@gscdump/cli 4.2.2 → 4.3.0

package/dist/commands/mcp.mjs

@@ -7,20 +7,27 @@ import { createGscMcpServer } from "../mcp/server/index.mjs";
 import { defineCommand } from "citty";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 const MCP_NO_AUTH_MESSAGE = [
-	"gscdump has no Google authentication.",
-	"Run `gscdump auth login` in a terminal, then call this tool again.",
-	"For cloud mode, run `gscdump auth login --mode cloud` in a terminal.",
-	"For local mode, set GSC_SERVICE_ACCOUNT_JSON or GOOGLE_APPLICATION_CREDENTIALS to a service-account key file, set GSC_ACCESS_TOKEN, or set GSC_CLIENT_ID, GSC_CLIENT_SECRET, and GSC_REFRESH_TOKEN.",
+	"gscdump has no Google credentials. The CLI MCP server runs in Local mode with your own Google credentials.",
+	"Recommended: set GSC_SERVICE_ACCOUNT_JSON or GOOGLE_APPLICATION_CREDENTIALS to a service-account key file.",
+	"Or set GSC_CLIENT_ID, GSC_CLIENT_SECRET, and GSC_REFRESH_TOKEN, or run `gscdump auth login --mode local` in a terminal.",
 	"If you set environment variables, set them in the MCP server configuration and restart the MCP client.",
+	"For Hosted mode, connect your MCP client to https://gscdump.com/mcp instead.",
 	"If the gscdump command is missing, run `npm install -g @gscdump/cli`."
 ].join(" ");
+const MCP_HOSTED_MESSAGE = [
+	"The CLI MCP server calls Google, so it needs Local mode.",
+	"For Hosted mode, connect your MCP client to https://gscdump.com/mcp.",
+	"If you want Local mode, run `gscdump auth login --mode local` in a terminal, then restart the MCP client."
+].join(" ");
 const MCP_RETRIES = 1;
 async function startMcpServer(transport, runtime = useCliRuntime()) {
 	const server = createGscMcpServer({
 		name: "gscdump",
 		version: VERSION,
 		getContext: async () => {
-			if (await probeAuth() === "none") throw new Error(MCP_NO_AUTH_MESSAGE);
+			const probe = await probeAuth();
+			if (probe === "hosted") throw new Error(MCP_HOSTED_MESSAGE);
+			if (probe === "none") throw new Error(MCP_NO_AUTH_MESSAGE);
 			const ctx = await createCommandContext({
 				needsAuth: true,
 				fetchOptions: { retry: MCP_RETRIES }
@@ -29,7 +36,6 @@ async function startMcpServer(transport, runtime = useCliRuntime()) {
 				throw error;
 			});
 			return {
-				authentication: ctx.authentication,
 				auth: ctx.auth,
 				client: ctx.client
 			};
@@ -46,4 +52,4 @@ const mcpCommand = defineCommand({
 		await startMcpServer(new StdioServerTransport());
 	}
 });
-export { MCP_NO_AUTH_MESSAGE, mcpCommand, startMcpServer };
+export { MCP_HOSTED_MESSAGE, MCP_NO_AUTH_MESSAGE, mcpCommand, startMcpServer };

package/dist/commands/query.mjs

@@ -1,5 +1,6 @@
 import { queryCommandMeta } from "../command-meta.mjs";
 import { useCliRuntime } from "../runtime.mjs";
+import { resolveAuthentication } from "../auth-state.mjs";
 import { loadConfig } from "../config.mjs";
 import { terminalOutputOptions } from "../render/terminal.mjs";
 import { ALL_SEARCH_TYPES, logger, parseSearchType, toCSV } from "../utils.mjs";
@@ -9,7 +10,9 @@ import { decideRoute, describeStop, liveNote, readRouteState, readSiteStates, re
 import { DEFAULT_WINDOW, checkWindowFlags, newestDoneDate, parseWindowFlags } from "../window.mjs";
 import { renderTable } from "../render/layout.mjs";
 import { asRecord, columnsFor } from "../render/analysis.mjs";
+import { resolveHostedSite } from "../hosted-site.mjs";
 import { FILTER_DIMS, filterDimensions, parseFilterArgs, toLiveFilter, toLocalFilter } from "../filters.mjs";
+import { queryHostedRows } from "../hosted-query.mjs";
 import { renderQuery } from "../render/query.mjs";
 import { openSqlViews, referencedTables } from "../sql-views.mjs";
 import process from "node:process";
@@ -148,7 +151,7 @@ const queryCommand = defineCommand({
 		"live": {
 			type: "boolean",
 			default: false,
-			description: "Bypass local store; hit the GSC API directly"
+			description: "Call the Search Console API directly (Local mode only)"
 		},
 		"quiet": {
 			type: "boolean",
@@ -256,6 +259,46 @@ const queryCommand = defineCommand({
 			process.exit(1);
 		}
 		const forceLive = Boolean(args.live);
+		if (!forceLive && (await resolveAuthentication())._tag === "Hosted") {
+			if (dataState || aggregationType) logger.warn("--data-state / --aggregation-type are ignored without --live");
+			const { client, site } = await resolveHostedSite(args, {
+				name: "query",
+				localAlternative: "run `gscdump sync --site <site>` first, or pass --live"
+			});
+			const { start: startDate, end: endDate } = windowOrExit(windowFlags, getLatestGscDate());
+			const state = {
+				...buildLocalState(dimNames, startDate, endDate, rowLimit, toLocalFilter(filters)),
+				searchType: localSearchType
+			};
+			if (args.explain) {
+				console.log(JSON.stringify({
+					siteUrl: site.siteUrl,
+					siteId: site.siteId,
+					source: "hosted",
+					state
+				}, null, 2));
+				return;
+			}
+			if (!args.quiet) logger.debug(`Querying ${site.siteUrl} from the hosted record...`);
+			const rows = await queryHostedRows(client, site.siteId, state);
+			await writeOutput({
+				output: {
+					siteUrl: site.siteUrl,
+					dimensions: dimNames,
+					dateRange: {
+						start: startDate,
+						end: endDate
+					},
+					total: rows.length,
+					data: rows,
+					meta: { source: "hosted" }
+				},
+				format,
+				path: args.output ? String(args.output) : void 0,
+				quiet: Boolean(args.quiet)
+			});
+			return;
+		}
 		const resolvable = isDatasetResolvable(dimNames, filterDims);
 		if (!resolvable && !forceLive) throw new Error(`No Store table holds ${[.../* @__PURE__ */ new Set([...dimNames, ...filterDims])].join(" with ")}. Remove a dimension or filter, or pass --live.`);
 		const storeCtx = await createCommandContext({ needsStore: true });

package/dist/commands/sites.mjs

@@ -1,5 +1,5 @@
 import { sitesCommandMeta } from "../command-meta.mjs";
-import { formatHostedSync, getCloudSites } from "../auth-state.mjs";
+import { LOCAL_MODE_REQUIRED, formatHostedSync, getHostedAccount, resolveAuthentication } from "../auth-state.mjs";
 import { OUTPUT_ARGS, applyOutputMode, logger } from "../utils.mjs";
 import { createCommandContext, formatSiteResolution } from "../context.mjs";
 import process from "node:process";
@@ -421,8 +421,37 @@ const LIST_ARGS = {
 		description: "Filter to permissionLevel=siteOwner"
 	}
 };
+async function runListHostedSites(args, authentication) {
+	if (args["with-sitemaps"] || args["owner-only"]) throw new Error(`--with-sitemaps and --owner-only read Search Console permissions.\n${LOCAL_MODE_REQUIRED}`);
+	const { sites } = await getHostedAccount(authentication);
+	if (args.json) {
+		console.log(JSON.stringify(sites.map((site) => ({
+			siteId: site.siteId,
+			siteUrl: site.siteUrl,
+			hostedSync: {
+				syncStatus: site.syncStatus ?? null,
+				syncProgress: site.syncProgress ?? null,
+				oldestDateSynced: site.oldestDateSynced ?? null,
+				newestDateSynced: site.newestDateSynced ?? null
+			}
+		})), null, 2));
+		return;
+	}
+	if (sites.length === 0) {
+		logger.warn("Your hosted record has no Sites. Connect a Site at https://gscdump.com/app/onboarding?step=connect-sites.");
+		return;
+	}
+	logger.success(`Found ${sites.length} hosted sites:`);
+	console.log();
+	for (const site of sites) console.log(`  ${site.siteUrl} \x1B[90m(${site.siteId})\x1B[0m  hosted sync ${formatHostedSync(site)}`);
+}
 async function runListSites(args) {
 	applyOutputMode(args);
+	const authentication = await resolveAuthentication();
+	if (authentication._tag === "Hosted") {
+		await runListHostedSites(args, authentication);
+		return;
+	}
 	const ctx = await createCommandContext({ needsAuth: true });
 	const ownerOnly = Boolean(args["owner-only"]);
 	if (args["with-sitemaps"]) {
@@ -458,22 +487,8 @@ async function runListSites(args) {
 	}
 	const all = await ctx.loadSites();
 	const sites = ownerOnly ? all.filter((s) => s.permissionLevel === "siteOwner") : all;
-	const hosted = ctx.authentication._tag === "Cloud" ? await getCloudSites(ctx.authentication).then((list) => new Map(list.map((site) => [site.siteUrl, site])), (error) => {
-		logger.warn(`Hosted sync status is not available: ${error.message}`);
-	}) : void 0;
 	if (args.json) {
-		console.log(JSON.stringify(hosted ? sites.map((site) => {
-			const entry = hosted.get(site.siteUrl);
-			return {
-				...site,
-				hostedSync: entry?.registered ? {
-					syncStatus: entry.syncStatus ?? null,
-					syncProgress: entry.syncProgress ?? null,
-					oldestDateSynced: entry.oldestDateSynced ?? null,
-					newestDateSynced: entry.newestDateSynced ?? null
-				} : null
-			};
-		}) : sites, null, 2));
+		console.log(JSON.stringify(sites, null, 2));
 		return;
 	}
 	if (sites.length === 0) {
@@ -484,9 +499,7 @@ async function runListSites(args) {
 	console.log();
 	for (const site of sites) {
 		const perm = site.permissionLevel === "siteOwner" ? "\x1B[32m" : "\x1B[90m";
-		const entry = hosted?.get(site.siteUrl);
-		const sync = entry ? formatHostedSync(entry) : void 0;
-		console.log(`  ${site.siteUrl} ${perm}(${site.permissionLevel})\x1B[0m${sync ? `  hosted sync ${sync}` : ""}`);
+		console.log(`  ${site.siteUrl} ${perm}(${site.permissionLevel})\x1B[0m`);
 	}
 }
 const listCommand = defineCommand({

package/dist/context.mjs

@@ -1,8 +1,7 @@
 import { openQuotaLedger, quotaFetchOptions } from "./quota-ledger.mjs";
-import { resolveAuthentication } from "./auth-state.mjs";
+import { LOCAL_MODE_REQUIRED, resolveAuthentication } from "./auth-state.mjs";
 import { loadResolvedConfig } from "./config.mjs";
 import { resolveAuth } from "./auth.mjs";
-import { createCloudGoogleClient } from "./cloud-google.mjs";
 import { createLocalStore } from "./local-store.mjs";
 import { listStoreSites } from "./store-sites.mjs";
 import process from "node:process";
@@ -13,14 +12,14 @@ const FULL_SITE_URL_RE = /^(?:sc-domain:|https?:\/\/)/i;
 async function createCommandContext(opts = {}) {
 	const { needsAuth = false, needsStore = false, interactive = false, byok, quota = true } = opts;
 	const { config, dataDir } = await loadResolvedConfig();
-	const authentication = needsAuth ? await resolveAuthentication() : { _tag: "Local" };
+	if (needsAuth && (await resolveAuthentication())._tag === "Hosted") throw new Error(LOCAL_MODE_REQUIRED);
 	const fetchOptions = needsAuth && quota ? quotaFetchOptions(await openQuotaLedger({ dataDir }), opts.fetchOptions) : opts.fetchOptions;
-	const auth = needsAuth && authentication._tag === "Local" ? await resolveAuth({
+	const auth = needsAuth ? await resolveAuth({
 		interactive,
 		config,
 		byok
 	}) : null;
-	const client = needsAuth && authentication._tag === "Cloud" ? createCloudGoogleClient(authentication, fetchOptions) : auth ? googleSearchConsole(auth, { fetchOptions }) : null;
+	const client = auth ? googleSearchConsole(auth, { fetchOptions }) : null;
 	const store = needsStore ? createLocalStore({ dataDir }) : null;
 	const loadSites = async () => {
 		if (!client) throw new Error("loadSites requires needsAuth: true");
@@ -69,7 +68,6 @@ async function createCommandContext(opts = {}) {
 	return {
 		config,
 		dataDir,
-		authentication,
 		auth,
 		client,
 		store,

package/dist/dump-bing.mjs

@@ -30,7 +30,7 @@ async function dumpBing(opts) {
 	const sites = [];
 	const failures = [];
 	const authentication = await resolveAuthentication();
-	if (authentication._tag === "Cloud") {
+	if (authentication._tag === "Hosted") {
 		const hosted = (await listHostedBingSites(authentication)).filter((site) => site.connection._tag === "connected");
 		const wanted = new Set(matchBingSites(hosted.map((site) => site.siteUrl), opts.googleSites));
 		const selected = hosted.filter((site) => wanted.has(site.siteUrl));

package/dist/error-handler.mjs

@@ -5,7 +5,7 @@ import { isEngineError } from "@gscdump/engine/errors";
 import { classifyError } from "gscdump/errors";
 import { isQueryError } from "gscdump/query";
 const HOSTED_KEY_REJECTED_REASON = "gscdump.com rejected the API key";
-const HOSTED_KEY_REJECTED = `${HOSTED_KEY_REJECTED_REASON}. Run \`gscdump auth login --mode cloud --api-key KEY\` with a valid key.`;
+const HOSTED_KEY_REJECTED = `${HOSTED_KEY_REJECTED_REASON}. Run \`gscdump auth login --mode hosted --api-key KEY\` with a valid key.`;
 const QUOTA_MESSAGE_RE = /quota|rate\s*limit/i;
 const ANSI_RE = /\x1B\[[0-9;]*m/g;
 function suggestionForGscError(error) {

package/dist/hosted-auth.mjs

@@ -1,75 +1,34 @@
 import { z } from "zod";
 const ORIGIN = "https://gscdump.com";
-const accessSchema = z.object({
-	accessToken: z.string().min(1),
-	expiresAt: z.number().int().positive()
-});
 const pollSchema = z.discriminatedUnion("status", [z.object({ status: z.literal("pending") }), z.object({
-	status: z.literal("complete"),
-	tokens: accessSchema.extend({ refreshToken: z.string().min(1) })
-})]);
-const cloudPollSchema = z.discriminatedUnion("status", [z.object({ status: z.literal("pending") }), z.object({
 	status: z.literal("complete"),
 	sessionId: z.string().regex(/^[a-f0-9]{64}$/)
 })]);
-async function requestJson(request, route, init = {}, failureMessage) {
+const HOSTED_LOGIN_FAILURE = "Hosted login failed. Run `gscdump auth login --mode hosted` to try again.";
+async function requestJson(request, route, init = {}) {
 	const response = await request(`${ORIGIN}/api/cli/auth/${route}`, {
 		...init,
 		redirect: "error",
 		signal: AbortSignal.timeout(3e4)
 	});
 	if (!response.ok) {
-		if (response.status === 429 || response.status >= 500) throw new Error("Google authorization is temporarily unavailable. Try again later.");
-		throw new Error(failureMessage ?? "Google authorization failed. Run `gscdump auth login --mode local --force` to reconnect.");
+		if (response.status === 429 || response.status >= 500) throw new Error("gscdump.com login is temporarily unavailable. Try again later.");
+		throw new Error(HOSTED_LOGIN_FAILURE);
 	}
 	return response.json();
 }
-async function refreshWithPlatform(refreshToken, request = fetch) {
-	const result = accessSchema.parse(await requestJson(request, "refresh", {
-		method: "POST",
-		headers: { "Content-Type": "application/json" },
-		body: JSON.stringify({ refreshToken })
-	}));
-	return {
-		access_token: result.accessToken,
-		expiry_date: result.expiresAt
-	};
-}
-async function loginWithPlatform(deps) {
-	const init = z.object({
-		code: z.string().regex(/^[A-F0-9]{20}$/),
-		expiresIn: z.number().int().positive().max(600)
-	}).parse(await requestJson(deps.request, "init", { method: "POST" }));
-	const deadline = deps.now() + init.expiresIn * 1e3;
-	const redirect = `/app/cli/auth?code=${init.code}`;
-	const route = deps.force ? `/auth/google?reauth=1&redirect=${encodeURIComponent(redirect)}` : redirect;
-	await deps.authorize(`${ORIGIN}${route}`);
-	while (deps.now() < deadline) {
-		const result = pollSchema.parse(await requestJson(deps.request, `poll?code=${init.code}`));
-		if (result.status === "complete") return {
-			provider: "gscdump",
-			access_token: result.tokens.accessToken,
-			refresh_token: result.tokens.refreshToken,
-			expiry_date: result.tokens.expiresAt
-		};
-		await deps.wait(2e3);
-	}
-	throw new Error("Authorization expired. Run `gscdump auth login` to try again.");
-}
-const CLOUD_SESSION_FAILURE = "Cloud authorization failed. Run `gscdump auth login --mode cloud` to try again.";
-async function loginWithCloudSession(deps) {
+async function loginWithHostedSession(deps) {
 	const init = z.object({
 		code: z.string().regex(/^S-[A-F0-9]{20}$/),
 		expiresIn: z.number().int().positive().max(600)
-	}).parse(await requestJson(deps.request, "init?mode=cloud", { method: "POST" }, CLOUD_SESSION_FAILURE));
+	}).parse(await requestJson(deps.request, "init?mode=cloud", { method: "POST" }));
 	const deadline = deps.now() + init.expiresIn * 1e3;
-	const url = `${ORIGIN}/app/cli/auth?code=${init.code}`;
-	await deps.authorize(url);
+	await deps.authorize(`${ORIGIN}/app/cli/auth?code=${init.code}`);
 	while (deps.now() < deadline) {
-		const result = cloudPollSchema.parse(await requestJson(deps.request, `poll?code=${init.code}`, {}, CLOUD_SESSION_FAILURE));
+		const result = pollSchema.parse(await requestJson(deps.request, `poll?code=${init.code}`));
 		if (result.status === "complete") return result.sessionId;
 		await deps.wait(2e3);
 	}
-	throw new Error("Authorization expired. Run `gscdump auth login --mode cloud` to try again.");
+	throw new Error("Authorization expired. Run `gscdump auth login --mode hosted` to try again.");
 }
-export { loginWithCloudSession, loginWithPlatform, refreshWithPlatform };
+export { loginWithHostedSession };

package/dist/hosted-query.mjs

@@ -0,0 +1,31 @@
+const PAGE_SIZE = 25e3;
+function toWireFilter(filter) {
+	const source = filter;
+	return {
+		_filters: source._filters,
+		...source._nestedGroups ? { _nestedGroups: source._nestedGroups.map((group) => toWireFilter(group)) } : {},
+		...source._groupType ? { _groupType: source._groupType } : {}
+	};
+}
+async function queryHostedRows(client, siteId, state) {
+	const limit = state.rowLimit ?? PAGE_SIZE;
+	const rows = [];
+	while (rows.length < limit) {
+		const rowLimit = Math.min(PAGE_SIZE, limit - rows.length);
+		const body = {
+			...state,
+			...state.filter ? { filter: toWireFilter(state.filter) } : {},
+			...state.prefilter ? { prefilter: toWireFilter(state.prefilter) } : {},
+			rowLimit,
+			...rows.length > 0 ? { startRow: (state.startRow ?? 0) + rows.length } : {}
+		};
+		const page = (await client.queryAnalyticsRows({
+			params: { siteId },
+			body
+		})).data.rows;
+		rows.push(...page);
+		if (page.length < rowLimit) break;
+	}
+	return rows;
+}
+export { queryHostedRows };

package/dist/hosted-site.mjs

@@ -1,4 +1,4 @@
-import { cloudCredential, getCloudAccount, parseAuthentication, resolveAuthentication } from "./auth-state.mjs";
+import { getHostedAccount, hostedCredential, parseAuthentication, resolveAuthentication } from "./auth-state.mjs";
 import { loadConfig } from "./config.mjs";
 import { resolveCliEnvironment } from "./environment.mjs";
 import { logger } from "./utils.mjs";
@@ -12,7 +12,7 @@ const HOSTED_ARGS = {
 	},
 	"api-root": {
 		type: "string",
-		description: "Hosted API root; defaults to saved cloud authentication or https://gscdump.com/api"
+		description: "Hosted API root; defaults to the saved Hosted mode or https://gscdump.com/api"
 	},
 	"api-key": {
 		type: "string",
@@ -71,19 +71,19 @@ async function resolveHostedSite(args, command) {
 	if (args._?.length) fail(`\`gscdump ${command.name}\` does not accept a positional Site ID. Pass --site instead.`);
 	const environment = resolveCliEnvironment().values;
 	const authentication = args["api-key"] ? parseAuthentication({
-		_tag: "Cloud",
+		_tag: "Hosted",
 		apiKey: args["api-key"],
 		apiRoot: String(args["api-root"] || environment.GSCDUMP_API_ROOT || "https://gscdump.com/api")
 	}) : await resolveAuthentication();
-	if (authentication._tag !== "Cloud") fail(`\`gscdump ${command.name}\` needs hosted authentication. Run \`gscdump auth login --mode cloud\` or pass --api-key. With local authentication, ${command.localAlternative}.`);
+	if (authentication._tag !== "Hosted") fail(`\`gscdump ${command.name}\` reads the hosted record, so it needs Hosted mode. Run \`gscdump auth login --mode hosted\`, or pass --api-key. In Local mode, ${command.localAlternative}.`);
 	if (args["api-root"] && String(args["api-root"]).replace(/\/+$/, "") !== authentication.apiRoot) fail("The API root changed. Pass --api-key for the new API root.");
 	const target = args.site ? String(args.site) : (await loadConfig()).defaultSite;
-	const match = matchHostedSite((await getCloudAccount(authentication)).sites, target);
+	const match = matchHostedSite((await getHostedAccount(authentication)).sites, target);
 	if (match.kind !== "found") fail(describeMatchFailure(match));
 	return {
 		client: createGscdumpV1Client({
 			apiRoot: authentication.apiRoot,
-			credential: cloudCredential(authentication)
+			credential: hostedCredential(authentication)
 		}),
 		site: match.site
 	};

package/dist/mcp/errors.mjs

@@ -1,5 +1,3 @@
-import { HOSTED_KEY_REJECTED, HOSTED_KEY_REJECTED_REASON } from "../error-handler.mjs";
-import { resolveAuthentication } from "../auth-state.mjs";
 import { resolveBYOK, resolveServiceAccount } from "../auth.mjs";
 import { COMPARISON_FLAGS, PERIOD_FLAGS } from "../window.mjs";
 import { isAnalysisError } from "@gscdump/analysis/errors";
@@ -93,9 +91,8 @@ function httpStatus(error) {
 	return typeof status === "number" ? status : void 0;
 }
 async function authenticationMode() {
-	if ((await resolveAuthentication().catch(() => null))?._tag === "Cloud") return "cloud";
 	if (await resolveServiceAccount().then(Boolean).catch(() => null)) return "service-account";
-	return await Promise.resolve().then(() => resolveBYOK()).catch(() => null) ? "byok" : "local";
+	return await Promise.resolve().then(() => resolveBYOK()).catch(() => null) ? "env" : "local";
 }
 const OAUTH_TOKEN_FAILURE_RE = /invalid_grant|invalid_client|unauthorized_client|token has been expired|token has been revoked/i;
 function classifyGoogleError(error) {
@@ -109,14 +106,10 @@ function classifyGoogleError(error) {
 }
 function nextStep(error, status, mode) {
 	if (error.kind === "rate-limited") return `Google quota or rate limit reached. Try again in ${error.retryAfter ? `${error.retryAfter}s` : "a few minutes"}.`;
-	if (status === 403) {
-		if (mode === "cloud") return "The gscdump.com account cannot open this Site. Check the Site is connected to your account at gscdump.com.";
-		return "The signed-in account cannot open this Site. Check its Search Console permissions, or run `gscdump auth status` to see the account.";
-	}
+	if (status === 403) return "The signed-in account cannot open this Site. Check its Search Console permissions, or run `gscdump auth status` to see the account.";
 	if (status === 401 || error.kind === "auth-expired") {
-		if (mode === "cloud") return "Run `gscdump auth login --mode cloud` in a terminal, then restart the MCP client.";
 		if (mode === "service-account") return "Fix the service-account key (GSC_SERVICE_ACCOUNT_JSON or GOOGLE_APPLICATION_CREDENTIALS) in the MCP server configuration and restart the MCP client, or run `gscdump auth status`.";
-		if (mode === "byok") return "Refresh GSC_ACCESS_TOKEN (or GSC_CLIENT_ID, GSC_CLIENT_SECRET, and GSC_REFRESH_TOKEN) in the MCP server configuration and restart the MCP client.";
+		if (mode === "env") return "Refresh GSC_ACCESS_TOKEN (or GSC_CLIENT_ID, GSC_CLIENT_SECRET, and GSC_REFRESH_TOKEN) in the MCP server configuration and restart the MCP client.";
 		return "Run `gscdump auth login` in a terminal to connect again.";
 	}
 	if (error.kind === "not-found") return "Check the Site and URL. Call list-sites to see the Sites of this account.";
@@ -127,10 +120,7 @@ function describeApiError(error, mode = "local") {
 	const status = httpStatus(error);
 	if (status === void 0) return null;
 	const classified = classifyGoogleError(error);
-	const message = googleMessage(error) ?? classified.message;
-	if (message === HOSTED_KEY_REJECTED) return `API error ${status}: ${HOSTED_KEY_REJECTED_REASON}. Replace GSCDUMP_API_KEY with a key from gscdump.com Agent setup, then restart the MCP client.`;
-	if (message === "gscdump.com rejected the CLI session. Run `gscdump auth login --mode cloud` again.") return `API error ${status}: gscdump.com rejected the CLI session. Run \`gscdump auth login --mode cloud\` again, then restart the MCP client.`;
-	return `API error ${status}: ${message.replace(/\s+/g, " ").trim().replace(/\.$/, "")}. ${nextStep(classified, status, mode)}`.trim();
+	return `API error ${status}: ${(googleMessage(error) ?? classified.message).replace(/\s+/g, " ").trim().replace(/\.$/, "")}. ${nextStep(classified, status, mode)}`.trim();
 }
 function googleMessage(error) {
 	const bodies = [error?.data, error?.response?.data];

package/dist/mcp/handlers/diagnostics.mjs

@@ -1,4 +1,3 @@
-import { getCloudAccount } from "../../auth-state.mjs";
 import { missingRequiredScopes } from "../../auth-scopes.mjs";
 import { currentAccessToken, fetchTokenInfo, redactTokens } from "../../token-info.mjs";
 import { ofetch } from "ofetch";
@@ -6,36 +5,6 @@ const FETCH_TIMEOUT_MS = 5e3;
 const TIME_SKEW_WARN_MS = 3e5;
 async function diagnostics(_input, ctx) {
 	const checks = [];
-	if (ctx.authentication?._tag === "Cloud") {
-		const [account, sites] = await Promise.all([getCloudAccount(ctx.authentication).catch((error) => error), ctx.client.sites().catch((error) => error)]);
-		checks.push(account instanceof Error ? {
-			name: "auth",
-			status: "fail",
-			detail: account.message
-		} : {
-			name: "auth",
-			status: "pass",
-			detail: `Cloud account: ${account.user.email}`
-		});
-		checks.push(sites instanceof Error ? {
-			name: "gsc.sites",
-			status: "fail",
-			detail: sites.message
-		} : {
-			name: "gsc.sites",
-			status: "pass",
-			detail: `${sites.length} Site(s) accessible through cloud authentication`
-		});
-		checks.push({
-			name: "auth.capabilities",
-			status: "info",
-			detail: "Google indexing and Site Verification require --mode local."
-		});
-		return {
-			ok: checks.every((check) => check.status !== "fail"),
-			checks
-		};
-	}
 	const current = await resolveAccessToken(ctx.auth);
 	if (current.kind === "failed") {
 		checks.push({

package/dist/package.mjs

@@ -1,2 +1,2 @@
-var version = "4.2.2";
+var version = "4.3.0";
 export { version };

package/dist/route.mjs

@@ -7,6 +7,7 @@ import { addDays } from "gscdump/dates";
 import { buildCoveragePlan, gapsForRange } from "@gscdump/engine/analysis-range";
 const CONNECT_COMMAND = "gscdump init";
 const LOGIN_COMMAND = "gscdump auth login";
+const LOCAL_LOGIN_COMMAND = "gscdump auth login --mode local";
 function isCovered(need) {
 	return need.kind === "window" ? need.gaps.length === 0 : need.stored;
 }
@@ -76,7 +77,7 @@ function decideRoute(req, state) {
 	const { auth, coverage, syncRun } = state;
 	const stored = coverage.some((need) => need.stored);
 	const covered = coverage.length > 0 && coverage.every(isCovered);
-	const connected = auth !== "none";
+	const connected = auth === "google";
 	const syncCommand = syncCommandFor(req.site ?? req.siteHint, coverage);
 	const tables = [...new Set(coverage.flatMap((need) => need.kind === "window" ? [need.table] : need.tables))];
 	const searchTypes = [...new Set(coverage.flatMap((need) => need.searchType && need.searchType !== "web" ? [need.searchType] : []))];
@@ -87,7 +88,7 @@ function decideRoute(req, state) {
 			tables,
 			...searchTypes.length > 0 ? { searchTypes } : {}
 		},
-		nextCommand: CONNECT_COMMAND
+		nextCommand: auth === "hosted" ? LOCAL_LOGIN_COMMAND : CONNECT_COMMAND
 	};
 	if (req.forceLive) {
 		if (!req.liveCapable) return {
@@ -150,7 +151,7 @@ function decideRoute(req, state) {
 			missing: gaps,
 			windows: windowGaps(coverage)
 		},
-		nextCommand: connected ? syncCommand : LOGIN_COMMAND
+		nextCommand: connected ? syncCommand : auth === "hosted" ? LOCAL_LOGIN_COMMAND : LOGIN_COMMAND
 	};
 }
 function siteLabel(site) {
@@ -165,6 +166,10 @@ function routeMessage(route, req, auth) {
 	const next = route.nextCommand;
 	switch (route.reason.kind) {
 		case "not-connected": {
+			if (auth === "hosted") {
+				const read = req.site ?? req.siteHint ? ` If you want the hosted record, run \`gscdump query --site ${siteArg(req.site ?? req.siteHint)}\`.` : "";
+				return `${route.reason.tables.length > 0 ? `The Store has no ${route.reason.tables.join(", ")} data for ${site}.` : `\`${req.label}\` needs Search Console.`} Hosted mode never calls Google, so it cannot sync or query live.${read} If you want Local mode, run \`${next}\`.`;
+			}
 			const types = route.reason.searchTypes ?? [];
 			const slice = types.length > 0 ? `${types.join(", ")} ` : "";
 			return `${route.reason.tables.length > 0 ? `The Store has no ${slice}${route.reason.tables.join(", ")} data for ${site}, and Google is not connected.` : `\`${req.label}\` needs Search Console, and Google is not connected.`} Run \`${next}\` to connect Google and sync the Site, or \`${LOGIN_COMMAND}\` to query Search Console directly.`;
@@ -175,6 +180,7 @@ function routeMessage(route, req, auth) {
 		case "partial": {
 			const { done, total, windows } = route.reason;
 			const head = [`The Store has ${done.toLocaleString("en-US")} of ${total.toLocaleString("en-US")} days for ${site}.`, ...windows.map(windowGapLine)].join("\n");
+			if (auth === "hosted") return `${head}\nHosted mode never calls Google, so it cannot sync the Store. If you want Local mode, run \`${next}\`, then \`${syncCommandFor(req.site ?? req.siteHint, [])}\`.`;
 			if (auth === "none") return `${head}\nRun \`${next}\` to connect Google, then \`${syncCommandFor(req.site ?? req.siteHint, [])}\` to sync the rest.`;
 			return `${head}\nRun \`${next}\` to sync the rest${req.liveCapable ? ", or pass --live to ask Search Console directly" : ""}.`;
 		}
@@ -252,7 +258,7 @@ async function readSiteStates(store, site) {
 }
 async function resolveReadSite(ctx, target, opts) {
 	const auth = await probeAuth();
-	const connected = auth !== "none";
+	const connected = auth === "google";
 	if (opts.forceLive && connected) return {
 		site: await (await opts.connect()).resolveSite(target, { scope: "account" }),
 		auth

package/dist/runtime.d.mts

@@ -1,7 +1,7 @@
 import { ConsolaInstance } from "consola";
 export type CliEnvironmentSource = Record<string, string | undefined>;
 export interface CliRuntime {
-  authModeOverride?: 'cloud' | 'local';
+  authModeOverride?: 'local' | 'hosted';
   activeProfileOverride: string | null;
   colorEnabled: boolean;
   configDir: string;

package/dist/sync-plan.mjs

@@ -1,5 +1,5 @@
-import { searchTypeSupportsDimensions, searchTypeSupportsQueries } from "@gscdump/contracts";
 import { addDays, getDateRange } from "gscdump/dates";
+import { searchTypeSupportsDimensions, searchTypeSupportsQueries } from "@gscdump/contracts";
 const TABLE_NEEDS = {
 	pages: {
 		queries: false,

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@gscdump/cli",
   "type": "module",
-  "version": "4.2.2",
+  "version": "4.3.0",
   "description": "CLI for Google Search Console and Bing with hosted or local authentication, data exports, and an MCP server",
   "author": {
     "name": "Harlan Wilton",
@@ -44,16 +44,16 @@
   "dependencies": {
     "@clack/prompts": "^1.8.1",
     "@duckdb/node-api": "1.5.5-r.5",
-    "@gscdump/analysis": "^4.2.2",
-    "@gscdump/contracts": "^4.2.2",
-    "@gscdump/engine": "^4.2.2",
-    "@gscdump/engine-gsc-api": "^4.2.2",
-    "@gscdump/sdk": "^4.2.2",
+    "@gscdump/analysis": "^4.3.0",
+    "@gscdump/contracts": "^4.3.0",
+    "@gscdump/engine": "^4.3.0",
+    "@gscdump/engine-gsc-api": "^4.3.0",
+    "@gscdump/sdk": "^4.3.0",
     "@modelcontextprotocol/sdk": "^1.30.1",
     "citty": "^0.2.2",
     "consola": "^3.4.2",
     "google-auth-library": "^11.1.0",
-    "gscdump": "^4.2.2",
+    "gscdump": "^4.3.0",
     "ofetch": "^1.5.1",
     "open": "^11.0.4",
     "proper-lockfile": "^4.1.2",