@snapvisor/cli 6.4.1

package/dist/index.mjs

@@ -0,0 +1,1492 @@
+import { mkdir, readFile, rename, unlink, writeFile } from "node:fs/promises";
+import { fileURLToPath } from "node:url";
+import { resolve } from "node:path";
+import { Option, program } from "commander";
+import { deploy, finalize, skip, upload } from "@snapvisor/core";
+import ora from "ora";
+import { APIError, createClient, throwAPIError } from "@snapvisor/api-client";
+import { homedir } from "node:os";
+import { createHash, randomBytes } from "node:crypto";
+import { createServer } from "node:http";
+import open from "open";
+//#region src/options.ts
+const parallelNonceOption = new Option("--parallel-nonce <string>", "A unique ID for this parallel build");
+const tokenOption = new Option("--token <token>", "Repository token");
+const projectOption = new Option("--project <slug>", "Snapvisor project slug (account/project), used to disambiguate tokenless authentication when multiple projects are linked to the same repository");
+const buildNameOption = new Option("--build-name <string>", "Name of the build, in case you want to run multiple Snapvisor builds in a single CI job");
+const accountOption = new Option("--account <slug>", "Slug of the account (personal or team) that will own the project");
+const jsonOption = new Option("--json", "Output machine-readable JSON instead of human-readable text");
+const projectPathOption = new Option("--project <owner/project>", "Project path in owner/project format. Required for build-number references on review and comment commands");
+const changeProjectPathOption = new Option("--project <owner/project>", "Project the change belongs to, in owner/project format. Also ARGOS_PROJECT");
+const METRICS_PERIOD_BY_CHOICE = {
+	"24h": "LAST_24_HOURS",
+	"3d": "LAST_3_DAYS",
+	"7d": "LAST_7_DAYS",
+	"30d": "LAST_30_DAYS",
+	"90d": "LAST_90_DAYS"
+};
+const metricsPeriodOption = new Option("--metrics-period <period>", "Window over which test flakiness metrics are computed").choices(Object.keys(METRICS_PERIOD_BY_CHOICE)).default("7d");
+/** Map a `--metrics-period` choice to the value the API expects. */
+function toMetricsPeriod(choice) {
+	return METRICS_PERIOD_BY_CHOICE[choice] ?? "LAST_7_DAYS";
+}
+//#endregion
+//#region src/commands/upload.ts
+function uploadCommand(program) {
+	program.command("upload").argument("<directory>", "Directory to upload").description("Upload screenshots to Snapvisor").option("-f, --files <patterns...>", "One or more globs matching image file paths to upload", "**/*.{png,jpg,jpeg}").option("-i, --ignore <patterns...>", "One or more globs matching image file paths to ignore (ex: \"**/*.png **/diff.jpg\")").addOption(tokenOption).addOption(projectOption).addOption(buildNameOption).addOption(new Option("--mode <string>", "Mode of comparison applied. CI for visual regression testing, monitoring for visual monitoring.").default("ci").choices(["ci", "monitoring"])).addOption(new Option("--parallel", "Enable parallel mode. Run multiple Argos builds and combine them at the end.\nCan also be set via the ARGOS_PARALLEL environment variable.")).addOption(new Option("--parallel-total <number>", "The number of parallel nodes being ran")).addOption(parallelNonceOption).addOption(new Option("--parallel-index <number>", "The index of the parallel node being ran (must be at least 1)")).addOption(new Option("--reference-branch <string>", "Branch used as baseline for screenshot comparison")).addOption(new Option("--reference-commit <string>", "Commit used as baseline for screenshot comparison")).addOption(new Option("--threshold <number>", "Sensitivity threshold between 0 and 1. The higher the threshold, the less sensitive the diff will be. Default to 0.5")).addOption(new Option("--subset", "Whether this build contains only a subset of screenshots.\nThis is useful when a build is created from an incomplete test suite where some tests are skipped.\nCan also be set via the ARGOS_SUBSET environment variable.")).action(async (directory, options) => {
+		const spinner = ora("Uploading screenshots").start();
+		try {
+			const parallel = (() => {
+				if (!options.parallel) return;
+				if (!options.parallelNonce) {
+					spinner.fail("--parallel-nonce is required if --parallel is set");
+					process.exit(1);
+				}
+				if (!options.parallelTotal) {
+					spinner.fail("--parallel-total is required if --parallel is set");
+					process.exit(1);
+				}
+				return {
+					nonce: options.parallelNonce,
+					total: options.parallelTotal,
+					index: options.parallelIndex
+				};
+			})();
+			const result = await upload({
+				token: options.token,
+				project: options.project,
+				root: directory,
+				buildName: options.buildName,
+				files: options.files,
+				ignore: options.ignore,
+				parallel,
+				referenceBranch: options.referenceBranch,
+				referenceCommit: options.referenceCommit,
+				mode: options.mode,
+				threshold: options.threshold,
+				subset: options.subset
+			});
+			spinner.succeed(`Build created: ${result.build.url}`);
+		} catch (error) {
+			if (error instanceof Error) {
+				spinner.fail(`Build failed: ${error.message}`);
+				console.error(error.stack);
+			}
+			process.exit(1);
+		}
+	});
+}
+//#endregion
+//#region src/commands/finalize.ts
+const skipIfEmptyOption = new Option("--skip-if-empty", "Create a skipped build when no parallel build matches the nonce.\nUseful when uploads are conditional (e.g. skipped by a CI cache) and Argos is a required status check: the skipped build reports a success status even though nothing was uploaded.");
+function finalizeCommand(program) {
+	program.command("finalize").description("Finalize pending parallel builds").addOption(parallelNonceOption).addOption(tokenOption).addOption(skipIfEmptyOption).addOption(buildNameOption).action(async (options) => {
+		const spinner = ora("Finalizing builds").start();
+		try {
+			const result = await finalize({
+				token: options.token,
+				parallel: options.parallelNonce ? { nonce: options.parallelNonce } : void 0,
+				skipIfEmpty: options.skipIfEmpty,
+				buildName: options.buildName
+			});
+			spinner.succeed(result.skippedBuild ? `No builds to finalize — skipped build created: ${result.skippedBuild.url}` : result.builds.length === 0 ? "No builds to finalize" : `Builds finalized: ${result.builds.map((b) => b.url).join(", ")}`);
+		} catch (error) {
+			if (error instanceof Error) {
+				spinner.fail(`Failed to finalize: ${error.message}`);
+				console.error(error.stack);
+			}
+			process.exit(1);
+		}
+	});
+}
+//#endregion
+//#region src/commands/skip.ts
+function skipCommand(program) {
+	program.command("skip").description("Mark a build as skipped").addOption(tokenOption).addOption(buildNameOption).action(async (options) => {
+		const spinner = ora("Creating skipped build").start();
+		try {
+			const result = await skip({
+				token: options.token,
+				buildName: options.buildName
+			});
+			spinner.succeed(`Build created: ${result.build.url}`);
+		} catch (error) {
+			if (error instanceof Error) {
+				spinner.fail(`Build failed: ${error.message}`);
+				console.error(error.stack);
+			}
+			process.exit(1);
+		}
+	});
+}
+//#endregion
+//#region src/lib/api.ts
+/** Optional override for the API base URL (used in tests and dev). */
+function getApiBaseUrl() {
+	return process.env["ARGOS_API_BASE_URL"];
+}
+/** Create an Argos API client authenticated with the given token. */
+function createApiClient(authToken) {
+	return createClient({
+		authToken,
+		baseUrl: getApiBaseUrl()
+	});
+}
+/**
+* Unwrap an `openapi-fetch` result, returning its data or throwing a formatted
+* {@link APIError} when the request failed or returned an empty body.
+*/
+function unwrap(result) {
+	if (!result.response.ok) throwAPIError(result.error, result.response);
+	if (result.data === void 0 || result.data === null) throw new APIError("Unexpected empty response from API.", { status: result.response.status });
+	return result.data;
+}
+//#endregion
+//#region src/lib/format.ts
+/** Render a scalar, using `-` for empty values. */
+function formatValue(value) {
+	if (value === null || value === void 0 || value === "") return "-";
+	return String(value);
+}
+function formatUser(user) {
+	if (!user) return "-";
+	return user.name ? `${user.name} (@${user.slug})` : `@${user.slug}`;
+}
+function formatMe(me) {
+	const lines = [
+		`Logged in to Argos as ${formatValue(me.user.name)}.`,
+		`Name: ${formatValue(me.user.name)}`,
+		`Email: ${formatValue(me.user.email)}`
+	];
+	if (me.accounts.length > 0) lines.push(`Accounts: ${me.accounts.map((a) => `@${a.slug}`).join(", ")}`);
+	return lines.join("\n");
+}
+function formatProject(project) {
+	return [
+		`Created project ${project.account.slug}/${project.name}.`,
+		`ID: ${project.id}`,
+		`Name: ${project.name}`,
+		`Account: ${project.account.slug}`,
+		`Default base branch: ${formatValue(project.defaultBaseBranch)}`
+	].join("\n");
+}
+function formatStats(stats) {
+	if (!stats) return "-";
+	return [
+		`total ${stats.total}`,
+		`changed ${stats.changed}`,
+		`added ${stats.added}`,
+		`removed ${stats.removed}`,
+		`unchanged ${stats.unchanged}`
+	].join(", ");
+}
+const SNAPSHOT_STATUS_ORDER = [
+	"changed",
+	"added",
+	"removed",
+	"unchanged",
+	"ignored",
+	"pending",
+	"failure",
+	"retryFailure"
+];
+function formatSnapshotSummary(diffs) {
+	const counts = /* @__PURE__ */ new Map();
+	for (const diff of diffs) counts.set(diff.status, (counts.get(diff.status) ?? 0) + 1);
+	return SNAPSHOT_STATUS_ORDER.map((status) => {
+		const count = counts.get(status);
+		return count ? `${status} ${count}` : null;
+	}).filter((part) => Boolean(part)).join(", ");
+}
+function formatBuild(build) {
+	return [
+		`Build #${build.number}`,
+		`Status: ${build.status}`,
+		`Snapshots: ${formatStats(build.stats)}`,
+		`Conclusion: ${formatValue(build.conclusion)}`,
+		`Branch: ${formatValue(build.head?.branch)}`,
+		`Commit: ${formatValue(build.head?.sha)}`,
+		`Base branch: ${formatValue(build.base?.branch)}`,
+		`Base commit: ${formatValue(build.base?.sha)}`,
+		`URL: ${build.url}`
+	].join("\n");
+}
+/** Render a 0–1 metric to two decimals, or `-` when absent. */
+function formatRatio(value) {
+	return value === null || value === void 0 ? "-" : value.toFixed(2);
+}
+/** Compact one-line summary of a test's flakiness metrics. */
+function formatFlakiness(metrics) {
+	return `${formatRatio(metrics.flakiness)} (stability ${formatRatio(metrics.stability)}, consistency ${formatRatio(metrics.consistency)})`;
+}
+/** Human-readable lines for a single snapshot diff. */
+function formatSnapshotDiff(diff, build) {
+	const lines = [
+		`${diff.name} [${diff.status}]`,
+		`  Review: ${build.url}/${diff.id}`,
+		`  Mask: ${formatValue(diff.url)}`,
+		`  Base file: ${formatValue(diff.base?.url)}`,
+		`  Head file: ${formatValue(diff.head?.url)}`,
+		`  Score: ${formatValue(diff.score)}`,
+		`  Group: ${formatValue(diff.group)}`
+	];
+	if (diff.test) lines.push(`  Flakiness: ${formatFlakiness(diff.test.metrics)}`);
+	if (diff.change) {
+		const ignored = diff.change.ignored ? " [ignored]" : "";
+		lines.push(`  Change: ${diff.change.id}${ignored} · ${diff.change.occurrences} occurrences`);
+	}
+	return lines;
+}
+function formatSnapshots(diffs, build) {
+	if (diffs.length === 0) return "No snapshots found.";
+	return [
+		`Snapshots for build #${build.number}`,
+		`Count: ${diffs.length}`,
+		`Summary: ${formatSnapshotSummary(diffs)}`,
+		"",
+		...diffs.flatMap((diff) => [...formatSnapshotDiff(diff, build), ""])
+	].slice(0, -1).join("\n");
+}
+function formatChange(change) {
+	return [
+		`Change ${change.id}`,
+		`Ignored: ${change.ignored ? "yes" : "no"}`,
+		`Occurrences: ${change.occurrences}`
+	].join("\n");
+}
+function formatReview(review) {
+	const lines = [
+		`Review #${review.id}`,
+		`State: ${review.state}`,
+		`Author: ${formatUser(review.user)}`,
+		`Date: ${review.date}`
+	];
+	if (review.dismissedAt) lines.push(`Dismissed: ${review.dismissedAt} by ${formatUser(review.dismissedBy)}`);
+	return lines.join("\n");
+}
+function formatReviews(reviews) {
+	if (reviews.length === 0) return "No reviews found.";
+	return [
+		`Reviews (${reviews.length})`,
+		"",
+		...reviews.flatMap((review) => [
+			`#${review.id} [${review.state}${review.dismissedAt ? ", dismissed" : ""}]`,
+			`  Author: ${formatUser(review.user)}`,
+			`  Date: ${review.date}`,
+			""
+		])
+	].slice(0, -1).join("\n");
+}
+function formatAnalytics(analytics, context) {
+	const { screenshots, builds } = analytics;
+	const lines = [
+		`Analytics for ${context.account}`,
+		`Period: ${context.from} → ${context.to ?? "now"} (grouped by ${context.groupBy})`,
+		"",
+		`Builds: ${builds.all.total}`,
+		`  Changes detected: ${builds.all.changesDetected}`,
+		`  No changes: ${builds.all.noChanges}`,
+		`  Accepted: ${builds.all.accepted}`,
+		`  Rejected: ${builds.all.rejected}`,
+		`Screenshots: ${screenshots.all.total}`
+	];
+	const names = /* @__PURE__ */ new Map();
+	for (const project of [...builds.projects, ...screenshots.projects]) names.set(project.id, project.name);
+	const ids = /* @__PURE__ */ new Set([...Object.keys(builds.all.projects), ...Object.keys(screenshots.all.projects)]);
+	if (ids.size > 0) {
+		const rows = [...ids].map((id) => ({
+			name: names.get(id) ?? id,
+			builds: builds.all.projects[id] ?? 0,
+			screenshots: screenshots.all.projects[id] ?? 0
+		})).sort((a, b) => b.builds - a.builds || b.screenshots - a.screenshots);
+		lines.push("", `Projects (${rows.length}):`);
+		for (const row of rows) lines.push(`  ${row.name}: ${row.builds} builds, ${row.screenshots} screenshots`);
+	}
+	return lines.join("\n");
+}
+function indent(text) {
+	return text.split("\n").map((line) => `  ${line}`).join("\n");
+}
+function formatAnchor(anchor) {
+	if (!anchor) return null;
+	return anchor.type === "point" ? `point ${anchor.x},${anchor.y}` : `lines ${anchor.from}-${anchor.to}`;
+}
+function formatReactions(reactions) {
+	if (reactions.length === 0) return null;
+	return reactions.map((r) => `${r.emoji} ${r.count}`).join(" ");
+}
+function formatComment(comment) {
+	const lines = [`Comment #${comment.id}`, `Author: ${formatUser(comment.author)}`];
+	if (comment.threadId) lines.push(`Reply to: ${comment.threadId}`);
+	if (comment.screenshotDiffId) {
+		const anchor = formatAnchor(comment.anchor);
+		lines.push(`Diff: ${comment.screenshotDiffId}${anchor ? ` (${anchor})` : ""}`);
+	}
+	if (comment.pending) lines.push("Pending: draft (only visible to you)");
+	if (comment.resolvedAt) lines.push(`Resolved: ${comment.resolvedAt}`);
+	const reactions = formatReactions(comment.reactions);
+	if (reactions) lines.push(`Reactions: ${reactions}`);
+	lines.push(`Date: ${comment.createdAt}${comment.editedAt ? " (edited)" : ""}`);
+	lines.push("", indent(comment.text));
+	return lines.join("\n");
+}
+function formatComments(comments) {
+	if (comments.length === 0) return "No comments found.";
+	return [
+		`Comments (${comments.length})`,
+		"",
+		...comments.flatMap((comment) => {
+			const tags = [
+				comment.threadId ? "reply" : "thread",
+				comment.pending ? "draft" : null,
+				comment.resolvedAt ? "resolved" : null
+			].filter(Boolean);
+			return [
+				`#${comment.id} [${tags.join(", ")}] ${formatUser(comment.author)}`,
+				indent(comment.text),
+				""
+			];
+		})
+	].slice(0, -1).join("\n");
+}
+//#endregion
+//#region src/lib/cli-error.ts
+/**
+* Error whose message is meant to be shown to the user verbatim (prefixed with
+* `Error: `) before the CLI exits with a non-zero code. Throw it — via
+* {@link fail} — instead of calling `process.exit` directly so the failure can
+* be unit-tested and handled in a single place ({@link handleCliError}).
+*/
+var CliError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "CliError";
+	}
+};
+/**
+* Abort the current command with a user-facing message.
+*/
+function fail(message) {
+	throw new CliError(message);
+}
+//#endregion
+//#region src/lib/oauth.ts
+/**
+* OAuth 2.1 client configuration and helpers for the `argos login` flow
+* (Authorization Code + PKCE with a loopback redirect, RFC 8252).
+*
+* The authorization server is the Argos app origin; endpoints and token
+* validation are implemented in the main Argos repo (`apps/backend/src/oauth`).
+*/
+/** First-party public client id, seeded in the Argos database. */
+const OAUTH_CLIENT_ID = "argos-cli";
+/**
+* Scopes requested by `argos login`, covering the CLI's user actions (identity,
+* projects, reviews, comments). Build upload keeps using a project token.
+*/
+const OAUTH_SCOPES = [
+	"profile",
+	"projects:read",
+	"projects:write",
+	"reviews:write",
+	"comments:read",
+	"comments:write"
+];
+/** Refresh a bit early so a token never expires mid-request. */
+const EXPIRY_SKEW_MS = 60 * 1e3;
+function getAppBaseUrl() {
+	return process.env["ARGOS_APP_BASE_URL"] ?? "https://app.snapvisor.io/";
+}
+/**
+* A token endpoint request that reached the server and was rejected by it
+* (non-2xx / OAuth error), as opposed to a transient network failure. Lets
+* callers tell "your session is gone, log in again" from "the network is down".
+*/
+var OAuthTokenError = class extends Error {
+	code;
+	constructor(message, code) {
+		super(message);
+		this.code = code;
+		this.name = "OAuthTokenError";
+	}
+};
+function toTokenSet(data) {
+	return {
+		accessToken: data.access_token,
+		refreshToken: data.refresh_token,
+		expiresAt: Date.now() + data.expires_in * 1e3 - EXPIRY_SKEW_MS,
+		scope: data.scope ?? ""
+	};
+}
+/** Generate a PKCE `code_verifier` and its S256 `code_challenge`. */
+function generatePkce() {
+	const codeVerifier = randomBytes(32).toString("base64url");
+	return {
+		codeVerifier,
+		codeChallenge: createHash("sha256").update(codeVerifier).digest("base64url")
+	};
+}
+/** Build the `/oauth/authorize` URL to open in the browser. */
+function buildAuthorizeUrl(params) {
+	const url = new URL("/oauth/authorize", getAppBaseUrl());
+	url.searchParams.set("response_type", "code");
+	url.searchParams.set("client_id", OAUTH_CLIENT_ID);
+	url.searchParams.set("redirect_uri", params.redirectUri);
+	url.searchParams.set("scope", OAUTH_SCOPES.join(" "));
+	url.searchParams.set("state", params.state);
+	url.searchParams.set("code_challenge", params.codeChallenge);
+	url.searchParams.set("code_challenge_method", "S256");
+	return url.href;
+}
+async function postToken(body) {
+	const url = new URL("/oauth/token", getAppBaseUrl());
+	const response = await fetch(url, {
+		method: "POST",
+		headers: { "Content-Type": "application/x-www-form-urlencoded" },
+		body: new URLSearchParams(body).toString()
+	});
+	const data = await response.json().catch(() => null);
+	if (!response.ok || !data?.access_token) throw new OAuthTokenError(data?.error_description ?? data?.error ?? `HTTP ${response.status}`, data?.error);
+	if (typeof data.refresh_token !== "string" || data.refresh_token === "") throw new Error("Token endpoint response is missing a refresh token.");
+	if (typeof data.expires_in !== "number" || !Number.isFinite(data.expires_in)) throw new Error("Token endpoint response is missing a valid expiry.");
+	return data;
+}
+/** Exchange an authorization code for a token set (`grant_type=authorization_code`). */
+async function exchangeAuthorizationCode(params) {
+	return toTokenSet(await postToken({
+		grant_type: "authorization_code",
+		code: params.code,
+		redirect_uri: params.redirectUri,
+		client_id: OAUTH_CLIENT_ID,
+		code_verifier: params.codeVerifier
+	}));
+}
+/** Rotate a refresh token for a new token set (`grant_type=refresh_token`). */
+async function refreshTokenSet(refreshToken) {
+	return toTokenSet(await postToken({
+		grant_type: "refresh_token",
+		refresh_token: refreshToken,
+		client_id: OAUTH_CLIENT_ID
+	}));
+}
+/** Best-effort token revocation (RFC 7009); never throws. */
+async function revokeToken(token) {
+	const url = new URL("/oauth/revoke", getAppBaseUrl());
+	await fetch(url, {
+		method: "POST",
+		headers: { "Content-Type": "application/x-www-form-urlencoded" },
+		body: new URLSearchParams({
+			token,
+			client_id: OAUTH_CLIENT_ID
+		}).toString()
+	}).catch(() => {});
+}
+//#endregion
+//#region src/auth.ts
+function getConfigPaths() {
+	const configDir = resolve(homedir(), ".config", "argos-ci");
+	return {
+		configDir,
+		configPath: resolve(configDir, "config.json")
+	};
+}
+function parseOAuthTokenSet(value) {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) return;
+	const record = value;
+	if (typeof record.accessToken === "string" && typeof record.refreshToken === "string" && typeof record.expiresAt === "number") return {
+		accessToken: record.accessToken,
+		refreshToken: record.refreshToken,
+		expiresAt: record.expiresAt,
+		scope: typeof record.scope === "string" ? record.scope : ""
+	};
+}
+function parseConfig(raw) {
+	let parsed;
+	try {
+		parsed = JSON.parse(raw);
+	} catch {
+		return null;
+	}
+	if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) return null;
+	const record = parsed;
+	if ("token" in record && record.token !== void 0 && typeof record.token !== "string") return null;
+	const config = {};
+	if (typeof record.token === "string") config.token = record.token;
+	const oauth = parseOAuthTokenSet(record.oauth);
+	if (oauth) config.oauth = oauth;
+	return config;
+}
+async function clearConfig() {
+	const { configPath } = getConfigPaths();
+	try {
+		await unlink(configPath);
+	} catch {}
+}
+async function readConfig() {
+	const { configPath } = getConfigPaths();
+	try {
+		const config = parseConfig(await readFile(configPath, "utf8"));
+		if (config === null) {
+			console.warn("Warning: Config file is invalid and has been cleared. Run `argos login` again.");
+			await clearConfig();
+			return null;
+		}
+		return config;
+	} catch (err) {
+		if (err instanceof Error && err.code === "ENOENT") return null;
+		throw err;
+	}
+}
+async function writeConfig(config) {
+	const { configDir, configPath } = getConfigPaths();
+	await mkdir(configDir, { recursive: true });
+	const tmpPath = configPath + ".tmp";
+	await writeFile(tmpPath, JSON.stringify(config, null, 2), { mode: 384 });
+	await rename(tmpPath, configPath);
+}
+/** Persist the OAuth token set from a successful login or refresh. */
+async function saveOAuthTokens(tokens) {
+	await writeConfig({ oauth: tokens });
+}
+/**
+* Return a valid access token for API calls, or `undefined` when not logged in.
+* Transparently refreshes (and persists) an expired OAuth access token, and
+* falls back to a legacy personal access token when present.
+*/
+async function getAccessToken() {
+	const config = await readConfig();
+	if (!config) return;
+	if (config.oauth) {
+		if (Date.now() < config.oauth.expiresAt) return config.oauth.accessToken;
+		try {
+			const tokens = await refreshTokenSet(config.oauth.refreshToken);
+			await saveOAuthTokens(tokens);
+			return tokens.accessToken;
+		} catch (err) {
+			if (config.token) return config.token;
+			if (err instanceof OAuthTokenError) console.warn("Warning: Your Argos session has expired. Run `argos login` again.");
+			else console.warn("Warning: Could not reach Argos to refresh your session. Check your connection and try again.");
+			return;
+		}
+	}
+	return config.token;
+}
+/** Read the stored credentials without refreshing (used by `logout`). */
+async function getStoredCredentials() {
+	const config = await readConfig();
+	return {
+		legacyToken: config?.token,
+		oauth: config?.oauth
+	};
+}
+/** Remove all stored credentials. */
+async function clearStoredCredentials() {
+	await writeConfig({});
+}
+//#endregion
+//#region src/lib/build-reference.ts
+const BUILD_URL_REGEXP = /^https:\/\/app\.argos-ci\.(?:com|dev(?::\d+)?)\/(?<owner>[^/?#]+)\/(?<project>[^/?#]+)\/builds\/(?<buildNumber>\d+)(?:[/?#]|$)/;
+/**
+* Parse a build reference, accepting either a bare build number (`"1234"`) or a
+* full Argos build URL. Returns `null` when the input is neither.
+*/
+function parseBuildReference(reference) {
+	const asNumber = Number(reference);
+	if (Number.isInteger(asNumber) && asNumber > 0) return { buildNumber: asNumber };
+	const match = reference.match(BUILD_URL_REGEXP);
+	if (match?.groups) return {
+		owner: match.groups.owner,
+		project: match.groups.project,
+		buildNumber: Number(match.groups.buildNumber)
+	};
+	return null;
+}
+/**
+* Like {@link parseBuildReference} but aborts the command with a clear message
+* when the reference is invalid.
+*/
+function parseBuildReferenceOrFail(reference) {
+	const parsed = parseBuildReference(reference);
+	if (!parsed) fail(`Build reference must be a valid build number or Argos build URL (https://app.argos-ci.com/.../builds/<number>), got "${reference}".`);
+	return parsed;
+}
+//#endregion
+//#region src/lib/project.ts
+/**
+* Parse a `owner/project` slug. Returns `null` when it is not exactly two
+* non-empty segments.
+*/
+function parseProjectPath(slug) {
+	const parts = slug.split("/");
+	if (parts.length !== 2 || !parts[0] || !parts[1]) return null;
+	return {
+		owner: parts[0],
+		project: parts[1]
+	};
+}
+/**
+* Like {@link parseProjectPath} but aborts the command on an invalid slug.
+*/
+function parseProjectPathOrFail(slug) {
+	const parsed = parseProjectPath(slug);
+	if (!parsed) fail("--project must be in the format 'owner/project'.");
+	return parsed;
+}
+//#endregion
+//#region src/lib/target.ts
+/**
+* Resolve the API token, preferring an explicit token (`--token` /
+* `ARGOS_TOKEN`) over the one stored by `argos login`.
+*/
+async function resolveToken(options) {
+	const token = options.token || process.env["ARGOS_TOKEN"] || await getAccessToken();
+	if (!token) fail("No Argos token found. Use --token, set ARGOS_TOKEN, or run `argos login`.");
+	return token;
+}
+function explicitProjectPath(reference, options) {
+	if (reference.owner && reference.project) return {
+		owner: reference.owner,
+		project: reference.project
+	};
+	const project = options.project || process.env["ARGOS_PROJECT"];
+	if (project) return parseProjectPathOrFail(project);
+	return null;
+}
+/**
+* Resolve a build reference into a ready-to-use {@link BuildTarget}: an
+* authenticated client and the `owner`, `project` and `buildNumber` needed by
+* every build-scoped endpoint.
+*/
+async function resolveBuildTarget(reference, options, { auth }) {
+	const parsed = parseBuildReferenceOrFail(reference);
+	const buildNumber = String(parsed.buildNumber);
+	const client = createApiClient(await resolveToken(options));
+	if (auth === "user") {
+		const projectPath = explicitProjectPath(parsed, options);
+		if (!projectPath) fail("--project <owner/project> is required for build-number references.");
+		return {
+			client,
+			...projectPath,
+			buildNumber
+		};
+	}
+	const projectPath = explicitProjectPath(parsed, options);
+	if (projectPath) return {
+		client,
+		...projectPath,
+		buildNumber
+	};
+	const project = unwrap(await client.GET("/project"));
+	return {
+		client,
+		owner: project.account.slug,
+		project: project.name,
+		buildNumber
+	};
+}
+/**
+* Resolve a project-scoped command target: an authenticated client and the
+* `owner`/`project` pair every project endpoint needs. The project path comes
+* from `--project owner/project` or the `ARGOS_PROJECT` environment variable.
+*/
+async function resolveProjectTarget(options) {
+	const client = createApiClient(await resolveToken(options));
+	const projectPath = options.project || process.env["ARGOS_PROJECT"];
+	if (!projectPath) fail("--project <owner/project> is required. Pass it or set ARGOS_PROJECT.");
+	return {
+		client,
+		...parseProjectPathOrFail(projectPath)
+	};
+}
+//#endregion
+//#region src/lib/run.ts
+const USER_AUTH_HINT = "Ensure your token is a personal access token with access to this project. Project tokens (ARGOS_TOKEN in CI) can read build data but cannot perform review or comment actions.";
+/**
+* Print an error and exit. {@link CliError} and {@link APIError} messages are
+* shown as-is; permission failures on user-authenticated commands get an extra
+* hint about token types.
+*/
+function handleCliError(error, auth) {
+	let message;
+	if (error instanceof CliError || error instanceof APIError) {
+		message = error.message;
+		if (auth === "user" && error instanceof APIError && (error.status === 401 || error.status === 403)) message += `\n${USER_AUTH_HINT}`;
+	} else if (error instanceof Error) message = error.message;
+	else message = String(error);
+	console.error(`Error: ${message}`);
+	process.exit(1);
+}
+/** Print a command result as pretty JSON or human-readable text. */
+function output(data, options, format) {
+	console.log(options.json ? JSON.stringify(data, null, 2) : format(data));
+}
+/**
+* Run a build-scoped command end to end: resolve the build target, run the
+* handler, print the result, and turn any failure into a clean CLI error.
+*/
+async function runBuildAction(opts) {
+	try {
+		const target = await resolveBuildTarget(opts.reference, opts.options, { auth: opts.auth });
+		output(await opts.handler(target), opts.options, opts.format);
+	} catch (error) {
+		handleCliError(error, opts.auth);
+	}
+}
+//#endregion
+//#region src/commands/build/get.ts
+function registerBuildGet(build) {
+	build.command("get").description("Fetch build metadata").argument("<buildReference>", "Build number or Argos build URL").addOption(tokenOption).addOption(jsonOption).action((reference, options) => runBuildAction({
+		reference,
+		options,
+		auth: "project",
+		handler: async ({ client, owner, project, buildNumber }) => unwrap(await client.GET("/projects/{owner}/{project}/builds/{buildNumber}", { params: { path: {
+			owner,
+			project,
+			buildNumber
+		} } })),
+		format: formatBuild
+	}));
+}
+//#endregion
+//#region src/commands/build/snapshots.ts
+const PER_PAGE = 100;
+function isBuildPending(build) {
+	return build.status === "pending" || build.status === "progress";
+}
+async function fetchBuild(target) {
+	const { client, owner, project, buildNumber } = target;
+	return unwrap(await client.GET("/projects/{owner}/{project}/builds/{buildNumber}", { params: { path: {
+		owner,
+		project,
+		buildNumber
+	} } }));
+}
+/** Fetch every diff of a build, following pagination. */
+async function fetchAllDiffs(target, options) {
+	const { client, owner, project, buildNumber } = target;
+	const results = [];
+	for (let page = 1;; page++) {
+		const data = unwrap(await client.GET("/projects/{owner}/{project}/builds/{buildNumber}/diffs", { params: {
+			path: {
+				owner,
+				project,
+				buildNumber
+			},
+			query: {
+				page: String(page),
+				perPage: String(PER_PAGE),
+				metricsPeriod: options.metricsPeriod,
+				...options.needsReview ? { needsReview: "true" } : {}
+			}
+		} }));
+		results.push(...data.results);
+		if (results.length >= data.pageInfo.total || data.results.length === 0) break;
+	}
+	return results;
+}
+function registerBuildSnapshots(build) {
+	build.command("snapshots").description("Fetch snapshot diffs for a build").argument("<buildReference>", "Build number or Argos build URL").addOption(new Option("--needs-review", "Only include snapshot diffs that require review")).addOption(metricsPeriodOption).addOption(tokenOption).addOption(jsonOption).action(async (reference, options) => {
+		try {
+			const target = await resolveBuildTarget(reference, options, { auth: "project" });
+			const build = await fetchBuild(target);
+			if (isBuildPending(build)) {
+				const message = `Build #${build.number} is still processing (${build.status}). Try again in a moment.`;
+				if (options.json) {
+					console.error(`Error: ${message}`);
+					process.exit(1);
+				}
+				console.log(message);
+				return;
+			}
+			output(await fetchAllDiffs(target, {
+				needsReview: Boolean(options.needsReview),
+				metricsPeriod: toMetricsPeriod(options.metricsPeriod)
+			}), options, (data) => formatSnapshots(data, build));
+		} catch (error) {
+			handleCliError(error, "project");
+		}
+	});
+}
+//#endregion
+//#region src/commands/build/index.ts
+function buildCommand(program) {
+	const build = program.command("build").description("Inspect Snapvisor builds");
+	registerBuildGet(build);
+	registerBuildSnapshots(build);
+}
+//#endregion
+//#region src/lib/body.ts
+/**
+* Resolve the Markdown body of a comment or review from the mutually-exclusive
+* `--body` (inline) and `--body-file` (path) options.
+*
+* The Argos API also accepts a rich-text JSON document, but that form is only
+* needed for `@mentions` (which require user ids); the CLI exposes Markdown
+* only, which the API converts server-side.
+*/
+async function resolveBody(options, { required = false } = {}) {
+	const { body, bodyFile } = options;
+	if (body !== void 0 && bodyFile !== void 0) fail("Use either --body or --body-file, not both.");
+	if (body !== void 0) return body;
+	if (bodyFile !== void 0) try {
+		return await readFile(bodyFile, "utf8");
+	} catch (error) {
+		fail(`Failed to read --body-file "${bodyFile}": ${error instanceof Error ? error.message : String(error)}`);
+	}
+	if (required) fail("A comment body is required. Use --body <markdown> or --body-file <path>.");
+}
+//#endregion
+//#region src/commands/review/create.ts
+const events = {
+	approve: "APPROVE",
+	reject: "REJECT",
+	comment: "COMMENT"
+};
+function registerReviewCreate(review) {
+	review.command("create").description("Submit a review on a build").argument("<buildReference>", "Build number or Argos build URL").addOption(new Option("--event <event>", "Review event to apply to the build").choices(Object.keys(events)).makeOptionMandatory()).option("--body <markdown>", "Markdown comment to attach to the review").option("--body-file <path>", "Read the review comment from a Markdown file").addOption(tokenOption).addOption(projectPathOption).addOption(jsonOption).action((reference, options) => runBuildAction({
+		reference,
+		options,
+		auth: "user",
+		handler: async ({ client, owner, project, buildNumber }) => {
+			const body = await resolveBody(options);
+			return unwrap(await client.POST("/projects/{owner}/{project}/builds/{buildNumber}/reviews", {
+				params: { path: {
+					owner,
+					project,
+					buildNumber
+				} },
+				body: {
+					event: events[options.event],
+					body
+				}
+			}));
+		},
+		format: formatReview
+	}));
+}
+//#endregion
+//#region src/commands/review/dismiss.ts
+function registerReviewDismiss(review) {
+	review.command("dismiss").description("Dismiss a submitted review on a build").argument("<buildReference>", "Build number or Argos build URL").argument("<reviewId>", "ID of the review to dismiss").addOption(tokenOption).addOption(projectPathOption).addOption(jsonOption).action((reference, reviewId, options) => runBuildAction({
+		reference,
+		options,
+		auth: "user",
+		handler: async ({ client, owner, project, buildNumber }) => unwrap(await client.POST("/projects/{owner}/{project}/builds/{buildNumber}/reviews/{reviewId}/dismiss", { params: { path: {
+			owner,
+			project,
+			buildNumber,
+			reviewId
+		} } })),
+		format: formatReview
+	}));
+}
+//#endregion
+//#region src/commands/review/list.ts
+function registerReviewList(review) {
+	review.command("list").description("List the reviews submitted on a build").argument("<buildReference>", "Build number or Argos build URL").addOption(tokenOption).addOption(projectPathOption).addOption(jsonOption).action((reference, options) => runBuildAction({
+		reference,
+		options,
+		auth: "user",
+		handler: async ({ client, owner, project, buildNumber }) => unwrap(await client.GET("/projects/{owner}/{project}/builds/{buildNumber}/reviews", { params: { path: {
+			owner,
+			project,
+			buildNumber
+		} } })),
+		format: formatReviews
+	}));
+}
+//#endregion
+//#region src/commands/review/index.ts
+function reviewCommand(program) {
+	const review = program.command("review").description("List, submit, and dismiss build reviews");
+	registerReviewList(review);
+	registerReviewCreate(review);
+	registerReviewDismiss(review);
+}
+//#endregion
+//#region src/lib/anchor.ts
+function parsePair(value) {
+	const parts = value.split(",").map((part) => Number(part.trim()));
+	if (parts.length !== 2 || parts.some((part) => Number.isNaN(part))) return null;
+	return [parts[0], parts[1]];
+}
+/**
+* Build a comment anchor from the mutually-exclusive `--anchor-point` and
+* `--anchor-lines` options. Returns `undefined` when neither is provided.
+*/
+function parseAnchor(options) {
+	const { anchorPoint, anchorLines } = options;
+	if (anchorPoint && anchorLines) fail("Use either --anchor-point or --anchor-lines, not both.");
+	if (anchorPoint) {
+		const pair = parsePair(anchorPoint);
+		if (!pair) fail("--anchor-point must be two numbers, e.g. --anchor-point 0.5,0.5.");
+		const [x, y] = pair;
+		if (x < 0 || x > 1 || y < 0 || y > 1) fail("--anchor-point coordinates must be normalized between 0 and 1.");
+		return {
+			type: "point",
+			x,
+			y
+		};
+	}
+	if (anchorLines) {
+		const pair = parsePair(anchorLines);
+		if (!pair) fail("--anchor-lines must be two numbers, e.g. --anchor-lines 10,20.");
+		const [from, to] = pair;
+		if (!Number.isInteger(from) || !Number.isInteger(to) || from < 1 || to < from) fail("--anchor-lines must be a 1-based range where from <= to.");
+		return {
+			type: "lines",
+			from,
+			to
+		};
+	}
+}
+//#endregion
+//#region src/commands/comment/create.ts
+function registerCommentCreate(comment) {
+	comment.command("create").description("Post a comment (or reply) on a build").argument("<buildReference>", "Build number or Argos build URL").option("--body <markdown>", "Markdown body of the comment").option("--body-file <path>", "Read the comment body from a Markdown file").option("--reply-to <threadId>", "Reply to an existing thread (its root comment ID)").option("--diff <screenshotDiffId>", "Anchor the comment to a screenshot diff").option("--anchor-point <x,y>", "Point on the diff in normalized 0-1 coordinates (requires --diff)").option("--anchor-lines <from,to>", "1-based inclusive line range on the diff (requires --diff)").option("--draft", "Attach to your pending review instead of posting immediately").addOption(tokenOption).addOption(projectPathOption).addOption(jsonOption).action((reference, options) => runBuildAction({
+		reference,
+		options,
+		auth: "user",
+		handler: async ({ client, owner, project, buildNumber }) => {
+			const body = await resolveBody(options, { required: true });
+			const anchor = parseAnchor(options);
+			if (anchor && !options.diff) fail("--anchor-point and --anchor-lines require --diff <screenshotDiffId>.");
+			return unwrap(await client.POST("/projects/{owner}/{project}/builds/{buildNumber}/comments", {
+				params: { path: {
+					owner,
+					project,
+					buildNumber
+				} },
+				body: {
+					body,
+					threadId: options.replyTo,
+					screenshotDiffId: options.diff,
+					anchor,
+					addToReview: options.draft
+				}
+			}));
+		},
+		format: formatComment
+	}));
+}
+//#endregion
+//#region src/commands/comment/_action.ts
+/**
+* Register a `comment <name> <buildReference> <commentId>` command that runs
+* `perform` and prints the returned comment. Used for the single-comment
+* actions that share the same shape (get, delete, resolve, subscribe, …).
+*/
+function defineCommentAction(opts) {
+	return (comment) => {
+		comment.command(opts.name).description(opts.description).argument("<buildReference>", "Build number or Argos build URL").argument("<commentId>", "ID of the comment").addOption(tokenOption).addOption(projectPathOption).addOption(jsonOption).action((reference, commentId, options) => runBuildAction({
+			reference,
+			options,
+			auth: "user",
+			handler: ({ client, owner, project, buildNumber }) => opts.perform({
+				client,
+				owner,
+				project,
+				buildNumber,
+				commentId
+			}),
+			format: formatComment
+		}));
+	};
+}
+//#endregion
+//#region src/commands/comment/delete.ts
+const registerCommentDelete = defineCommentAction({
+	name: "delete",
+	description: "Delete a comment on a build (author only)",
+	perform: async ({ client, owner, project, buildNumber, commentId }) => unwrap(await client.DELETE("/projects/{owner}/{project}/builds/{buildNumber}/comments/{commentId}", { params: { path: {
+		owner,
+		project,
+		buildNumber,
+		commentId
+	} } }))
+});
+//#endregion
+//#region src/commands/comment/edit.ts
+function registerCommentEdit(comment) {
+	comment.command("edit").description("Update the body of a comment (author only)").argument("<buildReference>", "Build number or Argos build URL").argument("<commentId>", "ID of the comment").option("--body <markdown>", "New Markdown body of the comment").option("--body-file <path>", "Read the new body from a Markdown file").addOption(tokenOption).addOption(projectPathOption).addOption(jsonOption).action((reference, commentId, options) => runBuildAction({
+		reference,
+		options,
+		auth: "user",
+		handler: async ({ client, owner, project, buildNumber }) => {
+			const body = await resolveBody(options, { required: true });
+			return unwrap(await client.PATCH("/projects/{owner}/{project}/builds/{buildNumber}/comments/{commentId}", {
+				params: { path: {
+					owner,
+					project,
+					buildNumber,
+					commentId
+				} },
+				body: { body }
+			}));
+		},
+		format: formatComment
+	}));
+}
+//#endregion
+//#region src/commands/comment/get.ts
+const registerCommentGet = defineCommentAction({
+	name: "get",
+	description: "Fetch a single comment on a build",
+	perform: async ({ client, owner, project, buildNumber, commentId }) => unwrap(await client.GET("/projects/{owner}/{project}/builds/{buildNumber}/comments/{commentId}", { params: { path: {
+		owner,
+		project,
+		buildNumber,
+		commentId
+	} } }))
+});
+//#endregion
+//#region src/commands/comment/list.ts
+function registerCommentList(comment) {
+	comment.command("list").description("List the comments on a build").argument("<buildReference>", "Build number or Argos build URL").addOption(tokenOption).addOption(projectPathOption).addOption(jsonOption).action((reference, options) => runBuildAction({
+		reference,
+		options,
+		auth: "user",
+		handler: async ({ client, owner, project, buildNumber }) => unwrap(await client.GET("/projects/{owner}/{project}/builds/{buildNumber}/comments", { params: { path: {
+			owner,
+			project,
+			buildNumber
+		} } })),
+		format: formatComments
+	}));
+}
+//#endregion
+//#region src/commands/comment/react.ts
+function registerCommentReact(comment) {
+	comment.command("react").description("Add an emoji reaction to a comment").argument("<buildReference>", "Build number or Argos build URL").argument("<commentId>", "ID of the comment").argument("<emoji>", "Emoji to react with").addOption(tokenOption).addOption(projectPathOption).addOption(jsonOption).action((reference, commentId, emoji, options) => runBuildAction({
+		reference,
+		options,
+		auth: "user",
+		handler: async ({ client, owner, project, buildNumber }) => unwrap(await client.POST("/projects/{owner}/{project}/builds/{buildNumber}/comments/{commentId}/reactions", {
+			params: { path: {
+				owner,
+				project,
+				buildNumber,
+				commentId
+			} },
+			body: { emoji }
+		})),
+		format: formatComment
+	}));
+}
+//#endregion
+//#region src/commands/comment/resolve.ts
+const registerCommentResolve = defineCommentAction({
+	name: "resolve",
+	description: "Mark a comment thread as resolved",
+	perform: async ({ client, owner, project, buildNumber, commentId }) => unwrap(await client.POST("/projects/{owner}/{project}/builds/{buildNumber}/comments/{commentId}/resolve", { params: { path: {
+		owner,
+		project,
+		buildNumber,
+		commentId
+	} } }))
+});
+//#endregion
+//#region src/commands/comment/subscribe.ts
+const registerCommentSubscribe = defineCommentAction({
+	name: "subscribe",
+	description: "Subscribe to a comment thread's notifications",
+	perform: async ({ client, owner, project, buildNumber, commentId }) => unwrap(await client.POST("/projects/{owner}/{project}/builds/{buildNumber}/comments/{commentId}/subscription", { params: { path: {
+		owner,
+		project,
+		buildNumber,
+		commentId
+	} } }))
+});
+//#endregion
+//#region src/commands/comment/unreact.ts
+function registerCommentUnreact(comment) {
+	comment.command("unreact").description("Remove one of your emoji reactions from a comment").argument("<buildReference>", "Build number or Argos build URL").argument("<commentId>", "ID of the comment").argument("<emoji>", "Emoji reaction to remove").addOption(tokenOption).addOption(projectPathOption).addOption(jsonOption).action((reference, commentId, emoji, options) => runBuildAction({
+		reference,
+		options,
+		auth: "user",
+		handler: async ({ client, owner, project, buildNumber }) => unwrap(await client.DELETE("/projects/{owner}/{project}/builds/{buildNumber}/comments/{commentId}/reactions", { params: {
+			path: {
+				owner,
+				project,
+				buildNumber,
+				commentId
+			},
+			query: { emoji }
+		} })),
+		format: formatComment
+	}));
+}
+//#endregion
+//#region src/commands/comment/unresolve.ts
+const registerCommentUnresolve = defineCommentAction({
+	name: "unresolve",
+	description: "Reopen a resolved comment thread",
+	perform: async ({ client, owner, project, buildNumber, commentId }) => unwrap(await client.POST("/projects/{owner}/{project}/builds/{buildNumber}/comments/{commentId}/unresolve", { params: { path: {
+		owner,
+		project,
+		buildNumber,
+		commentId
+	} } }))
+});
+//#endregion
+//#region src/commands/comment/unsubscribe.ts
+const registerCommentUnsubscribe = defineCommentAction({
+	name: "unsubscribe",
+	description: "Unsubscribe from a comment thread's notifications",
+	perform: async ({ client, owner, project, buildNumber, commentId }) => unwrap(await client.DELETE("/projects/{owner}/{project}/builds/{buildNumber}/comments/{commentId}/subscription", { params: { path: {
+		owner,
+		project,
+		buildNumber,
+		commentId
+	} } }))
+});
+//#endregion
+//#region src/commands/comment/index.ts
+function commentCommand(program) {
+	const comment = program.command("comment").description("List, post, and act on build comments");
+	registerCommentList(comment);
+	registerCommentCreate(comment);
+	registerCommentGet(comment);
+	registerCommentEdit(comment);
+	registerCommentDelete(comment);
+	registerCommentResolve(comment);
+	registerCommentUnresolve(comment);
+	registerCommentReact(comment);
+	registerCommentUnreact(comment);
+	registerCommentSubscribe(comment);
+	registerCommentUnsubscribe(comment);
+}
+//#endregion
+//#region src/commands/login.ts
+const LOGIN_CLI_SUCCESS_ROUTE = `/auth/cli/success`;
+const LOGIN_TIMEOUT_MS = 300 * 1e3;
+const CALLBACK_ERROR_HTML = `<!DOCTYPE html><html lang="en">
+  <head>
+    <meta charset="UTF-8">
+    <title>Argos CLI</title>
+  </head>
+  <body>
+    <p>Authorization failed. Please run <code>argos login</code> again.</p>
+  </body>
+</html>`;
+function color(text, code, isTTY) {
+	if (!isTTY || process.env["NO_COLOR"]) return text;
+	return `\x1b[${code}m${text}\x1b[0m`;
+}
+const successColor = (text) => color(text, 32, process.stdout.isTTY);
+const warningColor = (text) => color(text, 33, process.stderr.isTTY);
+const errorColor = (text) => color(text, 31, process.stderr.isTTY);
+function startCallbackServer() {
+	return new Promise((resolve, reject) => {
+		let resolveCallback = () => {};
+		let rejectCallback = () => {};
+		let timeout;
+		const callbackPromise = new Promise((res, rej) => {
+			resolveCallback = res;
+			rejectCallback = rej;
+		});
+		const closeServer = () => {
+			if (timeout) clearTimeout(timeout);
+			server.close();
+			server.closeAllConnections();
+		};
+		const server = createServer((req, res) => {
+			const url = new URL(req.url ?? "/", "http://127.0.0.1");
+			if (url.pathname !== "/callback") {
+				res.writeHead(404, { Connection: "close" });
+				res.end();
+				return;
+			}
+			const callbackError = url.searchParams.get("error");
+			const callbackErrorDescription = url.searchParams.get("error_description");
+			const code = url.searchParams.get("code");
+			const state = url.searchParams.get("state");
+			if (callbackError) {
+				const message = callbackErrorDescription ?? callbackError;
+				res.writeHead(400, {
+					"Content-Type": "text/html; charset=utf-8",
+					Connection: "close"
+				});
+				res.end(CALLBACK_ERROR_HTML, () => {
+					closeServer();
+					rejectCallback(new Error(message));
+				});
+				return;
+			}
+			if (!code || !state) {
+				res.writeHead(400, {
+					"Content-Type": "text/html; charset=utf-8",
+					Connection: "close"
+				});
+				res.end(CALLBACK_ERROR_HTML, () => {
+					closeServer();
+					rejectCallback(/* @__PURE__ */ new Error("Missing code or state in callback"));
+				});
+				return;
+			}
+			res.writeHead(302, {
+				Location: new URL(LOGIN_CLI_SUCCESS_ROUTE, getAppBaseUrl()).href,
+				Connection: "close"
+			});
+			res.end(() => {
+				closeServer();
+				resolveCallback({
+					code,
+					state
+				});
+			});
+		});
+		server.on("error", reject);
+		server.listen(0, "127.0.0.1", () => {
+			const { port } = server.address();
+			timeout = setTimeout(() => {
+				closeServer();
+				rejectCallback(/* @__PURE__ */ new Error("Authentication timed out"));
+			}, LOGIN_TIMEOUT_MS);
+			timeout.unref();
+			resolve({
+				port,
+				waitForCallback: () => callbackPromise
+			});
+		});
+	});
+}
+function loginCommand(program) {
+	program.command("login").description("Log in to Snapvisor by opening your browser").action(async () => {
+		const state = randomBytes(16).toString("hex");
+		const { codeVerifier, codeChallenge } = generatePkce();
+		let port;
+		let waitForCallback;
+		try {
+			({port, waitForCallback} = await startCallbackServer());
+		} catch (err) {
+			console.error(errorColor("Error: Failed to start local callback server."));
+			console.error(err);
+			process.exit(1);
+		}
+		const redirectUri = `http://127.0.0.1:${port}/callback`;
+		const authorizeUrl = buildAuthorizeUrl({
+			redirectUri,
+			state,
+			codeChallenge
+		});
+		console.log("\nOpening browser for authentication…");
+		console.log(`If the browser doesn't open, visit:\n  ${authorizeUrl}\n`);
+		if (process.env["ARGOS_CLI_DISABLE_BROWSER"] !== "1") await open(authorizeUrl).catch((err) => {
+			console.warn(warningColor(`Warning: Failed to open browser — ${err instanceof Error ? err.message : String(err)}`));
+			console.log("Hint: Open the URL above manually to continue authentication.");
+		});
+		let result;
+		try {
+			result = await waitForCallback();
+		} catch (err) {
+			console.error(errorColor(err instanceof Error ? `Error: ${err.message}. Please run \`argos login\` again.` : "Error: Authorization failed or was cancelled."));
+			process.exit(1);
+		}
+		if (result.state !== state) {
+			console.error(errorColor("Error: State mismatch. Try logging in again."));
+			process.exit(1);
+		}
+		try {
+			await saveOAuthTokens(await exchangeAuthorizationCode({
+				code: result.code,
+				codeVerifier,
+				redirectUri
+			}));
+		} catch (err) {
+			console.error(errorColor(`Error: Authentication failed${err instanceof Error ? ` — ${err.message}` : ""}. Please run \`argos login\` again.`));
+			process.exit(1);
+		}
+		console.log(successColor("Logged in to Argos successfully."));
+	});
+}
+//#endregion
+//#region src/commands/logout.ts
+function logoutCommand(program) {
+	program.command("logout").description("Log out from Snapvisor").action(async () => {
+		const { legacyToken, oauth } = await getStoredCredentials();
+		if (!legacyToken && !oauth) {
+			console.log("No token found. You are already logged out.");
+			return;
+		}
+		if (oauth) await revokeToken(oauth.refreshToken);
+		await clearStoredCredentials();
+		console.log("Logged out from Argos.");
+	});
+}
+//#endregion
+//#region src/commands/deploy.ts
+function deployCommand(program) {
+	program.command("deploy").argument("<directory>", "Directory of the static build to deploy").description("Deploy a static build (Storybook or any static site) to Snapvisor").addOption(tokenOption).addOption(new Option("--prod", "Deploy as a production deployment").default(false)).action(async (directory, options) => {
+		const spinner = ora("Deploying").start();
+		try {
+			const result = await deploy({
+				token: options.token,
+				root: resolve(directory),
+				environment: options.prod ? "production" : void 0
+			});
+			spinner.succeed(`Deployed: ${result.url}`);
+		} catch (error) {
+			if (error instanceof Error) {
+				spinner.fail(`Deploy failed: ${error.message}`);
+				console.error(error.stack);
+			}
+			process.exit(1);
+		}
+	});
+}
+//#endregion
+//#region src/commands/whoami.ts
+function whoamiCommand(program) {
+	program.command("whoami").description("Display the user authenticated with the current Snapvisor token").addOption(tokenOption).addOption(jsonOption).action(async (options) => {
+		try {
+			output(unwrap(await createApiClient(await resolveToken(options)).GET("/me")), options, formatMe);
+		} catch (error) {
+			handleCliError(error, "user");
+		}
+	});
+}
+//#endregion
+//#region src/commands/create-project.ts
+function createProjectCommand(program) {
+	program.command("create-project").argument("<name>", "Name of the project to create").description("Create a new project in an account you administer").addOption(accountOption).addOption(tokenOption).addOption(jsonOption).action(async (name, options) => {
+		try {
+			const accountSlug = options.account || process.env["ARGOS_ACCOUNT"];
+			if (!accountSlug) fail("An account is required. Use --account <slug> or set ARGOS_ACCOUNT.");
+			output(unwrap(await createApiClient(await resolveToken(options)).POST("/projects", { body: {
+				name,
+				accountSlug
+			} })), options, formatProject);
+		} catch (error) {
+			handleCliError(error, "user");
+		}
+	});
+}
+//#endregion
+//#region src/commands/analytics.ts
+const DEFAULT_PERIOD_DAYS = 30;
+const DAY_MS = 1440 * 60 * 1e3;
+/** Coerce a user-supplied date into an ISO 8601 datetime, or fail cleanly. */
+function toIsoOrFail(value, option) {
+	const date = new Date(value);
+	if (Number.isNaN(date.getTime())) fail(`Invalid --${option} value: "${value}". Use an ISO 8601 datetime.`);
+	return date.toISOString();
+}
+/** Collect a repeatable `--project` flag into an array of project names. */
+function collectProject(value, previous = []) {
+	return [...previous, value];
+}
+function analyticsCommand(program) {
+	program.command("analytics").description("Fetch build and screenshot analytics for an account").option("--account <slug>", "Slug of the account (personal or team) to fetch analytics for").option("--from <datetime>", `Start of the analytics period (ISO 8601). Defaults to ${DEFAULT_PERIOD_DAYS} days ago.`).option("--to <datetime>", "End of the analytics period (ISO 8601). Defaults to now.").addOption(new Option("--group-by <period>", "Time period used to group each series data point").choices([
+		"day",
+		"week",
+		"month"
+	]).default("day")).option("--project <name>", "Filter by project name. Repeat the flag to include multiple projects.", collectProject).addOption(tokenOption).addOption(jsonOption).action(async (options) => {
+		try {
+			const accountSlug = options.account || process.env["ARGOS_ACCOUNT"];
+			if (!accountSlug) fail("An account is required. Use --account <slug> or set ARGOS_ACCOUNT.");
+			const from = options.from ? toIsoOrFail(options.from, "from") : (/* @__PURE__ */ new Date(Date.now() - DEFAULT_PERIOD_DAYS * DAY_MS)).toISOString();
+			const to = options.to ? toIsoOrFail(options.to, "to") : void 0;
+			output(unwrap(await createApiClient(await resolveToken({ token: options.token })).GET("/accounts/{accountSlug}/analytics", { params: {
+				path: { accountSlug },
+				query: {
+					from,
+					to,
+					groupBy: options.groupBy,
+					projectNames: options.project
+				}
+			} })), options, (data) => formatAnalytics(data, {
+				account: accountSlug,
+				from,
+				to,
+				groupBy: options.groupBy
+			}));
+		} catch (error) {
+			handleCliError(error, "user");
+		}
+	});
+}
+//#endregion
+//#region src/commands/change/_action.ts
+/**
+* Register a `change <name> <changeId>` command that runs `perform` and prints
+* the updated change. Both change actions (ignore, unignore) share the same
+* shape and differ only by the endpoint they hit. They act as a user, so they
+* need a personal access token, and the project comes from `--project` or
+* `ARGOS_PROJECT` since a change id does not carry the account slug.
+*/
+function defineChangeAction(opts) {
+	return (change) => {
+		change.command(opts.name).description(opts.description).argument("<changeId>", "Change ID, taken from a diff's `change.id` (see `argos build snapshots`)").addOption(tokenOption).addOption(changeProjectPathOption).addOption(metricsPeriodOption).addOption(jsonOption).action(async (changeId, options) => {
+			try {
+				const { client, owner, project } = await resolveProjectTarget(options);
+				output(await opts.perform({
+					client,
+					owner,
+					project,
+					changeId,
+					metricsPeriod: toMetricsPeriod(options.metricsPeriod)
+				}), options, formatChange);
+			} catch (error) {
+				handleCliError(error, "user");
+			}
+		});
+	};
+}
+//#endregion
+//#region src/commands/change/ignore.ts
+const registerChangeIgnore = defineChangeAction({
+	name: "ignore",
+	description: "Ignore a flaky test change so its diffs stop requiring review and are auto-approved on future builds",
+	perform: async ({ client, owner, project, changeId, metricsPeriod }) => unwrap(await client.POST("/projects/{owner}/{project}/changes/{changeId}/ignore", { params: {
+		path: {
+			owner,
+			project,
+			changeId
+		},
+		query: { metricsPeriod }
+	} }))
+});
+//#endregion
+//#region src/commands/change/unignore.ts
+const registerChangeUnignore = defineChangeAction({
+	name: "unignore",
+	description: "Stop ignoring a test change so its diffs require review again on future builds",
+	perform: async ({ client, owner, project, changeId, metricsPeriod }) => unwrap(await client.POST("/projects/{owner}/{project}/changes/{changeId}/unignore", { params: {
+		path: {
+			owner,
+			project,
+			changeId
+		},
+		query: { metricsPeriod }
+	} }))
+});
+//#endregion
+//#region src/commands/change/index.ts
+function changeCommand(program) {
+	const change = program.command("change").description("Ignore or unignore flaky test changes");
+	registerChangeIgnore(change);
+	registerChangeUnignore(change);
+}
+//#endregion
+//#region src/index.ts
+const rawPkg = await readFile(resolve(fileURLToPath(new URL(".", import.meta.url)), "..", "package.json"), "utf8");
+const pkg = JSON.parse(rawPkg);
+program.name(pkg.name).description("Interact with and upload screenshots to Snapvisor via command line.").version(pkg.version);
+uploadCommand(program);
+skipCommand(program);
+finalizeCommand(program);
+buildCommand(program);
+reviewCommand(program);
+commentCommand(program);
+loginCommand(program);
+logoutCommand(program);
+deployCommand(program);
+whoamiCommand(program);
+createProjectCommand(program);
+analyticsCommand(program);
+changeCommand(program);
+if (!process.argv.slice(2).length) program.outputHelp();
+else program.parse(process.argv);
+//#endregion
+export {};