@devtrack-solution/codesdd 1.2.2

package/dist/core/sdd/sanitize.js

@@ -0,0 +1,750 @@
+import { createHash } from 'node:crypto';
+import { lstat, mkdir, readFile, readdir, rename, rm, rmdir, unlink, writeFile, cp } from 'node:fs/promises';
+import path from 'node:path';
+import { stringify as stringifyYaml } from 'yaml';
+import { StructuralDiagnosticReportSchema, StructuralSanitizerActionSchema, StructuralSanitizerReportSchema, StructuralSanitizerRollbackOperationSchema, StructuralSanitizerTransactionManifestSchema, StructuralSanitizerTransactionOperationSchema, } from './structural-health.js';
+import { diagnoseSddRoot } from './diagnose.js';
+import { loadProjectSddConfig, loadStateSnapshot, resolveSddPaths } from './state.js';
+import { renderViews } from './views.js';
+import { RootResolver, SddBoundaryError } from './root-resolver.js';
+export class SddSanitizeOptionsError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'SddSanitizeOptionsError';
+    }
+}
+export class SddSanitizeApplyError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'SddSanitizeApplyError';
+    }
+}
+function actionToken(input) {
+    const normalized = input.toUpperCase().replace(/[^A-Z0-9]+/g, '-').replace(/^-+|-+$/g, '');
+    return normalized.length > 0 ? normalized : 'GENERIC';
+}
+function createSourceReportId(report) {
+    const digest = createHash('sha1')
+        .update(JSON.stringify({
+        root_path: report.root_path,
+        generated_at: report.generated_at,
+        strict: report.strict,
+        findings: report.findings.map((finding) => ({
+            finding_id: finding.finding_id,
+            rule_id: finding.rule_id,
+            category: finding.category,
+            severity: finding.severity,
+            location: finding.location ?? '',
+            disposition: finding.sanitizer.disposition,
+        })),
+    }))
+        .digest('hex')
+        .slice(0, 12)
+        .toUpperCase();
+    return `SH-REPORT-${digest}`;
+}
+function isInsidePath(rootPath, candidatePath) {
+    const relative = path.relative(rootPath, candidatePath);
+    return relative === '' || (!!relative && !relative.startsWith('..') && !path.isAbsolute(relative));
+}
+function toAuditTimestampToken(value = new Date()) {
+    return value.toISOString().replace(/[-:]/g, '').replace(/\.\d{3}Z$/, 'Z');
+}
+function createTransactionId(sourceReportId, value = new Date()) {
+    const timestamp = toAuditTimestampToken(value);
+    const suffix = createHash('sha1').update(`${sourceReportId}:${value.toISOString()}`).digest('hex').slice(0, 8).toUpperCase();
+    return `SAN-${timestamp}-${suffix}`;
+}
+async function pathExists(targetPath) {
+    try {
+        await lstat(targetPath);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+async function hashPath(targetPath) {
+    let stat;
+    try {
+        stat = await lstat(targetPath);
+    }
+    catch {
+        return undefined;
+    }
+    if (stat.isFile()) {
+        const content = await readFile(targetPath);
+        return `file:${createHash('sha1').update(content).digest('hex')}`;
+    }
+    if (stat.isDirectory()) {
+        const children = await readdir(targetPath, { withFileTypes: true });
+        const digest = createHash('sha1');
+        for (const child of children.sort((a, b) => a.name.localeCompare(b.name))) {
+            digest.update(child.name);
+            digest.update(child.isDirectory() ? ':dir' : ':file');
+            digest.update('\n');
+        }
+        return `dir:${digest.digest('hex')}`;
+    }
+    return `other:${stat.mode}`;
+}
+async function resolveInSddRoot(projectRoot, memoryRoot, candidatePath, label) {
+    try {
+        return await RootResolver.verifyRealpathContainment(projectRoot, memoryRoot, candidatePath, label);
+    }
+    catch (error) {
+        if (error instanceof SddBoundaryError) {
+            throw new SddSanitizeApplyError(error.message);
+        }
+        throw error;
+    }
+}
+function transactionDirs(projectRoot, transactionId) {
+    const sanitizeRoot = path.resolve(projectRoot, '.sdd', 'reports', 'sanitize');
+    const backupRoot = path.join(sanitizeRoot, transactionId, 'backups');
+    return {
+        sanitizeRoot,
+        backupRoot,
+        manifestPath: path.join(sanitizeRoot, `${transactionId}-manifest.json`),
+        auditLogPath: path.join(sanitizeRoot, `${transactionId}-audit.jsonl`),
+    };
+}
+async function backupPath(targetPath, backupRoot) {
+    if (!(await pathExists(targetPath)))
+        return undefined;
+    const suffix = createHash('sha1').update(targetPath).digest('hex').slice(0, 10);
+    const backupPathResolved = path.join(backupRoot, `${path.basename(targetPath)}-${suffix}.bak`);
+    await mkdir(path.dirname(backupPathResolved), { recursive: true });
+    await cp(targetPath, backupPathResolved, { recursive: true });
+    return backupPathResolved;
+}
+async function removePathSafely(targetPath) {
+    const stat = await lstat(targetPath).catch(() => null);
+    if (!stat)
+        return;
+    if (stat.isDirectory()) {
+        await rmdir(targetPath);
+        return;
+    }
+    await unlink(targetPath);
+}
+function toLifecycleTargetPath(finding) {
+    const evidence = finding.evidence;
+    const expectedRoot = typeof evidence.expected_root === 'string' ? evidence.expected_root : undefined;
+    const itemId = typeof evidence.id === 'string' ? evidence.id : undefined;
+    if (expectedRoot && itemId) {
+        return path.posix.join('.sdd', expectedRoot, itemId);
+    }
+    if (typeof finding.location === 'string' && finding.location.startsWith('.sdd/active/')) {
+        const tail = finding.location.slice('.sdd/active/'.length);
+        if (tail.length > 0) {
+            return path.posix.join('.sdd', 'archived', tail);
+        }
+    }
+    return undefined;
+}
+function toQuarantinePath(location) {
+    if (!location)
+        return undefined;
+    const baseName = path.posix.basename(location);
+    return path.posix.join('.sdd', 'quarantine', baseName);
+}
+function toWorkspaceBackupPath(location) {
+    if (!location)
+        return undefined;
+    const normalized = location.replace(/\\/g, '/').replace(/^\.sdd\//, '');
+    return path.posix.join('.sdd', 'backup', normalized);
+}
+function inferOperation(finding) {
+    switch (finding.rule_id) {
+        case 'SH-RULE-MISSING-DIRECTORY':
+            return 'mkdir';
+        case 'SH-RULE-GENERATED-VIEW':
+            return 'render';
+        case 'SH-RULE-LIFECYCLE-PLACEMENT':
+        case 'SH-RULE-ORPHAN-WORKSPACE':
+            return 'move';
+        case 'SH-RULE-WORKSPACE-FILE-NOT-ALLOWLISTED':
+            return 'move';
+        case 'SH-RULE-MISSING-STATE-FILE':
+            return 'register';
+        case 'SH-RULE-WORKSPACE-SCHEMA-INVALID':
+        case 'SH-RULE-LIFECYCLE-VIOLATION':
+        case 'SH-RULE-QUALITY-EVIDENCE-INCOMPLETE':
+            return 'manual_review';
+        default:
+            if (finding.sanitizer.disposition === 'blocked' || finding.sanitizer.disposition === 'noop') {
+                return 'skip';
+            }
+            return 'manual_review';
+    }
+}
+function makeActionFromFinding(finding, index) {
+    const operation = inferOperation(finding);
+    const actionId = `SH-ACTION-${actionToken(finding.finding_id)}-${actionToken(operation)}-${index + 1}`;
+    const candidate = {
+        action_id: actionId,
+        finding_id: finding.finding_id,
+        disposition: finding.sanitizer.disposition,
+        operation,
+        notes: `${finding.summary} ${finding.sanitizer.reason}`,
+    };
+    if (operation === 'mkdir' || operation === 'render' || operation === 'register') {
+        candidate.to_path = finding.location;
+    }
+    if (operation === 'move') {
+        candidate.from_path = finding.location;
+        candidate.to_path = finding.rule_id === 'SH-RULE-WORKSPACE-FILE-NOT-ALLOWLISTED'
+            ? toWorkspaceBackupPath(finding.location)
+            : finding.rule_id === 'SH-RULE-ORPHAN-WORKSPACE'
+                ? toQuarantinePath(finding.location)
+                : toLifecycleTargetPath(finding);
+        if (finding.rule_id === 'SH-RULE-ORPHAN-WORKSPACE') {
+            candidate.notes = `${candidate.notes} Quarantine candidate generated for manual review.`;
+        }
+        if (finding.rule_id === 'SH-RULE-WORKSPACE-FILE-NOT-ALLOWLISTED') {
+            candidate.notes = `${candidate.notes} Backup candidate generated for confirmation-driven cleanup; remove only after review.`;
+        }
+    }
+    if (finding.rule_id === 'SH-RULE-ROOT-BOUNDARY' && finding.location) {
+        candidate.from_path = finding.location;
+        candidate.to_path = toQuarantinePath(finding.location);
+        candidate.notes = `${candidate.notes} Candidate path suggested for in-root quarantine.`;
+    }
+    if (finding.rule_id === 'SH-RULE-WORKSPACE-SCHEMA-INVALID') {
+        const evidence = finding.evidence;
+        const id = typeof evidence.id === 'string' ? evidence.id : undefined;
+        const hasLegacyMarkdown = evidence.has_legacy_markdown === true;
+        candidate.notes = hasLegacyMarkdown && id
+            ? `${candidate.notes} Suggested migration: opensdd sdd migrate-workspace --feat ${id}.`
+            : `${candidate.notes} Suggested repair: manually edit the YAML to satisfy the workspace schema.`;
+    }
+    if (finding.rule_id === 'SH-RULE-LIFECYCLE-VIOLATION') {
+        const evidence = finding.evidence;
+        const id = typeof evidence.id === 'string' ? evidence.id : undefined;
+        const expectedStatus = typeof evidence.expected_status === 'string' ? evidence.expected_status : undefined;
+        candidate.to_path = '.sdd/state/backlog.yaml';
+        candidate.notes = id && expectedStatus
+            ? `${candidate.notes} Suggested repair: set ${id}.status to ${expectedStatus} in backlog.yaml based on its lifecycle directory.`
+            : `${candidate.notes} Suggested repair: align backlog.yaml status with lifecycle directory.`;
+    }
+    if (finding.rule_id === 'SH-RULE-QUALITY-EVIDENCE-INCOMPLETE') {
+        candidate.notes = `${candidate.notes} Suggested repair: add validation commands/results to evidence_log[] and reference coverage targets.`;
+    }
+    return StructuralSanitizerActionSchema.parse(candidate);
+}
+function buildSanitizerDryRunReport(report) {
+    const actions = [];
+    const blockedActions = [];
+    report.findings.forEach((finding, index) => {
+        const action = makeActionFromFinding(finding, index);
+        if (action.disposition === 'blocked') {
+            blockedActions.push(action);
+            return;
+        }
+        actions.push(action);
+    });
+    return StructuralSanitizerReportSchema.parse({
+        report_version: 1,
+        generated_at: new Date().toISOString(),
+        source_report_id: createSourceReportId(report),
+        mode: 'dry_run',
+        actions,
+        blocked_actions: blockedActions,
+    });
+}
+function manifestSummary(operations) {
+    return {
+        applied: operations.filter((item) => item.status === 'applied').length,
+        skipped: operations.filter((item) => item.status === 'skipped').length,
+        failed: operations.filter((item) => item.status === 'failed').length,
+        rolled_back: operations.filter((item) => item.status === 'rolled_back').length,
+    };
+}
+async function writeAuditLog(auditLogPath, lines) {
+    await mkdir(path.dirname(auditLogPath), { recursive: true });
+    if (lines.length === 0) {
+        await writeFile(auditLogPath, '', 'utf-8');
+        return;
+    }
+    const payload = `${lines.map((line) => JSON.stringify(line)).join('\n')}\n`;
+    await writeFile(auditLogPath, payload, 'utf-8');
+}
+async function rollbackOperation(projectRoot, memoryRoot, rollback) {
+    const operation = StructuralSanitizerRollbackOperationSchema.parse(rollback);
+    if (operation.operation === 'noop')
+        return;
+    if (operation.operation === 'delete_path') {
+        if (!operation.path)
+            return;
+        const target = await resolveInSddRoot(projectRoot, memoryRoot, operation.path, 'Rollback delete target');
+        await removePathSafely(target);
+        return;
+    }
+    if (operation.operation === 'move') {
+        if (!operation.from_path || !operation.to_path)
+            return;
+        const fromPath = await resolveInSddRoot(projectRoot, memoryRoot, operation.from_path, 'Rollback move source');
+        const toPath = await resolveInSddRoot(projectRoot, memoryRoot, operation.to_path, 'Rollback move target');
+        if (!(await pathExists(fromPath)))
+            return;
+        await mkdir(path.dirname(toPath), { recursive: true });
+        await rename(fromPath, toPath);
+        return;
+    }
+    if (operation.operation === 'restore_backup') {
+        if (!operation.path || !operation.backup_path)
+            return;
+        const target = await resolveInSddRoot(projectRoot, memoryRoot, operation.path, 'Rollback restore target');
+        const backup = await resolveInSddRoot(projectRoot, memoryRoot, operation.backup_path, 'Rollback backup path');
+        await rm(target, { recursive: true, force: true });
+        await mkdir(path.dirname(target), { recursive: true });
+        await cp(backup, target, { recursive: true });
+    }
+}
+async function applySanitizerPlan(projectRoot, source, diagnosticReport, dryRunReport) {
+    const config = await loadProjectSddConfig(projectRoot);
+    const paths = resolveSddPaths(path.resolve(projectRoot), config);
+    const transactionId = createTransactionId(dryRunReport.source_report_id);
+    const txDirs = transactionDirs(projectRoot, transactionId);
+    await mkdir(paths.memoryRoot, { recursive: true });
+    await mkdir(txDirs.sanitizeRoot, { recursive: true });
+    await mkdir(txDirs.backupRoot, { recursive: true });
+    const operations = [];
+    const auditLines = [
+        {
+            timestamp: new Date().toISOString(),
+            event: 'sanitize.apply.started',
+            transaction_id: transactionId,
+            source_report_id: dryRunReport.source_report_id,
+            planned_actions: dryRunReport.actions.length,
+            planned_blocked_actions: dryRunReport.blocked_actions.length,
+        },
+    ];
+    let viewsRendered = false;
+    for (let index = 0; index < dryRunReport.actions.length; index += 1) {
+        const action = dryRunReport.actions[index];
+        const txActionId = `SAN-OP-${actionToken(action.action_id)}-${index + 1}`;
+        if (action.disposition !== 'safe') {
+            operations.push(StructuralSanitizerTransactionOperationSchema.parse({
+                transaction_action_id: txActionId,
+                action_id: action.action_id,
+                finding_id: action.finding_id,
+                disposition: action.disposition,
+                operation: action.operation,
+                status: 'skipped',
+                from_path: action.from_path,
+                to_path: action.to_path,
+                rollback: { operation: 'noop' },
+            }));
+            continue;
+        }
+        try {
+            if (action.operation === 'skip' || action.operation === 'manual_review') {
+                operations.push(StructuralSanitizerTransactionOperationSchema.parse({
+                    transaction_action_id: txActionId,
+                    action_id: action.action_id,
+                    finding_id: action.finding_id,
+                    disposition: action.disposition,
+                    operation: action.operation,
+                    status: 'skipped',
+                    from_path: action.from_path,
+                    to_path: action.to_path,
+                    rollback: { operation: 'noop' },
+                }));
+                continue;
+            }
+            if (action.operation === 'mkdir') {
+                if (!action.to_path) {
+                    throw new SddSanitizeApplyError(`Action ${action.action_id} missing to_path for mkdir.`);
+                }
+                const targetPath = await resolveInSddRoot(projectRoot, paths.memoryRoot, action.to_path, 'mkdir target');
+                const beforeHash = await hashPath(targetPath);
+                await mkdir(targetPath, { recursive: true });
+                const afterHash = await hashPath(targetPath);
+                operations.push(StructuralSanitizerTransactionOperationSchema.parse({
+                    transaction_action_id: txActionId,
+                    action_id: action.action_id,
+                    finding_id: action.finding_id,
+                    disposition: action.disposition,
+                    operation: action.operation,
+                    status: 'applied',
+                    to_path: action.to_path,
+                    before_hash: beforeHash,
+                    after_hash: afterHash,
+                    rollback: { operation: 'delete_path', path: action.to_path },
+                }));
+                continue;
+            }
+            if (action.operation === 'move') {
+                if (!action.from_path || !action.to_path) {
+                    throw new SddSanitizeApplyError(`Action ${action.action_id} requires from_path and to_path for move.`);
+                }
+                const fromPath = await resolveInSddRoot(projectRoot, paths.memoryRoot, action.from_path, 'move source');
+                const toPath = await resolveInSddRoot(projectRoot, paths.memoryRoot, action.to_path, 'move target');
+                if (!(await pathExists(fromPath))) {
+                    throw new SddSanitizeApplyError(`Action ${action.action_id} cannot move missing source: ${action.from_path}`);
+                }
+                if (await pathExists(toPath)) {
+                    throw new SddSanitizeApplyError(`Action ${action.action_id} refuses to overwrite existing target: ${action.to_path}`);
+                }
+                const beforeHash = await hashPath(fromPath);
+                await mkdir(path.dirname(toPath), { recursive: true });
+                await rename(fromPath, toPath);
+                const afterHash = await hashPath(toPath);
+                operations.push(StructuralSanitizerTransactionOperationSchema.parse({
+                    transaction_action_id: txActionId,
+                    action_id: action.action_id,
+                    finding_id: action.finding_id,
+                    disposition: action.disposition,
+                    operation: action.operation,
+                    status: 'applied',
+                    from_path: action.from_path,
+                    to_path: action.to_path,
+                    before_hash: beforeHash,
+                    after_hash: afterHash,
+                    rollback: {
+                        operation: 'move',
+                        from_path: action.to_path,
+                        to_path: action.from_path,
+                    },
+                }));
+                continue;
+            }
+            if (action.operation === 'render') {
+                if (!action.to_path) {
+                    throw new SddSanitizeApplyError(`Action ${action.action_id} missing to_path for render.`);
+                }
+                const renderPath = await resolveInSddRoot(projectRoot, paths.memoryRoot, action.to_path, 'render target');
+                const backup = await backupPath(renderPath, txDirs.backupRoot);
+                const beforeHash = await hashPath(renderPath);
+                if (!viewsRendered) {
+                    const state = await loadStateSnapshot(paths, config);
+                    await renderViews(paths, config, state);
+                    viewsRendered = true;
+                }
+                const afterHash = await hashPath(renderPath);
+                operations.push(StructuralSanitizerTransactionOperationSchema.parse({
+                    transaction_action_id: txActionId,
+                    action_id: action.action_id,
+                    finding_id: action.finding_id,
+                    disposition: action.disposition,
+                    operation: action.operation,
+                    status: 'applied',
+                    to_path: action.to_path,
+                    before_hash: beforeHash,
+                    after_hash: afterHash,
+                    rollback: backup
+                        ? {
+                            operation: 'restore_backup',
+                            path: action.to_path,
+                            backup_path: path.relative(projectRoot, backup),
+                        }
+                        : {
+                            operation: 'delete_path',
+                            path: action.to_path,
+                        },
+                }));
+                continue;
+            }
+            if (action.operation === 'register') {
+                if (!action.to_path) {
+                    throw new SddSanitizeApplyError(`Action ${action.action_id} missing to_path for register.`);
+                }
+                const targetPath = await resolveInSddRoot(projectRoot, paths.memoryRoot, action.to_path, 'register target');
+                if (await pathExists(targetPath)) {
+                    throw new SddSanitizeApplyError(`Action ${action.action_id} refuses to overwrite existing file: ${action.to_path}`);
+                }
+                await mkdir(path.dirname(targetPath), { recursive: true });
+                await writeFile(targetPath, stringifyYaml({ version: 1 }), 'utf-8');
+                const afterHash = await hashPath(targetPath);
+                operations.push(StructuralSanitizerTransactionOperationSchema.parse({
+                    transaction_action_id: txActionId,
+                    action_id: action.action_id,
+                    finding_id: action.finding_id,
+                    disposition: action.disposition,
+                    operation: action.operation,
+                    status: 'applied',
+                    to_path: action.to_path,
+                    after_hash: afterHash,
+                    rollback: { operation: 'delete_path', path: action.to_path },
+                }));
+                continue;
+            }
+            operations.push(StructuralSanitizerTransactionOperationSchema.parse({
+                transaction_action_id: txActionId,
+                action_id: action.action_id,
+                finding_id: action.finding_id,
+                disposition: action.disposition,
+                operation: action.operation,
+                status: 'skipped',
+                from_path: action.from_path,
+                to_path: action.to_path,
+                rollback: { operation: 'noop' },
+            }));
+        }
+        catch (error) {
+            const failure = StructuralSanitizerTransactionOperationSchema.parse({
+                transaction_action_id: txActionId,
+                action_id: action.action_id,
+                finding_id: action.finding_id,
+                disposition: action.disposition,
+                operation: action.operation,
+                status: 'failed',
+                from_path: action.from_path,
+                to_path: action.to_path,
+                error: error.message,
+                rollback: { operation: 'noop' },
+            });
+            operations.push(failure);
+            for (const operation of [...operations].reverse()) {
+                if (operation.status !== 'applied')
+                    continue;
+                try {
+                    await rollbackOperation(projectRoot, paths.memoryRoot, operation.rollback);
+                    operation.status = 'rolled_back';
+                }
+                catch {
+                    // Keep status as applied if rollback failed for this operation.
+                }
+            }
+            auditLines.push({
+                timestamp: new Date().toISOString(),
+                event: 'sanitize.apply.failed',
+                transaction_id: transactionId,
+                action_id: action.action_id,
+                error: error.message,
+            });
+            const summary = manifestSummary(operations);
+            const manifest = StructuralSanitizerTransactionManifestSchema.parse({
+                report_version: 1,
+                transaction_id: transactionId,
+                generated_at: new Date().toISOString(),
+                source_report_id: dryRunReport.source_report_id,
+                root_path: paths.memoryRoot,
+                mode: 'apply',
+                operations,
+                summary,
+                audit_log_path: path.relative(projectRoot, txDirs.auditLogPath),
+            });
+            await writeAuditLog(txDirs.auditLogPath, auditLines);
+            await writeFile(txDirs.manifestPath, `${JSON.stringify(manifest, null, 2)}\n`, 'utf-8');
+            throw new SddSanitizeApplyError(`Sanitizer apply failed and rolled back transaction ${transactionId}: ${error.message}`);
+        }
+    }
+    for (const action of dryRunReport.blocked_actions) {
+        operations.push(StructuralSanitizerTransactionOperationSchema.parse({
+            transaction_action_id: `SAN-OP-${actionToken(action.action_id)}-BLOCKED`,
+            action_id: action.action_id,
+            finding_id: action.finding_id,
+            disposition: action.disposition,
+            operation: action.operation,
+            status: 'skipped',
+            from_path: action.from_path,
+            to_path: action.to_path,
+            rollback: { operation: 'noop' },
+        }));
+    }
+    const summary = manifestSummary(operations);
+    const manifest = StructuralSanitizerTransactionManifestSchema.parse({
+        report_version: 1,
+        transaction_id: transactionId,
+        generated_at: new Date().toISOString(),
+        source_report_id: dryRunReport.source_report_id,
+        root_path: paths.memoryRoot,
+        mode: 'apply',
+        operations,
+        summary,
+        audit_log_path: path.relative(projectRoot, txDirs.auditLogPath),
+    });
+    auditLines.push({
+        timestamp: new Date().toISOString(),
+        event: 'sanitize.apply.completed',
+        transaction_id: transactionId,
+        summary,
+    });
+    await writeAuditLog(txDirs.auditLogPath, auditLines);
+    await writeFile(txDirs.manifestPath, `${JSON.stringify(manifest, null, 2)}\n`, 'utf-8');
+    const report = StructuralSanitizerReportSchema.parse({
+        ...dryRunReport,
+        generated_at: new Date().toISOString(),
+        mode: 'apply',
+        transaction_id: transactionId,
+        manifest_path: path.relative(projectRoot, txDirs.manifestPath),
+        audit_log_path: path.relative(projectRoot, txDirs.auditLogPath),
+        summary,
+    });
+    return {
+        source,
+        diagnosticReport,
+        report,
+        transaction: manifest,
+    };
+}
+async function loadDiagnosticReportFromFile(projectRoot, reportPath) {
+    const absolutePath = path.resolve(projectRoot, reportPath);
+    let raw;
+    try {
+        raw = await readFile(absolutePath, 'utf-8');
+    }
+    catch (error) {
+        throw new SddSanitizeOptionsError(`Could not read report file: ${path.relative(projectRoot, absolutePath)} (${error.message})`);
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch (error) {
+        throw new SddSanitizeOptionsError(`Invalid JSON report in ${path.relative(projectRoot, absolutePath)}: ${error.message}`);
+    }
+    const result = StructuralDiagnosticReportSchema.safeParse(parsed);
+    if (!result.success) {
+        throw new SddSanitizeOptionsError(`Invalid diagnostic report schema in ${path.relative(projectRoot, absolutePath)}.`);
+    }
+    return result.data;
+}
+export function formatSanitizerText(report) {
+    const lines = [
+        `SDD sanitizer plan: ${report.mode}`,
+        `Source report: ${report.source_report_id}`,
+        `Actions: ${report.actions.length}, blocked: ${report.blocked_actions.length}`,
+    ];
+    if (report.transaction_id) {
+        lines.push(`Transaction: ${report.transaction_id}`);
+    }
+    if (report.manifest_path) {
+        lines.push(`Manifest: ${report.manifest_path}`);
+    }
+    if (report.audit_log_path) {
+        lines.push(`Audit log: ${report.audit_log_path}`);
+    }
+    if (report.summary) {
+        lines.push(`Apply summary: applied=${report.summary.applied}, skipped=${report.summary.skipped}, failed=${report.summary.failed}, rolled_back=${report.summary.rolled_back}`);
+    }
+    if (report.actions.length > 0 || report.blocked_actions.length > 0) {
+        lines.push('');
+    }
+    for (const action of report.actions) {
+        lines.push(`${action.disposition.toUpperCase()} ${action.operation} ${action.finding_id}`);
+        if (action.from_path)
+            lines.push(`  from: ${action.from_path}`);
+        if (action.to_path)
+            lines.push(`  to: ${action.to_path}`);
+        if (action.notes)
+            lines.push(`  notes: ${action.notes}`);
+    }
+    for (const action of report.blocked_actions) {
+        lines.push(`BLOCKED ${action.operation} ${action.finding_id}`);
+        if (action.from_path)
+            lines.push(`  from: ${action.from_path}`);
+        if (action.to_path)
+            lines.push(`  to: ${action.to_path}`);
+        if (action.notes)
+            lines.push(`  notes: ${action.notes}`);
+    }
+    return lines.join('\n');
+}
+export class SddSanitizeCommand {
+    async execute(projectRoot, options = {}) {
+        const wantsApply = options.apply === true;
+        const wantsDryRun = options.dryRun !== false && !wantsApply;
+        if (wantsApply && options.yes !== true) {
+            throw new SddSanitizeOptionsError('Applying sanitizer actions requires explicit confirmation with --yes.');
+        }
+        if (!wantsApply && options.dryRun === false) {
+            throw new SddSanitizeOptionsError('Use --apply together with --yes to run a non-dry execution.');
+        }
+        const diagnosticReport = options.fromReport
+            ? await loadDiagnosticReportFromFile(projectRoot, options.fromReport)
+            : await diagnoseSddRoot(projectRoot, { strict: false });
+        const dryRunReport = buildSanitizerDryRunReport(diagnosticReport);
+        if (wantsApply) {
+            return applySanitizerPlan(projectRoot, options.fromReport ? 'report' : 'diagnose', diagnosticReport, dryRunReport);
+        }
+        const report = StructuralSanitizerReportSchema.parse({
+            ...dryRunReport,
+            mode: wantsDryRun ? 'dry_run' : dryRunReport.mode,
+        });
+        return {
+            source: options.fromReport ? 'report' : 'diagnose',
+            diagnosticReport,
+            report,
+        };
+    }
+    async rollback(projectRoot, transactionId, options) {
+        if (!options.reason || options.reason.trim().length === 0) {
+            throw new SddSanitizeOptionsError('Rollback requires a non-empty --reason.');
+        }
+        if (!/^SAN-[0-9]{8}T[0-9]{6}Z-[A-F0-9]{8}$/.test(transactionId)) {
+            throw new SddSanitizeOptionsError(`Invalid transaction id: ${transactionId}`);
+        }
+        const config = await loadProjectSddConfig(projectRoot);
+        const paths = resolveSddPaths(path.resolve(projectRoot), config);
+        const txDirs = transactionDirs(projectRoot, transactionId);
+        let rawManifest;
+        try {
+            rawManifest = await readFile(txDirs.manifestPath, 'utf-8');
+        }
+        catch (error) {
+            throw new SddSanitizeOptionsError(`Could not read manifest for ${transactionId}: ${error.message}`);
+        }
+        let parsedManifest;
+        try {
+            parsedManifest = JSON.parse(rawManifest);
+        }
+        catch (error) {
+            throw new SddSanitizeOptionsError(`Invalid JSON manifest for ${transactionId}: ${error.message}`);
+        }
+        const manifestResult = StructuralSanitizerTransactionManifestSchema.safeParse(parsedManifest);
+        if (!manifestResult.success) {
+            throw new SddSanitizeOptionsError(`Invalid sanitizer manifest schema for ${transactionId}.`);
+        }
+        const manifest = manifestResult.data;
+        const auditLines = [
+            {
+                timestamp: new Date().toISOString(),
+                event: 'sanitize.rollback.started',
+                transaction_id: transactionId,
+                reason: options.reason,
+            },
+        ];
+        let rolledBack = 0;
+        let skipped = 0;
+        for (const operation of [...manifest.operations].reverse()) {
+            if (operation.status !== 'applied') {
+                skipped += 1;
+                continue;
+            }
+            const target = operation.to_path ?? operation.from_path;
+            if (target && operation.after_hash) {
+                const targetPath = await resolveInSddRoot(projectRoot, paths.memoryRoot, target, 'Rollback validation target');
+                const currentHash = await hashPath(targetPath);
+                if (currentHash !== operation.after_hash) {
+                    throw new SddSanitizeApplyError(`Rollback refused for ${operation.action_id} because ${target} changed after transaction.`);
+                }
+            }
+            await rollbackOperation(projectRoot, paths.memoryRoot, operation.rollback);
+            rolledBack += 1;
+        }
+        auditLines.push({
+            timestamp: new Date().toISOString(),
+            event: 'sanitize.rollback.completed',
+            transaction_id: transactionId,
+            rolled_back: rolledBack,
+            skipped,
+            reason: options.reason,
+        });
+        await mkdir(path.dirname(txDirs.auditLogPath), { recursive: true });
+        const existingAudit = await readFile(txDirs.auditLogPath, 'utf-8').catch(() => '');
+        const extraAudit = `${auditLines.map((line) => JSON.stringify(line)).join('\n')}\n`;
+        await writeFile(txDirs.auditLogPath, `${existingAudit}${extraAudit}`, 'utf-8');
+        return {
+            transactionId,
+            rolledBack,
+            skipped,
+            manifestPath: path.relative(projectRoot, txDirs.manifestPath),
+            auditLogPath: path.relative(projectRoot, txDirs.auditLogPath),
+        };
+    }
+}
+//# sourceMappingURL=sanitize.js.map