@sitecoreai-labs/sitecoreai-cli 0.0.4 → 0.1.0

package/dist/hygiene/tasks/audit/site-residue.js

@@ -0,0 +1,164 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runAuditSiteResidue = void 0;
+const cli_tasks_1 = require("../../../shared/cli-tasks");
+const site_discovery_1 = require("../../../recipe/api/site-discovery");
+const shared_1 = require("../shared");
+/**
+ * Audit for orphaned site residue across the SXA tenant/site folder
+ * trees.
+ *
+ * The bug this catches: when a site is deleted via the Sites API,
+ * the cascade only removes the SXA Site Grouping and immediate site
+ * content — it does NOT clean up the parallel folders that SXA
+ * provisions under:
+ *
+ *   /sitecore/templates/Project/<Tenant>/<Site>
+ *   /sitecore/layout/Renderings/Project/<Tenant>/<Site>
+ *   /sitecore/media library/Project/<Tenant>/<Site>
+ *
+ * Over time these leak. A deleted SXA site can leave hundreds of
+ * orphan templates, renderings, and media items behind, none of which
+ * any audit that stays within a single Sitecore tree can see.
+ *
+ * Strategy:
+ *   1. Discover the authoritative active-site list via SXA Site
+ *      Grouping items in `/sitecore/content` (the same source
+ *      `scai provision deploy site list` uses).
+ *   2. For each SXA root, list direct tenant folders and site folders.
+ *   3. Emit a finding for every tenant / site folder whose name has
+ *      no corresponding active-site entry.
+ *
+ * Default scope is the three SXA Project roots. Operators on non-SXA
+ * tenants — or anyone investigating bespoke layout folders — can pass
+ * `--root <path>` (repeatable) to extend the scan. The audit makes no
+ * effort to second-guess SXA conventions: any direct child of a
+ * scanned root is treated as a tenant folder, and any direct child of
+ * that is treated as a site folder.
+ */
+const DEFAULT_RESIDUE_ROOTS = [
+    "/sitecore/templates/Project",
+    "/sitecore/layout/Renderings/Project",
+    "/sitecore/media library/Project",
+];
+const collectActiveSites = async (environment, contentRoot) => {
+    const discovered = await (0, site_discovery_1.discoverSites)(environment, { contentRoot });
+    const tenants = new Set();
+    const sites = new Set();
+    for (const site of discovered) {
+        tenants.add(site.tenantName.toLowerCase());
+        sites.add(`${site.tenantName.toLowerCase()}/${site.name.toLowerCase()}`);
+    }
+    return { tenants, sites };
+};
+const runAuditSiteResidue = async (options) => {
+    const logger = (0, shared_1.toLogger)(options);
+    const { envName, environment, client } = (0, shared_1.resolveTenant)(options);
+    const extraRoots = options.root ?? [];
+    const roots = [...DEFAULT_RESIDUE_ROOTS, ...extraRoots];
+    const concurrency = options.concurrency ?? 8;
+    logger.verbose(`Discovering active sites under ${options.contentRoot ?? "/sitecore/content"}.`);
+    const { tenants: activeTenants, sites: activeSites } = await collectActiveSites(environment, options.contentRoot);
+    logger.verbose(`Active sites: ${activeSites.size} across ${activeTenants.size} tenant${activeTenants.size === 1 ? "" : "s"}.`);
+    const countDescendants = async (itemId) => {
+        try {
+            const page = await client.search({
+                index: options.index,
+                latestVersionOnly: true,
+                paging: { pageSize: 1 },
+                searchStatement: {
+                    criteria: {
+                        field: "_path",
+                        value: (0, shared_1.normalizeItemId)(itemId),
+                        criteriaType: "CONTAINS",
+                    },
+                },
+            });
+            // Subtract 1 so the count reflects the *descendants* — the item
+            // itself satisfies `_path CONTAINS itemId` too.
+            return Math.max(0, page.totalCount - 1);
+        }
+        catch (error) {
+            logger.warn(`Descendant count failed for ${itemId}: ${error instanceof Error ? error.message : String(error)}. Reporting 0.`);
+            return 0;
+        }
+    };
+    const findings = [];
+    for (const root of roots) {
+        let tenantFolders;
+        try {
+            tenantFolders = await client.getChildren({ path: root });
+        }
+        catch (error) {
+            logger.warn(`Skipping root '${root}': ${error instanceof Error ? error.message : String(error)}.`);
+            continue;
+        }
+        if (tenantFolders.length === 0) {
+            logger.verbose(`No tenant folders under ${root}.`);
+            continue;
+        }
+        const tenantReports = await (0, cli_tasks_1.mapWithConcurrency)(tenantFolders, async (tenant) => {
+            const tenantKey = tenant.name.toLowerCase();
+            if (!activeTenants.has(tenantKey)) {
+                const descendants = await countDescendants(tenant.itemId);
+                return [
+                    {
+                        kind: "orphan-tenant",
+                        root,
+                        tenant: tenant.name,
+                        site: null,
+                        itemId: tenant.itemId,
+                        path: tenant.path,
+                        descendantCount: descendants,
+                    },
+                ];
+            }
+            const siteFolders = await client.getChildren({ itemId: tenant.itemId });
+            const siteReports = [];
+            for (const site of siteFolders) {
+                const siteKey = `${tenantKey}/${site.name.toLowerCase()}`;
+                if (activeSites.has(siteKey))
+                    continue;
+                const descendants = await countDescendants(site.itemId);
+                siteReports.push({
+                    kind: "orphan-site",
+                    root,
+                    tenant: tenant.name,
+                    site: site.name,
+                    itemId: site.itemId,
+                    path: site.path,
+                    descendantCount: descendants,
+                });
+            }
+            return siteReports;
+        }, concurrency);
+        for (const batch of tenantReports)
+            findings.push(...batch);
+    }
+    // Sort by descendant count desc (largest cleanup wins first) then by
+    // path for stable diffs across runs.
+    findings.sort((a, b) => {
+        if (b.descendantCount !== a.descendantCount) {
+            return b.descendantCount - a.descendantCount;
+        }
+        return a.path.localeCompare(b.path);
+    });
+    if (!options.silent) {
+        (0, shared_1.printReport)({
+            logger,
+            command: "audit.site-residue.list",
+            envName,
+            results: findings,
+            summary: `Scanned ${roots.length} root${roots.length === 1 ? "" : "s"}; ${findings.length} orphan ${findings.length === 1 ? "tree" : "trees"} (${findings.reduce((n, r) => n + r.descendantCount, 0)} descendant items).`,
+            formatLine: (r) => `${r.kind} ${r.path} (${r.descendantCount} item${r.descendantCount === 1 ? "" : "s"})`,
+            extra: {
+                activeTenantCount: activeTenants.size,
+                activeSiteCount: activeSites.size,
+                scannedRoots: roots,
+            },
+            options,
+        });
+    }
+    return findings;
+};
+exports.runAuditSiteResidue = runAuditSiteResidue;

package/dist/hygiene/tasks/audit/slug-conflicts.d.ts

@@ -0,0 +1,58 @@
+import { type HygieneCommonOptions } from "../shared";
+export interface AuditSlugConflictsOptions extends HygieneCommonOptions {
+    /** Content root. Default `/sitecore/content`. */
+    root?: string;
+    index?: string;
+    limit?: number;
+    includeSystem?: boolean;
+    language?: string;
+    batchSize?: number;
+    concurrency?: number;
+    pageParallelism?: number;
+    cache?: boolean;
+    exclude?: string[];
+    since?: string;
+    owner?: string;
+    baseline?: boolean;
+    output?: string;
+    format?: "json" | "csv" | "markdown";
+    /**
+     * Use case-insensitive matching for the slug comparison. Default
+     * true. Sitecore item names are case-sensitive on disk but URL
+     * resolution is case-insensitive on most renderers.
+     */
+    caseInsensitive?: boolean;
+}
+export interface SlugConflictGroup {
+    parentPath: string;
+    slug: string;
+    count: number;
+    members: Array<{
+        itemId: string;
+        path: string;
+        name: string;
+        templateName: string | null;
+        language: string | null;
+    }>;
+}
+/**
+ * Audit content for siblings sharing the same item name (slug).
+ *
+ * URL resolution under Sitecore typically uses the item name as the
+ * URL segment. Two siblings with identical names (case-insensitively)
+ * produce ambiguous URLs and unpredictable routing.
+ *
+ * Strategy:
+ *   1. Enumerate items via `scanItemsAndFields` (no fields needed →
+ *      `skipFields: true`).
+ *   2. Group by `(parentPath, lowercased-name)`.
+ *   3. Emit groups with >= 2 members.
+ *
+ * Notes:
+ *   - Cross-language siblings (en + fr versions of the same item)
+ *     share an itemId and don't show as conflicts — they're the same
+ *     item with different language entries.
+ *   - True conflicts are two distinct itemIds under the same parent
+ *     with the same name. Rare but high-impact when present.
+ */
+export declare const runAuditSlugConflicts: (options: AuditSlugConflictsOptions) => Promise<SlugConflictGroup[]>;

package/dist/hygiene/tasks/audit/slug-conflicts.js

@@ -0,0 +1,87 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runAuditSlugConflicts = void 0;
+const shared_1 = require("../shared");
+/**
+ * Audit content for siblings sharing the same item name (slug).
+ *
+ * URL resolution under Sitecore typically uses the item name as the
+ * URL segment. Two siblings with identical names (case-insensitively)
+ * produce ambiguous URLs and unpredictable routing.
+ *
+ * Strategy:
+ *   1. Enumerate items via `scanItemsAndFields` (no fields needed →
+ *      `skipFields: true`).
+ *   2. Group by `(parentPath, lowercased-name)`.
+ *   3. Emit groups with >= 2 members.
+ *
+ * Notes:
+ *   - Cross-language siblings (en + fr versions of the same item)
+ *     share an itemId and don't show as conflicts — they're the same
+ *     item with different language entries.
+ *   - True conflicts are two distinct itemIds under the same parent
+ *     with the same name. Rare but high-impact when present.
+ */
+const runAuditSlugConflicts = async (options) => {
+    const logger = (0, shared_1.toLogger)(options);
+    const { envName, client } = (0, shared_1.resolveTenant)(options);
+    const root = options.root ?? "/sitecore/content";
+    const caseInsensitive = options.caseInsensitive !== false;
+    const { scanned, cache } = await (0, shared_1.scanItemsAndFields)({
+        client,
+        envName,
+        root,
+        logger,
+        options,
+        skipFields: true,
+    });
+    const groups = new Map();
+    const seenItemsInGroup = new Map();
+    for (const item of scanned) {
+        const lastSlash = item.path.lastIndexOf("/");
+        if (lastSlash <= 0)
+            continue;
+        const parentPath = item.path.slice(0, lastSlash);
+        const name = item.name;
+        const slug = caseInsensitive ? name.toLowerCase() : name;
+        const key = `${parentPath}|${slug}`;
+        const normalizedItemId = (0, shared_1.normalizeItemId)(item.itemId);
+        let seen = seenItemsInGroup.get(key);
+        if (!seen) {
+            seen = new Set();
+            seenItemsInGroup.set(key, seen);
+        }
+        if (seen.has(normalizedItemId))
+            continue; // dedupe per-itemId (multi-language same item)
+        seen.add(normalizedItemId);
+        let group = groups.get(key);
+        if (!group) {
+            group = { parentPath, slug, count: 0, members: [] };
+            groups.set(key, group);
+        }
+        group.members.push({
+            itemId: normalizedItemId,
+            path: item.path,
+            name: item.name,
+            templateName: item.templateName,
+            language: item.language,
+        });
+        group.count = group.members.length;
+    }
+    const conflicts = Array.from(groups.values())
+        .filter((g) => g.count >= 2)
+        .sort((a, b) => b.count - a.count || a.parentPath.localeCompare(b.parentPath));
+    await cache?.flush();
+    (0, shared_1.printReport)({
+        logger,
+        command: "audit.slug-conflicts.list",
+        envName,
+        results: conflicts,
+        summary: `Scanned ${scanned.length} items; ${conflicts.length} parent path${conflicts.length === 1 ? "" : "s"} have sibling-name conflicts.`,
+        formatLine: (g) => `${g.parentPath}/${g.slug}* (${g.count}×)`,
+        extra: { root, scannedCount: scanned.length, caseInsensitive },
+        options,
+    });
+    return conflicts;
+};
+exports.runAuditSlugConflicts = runAuditSlugConflicts;

package/dist/hygiene/tasks/audit/stale-content.d.ts

@@ -0,0 +1,68 @@
+import { type HygieneCommonOptions } from "../shared";
+export interface AuditStaleContentOptions extends HygieneCommonOptions {
+    /** Days since last update to qualify as stale. Default 365 (one year). */
+    notUpdatedInDays?: number;
+    /** Content root to scan. Default `/sitecore/content`. */
+    root?: string;
+    /** Override the search index. */
+    index?: string;
+    /** Cap on items inspected. Default 5000. */
+    limit?: number;
+    /** Include system items. Off by default. */
+    includeSystem?: boolean;
+    /** Restrict to one language. */
+    language?: string;
+    /** Workflow-check concurrency. Default 8. */
+    concurrency?: number;
+    pageParallelism?: number;
+    /**
+     * Skip items that are currently in a non-final workflow state. Those
+     * are "in-flight" content, surfaced separately by `audit stale-workflow`.
+     * Default true.
+     */
+    excludeWorkflowItems?: boolean;
+    /**
+     * Skip items whose `__Never publish` field is set. They're
+     * intentionally hidden and not stale-content candidates. Default true.
+     */
+    excludeNeverPublish?: boolean;
+}
+export interface StaleContentReport {
+    itemId: string;
+    path: string;
+    templateName: string | null;
+    language: string | null;
+    daysSinceUpdate: number;
+    updatedDate: string | null;
+    createdDate: string | null;
+    /** Always present when set; null if no workflow attached. */
+    workflowState: string | null;
+}
+/**
+ * Audit content for items that haven't been updated in N days AND
+ * aren't in a workflow / aren't marked never-publish.
+ *
+ * Different from `audit stale-workflow`:
+ *   - `stale-workflow` finds items stuck mid-flight (in a non-final
+ *     workflow state past `--days`).
+ *   - `stale-content` finds **abandoned** items — published content
+ *     no one has touched in a long time. The "graveyard" signal.
+ *
+ * Strategy:
+ *   1. Crawl items via `searchAll` with `pageParallelism` for speed.
+ *   2. Filter by indexed `updatedDate` (cheap; no per-item API call).
+ *   3. For each candidate, optionally check workflow state and
+ *      `__Never publish` to exclude in-flight or intentionally-hidden
+ *      items.
+ *
+ * Notes:
+ *   - The `--not-updated-in-days` default is 365 days (one year).
+ *     Tune lower (90 days?) for fast-moving sites where year-old
+ *     content is actually stable; tune higher for archives.
+ *   - The `updatedDate` from the search index reflects the last
+ *     authoring activity (any field change). For "last published"
+ *     semantics, this isn't directly available via the master index;
+ *     query the web index (`--index sitecore_web_index`) to scope
+ *     to published-only content.
+ */
+export declare const runAuditStaleContent: (options: AuditStaleContentOptions) => Promise<StaleContentReport[]>;

package/dist/hygiene/tasks/audit/stale-content.js

@@ -0,0 +1,133 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runAuditStaleContent = void 0;
+const cli_tasks_1 = require("../../../shared/cli-tasks");
+const shared_1 = require("../shared");
+/**
+ * Audit content for items that haven't been updated in N days AND
+ * aren't in a workflow / aren't marked never-publish.
+ *
+ * Different from `audit stale-workflow`:
+ *   - `stale-workflow` finds items stuck mid-flight (in a non-final
+ *     workflow state past `--days`).
+ *   - `stale-content` finds **abandoned** items — published content
+ *     no one has touched in a long time. The "graveyard" signal.
+ *
+ * Strategy:
+ *   1. Crawl items via `searchAll` with `pageParallelism` for speed.
+ *   2. Filter by indexed `updatedDate` (cheap; no per-item API call).
+ *   3. For each candidate, optionally check workflow state and
+ *      `__Never publish` to exclude in-flight or intentionally-hidden
+ *      items.
+ *
+ * Notes:
+ *   - The `--not-updated-in-days` default is 365 days (one year).
+ *     Tune lower (90 days?) for fast-moving sites where year-old
+ *     content is actually stable; tune higher for archives.
+ *   - The `updatedDate` from the search index reflects the last
+ *     authoring activity (any field change). For "last published"
+ *     semantics, this isn't directly available via the master index;
+ *     query the web index (`--index sitecore_web_index`) to scope
+ *     to published-only content.
+ */
+const runAuditStaleContent = async (options) => {
+    const logger = (0, shared_1.toLogger)(options);
+    const { envName, client } = (0, shared_1.resolveTenant)(options);
+    const days = options.notUpdatedInDays ?? 365;
+    const root = options.root ?? "/sitecore/content";
+    const limit = options.limit ?? 5000;
+    const knobs = (0, shared_1.resolveHygieneKnobs)(options);
+    const concurrency = options.concurrency ?? knobs.concurrency;
+    const includeSystem = Boolean(options.includeSystem);
+    const excludeWorkflow = options.excludeWorkflowItems !== false;
+    const cutoff = Date.now() - days * 24 * 60 * 60 * 1000;
+    const rootSearch = await client.search({
+        index: options.index,
+        paging: { pageSize: 1 },
+        searchStatement: {
+            criteria: { field: "_fullpath", value: root.toLowerCase(), criteriaType: "EXACT" },
+        },
+    });
+    const rootItemId = rootSearch.results[0]?.itemId;
+    if (!rootItemId) {
+        logger.warn(`Root path '${root}' not found in search index — scanning entire master DB.`);
+    }
+    const candidates = [];
+    let scanned = 0;
+    for await (const r of client.searchAll({
+        index: options.index,
+        latestVersionOnly: true,
+        ...(options.language && { language: options.language }),
+        ...(rootItemId && { searchStatement: (0, shared_1.buildPathFilterStatement)(rootItemId) }),
+    }, 100, knobs.pageParallelism)) {
+        if (!includeSystem && (0, shared_1.isSystemPath)(r.path))
+            continue;
+        scanned += 1;
+        if (!r.updatedDate)
+            continue;
+        const updated = Date.parse(r.updatedDate);
+        if (!Number.isFinite(updated) || updated >= cutoff)
+            continue;
+        candidates.push({
+            itemId: (0, shared_1.normalizeItemId)(r.itemId),
+            path: r.path,
+            language: r.language?.name ?? null,
+            templateName: r.templateName ?? null,
+            updatedDate: r.updatedDate,
+            createdDate: r.createdDate ?? null,
+            daysSince: Math.floor((Date.now() - updated) / (24 * 60 * 60 * 1000)),
+        });
+        if (candidates.length >= limit)
+            break;
+    }
+    logger.verbose(`Scanned ${scanned} items; ${candidates.length} stale (> ${days} days).`);
+    // Optionally exclude items currently in a workflow.
+    let final = candidates;
+    let workflowState = new Map();
+    if (excludeWorkflow) {
+        const workflowChecks = await (0, cli_tasks_1.mapWithConcurrency)(candidates, async (c) => {
+            const wf = await client.getItemWorkflow(c.itemId, c.path);
+            return {
+                c,
+                wfStateName: wf?.stateName ?? null,
+                inActiveWorkflow: Boolean(wf && wf.workflowName && !wf.stateIsFinal),
+            };
+        }, concurrency);
+        final = workflowChecks
+            .filter((r) => !r.inActiveWorkflow)
+            .map((r) => {
+            workflowState.set(r.c.itemId, r.wfStateName);
+            return r.c;
+        });
+    }
+    const reports = final
+        .map((c) => ({
+        itemId: c.itemId,
+        path: c.path,
+        templateName: c.templateName,
+        language: c.language,
+        daysSinceUpdate: c.daysSince,
+        updatedDate: c.updatedDate,
+        createdDate: c.createdDate,
+        workflowState: workflowState.get(c.itemId) ?? null,
+    }))
+        .sort((a, b) => b.daysSinceUpdate - a.daysSinceUpdate);
+    (0, shared_1.printReport)({
+        logger,
+        command: "audit.stale-content.list",
+        envName,
+        results: reports,
+        summary: `Scanned ${scanned} items; ${reports.length} stale (> ${days} days, ${excludeWorkflow ? "excluding in-workflow items" : "incl. workflow"}).`,
+        formatLine: (r) => `${r.path} — ${r.daysSinceUpdate}d since update (${r.updatedDate?.slice(0, 10) ?? "no date"})${r.workflowState ? ` [in ${r.workflowState}]` : ""}`,
+        extra: {
+            root,
+            notUpdatedInDays: days,
+            limit,
+            scannedCount: scanned,
+            excludeWorkflow,
+        },
+        options,
+    });
+    return reports;
+};
+exports.runAuditStaleContent = runAuditStaleContent;

package/dist/hygiene/tasks/audit/stale-users.d.ts

@@ -0,0 +1,54 @@
+import { type HygieneCommonOptions } from "../shared";
+export interface AuditStaleUsersOptions extends HygieneCommonOptions {
+    /** Days since last activity. Default 180. */
+    notActiveDays?: number;
+    /** Cap on users inspected. Default 5000. */
+    limit?: number;
+    /** Include administrators. Off by default. */
+    includeAdmins?: boolean;
+    /**
+     * Include service accounts (heuristic: user names ending in
+     * `_service`, `_api`, or `service` substring). Off by default —
+     * service accounts have no human-meaningful "last login"
+     * because they authenticate via OAuth client credentials.
+     */
+    includeServiceAccounts?: boolean;
+    /**
+     * Use `lastActivityDate` instead of `lastLoginDate` for the
+     * staleness check. Default `false` → use `lastLoginDate` which
+     * reflects "has not logged into the admin UI." Activity date is a
+     * broader signal that includes API-style polling.
+     */
+    useActivityDate?: boolean;
+    concurrency?: number;
+    baseline?: boolean;
+    output?: string;
+    format?: "json" | "csv" | "markdown";
+}
+export interface StaleUserReport {
+    user: string;
+    domain: string | null;
+    isAdministrator: boolean;
+    lastLogin: string | null;
+    lastActivity: string | null;
+    daysSinceActive: number | null;
+}
+/**
+ * Audit users who have been inactive for N days.
+ *
+ * Strategy:
+ *   1. List every user via `listUsers`.
+ *   2. For each, fetch `getUserDetail` to read `profile.lastActivity`.
+ *   3. Flag users where `lastActivity` is null OR older than N days.
+ *
+ * Notes:
+ *   - The Authoring API's `UserProfile.lastActivity` reflects the
+ *     last time the user logged into the Sitecore admin / Pages
+ *     editor. It does NOT count CLI / Authoring-API access via
+ *     OAuth client-credentials — service-style "users" therefore
+ *     always appear stale, which is why the audit excludes likely
+ *     service accounts by default.
+ *   - Administrators are excluded by default; pass `--include-admins`
+ *     to include them.
+ */
+export declare const runAuditStaleUsers: (options: AuditStaleUsersOptions) => Promise<StaleUserReport[]>;

package/dist/hygiene/tasks/audit/stale-users.js

@@ -0,0 +1,83 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runAuditStaleUsers = void 0;
+const cli_tasks_1 = require("../../../shared/cli-tasks");
+const shared_1 = require("../shared");
+const SERVICE_ACCOUNT_RE = /(_service$|_api$|service|automation|robot|sync)/i;
+/**
+ * Audit users who have been inactive for N days.
+ *
+ * Strategy:
+ *   1. List every user via `listUsers`.
+ *   2. For each, fetch `getUserDetail` to read `profile.lastActivity`.
+ *   3. Flag users where `lastActivity` is null OR older than N days.
+ *
+ * Notes:
+ *   - The Authoring API's `UserProfile.lastActivity` reflects the
+ *     last time the user logged into the Sitecore admin / Pages
+ *     editor. It does NOT count CLI / Authoring-API access via
+ *     OAuth client-credentials — service-style "users" therefore
+ *     always appear stale, which is why the audit excludes likely
+ *     service accounts by default.
+ *   - Administrators are excluded by default; pass `--include-admins`
+ *     to include them.
+ */
+const runAuditStaleUsers = async (options) => {
+    const logger = (0, shared_1.toLogger)(options);
+    const { envName, client } = (0, shared_1.resolveTenant)(options);
+    const days = options.notActiveDays ?? 180;
+    const cutoff = Date.now() - days * 24 * 60 * 60 * 1000;
+    const includeAdmins = Boolean(options.includeAdmins);
+    const includeServiceAccounts = Boolean(options.includeServiceAccounts);
+    const limit = options.limit ?? 5000;
+    const knobs = (0, shared_1.resolveHygieneKnobs)(options);
+    const concurrency = options.concurrency ?? knobs.concurrency;
+    const users = await client.listUsers();
+    const bounded = users.slice(0, limit);
+    logger.verbose(`Inspecting ${bounded.length} users.`);
+    const pairs = await (0, cli_tasks_1.mapWithConcurrency)(bounded, async (summary) => {
+        if (!includeAdmins && summary.isAdministrator)
+            return { summary, detail: null };
+        if (!includeServiceAccounts && SERVICE_ACCOUNT_RE.test(summary.name))
+            return { summary, detail: null };
+        const detail = await client.getUserDetail(summary.name);
+        return { summary, detail };
+    }, concurrency);
+    const useActivity = Boolean(options.useActivityDate);
+    const reports = pairs
+        .filter((p) => p.detail != null)
+        .filter((p) => {
+        const value = useActivity ? p.detail.lastActivity : p.detail.lastLogin;
+        if (!value)
+            return true; // never active
+        const t = Date.parse(value);
+        return !Number.isFinite(t) || t < cutoff;
+    })
+        .map((p) => {
+        const value = useActivity ? p.detail.lastActivity : p.detail.lastLogin;
+        const t = value ? Date.parse(value) : NaN;
+        return {
+            user: p.summary.name,
+            domain: p.summary.domain,
+            isAdministrator: p.summary.isAdministrator,
+            lastLogin: p.detail.lastLogin,
+            lastActivity: p.detail.lastActivity,
+            daysSinceActive: Number.isFinite(t)
+                ? Math.floor((Date.now() - t) / (24 * 60 * 60 * 1000))
+                : null,
+        };
+    })
+        .sort((a, b) => (b.daysSinceActive ?? Infinity) - (a.daysSinceActive ?? Infinity));
+    (0, shared_1.printReport)({
+        logger,
+        command: "audit.stale-users.list",
+        envName,
+        results: reports,
+        summary: `Inspected ${bounded.length} users; ${reports.length} inactive > ${days} days.`,
+        formatLine: (r) => `${r.user} — ${r.daysSinceActive === null ? "never active" : `${r.daysSinceActive}d`}${r.lastActivity ? ` (${r.lastActivity.slice(0, 10)})` : ""}`,
+        extra: { notActiveDays: days, scannedCount: bounded.length },
+        options,
+    });
+    return reports;
+};
+exports.runAuditStaleUsers = runAuditStaleUsers;