@gscdump/cli 3.7.0 → 4.0.0

package/dist/commands/auth.mjs

@@ -1,25 +1,18 @@
-import { useCliRuntime } from "../runtime.mjs";
-import { clearAuthentication, getCloudAccount, parseAuthMode, parseAuthentication, resolveAuthentication, saveAuthentication } from "../auth-state.mjs";
 import { authCommandMeta } from "../command-meta.mjs";
+import { useCliRuntime } from "../runtime.mjs";
+import { clearAuthentication, formatHostedSync, getCloudAccount, getCloudSites, parseAuthMode, parseAuthentication, resolveAuthentication, saveAuthentication } from "../auth-state.mjs";
 import { loadConfig, saveConfig } from "../config.mjs";
-import { OUTPUT_ARGS, applyOutputMode, logger, noSubcommandSelected } from "../utils.mjs";
-import { clearTokens, formatAuthProvenance, getAuth, loadServiceAccount, loadTokens, resolveBYOK, saveTokens } from "../auth.mjs";
+import { OUTPUT_ARGS, applyOutputMode, logger } from "../utils.mjs";
+import { GOOGLE_NOT_CONNECTED, clearTokens, formatAuthProvenance, getAuth, loadServiceAccount, loadTokens, resolveBYOK, saveTokens } from "../auth.mjs";
 import { missingRequiredScopes } from "../auth-scopes.mjs";
 import { clearBingCredentials, getBingClient, inspectBingCredentials } from "../bing-auth.mjs";
+import { currentAccessToken, fetchTokenInfo, redactTokens } from "../token-info.mjs";
 import { runSmokeTest } from "./init.mjs";
 import { adoptCurrentConfigAsProfile, profileNameFromEmail, resolveActiveProfile } from "./profile.mjs";
 import process from "node:process";
 import { defineCommand } from "citty";
 import path from "node:path";
 import { isCancel, password } from "@clack/prompts";
-import { ofetch } from "ofetch";
-const AUTH_SUBCOMMANDS = [
-	"status",
-	"login",
-	"logout",
-	"refresh",
-	"scopes"
-];
 const MODE_ARG = {
 	type: "string",
 	description: "Authentication mode: cloud or local"
@@ -52,24 +45,26 @@ async function loginCloud(args) {
 	logger.success(`Cloud authentication saved for ${account.user.email}`);
 	logger.info("Google and Bing commands use connections saved on gscdump.com.");
 }
-async function fetchTokenInfo(accessToken) {
-	return ofetch("https://oauth2.googleapis.com/tokeninfo", { query: { access_token: accessToken } }).catch(() => null);
-}
 async function resolveLiveAuthState() {
 	const tokens = await loadTokens();
 	const byok = resolveBYOK();
-	let liveToken = null;
-	if (typeof byok === "string") liveToken = byok;
-	else if (byok && "getAccessToken" in byok) liveToken = await byok.getAccessToken().then((r) => r.token ?? null).catch(() => null);
-	else if (tokens?.access_token) liveToken = tokens.access_token;
-	const tokenInfo = liveToken ? await fetchTokenInfo(liveToken) : null;
+	const source = byok ?? (tokens ? await getAuth({ interactive: false }).catch((error) => error instanceof Error ? error : new Error(String(error))) : null);
+	const current = source === null ? null : source instanceof Error ? {
+		kind: "failed",
+		detail: redactTokens(source.message)
+	} : await currentAccessToken(source);
+	const liveToken = current?.kind === "token" ? current.token : null;
+	const verified = liveToken ? await fetchTokenInfo(liveToken) : null;
+	const tokenInfo = verified?.kind === "valid" ? verified.info : null;
+	const failure = current?.kind === "failed" ? current.detail : verified?.kind === "invalid" ? verified.detail : null;
 	const scopes = tokenInfo?.scope ? tokenInfo.scope.split(/\s+/).filter(Boolean) : [];
 	const missing = missingRequiredScopes(scopes, byok ? void 0 : tokens?.provider);
 	return {
 		byok,
-		tokens,
+		tokens: tokens && !byok ? await loadTokens() : tokens,
 		liveToken,
 		tokenInfo,
+		failure,
 		scopes,
 		missing
 	};
@@ -127,25 +122,42 @@ async function runStatus(args) {
 			}
 			return;
 		}
+		const hosted = await getCloudSites(authentication).then((sites) => ({
+			_tag: "Ok",
+			sites: sites.filter((site) => site.registered)
+		}), (error) => ({
+			_tag: "Err",
+			detail: error instanceof Error ? error.message : "Hosted Site list failed."
+		}));
 		if (json) console.log(JSON.stringify({
 			authenticated: true,
 			mode: "cloud",
 			account: account.value.user.email,
 			apiRoot: authentication.apiRoot,
 			sites: account.value.sites,
+			...hosted._tag === "Ok" ? { hostedSync: hosted.sites.map((site) => ({
+				siteUrl: site.siteUrl,
+				syncStatus: site.syncStatus ?? null,
+				syncProgress: site.syncProgress ?? null,
+				oldestDateSynced: site.oldestDateSynced ?? null,
+				newestDateSynced: site.newestDateSynced ?? null
+			})) } : { hostedSyncError: hosted.detail },
 			capabilities
 		}, null, 2));
 		else {
 			logger.success(`Authenticated with cloud: ${account.value.user.email}`);
 			console.log(`  API: ${authentication.apiRoot}`);
 			console.log(`  Sites: ${account.value.sites.length}`);
+			if (hosted._tag === "Ok") for (const site of hosted.sites) console.log(`    ${site.siteUrl}  ${formatHostedSync(site)}`);
+			else console.log(`  Hosted sync status is not available: ${hosted.detail}`);
 			console.log("  Google and Bing use connections saved on gscdump.com.");
 			console.log(`  Cloud commands: ${capabilities.cloud.join(", ")}`);
 			console.log("  Google indexing and Site Verification require --mode local.");
 		}
 		return;
 	}
-	const { byok, tokens, tokenInfo, scopes, missing } = await resolveLiveAuthState();
+	const { byok, tokens, tokenInfo, failure, scopes, missing } = await resolveLiveAuthState();
+	const googleAuthenticated = tokenInfo !== null;
 	const bingCredentials = await inspectBingCredentials();
 	const bingResult = bingCredentials._tag === "Missing" ? null : await getBingClient().then((client) => client.getUserSites({ signal: AbortSignal.timeout(1e4) })).catch(() => null);
 	const bing = {
@@ -156,9 +168,10 @@ async function runStatus(args) {
 	const byokKind = byok ? typeof byok === "string" ? "access-token" : "refresh-token" : null;
 	if (json) {
 		console.log(JSON.stringify({
-			authenticated: !!tokens || !!byok || bing.authenticated,
+			authenticated: googleAuthenticated || bing.authenticated,
 			mode: "local",
-			googleAuthenticated: !!tokens || !!byok,
+			googleAuthenticated,
+			googleError: failure,
 			bing,
 			source: byok ? "byok" : tokens ? "saved-tokens" : null,
 			byokKind,
@@ -186,7 +199,8 @@ async function runStatus(args) {
 		}
 	};
 	if (byok) {
-		logger.success(`Authenticated via BYOK (${byokKind})`);
+		if (googleAuthenticated) logger.success(`Authenticated via BYOK (${byokKind})`);
+		else logger.warn(`BYOK credentials (${byokKind}) failed verification: ${failure}`);
 		if (tokenInfo?.email) console.log(`  Account:       ${tokenInfo.email}`);
 		reportScopes();
 		return;
@@ -196,18 +210,15 @@ async function runStatus(args) {
 			logger.info("Google credentials are missing. Run `gscdump auth login --mode local` to connect Google.");
 			return;
 		}
-		logger.warn("Not authenticated");
-		logger.info("Run `gscdump init` (full setup) or `gscdump auth login` (OAuth only)");
-		logger.info("Or set GSC_ACCESS_TOKEN / GSC_CLIENT_ID + GSC_CLIENT_SECRET + GSC_REFRESH_TOKEN env vars");
+		logger.warn(GOOGLE_NOT_CONNECTED);
 		return;
 	}
 	const hasAccess = !!tokens.access_token;
 	const hasRefresh = !!tokens.refresh_token;
 	const expiry = tokens.expiry_date ? new Date(tokens.expiry_date) : null;
 	const isExpired = expiry && expiry < /* @__PURE__ */ new Date();
-	if (isExpired && hasRefresh) logger.warn("Token expired; refresh available. Run `gscdump auth refresh`, or any live command will auto-refresh.");
-	else if (isExpired) logger.error("Token expired and no refresh token present. Run `gscdump auth login`.");
-	else logger.success("Authenticated (saved tokens)");
+	if (googleAuthenticated) logger.success("Authenticated (saved tokens)");
+	else logger.warn(`Saved credentials failed verification: ${failure}. Run \`gscdump auth login\` to sign in again.`);
 	console.log();
 	console.log(`  Access token:  ${hasAccess ? "\x1B[32mpresent\x1B[0m" : "\x1B[31mmissing\x1B[0m"}`);
 	console.log(`  Refresh token: ${hasRefresh ? "\x1B[32mpresent\x1B[0m" : "\x1B[31mmissing\x1B[0m"}`);
@@ -217,7 +228,6 @@ async function runStatus(args) {
 	}
 	if (tokenInfo?.email) console.log(`  Account:       ${tokenInfo.email}`);
 	reportScopes();
-	if (isExpired && !hasRefresh) process.exit(1);
 }
 const statusCommand = defineCommand({
 	meta: authCommandMeta.status,
@@ -334,9 +344,9 @@ const loginCommand = defineCommand({
 		await saveAuthentication({ _tag: "Local" });
 		if (!resolveActiveProfile()) {
 			const tokens = await loadTokens();
-			const info = tokens?.access_token ? await fetchTokenInfo(tokens.access_token) : null;
-			if (info?.email) {
-				const name = profileNameFromEmail(info.email);
+			const verified = tokens?.access_token ? await fetchTokenInfo(tokens.access_token) : null;
+			if (verified?.kind === "valid" && verified.info.email) {
+				const name = profileNameFromEmail(verified.info.email);
 				if (await adoptCurrentConfigAsProfile(name).catch((error) => {
 					const message = error instanceof Error ? error.message : String(error);
 					logger.warn(`Login succeeded, but the config could not be moved into profile "${name}": ${message}`);
@@ -409,8 +419,7 @@ const authCommand = defineCommand({
 		scopes: scopesCommand
 	},
 	async run({ args }) {
-		if (!noSubcommandSelected("auth", AUTH_SUBCOMMANDS)) return;
 		await runStatus(args);
 	}
 });
-export { authCommand, loginCommand, logoutCommand, statusCommand };
+export { authCommand, loginCloud, loginCommand, logoutCommand, statusCommand };

package/dist/commands/bing.mjs

@@ -1,6 +1,6 @@
+import { bingCommandMeta } from "../command-meta.mjs";
 import { useCliRuntime } from "../runtime.mjs";
 import { resolveAuthentication, saveAuthentication } from "../auth-state.mjs";
-import { bingCommandMeta } from "../command-meta.mjs";
 import { OUTPUT_ARGS, applyOutputMode, logger } from "../utils.mjs";
 import { BING_REDIRECT_URI, clearBingCredentials, getBingClient, loginBingOAuth, saveBingCredentials } from "../bing-auth.mjs";
 import { BING_DATASETS, dumpBingSite, parseBingDumpOptions, resolveBingSites, unwrapBing } from "../bing-data.mjs";
@@ -223,7 +223,7 @@ const bingCommand = defineCommand({
 				},
 				"datasets": {
 					type: "string",
-					description: `Comma-separated datasets: ${BING_DATASETS.join(", ")}. Default: all except crawl-issues`
+					description: `Comma-separated datasets: ${BING_DATASETS.join(", ")}. Default: all. Crawl issues have no dates, so --start, --end, and cloud mode leave them out`
 				},
 				"start": {
 					type: "string",
@@ -240,7 +240,7 @@ const bingCommand = defineCommand({
 				const options = parseBingDumpOptions(args);
 				const authentication = await resolveAuthentication();
 				if (authentication._tag === "Cloud") {
-					if (options.datasets.includes("crawl-issues")) throw new Error("Bing crawl issues require local authentication. Use --mode local.");
+					if (options.datasetsExplicit && options.datasets.includes("crawl-issues")) throw new Error("Bing crawl issues require local authentication. Use --mode local.");
 					if (options.start && options.end && Date.parse(options.end) - Date.parse(options.start) > 316224e5) throw new Error("Hosted Bing exports support at most 366 days. Use a shorter --start and --end range.");
 					const sites = await resolveHostedBingSites(authentication, {
 						site: args.site,

package/dist/commands/compact.mjs

@@ -1,5 +1,6 @@
 import { OUTPUT_ARGS, applyOutputMode, logger } from "../utils.mjs";
 import { allTables } from "../local-store.mjs";
+import { readSiteMap, siteUrlForId } from "../store-sites.mjs";
 import { createCommandContext } from "../context.mjs";
 import { defineCommand } from "citty";
 import { inferLegacyTier } from "@gscdump/engine";
@@ -12,7 +13,7 @@ const compactCommand = defineCommand({
 		"site": {
 			type: "string",
 			alias: "s",
-			description: "Restrict to a single site (default: all sites with local data)"
+			description: "Restrict to one Site, for example example.com (default: every Site with local data)"
 		},
 		"raw-days": {
 			type: "string",
@@ -35,8 +36,9 @@ const compactCommand = defineCommand({
 	},
 	async run({ args }) {
 		const { json } = applyOutputMode(args);
-		const store = (await createCommandContext({ needsStore: true })).store;
-		const siteId = args.site ? store.siteIdFor(String(args.site)) : void 0;
+		const ctx = await createCommandContext({ needsStore: true });
+		const store = ctx.store;
+		const siteId = args.site ? store.siteIdFor(await ctx.resolveSite(String(args.site), { scope: "store" })) : void 0;
 		const dryRun = Boolean(args["dry-run"]);
 		const thresholds = {};
 		if (args["raw-days"]) thresholds.raw = Number(args["raw-days"]);
@@ -46,13 +48,15 @@ const compactCommand = defineCommand({
 			userId: store.userId,
 			siteId
 		});
+		const siteMap = await readSiteMap(store.dataDir, store.userId);
+		const siteLabel = (id) => id ? siteUrlForId(siteMap, id) : "-";
 		if (dryRun) {
 			const report = [];
 			for (const table of allTables()) {
 				const bySite = groupBySite(liveEntries.filter((entry) => entry.table === table));
 				for (const [s, group] of bySite) report.push({
 					table,
-					siteId: s,
+					siteUrl: s ? siteUrlForId(siteMap, s) : null,
 					...countByTier(group)
 				});
 			}
@@ -64,8 +68,8 @@ const compactCommand = defineCommand({
 				return;
 			}
 			console.log();
-			console.log(`  table                site                 raw    d7   d30   d90`);
-			for (const r of report) console.log(`  ${r.table.padEnd(20)} ${(r.siteId ?? "-").padEnd(20)} ${String(r.raw).padStart(4)}  ${String(r.d7).padStart(4)}  ${String(r.d30).padStart(4)}  ${String(r.d90).padStart(4)}`);
+			console.log(`  table                Site                           raw    d7   d30   d90`);
+			for (const r of report) console.log(`  ${r.table.padEnd(20)} ${(r.siteUrl ?? "-").padEnd(30)} ${String(r.raw).padStart(4)}  ${String(r.d7).padStart(4)}  ${String(r.d30).padStart(4)}  ${String(r.d90).padStart(4)}`);
 			console.log();
 			logger.info(`compact --dry-run: ${report.length} (table, site) pair(s) — pass without --dry-run to apply`);
 			return;
@@ -75,7 +79,7 @@ const compactCommand = defineCommand({
 			const entries = liveEntries.filter((entry) => entry.table === table);
 			const siteIds = new Set(entries.map((e) => e.siteId));
 			for (const targetSite of siteIds) {
-				logger.info(`Compacting ${table} [${targetSite ?? "-"}] (raw→d7→d30→d90)`);
+				logger.info(`Compacting ${table} [${siteLabel(targetSite)}] (raw→d7→d30→d90)`);
 				await store.engine.compactTiered({
 					userId: store.userId,
 					siteId: targetSite,
@@ -83,7 +87,7 @@ const compactCommand = defineCommand({
 				}, thresholds);
 				summary.push({
 					table,
-					siteId: targetSite
+					siteUrl: targetSite ? siteUrlForId(siteMap, targetSite) : null
 				});
 			}
 		}

package/dist/commands/config.mjs

@@ -1,11 +1,12 @@
 import { configCommandMeta } from "../command-meta.mjs";
 import { getConfigPath, loadConfig, resolveDataDir, saveConfig } from "../config.mjs";
-import { OUTPUT_ARGS, applyOutputMode, displayPath, logger, noSubcommandSelected } from "../utils.mjs";
-import { createCommandContext } from "../context.mjs";
+import { OUTPUT_ARGS, applyOutputMode, displayPath, logger } from "../utils.mjs";
+import { createCommandContext, formatSiteResolution } from "../context.mjs";
 import process from "node:process";
 import { defineCommand } from "citty";
 import fs from "node:fs/promises";
 import path from "node:path";
+import { resolveSiteInput } from "gscdump";
 const showCommand = defineCommand({
 	meta: {
 		name: "show",
@@ -35,9 +36,7 @@ const showCommand = defineCommand({
 });
 const VALID_KEYS = [
 	"defaultSite",
-	"defaultPeriod",
 	"defaultFormat",
-	"defaultDb",
 	"dataDir",
 	"defaultLimit",
 	"defaultSearchType",
@@ -45,6 +44,13 @@ const VALID_KEYS = [
 	"serviceAccountPath"
 ];
 const NUMERIC_KEYS = /* @__PURE__ */ new Set(["defaultLimit"]);
+async function canonicalSite(input) {
+	const fromStore = await (await createCommandContext()).matchSite(input, { scope: "store" });
+	if (fromStore.kind === "resolved") return fromStore.siteUrl;
+	return (await createCommandContext({ needsAuth: true }).catch((error) => {
+		throw new Error(`${formatSiteResolution(fromStore, "store")} ${error.message}`);
+	})).resolveSite(input);
+}
 const setCommand = defineCommand({
 	meta: {
 		name: "set",
@@ -71,7 +77,7 @@ const setCommand = defineCommand({
 			process.exit(1);
 		}
 		const config = await loadConfig();
-		const value = NUMERIC_KEYS.has(args.key) ? Number(args.value) : args.value;
+		const value = NUMERIC_KEYS.has(args.key) ? Number(args.value) : args.key === "defaultSite" ? await canonicalSite(args.value) : args.value;
 		if (NUMERIC_KEYS.has(args.key) && !Number.isFinite(value)) {
 			logger.error(`Invalid numeric value for ${args.key}: ${args.value}`);
 			process.exit(1);
@@ -163,10 +169,11 @@ const validateCommand = defineCommand({
 						message: `Could not verify Site: ${message}`
 					});
 				});
-				if (sites && !sites.some((s) => s.siteUrl === config.defaultSite || s.siteUrl.includes(String(config.defaultSite)))) issues.push({
+				const resolution = sites && resolveSiteInput(config.defaultSite, sites);
+				if (resolution && resolution.kind !== "resolved") issues.push({
 					key: "defaultSite",
 					level: "fail",
-					message: `${config.defaultSite} is not in the verified site list`
+					message: formatSiteResolution(resolution, "account")
 				});
 			} else issues.push({
 				key: "defaultSite",
@@ -212,13 +219,6 @@ const configCommand = defineCommand({
 		validate: validateCommand
 	},
 	async run({ args }) {
-		if (!noSubcommandSelected("config", [
-			"show",
-			"set",
-			"unset",
-			"path",
-			"validate"
-		])) return;
 		await showCommand.run?.({
 			args,
 			cmd: showCommand,

package/dist/commands/doctor.mjs

@@ -1,18 +1,20 @@
-import { getCloudAccount, resolveAuthentication } from "../auth-state.mjs";
 import { doctorCommandMeta } from "../command-meta.mjs";
+import { getCloudAccount, resolveAuthentication } from "../auth-state.mjs";
 import { loadConfig } from "../config.mjs";
 import { resolveCliEnvironment } from "../environment.mjs";
 import { parseEnvFile } from "../env-file.mjs";
 import { OUTPUT_ARGS, applyOutputMode, displayPath, logger } from "../utils.mjs";
-import { loadTokens, resolveAuth, resolveBYOK } from "../auth.mjs";
+import { getAuth, loadTokens, resolveAuth, resolveBYOK } from "../auth.mjs";
 import { createLocalStore } from "../local-store.mjs";
-import { createCommandContext } from "../context.mjs";
+import { createCommandContext, formatSiteResolution } from "../context.mjs";
 import { missingRequiredScopes } from "../auth-scopes.mjs";
+import { currentAccessToken, fetchTokenInfo, redactTokens } from "../token-info.mjs";
 import process from "node:process";
 import { defineCommand } from "citty";
 import fs from "node:fs/promises";
 import path from "node:path";
 import { googleSearchConsole } from "gscdump/client";
+import { resolveSiteInput } from "gscdump";
 import { ofetch } from "ofetch";
 const FETCH_TIMEOUT_MS = 5e3;
 const TIME_SKEW_WARN_MS = 3e5;
@@ -97,39 +99,36 @@ async function checkAuth(envKeys) {
 		status: "info",
 		detail: clientId
 	});
-	let liveToken = null;
-	let refreshError = null;
-	if (typeof byok === "string") liveToken = byok;
-	else if (byok && "getAccessToken" in byok) liveToken = await byok.getAccessToken().then((r) => r.token ?? null).catch((e) => {
-		refreshError = e?.data?.error_description ?? e?.data?.error ?? e?.message ?? String(e);
-		return null;
-	});
-	else if (tokens?.access_token) liveToken = tokens.access_token;
-	if (!liveToken) {
-		const source = describeAuthSource(envKeys, byok);
-		const detail = refreshError ? `${source} — refresh failed: ${refreshError} (token revoked / invalid — re-run \`gscdump auth login --force\` and update the source above)` : `${source} — no usable access token`;
+	const source = byok ?? await getAuth({ interactive: false }).catch((error) => error instanceof Error ? error : new Error(String(error)));
+	const current = source instanceof Error ? {
+		kind: "failed",
+		detail: redactTokens(source.message)
+	} : await currentAccessToken(source);
+	if (current.kind === "failed") {
 		checks.push({
 			name: "auth",
 			status: "fail",
-			detail
+			detail: `${describeAuthSource(envKeys, byok)}: refresh failed: ${current.detail}. Run \`gscdump auth login --force\` and update the source above.`
 		});
 		return {
 			checks,
 			liveToken: null
 		};
 	}
-	const info = await ofetch("https://oauth2.googleapis.com/tokeninfo", { query: { access_token: liveToken } }).catch((e) => ({ error: e.message }));
-	if ("error" in info) {
+	const liveToken = current.token;
+	const tokenInfo = await fetchTokenInfo(liveToken);
+	if (tokenInfo.kind === "invalid") {
 		checks.push({
 			name: "auth",
 			status: "fail",
-			detail: `tokeninfo failed: ${info.error}`
+			detail: `tokeninfo failed: ${tokenInfo.detail}`
 		});
 		return {
 			checks,
 			liveToken: null
 		};
 	}
+	const info = tokenInfo.info;
 	checks.push({
 		name: "auth",
 		status: "pass",
@@ -152,12 +151,13 @@ async function checkAuth(envKeys) {
 		status: "pass",
 		detail: `${scopes.length} granted`
 	});
-	if (tokens?.expiry_date) {
-		const expiresInMs = tokens.expiry_date - Date.now();
+	const savedAfterRefresh = byok ? null : await loadTokens();
+	if (savedAfterRefresh?.expiry_date) {
+		const expiresInMs = savedAfterRefresh.expiry_date - Date.now();
 		if (expiresInMs < 0) checks.push({
 			name: "auth.expiry",
 			status: "warn",
-			detail: `expired ${new Date(tokens.expiry_date).toISOString()} — will refresh on next call`
+			detail: `expired ${new Date(savedAfterRefresh.expiry_date).toISOString()} — will refresh on next call`
 		});
 		else checks.push({
 			name: "auth.expiry",
@@ -298,7 +298,7 @@ async function checkGscSites() {
 	if (sites instanceof Error) return [{
 		name: "gsc.sites",
 		status: "fail",
-		detail: `sites() failed: ${sites.message}`
+		detail: `sites() failed: ${redactTokens(sites.message)}`
 	}];
 	return describeGscSites(sites, config.defaultSite);
 }
@@ -311,15 +311,15 @@ function describeGscSites(sites, defaultSite) {
 		detail: `${sites.length} site(s) accessible (${verified} verified)`
 	});
 	if (defaultSite) {
-		const match = sites.find((s) => s.siteUrl === defaultSite || (s.siteUrl ?? "").includes(defaultSite));
-		checks.push(match ? {
+		const resolution = resolveSiteInput(defaultSite, sites.flatMap((s) => s.siteUrl ? [{ siteUrl: s.siteUrl }] : []));
+		checks.push(resolution.kind === "resolved" ? {
 			name: "config.defaultSite",
 			status: "pass",
-			detail: `${defaultSite} ✓`
+			detail: `${resolution.siteUrl} ✓`
 		} : {
 			name: "config.defaultSite",
 			status: "fail",
-			detail: `${defaultSite} not in verified site list`
+			detail: formatSiteResolution(resolution, "account")
 		});
 	}
 	return checks;