@feastalytics/cli 0.1.1 → 0.1.3

package/dist/cli.js

@@ -3221,8 +3221,8 @@ var require_utils = __commonJS({
       }
       return ind;
     }
-    function removeDotSegments(path2) {
-      let input = path2;
+    function removeDotSegments(path3) {
+      let input = path3;
       const output = [];
       let nextSlash = -1;
       let len = 0;
@@ -3474,8 +3474,8 @@ var require_schemes = __commonJS({
         wsComponent.secure = void 0;
       }
       if (wsComponent.resourceName) {
-        const [path2, query] = wsComponent.resourceName.split("?");
-        wsComponent.path = path2 && path2 !== "/" ? path2 : void 0;
+        const [path3, query] = wsComponent.resourceName.split("?");
+        wsComponent.path = path3 && path3 !== "/" ? path3 : void 0;
         wsComponent.query = query;
         wsComponent.resourceName = void 0;
       }
@@ -6597,6 +6597,9 @@ function getCredentialsPath() {
   return CREDENTIALS_PATH;
 }
 
+// src/http.ts
+import { createRequire } from "module";
+
 // node_modules/@trpc/server/dist/observable-ade1bad8.mjs
 function identity(x) {
   return x;
@@ -6833,22 +6836,22 @@ var TRPC_ERROR_CODES_BY_NUMBER = invert(TRPC_ERROR_CODES_BY_KEY);
 var TRPC_ERROR_CODES_BY_NUMBER2 = invert(TRPC_ERROR_CODES_BY_KEY);
 var noop = () => {
 };
-function createInnerProxy(callback, path2) {
+function createInnerProxy(callback, path3) {
   const proxy = new Proxy(noop, {
     get(_obj, key) {
       if (typeof key !== "string" || key === "then") {
         return void 0;
       }
       return createInnerProxy(callback, [
-        ...path2,
+        ...path3,
         key
       ]);
     },
     apply(_1, _2, args) {
-      const isApply = path2[path2.length - 1] === "apply";
+      const isApply = path3[path3.length - 1] === "apply";
       return callback({
         args: isApply ? args.length >= 2 ? args[1] : [] : args,
-        path: isApply ? path2.slice(0, -1) : path2
+        path: isApply ? path3.slice(0, -1) : path3
       });
     }
   });
@@ -7260,18 +7263,18 @@ function createHTTPBatchLink(requester) {
           if (maxURLLength === Infinity) {
             return true;
           }
-          const path2 = batchOps.map((op) => op.path).join(",");
+          const path3 = batchOps.map((op) => op.path).join(",");
           const inputs = batchOps.map((op) => op.input);
           const url = getUrl({
             ...resolvedOpts,
             runtime,
             type,
-            path: path2,
+            path: path3,
             inputs
           });
           return url.length <= maxURLLength;
         };
-        const fetch = requester({
+        const fetch2 = requester({
           ...resolvedOpts,
           runtime,
           type,
@@ -7279,7 +7282,7 @@ function createHTTPBatchLink(requester) {
         });
         return {
           validate,
-          fetch
+          fetch: fetch2
         };
       };
       const query = dataLoader(batchLoader("query"));
@@ -7324,11 +7327,11 @@ function createHTTPBatchLink(requester) {
 }
 var batchRequester = (requesterOpts) => {
   return (batchOps) => {
-    const path2 = batchOps.map((op) => op.path).join(",");
+    const path3 = batchOps.map((op) => op.path).join(",");
     const inputs = batchOps.map((op) => op.input);
     const { promise, cancel } = jsonHttpRequester({
       ...requesterOpts,
-      path: path2,
+      path: path3,
       inputs,
       headers() {
         if (!requesterOpts.opts.headers) {
@@ -7362,12 +7365,12 @@ function httpLinkFactory(factoryOpts) {
   return (opts) => {
     const resolvedOpts = resolveHTTPLinkOptions(opts);
     return (runtime) => ({ op }) => observable((observer) => {
-      const { path: path2, input, type } = op;
+      const { path: path3, input, type } = op;
       const { promise, cancel } = factoryOpts.requester({
         ...resolvedOpts,
         runtime,
         type,
-        path: path2,
+        path: path3,
         input,
         headers() {
           if (!opts.headers) {
@@ -7413,13 +7416,13 @@ var httpLink = httpLinkFactory({
 
 // node_modules/@trpc/client/dist/index.mjs
 var TRPCUntypedClient = class {
-  $request({ type, input, path: path2, context = {} }) {
+  $request({ type, input, path: path3, context = {} }) {
     const chain$ = createChain({
       links: this.links,
       op: {
         id: ++this.requestId,
         type,
-        path: path2,
+        path: path3,
         input,
         context
       }
@@ -7439,28 +7442,28 @@ var TRPCUntypedClient = class {
     });
     return abortablePromise;
   }
-  query(path2, input, opts) {
+  query(path3, input, opts) {
     return this.requestAsPromise({
       type: "query",
-      path: path2,
+      path: path3,
       input,
       context: opts?.context,
       signal: opts?.signal
     });
   }
-  mutation(path2, input, opts) {
+  mutation(path3, input, opts) {
     return this.requestAsPromise({
       type: "mutation",
-      path: path2,
+      path: path3,
       input,
       context: opts?.context,
       signal: opts?.signal
     });
   }
-  subscription(path2, input, opts) {
+  subscription(path3, input, opts) {
     const observable$ = this.$request({
       type: "subscription",
-      path: path2,
+      path: path3,
       input,
       context: opts?.context
     });
@@ -7532,10 +7535,10 @@ function createTRPCClientProxy(client) {
     if (key === "__untypedClient") {
       return client;
     }
-    return createRecursiveProxy(({ path: path2, args }) => {
+    return createRecursiveProxy(({ path: path3, args }) => {
       const pathCopy = [
         key,
-        ...path2
+        ...path3
       ];
       const procedureType = clientCallTypeToProcedureType(pathCopy.pop());
       const fullPath = pathCopy.join(".");
@@ -7644,12 +7647,12 @@ var streamingJsonHttpRequester = (opts, onSingle) => {
 var streamRequester = (requesterOpts) => {
   const textDecoder = getTextDecoder(requesterOpts.opts.textDecoder);
   return (batchOps, unitResolver) => {
-    const path2 = batchOps.map((op) => op.path).join(",");
+    const path3 = batchOps.map((op) => op.path).join(",");
     const inputs = batchOps.map((op) => op.input);
     const { cancel, promise } = streamingJsonHttpRequester({
       ...requesterOpts,
       textDecoder,
-      path: path2,
+      path: path3,
       inputs,
       headers() {
         if (!requesterOpts.opts.headers) {
@@ -7863,7 +7866,7 @@ var isURL = (payload) => payload instanceof URL;
 
 // node_modules/superjson/dist/pathstringifier.js
 var escapeKey = (key) => key.replace(/\\/g, "\\\\").replace(/\./g, "\\.");
-var stringifyPath = (path2) => path2.map(String).map(escapeKey).join(".");
+var stringifyPath = (path3) => path3.map(String).map(escapeKey).join(".");
 var parsePath = (string, legacyPaths) => {
   const result = [];
   let segment = "";
@@ -8110,26 +8113,26 @@ var getNthKey = (value, n) => {
   }
   return keys.next().value;
 };
-function validatePath(path2) {
-  if (includes(path2, "__proto__")) {
+function validatePath(path3) {
+  if (includes(path3, "__proto__")) {
     throw new Error("__proto__ is not allowed as a property");
   }
-  if (includes(path2, "prototype")) {
+  if (includes(path3, "prototype")) {
     throw new Error("prototype is not allowed as a property");
   }
-  if (includes(path2, "constructor")) {
+  if (includes(path3, "constructor")) {
     throw new Error("constructor is not allowed as a property");
   }
 }
-var getDeep = (object, path2) => {
-  validatePath(path2);
-  for (let i = 0; i < path2.length; i++) {
-    const key = path2[i];
+var getDeep = (object, path3) => {
+  validatePath(path3);
+  for (let i = 0; i < path3.length; i++) {
+    const key = path3[i];
     if (isSet(object)) {
       object = getNthKey(object, +key);
     } else if (isMap(object)) {
       const row = +key;
-      const type = +path2[++i] === 0 ? "key" : "value";
+      const type = +path3[++i] === 0 ? "key" : "value";
       const keyOfRow = getNthKey(object, row);
       switch (type) {
         case "key":
@@ -8145,14 +8148,14 @@ var getDeep = (object, path2) => {
   }
   return object;
 };
-var setDeep = (object, path2, mapper) => {
-  validatePath(path2);
-  if (path2.length === 0) {
+var setDeep = (object, path3, mapper) => {
+  validatePath(path3);
+  if (path3.length === 0) {
     return mapper(object);
   }
   let parent = object;
-  for (let i = 0; i < path2.length - 1; i++) {
-    const key = path2[i];
+  for (let i = 0; i < path3.length - 1; i++) {
+    const key = path3[i];
     if (isArray(parent)) {
       const index = +key;
       parent = parent[index];
@@ -8162,12 +8165,12 @@ var setDeep = (object, path2, mapper) => {
       const row = +key;
       parent = getNthKey(parent, row);
     } else if (isMap(parent)) {
-      const isEnd = i === path2.length - 2;
+      const isEnd = i === path3.length - 2;
       if (isEnd) {
         break;
       }
       const row = +key;
-      const type = +path2[++i] === 0 ? "key" : "value";
+      const type = +path3[++i] === 0 ? "key" : "value";
       const keyOfRow = getNthKey(parent, row);
       switch (type) {
         case "key":
@@ -8179,7 +8182,7 @@ var setDeep = (object, path2, mapper) => {
       }
     }
   }
-  const lastKey = path2[path2.length - 1];
+  const lastKey = path3[path3.length - 1];
   if (isArray(parent)) {
     parent[+lastKey] = mapper(parent[+lastKey]);
   } else if (isPlainObject(parent)) {
@@ -8194,7 +8197,7 @@ var setDeep = (object, path2, mapper) => {
     }
   }
   if (isMap(parent)) {
-    const row = +path2[path2.length - 2];
+    const row = +path3[path3.length - 2];
     const keyToRow = getNthKey(parent, row);
     const type = +lastKey === 0 ? "key" : "value";
     switch (type) {
@@ -8241,16 +8244,16 @@ function traverse(tree, walker2, version, origin = []) {
   walker2(nodeValue, origin);
 }
 function applyValueAnnotations(plain, annotations, version, superJson) {
-  traverse(annotations, (type, path2) => {
-    plain = setDeep(plain, path2, (v) => untransformValue(v, type, superJson));
+  traverse(annotations, (type, path3) => {
+    plain = setDeep(plain, path3, (v) => untransformValue(v, type, superJson));
   }, version);
   return plain;
 }
 function applyReferentialEqualityAnnotations(plain, annotations, version) {
   const legacyPaths = enableLegacyPaths(version);
-  function apply(identicalPaths, path2) {
-    const object = getDeep(plain, parsePath(path2, legacyPaths));
-    identicalPaths.map((path3) => parsePath(path3, legacyPaths)).forEach((identicalObjectPath) => {
+  function apply(identicalPaths, path3) {
+    const object = getDeep(plain, parsePath(path3, legacyPaths));
+    identicalPaths.map((path4) => parsePath(path4, legacyPaths)).forEach((identicalObjectPath) => {
       plain = setDeep(plain, identicalObjectPath, () => object);
     });
   }
@@ -8268,12 +8271,12 @@ function applyReferentialEqualityAnnotations(plain, annotations, version) {
   return plain;
 }
 var isDeep = (object, superJson) => isPlainObject(object) || isArray(object) || isMap(object) || isSet(object) || isError(object) || isInstanceOfRegisteredClass(object, superJson);
-function addIdentity(object, path2, identities) {
+function addIdentity(object, path3, identities) {
   const existingSet = identities.get(object);
   if (existingSet) {
-    existingSet.push(path2);
+    existingSet.push(path3);
   } else {
-    identities.set(object, [path2]);
+    identities.set(object, [path3]);
   }
 }
 function generateReferentialEqualityAnnotations(identitites, dedupe) {
@@ -8284,7 +8287,7 @@ function generateReferentialEqualityAnnotations(identitites, dedupe) {
       return;
     }
     if (!dedupe) {
-      paths = paths.map((path2) => path2.map(String)).sort((a, b) => a.length - b.length);
+      paths = paths.map((path3) => path3.map(String)).sort((a, b) => a.length - b.length);
     }
     const [representativePath, ...identicalPaths] = paths;
     if (representativePath.length === 0) {
@@ -8303,10 +8306,10 @@ function generateReferentialEqualityAnnotations(identitites, dedupe) {
     return isEmptyObject(result) ? void 0 : result;
   }
 }
-var walker = (object, identities, superJson, dedupe, path2 = [], objectsInThisPath = [], seenObjects = /* @__PURE__ */ new Map()) => {
+var walker = (object, identities, superJson, dedupe, path3 = [], objectsInThisPath = [], seenObjects = /* @__PURE__ */ new Map()) => {
   const primitive = isPrimitive(object);
   if (!primitive) {
-    addIdentity(object, path2, identities);
+    addIdentity(object, path3, identities);
     const seen = seenObjects.get(object);
     if (seen) {
       return dedupe ? {
@@ -8340,7 +8343,7 @@ var walker = (object, identities, superJson, dedupe, path2 = [], objectsInThisPa
     if (index === "__proto__" || index === "constructor" || index === "prototype") {
       throw new Error(`Detected property ${index}. This is a prototype pollution risk, please remove it from your object.`);
     }
-    const recursiveResult = walker(value, identities, superJson, dedupe, [...path2, index], [...objectsInThisPath, object], seenObjects);
+    const recursiveResult = walker(value, identities, superJson, dedupe, [...path3, index], [...objectsInThisPath, object], seenObjects);
     transformedValue[index] = recursiveResult.transformedValue;
     if (isArray(recursiveResult.annotations)) {
       innerAnnotations[escapeKey(index)] = recursiveResult.annotations;
@@ -8518,7 +8521,35 @@ function getApiKey() {
   return process.env.FEAST_API_KEY ?? PROD_API_KEY;
 }
 
+// src/jwt.ts
+function decodeJwtPayload(jwt) {
+  const payload = jwt.split(".")[1];
+  if (payload == null) {
+    throw new Error("Malformed JWT");
+  }
+  return JSON.parse(Buffer.from(payload, "base64url").toString("utf-8"));
+}
+
 // src/http.ts
+function readPackageVersion() {
+  try {
+    const require2 = createRequire(import.meta.url);
+    return require2("../package.json").version ?? "unknown";
+  } catch {
+    return "unknown";
+  }
+}
+var CLI_VERSION = readPackageVersion();
+var CLI_CLIENT_ID = `feast-cli/${CLI_VERSION}`;
+var CLI_USER_AGENT = `${CLI_CLIENT_ID} node/${process.versions.node}`;
+function usernameFromToken(accessToken) {
+  try {
+    const payload = decodeJwtPayload(accessToken);
+    return payload.username ?? payload.sub;
+  } catch {
+    return void 0;
+  }
+}
 function createHttpCaller(auth) {
   return createTRPCProxyClient({
     transformer: dist_default,
@@ -8527,11 +8558,17 @@ function createHttpCaller(auth) {
         url: getApiUrl(),
         headers: () => {
           const headers = {
-            "x-api-key": getApiKey()
+            "x-api-key": getApiKey(),
+            "x-client": CLI_CLIENT_ID,
+            "user-agent": CLI_USER_AGENT
           };
           if (auth.accessToken != null) {
             headers["x-access-token"] = `Bearer ${auth.accessToken}`;
             headers["x-timezone"] = Intl.DateTimeFormat().resolvedOptions().timeZone;
+            const username = usernameFromToken(auth.accessToken);
+            if (username != null) {
+              headers["x-client-user"] = username;
+            }
           }
           if (auth.preferredRole != null) {
             headers["x-preferred-role"] = auth.preferredRole;
@@ -8552,13 +8589,6 @@ function callProcedure(client, pathSegments, type, input) {
 
 // src/auth.ts
 var REFRESH_MARGIN_MS = 5 * 60 * 1e3;
-function decodeJwtPayload(jwt) {
-  const payload = jwt.split(".")[1];
-  if (payload == null) {
-    throw new Error("Malformed JWT");
-  }
-  return JSON.parse(Buffer.from(payload, "base64url").toString("utf-8"));
-}
 async function login(username, password) {
   const client = createHttpCaller({});
   const response = await client.api.auth.login.query({ username, password });
@@ -8626,146 +8656,6 @@ function errorMessage(error) {
 // src/main.ts
 import fs2 from "fs";
 
-// src/browserLogin.ts
-import { spawn } from "child_process";
-import { createHash, randomBytes } from "crypto";
-import http from "http";
-var CALLBACK_TIMEOUT_MS = 5 * 60 * 1e3;
-function base64url(buffer) {
-  return buffer.toString("base64url");
-}
-function tabHtml(title, body) {
-  return `<!doctype html><html><head><meta charset="utf-8"><title>${title}</title>
-<style>body{font-family:-apple-system,system-ui,sans-serif;background:#0f0f0f;color:#f5f5f5;
-display:flex;min-height:100vh;align-items:center;justify-content:center;margin:0}
-.card{text-align:center;padding:2rem 3rem}.t{font-size:1.4rem;font-weight:600;margin-bottom:.5rem}
-.b{color:#a1a1a1}</style></head><body><div class="card">
-<div class="t">${title}</div><div class="b">${body}</div></div></body></html>`;
-}
-function openBrowser(url) {
-  let command;
-  let args;
-  if (process.platform === "darwin") {
-    command = "open";
-    args = [url];
-  } else if (process.platform === "win32") {
-    command = "cmd";
-    args = ["/c", "start", "", url];
-  } else {
-    command = "xdg-open";
-    args = [url];
-  }
-  try {
-    const child = spawn(command, args, { stdio: "ignore", detached: true });
-    child.on("error", () => {
-    });
-    child.unref();
-  } catch {
-  }
-}
-function startLoopback(expectedState) {
-  return new Promise((resolveOuter, rejectOuter) => {
-    let resolveCode = () => {
-    };
-    let rejectCode = () => {
-    };
-    const waitForCode = new Promise((resolve, reject) => {
-      resolveCode = resolve;
-      rejectCode = reject;
-    });
-    waitForCode.catch(() => {
-    });
-    const server = http.createServer((req, res) => {
-      const url = new URL(req.url ?? "/", "http://127.0.0.1");
-      if (url.pathname !== "/callback") {
-        res.writeHead(404);
-        res.end();
-        return;
-      }
-      const error = url.searchParams.get("error");
-      if (error != null) {
-        res.writeHead(200, { "Content-Type": "text/html" });
-        res.end(tabHtml("Authorization declined", "You can close this tab."));
-        rejectCode(new Error(`Authorization declined: ${error}`));
-        return;
-      }
-      if (url.searchParams.get("state") !== expectedState) {
-        res.writeHead(400, { "Content-Type": "text/html" });
-        res.end(
-          tabHtml("Invalid request", "State mismatch \u2014 retry from the CLI.")
-        );
-        rejectCode(new Error("State mismatch \u2014 aborting (possible CSRF)"));
-        return;
-      }
-      const code = url.searchParams.get("code");
-      if (code == null || code.length === 0) {
-        res.writeHead(400);
-        res.end();
-        rejectCode(new Error("Authorization callback did not include a code"));
-        return;
-      }
-      res.writeHead(200, {
-        "Content-Type": "text/html",
-        Connection: "close"
-      });
-      res.end(
-        tabHtml(
-          "You're all set \u2713",
-          "The feast CLI is authorized. Close this tab and return to your terminal."
-        )
-      );
-      resolveCode(code);
-    });
-    const timeout = setTimeout(() => {
-      rejectCode(
-        new Error("Timed out waiting for browser authorization (5 minutes)")
-      );
-    }, CALLBACK_TIMEOUT_MS);
-    const close = () => {
-      clearTimeout(timeout);
-      server.closeAllConnections?.();
-      server.close();
-    };
-    server.on("error", rejectOuter);
-    server.listen(0, "127.0.0.1", () => {
-      server.unref();
-      const address = server.address();
-      const port = typeof address === "object" && address != null ? address.port : 0;
-      resolveOuter({ port, waitForCode, close });
-    });
-  });
-}
-async function browserLogin() {
-  const codeVerifier = base64url(randomBytes(32));
-  const codeChallenge = base64url(
-    createHash("sha256").update(codeVerifier).digest()
-  );
-  const state = base64url(randomBytes(16));
-  const { port, waitForCode, close } = await startLoopback(state);
-  try {
-    const authUrl = `${getWebBaseUrl()}/oauth?port=${port}&state=${encodeURIComponent(state)}&challenge=${encodeURIComponent(codeChallenge)}`;
-    console.error("Opening your browser to authorize the feast CLI...");
-    console.error(`If it doesn't open, visit:
-  ${authUrl}
-`);
-    openBrowser(authUrl);
-    const code = await waitForCode;
-    const client = createHttpCaller({});
-    const response = await client.api.auth.exchangeAuthCode.mutate({
-      code,
-      codeVerifier
-    });
-    const tokens = response?.tokens;
-    if (tokens?.accessToken?.jwtToken == null) {
-      throw new Error("Authorization failed: empty token response");
-    }
-    saveTokens(tokens);
-    return tokens;
-  } finally {
-    close();
-  }
-}
-
 // src/generated/manifest.ts
 var CLI_MANIFEST = {
   "awsAccountId": "891817334910",
@@ -10828,6 +10718,82 @@ var CLI_MANIFEST = {
         "$schema": "http://json-schema.org/draft-07/schema#"
       }
     },
+    {
+      "id": "deleteMedia",
+      "domain": "core",
+      "description": "Delete an uploaded media file for the organization by its S3 key. The key must belong to the given scope (passBuilder, funnel, organizationFilePublic, organizationFilePrivate, or creativeLibrary).",
+      "needsApproval": true,
+      "type": "mutation",
+      "path": [
+        "api",
+        "media",
+        "delete"
+      ],
+      "inputJsonSchema": {
+        "type": "object",
+        "properties": {
+          "scope": {
+            "type": "string",
+            "enum": [
+              "passBuilder",
+              "funnel",
+              "organizationFilePublic",
+              "organizationFilePrivate",
+              "creativeLibrary",
+              "creativeLibraryBroll"
+            ]
+          },
+          "key": {
+            "type": "string"
+          }
+        },
+        "required": [
+          "scope",
+          "key"
+        ],
+        "additionalProperties": false,
+        "$schema": "http://json-schema.org/draft-07/schema#"
+      }
+    },
+    {
+      "id": "describeData",
+      "domain": "data",
+      "description": "Describe the queryable data model, then use queryData to read it. Call with no arguments for an index of every queryable object type plus the full query grammar - start here. Call with schemaName for every object type in that schema with full column detail, schemaName plus objectTypeName for a single object type, or detail='full' for the entire model at once. Columns come back with their type, enum values, nullability and a description; links come back with the name you pass to a pivot or join command. Prefer the 'interface' schema, whose object types (order, orderItem, customer, location, ...) are POS-agnostic and return the same shape regardless of which POS the organization runs. Pass includeGrammar=false to omit the grammar once you already have it.",
+      "needsApproval": false,
+      "type": "query",
+      "path": [
+        "api",
+        "data",
+        "describe"
+      ],
+      "inputJsonSchema": {
+        "type": "object",
+        "properties": {
+          "schemaName": {
+            "type": "string",
+            "description": 'Narrow to one schema, e.g. "interface", "core", "events", "texting". Omit for the index of everything.'
+          },
+          "objectTypeName": {
+            "type": "string",
+            "description": 'Narrow to one object type within schemaName, e.g. "order", "guest". Requires schemaName.'
+          },
+          "detail": {
+            "type": "string",
+            "enum": [
+              "index",
+              "full"
+            ],
+            "description": 'Only applies when schemaName is omitted. "index" (default) lists object types with a one-line description; "full" returns every column of every object type.'
+          },
+          "includeGrammar": {
+            "type": "boolean",
+            "description": "Whether to include the query grammar for queryData. Defaults to true; pass false once you already have it."
+          }
+        },
+        "additionalProperties": false,
+        "$schema": "http://json-schema.org/draft-07/schema#"
+      }
+    },
     {
       "id": "dfyCreateOffer",
       "domain": "offer",
@@ -11252,6 +11218,50 @@ var CLI_MANIFEST = {
         "$schema": "http://json-schema.org/draft-07/schema#"
       }
     },
+    {
+      "id": "getMediaUploadUrl",
+      "domain": "core",
+      "description": "Get a presigned S3 upload URL for a media file in a given scope (passBuilder, funnel, organizationFilePublic, organizationFilePrivate, creativeLibrary, creativeLibraryBroll). Set cropped to store a cropped variant under the scope's cropped/ subfolder. PUT the file bytes to the returned presignedUrl, then reference the returned url/key.",
+      "needsApproval": false,
+      "type": "mutation",
+      "path": [
+        "api",
+        "media",
+        "getUploadUrl"
+      ],
+      "inputJsonSchema": {
+        "type": "object",
+        "properties": {
+          "scope": {
+            "type": "string",
+            "enum": [
+              "passBuilder",
+              "funnel",
+              "organizationFilePublic",
+              "organizationFilePrivate",
+              "creativeLibrary",
+              "creativeLibraryBroll"
+            ]
+          },
+          "fileName": {
+            "type": "string"
+          },
+          "fileType": {
+            "type": "string"
+          },
+          "cropped": {
+            "type": "boolean"
+          }
+        },
+        "required": [
+          "scope",
+          "fileName",
+          "fileType"
+        ],
+        "additionalProperties": false,
+        "$schema": "http://json-schema.org/draft-07/schema#"
+      }
+    },
     {
       "id": "listAutomationFlows",
       "domain": "automations",
@@ -11430,6 +11440,49 @@ var CLI_MANIFEST = {
         "$schema": "http://json-schema.org/draft-07/schema#"
       }
     },
+    {
+      "id": "listMedia",
+      "domain": "core",
+      "description": "List uploaded media files for the organization across one or more scopes (passBuilder, funnel, organizationFilePublic, organizationFilePrivate, creativeLibrary, creativeLibraryBroll). Each file is tagged with its scope and a canDelete flag. Set mediaOnly to return only image/video files. Set cropped to list the cropped variants (each scope's cropped/ subfolder) instead of the base files.",
+      "needsApproval": false,
+      "type": "query",
+      "path": [
+        "api",
+        "media",
+        "list"
+      ],
+      "inputJsonSchema": {
+        "type": "object",
+        "properties": {
+          "scopes": {
+            "type": "array",
+            "items": {
+              "type": "string",
+              "enum": [
+                "passBuilder",
+                "funnel",
+                "organizationFilePublic",
+                "organizationFilePrivate",
+                "creativeLibrary",
+                "creativeLibraryBroll"
+              ]
+            },
+            "minItems": 1
+          },
+          "mediaOnly": {
+            "type": "boolean"
+          },
+          "cropped": {
+            "type": "boolean"
+          }
+        },
+        "required": [
+          "scopes"
+        ],
+        "additionalProperties": false,
+        "$schema": "http://json-schema.org/draft-07/schema#"
+      }
+    },
     {
       "id": "loadCurrentOrganization",
       "domain": "core",
@@ -11527,18 +11580,196 @@ var CLI_MANIFEST = {
               "imageKey": {
                 "type": "string"
               },
-              "imageUrl": {
-                "type": "string"
+              "imageUrl": {
+                "type": "string"
+              }
+            },
+            "required": [
+              "promotionName"
+            ],
+            "additionalProperties": false
+          }
+        },
+        "required": [
+          "campaignId"
+        ],
+        "additionalProperties": false,
+        "$schema": "http://json-schema.org/draft-07/schema#"
+      }
+    },
+    {
+      "id": "queryData",
+      "domain": "data",
+      "description": `Run a read-only query against the organization's data. Call describeData first for the object types and their exact column names - do not guess columns.
+Results are always scoped to the calling organization, so never filter on organizationId yourself.
+
+Example - export opted-in members with more than 5 visits, newest first:
+{"schemaName":"core","objectTypeName":"guest","commands":[{"type":"filter","filter":{"type":"and","filters":[{"$optIn":{"boolean":true}},{"$testUser":{"boolean":false}},{"$progress":{"number":5,"match":"GT"}}]}}],"args":{"limit":500,"order":{"field":"timeAdded","direction":"DESC"},"fields":["serialNumber","firstName","lastName","phoneNumber","email","progress"]}}
+
+Example - order revenue by location for orders closed this year:
+{"schemaName":"interface","objectTypeName":"order","commands":[{"type":"filter","filter":{"$closedAt":{"datetime":"2026-01-01T00:00:00.000Z","match":"GTE"}}},{"type":"aggregate","aggregate":{"aggregate":{"$amount":"SUM"},"groupBy":{"$locationId":"EXACT"}}}]}
+
+Example - a member's recent texts, newest first:
+{"schemaName":"texting","objectTypeName":"textMessage","commands":[{"type":"filter","filter":{"$serialNumber":{"string":"<serial>","match":"EQ"}}}],"args":{"limit":50,"order":{"field":"dateCreated","direction":"DESC"}}}
+
+Filter leaves are one column each, written as the column name prefixed with $, combined with {"type":"and"|"or","filters":[...]}. Use {"strings":[...]} for any-of rather than a large or. Page by passing the returned nextCursor back as args.cursor.`,
+      "needsApproval": false,
+      "type": "query",
+      "path": [
+        "api",
+        "data",
+        "query"
+      ],
+      "inputJsonSchema": {
+        "type": "object",
+        "properties": {
+          "schemaName": {
+            "type": "string",
+            "description": 'Schema as reported by describeData, e.g. "interface", "core", "events", "texting".'
+          },
+          "objectTypeName": {
+            "type": "string",
+            "description": 'Object type as reported by describeData, e.g. "order", "guest", "userEvent", "textMessage".'
+          },
+          "commands": {
+            "type": "array",
+            "items": {
+              "anyOf": [
+                {
+                  "type": "object",
+                  "properties": {
+                    "type": {
+                      "type": "string",
+                      "const": "filter"
+                    },
+                    "filter": {
+                      "description": 'Required. A filter tree. One column per leaf, as the column name prefixed with $. Leaf: {"$<column>": <predicate>}. Combine with {"type":"and","filters":[...]} or {"type":"or","filters":[...]}. Predicates by column type - string: {"string":"Jane","match":"EQ"|"NEQ"|"IN"|"ENDS_WITH"} where IN means contains, or {"strings":["a","b"]} for any-of. number: {"number":5,"match":"GT"|"GTE"|"LT"|"LTE"|"EQ"|"NEQ"}. boolean: {"boolean":true} with no match key. datetime/date: {"datetime":"2026-01-01T00:00:00.000Z","match":"GTE"}. Nullable columns also accept {"match":"NULL"} or {"match":"NOT_NULL"}. Example: {"type":"and","filters":[{"$optIn":{"boolean":true}},{"$progress":{"number":5,"match":"GT"}}]}'
+                    }
+                  },
+                  "required": [
+                    "type",
+                    "filter"
+                  ],
+                  "additionalProperties": false,
+                  "description": 'Restrict the set to matching rows. Example: {"type":"filter","filter":{"$eventType":{"strings":["order","rewardAwarded"]}}}'
+                },
+                {
+                  "type": "object",
+                  "properties": {
+                    "type": {
+                      "type": "string",
+                      "const": "pivot"
+                    },
+                    "name": {
+                      "type": "string",
+                      "description": "A link name from describeData's links for the current object type. Replaces the set with that linked object type, so later commands apply to the new type."
+                    }
+                  },
+                  "required": [
+                    "type",
+                    "name"
+                  ],
+                  "additionalProperties": false,
+                  "description": 'Traverse a link. Example: {"type":"pivot","name":"orderItem"} on interface.order gives its line items.'
+                },
+                {
+                  "type": "object",
+                  "properties": {
+                    "type": {
+                      "type": "string",
+                      "const": "aggregate"
+                    },
+                    "aggregate": {
+                      "description": 'Required. Group and aggregate, replacing the row shape with the grouped and aggregated columns only. Shape: {"aggregate":{"$<column>":"SUM"|"MAX"|"MIN"|"AVG"|"COUNT"},"groupBy":{"$<column>":"EXACT"}}. Example - revenue by location: {"aggregate":{"$amount":"SUM"},"groupBy":{"$locationId":"EXACT"}}'
+                    }
+                  },
+                  "required": [
+                    "type",
+                    "aggregate"
+                  ],
+                  "additionalProperties": false,
+                  "description": 'Group and aggregate. Example: {"type":"aggregate","aggregate":{"aggregate":{"$amount":"SUM"},"groupBy":{"$locationId":"EXACT"}}}'
+                },
+                {
+                  "type": "object",
+                  "properties": {
+                    "type": {
+                      "type": "string",
+                      "const": "join"
+                    },
+                    "name": {
+                      "type": "string",
+                      "description": "A link name from describeData for the current object type."
+                    },
+                    "fields": {
+                      "type": "array",
+                      "items": {
+                        "type": "string"
+                      },
+                      "description": "Columns to pull from the linked object type."
+                    }
+                  },
+                  "required": [
+                    "type",
+                    "name",
+                    "fields"
+                  ],
+                  "additionalProperties": false,
+                  "description": 'Widen each row with columns from a linked object, keeping the current object type. Example: {"type":"join","name":"order","fields":["closedAt","amount"]}'
+                }
+              ]
+            },
+            "description": "Ordered list of commands, each narrowing or reshaping the set before the fetch. Omit to fetch the object type unfiltered. pivot and join must come before any aggregate."
+          },
+          "args": {
+            "type": "object",
+            "properties": {
+              "limit": {
+                "type": "integer",
+                "exclusiveMinimum": 0,
+                "maximum": 1e3,
+                "description": "Rows to return. Defaults to 100, maximum 1000."
+              },
+              "cursor": {
+                "type": "integer",
+                "minimum": 0,
+                "description": "Row offset. Pass the nextCursor from the previous response to page; a missing nextCursor means there are no more rows."
+              },
+              "order": {
+                "type": "object",
+                "properties": {
+                  "field": {
+                    "type": "string"
+                  },
+                  "direction": {
+                    "type": "string",
+                    "enum": [
+                      "ASC",
+                      "DESC"
+                    ]
+                  }
+                },
+                "required": [
+                  "field",
+                  "direction"
+                ],
+                "additionalProperties": false,
+                "description": 'Sort order. Example: {"field":"eventTime","direction":"DESC"}'
+              },
+              "fields": {
+                "type": "array",
+                "items": {
+                  "type": "string"
+                },
+                "description": "Columns to return. Omit for all of them. The main lever for keeping responses under the payload cap on wide object types."
               }
             },
-            "required": [
-              "promotionName"
-            ],
             "additionalProperties": false
           }
         },
         "required": [
-          "campaignId"
+          "schemaName",
+          "objectTypeName"
         ],
         "additionalProperties": false,
         "$schema": "http://json-schema.org/draft-07/schema#"
@@ -17563,6 +17794,9 @@ var CLI_MANIFEST = {
                                       "type": "string",
                                       "enum": [
                                         "first",
+                                        "second",
+                                        "third",
+                                        "fourth",
                                         "last"
                                       ]
                                     }
@@ -17894,6 +18128,234 @@ ${available}`
   };
 }
 
+// src/actingContext.ts
+function environmentAccessToken() {
+  const token = process.env.FEAST_ACCESS_TOKEN;
+  return token != null && token.length > 0 ? token : void 0;
+}
+function firstNonEmpty(...values) {
+  for (const value of values) {
+    if (value != null && value.length > 0) {
+      return value;
+    }
+  }
+  return void 0;
+}
+function roleLabelFromArn(arn) {
+  return arn.split("/").pop()?.split(".").pop() ?? arn;
+}
+function buildPreferredRole(organizationId, role) {
+  if (role.startsWith("arn:")) {
+    return role;
+  }
+  if (!CLI_MANIFEST.organizationRoles.includes(role)) {
+    throw new Error(
+      `Unknown role "${role}". Expected one of ${CLI_MANIFEST.organizationRoles.join(", ")}, or a full role ARN.`
+    );
+  }
+  return formRoleArn(organizationId, role);
+}
+function resolvePinned(pinned, flag, variableName, flagName) {
+  if (pinned == null) {
+    return flag;
+  }
+  if (flag != null && flag !== pinned) {
+    throw new Error(
+      `${variableName} pins this session to ${pinned}, so ${flagName} ${flag} is not allowed.`
+    );
+  }
+  return pinned;
+}
+function resolveFromEnvironment(accessToken, orgFlag, roleFlag) {
+  const organizationId = resolvePinned(
+    firstNonEmpty(process.env.FEAST_ORGANIZATION_ID),
+    orgFlag,
+    "FEAST_ORGANIZATION_ID",
+    "--org"
+  );
+  if (organizationId == null) {
+    throw new Error(
+      "FEAST_ACCESS_TOKEN is set, so the organization cannot be read from the token. Pass --org <organizationId> or set FEAST_ORGANIZATION_ID."
+    );
+  }
+  const role = resolvePinned(
+    firstNonEmpty(process.env.FEAST_PREFERRED_ROLE),
+    roleFlag,
+    "FEAST_PREFERRED_ROLE",
+    "--role"
+  );
+  if (role == null) {
+    throw new Error(
+      "FEAST_ACCESS_TOKEN is set, so the role cannot be read from the token. Pass --role <role> or set FEAST_PREFERRED_ROLE."
+    );
+  }
+  const preferredRole = buildPreferredRole(organizationId, role);
+  return {
+    accessToken,
+    organizationId,
+    preferredRole,
+    roleLabel: roleLabelFromArn(preferredRole),
+    source: "environment"
+  };
+}
+async function resolveActingContext(orgFlag, roleFlag) {
+  const environmentToken = environmentAccessToken();
+  if (environmentToken != null) {
+    return resolveFromEnvironment(environmentToken, orgFlag, roleFlag);
+  }
+  const tokens = await ensureFreshTokens();
+  const accessToken = tokens.accessToken.jwtToken;
+  const organizationId = resolveOrganizationId(accessToken, orgFlag);
+  const resolved = resolvePreferredRole(accessToken, organizationId);
+  return {
+    accessToken,
+    organizationId,
+    preferredRole: resolved.arn,
+    roleLabel: resolved.orgRole.role,
+    source: "credentials"
+  };
+}
+
+// src/browserLogin.ts
+import { spawn } from "child_process";
+import { createHash, randomBytes } from "crypto";
+import http from "http";
+var CALLBACK_TIMEOUT_MS = 5 * 60 * 1e3;
+function base64url(buffer) {
+  return buffer.toString("base64url");
+}
+function tabHtml(title, body) {
+  return `<!doctype html><html><head><meta charset="utf-8"><title>${title}</title>
+<style>body{font-family:-apple-system,system-ui,sans-serif;background:#0f0f0f;color:#f5f5f5;
+display:flex;min-height:100vh;align-items:center;justify-content:center;margin:0}
+.card{text-align:center;padding:2rem 3rem}.t{font-size:1.4rem;font-weight:600;margin-bottom:.5rem}
+.b{color:#a1a1a1}</style></head><body><div class="card">
+<div class="t">${title}</div><div class="b">${body}</div></div></body></html>`;
+}
+function openBrowser(url) {
+  let command;
+  let args;
+  if (process.platform === "darwin") {
+    command = "open";
+    args = [url];
+  } else if (process.platform === "win32") {
+    command = "cmd";
+    args = ["/c", "start", "", url];
+  } else {
+    command = "xdg-open";
+    args = [url];
+  }
+  try {
+    const child = spawn(command, args, { stdio: "ignore", detached: true });
+    child.on("error", () => {
+    });
+    child.unref();
+  } catch {
+  }
+}
+function startLoopback(expectedState) {
+  return new Promise((resolveOuter, rejectOuter) => {
+    let resolveCode = () => {
+    };
+    let rejectCode = () => {
+    };
+    const waitForCode = new Promise((resolve, reject) => {
+      resolveCode = resolve;
+      rejectCode = reject;
+    });
+    waitForCode.catch(() => {
+    });
+    const server = http.createServer((req, res) => {
+      const url = new URL(req.url ?? "/", "http://127.0.0.1");
+      if (url.pathname !== "/callback") {
+        res.writeHead(404);
+        res.end();
+        return;
+      }
+      const error = url.searchParams.get("error");
+      if (error != null) {
+        res.writeHead(200, { "Content-Type": "text/html" });
+        res.end(tabHtml("Authorization declined", "You can close this tab."));
+        rejectCode(new Error(`Authorization declined: ${error}`));
+        return;
+      }
+      if (url.searchParams.get("state") !== expectedState) {
+        res.writeHead(400, { "Content-Type": "text/html" });
+        res.end(
+          tabHtml("Invalid request", "State mismatch \u2014 retry from the CLI.")
+        );
+        rejectCode(new Error("State mismatch \u2014 aborting (possible CSRF)"));
+        return;
+      }
+      const code = url.searchParams.get("code");
+      if (code == null || code.length === 0) {
+        res.writeHead(400);
+        res.end();
+        rejectCode(new Error("Authorization callback did not include a code"));
+        return;
+      }
+      res.writeHead(200, {
+        "Content-Type": "text/html",
+        Connection: "close"
+      });
+      res.end(
+        tabHtml(
+          "You're all set \u2713",
+          "The feast CLI is authorized. Close this tab and return to your terminal."
+        )
+      );
+      resolveCode(code);
+    });
+    const timeout = setTimeout(() => {
+      rejectCode(
+        new Error("Timed out waiting for browser authorization (5 minutes)")
+      );
+    }, CALLBACK_TIMEOUT_MS);
+    const close = () => {
+      clearTimeout(timeout);
+      server.closeAllConnections?.();
+      server.close();
+    };
+    server.on("error", rejectOuter);
+    server.listen(0, "127.0.0.1", () => {
+      server.unref();
+      const address = server.address();
+      const port = typeof address === "object" && address != null ? address.port : 0;
+      resolveOuter({ port, waitForCode, close });
+    });
+  });
+}
+async function browserLogin() {
+  const codeVerifier = base64url(randomBytes(32));
+  const codeChallenge = base64url(
+    createHash("sha256").update(codeVerifier).digest()
+  );
+  const state = base64url(randomBytes(16));
+  const { port, waitForCode, close } = await startLoopback(state);
+  try {
+    const authUrl = `${getWebBaseUrl()}/oauth?port=${port}&state=${encodeURIComponent(state)}&challenge=${encodeURIComponent(codeChallenge)}`;
+    console.error("Opening your browser to authorize the feast CLI...");
+    console.error(`If it doesn't open, visit:
+  ${authUrl}
+`);
+    openBrowser(authUrl);
+    const code = await waitForCode;
+    const client = createHttpCaller({});
+    const response = await client.api.auth.exchangeAuthCode.mutate({
+      code,
+      codeVerifier
+    });
+    const tokens = response?.tokens;
+    if (tokens?.accessToken?.jwtToken == null) {
+      throw new Error("Authorization failed: empty token response");
+    }
+    saveTokens(tokens);
+    return tokens;
+  } finally {
+    close();
+  }
+}
+
 // src/prompt.ts
 import readline from "readline";
 function promptText(question) {
@@ -17978,17 +18440,26 @@ Commands:
 
 Call options:
   --org <organizationId>    Organization to act on (required unless you belong to exactly one)
+  --role <role|roleArn>     Role to act as, e.g. OWNER (required when FEAST_ACCESS_TOKEN is set)
   --input <json>            Tool input as a JSON string (default: {})
   --input-file <path>       Tool input from a JSON file
   --yes                     Skip the confirmation prompt for mutations
 
 Environment:
   FEAST_API_URL             Override the API base URL (default: production)
-  FEAST_WEB_URL             Override the web app base URL for browser login (default: production)`;
+  FEAST_WEB_URL             Override the web app base URL for browser login (default: production)
+  FEAST_NO_UPDATE_CHECK     Disable the daily check for a newer published version
+
+Non-interactive credentials (for sandboxed agents):
+  FEAST_ACCESS_TOKEN        Access token to send verbatim. When set, no token is read
+                            from disk and none is refreshed, and the token is never
+                            decoded \u2014 so the organization and role must be supplied too.
+  FEAST_ORGANIZATION_ID     Pins the organization. --org must match it or be omitted.
+  FEAST_PREFERRED_ROLE      Pins the role. --role must match it or be omitted.`;
 function parseArgs(argv) {
   const positional = [];
   const flags = {};
-  const valueFlags = /* @__PURE__ */ new Set(["org", "input", "input-file", "domain"]);
+  const valueFlags = /* @__PURE__ */ new Set(["org", "role", "input", "input-file", "domain"]);
   for (let i = 0; i < argv.length; i++) {
     const arg = argv[i];
     if (!arg.startsWith("--")) {
@@ -18010,6 +18481,11 @@ function parseArgs(argv) {
   return { positional, flags };
 }
 async function commandLogin(args) {
+  if (environmentAccessToken() != null) {
+    throw new Error(
+      "FEAST_ACCESS_TOKEN is set, so this CLI is using credentials from the environment. Unset it to log in and store tokens on disk."
+    );
+  }
   if (args.flags["password"] === true) {
     const username = args.positional[0] ?? await promptText("Username: ");
     if (username.length === 0) {
@@ -18030,7 +18506,20 @@ async function commandLogin(args) {
   console.info(`Logged in as ${payload.username ?? payload.sub}`);
   console.info(`Tokens stored in ${getCredentialsPath()}`);
 }
-async function commandWhoami() {
+async function commandWhoami(args) {
+  if (environmentAccessToken() != null) {
+    const acting = await resolveActingContext(
+      args.flags["org"],
+      args.flags["role"]
+    );
+    console.info("Credentials: FEAST_ACCESS_TOKEN (environment)");
+    console.info(`Organization: ${acting.organizationId}`);
+    console.info(`Role: ${acting.roleLabel}`);
+    console.info(
+      "The token is opaque to this CLI, so the user and their other organizations cannot be listed."
+    );
+    return;
+  }
   const tokens = await ensureFreshTokens();
   const payload = decodeJwtPayload(tokens.accessToken.jwtToken);
   const orgRoles = listOrgRoles(tokens.accessToken.jwtToken);
@@ -18172,25 +18661,20 @@ ${issues.join("\n")}
 Run: feast describe ${tool.id}`
     );
   }
-  const tokens = await ensureFreshTokens();
-  const isWrite = tool.type === "mutation" || tool.needsApproval;
-  const organizationId = resolveOrganizationId(
-    tokens.accessToken.jwtToken,
-    args.flags["org"]
-  );
-  const resolved = resolvePreferredRole(
-    tokens.accessToken.jwtToken,
-    organizationId
+  const acting = await resolveActingContext(
+    args.flags["org"],
+    args.flags["role"]
   );
+  const isWrite = tool.type === "mutation" || tool.needsApproval;
   console.error(
-    `Acting on organization ${organizationId} as ${resolved.orgRole.role}`
+    `Acting on organization ${acting.organizationId} as ${acting.roleLabel}`
   );
   const client = createHttpCaller({
-    accessToken: tokens.accessToken.jwtToken,
-    preferredRole: resolved.arn
+    accessToken: acting.accessToken,
+    preferredRole: acting.preferredRole
   });
   if (isWrite) {
-    const organization = await verifyOrganization(client, organizationId);
+    const organization = await verifyOrganization(client, acting.organizationId);
     if (args.flags["yes"] !== true) {
       const orgLabel = organization.name != null ? `"${organization.name}" (${organization.id})` : organization.id;
       const approved = await promptConfirm(
@@ -18218,7 +18702,7 @@ async function runCli(argv) {
       console.info("Logged out");
       break;
     case "whoami":
-      await commandWhoami();
+      await commandWhoami(args);
       break;
     case "tools":
       commandTools(args);
@@ -18237,11 +18721,121 @@ async function runCli(argv) {
   }
 }
 
+// src/updateNotifier.ts
+import fs3 from "fs";
+import { createRequire as createRequire2 } from "module";
+import os2 from "os";
+import path2 from "path";
+var PACKAGE_NAME = "@feastalytics/cli";
+var REGISTRY_URL = "https://registry.npmjs.org";
+var CHECK_INTERVAL_MS = 24 * 60 * 60 * 1e3;
+var FETCH_TIMEOUT_MS = 1500;
+var CACHE_DIR = path2.join(os2.homedir(), ".config", "feast-cli");
+var CACHE_PATH = path2.join(CACHE_DIR, "update-check.json");
+function readPackageVersion2() {
+  try {
+    const require2 = createRequire2(import.meta.url);
+    const version = require2("../package.json").version;
+    return typeof version === "string" ? version : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function parseVersion(version) {
+  const parts = version.split(".");
+  if (parts.length !== 3) {
+    return void 0;
+  }
+  const numbers = parts.map((part) => Number(part));
+  return numbers.some((number) => !Number.isInteger(number) || number < 0) ? void 0 : numbers;
+}
+function isNewer(latest, current) {
+  const a = parseVersion(latest);
+  const b = parseVersion(current);
+  if (a == null || b == null) {
+    return false;
+  }
+  for (let i = 0; i < 3; i++) {
+    if (a[i] !== b[i]) {
+      return a[i] > b[i];
+    }
+  }
+  return false;
+}
+function isDisabled() {
+  return process.env.FEAST_NO_UPDATE_CHECK != null || process.env.NO_UPDATE_NOTIFIER != null || process.env.CI != null || !process.stderr.isTTY;
+}
+function readCache() {
+  try {
+    const parsed = JSON.parse(
+      fs3.readFileSync(CACHE_PATH, "utf-8")
+    );
+    return typeof parsed.latest === "string" && typeof parsed.checkedAt === "number" ? parsed : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function writeCache(cache) {
+  try {
+    fs3.mkdirSync(CACHE_DIR, { recursive: true, mode: 448 });
+    fs3.writeFileSync(CACHE_PATH, JSON.stringify(cache));
+  } catch {
+    return;
+  }
+}
+async function fetchLatestVersion() {
+  try {
+    const response = await fetch(
+      `${REGISTRY_URL}/${encodeURIComponent(PACKAGE_NAME)}/latest`,
+      {
+        headers: { accept: "application/json" },
+        signal: AbortSignal.timeout(FETCH_TIMEOUT_MS)
+      }
+    );
+    if (!response.ok) {
+      return void 0;
+    }
+    const body = await response.json();
+    return typeof body.version === "string" ? body.version : void 0;
+  } catch {
+    return void 0;
+  }
+}
+async function notifyIfOutdated() {
+  if (isDisabled()) {
+    return;
+  }
+  const current = readPackageVersion2();
+  if (current == null) {
+    return;
+  }
+  const cached = readCache();
+  let latest = cached?.latest;
+  if (cached == null || Date.now() - cached.checkedAt > CHECK_INTERVAL_MS) {
+    const fetched = await fetchLatestVersion();
+    if (fetched != null) {
+      latest = fetched;
+      writeCache({ checkedAt: Date.now(), latest: fetched });
+    } else {
+      writeCache({ checkedAt: Date.now(), latest: latest ?? current });
+    }
+  }
+  if (latest == null || !isNewer(latest, current)) {
+    return;
+  }
+  console.error(
+    `
+Update available: feast ${current} \u2192 ${latest}
+  npx ${PACKAGE_NAME}@latest <command>   (or: npm install -g ${PACKAGE_NAME}@latest)
+`
+  );
+}
+
 // src/cli.ts
 runCli(process.argv.slice(2)).catch((error) => {
   console.error(errorMessage(error));
   process.exitCode = 1;
-});
+}).then(() => notifyIfOutdated()).catch(() => void 0);
 /*! Bundled license information:
 
 @trpc/client/dist/httpUtils-b9d0cb48.mjs: