hasRequiredIni, iniExports, prompts$2, kleur, hasRequiredKleur, action, hasRequiredAction, strip, hasRequiredStrip, src, hasRequiredSrc, clear, hasRequiredClear, figures_1, hasRequiredFigures, style, hasRequiredStyle, lines, hasRequiredLines, wrap, hasRequiredWrap, entriesToDisplay, hasRequiredEntriesToDisplay, util, hasRequiredUtil, prompt, hasRequiredPrompt, text, hasRequiredText, select5, hasRequiredSelect, toggle, hasRequiredToggle, datepart, hasRequiredDatepart, meridiem, hasRequiredMeridiem, day, hasRequiredDay, hours, hasRequiredHours, milliseconds, hasRequiredMilliseconds, minutes, hasRequiredMinutes, month, hasRequiredMonth, seconds, hasRequiredSeconds, year, hasRequiredYear, dateparts, hasRequiredDateparts, date, hasRequiredDate, number, hasRequiredNumber, multiselect, hasRequiredMultiselect, autocomplete, hasRequiredAutocomplete, autocompleteMultiselect, hasRequiredAutocompleteMultiselect, confirm5, hasRequiredConfirm, elements, hasRequiredElements, hasRequiredPrompts$1, lib$1, hasRequiredLib$1, prompts$1, hasRequiredPrompts, promptsExports, prompts, isBrowser, platform, OSC = "\x1B]", BEL = "\x07", SEP = ";", link = (text2, url) => [
+var ini$1, hasRequiredIni, iniExports, prompts$2, kleur, hasRequiredKleur, action, hasRequiredAction, strip, hasRequiredStrip, src, hasRequiredSrc, clear, hasRequiredClear, figures_1, hasRequiredFigures, style, hasRequiredStyle, lines, hasRequiredLines, wrap, hasRequiredWrap, entriesToDisplay, hasRequiredEntriesToDisplay, util, hasRequiredUtil, prompt, hasRequiredPrompt, text, hasRequiredText, select5, hasRequiredSelect, toggle, hasRequiredToggle, datepart, hasRequiredDatepart, meridiem, hasRequiredMeridiem, day, hasRequiredDay, hours, hasRequiredHours, milliseconds, hasRequiredMilliseconds, minutes, hasRequiredMinutes, month, hasRequiredMonth, seconds, hasRequiredSeconds, year, hasRequiredYear, dateparts, hasRequiredDateparts, date, hasRequiredDate, number, hasRequiredNumber, multiselect, hasRequiredMultiselect, autocomplete, hasRequiredAutocomplete, autocompleteMultiselect, hasRequiredAutocompleteMultiselect, confirm6, hasRequiredConfirm, elements, hasRequiredElements, hasRequiredPrompts$1, lib$1, hasRequiredLib$1, prompts$1, hasRequiredPrompts, promptsExports, prompts, isBrowser, platform, OSC = "\x1B]", BEL = "\x07", SEP = ";", link = (text2, url) => [
   OSC,
   "8",
   SEP,
@@ -28352,7 +28352,7 @@ function prettyMilliseconds(milliseconds2, options3) {
     throw new TypeError("Expected a finite number or bigint");
   }
   options3 = { ...options3 };
-  const sign = milliseconds2 < 0 ? "-" : "";
+  const sign2 = milliseconds2 < 0 ? "-" : "";
   milliseconds2 = milliseconds2 < 0 ? -milliseconds2 : milliseconds2;
   if (options3.colonNotation) {
     options3.compact = false;
@@ -28426,13 +28426,13 @@ function prettyMilliseconds(milliseconds2, options3) {
     }
   }
   if (result.length === 0) {
-    return sign + "0" + (options3.verbose ? " milliseconds" : "ms");
+    return sign2 + "0" + (options3.verbose ? " milliseconds" : "ms");
   }
   const separator = options3.colonNotation ? ":" : " ";
   if (typeof options3.unitCount === "number") {
     result = result.slice(0, Math.max(options3.unitCount, 1));
   }
-  return sign + result.join(separator);
+  return sign2 + result.join(separator);
 }
 var isZero = (value) => value === 0 || value === 0n, pluralize = (word, count2) => count2 === 1 || count2 === 1n ? word : `${word}s`, SECOND_ROUNDING_EPSILON = 0.0000001, ONE_DAY_IN_MILLISECONDS;
 var init_pretty_ms = __esm(() => {
@@ -32410,7 +32410,7 @@ var {
 // package.json
 var package_default = {
   name: "@secondlayer/cli",
-  version: "3.2.1",
+  version: "3.3.0",
   description: "CLI for subgraphs and blockchain indexing on Stacks",
   type: "module",
   bin: {
@@ -32453,8 +32453,8 @@ var package_default = {
   dependencies: {
     "@inquirer/prompts": "^8.2.0",
     "@secondlayer/bundler": "^0.3.1",
-    "@secondlayer/sdk": "^3.0.1",
-    "@secondlayer/shared": "^4.0.0",
+    "@secondlayer/sdk": "^3.1.0",
+    "@secondlayer/shared": "^4.1.0",
     "@secondlayer/stacks": "^1.0.1",
     "@secondlayer/subgraphs": "^1.1.0",
     "@biomejs/js-api": "^0.7.0",
@@ -32963,7 +32963,6 @@ async function validateDatabaseConnection(url) {
   }
 }
 // src/commands/create.ts
-init_output();
 import {
   copyFileSync,
   existsSync as existsSync2,
@@ -32977,6 +32976,96 @@ import { dirname as dirname3, join as join5, relative, resolve as resolve2 } fro
 import { fileURLToPath } from "node:url";
 import { input, select as select2 } from "@inquirer/prompts";
 import { SecondLayer as SecondLayer2 } from "@secondlayer/sdk";
+
+// src/lib/filter-params.ts
+var FILTER_OPERATORS = ["eq", "neq", "gt", "gte", "lt", "lte"];
+var QUERY_ONLY_OPERATORS = ["like"];
+var ALL_OPERATORS = new Set([
+  ...FILTER_OPERATORS,
+  ...QUERY_ONLY_OPERATORS
+]);
+var ALL_OPERATOR_LABELS = [...FILTER_OPERATORS, ...QUERY_ONLY_OPERATORS].join(", ");
+function parseFilterArg(input) {
+  const eqIndex = input.indexOf("=");
+  if (eqIndex <= 0) {
+    throw new Error(`Invalid filter format: "${input}". Use key=value.`);
+  }
+  const key = input.slice(0, eqIndex).trim();
+  const value = input.slice(eqIndex + 1);
+  if (!key)
+    throw new Error(`Invalid filter format: "${input}". Use key=value.`);
+  const dotIndex = key.lastIndexOf(".");
+  if (dotIndex > 0) {
+    const field = key.slice(0, dotIndex);
+    const operator = key.slice(dotIndex + 1);
+    if (!field)
+      throw new Error(`Invalid filter field in "${input}".`);
+    if (!ALL_OPERATORS.has(operator)) {
+      throw new Error(`Invalid filter operator ".${operator}" in "${input}". Supported operators: ${ALL_OPERATOR_LABELS}.`);
+    }
+    return {
+      field,
+      operator,
+      value,
+      explicitOperator: true
+    };
+  }
+  return { field: key, operator: "eq", value, explicitOperator: false };
+}
+function parseFilterArgs(args) {
+  return (args ?? []).map(parseFilterArg);
+}
+function parseQueryFilters(args) {
+  const filters = {};
+  for (const filter of parseFilterArgs(args)) {
+    const key = filter.operator === "eq" ? filter.field : `${filter.field}.${filter.operator}`;
+    filters[key] = filter.value;
+  }
+  return Object.keys(filters).length > 0 ? filters : undefined;
+}
+function parseSubscriptionFilter(args) {
+  const filters = {};
+  const seenFields = new Set;
+  for (const filter of parseFilterArgs(args)) {
+    if (filter.operator === "like") {
+      throw new Error(`Subscription filters do not support ".like". Supported operators: ${FILTER_OPERATORS.join(", ")}.`);
+    }
+    if (seenFields.has(filter.field)) {
+      throw new Error(`Subscription filters support one condition per field; got multiple filters for "${filter.field}".`);
+    }
+    seenFields.add(filter.field);
+    if (!filter.explicitOperator || filter.operator === "eq") {
+      filters[filter.field] = filter.value;
+    } else {
+      filters[filter.field] = { [filter.operator]: filter.value };
+    }
+  }
+  return Object.keys(filters).length > 0 ? filters : undefined;
+}
+
+// src/commands/create.ts
+init_output();
+init_resolve_tenant();
+
+// src/lib/subscription-validation.ts
+import {
+  validateSubscriptionFilterForTable
+} from "@secondlayer/shared/schemas/subscriptions";
+async function validateSubscriptionTargetFromApi(client, input) {
+  const subgraph = await client.subgraphs.get(input.subgraphName);
+  const errors = validateSubscriptionFilterForTable({
+    subgraphName: input.subgraphName,
+    tableName: input.tableName,
+    filter: input.filter,
+    tables: subgraph.tables
+  });
+  if (errors.length > 0) {
+    throw new Error(errors.join(`
+`));
+  }
+}
+
+// src/commands/create.ts
 var RUNTIMES = ["inngest", "trigger", "cloudflare", "node"];
 var FORMAT_BY_RUNTIME = {
   inngest: "inngest",
@@ -33031,6 +33120,27 @@ async function promptFor(_name, opts) {
 }
 async function createSubscription(name, opts) {
   const { runtime, subgraph, table, url } = await promptFor(name, opts);
+  let filter;
+  try {
+    filter = parseSubscriptionFilter(opts.filter);
+  } catch (err) {
+    error(err instanceof Error ? err.message : String(err));
+    process.exit(1);
+  }
+  let sl = null;
+  if (!opts.skipApi) {
+    try {
+      sl = await getSubscriptionClient(opts);
+      await validateSubscriptionTargetFromApi(sl, {
+        subgraphName: subgraph,
+        tableName: table,
+        filter
+      });
+    } catch (err) {
+      error(err instanceof Error ? err.message : String(err));
+      process.exit(1);
+    }
+  }
   const eventName = `${subgraph}.${table}.created`;
   const targetDir = resolve2(process.cwd(), name);
   if (existsSync2(targetDir)) {
@@ -33048,27 +33158,19 @@ async function createSubscription(name, opts) {
   let signingSecret = null;
   if (!opts.skipApi) {
     try {
-      const serviceKey = opts.serviceKey ?? process.env.SL_SERVICE_KEY;
-      const baseUrl = opts.baseUrl ?? process.env.SL_API_URL;
-      if (!serviceKey) {
-        warn("SL_SERVICE_KEY not set — template copied but subscription not provisioned.");
-        info("Provision it from the dashboard or re-run with SL_SERVICE_KEY set.");
-      } else {
-        const sl = new SecondLayer2({
-          apiKey: serviceKey,
-          ...baseUrl ? { baseUrl } : {}
-        });
-        const res = await sl.subscriptions.create({
-          name,
-          subgraphName: subgraph,
-          tableName: table,
-          url,
-          format: FORMAT_BY_RUNTIME[runtime],
-          runtime
-        });
-        signingSecret = res.signingSecret;
-        success(`Subscription provisioned: ${blue(res.subscription.id)}`);
-      }
+      if (!sl)
+        sl = await getSubscriptionClient(opts);
+      const res = await sl.subscriptions.create({
+        name,
+        subgraphName: subgraph,
+        tableName: table,
+        url,
+        format: FORMAT_BY_RUNTIME[runtime],
+        runtime,
+        ...filter ? { filter } : {}
+      });
+      signingSecret = res.signingSecret;
+      success(`Subscription provisioned: ${blue(res.subscription.id)}`);
     } catch (err) {
       warn(`Subscription provisioning failed: ${err instanceof Error ? err.message : String(err)}`);
       info("Template copied — fix auth + run again, or provision via dashboard.");
@@ -33098,9 +33200,40 @@ ${dim("  ")}${signingSecret}`);
   bun install
   bun run dev`);
 }
+function resolveSubscriptionClientConfig(opts, env = process.env, resolved) {
+  const needsResolvedKey = !opts.serviceKey && !env.SL_SERVICE_KEY;
+  const needsResolvedUrl = !opts.baseUrl && !env.SL_API_URL;
+  if ((needsResolvedKey || needsResolvedUrl) && !resolved) {
+    return { needsTenantResolution: true };
+  }
+  const apiKey = opts.serviceKey ?? env.SL_SERVICE_KEY ?? resolved?.ephemeralKey;
+  const baseUrl = opts.baseUrl ?? env.SL_API_URL ?? resolved?.apiUrl;
+  if (!apiKey) {
+    throw new Error("No service key available. Run `sl login` from an active project or pass --service-key.");
+  }
+  if (!baseUrl) {
+    throw new Error("No tenant API URL available. Run `sl project use <slug>` or pass --base-url.");
+  }
+  return { needsTenantResolution: false, baseUrl, apiKey };
+}
+async function getSubscriptionClient(opts) {
+  const config = resolveSubscriptionClientConfig(opts);
+  if (!config.needsTenantResolution) {
+    return new SecondLayer2({ baseUrl: config.baseUrl, apiKey: config.apiKey });
+  }
+  const resolved = await resolveActiveTenant();
+  const resolvedConfig = resolveSubscriptionClientConfig(opts, process.env, resolved);
+  if (resolvedConfig.needsTenantResolution) {
+    throw new Error("Could not resolve active tenant credentials.");
+  }
+  return new SecondLayer2({
+    baseUrl: resolvedConfig.baseUrl,
+    apiKey: resolvedConfig.apiKey
+  });
+}
 function registerCreateCommand(program2) {
   const create = program2.command("create").description("Scaffold new resources (subscription receivers, etc.)");
-  create.command("subscription <name>").description("Scaffold a subscription receiver for a runtime").option("-r, --runtime <runtime>", "inngest | trigger | cloudflare | node").option("-s, --subgraph <name>", "Subgraph to subscribe to").option("-t, --table <name>", "Table to subscribe to").option("-u, --url <url>", "Webhook URL").option("--service-key <key>", "SL_SERVICE_KEY override").option("--base-url <url>", "SL_API_URL override").option("--skip-api", "Copy template only, don't call the API").action(async (name, options) => {
+  create.command("subscription <name>").description("Scaffold a subscription receiver for a runtime").option("-r, --runtime <runtime>", "inngest | trigger | cloudflare | node").option("-s, --subgraph <name>", "Subgraph to subscribe to").option("-t, --table <name>", "Table to subscribe to").option("-u, --url <url>", "Webhook URL").option("--filter <kv...>", "Filter as key=value (supports .eq/.neq/.gt/.gte/.lt/.lte suffixes)").option("--service-key <key>", "SL_SERVICE_KEY override").option("--base-url <url>", "SL_API_URL override").option("--skip-api", "Copy template only, don't call the API").action(async (name, options) => {
     await createSubscription(name, options);
   });
 }
@@ -33193,11 +33326,596 @@ function printStatus(status) {
   }
   console.log(dim(`Last updated: ${status.timestamp}`));
 }
+// src/commands/subscriptions.ts
+import { confirm } from "@inquirer/prompts";
+import { sign } from "@secondlayer/shared/crypto/standard-webhooks";
+init_output();
+function commonOptions(cmd) {
+  return cmd.option("--service-key <key>", "SL_SERVICE_KEY override").option("--base-url <url>", "SL_API_URL override");
+}
+function parseIntegerOption(value, name, min) {
+  if (value === undefined)
+    return;
+  const parsed = Number.parseInt(value, 10);
+  if (!Number.isFinite(parsed) || String(parsed) !== value.trim()) {
+    throw new Error(`${name} must be an integer`);
+  }
+  if (parsed < min)
+    throw new Error(`${name} must be >= ${min}`);
+  return parsed;
+}
+function requireIntegerOption(value, name) {
+  const parsed = parseIntegerOption(value, name, 0);
+  if (parsed === undefined)
+    throw new Error(`${name} is required`);
+  return parsed;
+}
+function truncate(value, max = 48) {
+  return value.length <= max ? value : `${value.slice(0, max - 3)}...`;
+}
+function formatMaybeDate(value) {
+  return value ? value.replace("T", " ").slice(0, 19) : dim("-");
+}
+function isSuccessDelivery(row) {
+  return row.statusCode !== null && row.statusCode >= 200 && row.statusCode < 300;
+}
+function printJson(value) {
+  console.log(JSON.stringify(value, null, 2));
+}
+async function resolveSubscriptionRef(client, ref) {
+  const { data } = await client.subscriptions.list();
+  const idMatch = data.find((sub) => sub.id === ref);
+  if (idMatch) {
+    return {
+      id: idMatch.id,
+      detail: await client.subscriptions.get(idMatch.id)
+    };
+  }
+  const nameMatches = data.filter((sub) => sub.name === ref);
+  if (nameMatches.length > 1) {
+    throw new Error(`Subscription name "${ref}" is ambiguous; use the subscription id.`);
+  }
+  if (nameMatches[0]) {
+    return {
+      id: nameMatches[0].id,
+      detail: await client.subscriptions.get(nameMatches[0].id)
+    };
+  }
+  return {
+    id: ref,
+    detail: await client.subscriptions.get(ref)
+  };
+}
+function buildUpdatePatch(options) {
+  const patch = {};
+  if (options.name)
+    patch.name = options.name;
+  if (options.url)
+    patch.url = options.url;
+  if (options.format) {
+    patch.format = options.format;
+  }
+  if (options.runtime !== undefined) {
+    patch.runtime = options.runtime === "none" || options.runtime === "null" ? null : options.runtime;
+  }
+  if (options.clearFilter)
+    patch.filter = {};
+  if (options.filter) {
+    if (options.clearFilter) {
+      throw new Error("Use either --filter or --clear-filter, not both");
+    }
+    patch.filter = parseSubscriptionFilter(options.filter) ?? {};
+  }
+  const maxRetries = parseIntegerOption(options.maxRetries, "--max-retries", 0);
+  if (maxRetries !== undefined)
+    patch.maxRetries = maxRetries;
+  const timeoutMs = parseIntegerOption(options.timeoutMs, "--timeout-ms", 100);
+  if (timeoutMs !== undefined)
+    patch.timeoutMs = timeoutMs;
+  const concurrency = parseIntegerOption(options.concurrency, "--concurrency", 1);
+  if (concurrency !== undefined)
+    patch.concurrency = concurrency;
+  if (Object.keys(patch).length === 0) {
+    throw new Error("No update fields provided");
+  }
+  return patch;
+}
+function printSubscriptionDetail(sub) {
+  console.log(formatKeyValue([
+    ["ID", sub.id],
+    ["Name", sub.name],
+    ["Status", sub.status],
+    ["Target", `${sub.subgraphName}.${sub.tableName}`],
+    ["Format", sub.format],
+    ["Runtime", sub.runtime ?? "none"],
+    ["URL", sub.url],
+    ["Last Delivery", sub.lastDeliveryAt ?? "none"],
+    ["Last Success", sub.lastSuccessAt ?? "none"],
+    ["Circuit Failures", String(sub.circuitFailures)],
+    ["Circuit Opened", sub.circuitOpenedAt ?? "none"],
+    ["Last Error", sub.lastError ?? "none"],
+    ["Max Retries", String(sub.maxRetries)],
+    ["Timeout", `${sub.timeoutMs}ms`],
+    ["Concurrency", String(sub.concurrency)],
+    ["Created", sub.createdAt],
+    ["Updated", sub.updatedAt]
+  ]));
+  console.log(dim(`
+Filter:`));
+  console.log(JSON.stringify(sub.filter, null, 2));
+  if (Object.keys(sub.authConfig).length > 0) {
+    console.log(dim(`
+Auth config:`));
+    console.log(JSON.stringify(sub.authConfig, null, 2));
+  }
+}
+function buildDoctorReport(input2) {
+  const successful = input2.deliveries.filter(isSuccessDelivery).length;
+  const failed = input2.deliveries.length - successful;
+  const subgraph = input2.subgraph ? {
+    name: input2.subgraph.name,
+    status: input2.subgraph.status,
+    syncStatus: input2.subgraph.sync.status,
+    lastProcessedBlock: input2.subgraph.sync.lastProcessedBlock,
+    chainTip: input2.subgraph.sync.chainTip,
+    gapCount: input2.subgraph.sync.gaps.count,
+    integrity: input2.subgraph.sync.integrity
+  } : null;
+  const hints = [];
+  if (input2.subscription.status === "paused") {
+    hints.push(`Resume when the receiver is healthy: sl subscriptions resume ${input2.subscription.id}`);
+  }
+  if (input2.subscription.lastError) {
+    hints.push("Run sl subscriptions test to reproduce the receiver request.");
+  }
+  if (input2.subscription.circuitOpenedAt || input2.subscription.circuitFailures > 0) {
+    hints.push("Circuit breaker has failures; inspect receiver logs and delivery status codes.");
+  }
+  if (input2.dead.length > 0) {
+    hints.push(`Dead-letter rows exist; inspect with sl subscriptions dead ${input2.subscription.id} and requeue selected rows.`);
+  }
+  if (subgraph?.gapCount && subgraph.gapCount > 0) {
+    hints.push(`Linked subgraph has gaps; run sl subgraphs gaps ${input2.subscription.subgraphName}.`);
+  }
+  if (subgraph?.syncStatus === "catching_up") {
+    hints.push("Linked subgraph is still catching up; new matching rows may arrive later.");
+  }
+  if (input2.deliveries.length === 0) {
+    hints.push("No deliveries yet; confirm the table is receiving inserted rows that match the filter.");
+  }
+  if (hints.length === 0) {
+    hints.push("No immediate action needed.");
+  }
+  return {
+    subscription: input2.subscription,
+    deliverySummary: {
+      total: input2.deliveries.length,
+      successful,
+      failed,
+      last: input2.deliveries[0] ?? null
+    },
+    deadCount: input2.dead.length,
+    subgraph,
+    hints
+  };
+}
+function printDoctorReport(report) {
+  const sub = report.subscription;
+  console.log(formatKeyValue([
+    ["Subscription", `${sub.name} (${sub.id})`],
+    ["Status", sub.status],
+    ["Target", `${sub.subgraphName}.${sub.tableName}`],
+    ["Format", sub.format],
+    ["Runtime", sub.runtime ?? "none"],
+    ["URL", sub.url],
+    [
+      "Circuit",
+      sub.circuitOpenedAt ? `open at ${sub.circuitOpenedAt}` : `${sub.circuitFailures} failures`
+    ],
+    ["Last Error", sub.lastError ?? "none"],
+    ["Last Delivery", sub.lastDeliveryAt ?? "none"],
+    ["Last Success", sub.lastSuccessAt ?? "none"]
+  ]));
+  console.log(dim(`
+Delivery summary:`));
+  console.log(formatKeyValue([
+    ["Recent Attempts", String(report.deliverySummary.total)],
+    ["Successful", String(report.deliverySummary.successful)],
+    ["Failed", String(report.deliverySummary.failed)],
+    [
+      "Last Attempt",
+      report.deliverySummary.last ? `${report.deliverySummary.last.statusCode ?? "error"} at ${report.deliverySummary.last.dispatchedAt}` : "none"
+    ],
+    ["Dead Letter Rows", String(report.deadCount)]
+  ]));
+  if (report.subgraph) {
+    console.log(dim(`
+Linked subgraph:`));
+    console.log(formatKeyValue([
+      ["Name", report.subgraph.name],
+      ["Status", report.subgraph.status],
+      ["Sync", report.subgraph.syncStatus],
+      [
+        "Blocks",
+        `${report.subgraph.lastProcessedBlock} / ${report.subgraph.chainTip}`
+      ],
+      ["Integrity", report.subgraph.integrity],
+      ["Gaps", String(report.subgraph.gapCount)]
+    ]));
+  }
+  console.log(dim(`
+Next steps:`));
+  for (const hint of report.hints)
+    console.log(`  - ${hint}`);
+}
+function syntheticValue(type) {
+  switch (type) {
+    case "uint":
+    case "int":
+      return "1000";
+    case "boolean":
+      return true;
+    case "timestamp":
+      return new Date(0).toISOString();
+    case "jsonb":
+      return {};
+    case "principal":
+      return "SP000000000000000000002Q6VF78";
+    default:
+      return "example";
+  }
+}
+function buildSyntheticRow(subgraph, tableName) {
+  const table = subgraph?.tables[tableName];
+  if (!table)
+    return { id: "example", value: "example" };
+  const row = {};
+  for (const [column, def] of Object.entries(table.columns)) {
+    if (column.startsWith("_"))
+      continue;
+    row[column] = syntheticValue(def.type);
+  }
+  return Object.keys(row).length > 0 ? row : { id: "example", value: "example" };
+}
+function resolveSigningSecret(options, env = process.env) {
+  const secret = options.signingSecret ?? env.SIGNING_SECRET;
+  if (!secret) {
+    throw new Error("Provide --signing-secret or set SIGNING_SECRET.");
+  }
+  return secret;
+}
+function shellQuote(value) {
+  return `'${value.replace(/'/g, "'\\''")}'`;
+}
+function buildSubscriptionTestFixture(input2) {
+  const nowSeconds = input2.nowSeconds ?? Math.floor(Date.now() / 1000);
+  const body = JSON.stringify({
+    type: `${input2.subscription.subgraphName}.${input2.subscription.tableName}.created`,
+    timestamp: new Date(nowSeconds * 1000).toISOString(),
+    data: input2.row
+  });
+  const headers = {
+    "content-type": "application/json",
+    ...sign(body, input2.signingSecret, {
+      id: input2.id ?? `test-${input2.subscription.id}`,
+      timestampSeconds: nowSeconds
+    })
+  };
+  const headerArgs = Object.entries(headers).map(([key, value]) => `  -H ${shellQuote(`${key}: ${value}`)} \\`).join(`
+`);
+  const curl = [
+    `curl -X POST ${shellQuote(input2.subscription.url)} \\`,
+    headerArgs,
+    `  --data ${shellQuote(body)}`
+  ].join(`
+`);
+  return { body, headers, curl };
+}
+async function representativeRow(client, sub, subgraph) {
+  try {
+    const rows = await client.subgraphs.queryTable(sub.subgraphName, sub.tableName, {
+      sort: "_block_height",
+      order: "desc",
+      limit: 1
+    });
+    if (rows[0] && typeof rows[0] === "object")
+      return rows[0];
+  } catch {}
+  return buildSyntheticRow(subgraph, sub.tableName);
+}
+function printDeliveries(rows) {
+  if (rows.length === 0) {
+    console.log(dim("No delivery attempts"));
+    return;
+  }
+  console.log(formatTable(["Dispatched", "Attempt", "Status", "Duration", "Error"], rows.map((row) => [
+    formatMaybeDate(row.dispatchedAt),
+    String(row.attempt),
+    row.statusCode === null ? redStatus("error") : isSuccessDelivery(row) ? green(String(row.statusCode)) : yellow(String(row.statusCode)),
+    row.durationMs === null ? dim("-") : `${row.durationMs}ms`,
+    row.errorMessage ? truncate(row.errorMessage, 64) : dim("-")
+  ])));
+}
+function redStatus(text) {
+  return `\x1B[31m${text}\x1B[0m`;
+}
+function printDead(rows) {
+  if (rows.length === 0) {
+    console.log(dim("No dead-letter rows"));
+    return;
+  }
+  console.log(formatTable(["ID", "Event", "Block", "Attempt", "Failed"], rows.map((row) => [
+    row.id,
+    row.eventType,
+    String(row.blockHeight),
+    String(row.attempt),
+    formatMaybeDate(row.failedAt)
+  ])));
+}
+async function confirmOrExit(message, yes) {
+  if (yes)
+    return true;
+  const ok = await confirm({ message });
+  if (!ok) {
+    info("Cancelled");
+    return false;
+  }
+  return true;
+}
+function registerSubscriptionsCommand(program2) {
+  const subscriptions = commonOptions(program2.command("subscriptions").alias("subs").description("Manage subgraph table subscriptions"));
+  commonOptions(subscriptions.command("list").alias("ls").description("List subscriptions").option("--json", "Output as JSON")).action(async (options) => {
+    try {
+      const client = await getSubscriptionClient(options);
+      const { data } = await client.subscriptions.list();
+      if (options.json) {
+        printJson(data);
+        return;
+      }
+      if (data.length === 0) {
+        console.log(dim("No subscriptions"));
+        return;
+      }
+      console.log(formatTable(["Name", "ID", "Status", "Target", "Format", "Last Success"], data.map((sub) => [
+        sub.name,
+        sub.id,
+        sub.status === "active" ? green(sub.status) : sub.status === "paused" ? yellow(sub.status) : redStatus(sub.status),
+        `${sub.subgraphName}.${sub.tableName}`,
+        sub.format,
+        formatMaybeDate(sub.lastSuccessAt)
+      ])));
+      console.log(dim(`
+${data.length} subscription(s) total`));
+    } catch (err) {
+      handleApiError(err, "list subscriptions");
+    }
+  });
+  commonOptions(subscriptions.command("get <idOrName>").description("Show subscription details").option("--json", "Output as JSON")).action(async (idOrName, options) => {
+    try {
+      const client = await getSubscriptionClient(options);
+      const { detail } = await resolveSubscriptionRef(client, idOrName);
+      if (options.json)
+        printJson(detail);
+      else
+        printSubscriptionDetail(detail);
+    } catch (err) {
+      handleApiError(err, "get subscription");
+    }
+  });
+  commonOptions(subscriptions.command("update <idOrName>").description("Update subscription config").option("--name <name>", "Rename subscription").option("--url <url>", "Webhook URL").option("--format <format>", "standard-webhooks | inngest | trigger | cloudflare | cloudevents | raw").option("--runtime <runtime>", "inngest | trigger | cloudflare | node | none").option("--filter <kv...>", "Filter as key=value (supports .eq/.neq/.gt/.gte/.lt/.lte suffixes)").option("--clear-filter", "Replace filter with {}").option("--max-retries <n>", "Maximum delivery retries").option("--timeout-ms <n>", "Delivery timeout in milliseconds").option("--concurrency <n>", "Per-subscription delivery concurrency").option("--json", "Output as JSON")).action(async (idOrName, options) => {
+    try {
+      const client = await getSubscriptionClient(options);
+      const patch = buildUpdatePatch(options);
+      const { id, detail } = await resolveSubscriptionRef(client, idOrName);
+      if (patch.filter !== undefined) {
+        await validateSubscriptionTargetFromApi(client, {
+          subgraphName: detail.subgraphName,
+          tableName: detail.tableName,
+          filter: patch.filter
+        });
+      }
+      const updated = await client.subscriptions.update(id, patch);
+      if (options.json)
+        printJson(updated);
+      else
+        success(`Updated subscription ${blue(updated.name)}`);
+    } catch (err) {
+      handleApiError(err, "update subscription");
+    }
+  });
+  for (const action of ["pause", "resume"]) {
+    commonOptions(subscriptions.command(`${action} <idOrName>`).description(`${action === "pause" ? "Pause" : "Resume"} a subscription`).option("--json", "Output as JSON")).action(async (idOrName, options) => {
+      try {
+        const client = await getSubscriptionClient(options);
+        const { id } = await resolveSubscriptionRef(client, idOrName);
+        const updated = await client.subscriptions[action](id);
+        if (options.json)
+          printJson(updated);
+        else
+          success(`${action === "pause" ? "Paused" : "Resumed"} ${blue(updated.name)}`);
+      } catch (err) {
+        handleApiError(err, `${action} subscription`);
+      }
+    });
+  }
+  commonOptions(subscriptions.command("delete <idOrName>").description("Delete a subscription").option("-y, --yes", "Skip confirmation").option("--json", "Output as JSON")).action(async (idOrName, options) => {
+    try {
+      const client = await getSubscriptionClient(options);
+      const { id, detail } = await resolveSubscriptionRef(client, idOrName);
+      const ok = await confirmOrExit(`Delete subscription "${detail.name}"? Pending outbox rows will be removed.`, options.yes);
+      if (!ok)
+        return;
+      const res = await client.subscriptions.delete(id);
+      if (options.json)
+        printJson(res);
+      else
+        success(`Deleted subscription ${blue(detail.name)}`);
+    } catch (err) {
+      handleApiError(err, "delete subscription");
+    }
+  });
+  commonOptions(subscriptions.command("rotate-secret <idOrName>").description("Rotate the signing secret").option("-y, --yes", "Skip confirmation").option("--json", "Output as JSON")).action(async (idOrName, options) => {
+    try {
+      const client = await getSubscriptionClient(options);
+      const { id, detail } = await resolveSubscriptionRef(client, idOrName);
+      const ok = await confirmOrExit(`Rotate signing secret for "${detail.name}"? Existing receivers using the old secret will fail verification.`, options.yes);
+      if (!ok)
+        return;
+      const res = await client.subscriptions.rotateSecret(id);
+      if (options.json)
+        printJson(res);
+      else {
+        success(`Rotated signing secret for ${blue(res.subscription.name)}`);
+        console.log(res.signingSecret);
+      }
+    } catch (err) {
+      handleApiError(err, "rotate subscription secret");
+    }
+  });
+  commonOptions(subscriptions.command("deliveries <idOrName>").description("Show recent delivery attempts").option("--json", "Output as JSON")).action(async (idOrName, options) => {
+    try {
+      const client = await getSubscriptionClient(options);
+      const { id } = await resolveSubscriptionRef(client, idOrName);
+      const { data } = await client.subscriptions.recentDeliveries(id);
+      if (options.json)
+        printJson(data);
+      else
+        printDeliveries(data);
+    } catch (err) {
+      handleApiError(err, "list subscription deliveries");
+    }
+  });
+  commonOptions(subscriptions.command("dead <idOrName>").description("Show dead-letter outbox rows").option("--json", "Output as JSON")).action(async (idOrName, options) => {
+    try {
+      const client = await getSubscriptionClient(options);
+      const { id } = await resolveSubscriptionRef(client, idOrName);
+      const { data } = await client.subscriptions.dead(id);
+      if (options.json)
+        printJson(data);
+      else
+        printDead(data);
+    } catch (err) {
+      handleApiError(err, "list dead-letter rows");
+    }
+  });
+  commonOptions(subscriptions.command("requeue <idOrName> <outboxId>").description("Requeue one dead-letter row").option("-y, --yes", "Skip confirmation").option("--json", "Output as JSON")).action(async (idOrName, outboxId, options) => {
+    try {
+      const client = await getSubscriptionClient(options);
+      const { id, detail } = await resolveSubscriptionRef(client, idOrName);
+      const ok = await confirmOrExit(`Requeue ${outboxId} for "${detail.name}"?`, options.yes);
+      if (!ok)
+        return;
+      const res = await client.subscriptions.requeueDead(id, outboxId);
+      if (options.json)
+        printJson(res);
+      else
+        success(`Requeued ${blue(outboxId)}`);
+    } catch (err) {
+      handleApiError(err, "requeue dead-letter row");
+    }
+  });
+  commonOptions(subscriptions.command("replay <idOrName>").description("Replay a block range").requiredOption("--from-block <n>", "Start block height").requiredOption("--to-block <n>", "End block height").option("-y, --yes", "Skip confirmation").option("--json", "Output as JSON")).action(async (idOrName, options) => {
+    try {
+      const fromBlock = requireIntegerOption(options.fromBlock, "--from-block");
+      const toBlock = requireIntegerOption(options.toBlock, "--to-block");
+      if (fromBlock > toBlock) {
+        throw new Error("--from-block must be <= --to-block");
+      }
+      const client = await getSubscriptionClient(options);
+      const { id, detail } = await resolveSubscriptionRef(client, idOrName);
+      const ok = await confirmOrExit(`Replay ${detail.name} from block ${fromBlock} to ${toBlock}?`, options.yes);
+      if (!ok)
+        return;
+      const res = await client.subscriptions.replay(id, {
+        fromBlock,
+        toBlock
+      });
+      if (options.json)
+        printJson(res);
+      else {
+        success(`Replay enqueued: ${blue(res.replayId)}`);
+        info(`${res.enqueuedCount} row(s) enqueued from ${res.scannedCount} scanned`);
+      }
+    } catch (err) {
+      handleApiError(err, "replay subscription");
+    }
+  });
+  commonOptions(subscriptions.command("doctor <idOrName>").description("Diagnose subscription health and next steps").option("--json", "Output as JSON")).action(async (idOrName, options) => {
+    try {
+      const client = await getSubscriptionClient(options);
+      const { id, detail } = await resolveSubscriptionRef(client, idOrName);
+      const [deliveries, dead, subgraph] = await Promise.allSettled([
+        client.subscriptions.recentDeliveries(id),
+        client.subscriptions.dead(id),
+        client.subgraphs.get(detail.subgraphName)
+      ]);
+      const report = buildDoctorReport({
+        subscription: detail,
+        deliveries: deliveries.status === "fulfilled" ? deliveries.value.data : [],
+        dead: dead.status === "fulfilled" ? dead.value.data : [],
+        subgraph: subgraph.status === "fulfilled" ? subgraph.value : null
+      });
+      if (options.json)
+        printJson(report);
+      else
+        printDoctorReport(report);
+    } catch (err) {
+      handleApiError(err, "diagnose subscription");
+    }
+  });
+  commonOptions(subscriptions.command("test <idOrName>").description("Build and optionally POST a signed Standard Webhooks fixture").option("--signing-secret <secret>", "Signing secret override").option("--post", "POST the fixture to the subscription URL").option("--json", "Output as JSON")).action(async (idOrName, options) => {
+    try {
+      const signingSecret = resolveSigningSecret(options);
+      const client = await getSubscriptionClient(options);
+      const { detail } = await resolveSubscriptionRef(client, idOrName);
+      const subgraph = await client.subgraphs.get(detail.subgraphName).catch(() => null);
+      const row = await representativeRow(client, detail, subgraph);
+      const fixture = buildSubscriptionTestFixture({
+        subscription: detail,
+        row,
+        signingSecret
+      });
+      let postResult = null;
+      if (options.post) {
+        const res = await fetch(detail.url, {
+          method: "POST",
+          headers: fixture.headers,
+          body: fixture.body
+        });
+        postResult = {
+          status: res.status,
+          body: (await res.text()).slice(0, 2000)
+        };
+      }
+      if (options.json) {
+        printJson({ ...fixture, postResult });
+        return;
+      }
+      console.log(dim("Body:"));
+      console.log(fixture.body);
+      console.log(dim(`
+Headers:`));
+      console.log(JSON.stringify(fixture.headers, null, 2));
+      console.log(dim(`
+Curl:`));
+      console.log(fixture.curl);
+      if (postResult) {
+        console.log(dim(`
+POST result:`));
+        console.log(`Status: ${postResult.status}`);
+        if (postResult.body)
+          console.log(postResult.body);
+      }
+    } catch (err) {
+      handleApiError(err, "test subscription");
+    }
+  });
+}
 // src/commands/db.ts
 init_config();
 init_dev_state();
 init_output();
-import { confirm } from "@inquirer/prompts";
+import { confirm as confirm2 } from "@inquirer/prompts";
 import { getDb, sql } from "@secondlayer/shared/db";
 import {
   countMissingBlocks,
@@ -33408,7 +34126,7 @@ async function resetDatabase(skipConfirm) {
     console.log(dim("Note: Subgraph configurations will be preserved."));
     console.log("");
     if (!skipConfirm) {
-      const confirmed = await confirm({
+      const confirmed = await confirm2({
         message: "Are you sure you want to reset the database?",
         default: false
       });
@@ -33445,7 +34163,7 @@ async function resyncDatabase(skipConfirm, backfill) {
     console.log(dim("Note: Subgraph configurations will be preserved."));
     console.log("");
     if (!skipConfirm) {
-      const confirmed = await confirm({
+      const confirmed = await confirm2({
         message: "Are you sure you want to resync?",
         default: false
       });
@@ -33549,7 +34267,7 @@ async function resyncDatabase(skipConfirm, backfill) {
 // src/commands/subgraphs.ts
 import { existsSync as existsSync3, mkdirSync as mkdirSync2, watch } from "node:fs";
 import { resolve as resolve3 } from "node:path";
-import { confirm as confirm2 } from "@inquirer/prompts";
+import { confirm as confirm3 } from "@inquirer/prompts";
 
 // src/generators/subgraph-scaffold.ts
 init_format();
@@ -33930,7 +34648,7 @@ Stopped watching.`);
               info(`  + columns: ${t}.${cols.join(", ")}`);
             }
           }
-          const confirmed = options2.force || await confirm2({
+          const confirmed = options2.force || await confirm3({
             message: "⚠  This will drop all data and reindex from scratch. Continue?"
           });
           if (!confirmed) {
@@ -34113,16 +34831,12 @@ ${result.meta.total} gap(s), ${result.meta.totalMissingBlocks} total missing blo
   });
   subgraphs.command("query <name> <table>").description("Query a subgraph table").option("--sort <column>", "Sort by column").option("--order <dir>", "Sort direction (asc|desc)", "asc").option("--limit <n>", "Max rows to return", "20").option("--offset <n>", "Skip first N rows").option("--fields <cols>", "Comma-separated columns to include").option("--filter <kv...>", "Filter as key=value (supports .gte/.lte/.gt/.lt/.neq suffixes)").option("--count", "Return row count only").option("--json", "Output as JSON").action(async (name, table, options2) => {
     try {
-      const filters = {};
-      if (options2.filter) {
-        for (const kv of options2.filter) {
-          const eqIndex = kv.indexOf("=");
-          if (eqIndex === -1) {
-            error(`Invalid filter format: "${kv}". Use key=value.`);
-            process.exit(1);
-          }
-          filters[kv.slice(0, eqIndex)] = kv.slice(eqIndex + 1);
-        }
+      let filters;
+      try {
+        filters = parseQueryFilters(options2.filter);
+      } catch (err) {
+        error(err instanceof Error ? err.message : String(err));
+        process.exit(1);
       }
       const params = {
         sort: options2.sort,
@@ -34130,7 +34844,7 @@ ${result.meta.total} gap(s), ${result.meta.totalMissingBlocks} total missing blo
         limit: Number.parseInt(options2.limit, 10),
         offset: options2.offset ? Number.parseInt(options2.offset, 10) : undefined,
         fields: options2.fields,
-        filters: Object.keys(filters).length > 0 ? filters : undefined
+        filters
       };
       if (options2.count) {
         const result = await querySubgraphTableCount(name, table, params);
@@ -34172,8 +34886,8 @@ ${rows.length} row(s)`));
   subgraphs.command("delete <name>").description("Delete a subgraph and its data").option("-y, --yes", "Skip confirmation").action(async (name, options2) => {
     try {
       if (!options2.yes) {
-        const { confirm: confirm3 } = await import("@inquirer/prompts");
-        const ok = await confirm3({
+        const { confirm: confirm4 } = await import("@inquirer/prompts");
+        const ok = await confirm4({
           message: `Delete subgraph "${name}" and all its data? This cannot be undone.`
         });
         if (!ok) {
@@ -35167,7 +35881,7 @@ init_http();
 init_output();
 init_project_file();
 init_resolve_tenant();
-import { confirm as confirm4, input as input4, select as select4 } from "@inquirer/prompts";
+import { confirm as confirm5, input as input4, select as select4 } from "@inquirer/prompts";
 function registerInstanceCommand(program2) {
   const instance = program2.command("instance").description("Manage your dedicated Secondlayer instance");
   instance.command("create").description("Provision a new dedicated instance for the active project").option("--plan <plan>", "Plan: hobby (free) | launch | grow | scale", "hobby").action(async (opts) => {
@@ -35218,7 +35932,7 @@ function registerInstanceCommand(program2) {
       target = answer;
     }
     if (!opts.yes) {
-      const ok = await confirm4({
+      const ok = await confirm5({
         message: `Resize to ${target}? ~30s downtime while containers recreate. Data preserved.`,
         default: false
       });
@@ -35367,7 +36081,7 @@ function registerInstanceCommand(program2) {
   db.command("revoke-key").description("Revoke bastion access for this instance").option("-y, --yes", "Skip confirmation").action(async (opts) => {
     guardOssMode();
     if (!opts.yes) {
-      const ok = await confirm4({
+      const ok = await confirm5({
         message: "Revoke bastion access for this instance?",
         default: false
       });
@@ -35570,6 +36284,7 @@ registerProjectCommand(program);
 registerInstanceCommand(program);
 registerSubgraphsCommand(program);
 registerCreateCommand(program);
+registerSubscriptionsCommand(program);
 registerStatusCommand(program);
 registerStackCommand(program);
 registerDbCommand(program);
@@ -35579,5 +36294,5 @@ registerLocalCommand(program);
 registerAccountCommand(program);
 program.parse();
 
-//# debugId=C959E54B7099E8D964756E2164756E21
+//# debugId=CDED029144E4004564756E2164756E21
 //# sourceMappingURL=cli.js.map