@sitecoreai-labs/sitecoreai-cli 0.0.4 → 0.1.0

package/dist/hygiene/tasks/cleanup/slug-conflicts.js

@@ -0,0 +1,296 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runCleanupSlugConflicts = void 0;
+const node_readline_1 = __importDefault(require("node:readline"));
+const cli_tasks_1 = require("../../../shared/cli-tasks");
+const errors_1 = require("../../../shared/errors");
+const references_1 = require("../audit/references");
+const slug_conflicts_1 = require("../audit/slug-conflicts");
+const shared_1 = require("../shared");
+const pickByRule = (group, rule
+// The audit-side report doesn't carry createdDate/updatedDate. For
+// `oldest`/`newest` we fall back to itemId-stable ordering (smallest
+// itemId wins for `oldest`, largest for `newest`) — not perfect, but
+// deterministic across runs so baseline fingerprints stay stable.
+) => {
+    const sorted = [...group.members];
+    switch (rule) {
+        case "oldest":
+            sorted.sort((a, b) => a.itemId.localeCompare(b.itemId));
+            break;
+        case "newest":
+            sorted.sort((a, b) => b.itemId.localeCompare(a.itemId));
+            break;
+        case "shortest-path":
+            sorted.sort((a, b) => {
+                const lenDiff = a.path.length - b.path.length;
+                return lenDiff !== 0 ? lenDiff : a.path.localeCompare(b.path);
+            });
+            break;
+    }
+    return { kept: sorted[0], rest: sorted.slice(1) };
+};
+const promptForKeep = async (group) => {
+    const rl = node_readline_1.default.createInterface({ input: process.stdin, output: process.stdout });
+    try {
+        process.stdout.write(`\nSlug conflict at ${group.parentPath}/${group.slug}* — ${group.count} siblings:\n`);
+        group.members.forEach((m, i) => {
+            process.stdout.write(`  [${i + 1}] ${m.path}${m.language ? ` (${m.language})` : ""}${m.templateName ? ` [${m.templateName}]` : ""}\n`);
+        });
+        process.stdout.write(`  [s]kip group\nKeep which? [1-${group.members.length}/s]: `);
+        const answer = await new Promise((resolve) => rl.question("", (a) => resolve(a.trim().toLowerCase())));
+        if (answer === "s" || answer === "skip") {
+            // Skip = keep first, resolve none.
+            return { kept: group.members[0], rest: [] };
+        }
+        const idx = parseInt(answer, 10) - 1;
+        if (!Number.isFinite(idx) || idx < 0 || idx >= group.members.length) {
+            throw (0, errors_1.createScaiError)(`Invalid selection '${answer}' for group ${group.parentPath}/${group.slug}.`, "INPUT_INVALID");
+        }
+        return {
+            kept: group.members[idx],
+            rest: group.members.filter((_, i) => i !== idx),
+        };
+    }
+    finally {
+        rl.close();
+    }
+};
+const renderSuffix = (template, itemId) => {
+    const flat = itemId.replace(/[-{}]/g, "").toLowerCase();
+    const shortId = flat.slice(0, 8);
+    return template.replace(/\{shortId\}/g, shortId).replace(/\{full\}/g, flat);
+};
+/**
+ * Resolve sibling-name conflicts surfaced by `audit slug-conflicts`.
+ *
+ * Strategy:
+ *   1. Run `audit slug-conflicts` to find groups of siblings sharing
+ *      a name (case-insensitive by default — match the audit).
+ *   2. For each group, pick the survivor per `--keep-rule`.
+ *   3. Resolve the losers via `--action`:
+ *        - `delete` — `deleteItem(permanently: true)` (default).
+ *        - `rename` — `renameItem({ name: oldName + suffix })`. The
+ *          suffix template defaults to `-{shortId}` so renamed items
+ *          stay traceable to their itemId.
+ *
+ * Notes:
+ *   - **Inbound refs.** Deletes turn refs into broken links — run
+ *     `audit broken-links list` after a delete pass. Renames preserve
+ *     inbound refs (the itemId doesn't change), but URLs depending on
+ *     the old slug break.
+ *   - The audit's report has no createdDate/updatedDate, so the
+ *     `oldest`/`newest` rules fall back to itemId-stable ordering. This
+ *     is deterministic across runs (so baselines stay valid) but isn't
+ *     literally creation-date sorted. Use `interactive` when the
+ *     decision matters per-item.
+ *   - With `--keep-rule interactive`, the command prompts per group.
+ *     Honors `s`/`skip` to leave a group untouched. Requires a TTY;
+ *     pass any other keep-rule when scripting.
+ */
+const runCleanupSlugConflicts = async (options) => {
+    const logger = (0, shared_1.toLogger)(options);
+    const keepRule = options.keepRule ?? "oldest";
+    const action = options.action ?? "delete";
+    const suffixTemplate = options.renameSuffix ?? "-{shortId}";
+    if (keepRule === "interactive") {
+        if (!process.stdin.isTTY || options.nonInteractive) {
+            throw (0, errors_1.createScaiError)("--keep-rule interactive requires a TTY (cannot run with --non-interactive or piped stdin).", "INPUT_INVALID", { hint: "Pass --keep-rule oldest|newest|shortest-path for CI / agent use." });
+        }
+    }
+    const { envName, root: rootConfig, client } = (0, shared_1.resolveTenant)(options);
+    if (!options.whatIf) {
+        (0, shared_1.ensureAllowWriteForCleanup)(rootConfig, envName, options.allowWrite);
+    }
+    else if (!logger.isJson()) {
+        logger.info("What-if mode active — no items will be deleted or renamed.", "yellow");
+    }
+    // Reuse audit to find groups. Pass through scan-shaping options so
+    // the cleanup respects the same scope the operator audited with.
+    const groups = await (0, slug_conflicts_1.runAuditSlugConflicts)({
+        ...options,
+        json: true,
+        quiet: true,
+    });
+    const plans = [];
+    for (const group of groups) {
+        const selection = keepRule === "interactive" ? await promptForKeep(group) : pickByRule(group, keepRule);
+        plans.push({ group, selection });
+    }
+    // Phase 2 (optional): inbound-ref check per loser. The audit's cache
+    // (`cache: true`) shares field reads across scans, so the cost is
+    // amortized when multiple losers live under the same content root.
+    // Strip `output`/`format` from the forwarded options so the audit
+    // doesn't try to write to the cleanup's output target.
+    const refCounts = new Map();
+    if (options.checkRefs) {
+        const losers = plans.flatMap((p) => p.selection.rest);
+        const refOptions = {
+            ...options,
+            output: undefined,
+            format: undefined,
+            json: true,
+            quiet: true,
+            cache: true,
+            root: options.refCheckRoot ?? "/sitecore",
+        };
+        await (0, cli_tasks_1.mapWithConcurrency)(losers, async (m) => {
+            const refs = await (0, references_1.runAuditReferences)({
+                ...refOptions,
+                to: (0, shared_1.dashifyItemId)(m.itemId),
+            });
+            refCounts.set(m.itemId, refs.length);
+        }, options.concurrency ?? 4);
+        if (!options.whatIf) {
+            const blockers = losers
+                .map((m) => ({ ...m, refs: refCounts.get(m.itemId) ?? 0 }))
+                .filter((m) => m.refs > 0);
+            if (blockers.length > 0) {
+                const summary = blockers
+                    .slice(0, 5)
+                    .map((b) => `  ${b.path} (${b.refs} ref${b.refs === 1 ? "" : "s"})`)
+                    .join("\n");
+                const more = blockers.length > 5 ? `\n  ...and ${blockers.length - 5} more` : "";
+                throw (0, errors_1.createScaiError)(`--check-refs gate: ${blockers.length} loser${blockers.length === 1 ? " has" : "s have"} inbound references. Resolve refs first or re-run without --check-refs:\n${summary}${more}`, "INPUT_INVALID");
+            }
+        }
+    }
+    // Phase 3: resolve (delete or rename) per group.
+    const actions = [];
+    for (const { group, selection } of plans) {
+        const actionRecord = {
+            parentPath: group.parentPath,
+            slug: group.slug,
+            kept: { itemId: selection.kept.itemId, path: selection.kept.path },
+            resolved: [],
+        };
+        const results = await (0, cli_tasks_1.mapWithConcurrency)(selection.rest, async (m) => {
+            // Attach the optional inbound-ref count built during phase 2.
+            // Omitted (undefined) when --check-refs wasn't passed.
+            const refField = options.checkRefs ? { inboundRefs: refCounts.get(m.itemId) ?? 0 } : {};
+            if (action === "rename") {
+                const newName = m.name + renderSuffix(suffixTemplate, m.itemId);
+                if (newName === m.name) {
+                    return {
+                        itemId: m.itemId,
+                        path: m.path,
+                        action,
+                        newName,
+                        ...refField,
+                        status: "failed",
+                        error: "rename suffix produced an unchanged name; pick a different --rename-suffix",
+                    };
+                }
+                if (options.whatIf) {
+                    return {
+                        itemId: m.itemId,
+                        path: m.path,
+                        action,
+                        newName,
+                        ...refField,
+                        status: "what-if",
+                    };
+                }
+                try {
+                    await client.renameItem({
+                        itemId: (0, shared_1.dashifyItemId)(m.itemId),
+                        name: newName,
+                    });
+                    return {
+                        itemId: m.itemId,
+                        path: m.path,
+                        action,
+                        newName,
+                        ...refField,
+                        status: "applied",
+                    };
+                }
+                catch (error) {
+                    return {
+                        itemId: m.itemId,
+                        path: m.path,
+                        action,
+                        newName,
+                        ...refField,
+                        status: "failed",
+                        error: error instanceof Error ? error.message : String(error),
+                    };
+                }
+            }
+            // action === "delete"
+            if (options.whatIf) {
+                return {
+                    itemId: m.itemId,
+                    path: m.path,
+                    action,
+                    ...refField,
+                    status: "what-if",
+                };
+            }
+            try {
+                await client.deleteItem({
+                    itemId: (0, shared_1.dashifyItemId)(m.itemId),
+                    permanently: true,
+                });
+                return {
+                    itemId: m.itemId,
+                    path: m.path,
+                    action,
+                    ...refField,
+                    status: "applied",
+                };
+            }
+            catch (error) {
+                return {
+                    itemId: m.itemId,
+                    path: m.path,
+                    action,
+                    ...refField,
+                    status: "failed",
+                    error: error instanceof Error ? error.message : String(error),
+                };
+            }
+        }, options.concurrency ?? 4);
+        actionRecord.resolved = results;
+        actions.push(actionRecord);
+    }
+    const totalApplied = actions.reduce((n, a) => n + a.resolved.filter((r) => r.status === "applied").length, 0);
+    const totalFailed = actions.reduce((n, a) => n + a.resolved.filter((r) => r.status === "failed").length, 0);
+    const totalPlanned = actions.reduce((n, a) => n + a.resolved.length, 0);
+    const verb = action === "rename" ? "rename" : "delete";
+    const verbPast = action === "rename" ? "Renamed" : "Deleted";
+    const summary = options.whatIf
+        ? `Plan: would ${verb} ${totalPlanned} sibling${totalPlanned === 1 ? "" : "s"} across ${actions.length} slug-conflict group${actions.length === 1 ? "" : "s"} (keep-rule: ${keepRule}).`
+        : `${verbPast} ${totalApplied} sibling${totalApplied === 1 ? "" : "s"} across ${actions.length} slug-conflict group${actions.length === 1 ? "" : "s"} (keep-rule: ${keepRule})${totalFailed > 0 ? `; ${totalFailed} failed` : ""}.`;
+    (0, shared_1.printReport)({
+        logger,
+        command: "cleanup.slug-conflicts.purge",
+        envName,
+        results: actions,
+        summary,
+        formatLine: (a) => `${a.parentPath}/${a.slug}* keep ${a.kept.path}; ${a.resolved
+            .map((r) => {
+            const tag = r.status === "applied" ? "" : `[${r.status}] `;
+            const target = r.action === "rename" ? `${r.path} → ${r.newName}` : r.path;
+            const refs = r.inboundRefs !== undefined ? ` [${r.inboundRefs} refs]` : "";
+            return `${tag}${target}${refs}`;
+        })
+            .join(", ")}`,
+        extra: {
+            keepRule,
+            action,
+            renameSuffix: action === "rename" ? suffixTemplate : undefined,
+            whatIf: Boolean(options.whatIf),
+            checkRefs: Boolean(options.checkRefs),
+            groupCount: actions.length,
+            appliedCount: totalApplied,
+            failedCount: totalFailed,
+        },
+        options,
+    });
+    return actions;
+};
+exports.runCleanupSlugConflicts = runCleanupSlugConflicts;

package/dist/hygiene/tasks/cleanup/subtree-prune.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Per-field-type pruners for `cleanup subtree --orphan-external-refs prune`.
+ *
+ * Each pruner inspects the field value, decides whether it can handle
+ * the shape, and returns the pruned value with target references
+ * surgically removed (preserving sibling entries). Returning `null`
+ * means "this isn't my shape" — caller tries the next pruner.
+ *
+ * Order of attempts in the caller is renderings-XML first (most
+ * specific) then multi-list (catches pipe-separated GUID lists). If
+ * none match, the field is a single-value reference and we fall back
+ * to clearing it entirely.
+ */
+/**
+ * Remove every target id from a pipe-separated GUID list, preserving
+ * the formatting (curly-uppercase vs bare-lowercase) of the surviving
+ * entries. Returns the pruned list or `null` if the value isn't a
+ * multi-list.
+ */
+export declare const pruneMultiList: (value: string, targetIds: ReadonlySet<string>) => string | null;
+/**
+ * Remove every `<r ... />` element whose `id`/`s:id` (rendering item)
+ * or `ds`/`s:ds` (datasource item) attribute references a target id.
+ * Other renderings stay in their original placeholder; the outer
+ * `<r>...<d>...</d></r>` wrapper is preserved even when every inner
+ * rendering is removed (callers can post-process empty layouts if
+ * needed).
+ *
+ * Pattern-based parser: each inner rendering is a self-closing `<r
+ * attr="value" attr="value" />` element. The outer wrapper `<r ` is
+ * followed by namespace declarations / `xmlns`, never by a `/`, so the
+ * self-closing-only regex never touches it.
+ */
+export declare const pruneRenderingsXml: (value: string, targetIds: ReadonlySet<string>) => string | null;
+/**
+ * Try every pruner in priority order; return the first successful
+ * prune. Falls through to `null` when no pruner matches — the caller
+ * should treat that as "single-value field; clearing is the prune."
+ */
+export declare const pruneFieldValue: (value: string, targetIds: ReadonlySet<string>) => string | null;

package/dist/hygiene/tasks/cleanup/subtree-prune.js

@@ -0,0 +1,113 @@
+"use strict";
+/**
+ * Per-field-type pruners for `cleanup subtree --orphan-external-refs prune`.
+ *
+ * Each pruner inspects the field value, decides whether it can handle
+ * the shape, and returns the pruned value with target references
+ * surgically removed (preserving sibling entries). Returning `null`
+ * means "this isn't my shape" — caller tries the next pruner.
+ *
+ * Order of attempts in the caller is renderings-XML first (most
+ * specific) then multi-list (catches pipe-separated GUID lists). If
+ * none match, the field is a single-value reference and we fall back
+ * to clearing it entirely.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.pruneFieldValue = exports.pruneRenderingsXml = exports.pruneMultiList = void 0;
+const normalize = (raw) => raw.toLowerCase().replace(/[{}-]/g, "");
+const isRenderingsXml = (value) => {
+    const trimmed = value.trimStart();
+    // Sitecore layout always starts with the outer `<r ` element, either
+    // canonical (`<r xmlns:xsd=…`) or delta (`<r xmlns:p="p" …`). A bare
+    // `<r>` with no attributes is the empty-renderings form some tenants
+    // emit; accept that too.
+    return trimmed.startsWith("<r ") || trimmed.startsWith("<r>");
+};
+/**
+ * Detect a pipe-separated GUID list (multi-list, treelist, single
+ * multi-link). Returns false on values that contain a pipe but aren't
+ * GUID-shaped (rare custom delimited fields). Empty strings are not
+ * multi-lists — the caller's no-op path handles them.
+ */
+const isMultiList = (value) => {
+    if (!value.includes("|") && !/^\s*\{?[0-9a-f-]{32,}\}?\s*$/i.test(value))
+        return false;
+    const parts = value
+        .split("|")
+        .map((p) => p.trim())
+        .filter((p) => p.length > 0);
+    if (parts.length === 0)
+        return false;
+    // Every part must be GUID-shaped (with or without curly braces /
+    // dashes). Reject if any token has whitespace or non-hex chars.
+    return parts.every((p) => /^\{?[0-9a-f]{8}-?[0-9a-f]{4}-?[0-9a-f]{4}-?[0-9a-f]{4}-?[0-9a-f]{12}\}?$/i.test(p));
+};
+/**
+ * Remove every target id from a pipe-separated GUID list, preserving
+ * the formatting (curly-uppercase vs bare-lowercase) of the surviving
+ * entries. Returns the pruned list or `null` if the value isn't a
+ * multi-list.
+ */
+const pruneMultiList = (value, targetIds) => {
+    if (!isMultiList(value))
+        return null;
+    const remaining = value
+        .split("|")
+        .map((p) => p.trim())
+        .filter((p) => p.length > 0 && !targetIds.has(normalize(p)));
+    return remaining.join("|");
+};
+exports.pruneMultiList = pruneMultiList;
+/**
+ * Remove every `<r ... />` element whose `id`/`s:id` (rendering item)
+ * or `ds`/`s:ds` (datasource item) attribute references a target id.
+ * Other renderings stay in their original placeholder; the outer
+ * `<r>...<d>...</d></r>` wrapper is preserved even when every inner
+ * rendering is removed (callers can post-process empty layouts if
+ * needed).
+ *
+ * Pattern-based parser: each inner rendering is a self-closing `<r
+ * attr="value" attr="value" />` element. The outer wrapper `<r ` is
+ * followed by namespace declarations / `xmlns`, never by a `/`, so the
+ * self-closing-only regex never touches it.
+ */
+const pruneRenderingsXml = (value, targetIds) => {
+    if (!isRenderingsXml(value))
+        return null;
+    return value.replace(/<r ([^>]*?)\/>/g, (match, attrs) => {
+        // Match both canonical (`id="…"`, `ds="…"`) and SXA delta
+        // (`s:id="…"`, `s:ds="…"`) attribute forms. The dotall-friendly
+        // `\s` covers tabs and newlines authors sometimes paste in.
+        const idMatch = /(?:^|\s)(?:s:)?id="([^"]+)"/i.exec(attrs);
+        const dsMatch = /(?:^|\s)(?:s:)?ds="([^"]+)"/i.exec(attrs);
+        const hit = (val) => {
+            if (!val)
+                return false;
+            // The `ds` attribute can hold a path sentinel (`local:slot`) or
+            // a content-tree path in some SXA configs — not a GUID. Skip
+            // non-GUID values; we only match by id.
+            if (!/^\{?[0-9a-f]{8}-?[0-9a-f]{4}-?[0-9a-f]{4}-?[0-9a-f]{4}-?[0-9a-f]{12}\}?$/i.test(val))
+                return false;
+            return targetIds.has(normalize(val));
+        };
+        if (hit(idMatch?.[1]) || hit(dsMatch?.[1]))
+            return "";
+        return match;
+    });
+};
+exports.pruneRenderingsXml = pruneRenderingsXml;
+/**
+ * Try every pruner in priority order; return the first successful
+ * prune. Falls through to `null` when no pruner matches — the caller
+ * should treat that as "single-value field; clearing is the prune."
+ */
+const pruneFieldValue = (value, targetIds) => {
+    const xmlPruned = (0, exports.pruneRenderingsXml)(value, targetIds);
+    if (xmlPruned !== null)
+        return xmlPruned;
+    const listPruned = (0, exports.pruneMultiList)(value, targetIds);
+    if (listPruned !== null)
+        return listPruned;
+    return null;
+};
+exports.pruneFieldValue = pruneFieldValue;

package/dist/hygiene/tasks/cleanup/subtree.d.ts

@@ -0,0 +1,123 @@
+import { type HygieneCommonOptions } from "../shared";
+import { type ReferenceKind } from "../reference-kind";
+/** Policy for handling external inbound references to the subtree. */
+export type OrphanExternalRefsPolicy = 
+/**
+ * Empty the entire referring field. Cheap and correct for single-value
+ * fields (droplists, single-link). Blunt for multi-value fields:
+ * a treelist or multi-list field carrying ten GUIDs would lose all
+ * ten, not just the one targeting the subtree.
+ */
+"clear"
+/**
+ * Surgical removal — preserve sibling entries in multi-value fields.
+ * Dispatches by field-value shape: `__Renderings`-style XML drops
+ * just the `<r ... />` elements pointing at the subtree; pipe-
+ * separated multi-list / treelist fields drop just the offending
+ * GUIDs. Single-value fields with no shape to preserve fall through
+ * to a clear (empty-string write).
+ */
+ | "prune"
+/**
+ * Delete the subtree and do nothing to external referrers — accept
+ * dangling refs as a tradeoff for speed. Skips the inbound-reference
+ * scan entirely (fastest mode). Operator is expected to run `audit
+ * broken-links` after the fact to find and triage the dangling refs.
+ */
+ | "leave";
+export interface CleanupSubtreeOptions extends HygieneCommonOptions {
+    /** Required. Root path of the subtree to delete. */
+    path?: string;
+    /**
+     * Content root to scan for inbound references. Default `/sitecore` —
+     * the entire CMS, so refs from any root are caught. Narrow to
+     * `/sitecore/content` etc. for faster runs at the cost of missing
+     * refs from outside that root.
+     */
+    scanRoot?: string;
+    /**
+     * What to do when external items have field values referencing items
+     * inside the subtree. Default: refuse (hard-block) and print the
+     * blockers. With `clear`, the audit clears those field values before
+     * walking the deletion bottom-up.
+     */
+    orphanExternalRefs?: OrphanExternalRefsPolicy;
+    /**
+     * Permit operating on protected platform subtrees. Off by default —
+     * `/sitecore/system`, `/sitecore/templates/System`, `/sitecore/layout/Layouts/System`,
+     * and the Recycle Bin are all refused without `--force`.
+     */
+    force?: boolean;
+    /** Hard cap on items deleted. Default 1000. Protects against runaway scope. */
+    maxDeletions?: number;
+    whatIf?: boolean;
+    allowWrite?: boolean;
+    index?: string;
+    concurrency?: number;
+    pageParallelism?: number;
+    batchSize?: number;
+    cache?: boolean;
+    limit?: number;
+    /** Restrict the inbound-ref scan to these field names. */
+    fields?: string[];
+}
+export interface InboundBlocker {
+    /** Item that holds the referencing field — outside the subtree. */
+    referrerItemId: string;
+    referrerPath: string;
+    referrerTemplateName: string | null;
+    fieldName: string;
+    /**
+     * Structured reference category derived from `fieldName`. Lets the
+     * operator distinguish "base-template inheritance" (catastrophic —
+     * orphans every inheritor's fields) from "field-value" (recoverable
+     * — clear the field, refs go away). See
+     * [./reference-kind](./reference-kind.ts) for the mapping table.
+     */
+    referenceKind: ReferenceKind;
+    /** Item inside the subtree the field value references. */
+    targetItemId: string;
+    /**
+     * The field's value at scan time. Captured so `prune` can compute
+     * surgical removals without a re-read; `clear` ignores it.
+     */
+    fieldValue?: string;
+    /**
+     * Whether the referring field was successfully written (cleared OR
+     * pruned) in apply mode. Stays undefined in what-if mode and on
+     * update failures. Name kept for back-compat with the v1.1 API.
+     */
+    cleared?: boolean;
+}
+export interface SubtreeDeletion {
+    itemId: string;
+    path: string;
+    status: "deleted" | "what-if" | "failed";
+    error?: string;
+}
+export interface CleanupSubtreeResult {
+    blockers: InboundBlocker[];
+    deletions: SubtreeDeletion[];
+    /** What this run was — useful for downstream tooling. */
+    policy: OrphanExternalRefsPolicy | "block";
+    whatIf: boolean;
+}
+/**
+ * Bottom-up cascade delete of a Sitecore subtree.
+ *
+ * Steps:
+ *   1. Resolve `--path` to an itemId; refuse protected roots.
+ *   2. Enumerate the subtree via `_path CONTAINS <rootItemId>` and
+ *      sort path-length-descending so leaves delete before their
+ *      parents.
+ *   3. Scan `--scan-root` (default `/sitecore`) for items outside the
+ *      subtree whose field values reference any item inside.
+ *   4. Hard-block by default. With `--orphan-external-refs clear`,
+ *      empty each referring field, then proceed.
+ *   5. Walk the deletion list and delete each item.
+ *
+ * Safety rails match the rest of `scai hygiene cleanup`: `--what-if` for
+ * plan-only mode, `--allow-write` enforced outside what-if,
+ * `--max-deletions` blast-radius cap.
+ */
+export declare const runCleanupSubtree: (options: CleanupSubtreeOptions) => Promise<CleanupSubtreeResult>;