@gscdump/cli 3.4.4 → 3.6.0

package/dist/auth.mjs

@@ -3,17 +3,18 @@ import { pickCliEnvironmentValue, resolveCliEnvironment } from "./environment.mj
 import { getAppliedEnvKeys, getLoadedEnvPath } from "./env-file.mjs";
 import { displayPath, logger } from "./utils.mjs";
 import process from "node:process";
-import path from "node:path";
+import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
 import fs from "node:fs/promises";
+import path from "node:path";
+import { Buffer } from "node:buffer";
 import { err, ok, unwrapResult } from "gscdump/result";
-import { isCancel, text } from "@clack/prompts";
+import { text } from "@clack/prompts";
 import { createAuth } from "gscdump/client";
 import { createServer } from "node:http";
-import { JWT, OAuth2Client } from "google-auth-library";
-import { ofetch } from "ofetch";
+import { CodeChallengeMethod, JWT, OAuth2Client } from "google-auth-library";
+import open from "open";
 function authErrorToException(error) {
 	const exception = new Error(error.message);
-	if ("cause" in error && error.cause !== void 0) exception.cause = error.cause;
 	exception.authError = error;
 	return exception;
 }
@@ -46,70 +47,6 @@ async function resolveServiceAccount(opts = {}) {
 	if (!p) return null;
 	return loadServiceAccount(p);
 }
-async function authenticateDeviceCode(credentials) {
-	return unwrapResult(await authenticateDeviceCodeResult(credentials), authErrorToException);
-}
-async function authenticateDeviceCodeResult(credentials) {
-	const init = await ofetch("https://oauth2.googleapis.com/device/code", {
-		method: "POST",
-		body: new URLSearchParams({
-			client_id: credentials.clientId,
-			scope: SCOPES.join(" ")
-		})
-	}).then(ok).catch((e) => err({
-		kind: "device-code-request-failed",
-		message: `Device-code request failed: ${e.message}`,
-		cause: e
-	}));
-	if (!init.ok) return init;
-	return pollDeviceCode(credentials, init.value);
-}
-async function pollDeviceCode(credentials, init) {
-	console.log();
-	console.log(`  \x1B[1mDevice-code OAuth\x1B[0m`);
-	console.log(`  1. On any device, open: \x1B[36m${init.verification_url}\x1B[0m`);
-	console.log(`  2. Enter this code:     \x1B[1m${init.user_code}\x1B[0m`);
-	console.log(`  3. Approve the requested scopes`);
-	console.log();
-	logger.info(`Polling for completion (expires in ${Math.floor(init.expires_in / 60)}m)...`);
-	const intervalMs = init.interval * 1e3;
-	const deadline = Date.now() + init.expires_in * 1e3;
-	while (Date.now() < deadline) {
-		await new Promise((r) => setTimeout(r, intervalMs));
-		const res = await ofetch("https://oauth2.googleapis.com/token", {
-			method: "POST",
-			body: new URLSearchParams({
-				client_id: credentials.clientId,
-				client_secret: credentials.clientSecret,
-				device_code: init.device_code,
-				grant_type: "urn:ietf:params:oauth:grant-type:device_code"
-			})
-		}).catch((e) => e?.data ?? { error: "request_failed" });
-		if (res.access_token) return ok({
-			access_token: res.access_token,
-			refresh_token: res.refresh_token,
-			expiry_date: res.expires_in ? Date.now() + res.expires_in * 1e3 : void 0
-		});
-		if (res.error === "authorization_pending" || res.error === "slow_down") continue;
-		if (res.error === "access_denied") return err({
-			kind: "device-code-denied",
-			message: "User denied authorization."
-		});
-		if (res.error === "expired_token") return err({
-			kind: "device-code-expired",
-			message: "Device code expired. Re-run `gscdump auth login --no-browser`."
-		});
-		if (res.error) return err({
-			kind: "device-code-failed",
-			reason: res.error,
-			message: `Device-code poll failed: ${res.error_description || res.error}`
-		});
-	}
-	return err({
-		kind: "device-code-timed-out",
-		message: "Device-code flow timed out."
-	});
-}
 function resolveBYOK(opts = {}) {
 	const env = resolveCliEnvironment();
 	const accessToken = opts.accessToken || env.accessToken;
@@ -124,7 +61,6 @@ function resolveBYOK(opts = {}) {
 	if (accessToken) return accessToken;
 	return null;
 }
-const REDIRECT_URI_RE = /redirect_uri=[^&]+/;
 function getTokensPath() {
 	return path.join(getConfigDir(), "tokens.json");
 }
@@ -186,12 +122,12 @@ async function getAuthCredentials(interactive) {
 		placeholder: "your-client-id.googleusercontent.com",
 		validate: (v) => v ? void 0 : "Required"
 	});
-	if (isCancel(clientIdResult)) process.exit(1);
+	if (typeof clientIdResult !== "string") process.exit(1);
 	const clientSecretResult = await text({
 		message: "Enter your Google OAuth Client Secret:",
 		validate: (v) => v ? void 0 : "Required"
 	});
-	if (isCancel(clientSecretResult)) process.exit(1);
+	if (typeof clientSecretResult !== "string") process.exit(1);
 	console.log();
 	logger.info("Tip: Set GOOGLE_CLIENT_ID and GOOGLE_CLIENT_SECRET env vars to skip prompts");
 	return {
@@ -199,65 +135,114 @@ async function getAuthCredentials(interactive) {
 		clientSecret: clientSecretResult
 	};
 }
-async function getAuthCodeViaLoopback(authUrl) {
+async function getAuthCodeViaLoopback(authUrl, expectedState, noBrowser) {
 	return new Promise((resolve, reject) => {
 		let resolvedRedirectUri = "";
 		let timeoutId;
-		let server;
-		const settle = (fn) => {
-			if (timeoutId) clearTimeout(timeoutId);
-			server.closeAllConnections?.();
+		let settled = false;
+		const server = createServer();
+		const settle = (result) => {
+			if (settled) return;
+			settled = true;
+			clearTimeout(timeoutId);
 			server.close();
-			fn();
+			server.closeAllConnections();
+			if (result.ok) resolve(result.value);
+			else reject(result.error);
 		};
-		server = createServer((req, res) => {
-			const url = new URL(req.url || "", `http://127.0.0.1`);
-			const code = url.searchParams.get("code");
-			const error = url.searchParams.get("error");
-			if (error) {
-				res.writeHead(400, { "Content-Type": "text/html" });
-				res.end(`<html><body><h1>Authorization Failed</h1><p>${error}</p><p>You can close this window.</p></body></html>`);
-				settle(() => reject(/* @__PURE__ */ new Error(`OAuth error: ${error}`)));
+		server.on("request", (req, res) => {
+			res.setHeader("Content-Type", "text/plain; charset=utf-8");
+			res.setHeader("Cache-Control", "no-store");
+			res.setHeader("X-Content-Type-Options", "nosniff");
+			if (settled) {
+				res.writeHead(409);
+				res.end("Authorization already completed.");
+				return;
+			}
+			if (!URL.canParse(req.url || "/", "http://127.0.0.1")) {
+				res.writeHead(400);
+				res.end("Invalid authorization URL.");
 				return;
 			}
-			if (code) {
-				res.writeHead(200, { "Content-Type": "text/html" });
-				res.end(`<html><body><h1>Authorization Successful</h1><p>You can close this window and return to the terminal.</p></body></html>`);
-				settle(() => resolve({
-					code,
+			const url = new URL(req.url || "/", "http://127.0.0.1");
+			if (req.method !== "GET" || url.pathname !== "/") {
+				res.writeHead(404);
+				res.end("Not found.");
+				return;
+			}
+			const state = url.searchParams.getAll("state");
+			const receivedState = Buffer.from(state[0] ?? "");
+			const expected = Buffer.from(expectedState);
+			if (state.length !== 1 || receivedState.length !== expected.length || !timingSafeEqual(receivedState, expected)) {
+				res.writeHead(400);
+				res.end("Invalid authorization state. Use the URL shown in the terminal.");
+				return;
+			}
+			const codes = url.searchParams.getAll("code");
+			const errors = url.searchParams.getAll("error");
+			if (codes.length === 1 && codes[0] && errors.length === 0) {
+				res.once("finish", () => settle(ok({
+					code: codes[0],
 					redirectUri: resolvedRedirectUri
-				}));
+				})));
+				res.writeHead(200);
+				res.end("Authorization successful. Close this window and return to the terminal.");
+				return;
+			}
+			if (errors.length === 1 && errors[0] && codes.length === 0) {
+				const error = errors[0] === "access_denied" ? {
+					kind: "oauth-denied",
+					message: "Authorization denied. If you want to retry, run `gscdump auth login`."
+				} : {
+					kind: "oauth-failed",
+					message: "Authorization failed. Run `gscdump auth login` to retry."
+				};
+				res.once("finish", () => settle(err(authErrorToException(error))));
+				res.writeHead(400);
+				res.end(error.message);
 				return;
 			}
-			res.writeHead(400, { "Content-Type": "text/html" });
-			res.end(`<html><body><h1>Missing authorization code</h1></body></html>`);
+			res.writeHead(400);
+			res.end("Invalid authorization response. Use the URL shown in the terminal.");
 		});
+		server.on("error", (error) => settle(err(error)));
+		timeoutId = setTimeout(() => {
+			settle(err(authErrorToException({
+				kind: "oauth-timed-out",
+				message: "Authorization timed out. Use a Desktop application OAuth client. Run `gscdump auth login` to retry."
+			})));
+		}, 3e5);
 		server.listen(0, "127.0.0.1", () => {
 			const addr = server.address();
 			if (!addr || typeof addr === "string") {
-				settle(() => reject(/* @__PURE__ */ new Error("Failed to start local server")));
+				settle(err(/* @__PURE__ */ new Error("Failed to start local server")));
 				return;
 			}
 			resolvedRedirectUri = `http://127.0.0.1:${addr.port}`;
-			const fullAuthUrl = authUrl.replace(REDIRECT_URI_RE, `redirect_uri=${encodeURIComponent(resolvedRedirectUri)}`);
+			authUrl.searchParams.set("redirect_uri", resolvedRedirectUri);
+			const fullAuthUrl = authUrl.toString();
 			console.log();
-			console.log("  \x1B[1mOpening browser for authorization...\x1B[0m");
-			console.log(`  \x1B[90mIf browser doesn't open, visit:\x1B[0m`);
-			console.log(`  \x1B[36m${fullAuthUrl}\x1B[0m`);
+			if (noBrowser) console.log("  Open this URL in your browser:");
+			else {
+				console.log("  Opening browser for authorization...");
+				console.log("  If the browser does not open, visit:");
+			}
+			console.log(`  ${fullAuthUrl}`);
 			console.log();
-			console.log(`  \x1B[90mIf Google says "redirect_uri_mismatch", your OAuth client is`);
-			console.log(`  not a "Desktop application" type. Create a Desktop client at`);
-			console.log(`  https://console.cloud.google.com/apis/credentials, then run`);
-			console.log(`  \`gscdump init --force\` with the new ID/secret.\x1B[0m`);
+			if (noBrowser) {
+				console.log(`  If the CLI runs on another host, forward loopback port ${addr.port} before opening the URL.`);
+				console.log(`  On your browser host, run: ssh -N -L ${addr.port}:127.0.0.1:${addr.port} user@host`);
+				console.log("  Replace user@host with the CLI host. Keep this command running during login.");
+				console.log();
+			}
+			console.log("  If Google reports redirect_uri_mismatch, use a Desktop application OAuth client.");
+			console.log("  Create it at https://console.cloud.google.com/apis/credentials.");
+			console.log("  Then run `gscdump init --force` with the new client credentials.");
 			console.log();
-			import("open").then(({ default: open }) => open(fullAuthUrl)).catch(() => {
-				logger.warn("Could not open browser automatically");
+			if (!noBrowser) open(fullAuthUrl).catch(() => {
+				logger.warn("Could not open browser automatically. Open the URL shown above.");
 			});
 		});
-		server.on("error", (err) => settle(() => reject(err)));
-		timeoutId = setTimeout(() => {
-			settle(() => reject(/* @__PURE__ */ new Error("Authorization timed out. If Google showed \"redirect_uri_mismatch\", your OAuth client must be type \"Desktop application\" (create one at https://console.cloud.google.com/apis/credentials and run `gscdump init --force`).")));
-		}, 3e5);
 	});
 }
 async function authenticate(credentials, interactive, opts = {}) {
@@ -312,21 +297,23 @@ async function authenticate(credentials, interactive, opts = {}) {
 		}
 		process.exit(1);
 	}
-	if (opts.noBrowser) {
-		const tokens = await authenticateDeviceCode(credentials);
-		oauth2Client.setCredentials(tokens);
-		await saveTokens(tokens);
-		logger.success(`Tokens saved to ${displayPath(getTokensPath())}`);
-		return oauth2Client;
-	}
-	const authUrl = oauth2Client.generateAuthUrl({
+	const state = randomBytes(32).toString("base64url");
+	const codeVerifier = randomBytes(32).toString("base64url");
+	const authUrl = new URL(oauth2Client.generateAuthUrl({
 		access_type: "offline",
 		scope: SCOPES,
-		prompt: "consent"
-	});
+		prompt: "consent",
+		state,
+		code_challenge: createHash("sha256").update(codeVerifier).digest("base64url"),
+		code_challenge_method: CodeChallengeMethod.S256
+	}));
 	logger.info("Waiting for authorization...");
-	const { code, redirectUri } = await getAuthCodeViaLoopback(authUrl);
-	const { tokens } = await new OAuth2Client(credentials.clientId, credentials.clientSecret, redirectUri).getToken(code);
+	const { code, redirectUri } = await getAuthCodeViaLoopback(authUrl, state, Boolean(opts.noBrowser));
+	const { tokens } = await new OAuth2Client(credentials.clientId, credentials.clientSecret, redirectUri).getToken({
+		code,
+		codeVerifier,
+		redirect_uri: redirectUri
+	});
 	oauth2Client.setCredentials(tokens);
 	await saveTokens(tokens);
 	logger.success(`Tokens saved to ${displayPath(getTokensPath())}`);
@@ -473,4 +460,4 @@ function isAuthError(err) {
 	if (!msg) return false;
 	return /\b(?:401|403|unauthorized|forbidden|invalid_grant|invalid_token|insufficient.*scope|invalid_client|token has been expired|token has been revoked)\b/.test(msg) || msg.includes("oauth2.googleapis.com/token");
 }
-export { authenticate, authenticateDeviceCode, authenticateDeviceCodeResult, clearTokens, describeAuthProvenance, formatAuthProvenance, getAuth, getAuthCredentials, isAuthError, loadServiceAccount, loadServiceAccountResult, loadTokens, resolveAuth, resolveBYOK, resolveServiceAccount, saveTokens };
+export { authenticate, clearTokens, describeAuthProvenance, formatAuthProvenance, getAuth, getAuthCredentials, isAuthError, loadServiceAccount, loadServiceAccountResult, loadTokens, resolveAuth, resolveBYOK, resolveServiceAccount, saveTokens };

package/dist/bing-auth.mjs

@@ -0,0 +1,200 @@
+import { useCliRuntime } from "./runtime.mjs";
+import { getConfigDir } from "./config.mjs";
+import { randomUUID } from "node:crypto";
+import fs from "node:fs/promises";
+import path from "node:path";
+import { z } from "zod";
+import { createServer } from "node:http";
+import { bingWebmaster } from "gscdump/bing";
+const secret = z.string().trim().min(1);
+const oauthClientSchema = z.object({
+	clientId: secret,
+	clientSecret: secret,
+	redirectUri: z.url()
+});
+const credentialsSchema = z.discriminatedUnion("_tag", [z.object({
+	_tag: z.literal("ApiKey"),
+	apiKey: secret
+}), z.object({
+	_tag: z.literal("OAuth"),
+	...oauthClientSchema.shape,
+	accessToken: secret,
+	refreshToken: secret,
+	expiresAt: z.number().finite().positive()
+})]);
+const tokenSchema = z.object({
+	access_token: secret,
+	refresh_token: secret.optional(),
+	expires_in: z.union([z.number(), z.string().regex(/^\d+$/).transform(Number)]).pipe(z.number().int().positive().max(31536e3))
+});
+const BING_REDIRECT_URI = "http://127.0.0.1:53683/oauth/bing";
+function credentialsPath() {
+	return path.join(getConfigDir(), "bing-tokens.json");
+}
+async function saveBingCredentials(credentials) {
+	const value = credentialsSchema.parse(credentials);
+	await fs.mkdir(getConfigDir(), {
+		recursive: true,
+		mode: 448
+	});
+	const temporary = `${credentialsPath()}.${randomUUID()}.tmp`;
+	try {
+		await fs.writeFile(temporary, JSON.stringify(value, null, 2), {
+			mode: 384,
+			flag: "wx"
+		});
+		await fs.rename(temporary, credentialsPath());
+	} finally {
+		await fs.rm(temporary, { force: true });
+	}
+}
+async function clearBingCredentials() {
+	await fs.rm(credentialsPath(), { force: true });
+}
+async function inspectBingCredentials() {
+	const env = useCliRuntime().environment;
+	if (env.BING_API_KEY?.trim()) return { _tag: "ApiKey" };
+	if (env.BING_ACCESS_TOKEN?.trim()) return { _tag: "AccessToken" };
+	return { _tag: (await loadBingCredentials())?._tag ?? "Missing" };
+}
+async function loadBingCredentials() {
+	const body = await fs.readFile(credentialsPath(), "utf8").catch((error) => {
+		if (error.code === "ENOENT") return null;
+		throw error;
+	});
+	if (body === null) return null;
+	const parsed = credentialsSchema.safeParse(JSON.parse(body));
+	if (!parsed.success) throw new Error("Saved Bing credentials are invalid. Run `gscdump bing login` again.");
+	return parsed.data;
+}
+async function requestToken(client, grant) {
+	const response = await fetch("https://www.bing.com/webmasters/oauth/token", {
+		method: "POST",
+		headers: { "Content-Type": "application/x-www-form-urlencoded" },
+		body: new URLSearchParams({
+			client_id: client.clientId,
+			client_secret: client.clientSecret,
+			redirect_uri: client.redirectUri,
+			...grant
+		}),
+		signal: AbortSignal.timeout(3e4)
+	});
+	if (!response.ok) throw new Error(`Bing token request failed (${response.status}). Run \`gscdump bing login --oauth\` again.`);
+	const payload = await response.json().catch((error) => {
+		if (error instanceof SyntaxError) throw new Error("Bing returned an invalid OAuth token.");
+		throw error;
+	});
+	const token = tokenSchema.safeParse(payload);
+	if (!token.success) throw new Error("Bing returned an invalid OAuth token.");
+	return token.data;
+}
+async function getBingClient() {
+	const env = useCliRuntime().environment;
+	if (env.BING_API_KEY?.trim()) return bingWebmaster({ apiKey: env.BING_API_KEY.trim() });
+	if (env.BING_ACCESS_TOKEN?.trim()) return bingWebmaster({ accessToken: env.BING_ACCESS_TOKEN.trim() });
+	const credentials = await loadBingCredentials();
+	if (!credentials) throw new Error("Bing credentials are missing. Run `gscdump bing login` or set BING_API_KEY.");
+	if (credentials._tag === "ApiKey") return bingWebmaster({ apiKey: credentials.apiKey });
+	let current = credentials;
+	let refreshing;
+	const accessToken = () => {
+		if (current.expiresAt > Date.now() + 6e4) return Promise.resolve(current.accessToken);
+		refreshing ??= requestToken(current, {
+			grant_type: "refresh_token",
+			refresh_token: current.refreshToken
+		}).then(async (token) => {
+			const updated = {
+				...current,
+				accessToken: token.access_token,
+				refreshToken: token.refresh_token ?? current.refreshToken,
+				expiresAt: Date.now() + token.expires_in * 1e3
+			};
+			await saveBingCredentials(updated);
+			current = updated;
+			return updated.accessToken;
+		}).finally(() => {
+			refreshing = void 0;
+		});
+		return refreshing;
+	};
+	await accessToken();
+	return bingWebmaster({ accessToken });
+}
+async function loginBingOAuth(input) {
+	const parsed = oauthClientSchema.safeParse(input);
+	if (!parsed.success) throw new Error("Bing OAuth needs a client ID, client secret, and redirect URI.");
+	const client = parsed.data;
+	const redirect = new URL(client.redirectUri);
+	if (redirect.protocol !== "http:" || !["127.0.0.1", "localhost"].includes(redirect.hostname) || !redirect.port || redirect.username || redirect.password || redirect.search || redirect.hash) throw new Error("Use an HTTP loopback redirect URI with an explicit port and no query or fragment.");
+	const state = randomUUID();
+	const authorize = new URL("https://www.bing.com/webmasters/oauth/authorize");
+	authorize.search = new URLSearchParams({
+		client_id: client.clientId,
+		redirect_uri: client.redirectUri,
+		response_type: "code",
+		scope: "webmaster.manage",
+		state
+	}).toString();
+	const result = Promise.withResolvers();
+	const settled = result.promise.then((code) => ({ code }), (error) => ({ error }));
+	const server = createServer((request, response) => {
+		const callback = URL.parse(request.url ?? "/", redirect.origin);
+		response.setHeader("Content-Type", "text/plain; charset=utf-8");
+		response.setHeader("Cache-Control", "no-store");
+		if (!callback) {
+			response.writeHead(400).end("Invalid OAuth callback URL.");
+			return;
+		}
+		if (request.method !== "GET" || callback.pathname !== redirect.pathname) {
+			response.writeHead(404).end("Not found.");
+			return;
+		}
+		if (callback.searchParams.getAll("state").length !== 1 || callback.searchParams.get("state") !== state || callback.searchParams.getAll("code").length > 1 || callback.searchParams.getAll("error").length > 1) {
+			response.writeHead(400).end("Invalid OAuth state. Use the original login link.");
+			return;
+		}
+		const code = callback.searchParams.get("code");
+		if (!code && !callback.searchParams.has("error") || code && callback.searchParams.has("error")) {
+			response.writeHead(400).end("Invalid OAuth response. Use the original login link.");
+			return;
+		}
+		if (callback.searchParams.has("error") || !code) {
+			response.writeHead(400).end("Bing authorization failed. Return to the terminal.");
+			result.reject(/* @__PURE__ */ new Error("Bing authorization failed. Run `gscdump bing login --oauth` again."));
+			return;
+		}
+		response.end("Bing authorization received. Return to the terminal.");
+		result.resolve(code);
+	});
+	const timeout = setTimeout(() => result.reject(/* @__PURE__ */ new Error("Bing login timed out. Run `gscdump bing login --oauth` again.")), input.timeoutMs ?? 3e5);
+	try {
+		await new Promise((resolve, reject) => {
+			server.once("error", reject);
+			server.listen(Number(redirect.port), redirect.hostname, () => resolve());
+		});
+		await input.openUrl(authorize.toString());
+		const authorization = await settled;
+		if ("error" in authorization) throw authorization.error;
+		const token = await requestToken(client, {
+			grant_type: "authorization_code",
+			code: authorization.code
+		});
+		if (!token.refresh_token) throw new Error("Bing did not return a refresh token. Run `gscdump bing login --oauth` again.");
+		const sites = await bingWebmaster({ accessToken: token.access_token }).getUserSites({ signal: AbortSignal.timeout(3e4) });
+		if (!sites.ok) throw new Error(`Bing login failed: ${sites.error._tag}.`);
+		await saveBingCredentials({
+			_tag: "OAuth",
+			...client,
+			accessToken: token.access_token,
+			refreshToken: token.refresh_token,
+			expiresAt: Date.now() + token.expires_in * 1e3
+		});
+	} finally {
+		clearTimeout(timeout);
+		server.closeAllConnections();
+		await new Promise((resolve) => {
+			server.close(() => resolve());
+		});
+	}
+}
+export { BING_REDIRECT_URI, clearBingCredentials, getBingClient, inspectBingCredentials, loginBingOAuth, saveBingCredentials };

package/dist/bing-data.mjs

@@ -0,0 +1,160 @@
+import { toCSV } from "./utils.mjs";
+import fs from "node:fs/promises";
+import path from "node:path";
+import { z } from "zod";
+const BING_DATASETS = [
+	"traffic",
+	"pages",
+	"keywords",
+	"crawl",
+	"crawl-issues"
+];
+const datedDatasets = BING_DATASETS.filter((dataset) => dataset !== "crawl-issues");
+const dateSchema = z.iso.date();
+const dumpSchema = z.object({
+	format: z.enum([
+		"json",
+		"ndjson",
+		"csv"
+	]).default("json"),
+	datasets: z.array(z.enum(BING_DATASETS)).min(1),
+	start: dateSchema.optional(),
+	end: dateSchema.optional()
+}).refine((value) => !value.start || !value.end || value.start <= value.end, { message: "--start must precede --end" });
+function parseBingDumpOptions(args) {
+	const parsed = dumpSchema.safeParse({
+		...args,
+		datasets: args.datasets ? [...new Set(args.datasets.split(",").map((value) => value.trim()))] : datedDatasets
+	});
+	if (!parsed.success) throw new Error(`Invalid Bing dump options: ${parsed.error.issues.map((issue) => issue.message).join("; ")}.`);
+	if (parsed.data.datasets.includes("crawl-issues") && (parsed.data.start || parsed.data.end)) throw new Error("Bing crawl issues have no dates. Export them without --start or --end.");
+	return parsed.data;
+}
+function unwrapBing(result) {
+	if (result.ok) return result.value;
+	const error = result.error;
+	const help = error._tag === "AuthenticationRequired" ? " Run `gscdump bing login` again." : error._tag === "Throttled" && error.retryAfterMs !== void 0 ? ` Retry after ${Math.ceil(error.retryAfterMs / 1e3)} seconds.` : "";
+	throw new Error(`Bing request failed: ${error._tag}.${help}`);
+}
+function siteIdentity(value) {
+	const url = URL.parse(value);
+	if (!url || !["http:", "https:"].includes(url.protocol) || url.username || url.password || url.search || url.hash) throw new Error("Use the full Bing site URL from `gscdump bing sites`.");
+	return url.toString();
+}
+async function resolveBingSites(client, input) {
+	if (Boolean(input.site) === Boolean(input.allSites)) throw new Error("Choose --site URL or --all-sites.");
+	const wanted = input.site ? siteIdentity(input.site) : null;
+	const verified = unwrapBing(await client.getUserSites({ signal: AbortSignal.timeout(3e4) })).filter((site) => site.isVerified);
+	if (input.allSites) {
+		const unique = new Map(verified.map((site) => [siteIdentity(site.url), site.url]));
+		if (unique.size === 0) throw new Error("No verified Bing sites are available.");
+		return [...unique.values()];
+	}
+	const match = verified.find((site) => siteIdentity(site.url) === wanted);
+	if (!match) throw new Error("The Bing site is missing or unverified. Run `gscdump bing sites` and verify the site.");
+	return [match.url];
+}
+const columns = {
+	"traffic": [
+		"date",
+		"clicks",
+		"impressions"
+	],
+	"pages": [
+		"date",
+		"page",
+		"clicks",
+		"impressions",
+		"averageClickPosition",
+		"averageImpressionPosition"
+	],
+	"keywords": [
+		"date",
+		"query",
+		"clicks",
+		"impressions",
+		"averageClickPosition",
+		"averageImpressionPosition"
+	],
+	"crawl": [
+		"date",
+		"crawledPages",
+		"inIndex",
+		"inLinks",
+		"crawlErrors",
+		"blockedByRobotsTxt",
+		"containsMalware",
+		"code2xx",
+		"code301",
+		"code302",
+		"code4xx",
+		"code5xx",
+		"allOtherCodes",
+		"connectionTimeout",
+		"dnsFailures"
+	],
+	"crawl-issues": [
+		"url",
+		"httpCode",
+		"inLinks",
+		"issue",
+		"rawIssueCode"
+	]
+};
+async function dumpBingSite(client, siteUrl, outDir, options) {
+	const calls = {
+		"traffic": client.getRankAndTrafficStats,
+		"pages": client.getPageStats,
+		"keywords": client.getQueryStats,
+		"crawl": client.getCrawlStats,
+		"crawl-issues": client.getCrawlIssues
+	};
+	const results = await Promise.all(options.datasets.map(async (dataset) => {
+		return {
+			dataset,
+			rows: unwrapBing(await calls[dataset](siteUrl, { signal: AbortSignal.timeout(3e4) })).filter((row) => {
+				if (!("date" in row) || typeof row.date !== "string") return true;
+				const date = row.date.slice(0, 10);
+				return (!options.start || date >= options.start) && (!options.end || date <= options.end);
+			})
+		};
+	}));
+	return writeBingDump(siteUrl, outDir, options.format, results);
+}
+async function writeBingDump(siteUrl, outDir, format, results) {
+	const siteDir = path.resolve(outDir, encodeURIComponent(siteUrl));
+	await fs.mkdir(siteDir, { recursive: true });
+	const staging = await fs.mkdtemp(path.join(siteDir, ".dump-"));
+	try {
+		const files = [];
+		for (const { dataset, rows, sync, semantics } of results) {
+			const name = `${dataset}.${format}`;
+			const body = format === "json" ? `${JSON.stringify(rows, null, 2)}\n` : format === "ndjson" ? rows.map((row) => `${JSON.stringify(row)}\n`).join("") : `${toCSV(rows, columns[dataset])}\n`;
+			await fs.writeFile(path.join(staging, name), body);
+			files.push({
+				dataset,
+				rows: rows.length,
+				path: path.join(siteDir, name),
+				...sync ? { sync } : {},
+				...semantics ? { semantics } : {}
+			});
+		}
+		const summary = {
+			searchEngine: "bing",
+			siteUrl,
+			observedAt: (/* @__PURE__ */ new Date()).toISOString(),
+			format,
+			files
+		};
+		await fs.writeFile(path.join(staging, "metadata.json"), `${JSON.stringify(summary, null, 2)}\n`);
+		for (const file of files) await fs.rename(path.join(staging, path.basename(file.path)), file.path);
+		await fs.rename(path.join(staging, "metadata.json"), path.join(siteDir, "metadata.json"));
+		return summary;
+	} finally {
+		await fs.rm(staging, {
+			recursive: true,
+			force: true
+		});
+	}
+}
+export { BING_DATASETS, dumpBingSite, parseBingDumpOptions, resolveBingSites, unwrapBing, writeBingDump };