@sitecoreai-labs/sitecoreai-cli 0.0.4 → 0.1.0

package/dist/hygiene/tasks/cleanup/roles.js

@@ -0,0 +1,177 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runCleanupRoles = void 0;
+const cli_tasks_1 = require("../../../shared/cli-tasks");
+const empty_roles_1 = require("../audit/empty-roles");
+const shared_1 = require("../shared");
+/**
+ * Built-in Sitecore role names that ship with the platform. The set
+ * covers:
+ *   - Core admin roles (`Administrator`, `Designer`, `Developer`,
+ *     `Everyone`).
+ *   - The `Sitecore Client …` family (Authoring, Configuring, Forms
+ *     Author, Maintaining, Publishing, Securing, Translating, Users).
+ *   - The `Analytics …` and `Marketer …` reporting / personalization
+ *     families.
+ *   - The author role.
+ *
+ * The match is by lowercased bare name within the `sitecore\` domain.
+ * Tenants that customise the role catalog can extend via `--always-skip`
+ * or override globally with `--include-builtin`. Listing exact names
+ * (rather than `sitecore\Sitecore *` prefix) keeps a customer-named
+ * role like `sitecore\Sitecore Internal Team` out of the skip list.
+ */
+const BUILTIN_SITECORE_ROLES = new Set([
+    "administrator",
+    "designer",
+    "developer",
+    "author",
+    "everyone",
+    "sitecore client account managing",
+    "sitecore client authoring",
+    "sitecore client configuring",
+    "sitecore client designing",
+    "sitecore client developing",
+    "sitecore client forms author",
+    "sitecore client maintaining",
+    "sitecore client publishing",
+    "sitecore client securing",
+    "sitecore client translating",
+    "sitecore client users",
+    "sitecore local administrators",
+    "sitecore marketing author",
+    "sitecore marketing reporting",
+    "marketer",
+    "marketer limited",
+    "marketer minimal",
+    "analytics maintaining",
+    "analytics reporting",
+    "analytics personalization",
+    "analytics testing",
+]);
+const splitRoleName = (raw) => {
+    const idx = raw.indexOf("\\");
+    if (idx < 0)
+        return { domain: null, bareName: raw.toLowerCase() };
+    return {
+        domain: raw.slice(0, idx).toLowerCase(),
+        bareName: raw.slice(idx + 1).toLowerCase(),
+    };
+};
+const isBuiltinSitecoreRole = (name) => {
+    const { domain, bareName } = splitRoleName(name);
+    if (domain && domain !== "sitecore")
+        return false;
+    return BUILTIN_SITECORE_ROLES.has(bareName);
+};
+/**
+ * Purge empty roles. Pairs with `audit empty-roles list`.
+ *
+ * Safety rails:
+ *   - `--what-if` reports the plan without mutating.
+ *   - `--allow-write` required outside `--what-if`.
+ *   - `--max-deletions` caps per-run blast radius (default 50).
+ *   - Sitecore built-in roles (sitecore\\Author, sitecore\\Developer,
+ *     etc.) are surfaced by `audit empty-roles` only if they are
+ *     genuinely empty. If they're empty by accident (after a user
+ *     migration), deleting them breaks the platform's role model.
+ *     Operators should review the audit output BEFORE running cleanup.
+ *
+ * Notes:
+ *   - The Authoring API's `deleteRole` cascades — users in the role
+ *     lose that membership. Empty roles have no members by definition,
+ *     so no membership change.
+ *   - Roles that are members of OTHER roles (via `Role.memberOf`)
+ *     leave dangling memberships when deleted. We don't check that
+ *     here; the cleanup is intentionally minimal.
+ */
+const runCleanupRoles = async (options) => {
+    const logger = (0, shared_1.toLogger)(options);
+    const { envName, root: rootConfig, client } = (0, shared_1.resolveTenant)(options);
+    if (!options.whatIf) {
+        (0, shared_1.ensureAllowWriteForCleanup)(rootConfig, envName, options.allowWrite, "cleanup-roles");
+    }
+    else if (!logger.isJson()) {
+        logger.info("What-if mode active — no roles will be deleted.", "yellow");
+    }
+    const empty = await (0, empty_roles_1.runAuditEmptyRoles)({
+        ...options,
+        domain: options.domain,
+        json: true,
+        quiet: true,
+    });
+    // Filter out built-in Sitecore roles unless --include-builtin is set.
+    // Empty audit results land here regardless of platform-status —
+    // every fresh tenant has dozens of empty built-in roles, and naive
+    // purge would shred the role model that Item.AccessRights depends on.
+    const userSkip = new Set((options.alwaysSkip ?? []).map((s) => s.toLowerCase()));
+    const wasSkipped = (roleName) => {
+        // Audit returns `name` as either the fully-qualified `domain\\Role`
+        // form OR the bare role name — accept both. Compare both the full
+        // string and the bare name against --always-skip; pass either form
+        // straight to the built-in matcher (it splits internally).
+        const lower = roleName.toLowerCase();
+        if (userSkip.has(lower))
+            return true;
+        const sep = roleName.indexOf("\\");
+        if (sep >= 0) {
+            const bare = roleName.slice(sep + 1).toLowerCase();
+            if (userSkip.has(bare))
+                return true;
+        }
+        if (!options.includeBuiltin && isBuiltinSitecoreRole(roleName))
+            return true;
+        return false;
+    };
+    const eligible = empty.filter((r) => !wasSkipped(r.name));
+    const skippedBuiltinCount = empty.length - eligible.length;
+    if (skippedBuiltinCount > 0) {
+        logger.verbose(`Skipping ${skippedBuiltinCount} built-in or always-skip role${skippedBuiltinCount === 1 ? "" : "s"} (pass --include-builtin to override).`);
+    }
+    const maxDeletions = options.maxDeletions ?? 50;
+    const targets = eligible.slice(0, maxDeletions);
+    const knobs = (0, shared_1.resolveHygieneKnobs)(options);
+    const concurrency = options.concurrency ?? knobs.concurrency;
+    const actions = await (0, cli_tasks_1.mapWithConcurrency)(targets, async (r) => {
+        if (options.whatIf) {
+            return { name: r.name, domain: r.domain, status: "what-if" };
+        }
+        try {
+            await client.deleteRole(r.name);
+            return { name: r.name, domain: r.domain, status: "deleted" };
+        }
+        catch (error) {
+            return {
+                name: r.name,
+                domain: r.domain,
+                status: "failed",
+                error: error instanceof Error ? error.message : String(error),
+            };
+        }
+    }, concurrency);
+    const deleted = actions.filter((a) => a.status === "deleted").length;
+    const failed = actions.filter((a) => a.status === "failed").length;
+    const summary = options.whatIf
+        ? `Plan: would delete ${actions.length} empty role${actions.length === 1 ? "" : "s"}.`
+        : `Deleted ${deleted} role${deleted === 1 ? "" : "s"}${failed > 0 ? ` (${failed} failed)` : ""}.`;
+    (0, shared_1.printReport)({
+        logger,
+        command: "cleanup.roles.purge-empty",
+        envName,
+        results: actions,
+        summary,
+        formatLine: (a) => `${a.status === "what-if" ? "[would delete] " : a.status === "failed" ? "[failed] " : ""}${a.name}${a.error ? ` — ${a.error}` : ""}`,
+        extra: {
+            domain: options.domain ?? null,
+            whatIf: Boolean(options.whatIf),
+            maxDeletions,
+            deletedCount: deleted,
+            failedCount: failed,
+            skippedBuiltinCount,
+            includeBuiltin: Boolean(options.includeBuiltin),
+        },
+        options,
+    });
+    return actions;
+};
+exports.runCleanupRoles = runCleanupRoles;

package/dist/hygiene/tasks/cleanup/site-residue.d.ts

@@ -0,0 +1,55 @@
+import { type HygieneCommonOptions } from "../shared";
+import { type SiteResidueKind } from "../audit/site-residue";
+import { type ReferenceKind } from "../reference-kind";
+export interface CleanupSiteResidueOptions extends HygieneCommonOptions {
+    root?: string[];
+    contentRoot?: string;
+    index?: string;
+    concurrency?: number;
+    whatIf?: boolean;
+    allowWrite?: boolean;
+    /**
+     * Delete orphans even when the pre-flight finds inbound refs from
+     * active content. Default false — refs cause the orphan to be
+     * skipped with `inboundRefs` populated in the report.
+     */
+    force?: boolean;
+    /**
+     * Skip the inbound-ref pre-flight entirely. Faster but loses the
+     * safety net — pair with a separate `audit broken-links` run if you
+     * use this.
+     */
+    skipRefCheck?: boolean;
+    baseline?: boolean;
+    output?: string;
+    format?: "json" | "csv" | "markdown";
+}
+export interface InboundRef {
+    fromItemId: string;
+    fromPath: string;
+    fieldName: string;
+    /**
+     * Structured reference category derived from `fieldName`. "base-template"
+     * means an active template inherits from an item in the doomed tree —
+     * catastrophic. "field-value" means a generic field reference — usually
+     * recoverable. See [./reference-kind](./reference-kind.ts) for the full
+     * mapping.
+     */
+    referenceKind: ReferenceKind;
+    /** itemId inside the doomed tree that the active-content ref pointed at. */
+    refItemId: string;
+}
+export interface SiteResidueCleanupAction {
+    kind: SiteResidueKind;
+    root: string;
+    tenant: string;
+    site: string | null;
+    itemId: string;
+    path: string;
+    descendantCount: number;
+    status: "deleted" | "what-if" | "skipped" | "failed";
+    /** Populated when the pre-flight ran. Empty array = no inbound refs found. */
+    inboundRefs?: InboundRef[];
+    error?: string;
+}
+export declare const runCleanupSiteResidue: (options: CleanupSiteResidueOptions) => Promise<SiteResidueCleanupAction[]>;

package/dist/hygiene/tasks/cleanup/site-residue.js

@@ -0,0 +1,247 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runCleanupSiteResidue = void 0;
+const cli_tasks_1 = require("../../../shared/cli-tasks");
+const shared_1 = require("../shared");
+const site_residue_1 = require("../audit/site-residue");
+const reference_kind_1 = require("../reference-kind");
+const site_discovery_1 = require("../../../recipe/api/site-discovery");
+/**
+ * Companion to `audit site-residue` — deletes the orphan tenant/site
+ * subtrees the audit identifies.
+ *
+ * The upstream bug this works around: Sites-API DELETE doesn't cascade
+ * to the SXA `templates/Project`, `layout/Renderings/Project`, and
+ * `media library/Project` folders, so deleting a site leaves hundreds
+ * of orphan items behind. This cleanup cascades through all three trees
+ * (plus any operator-supplied `--root` paths) by calling
+ * `Authoring.deleteItem` on each orphan root — Sitecore handles the
+ * recursive delete server-side.
+ *
+ * Safety rails (matching the destructive-ops convention):
+ *   - `--what-if` is the default. The mutation only runs when both
+ *     `--what-if` is absent AND `--allow-write` is passed.
+ *   - Inbound-ref pre-flight is ON by default. The cleanup walks every
+ *     active-tenant content tree, extracts internal item refs, and
+ *     matches them against the orphan-tree descendants. Any orphan with
+ *     inbound refs from active content is **skipped** unless `--force`.
+ *   - `--skip-ref-check` opts out of the pre-flight (faster, less
+ *     safe — only use when you've just run `audit broken-links` and
+ *     trust the result).
+ */
+const REFCHECK_LIMIT_PER_ORPHAN = 5000;
+const collectDescendantIds = async (client, itemId, index) => {
+    const ids = new Set([(0, shared_1.normalizeItemId)(itemId)]);
+    let pageIndex = 0;
+    const pageSize = 500;
+    while (ids.size < REFCHECK_LIMIT_PER_ORPHAN) {
+        const page = await client.search({
+            index,
+            latestVersionOnly: true,
+            paging: { pageIndex, pageSize },
+            searchStatement: {
+                criteria: {
+                    field: "_path",
+                    value: (0, shared_1.normalizeItemId)(itemId),
+                    criteriaType: "CONTAINS",
+                },
+            },
+        });
+        if (!page.results.length)
+            break;
+        for (const r of page.results)
+            ids.add((0, shared_1.normalizeItemId)(r.itemId));
+        if (page.results.length < pageSize)
+            break;
+        pageIndex += 1;
+    }
+    return ids;
+};
+const scanActiveContentForRefs = async (params) => {
+    const { scanned, fieldsByItemId } = await (0, shared_1.scanItemsAndFields)({
+        client: params.client,
+        envName: params.envName,
+        root: params.contentRoot,
+        logger: params.logger,
+        options: params.options,
+    });
+    const rows = [];
+    for (const item of scanned) {
+        const fields = fieldsByItemId.get(item.itemId);
+        if (!fields || !Array.isArray(fields))
+            continue;
+        for (const field of fields) {
+            if (!field.value)
+                continue;
+            const refs = (0, shared_1.extractInternalRefs)(field.value);
+            if (refs.length === 0)
+                continue;
+            rows.push({
+                itemId: item.itemId,
+                path: item.path,
+                field: field.name,
+                referenceKind: (0, reference_kind_1.classifyReferenceKind)(field.name),
+                refs,
+            });
+        }
+    }
+    return rows;
+};
+const runCleanupSiteResidue = async (options) => {
+    const logger = (0, shared_1.toLogger)(options);
+    const { envName, environment, root: rootConfig, client } = (0, shared_1.resolveTenant)(options);
+    if (!options.whatIf) {
+        (0, shared_1.ensureAllowWriteForCleanup)(rootConfig, envName, options.allowWrite, "cleanup-site-residue");
+    }
+    else if (!logger.isJson()) {
+        logger.info("What-if mode active — no orphan trees will be deleted.", "yellow");
+    }
+    const auditOptions = options;
+    const findings = await (0, site_residue_1.runAuditSiteResidue)({
+        ...auditOptions,
+        // Suppress the audit's own report write — the cleanup emits its
+        // own consolidated envelope below.
+        output: undefined,
+        format: undefined,
+        quiet: true,
+    });
+    if (findings.length === 0) {
+        (0, shared_1.printReport)({
+            logger,
+            command: "cleanup.site-residue.purge",
+            envName,
+            results: [],
+            summary: "No orphan site-residue trees found.",
+            formatLine: () => "",
+            extra: { whatIf: Boolean(options.whatIf) },
+            options,
+        });
+        return [];
+    }
+    const refsByOrphan = new Map();
+    if (!options.skipRefCheck) {
+        logger.verbose(`Pre-flight: scanning active content for refs into ${findings.length} orphan tree${findings.length === 1 ? "" : "s"}.`);
+        // Build a per-orphan descendant-itemId set so a single ref scan can
+        // attribute hits back to the right orphan.
+        const descendantsByOrphan = new Map();
+        await (0, cli_tasks_1.mapWithConcurrency)(findings, async (finding) => {
+            const ids = await collectDescendantIds(client, finding.itemId, options.index);
+            descendantsByOrphan.set(finding.itemId, ids);
+        }, options.concurrency ?? 4);
+        // Active sites give us the tenant roots that we treat as "live
+        // content" — anything inside one of them with a ref into an orphan
+        // tree is the problem we're trying to catch.
+        const activeSites = await (0, site_discovery_1.discoverSites)(environment, {
+            contentRoot: options.contentRoot,
+        });
+        const tenantRoots = Array.from(new Set(activeSites.map((s) => s.tenantPath)));
+        if (tenantRoots.length === 0) {
+            tenantRoots.push(options.contentRoot ?? "/sitecore/content");
+        }
+        for (const root of tenantRoots) {
+            const rows = await scanActiveContentForRefs({
+                client,
+                envName,
+                options,
+                contentRoot: root,
+                logger,
+            });
+            for (const row of rows) {
+                for (const ref of row.refs) {
+                    const normalized = ref.toLowerCase();
+                    for (const [orphanId, descendants] of descendantsByOrphan) {
+                        if (!descendants.has(normalized))
+                            continue;
+                        const list = refsByOrphan.get(orphanId) ?? [];
+                        list.push({
+                            fromItemId: row.itemId,
+                            fromPath: row.path,
+                            fieldName: row.field,
+                            referenceKind: row.referenceKind,
+                            refItemId: normalized,
+                        });
+                        refsByOrphan.set(orphanId, list);
+                    }
+                }
+            }
+        }
+    }
+    const actions = await (0, cli_tasks_1.mapWithConcurrency)(findings, async (finding) => {
+        const inboundRefs = refsByOrphan.get(finding.itemId);
+        const base = {
+            kind: finding.kind,
+            root: finding.root,
+            tenant: finding.tenant,
+            site: finding.site,
+            itemId: finding.itemId,
+            path: finding.path,
+            descendantCount: finding.descendantCount,
+            status: "what-if",
+            ...(options.skipRefCheck ? {} : { inboundRefs: inboundRefs ?? [] }),
+        };
+        // Inbound refs are the only thing that overrides --what-if /
+        // --allow-write. If refs exist and the operator hasn't passed
+        // --force, skip — leaving the orphan in place is safer than
+        // breaking active content.
+        if (inboundRefs && inboundRefs.length > 0 && !options.force) {
+            return { ...base, status: "skipped" };
+        }
+        if (options.whatIf) {
+            return base;
+        }
+        try {
+            await client.deleteItem({ itemId: finding.itemId, permanently: true });
+            return { ...base, status: "deleted" };
+        }
+        catch (error) {
+            return {
+                ...base,
+                status: "failed",
+                error: error instanceof Error ? error.message : String(error),
+            };
+        }
+    }, options.concurrency ?? 4);
+    const deleted = actions.filter((a) => a.status === "deleted").length;
+    const wouldDelete = actions.filter((a) => a.status === "what-if").length;
+    const skipped = actions.filter((a) => a.status === "skipped").length;
+    const failed = actions.filter((a) => a.status === "failed").length;
+    const totalDescendants = actions
+        .filter((a) => a.status === "deleted" || a.status === "what-if")
+        .reduce((n, a) => n + a.descendantCount, 0);
+    const summary = options.whatIf
+        ? `Plan: would delete ${wouldDelete} orphan tree${wouldDelete === 1 ? "" : "s"} (~${totalDescendants} items)${skipped > 0 ? `, skip ${skipped} due to inbound refs` : ""}.`
+        : `Deleted ${deleted} orphan tree${deleted === 1 ? "" : "s"} (~${totalDescendants} items)${skipped > 0 ? `, skipped ${skipped} due to inbound refs` : ""}${failed > 0 ? `, ${failed} failure${failed === 1 ? "" : "s"}` : ""}.`;
+    (0, shared_1.printReport)({
+        logger,
+        command: "cleanup.site-residue.purge",
+        envName,
+        results: actions,
+        summary,
+        formatLine: (a) => {
+            const refTag = a.inboundRefs && a.inboundRefs.length > 0
+                ? ` [${a.inboundRefs.length} inbound ref${a.inboundRefs.length === 1 ? "" : "s"}]`
+                : "";
+            const errorTag = a.error ? ` — ${a.error}` : "";
+            const prefix = a.status === "deleted"
+                ? "[deleted]"
+                : a.status === "what-if"
+                    ? "[would delete]"
+                    : a.status === "skipped"
+                        ? "[skipped]"
+                        : "[failed]";
+            return `${prefix} ${a.path} (${a.descendantCount} items)${refTag}${errorTag}`;
+        },
+        extra: {
+            whatIf: Boolean(options.whatIf),
+            skipRefCheck: Boolean(options.skipRefCheck),
+            force: Boolean(options.force),
+            deletedCount: deleted,
+            wouldDeleteCount: wouldDelete,
+            skippedCount: skipped,
+            failedCount: failed,
+        },
+        options,
+    });
+    return actions;
+};
+exports.runCleanupSiteResidue = runCleanupSiteResidue;

package/dist/hygiene/tasks/cleanup/slug-conflicts.d.ts

@@ -0,0 +1,126 @@
+import { type HygieneCommonOptions } from "../shared";
+export type SlugConflictsKeepRule = "oldest" | "newest" | "shortest-path" | "interactive";
+export type SlugConflictsAction = "delete" | "rename";
+export interface CleanupSlugConflictsOptions extends HygieneCommonOptions {
+    root?: string;
+    index?: string;
+    limit?: number;
+    includeSystem?: boolean;
+    language?: string;
+    pageParallelism?: number;
+    exclude?: string[];
+    since?: string;
+    owner?: string;
+    caseInsensitive?: boolean;
+    /**
+     * Which member of each conflict group survives. Default `oldest`
+     * (the survivor is whichever sibling was created first). `newest`
+     * keeps the most-recently-updated sibling; `shortest-path` keeps the
+     * one whose full path is shortest (rare tie-breaker — useful when
+     * one sibling is at the canonical depth and others are buried).
+     * `interactive` prompts per group; requires a TTY.
+     */
+    keepRule?: SlugConflictsKeepRule;
+    /**
+     * What to do with the losers. `delete` (default) calls
+     * `deleteItem(permanently: true)`. `rename` keeps the item but
+     * renames it to `${name}${suffix}` where suffix is auto-generated
+     * from the itemId (8-char prefix) so subsequent runs don't re-collide.
+     * Rename preserves inbound refs (the itemId is unchanged) at the cost
+     * of leaving stale-named siblings around the parent — operators
+     * picking between the two should think about whether broken refs or
+     * stale names are worse for their tenant.
+     */
+    action?: SlugConflictsAction;
+    /**
+     * Override the auto-generated rename suffix. Use `{shortId}` as a
+     * placeholder for the loser's 8-char itemId prefix, `{full}` for the
+     * full 32-char id. Default: `-{shortId}`. Ignored when
+     * `--action delete`.
+     */
+    renameSuffix?: string;
+    /** Concurrency for delete/rename calls. Default 4. */
+    concurrency?: number;
+    whatIf?: boolean;
+    allowWrite?: boolean;
+    /** Required when `keepRule === "interactive"` and stdin isn't a TTY. */
+    nonInteractive?: boolean;
+    /**
+     * Pre-action inbound-reference check. When true, runs
+     * `audit references --to <itemId>` against every loser BEFORE the
+     * resolve phase. Behavior depends on mode:
+     *
+     *   - **Preview (`whatIf: true`):** counts attach to each resolved
+     *     row as `inboundRefs`. Warn-only — never aborts.
+     *   - **Apply (`whatIf: false`):** if any loser has positive count,
+     *     the whole run aborts with INPUT_INVALID listing the blockers.
+     *     The implicit safety net for "you're about to break N inbound
+     *     refs."
+     *
+     * Cost: one `audit references` scan per loser. Uses `cache: true` so
+     * the underlying field reads are shared across scans (large blast-
+     * radius runs are cheaper than naive O(N) implies). Off by default
+     * — operators who care opt in.
+     */
+    checkRefs?: boolean;
+    /**
+     * Content root the inbound-ref check scans. Default `/sitecore` to
+     * cover refs from anywhere on the tenant. Narrow if you know refs
+     * to losing items can only come from a subtree (e.g. `/sitecore/content`).
+     * Ignored when `checkRefs` is unset.
+     */
+    refCheckRoot?: string;
+}
+export interface SlugConflictPurgeAction {
+    parentPath: string;
+    slug: string;
+    kept: {
+        itemId: string;
+        path: string;
+    };
+    resolved: Array<{
+        itemId: string;
+        path: string;
+        /** `delete` losers get `permanently: true`. `rename` losers get a new sibling name. */
+        action: SlugConflictsAction;
+        /** Only set on `rename`. The new item name (not the full path). */
+        newName?: string;
+        /**
+         * Inbound-reference count from the optional `checkRefs` pre-scan.
+         * Set when the caller passed `checkRefs: true`; omitted otherwise.
+         * Surfaced in preview output so operators can see "I'm about to
+         * break N refs." In apply mode a positive count aborts the run.
+         */
+        inboundRefs?: number;
+        status: "applied" | "what-if" | "failed";
+        error?: string;
+    }>;
+}
+/**
+ * Resolve sibling-name conflicts surfaced by `audit slug-conflicts`.
+ *
+ * Strategy:
+ *   1. Run `audit slug-conflicts` to find groups of siblings sharing
+ *      a name (case-insensitive by default — match the audit).
+ *   2. For each group, pick the survivor per `--keep-rule`.
+ *   3. Resolve the losers via `--action`:
+ *        - `delete` — `deleteItem(permanently: true)` (default).
+ *        - `rename` — `renameItem({ name: oldName + suffix })`. The
+ *          suffix template defaults to `-{shortId}` so renamed items
+ *          stay traceable to their itemId.
+ *
+ * Notes:
+ *   - **Inbound refs.** Deletes turn refs into broken links — run
+ *     `audit broken-links list` after a delete pass. Renames preserve
+ *     inbound refs (the itemId doesn't change), but URLs depending on
+ *     the old slug break.
+ *   - The audit's report has no createdDate/updatedDate, so the
+ *     `oldest`/`newest` rules fall back to itemId-stable ordering. This
+ *     is deterministic across runs (so baselines stay valid) but isn't
+ *     literally creation-date sorted. Use `interactive` when the
+ *     decision matters per-item.
+ *   - With `--keep-rule interactive`, the command prompts per group.
+ *     Honors `s`/`skip` to leave a group untouched. Requires a TTY;
+ *     pass any other keep-rule when scripting.
+ */
+export declare const runCleanupSlugConflicts: (options: CleanupSlugConflictsOptions) => Promise<SlugConflictPurgeAction[]>;