@gscdump/cli 4.8.0 → 5.1.0

package/dist/analysis-local.mjs

@@ -1,5 +1,5 @@
-import { LocalStoreUnsupportedError } from "./error-handler.mjs";
 import { useCliRuntime } from "./runtime.mjs";
+import { LocalStoreUnsupportedError } from "./error-handler.mjs";
 import { logger } from "./utils.mjs";
 import { inferTable } from "./local-store.mjs";
 import { createCommandContext } from "./context.mjs";
@@ -174,7 +174,7 @@ async function resolveAnalysisSource(args) {
 		auth
 	});
 	const route = decideRoute(req, state);
-	if (route.kind === "syncing" || route.kind === "prompt") stopAtRoute(route, req, state.auth, { json: Boolean(args.json) });
+	if (route.kind === "syncing" || route.kind === "prompt") stopAtRoute(route, req, state.auth);
 	if (route.kind === "local") {
 		const source = createEngineQuerySource({
 			engine: store.engine,

package/dist/auth-state.mjs

@@ -1,15 +1,23 @@
-import { HOSTED_KEY_REJECTED } from "./error-handler.mjs";
 import { useCliRuntime } from "./runtime.mjs";
+import { stopError } from "./stop.mjs";
 import { randomUUID } from "node:crypto";
 import fs from "node:fs/promises";
 import path from "node:path";
 import { z } from "zod";
 const HOSTED_SESSION_REJECTED = "gscdump.com rejected the CLI session. Run `gscdump auth login --mode hosted` again.";
+const HOSTED_KEY_REJECTED = "gscdump.com rejected the API key. Run `gscdump auth login --mode hosted --api-key KEY` with a valid key.";
 const LOCAL_MODE_REQUIRED = [
 	"This command calls Google, so it needs Local mode.",
 	"Hosted mode reads your gscdump.com record and never calls Google.",
 	"If you want Local mode, run `gscdump auth login --mode local`."
 ].join("\n");
+function localModeRequired(detail) {
+	return stopError({
+		code: "LOCAL_MODE_REQUIRED",
+		message: detail ? `${detail}\n${LOCAL_MODE_REQUIRED}` : LOCAL_MODE_REQUIRED,
+		nextCommand: "gscdump auth login --mode local"
+	});
+}
 const HOSTED_NOT_SET_UP = "Hosted credentials are missing. Run `gscdump auth login --mode hosted`, or set GSCDUMP_API_KEY.";
 const SAVED_STATE_INVALID = "The saved access mode is invalid. Run `gscdump auth login --mode local` or `gscdump auth login --mode hosted`.";
 const apiRootSchema = z.url().transform((value) => value.replace(/\/+$/, "")).refine((value) => {
@@ -129,7 +137,11 @@ async function resolveAuthentication() {
 		if (env.GSCDUMP_API_ROOT && env.GSCDUMP_API_ROOT.replace(/\/+$/, "") !== state.apiRoot) throw new Error("The API root changed. Run `gscdump auth login --mode hosted` for the new API root.");
 		return state;
 	}
-	throw new Error(HOSTED_NOT_SET_UP);
+	throw stopError({
+		code: "HOSTED_CREDENTIALS_MISSING",
+		message: HOSTED_NOT_SET_UP,
+		nextCommand: "gscdump auth login --mode hosted"
+	});
 }
 const hostedSiteSchema = z.object({
 	siteId: z.string(),
@@ -162,18 +174,41 @@ async function hostedRequest(state, route, options = {}) {
 		redirect: "error"
 	});
 	if (!response.ok) {
-		const message = response.status === 401 ? "sessionId" in state ? HOSTED_SESSION_REJECTED : HOSTED_KEY_REJECTED : `Hosted request failed (${response.status}) for ${route.split("?")[0]}. Check \`gscdump auth status\`.`;
-		throw Object.assign(new Error(message), {
+		const details = {
 			statusCode: response.status,
 			retryAfter: response.headers.get("retry-after"),
 			response
-		});
+		};
+		if (response.status === 401) {
+			const session = "sessionId" in state;
+			throw Object.assign(stopError({
+				code: "HOSTED_CREDENTIALS_REJECTED",
+				message: session ? HOSTED_SESSION_REJECTED : HOSTED_KEY_REJECTED,
+				nextCommand: session ? "gscdump auth login --mode hosted" : null
+			}), details);
+		}
+		throw Object.assign(/* @__PURE__ */ new Error(`Hosted request failed (${response.status}) for ${route.split("?")[0]}. Check \`gscdump auth status\`.`), details);
 	}
 	return response.status === 204 ? void 0 : response.json();
 }
 function hostedCredential(state) {
 	return "sessionId" in state ? state.sessionId : state.apiKey;
 }
+function siteManagerOf(state) {
+	return "sessionId" in state ? { _tag: "gscdump" } : { _tag: "key_issuer" };
+}
+function connectSiteStep(manager) {
+	switch (manager._tag) {
+		case "gscdump": return "Connect a Site at https://gscdump.com/app/onboarding?step=connect-sites.";
+		case "key_issuer": return "Connect a Site in the app that issued this API key.";
+	}
+}
+function siteSettingsPlace(manager) {
+	switch (manager._tag) {
+		case "gscdump": return "in the Site settings on gscdump.com";
+		case "key_issuer": return "in the Site settings of the app that issued this API key";
+	}
+}
 async function getHostedAccount(state) {
 	const result = accountSchema.safeParse(await hostedRequest(state, "/cli/me"));
 	if (!result.success) throw new Error("gscdump.com returned invalid account data.");
@@ -183,4 +218,4 @@ function formatHostedSync(site) {
 	const status = site.syncStatus ?? "pending";
 	return `${status}${site.syncProgress && site.syncProgress.total > 0 && status !== "synced" ? `: ${site.syncProgress.completed.toLocaleString("en-US")} of ${site.syncProgress.total.toLocaleString("en-US")} days (${Math.round(site.syncProgress.percent)}%)` : ""}${status === "synced" && site.oldestDateSynced && site.newestDateSynced ? `: ${site.oldestDateSynced} to ${site.newestDateSynced}` : ""}`;
 }
-export { HOSTED_NOT_SET_UP, HOSTED_SESSION_REJECTED, LOCAL_MODE_REQUIRED, clearAuthentication, formatHostedSync, getHostedAccount, hostedCredential, hostedRequest, parseAuthMode, parseAuthentication, resolveAccessMode, resolveAuthentication, revokeHostedSession, saveAuthentication };
+export { HOSTED_KEY_REJECTED, HOSTED_NOT_SET_UP, HOSTED_SESSION_REJECTED, LOCAL_MODE_REQUIRED, clearAuthentication, connectSiteStep, formatHostedSync, getHostedAccount, hostedCredential, hostedRequest, localModeRequired, parseAuthMode, parseAuthentication, resolveAccessMode, resolveAuthentication, revokeHostedSession, saveAuthentication, siteManagerOf, siteSettingsPlace };

package/dist/auth.mjs

@@ -1,7 +1,6 @@
 import { resolveAuthentication } from "./auth-state.mjs";
 import { getConfigDir, loadConfig, saveConfig } from "./config.mjs";
 import { pickCliEnvironmentValue, resolveCliEnvironment } from "./environment.mjs";
-import { getAppliedEnvKeys, getLoadedEnvPath } from "./env-file.mjs";
 import { displayPath, logger } from "./utils.mjs";
 import process from "node:process";
 import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
@@ -361,7 +360,7 @@ async function resolveAuth(opts = {}) {
 	return getAuth(opts);
 }
 function envSourceLabel(envVar) {
-	return getAppliedEnvKeys().has(envVar) ? `.env (${envVar})` : `shell env (${envVar})`;
+	return `environment (${envVar})`;
 }
 function pickEnvSource(...envVars) {
 	return pickCliEnvironmentValue(envVars);
@@ -451,11 +450,6 @@ async function describeAuthProvenance() {
 	else if (tokens) effective = "saved-tokens";
 	else effective = "none";
 	if ((effective === "byok-refresh-token" || effective === "byok-access-token") && tokens) warnings.push("Environment credentials take priority over saved tokens. If you just ran `auth login --force`, unset or update the environment tokens.");
-	if (effective === "byok-refresh-token" && clientId && refreshTok) {
-		if (getAppliedEnvKeys().has(clientId.envVar) !== getAppliedEnvKeys().has(refreshTok.envVar)) warnings.push(`client_id and refresh_token come from different sources (${envSourceLabel(clientId.envVar)} vs ${envSourceLabel(refreshTok.envVar)}); they may not match.`);
-	}
-	const envFile = getLoadedEnvPath();
-	if (envFile && getAppliedEnvKeys().size > 0) warnings.push(`Loaded ${getAppliedEnvKeys().size} var(s) from ${displayPath(envFile)}.`);
 	return {
 		rows,
 		effective,

package/dist/bing-hosted.mjs

@@ -1,7 +1,10 @@
-import { getHostedAccount, hostedCredential } from "./auth-state.mjs";
+import { stopError } from "./stop.mjs";
+import { getHostedAccount, hostedCredential, siteManagerOf } from "./auth-state.mjs";
 import { logger } from "./utils.mjs";
 import { writeBingDump } from "./bing-data.mjs";
+import { noSitesStop } from "./hosted-site.mjs";
 import { createGscdumpV1Client } from "@gscdump/sdk/v1";
+const BING_SITES_COMMAND = "gscdump bing sites --json";
 function hostedBingClient(state) {
 	return createGscdumpV1Client({
 		apiRoot: state.apiRoot,
@@ -30,15 +33,33 @@ async function loadHostedBingConnections(state, sites, options = {}) {
 async function resolveHostedBingSites(state, input) {
 	if (Boolean(input.site) === Boolean(input.allSites)) throw new Error("Choose --site or --all-sites.");
 	const account = await getHostedAccount(state);
+	if (account.sites.length === 0) throw stopError(noSitesStop(siteManagerOf(state)));
 	const exact = account.sites.filter((site) => site.siteId === input.site || site.siteUrl === input.site);
 	const normalize = (value) => URL.parse(value.startsWith("sc-domain:") ? `https://${value.slice(10)}/` : value)?.toString();
 	const requested = input.allSites ? account.sites : exact.length ? exact : account.sites.filter((site) => normalize(site.siteUrl) === normalize(input.site) && normalize(input.site) !== void 0);
-	if (requested.length === 0) throw new Error("No matching Bing site. Run `gscdump bing sites`.");
-	if (!input.allSites && requested.length > 1) throw new Error("Multiple Bing sites match. Use a site ID from `gscdump bing sites`.");
+	if (requested.length === 0) throw stopError({
+		code: "SITE_NOT_FOUND",
+		message: "No matching Bing site. Run `gscdump bing sites`.",
+		nextCommand: BING_SITES_COMMAND
+	});
+	if (!input.allSites && requested.length > 1) throw stopError({
+		code: "SITE_AMBIGUOUS",
+		message: "Multiple Bing sites match. Use a site ID from `gscdump bing sites`.",
+		nextCommand: BING_SITES_COMMAND
+	});
 	const connections = await loadHostedBingConnections(state, requested, { tolerateFailures: Boolean(input.allSites) });
 	const selected = input.allSites ? connections.filter((site) => site.connection._tag === "connected") : connections;
-	if (selected.length === 0) throw new Error("No matching Bing site. Run `gscdump bing sites`.");
-	if (input.requireConnected !== false && selected.some((site) => site.connection._tag !== "connected")) throw new Error("Bing is not connected. Run `gscdump bing login --site SITE_ID`.");
+	if (selected.length === 0) throw stopError({
+		code: "SITE_NOT_FOUND",
+		message: "No matching Bing site. Run `gscdump bing sites`.",
+		nextCommand: BING_SITES_COMMAND
+	});
+	const unconnected = input.requireConnected === false ? void 0 : selected.find((site) => site.connection._tag !== "connected");
+	if (unconnected) throw stopError({
+		code: "BING_NOT_CONNECTED",
+		message: `Bing is not connected for ${unconnected.siteUrl}. Run \`gscdump bing login --site ${unconnected.siteId}\`.`,
+		nextCommand: `gscdump bing login --site ${unconnected.siteId}`
+	});
 	return selected;
 }
 async function dumpHostedBingSite(state, site, outDir, options) {

package/dist/cli.d.mts

@@ -2,7 +2,6 @@ import { CliRuntime, CreateCliRuntimeOptions, createCliRuntime } from "./runtime
 export declare const main: import("citty").CommandDef<import("citty").ArgsDef>;
 export interface RunCliOptions {
   rawArgs?: string[];
-  loadEnv?: boolean;
   environment?: Record<string, string | undefined>;
   runtime?: CliRuntime;
 }

package/dist/cli.mjs

@@ -1,11 +1,10 @@
-import { CLI_SUBCOMMANDS, resolveUsageTarget } from "./command-registry.mjs";
-import { reportCliError } from "./error-handler.mjs";
 import { createCliRuntime, runWithCliRuntime, useCliRuntime } from "./runtime.mjs";
 import { parseAuthMode } from "./auth-state.mjs";
 import { checkCliArgs } from "./cli-args.mjs";
+import { CLI_SUBCOMMANDS, resolveUsageTarget } from "./command-registry.mjs";
 import { resolveCliEnvironment } from "./environment.mjs";
 import { applyProfileFromCli } from "./commands/profile-selection.mjs";
-import { loadEnvFromCwd } from "./env-file.mjs";
+import { reportCliError } from "./error-handler.mjs";
 import { resolveOutputOptions, terminalOutputOptions } from "./render/terminal.mjs";
 import { VERSION, setNoColor, showSplash, withConfiguredOutput } from "./utils.mjs";
 import process from "node:process";
@@ -97,8 +96,8 @@ async function runCli(opts = {}) {
 	runtime.rawArgs = [...input];
 	return runWithCliRuntime(runtime, async () => {
 		let rawArgs = [...input];
+		runtime.jsonOutput = false;
 		try {
-			if (opts.loadEnv !== false) loadEnvFromCwd();
 			rawArgs = prepareCliArgs(input);
 			runtime.rawArgs = [...rawArgs];
 			const argumentError = await checkCliArgs(main, rawArgs);
@@ -108,6 +107,7 @@ async function runCli(opts = {}) {
 		} catch (error) {
 			await reportCliError(error, {
 				color: stderrColor(runtime, rawArgs),
+				json: runtime.jsonOutput,
 				usage: async () => renderUsage(...await resolveUsageTarget(main, rawArgs)),
 				authSources: async () => (await import("./auth.mjs")).formatAuthProvenance()
 			});

package/dist/commands/analyze.mjs

@@ -1,6 +1,6 @@
 import { analyzeCommandMeta } from "../command-meta.mjs";
 import { terminalOutputOptions } from "../render/terminal.mjs";
-import { logger, parseFetchBudget, parseIntegerOption, toCSV } from "../utils.mjs";
+import { logger, parseFetchBudget, parseIntegerOption, setJsonOutput, toCSV } from "../utils.mjs";
 import { DEFAULT_WINDOW, PERIOD_FLAGS, parseWindowFlags, windowFlagErrorToException } from "../window.mjs";
 import { analysisNeeds, analyzerTables, resolveAnalysisSource } from "../analysis-local.mjs";
 import { coverageWarning, renderAnalysis } from "../render/analysis.mjs";
@@ -176,10 +176,10 @@ function makeToolCommand(tool) {
 			].includes(args.format ?? "table")) throw new Error("Invalid --format. Use table, json, or csv.");
 			const baseParams = buildParams(tool, args);
 			const format = args.json ? "json" : String(args.format ?? "table");
+			setJsonOutput(format === "json");
 			const { runAnalysis, siteUrl, anchor } = await resolveAnalysisSource({
 				site: args.site,
 				live: !!args.live,
-				json: format === "json",
 				label: `analyze ${tool}`,
 				types: [tool],
 				anchorTables: analyzerTables(baseParams),

package/dist/commands/auth.mjs

@@ -1,6 +1,6 @@
-import { authCommandMeta } from "../command-meta.mjs";
 import { useCliRuntime } from "../runtime.mjs";
 import { clearAuthentication, formatHostedSync, getHostedAccount, parseAuthMode, parseAuthentication, resolveAuthentication, revokeHostedSession, saveAuthentication } from "../auth-state.mjs";
+import { authCommandMeta } from "../command-meta.mjs";
 import { loadConfig, saveConfig } from "../config.mjs";
 import { OUTPUT_ARGS, applyOutputMode, logger } from "../utils.mjs";
 import { ACCESS_NOT_SET_UP, clearTokens, formatAuthProvenance, getAuth, loadServiceAccount, loadTokens, resolveBYOK, saveTokens } from "../auth.mjs";

package/dist/commands/bing.mjs

@@ -1,7 +1,8 @@
-import { bingCommandMeta } from "../command-meta.mjs";
 import { useCliRuntime } from "../runtime.mjs";
+import { stopError } from "../stop.mjs";
 import { resolveAuthentication, saveAuthentication } from "../auth-state.mjs";
-import { OUTPUT_ARGS, applyOutputMode, logger } from "../utils.mjs";
+import { bingCommandMeta } from "../command-meta.mjs";
+import { OUTPUT_ARGS, applyOutputMode, logger, plural } from "../utils.mjs";
 import { BING_REDIRECT_URI, clearBingCredentials, getBingClient, loginBingOAuth, saveBingCredentials } from "../bing-auth.mjs";
 import { BING_DATASETS, dumpBingSite, parseBingDumpOptions, resolveBingSites, unwrapBing } from "../bing-data.mjs";
 import { dumpHostedBingSite, hostedBingClient, inspectHostedBingUrl, listHostedBingSites, resolveHostedBingSites } from "../bing-hosted.mjs";
@@ -171,7 +172,7 @@ const bingCommand = defineCommand({
 					authenticated: true,
 					verifiedSites: sites.filter((site) => site.isVerified).length
 				}));
-				else logger.success(`Bing authenticated. ${sites.filter((site) => site.isVerified).length} verified sites.`);
+				else logger.success(`Bing authenticated. ${plural(sites.filter((site) => site.isVerified).length, "verified site", "verified sites")}.`);
 			}
 		}),
 		sites: defineCommand({
@@ -250,7 +251,7 @@ const bingCommand = defineCommand({
 					for (const site of sites) {
 						const summary = await dumpHostedBingSite(authentication, site, args.out, options);
 						summaries.push(summary);
-						if (!json) logger.success(`Bing ${site.siteUrl}: ${summary.files.length} files exported to ${args.out}.`);
+						if (!json) logger.success(`Bing ${site.siteUrl}: ${plural(summary.files.length, "file", "files")} exported to ${args.out}.`);
 					}
 					if (json) console.log(JSON.stringify(args["all-sites"] ? {
 						searchEngine: "bing",
@@ -267,7 +268,7 @@ const bingCommand = defineCommand({
 				for (const site of sites) {
 					const summary = await dumpBingSite(client, site, args.out, options);
 					summaries.push(summary);
-					if (!json) logger.success(`Bing ${site}: ${summary.files.length} files exported to ${args.out}.`);
+					if (!json) logger.success(`Bing ${site}: ${plural(summary.files.length, "file", "files")} exported to ${args.out}.`);
 				}
 				if (json) console.log(JSON.stringify(args["all-sites"] ? {
 					searchEngine: "bing",
@@ -323,7 +324,11 @@ const bingCommand = defineCommand({
 			async run({ args }) {
 				applyOutputMode(args);
 				const authentication = await resolveAuthentication();
-				if (authentication._tag !== "Hosted") throw new Error("Hosted Bing connection verification needs Hosted mode. Pass --mode hosted.");
+				if (authentication._tag !== "Hosted") throw stopError({
+					code: "HOSTED_MODE_REQUIRED",
+					message: "Hosted Bing connection verification needs Hosted mode. Pass --mode hosted.",
+					nextCommand: "gscdump auth login --mode hosted"
+				});
 				const [site] = await resolveHostedBingSites(authentication, {
 					site: args.site,
 					requireConnected: false

package/dist/commands/doctor.mjs

@@ -1,8 +1,7 @@
+import { connectSiteStep, getHostedAccount, resolveAuthentication, siteManagerOf } from "../auth-state.mjs";
 import { doctorCommandMeta } from "../command-meta.mjs";
-import { getHostedAccount, resolveAuthentication } from "../auth-state.mjs";
 import { loadConfig } from "../config.mjs";
-import { resolveCliEnvironment } from "../environment.mjs";
-import { parseEnvFile } from "../env-file.mjs";
+import { pickCliEnvironmentValue, resolveCliEnvironment } from "../environment.mjs";
 import { OUTPUT_ARGS, applyOutputMode, displayPath, logger } from "../utils.mjs";
 import { getAuth, isStaleServiceAccountPointer, loadTokens, resolveAuth, resolveBYOK, resolveServiceAccount } from "../auth.mjs";
 import { createLocalStore } from "../local-store.mjs";
@@ -12,73 +11,19 @@ import { currentAccessToken, fetchTokenInfo, redactTokens } from "../token-info.
 import process from "node:process";
 import { defineCommand } from "citty";
 import fs from "node:fs/promises";
-import path from "node:path";
 import { googleSearchConsole } from "gscdump/client";
 import { resolveSiteInput } from "gscdump";
 import { ofetch } from "ofetch";
 const FETCH_TIMEOUT_MS = 5e3;
 const TIME_SKEW_WARN_MS = 3e5;
 const WATERMARK_STALE_DAYS_WARN = 7;
-const RELEVANT_ENV_KEYS = [
-	"GSC_ACCESS_TOKEN",
-	"GSC_CLIENT_ID",
-	"GSC_CLIENT_SECRET",
-	"GSC_REFRESH_TOKEN",
-	"GOOGLE_ACCESS_TOKEN",
-	"GOOGLE_CLIENT_ID",
-	"GOOGLE_CLIENT_SECRET",
-	"GOOGLE_REFRESH_TOKEN",
-	"GOOGLE_APPLICATION_CREDENTIALS",
-	"GSC_SERVICE_ACCOUNT_JSON"
-];
-function redact(v) {
-	if (!v) return "<missing>";
-	if (v.length <= 6) return "***";
-	return `***${v.slice(-6)}`;
-}
-async function checkEnv() {
-	const envPath = path.join(process.cwd(), ".env");
-	const parsed = parseEnvFile(envPath);
-	if (!parsed) return {
-		checks: [{
-			name: "env",
-			status: "info",
-			detail: "no .env (using shell env / saved tokens)"
-		}],
-		envKeys: /* @__PURE__ */ new Set()
-	};
-	const relevant = RELEVANT_ENV_KEYS.filter((k) => parsed[k] !== void 0);
-	const envKeys = new Set(relevant);
-	if (relevant.length === 0) return {
-		checks: [{
-			name: "env",
-			status: "info",
-			detail: `${displayPath(envPath)} found, no auth vars`
-		}],
-		envKeys
-	};
-	const inventory = relevant.map((k) => {
-		const v = parsed[k];
-		if (k.endsWith("CLIENT_ID")) return `${k}=${v}`;
-		return `${k}=${redact(v)}`;
-	});
-	return {
-		checks: [{
-			name: "env",
-			status: "info",
-			detail: `${displayPath(envPath)} → ${inventory.join(", ")} (not validated — see auth)`
-		}],
-		envKeys
-	};
-}
-function describeAuthSource(envKeys, byok) {
+function describeAuthSource(byok) {
 	if (!byok) return "saved tokens";
 	const isAccessToken = typeof byok === "string";
-	const driver = isAccessToken ? "GSC_ACCESS_TOKEN" : "GSC_REFRESH_TOKEN";
-	const source = (isAccessToken ? ["GSC_ACCESS_TOKEN", "GOOGLE_ACCESS_TOKEN"] : ["GSC_REFRESH_TOKEN", "GOOGLE_REFRESH_TOKEN"]).some((k) => envKeys.has(k)) ? ".env" : "shell env";
-	return `environment credentials ${isAccessToken ? "(access-token)" : "(refresh-token)"} from ${source} via ${driver}`;
+	const driver = pickCliEnvironmentValue(isAccessToken ? ["GSC_ACCESS_TOKEN", "GOOGLE_ACCESS_TOKEN"] : ["GSC_REFRESH_TOKEN", "GOOGLE_REFRESH_TOKEN"])?.envVar ?? (isAccessToken ? "GSC_ACCESS_TOKEN" : "GSC_REFRESH_TOKEN");
+	return `environment credentials ${isAccessToken ? "(access-token)" : "(refresh-token)"} via ${driver}`;
 }
-async function checkAuth(envKeys) {
+async function checkAuth() {
 	const checks = [];
 	const serviceAccount = await resolveServiceAccount().catch((error) => {
 		if (isStaleServiceAccountPointer(error)) {
@@ -153,7 +98,7 @@ async function checkAuth(envKeys) {
 		checks.push({
 			name: "auth",
 			status: "fail",
-			detail: `${describeAuthSource(envKeys, byok)}: refresh failed: ${current.detail}. Run \`gscdump auth login --force\` and update the source above.`
+			detail: `${describeAuthSource(byok)}: refresh failed: ${current.detail}. Run \`gscdump auth login --force\` and update the source above.`
 		});
 		return {
 			checks,
@@ -177,7 +122,7 @@ async function checkAuth(envKeys) {
 	checks.push({
 		name: "auth",
 		status: "pass",
-		detail: describeAuthSource(envKeys, byok)
+		detail: describeAuthSource(byok)
 	});
 	if (info.email) checks.push({
 		name: "auth.account",
@@ -394,7 +339,7 @@ async function checkHostedConnection(authentication) {
 	} : {
 		name: "hosted.sites",
 		status: "warn",
-		detail: "no hosted Sites. Connect a Site at https://gscdump.com/app/onboarding?step=connect-sites"
+		detail: `no hosted Sites. ${connectSiteStep(siteManagerOf(authentication))}`
 	}];
 	return [
 		{
@@ -410,9 +355,9 @@ async function checkHostedConnection(authentication) {
 		...sitesChecks
 	];
 }
-async function checkLocalConnection(envKeys) {
+async function checkLocalConnection() {
 	const [authResult, timeChecks, gscApi, indexingApi, siteVerificationApi] = await Promise.all([
-		checkAuth(envKeys),
+		checkAuth(),
 		checkTimeSkew(),
 		checkApiReachable("gsc.api", "https://searchconsole.googleapis.com/$discovery/rest?version=v1"),
 		checkApiReachable("indexing.api", "https://indexing.googleapis.com/$discovery/rest?version=v3"),
@@ -439,14 +384,12 @@ const doctorCommand = defineCommand({
 		const { json } = applyOutputMode(args);
 		const { dataDir } = await createCommandContext();
 		const authentication = await resolveAuthentication();
-		const envResult = await checkEnv();
 		const [connectionChecks, dataDirChecks, watermarkChecks] = await Promise.all([
-			authentication._tag === "Hosted" ? checkHostedConnection(authentication) : checkLocalConnection(envResult.envKeys),
+			authentication._tag === "Hosted" ? checkHostedConnection(authentication) : checkLocalConnection(),
 			checkDataDir(dataDir),
 			checkStoreWatermarks(dataDir)
 		]);
 		const all = [
-			...envResult.checks,
 			...connectionChecks,
 			...dataDirChecks,
 			...watermarkChecks

package/dist/commands/indexing-urls.mjs

@@ -121,8 +121,8 @@ const indexingUrlsCommand = defineCommand({
 		if (limit > MAX_PAGE_SIZE) throw new Error(`--limit must be ${MAX_PAGE_SIZE} or less. Use --all to read every page.`);
 		const search = args.search ? String(args.search) : void 0;
 		applyOutputMode({
-			json: format !== "table",
-			quiet: args.quiet
+			json: format === "json",
+			quiet: Boolean(args.quiet) || format === "csv"
 		});
 		const filters = {
 			...status ? { status } : {},

package/dist/commands/indexing-watch.mjs

@@ -1,3 +1,4 @@
+import { siteManagerOf, siteSettingsPlace } from "../auth-state.mjs";
 import { terminalOutputOptions } from "../render/terminal.mjs";
 import { applyOutputMode, logger, readUrlList } from "../utils.mjs";
 import { renderTable } from "../render/layout.mjs";
@@ -39,12 +40,14 @@ function watchedRow(entry) {
 		dueAt: entry.dueAt.slice(0, 10)
 	};
 }
-const SKIP_HINTS = { inspection_disabled: "gscdump never inspects this Site, so a Watched URL gets no Checkpoint. To use Watched URLs, turn on URL Inspection in the Site settings on gscdump.com." };
-function printChange(verb, result, siteUrl) {
+function skipHint(reason, manager) {
+	return reason === "inspection_disabled" ? `gscdump never inspects this Site, so a Watched URL gets no Checkpoint. To use Watched URLs, turn on URL Inspection ${siteSettingsPlace(manager)}.` : void 0;
+}
+function printChange(verb, result, siteUrl, manager) {
 	for (const url of result.changed) console.log(`${verb}: ${url}`);
 	for (const url of result.unchanged) console.log(`${verb === "Added" ? "Already watched" : "Not watched"}: ${url}`);
 	for (const { url, reason } of result.skipped) console.log(`Skipped (${reason}): ${url}`);
-	for (const hint of new Set(result.skipped.map(({ reason }) => SKIP_HINTS[reason]).filter(Boolean))) console.log(hint);
+	for (const hint of new Set(result.skipped.map(({ reason }) => skipHint(reason, manager)).filter(Boolean))) console.log(hint);
 	logger.info(`${siteUrl} has ${result.total} of ${result.limit} Watched URLs.`);
 }
 async function readUrls(args) {
@@ -133,7 +136,7 @@ const addCommand = defineCommand({
 	async run({ args }) {
 		const { json } = applyOutputMode(args);
 		const urls = await readUrls(args);
-		const { client, site } = await resolveHostedSite({
+		const { client, site, authentication } = await resolveHostedSite({
 			...args,
 			_: []
 		}, {
@@ -148,7 +151,7 @@ const addCommand = defineCommand({
 			console.log(JSON.stringify(data, null, 2));
 			return;
 		}
-		printChange("Added", data, site.siteUrl);
+		printChange("Added", data, site.siteUrl, siteManagerOf(authentication));
 	}
 });
 const removeCommand = defineCommand({
@@ -164,7 +167,7 @@ const removeCommand = defineCommand({
 	async run({ args }) {
 		const { json } = applyOutputMode(args);
 		const urls = await readUrls(args);
-		const { client, site } = await resolveHostedSite({
+		const { client, site, authentication } = await resolveHostedSite({
 			...args,
 			_: []
 		}, {
@@ -179,7 +182,7 @@ const removeCommand = defineCommand({
 			console.log(JSON.stringify(data, null, 2));
 			return;
 		}
-		printChange("Removed", data, site.siteUrl);
+		printChange("Removed", data, site.siteUrl, siteManagerOf(authentication));
 	}
 });
 const indexingWatchCommand = defineCommand({

package/dist/commands/init.mjs

@@ -1,18 +1,14 @@
-import { initCommandMeta } from "../command-meta.mjs";
 import { useCliRuntime } from "../runtime.mjs";
 import { saveAuthentication } from "../auth-state.mjs";
+import { initCommandMeta } from "../command-meta.mjs";
 import { defaultDataDir, loadConfig, saveConfig } from "../config.mjs";
-import { applyCliEnvironment } from "../environment.mjs";
-import { OUTPUT_ARGS, applyOutputMode, displayPath, logger } from "../utils.mjs";
-import { ACCESS_NOT_SET_UP, authenticate, getAuth, loadTokens, resolveBYOK, resolveServiceAccount, saveTokens } from "../auth.mjs";
+import { OUTPUT_ARGS, applyOutputMode, logger } from "../utils.mjs";
+import { ACCESS_NOT_SET_UP, getAuth, loadTokens, resolveBYOK, resolveServiceAccount } from "../auth.mjs";
 import { loginHosted } from "./auth.mjs";
 import process from "node:process";
 import { defineCommand } from "citty";
-import fs from "node:fs/promises";
-import path from "node:path";
-import { confirm, isCancel, text } from "@clack/prompts";
+import { isCancel, text } from "@clack/prompts";
 import { googleSearchConsole } from "gscdump/client";
-const ENV_LINE_RE = /^([^=]+)=(.*)$/;
 function canPrompt() {
 	return process.stdin.isTTY === true;
 }
@@ -27,24 +23,6 @@ async function promptDataDir(existing) {
 	if (isCancel(answer)) process.exit(1);
 	return String(answer) || fallback;
 }
-async function loadEnvFile() {
-	const envPath = path.join(process.cwd(), ".env");
-	const content = await fs.readFile(envPath, "utf-8").catch(() => null);
-	if (!content) return null;
-	const env = {};
-	for (const line of content.split("\n")) {
-		const trimmed = line.trim();
-		if (!trimmed || trimmed.startsWith("#")) continue;
-		const match = trimmed.match(ENV_LINE_RE);
-		if (match) {
-			const key = match[1].trim();
-			let value = match[2].trim();
-			if (value.startsWith("\"") && value.endsWith("\"") || value.startsWith("'") && value.endsWith("'")) value = value.slice(1, -1);
-			env[key] = value;
-		}
-	}
-	return env;
-}
 const initCommand = defineCommand({
 	meta: initCommandMeta,
 	args: {
@@ -121,40 +99,6 @@ const initCommand = defineCommand({
 			printNextSteps();
 			return;
 		}
-		const envFile = await loadEnvFile();
-		const envCid = envFile?.GSC_CLIENT_ID ?? envFile?.GOOGLE_CLIENT_ID;
-		const envSec = envFile?.GSC_CLIENT_SECRET ?? envFile?.GOOGLE_CLIENT_SECRET;
-		const envRef = envFile?.GSC_REFRESH_TOKEN ?? envFile?.GOOGLE_REFRESH_TOKEN;
-		const envAcc = envFile?.GSC_ACCESS_TOKEN ?? envFile?.GOOGLE_ACCESS_TOKEN;
-		if (envCid && envSec && envRef) {
-			logger.info("Found .env file with credentials");
-			applyCliEnvironment({
-				GOOGLE_ACCESS_TOKEN: envAcc,
-				GOOGLE_CLIENT_ID: envCid,
-				GOOGLE_CLIENT_SECRET: envSec,
-				GOOGLE_REFRESH_TOKEN: envRef
-			});
-			await saveConfig({
-				...config,
-				clientId: envCid,
-				clientSecret: envSec,
-				dataDir: config.dataDir ?? defaultDataDir()
-			});
-			const creds = (await authenticate({
-				clientId: envCid,
-				clientSecret: envSec
-			}, false)).credentials;
-			if (creds.access_token) await saveTokens({
-				access_token: creds.access_token,
-				refresh_token: creds.refresh_token || envRef,
-				expiry_date: creds.expiry_date
-			});
-			await saveAuthentication({ _tag: "Local" });
-			console.log();
-			logger.success("Setup complete using .env credentials.");
-			printNextSteps();
-			return;
-		}
 		if (!canPrompt()) {
 			if (!await loadTokens()) {
 				logger.error(`Init cannot prompt without a terminal.\n${ACCESS_NOT_SET_UP}`);
@@ -180,7 +124,6 @@ const initCommand = defineCommand({
 		});
 		const sites = await runSmokeTest(await getAuth({ interactive: true }));
 		await saveAuthentication({ _tag: "Local" });
-		if (config.clientId && config.clientSecret) await maybeWriteEnvFile(config.clientId, config.clientSecret);
 		console.log();
 		logger.success("Setup complete.");
 		printNextSteps(sites);
@@ -229,32 +172,4 @@ async function runSmokeTest(oauth) {
 	logger.success(`Verified: ${sites.length} GSC site(s) accessible`);
 	return sites.flatMap((site) => site.siteUrl ? [site.siteUrl] : []);
 }
-async function maybeWriteEnvFile(clientId, clientSecret) {
-	const tokens = await loadTokens();
-	if (!tokens?.refresh_token) return;
-	const wants = await confirm({
-		message: "Write a `.env` file with these credentials? (handy for CI / other machines)",
-		initialValue: false
-	});
-	if (isCancel(wants) || !wants) return;
-	const envPath = path.join(process.cwd(), ".env");
-	if (await fs.stat(envPath).then(() => true).catch(() => false)) {
-		const overwrite = await confirm({
-			message: `${displayPath(envPath)} exists. Overwrite?`,
-			initialValue: false
-		});
-		if (isCancel(overwrite) || !overwrite) {
-			logger.info(`Skipped — keep credentials at ${displayPath(envPath)} manually if needed`);
-			return;
-		}
-	}
-	const content = [
-		`GSC_CLIENT_ID=${clientId}`,
-		`GSC_CLIENT_SECRET=${clientSecret}`,
-		`GSC_REFRESH_TOKEN=${tokens.refresh_token}`,
-		""
-	].join("\n");
-	await fs.writeFile(envPath, content, { mode: 384 });
-	logger.success(`Wrote ${displayPath(envPath)}`);
-}
 export { initCommand, printHostedNextSteps, printNextSteps, runSmokeTest };

package/dist/commands/mcp.mjs

@@ -1,5 +1,5 @@
-import { mcpCommandMeta } from "../command-meta.mjs";
 import { runWithCliRuntime, useCliRuntime } from "../runtime.mjs";
+import { mcpCommandMeta } from "../command-meta.mjs";
 import { VERSION } from "../utils.mjs";
 import { probeAuth } from "../auth.mjs";
 import { createCommandContext } from "../context.mjs";