@gscdump/cli 4.2.3 → 4.3.0

package/README.md

@@ -2,7 +2,7 @@
 
 Google Search Console CLI and MCP server.
 
-Choose [cloud or local access](../../docs/gscdump-cli/guides/1.start/2.choose-access.md) before login. Cloud login opens gscdump.com and saves a CLI session. Local login calls Google directly and can use your own Google credentials.
+Choose [Local or Hosted mode](../../docs/gscdump-cli/guides/1.start/2.choose-access.md) before login. Local mode calls Google with your own credentials: a service account or an OAuth client. Hosted mode opens gscdump.com, saves a CLI session, and reads your hosted record. It never calls Google.
 
 ```bash
 npm install -g @gscdump/cli

package/dist/auth-scopes.mjs

@@ -1,9 +1,9 @@
-import { GSC_INDEXING_SCOPE, GSC_READ_SCOPE, GSC_SITE_VERIFICATION_SCOPE, GSC_WRITE_SCOPE, hasGoogleScope } from "gscdump/client";
-function missingRequiredScopes(scopes, provider) {
-	return (provider === "gscdump" ? [GSC_READ_SCOPE] : [
+import { GSC_INDEXING_SCOPE, GSC_SITE_VERIFICATION_SCOPE, GSC_WRITE_SCOPE, hasGoogleScope } from "gscdump/client";
+function missingRequiredScopes(scopes) {
+	return [
 		GSC_WRITE_SCOPE,
 		GSC_INDEXING_SCOPE,
 		GSC_SITE_VERIFICATION_SCOPE
-	]).filter((scope) => !hasGoogleScope(scopes, scope));
+	].filter((scope) => !hasGoogleScope(scopes, scope));
 }
 export { missingRequiredScopes };

package/dist/auth-state.mjs

@@ -3,9 +3,15 @@ import { useCliRuntime } from "./runtime.mjs";
 import { randomUUID } from "node:crypto";
 import fs from "node:fs/promises";
 import path from "node:path";
-import { gscdumpAvailableSiteSchema } from "@gscdump/contracts";
 import { z } from "zod";
-const HOSTED_SESSION_REJECTED = "gscdump.com rejected the CLI session. Run `gscdump auth login --mode cloud` again.";
+const HOSTED_SESSION_REJECTED = "gscdump.com rejected the CLI session. Run `gscdump auth login --mode hosted` again.";
+const LOCAL_MODE_REQUIRED = [
+	"This command calls Google, so it needs Local mode.",
+	"Hosted mode reads your gscdump.com record and never calls Google.",
+	"If you want Local mode, run `gscdump auth login --mode local`."
+].join("\n");
+const HOSTED_NOT_SET_UP = "Hosted credentials are missing. Run `gscdump auth login --mode hosted`, or set GSCDUMP_API_KEY.";
+const SAVED_STATE_INVALID = "The saved access mode is invalid. Run `gscdump auth login --mode local` or `gscdump auth login --mode hosted`.";
 const apiRootSchema = z.url().transform((value) => value.replace(/\/+$/, "")).refine((value) => {
 	const url = new URL(value);
 	return !url.username && !url.password && !url.search && !url.hash && (url.protocol === "https:" || url.protocol === "http:" && [
@@ -17,24 +23,47 @@ const apiRootSchema = z.url().transform((value) => value.replace(/\/+$/, "")).re
 const stateSchema = z.union([
 	z.object({ _tag: z.literal("Local") }),
 	z.object({
-		_tag: z.literal("Cloud"),
+		_tag: z.literal("Hosted"),
 		apiRoot: apiRootSchema,
 		apiKey: z.string().trim().regex(/^gsd_user_\S+$/)
 	}),
 	z.object({
-		_tag: z.literal("Cloud"),
+		_tag: z.literal("Hosted"),
 		apiRoot: apiRootSchema,
 		sessionId: z.string().regex(/^[a-f0-9]{64}$/)
 	})
 ]);
 function parseAuthMode(value) {
 	if (value === void 0 || value === "") return void 0;
-	if (value === "cloud" || value === "local") return value;
-	throw new Error("Authentication mode must be cloud or local.");
+	if (value === "local" || value === "hosted") return value;
+	throw new Error("Access mode must be local or hosted.");
+}
+function resolveAccessMode(input) {
+	if (input.flag) return {
+		mode: input.flag,
+		source: "flag"
+	};
+	const env = parseAuthMode(input.env);
+	if (env) return {
+		mode: env,
+		source: "env"
+	};
+	if (input.saved) return {
+		mode: input.saved,
+		source: "saved"
+	};
+	if (input.apiKey) return {
+		mode: "hosted",
+		source: "api-key"
+	};
+	return {
+		mode: "local",
+		source: "default"
+	};
 }
 function parseAuthentication(value) {
 	const parsed = stateSchema.safeParse(value);
-	if (!parsed.success) throw new Error("Invalid authentication. Use a CLI session or gscdump user API key with a trusted API root.");
+	if (!parsed.success) throw new Error("Invalid Hosted credentials. Use a CLI session or a gscdump user API key with a trusted API root.");
 	return parsed.data;
 }
 async function saveAuthentication(state) {
@@ -59,50 +88,70 @@ async function saveAuthentication(state) {
 async function clearAuthentication() {
 	await fs.rm(path.join(useCliRuntime().configDir, "authentication.json"), { force: true });
 }
-async function revokeCloudSession(state) {
+async function revokeHostedSession(state) {
 	if (!("sessionId" in state)) return;
-	await cloudRequest(state, "/cli/auth/logout", { method: "POST" });
+	await hostedRequest(state, "/cli/auth/logout", { method: "POST" });
+}
+async function readSavedAuthentication(configDir) {
+	const body = await fs.readFile(path.join(configDir, "authentication.json"), "utf8").catch((error) => {
+		if (error.code === "ENOENT") return null;
+		throw error;
+	});
+	if (body === null) return null;
+	const saved = stateSchema.safeParse(JSON.parse(body));
+	if (!saved.success) throw new Error(SAVED_STATE_INVALID);
+	return saved.data;
 }
 async function resolveAuthentication() {
 	const runtime = useCliRuntime();
 	const env = runtime.environment;
-	const mode = runtime.authModeOverride ?? parseAuthMode(env.GSCDUMP_AUTH_MODE);
-	if (mode === "local") return { _tag: "Local" };
-	const body = await fs.readFile(path.join(runtime.configDir, "authentication.json"), "utf8").catch((error) => {
-		if (error.code === "ENOENT") return null;
-		throw error;
+	const flag = runtime.authModeOverride;
+	const envMode = parseAuthMode(env.GSCDUMP_AUTH_MODE);
+	if ((flag ?? envMode) === "local") return { _tag: "Local" };
+	const state = await readSavedAuthentication(runtime.configDir);
+	const { mode } = resolveAccessMode({
+		flag,
+		env: envMode,
+		saved: state ? state._tag === "Hosted" ? "hosted" : "local" : void 0,
+		apiKey: env.GSCDUMP_API_KEY
 	});
-	const saved = body === null ? null : stateSchema.safeParse(JSON.parse(body));
-	if (saved && !saved.success) throw new Error("Saved authentication is invalid. Run `gscdump auth login --mode cloud` or `--mode local`.");
-	const state = saved?.success ? saved.data : null;
-	if (mode !== "cloud" && state?._tag === "Local") return state;
+	if (mode === "local") return { _tag: "Local" };
 	if (env.GSCDUMP_API_KEY) {
 		const parsed = stateSchema.safeParse({
-			_tag: "Cloud",
+			_tag: "Hosted",
 			apiKey: env.GSCDUMP_API_KEY,
-			apiRoot: env.GSCDUMP_API_ROOT ?? (state?._tag === "Cloud" ? state.apiRoot : "https://gscdump.com/api")
+			apiRoot: env.GSCDUMP_API_ROOT ?? (state?._tag === "Hosted" ? state.apiRoot : "https://gscdump.com/api")
 		});
-		if (!parsed.success) throw new Error("Invalid hosted authentication. Set GSCDUMP_API_KEY to a gscdump user API key.");
+		if (!parsed.success) throw new Error("GSCDUMP_API_KEY is invalid. Set it to a gscdump user API key.");
 		return parsed.data;
 	}
-	if (state?._tag === "Cloud") {
-		if (env.GSCDUMP_API_ROOT && env.GSCDUMP_API_ROOT.replace(/\/+$/, "") !== state.apiRoot) throw new Error("The API root changed. Run `gscdump auth login --mode cloud` for the new API root.");
+	if (state?._tag === "Hosted") {
+		if (env.GSCDUMP_API_ROOT && env.GSCDUMP_API_ROOT.replace(/\/+$/, "") !== state.apiRoot) throw new Error("The API root changed. Run `gscdump auth login --mode hosted` for the new API root.");
 		return state;
 	}
-	if (mode === "cloud") throw new Error("Hosted credentials are missing. Run `gscdump auth login --mode cloud`.");
-	return { _tag: "Local" };
+	throw new Error(HOSTED_NOT_SET_UP);
 }
+const hostedSiteSchema = z.object({
+	siteId: z.string(),
+	siteUrl: z.string(),
+	syncStatus: z.string().nullable().optional(),
+	syncProgress: z.object({
+		completed: z.number(),
+		total: z.number(),
+		percent: z.number()
+	}).passthrough().nullable().optional(),
+	lastSyncAt: z.number().nullable().optional(),
+	newestDateSynced: z.string().nullable().optional(),
+	oldestDateSynced: z.string().nullable().optional()
+}).passthrough();
 const accountSchema = z.object({
 	user: z.object({
 		publicId: z.string(),
 		email: z.string()
 	}),
-	sites: z.array(z.object({
-		siteId: z.string(),
-		siteUrl: z.string()
-	}).passthrough())
+	sites: z.array(hostedSiteSchema)
 });
-async function cloudRequest(state, route, options = {}) {
+async function hostedRequest(state, route, options = {}) {
 	const response = await fetch(`${state.apiRoot}${route}`, {
 		...options,
 		headers: {
@@ -122,22 +171,16 @@ async function cloudRequest(state, route, options = {}) {
 	}
 	return response.status === 204 ? void 0 : response.json();
 }
-function cloudCredential(state) {
+function hostedCredential(state) {
 	return "sessionId" in state ? state.sessionId : state.apiKey;
 }
-async function getCloudAccount(state) {
-	const result = accountSchema.safeParse(await cloudRequest(state, "/cli/me"));
-	if (!result.success) throw new Error("The hosted API returned invalid account data.");
-	return result.data;
-}
-async function getCloudSites(state) {
-	const result = gscdumpAvailableSiteSchema.array().safeParse(await cloudRequest(state, "/cli/sites/available"));
-	if (!result.success) throw new Error("The hosted API returned invalid Site data.");
+async function getHostedAccount(state) {
+	const result = accountSchema.safeParse(await hostedRequest(state, "/cli/me"));
+	if (!result.success) throw new Error("gscdump.com returned invalid account data.");
 	return result.data;
 }
 function formatHostedSync(site) {
-	if (!site.registered) return void 0;
 	const status = site.syncStatus ?? "pending";
 	return `${status}${site.syncProgress && site.syncProgress.total > 0 && status !== "synced" ? `: ${site.syncProgress.completed.toLocaleString("en-US")} of ${site.syncProgress.total.toLocaleString("en-US")} days (${Math.round(site.syncProgress.percent)}%)` : ""}${status === "synced" && site.oldestDateSynced && site.newestDateSynced ? `: ${site.oldestDateSynced} to ${site.newestDateSynced}` : ""}`;
 }
-export { HOSTED_SESSION_REJECTED, clearAuthentication, cloudCredential, cloudRequest, formatHostedSync, getCloudAccount, getCloudSites, parseAuthMode, parseAuthentication, resolveAuthentication, revokeCloudSession, saveAuthentication };
+export { HOSTED_NOT_SET_UP, HOSTED_SESSION_REJECTED, LOCAL_MODE_REQUIRED, clearAuthentication, formatHostedSync, getHostedAccount, hostedCredential, hostedRequest, parseAuthMode, parseAuthentication, resolveAccessMode, resolveAuthentication, revokeHostedSession, saveAuthentication };

package/dist/auth.mjs

@@ -1,16 +1,14 @@
 import { resolveAuthentication } from "./auth-state.mjs";
-import { getConfigDir, loadConfig } from "./config.mjs";
+import { getConfigDir, loadConfig, saveConfig } from "./config.mjs";
 import { pickCliEnvironmentValue, resolveCliEnvironment } from "./environment.mjs";
 import { getAppliedEnvKeys, getLoadedEnvPath } from "./env-file.mjs";
 import { displayPath, logger } from "./utils.mjs";
-import { loginWithPlatform, refreshWithPlatform } from "./hosted-auth.mjs";
 import process from "node:process";
 import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
 import fs from "node:fs/promises";
 import path from "node:path";
 import { Buffer } from "node:buffer";
 import { createServer } from "node:http";
-import { setTimeout as setTimeout$1 } from "node:timers/promises";
 import { text } from "@clack/prompts";
 import { CodeChallengeMethod, JWT, OAuth2Client } from "google-auth-library";
 import { createAuth } from "gscdump/client";
@@ -67,14 +65,18 @@ function resolveBYOK(opts = {}) {
 function getTokensPath() {
 	return path.join(getConfigDir(), "tokens.json");
 }
-const GOOGLE_NOT_CONNECTED = [
-	"Google is not connected. Use one of these:",
-	"  Local:  gscdump auth login",
-	"  Cloud:  gscdump auth login --mode cloud (opens a browser)",
-	"  BYOK:   set GSC_ACCESS_TOKEN, or GSC_CLIENT_ID, GSC_CLIENT_SECRET and GSC_REFRESH_TOKEN"
+const ACCESS_NOT_SET_UP = [
+	"Google credentials are missing. Set up one of the 2 access modes:",
+	"  Local mode uses your own Google credentials:",
+	"    Service account (recommended): gscdump auth login --mode local --service-account ./key.json",
+	"    OAuth client: set GSC_CLIENT_ID and GSC_CLIENT_SECRET, then run `gscdump auth login --mode local`",
+	"  Hosted mode reads your gscdump.com record:",
+	"    gscdump auth login --mode hosted",
+	"Guide: https://gscdump.com/gscdump-cli/guides/start/choose-access"
 ].join("\n");
 async function loadTokens() {
-	return fs.readFile(getTokensPath(), "utf-8").then((data) => JSON.parse(data)).catch(() => null);
+	const tokens = await fs.readFile(getTokensPath(), "utf-8").then((data) => JSON.parse(data)).catch(() => null);
+	return tokens?.provider === "gscdump" ? null : tokens;
 }
 async function saveTokens(tokens) {
 	await fs.mkdir(getConfigDir(), {
@@ -112,19 +114,20 @@ async function getAuthCredentials(interactive) {
 			clientSecret: config.clientSecret
 		};
 	}
-	if (!interactive) {
-		logger.error("GOOGLE_CLIENT_ID and GOOGLE_CLIENT_SECRET required for non-interactive mode");
-		process.exit(1);
-	}
+	if (!interactive) throw new Error(ACCESS_NOT_SET_UP);
 	console.log();
-	console.log("  \x1B[1mOAuth 2.0 Setup Required\x1B[0m");
-	console.log("  \x1B[90mThe Google Search Console API requires OAuth 2.0 credentials.\x1B[0m");
+	console.log("  \x1B[1mLocal mode: OAuth client setup\x1B[0m");
+	console.log("  \x1B[90mA service account is simpler and never expires. To use one, press Ctrl+C and run:\x1B[0m");
+	console.log("  \x1B[90m  gscdump auth login --mode local --service-account ./key.json\x1B[0m");
+	console.log("  \x1B[90mTo read your gscdump.com record instead, run: gscdump auth login --mode hosted\x1B[0m");
 	console.log();
 	console.log("  \x1B[1mSteps:\x1B[0m");
-	console.log("  \x1B[90m1.\x1B[0m Go to \x1B[36mhttps://console.developers.google.com/apis/credentials\x1B[0m");
+	console.log("  \x1B[90m1.\x1B[0m Go to \x1B[36mhttps://console.cloud.google.com/apis/credentials\x1B[0m");
 	console.log("  \x1B[90m2.\x1B[0m Create credentials > OAuth client ID > Desktop application");
-	console.log("  \x1B[90m3.\x1B[0m Enable \"Search Console API\" and \"Web Search Indexing API\" for your project");
-	console.log("  \x1B[90m4.\x1B[0m Copy the Client ID and Client Secret");
+	console.log("  \x1B[90m3.\x1B[0m Enable \"Google Search Console API\" and \"Web Search Indexing API\" for your project");
+	console.log("  \x1B[90m4.\x1B[0m On the OAuth consent screen, set the publishing status to \"In production\"");
+	console.log("  \x1B[90m   In \"Testing\" status, Google expires refresh tokens after 7 days.\x1B[0m");
+	console.log("  \x1B[90m5.\x1B[0m Copy the Client ID and Client Secret");
 	console.log();
 	const clientIdResult = await text({
 		message: "Enter your Google OAuth Client ID:",
@@ -137,8 +140,13 @@ async function getAuthCredentials(interactive) {
 		validate: (v) => v ? void 0 : "Required"
 	});
 	if (typeof clientSecretResult !== "string") process.exit(1);
+	await saveConfig({
+		...config,
+		clientId: clientIdResult,
+		clientSecret: clientSecretResult
+	});
 	console.log();
-	logger.info("Tip: Set GOOGLE_CLIENT_ID and GOOGLE_CLIENT_SECRET env vars to skip prompts");
+	logger.info(`Saved the OAuth client to ${displayPath(`${getConfigDir()}/config.json`)}`);
 	return {
 		clientId: clientIdResult,
 		clientSecret: clientSecretResult
@@ -270,8 +278,7 @@ async function authenticate(credentials, interactive, opts = {}) {
 		}
 		return oauth2Client;
 	}
-	const savedTokens = !opts.force ? await loadTokens() : null;
-	const existingTokens = savedTokens?.provider === "gscdump" ? null : savedTokens;
+	const existingTokens = !opts.force ? await loadTokens() : null;
 	let refreshFailed = false;
 	let refreshError = null;
 	if (existingTokens) {
@@ -299,7 +306,7 @@ async function authenticate(credentials, interactive, opts = {}) {
 	}
 	if (!interactive) {
 		if (refreshFailed) throw new Error(`Token refresh failed${refreshError ? `: ${refreshError.message}` : ""}. The refresh token may be revoked or expired. Run \`gscdump auth login\` to sign in again.`);
-		throw new Error(GOOGLE_NOT_CONNECTED);
+		throw new Error(ACCESS_NOT_SET_UP);
 	}
 	const state = randomBytes(32).toString("base64url");
 	const codeVerifier = randomBytes(32).toString("base64url");
@@ -327,42 +334,11 @@ async function getAuth(opts = {}) {
 	const { interactive = true, noBrowser = false, force = false } = opts;
 	const env = resolveCliEnvironment();
 	const config = opts.config ?? await loadConfig();
-	if (env.clientId && env.clientSecret || config.clientId && config.clientSecret) return authenticate(await getAuthCredentials(interactive), interactive, {
+	if (!Boolean(env.clientId && env.clientSecret || config.clientId && config.clientSecret) && !interactive) throw new Error(ACCESS_NOT_SET_UP);
+	return authenticate(await getAuthCredentials(interactive), interactive, {
 		noBrowser,
 		force
 	});
-	let tokens = force ? null : await loadTokens();
-	if (tokens?.provider !== "gscdump" || !tokens.refresh_token) {
-		if (!interactive) throw new Error(GOOGLE_NOT_CONNECTED);
-		tokens = await loginWithPlatform({
-			force,
-			request: fetch,
-			now: Date.now,
-			wait: setTimeout$1,
-			authorize: async (url) => {
-				logger.info(`Open this URL to connect Google:\n${url}`);
-				if (!noBrowser) await open(url).catch((error) => logger.warn(`Browser could not open: ${error.message}. Open the URL above.`));
-			}
-		});
-		await saveTokens(tokens);
-	}
-	const refreshToken = tokens.refresh_token;
-	const client = new OAuth2Client();
-	client.refreshHandler = async () => {
-		const refreshed = await refreshWithPlatform(refreshToken);
-		await saveTokens({
-			provider: "gscdump",
-			refresh_token: refreshToken,
-			...refreshed
-		});
-		return refreshed;
-	};
-	client.setCredentials({
-		access_token: tokens.access_token,
-		expiry_date: tokens.expiry_date
-	});
-	await client.getAccessToken();
-	return client;
 }
 function isStaleServiceAccountPointer(error) {
 	if (error instanceof SyntaxError) return true;
@@ -379,7 +355,7 @@ async function resolveAuth(opts = {}) {
 	}
 	const byok = resolveBYOK(opts.byok);
 	if (byok) {
-		if (typeof byok !== "string") logger.success("Using BYOK credentials");
+		if (typeof byok !== "string") logger.success("Using Google credentials from the environment");
 		return byok;
 	}
 	return getAuth(opts);
@@ -474,7 +450,7 @@ async function describeAuthProvenance() {
 	else if (accessTok) effective = "byok-access-token";
 	else if (tokens) effective = "saved-tokens";
 	else effective = "none";
-	if ((effective === "byok-refresh-token" || effective === "byok-access-token") && tokens) warnings.push("BYOK env vars shadow saved tokens. If you just ran `auth login --force`, the env tokens are stale; unset them or update them.");
+	if ((effective === "byok-refresh-token" || effective === "byok-access-token") && tokens) warnings.push("Environment credentials take priority over saved tokens. If you just ran `auth login --force`, unset or update the environment tokens.");
 	if (effective === "byok-refresh-token" && clientId && refreshTok) {
 		if (getAppliedEnvKeys().has(clientId.envVar) !== getAppliedEnvKeys().has(refreshTok.envVar)) warnings.push(`client_id and refresh_token come from different sources (${envSourceLabel(clientId.envVar)} vs ${envSourceLabel(refreshTok.envVar)}); they may not match.`);
 	}
@@ -501,9 +477,9 @@ async function formatAuthProvenance() {
 	return lines.join("\n");
 }
 async function probeAuth() {
-	if ((await resolveAuthentication())._tag === "Cloud") return "hosted";
+	if ((await resolveAuthentication())._tag === "Hosted") return "hosted";
 	if (resolveBYOK()) return "google";
 	if (await resolveServiceAccount().then(Boolean, (error) => !isStaleServiceAccountPointer(error))) return "google";
 	return await loadTokens() !== null ? "google" : "none";
 }
-export { GOOGLE_NOT_CONNECTED, authenticate, clearTokens, describeAuthProvenance, formatAuthProvenance, getAuth, getAuthCredentials, loadServiceAccount, loadServiceAccountResult, loadTokens, probeAuth, resolveAuth, resolveBYOK, resolveServiceAccount, saveTokens };
+export { ACCESS_NOT_SET_UP, authenticate, clearTokens, describeAuthProvenance, formatAuthProvenance, getAuth, getAuthCredentials, isStaleServiceAccountPointer, loadServiceAccount, loadServiceAccountResult, loadTokens, probeAuth, resolveAuth, resolveBYOK, resolveServiceAccount, saveTokens };

package/dist/bing-hosted.mjs

@@ -1,15 +1,15 @@
-import { cloudCredential, getCloudAccount } from "./auth-state.mjs";
+import { getHostedAccount, hostedCredential } from "./auth-state.mjs";
 import { logger } from "./utils.mjs";
 import { writeBingDump } from "./bing-data.mjs";
 import { createGscdumpV1Client } from "@gscdump/sdk/v1";
 function hostedBingClient(state) {
 	return createGscdumpV1Client({
 		apiRoot: state.apiRoot,
-		credential: cloudCredential(state)
+		credential: hostedCredential(state)
 	});
 }
 async function listHostedBingSites(state) {
-	return loadHostedBingConnections(state, (await getCloudAccount(state)).sites, { tolerateFailures: true });
+	return loadHostedBingConnections(state, (await getHostedAccount(state)).sites, { tolerateFailures: true });
 }
 async function loadHostedBingConnections(state, sites, options = {}) {
 	const client = hostedBingClient(state);
@@ -29,7 +29,7 @@ async function loadHostedBingConnections(state, sites, options = {}) {
 }
 async function resolveHostedBingSites(state, input) {
 	if (Boolean(input.site) === Boolean(input.allSites)) throw new Error("Choose --site or --all-sites.");
-	const account = await getCloudAccount(state);
+	const account = await getHostedAccount(state);
 	const exact = account.sites.filter((site) => site.siteId === input.site || site.siteUrl === input.site);
 	const normalize = (value) => URL.parse(value.startsWith("sc-domain:") ? `https://${value.slice(10)}/` : value)?.toString();
 	const requested = input.allSites ? account.sites : exact.length ? exact : account.sites.filter((site) => normalize(site.siteUrl) === normalize(input.site) && normalize(input.site) !== void 0);

package/dist/command-meta.mjs

@@ -8,7 +8,7 @@ const dumpCommandMeta = {
 };
 const queryCommandMeta = {
 	name: "query",
-	description: "Run a search analytics query (local Parquet by default, --live hits GSC API)"
+	description: "Run a search analytics query (Store or hosted record; --live calls Google)"
 };
 const sitesCommandMeta = {
 	name: "sites",
@@ -53,7 +53,7 @@ const authCommandMeta = {
 	},
 	login: {
 		name: "login",
-		description: "Run OAuth flow and persist tokens (skip if BYOK env vars set)"
+		description: "Set up Local mode (service account or OAuth client) or Hosted mode (--mode hosted)"
 	},
 	logout: {
 		name: "logout",