@ductape/cli 0.2.23 → 0.3.0

package/dist/commands/migration-review.js

@@ -0,0 +1,624 @@
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import path from 'node:path';
+import { printJson } from '../lib/output.js';
+import { readMigrationJson, writeMigrationJson } from '../lib/migration-artifact.js';
+const CLI_VERSION = (() => {
+    try {
+        const packagePath = path.resolve(path.dirname(new URL(import.meta.url).pathname), '../../package.json');
+        return String(JSON.parse(fs.readFileSync(packagePath, 'utf8')).version);
+    }
+    catch {
+        return 'unknown';
+    }
+})();
+function checksum(file) {
+    try {
+        return crypto.createHash('sha256').update(fs.readFileSync(file)).digest('hex');
+    }
+    catch {
+        return null;
+    }
+}
+function readJson(file) {
+    return readMigrationJson(file);
+}
+function parity() {
+    return { status: 'pending', evidence: [] };
+}
+export function initializeReviewLedger(analysisPath, ledgerPath) {
+    const resolvedAnalysis = path.resolve(analysisPath);
+    const analysis = readJson(resolvedAnalysis);
+    if (!analysis.source || !Array.isArray(analysis.review_queue)) {
+        throw new Error('Invalid migration analysis: source and review_queue are required.');
+    }
+    const output = path.resolve(ledgerPath ?? path.join(path.dirname(resolvedAnalysis), 'review-ledger.json'));
+    if (fs.existsSync(output)) {
+        throw new Error(`Review ledger already exists: ${output}`);
+    }
+    const ledger = {
+        version: 1,
+        artifact_kind: 'ai_migration_review_ledger',
+        source: path.resolve(analysis.source),
+        created_at: new Date().toISOString(),
+        revision: 0,
+        events: [],
+        entries: analysis.review_queue.map((item) => ({
+            file: item.file,
+            status: 'pending',
+            safety: item.safety,
+            baseline_checksum: checksum(path.join(analysis.source, item.file)),
+            reviewed_checksum: null,
+            purpose: '',
+            dependencies: [],
+            follow_up_files: [],
+            references: [],
+            interfaces: [],
+            findings: [],
+            interface_parity: parity(),
+            functional_parity: parity(),
+            operational_parity: parity(),
+        })),
+    };
+    fs.mkdirSync(path.dirname(output), { recursive: true });
+    writeMigrationJson(output, ledger, { createOnly: true });
+    return { ledger, path: output };
+}
+function validParity(value) {
+    if (value.status === 'verified')
+        return value.evidence.length > 0;
+    if (value.status === 'not_applicable')
+        return Boolean(value.reason?.trim());
+    return false;
+}
+function writeLedger(file, ledger, operation = 'update') {
+    const lock = `${file}.lock`;
+    let descriptor;
+    try {
+        try {
+            descriptor = fs.openSync(lock, 'wx');
+        }
+        catch (error) {
+            if (error.code === 'EEXIST') {
+                throw new Error('Review ledger is locked by another reviewer; retry after that update completes.');
+            }
+            throw error;
+        }
+        const current = readJson(file);
+        const currentStateHash = current.events?.at(-1)?.state_hash;
+        if (currentStateHash &&
+            currentStateHash !== crypto.createHash('sha256').update(JSON.stringify(current.entries)).digest('hex')) {
+            throw new Error('Review ledger state was modified outside the append-only audit workflow.');
+        }
+        const expectedRevision = ledger.revision ?? 0;
+        if ((current.revision ?? 0) !== expectedRevision) {
+            throw new Error(`Review ledger revision conflict: expected ${expectedRevision}, found ${current.revision ?? 0}`);
+        }
+        const previousHash = ledger.events?.at(-1)?.hash ?? null;
+        const eventWithoutHash = {
+            revision: expectedRevision + 1,
+            timestamp: new Date().toISOString(),
+            actor: process.env.USER || 'unknown',
+            tool: '@ductape/cli',
+            tool_version: CLI_VERSION,
+            operation,
+            state_hash: crypto.createHash('sha256').update(JSON.stringify(ledger.entries)).digest('hex'),
+            previous_hash: previousHash,
+        };
+        const hash = crypto.createHash('sha256')
+            .update(JSON.stringify(eventWithoutHash))
+            .digest('hex');
+        ledger.revision = eventWithoutHash.revision;
+        ledger.events = [...(ledger.events ?? []), { ...eventWithoutHash, hash }];
+        const temporary = `${file}.tmp-${process.pid}`;
+        fs.writeFileSync(temporary, JSON.stringify(ledger, null, 2) + '\n');
+        fs.copyFileSync(file, `${file}.bak`);
+        fs.renameSync(temporary, file);
+    }
+    finally {
+        if (descriptor !== undefined) {
+            fs.closeSync(descriptor);
+            if (fs.existsSync(lock))
+                fs.unlinkSync(lock);
+        }
+    }
+}
+function loadLedger(ledgerPath) {
+    const resolved = path.resolve(ledgerPath);
+    const ledger = readJson(resolved);
+    if (ledger.artifact_kind !== 'ai_migration_review_ledger' || !Array.isArray(ledger.entries)) {
+        throw new Error('Invalid AI migration review ledger.');
+    }
+    ledger.revision ??= 0;
+    ledger.events ??= [];
+    return { path: resolved, ledger };
+}
+function repositoryFile(value) {
+    const normalized = value.split(path.sep).join('/').replace(/^\.\//, '');
+    if (!normalized || path.isAbsolute(value) || normalized === '..' || normalized.startsWith('../')) {
+        throw new Error(`File must be repository-relative: ${value}`);
+    }
+    return normalized;
+}
+const WALK_IGNORE = new Set(['.git', 'node_modules', 'dist', 'build', 'coverage', 'vendor', 'bin', 'obj', 'target']);
+function findFilesByChecksum(root, expected) {
+    const matches = [];
+    const visit = (directory) => {
+        for (const item of fs.readdirSync(directory, { withFileTypes: true })) {
+            if (item.isDirectory() && WALK_IGNORE.has(item.name))
+                continue;
+            const absolute = path.join(directory, item.name);
+            if (item.isSymbolicLink())
+                continue;
+            if (item.isDirectory())
+                visit(absolute);
+            else if (item.isFile() && checksum(absolute) === expected) {
+                matches.push(path.relative(root, absolute).split(path.sep).join('/'));
+            }
+        }
+    };
+    visit(root);
+    return matches;
+}
+function findEntry(ledger, file) {
+    const normalized = repositoryFile(file);
+    const entry = ledger.entries.find((candidate) => candidate.file === normalized);
+    if (!entry)
+        throw new Error(`File is not present in the review ledger: ${normalized}`);
+    return entry;
+}
+export function validateReviewLedger(ledgerPath) {
+    const { path: resolved, ledger } = loadLedger(ledgerPath);
+    const known = new Set(ledger.entries.map((entry) => entry.file));
+    const pending = [];
+    const stale = [];
+    const invalidExclusions = [];
+    const missingFollowUps = [];
+    const incompleteParity = [];
+    const missingContext = [];
+    const missingFindingProvenance = [];
+    const missingSymbolProvenance = [];
+    const probableMoves = [];
+    const auditErrors = [];
+    let previousHash = null;
+    let expectedEventRevision = 1;
+    for (const event of ledger.events ?? []) {
+        const { hash, ...eventWithoutHash } = event;
+        const expectedHash = crypto.createHash('sha256').update(JSON.stringify(eventWithoutHash)).digest('hex');
+        if (event.revision !== expectedEventRevision)
+            auditErrors.push(`event revision sequence breaks at ${event.revision}`);
+        if (event.previous_hash !== previousHash)
+            auditErrors.push(`event previous_hash mismatch at ${event.revision}`);
+        if (hash !== expectedHash)
+            auditErrors.push(`event hash mismatch at ${event.revision}`);
+        previousHash = hash;
+        expectedEventRevision += 1;
+    }
+    if ((ledger.revision ?? 0) !== (ledger.events?.length ?? 0)) {
+        auditErrors.push('ledger revision does not match append-only event count');
+    }
+    const lastStateHash = ledger.events?.at(-1)?.state_hash;
+    if (lastStateHash &&
+        lastStateHash !== crypto.createHash('sha256').update(JSON.stringify(ledger.entries)).digest('hex')) {
+        auditErrors.push('ledger entry state does not match the latest audit event');
+    }
+    const uncoveredReferences = [];
+    const invalidGeneratedExclusions = [];
+    for (const entry of ledger.entries) {
+        const current = checksum(path.join(ledger.source, entry.file));
+        if (entry.status === 'pending')
+            pending.push(entry.file);
+        if (entry.status === 'reviewed') {
+            if (!entry.reviewed_checksum || current !== entry.reviewed_checksum) {
+                stale.push(entry.file);
+                if (current === null && entry.reviewed_checksum) {
+                    const candidates = findFilesByChecksum(ledger.source, entry.reviewed_checksum)
+                        .filter((candidate) => candidate !== entry.file);
+                    if (candidates.length)
+                        probableMoves.push({ from: entry.file, candidates });
+                }
+            }
+            if (!entry.purpose.trim())
+                missingContext.push(entry.file);
+            for (const [concern, evidence] of [
+                ['interface', entry.interface_parity],
+                ['functional', entry.functional_parity],
+                ['operational', entry.operational_parity],
+            ]) {
+                if (!validParity(evidence))
+                    incompleteParity.push({ file: entry.file, concern });
+            }
+        }
+        if (entry.status === 'excluded' && !entry.exclusion_reason?.trim()) {
+            invalidExclusions.push(entry.file);
+        }
+        if (entry.status === 'excluded' && entry.exclusion?.classification === 'generated') {
+            if (!entry.exclusion.generator?.trim() || !entry.exclusion.regeneration_test?.trim()) {
+                invalidGeneratedExclusions.push(entry.file);
+            }
+        }
+        for (const followUp of entry.follow_up_files) {
+            if (!known.has(followUp))
+                missingFollowUps.push({ file: entry.file, follow_up: followUp });
+        }
+        for (const finding of entry.findings ?? []) {
+            const index = entry.findings.indexOf(finding);
+            if (!finding.location ||
+                !Number.isInteger(finding.location.start_line) ||
+                !Number.isInteger(finding.location.end_line) ||
+                finding.location.start_line < 1 ||
+                finding.location.end_line < finding.location.start_line) {
+                missingFindingProvenance.push({ file: entry.file, finding: index });
+            }
+            if (!finding.symbol?.kind || !finding.symbol.name?.trim()) {
+                missingSymbolProvenance.push({ file: entry.file, finding: index });
+            }
+            for (const followUp of finding.requires_followup ?? []) {
+                if (!known.has(followUp))
+                    missingFollowUps.push({ file: entry.file, follow_up: followUp });
+            }
+        }
+        for (const reference of entry.references ?? []) {
+            if (reference.external)
+                continue;
+            const target = ledger.entries.find((candidate) => candidate.file === reference.target);
+            if (!target || target.status === 'pending') {
+                uncoveredReferences.push({ file: entry.file, kind: reference.kind, target: reference.target });
+            }
+        }
+    }
+    const invalidatedDependents = new Set();
+    const changed = new Set(stale);
+    let expanded = true;
+    while (expanded) {
+        expanded = false;
+        for (const entry of ledger.entries) {
+            if (changed.has(entry.file) || entry.status !== 'reviewed')
+                continue;
+            const internalTargets = [
+                ...(entry.follow_up_files ?? []),
+                ...(entry.references ?? []).filter((reference) => !reference.external).map((reference) => reference.target),
+                ...(entry.findings ?? []).flatMap((finding) => finding.requires_followup ?? []),
+            ];
+            if (internalTargets.some((target) => changed.has(target))) {
+                changed.add(entry.file);
+                invalidatedDependents.add(entry.file);
+                expanded = true;
+            }
+        }
+    }
+    const reviewed = ledger.entries.filter((entry) => entry.status === 'reviewed').length;
+    const excluded = ledger.entries.filter((entry) => entry.status === 'excluded').length;
+    const ready = pending.length === 0 &&
+        stale.length === 0 &&
+        invalidExclusions.length === 0 &&
+        invalidGeneratedExclusions.length === 0 &&
+        missingFollowUps.length === 0 &&
+        uncoveredReferences.length === 0 &&
+        missingFindingProvenance.length === 0 &&
+        missingSymbolProvenance.length === 0 &&
+        invalidatedDependents.size === 0 &&
+        auditErrors.length === 0 &&
+        incompleteParity.length === 0 &&
+        missingContext.length === 0;
+    return {
+        ledger: resolved,
+        source: ledger.source,
+        ready,
+        coverage: {
+            total: ledger.entries.length,
+            reviewed,
+            excluded,
+            pending: pending.length,
+            percent: ledger.entries.length === 0
+                ? 100
+                : Math.round(((reviewed + excluded) / ledger.entries.length) * 10_000) / 100,
+        },
+        blockers: {
+            pending,
+            stale,
+            invalid_exclusions: invalidExclusions,
+            invalid_generated_exclusions: invalidGeneratedExclusions,
+            missing_follow_ups: missingFollowUps,
+            uncovered_references: uncoveredReferences,
+            missing_finding_provenance: missingFindingProvenance,
+            missing_symbol_provenance: missingSymbolProvenance,
+            probable_moves: probableMoves,
+            invalidated_dependents: [...invalidatedDependents],
+            audit_errors: auditErrors,
+            missing_context: missingContext,
+            incomplete_parity: incompleteParity,
+        },
+    };
+}
+export function snapshotReviewedFile(ledgerPath, file) {
+    const { path: resolved, ledger } = loadLedger(ledgerPath);
+    const entry = findEntry(ledger, file);
+    if (!entry.purpose.trim()) {
+        throw new Error(`Record the file purpose before marking it reviewed: ${file}`);
+    }
+    const current = checksum(path.join(ledger.source, file));
+    if (!current)
+        throw new Error(`Cannot read reviewed file: ${file}`);
+    entry.status = 'reviewed';
+    entry.reviewed_checksum = current;
+    delete entry.exclusion_reason;
+    writeLedger(resolved, ledger, `snapshot:${entry.file}`);
+    return entry;
+}
+export function recordReviewContext(ledgerPath, file, dataPath) {
+    const { path: resolved, ledger } = loadLedger(ledgerPath);
+    const entry = findEntry(ledger, file);
+    const data = readJson(path.resolve(dataPath));
+    if (typeof data.purpose === 'string')
+        entry.purpose = data.purpose;
+    if (Array.isArray(data.dependencies))
+        entry.dependencies = data.dependencies;
+    if (Array.isArray(data.interfaces))
+        entry.interfaces = data.interfaces;
+    if (Array.isArray(data.findings))
+        entry.findings = data.findings;
+    if (Array.isArray(data.references)) {
+        entry.references = data.references.map((reference) => ({
+            ...reference,
+            target: reference.external ? reference.target : repositoryFile(reference.target),
+        }));
+    }
+    if (Array.isArray(data.follow_up_files)) {
+        entry.follow_up_files = data.follow_up_files.map(repositoryFile);
+    }
+    writeLedger(resolved, ledger, `record:${entry.file}`);
+    return entry;
+}
+export function addFollowUpFile(ledgerPath, fromFile, followUpFile) {
+    const { path: resolved, ledger } = loadLedger(ledgerPath);
+    const source = findEntry(ledger, fromFile);
+    const target = repositoryFile(followUpFile);
+    if (!fs.existsSync(path.join(ledger.source, target))) {
+        throw new Error(`Follow-up file does not exist in the repository: ${target}`);
+    }
+    if (!source.follow_up_files.includes(target))
+        source.follow_up_files.push(target);
+    if (!ledger.entries.some((entry) => entry.file === target)) {
+        ledger.entries.push({
+            file: target,
+            status: 'pending',
+            safety: path.basename(target).startsWith('.env') ? 'names_only' : 'normal',
+            baseline_checksum: checksum(path.join(ledger.source, target)),
+            reviewed_checksum: null,
+            purpose: '',
+            dependencies: [],
+            follow_up_files: [],
+            references: [],
+            interfaces: [],
+            findings: [],
+            interface_parity: parity(),
+            functional_parity: parity(),
+            operational_parity: parity(),
+        });
+    }
+    writeLedger(resolved, ledger, `follow-up:${source.file}->${target}`);
+    return source;
+}
+export function excludeReviewFile(ledgerPath, file, exclusion) {
+    if (!['generated', 'vendor', 'build', 'snapshot', 'other'].includes(exclusion.classification)) {
+        throw new Error('Invalid exclusion classification.');
+    }
+    const { path: resolved, ledger } = loadLedger(ledgerPath);
+    const entry = findEntry(ledger, file);
+    if (!exclusion.reason.trim())
+        throw new Error('An exclusion reason is required.');
+    if (exclusion.classification === 'generated' &&
+        (!exclusion.generator?.trim() || !exclusion.regeneration_test?.trim())) {
+        throw new Error('Generated-file exclusions require --generator and --regeneration-test.');
+    }
+    entry.status = 'excluded';
+    entry.exclusion_reason = exclusion.reason;
+    entry.exclusion = exclusion;
+    entry.reviewed_checksum = null;
+    writeLedger(resolved, ledger, `exclude:${entry.file}`);
+    return entry;
+}
+export function setParityEvidence(ledgerPath, file, concern, status, evidence, reason) {
+    if (!['interface', 'functional', 'operational'].includes(concern)) {
+        throw new Error('Invalid parity concern.');
+    }
+    if (!['verified', 'not_applicable'].includes(status)) {
+        throw new Error('Invalid parity status.');
+    }
+    const { path: resolved, ledger } = loadLedger(ledgerPath);
+    const entry = findEntry(ledger, file);
+    if (status === 'verified' && !evidence?.trim())
+        throw new Error('Verified parity requires evidence.');
+    if (status === 'not_applicable' && !reason?.trim())
+        throw new Error('Not-applicable parity requires a reason.');
+    entry[`${concern}_parity`] = {
+        status,
+        evidence: evidence?.trim() ? [evidence.trim()] : [],
+        ...(reason?.trim() ? { reason: reason.trim() } : {}),
+    };
+    writeLedger(resolved, ledger, `parity:${concern}:${entry.file}`);
+    return entry;
+}
+export function reopenReviewFile(ledgerPath, file) {
+    const { path: resolved, ledger } = loadLedger(ledgerPath);
+    const entry = findEntry(ledger, file);
+    entry.status = 'pending';
+    entry.reviewed_checksum = null;
+    delete entry.exclusion;
+    delete entry.exclusion_reason;
+    writeLedger(resolved, ledger, `reopen:${entry.file}`);
+    return entry;
+}
+export function moveReviewedFile(ledgerPath, from, to) {
+    const { path: resolved, ledger } = loadLedger(ledgerPath);
+    const entry = findEntry(ledger, from);
+    const target = repositoryFile(to);
+    if (ledger.entries.some((candidate) => candidate.file === target)) {
+        throw new Error(`Move target already exists in the review ledger: ${target}`);
+    }
+    const targetChecksum = checksum(path.join(ledger.source, target));
+    const expected = entry.reviewed_checksum ?? entry.baseline_checksum;
+    if (!targetChecksum || !expected || targetChecksum !== expected) {
+        throw new Error('Move target content does not match the reviewed source checksum.');
+    }
+    const previous = entry.file;
+    entry.file = target;
+    for (const candidate of ledger.entries) {
+        candidate.follow_up_files = candidate.follow_up_files.map((value) => value === previous ? target : value);
+        for (const reference of candidate.references ?? []) {
+            if (!reference.external && reference.target === previous)
+                reference.target = target;
+        }
+        for (const finding of candidate.findings ?? []) {
+            finding.requires_followup = finding.requires_followup.map((value) => value === previous ? target : value);
+        }
+    }
+    writeLedger(resolved, ledger, `move:${previous}->${target}`);
+    return entry;
+}
+export function signReviewLedger(opts) {
+    const ledger = path.resolve(opts.ledger);
+    validateReviewLedger(ledger);
+    if (!opts.keyId.trim())
+        throw new Error('Signing key_id is required.');
+    const privateKey = fs.readFileSync(path.resolve(opts.privateKey), 'utf8');
+    const ledgerChecksum = checksum(ledger);
+    if (!ledgerChecksum)
+        throw new Error('Cannot checksum review ledger.');
+    const signature = {
+        version: 1,
+        artifact_kind: 'ductape_review_ledger_signature',
+        ledger,
+        ledger_checksum: ledgerChecksum,
+        key_id: opts.keyId,
+        algorithm: 'Ed25519',
+        signed_at: new Date().toISOString(),
+        signature: crypto.sign(null, Buffer.from(ledgerChecksum, 'utf8'), privateKey).toString('base64'),
+    };
+    const output = path.resolve(opts.output ?? `${ledger}.sig.json`);
+    writeMigrationJson(output, signature, { createOnly: true, mode: 0o600 });
+    return { path: output, signature };
+}
+export function verifyReviewLedgerSignature(opts) {
+    const ledger = path.resolve(opts.ledger);
+    const signature = readJson(path.resolve(opts.signature));
+    const current = checksum(ledger);
+    const valid = Boolean(signature.artifact_kind === 'ductape_review_ledger_signature' &&
+        signature.algorithm === 'Ed25519' &&
+        current &&
+        current === signature.ledger_checksum &&
+        crypto.verify(null, Buffer.from(signature.ledger_checksum, 'utf8'), fs.readFileSync(path.resolve(opts.publicKey), 'utf8'), Buffer.from(signature.signature, 'base64')));
+    return { ledger, key_id: signature.key_id, valid };
+}
+export function mergeReviewLedgers(opts) {
+    const base = loadLedger(opts.base).ledger;
+    const current = loadLedger(opts.current).ledger;
+    const incoming = loadLedger(opts.incoming).ledger;
+    if (base.source !== current.source || base.source !== incoming.source) {
+        throw new Error('Parallel review ledgers must use the same source repository.');
+    }
+    const baseByFile = new Map(base.entries.map((entry) => [entry.file, entry]));
+    const currentByFile = new Map(current.entries.map((entry) => [entry.file, entry]));
+    const incomingByFile = new Map(incoming.entries.map((entry) => [entry.file, entry]));
+    const files = new Set([...baseByFile.keys(), ...currentByFile.keys(), ...incomingByFile.keys()]);
+    const merged = [];
+    const conflicts = [];
+    for (const file of [...files].sort()) {
+        const original = baseByFile.get(file);
+        const ours = currentByFile.get(file);
+        const theirs = incomingByFile.get(file);
+        const originalJson = JSON.stringify(original);
+        const oursChanged = JSON.stringify(ours) !== originalJson;
+        const theirsChanged = JSON.stringify(theirs) !== originalJson;
+        if (oursChanged && theirsChanged && JSON.stringify(ours) !== JSON.stringify(theirs)) {
+            conflicts.push(file);
+            continue;
+        }
+        const selected = theirsChanged ? theirs : oursChanged ? ours : original;
+        if (selected)
+            merged.push(selected);
+    }
+    if (conflicts.length) {
+        return { merged: false, conflicts, output: null };
+    }
+    const result = {
+        version: 1,
+        artifact_kind: 'ai_migration_review_ledger',
+        source: base.source,
+        created_at: new Date().toISOString(),
+        revision: 0,
+        events: [],
+        entries: merged,
+    };
+    const output = path.resolve(opts.output);
+    if (fs.existsSync(output))
+        throw new Error(`Merge output already exists: ${output}`);
+    writeMigrationJson(output, result, { createOnly: true });
+    return { merged: true, conflicts: [], output };
+}
+export function runMigrationReviewInit(opts) {
+    const result = initializeReviewLedger(opts.analysis, opts.output);
+    printJson({ path: result.path, entries: result.ledger.entries.length }, Boolean(opts.json));
+}
+export function runMigrationReviewValidate(opts) {
+    const result = validateReviewLedger(opts.ledger);
+    printJson(result, Boolean(opts.json));
+    if (opts.strict && !result.ready) {
+        throw new Error('Migration review is not ready: resolve every reported blocker before cutover.');
+    }
+}
+export function runMigrationReviewSnapshot(opts) {
+    const entry = snapshotReviewedFile(opts.ledger, opts.file);
+    printJson({
+        file: entry.file,
+        status: entry.status,
+        reviewed_checksum: entry.reviewed_checksum,
+    }, Boolean(opts.json));
+}
+export function runMigrationReviewRecord(opts) {
+    const entry = recordReviewContext(opts.ledger, opts.file, opts.data);
+    printJson({ file: entry.file, purpose: entry.purpose, findings: entry.findings.length }, Boolean(opts.json));
+}
+export function runMigrationReviewFollowUp(opts) {
+    const entry = addFollowUpFile(opts.ledger, opts.file, opts.followUp);
+    printJson({ file: entry.file, follow_up_files: entry.follow_up_files }, Boolean(opts.json));
+}
+export function runMigrationReviewExclude(opts) {
+    const entry = excludeReviewFile(opts.ledger, opts.file, {
+        classification: opts.classification,
+        reason: opts.reason,
+        owner: opts.owner,
+        generator: opts.generator,
+        regeneration_test: opts.regenerationTest,
+    });
+    printJson({ file: entry.file, status: entry.status, exclusion: entry.exclusion }, Boolean(opts.json));
+}
+export function runMigrationReviewParity(opts) {
+    const entry = setParityEvidence(opts.ledger, opts.file, opts.concern, opts.status, opts.evidence, opts.reason);
+    printJson({ file: entry.file, concern: opts.concern, parity: entry[`${opts.concern}_parity`] }, Boolean(opts.json));
+}
+export function runMigrationReviewReopen(opts) {
+    const entry = reopenReviewFile(opts.ledger, opts.file);
+    printJson({ file: entry.file, status: entry.status }, Boolean(opts.json));
+}
+export function runMigrationReviewMove(opts) {
+    const entry = moveReviewedFile(opts.ledger, opts.from, opts.to);
+    printJson({ file: entry.file, status: entry.status, reviewed_checksum: entry.reviewed_checksum }, Boolean(opts.json));
+}
+export function runMigrationReviewSign(opts) {
+    const result = signReviewLedger(opts);
+    printJson({ path: result.path, key_id: result.signature.key_id, algorithm: result.signature.algorithm }, Boolean(opts.json));
+}
+export function runMigrationReviewVerifySignature(opts) {
+    const result = verifyReviewLedgerSignature(opts);
+    printJson(result, Boolean(opts.json));
+    if (!result.valid)
+        throw new Error('Review ledger signature verification failed.');
+}
+export function runMigrationReviewMerge(opts) {
+    const result = mergeReviewLedgers(opts);
+    printJson(result, Boolean(opts.json));
+    if (!result.merged)
+        throw new Error(`Review merge has conflicts: ${result.conflicts.join(', ')}`);
+}

package/dist/commands/migration-secrets.d.ts

@@ -0,0 +1,24 @@
+export declare function initializeSecretMap(opts: {
+    analysis: string;
+    definition: string;
+    output: string;
+}): {
+    path: string;
+};
+export declare function validateSecretMap(file: string): {
+    artifact: string;
+    ready: boolean;
+    references: number;
+    blockers: string[];
+};
+export declare function runMigrationSecretsInit(opts: {
+    analysis: string;
+    definition: string;
+    output: string;
+    json?: boolean;
+}): void;
+export declare function runMigrationSecretsValidate(opts: {
+    file: string;
+    strict?: boolean;
+    json?: boolean;
+}): void;