dsh-config-manager 0.1.0

package/src/core/backup.ts

@@ -0,0 +1,212 @@
+/**
+ * Pre-import Snapshot（规范 §16/§27）：只保存本次导入将被修改的目标原值。
+ * 应用层事务的基础：所有补偿动作基于快照（rollback.ts 逆序执行）。
+ *
+ * 快照不保存 credential 值（DSH 永不回读值）——credential 条目只记 existed 标志，
+ * 回滚时 existed=true 的条目如实标记「值需人工补录」。
+ */
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import crypto from 'node:crypto';
+import { parseJsonSafe } from '../utils/json.ts';
+import { sha256Hex } from '../utils/hashing.ts';
+import type { SectionId } from '../schema/types.ts';
+import type {
+  ConfigAdapter, HostContext, ImportPlan, PlanItem, Snapshot,
+  SnapshotEntry, SnapshotStore, SnapshotTarget,
+} from './types.ts';
+
+/** 导入将实际写入的目标 kinds（这些项才需要快照） */
+const EXECUTABLE_KINDS = new Set(['Create', 'Update', 'Install', 'MissingSecret', 'MissingDependency']);
+
+/** 文件类分区的目标基准目录（相对 homeDir；pluginFiles 的 ref 已是完整相对路径） */
+const FILE_BASES: Partial<Record<SectionId, string>> = {
+  skills: 'skills',
+  agentPresets: '.agent-presets',
+  pluginFiles: '',
+  sessions: 'sessions',
+};
+
+/** 解析文件类目标的绝对路径（引擎通用快照与回滚共用） */
+export function resolveFileTarget(ctx: HostContext, adapter: SectionId, ref: string): string {
+  const base = FILE_BASES[adapter] ?? '';
+  return path.join(ctx.homeDir, base, ref);
+}
+
+export interface CreateSnapshotOptions {
+  ctx: HostContext;
+  plan: ImportPlan;
+  sourceZip: string;
+  store: SnapshotStore;
+  adapters: ConfigAdapter[];
+}
+
+/** 从计划中收集将被写入的 target（去重） */
+function collectTargets(plan: ImportPlan): SnapshotTarget[] {
+  const seen = new Set<string>();
+  const targets: SnapshotTarget[] = [];
+  for (const item of plan.items) {
+    if (!EXECUTABLE_KINDS.has(item.kind) || item.target === undefined) continue;
+    const key = `${item.target.adapter}\u0000${item.target.ref}`;
+    if (seen.has(key)) continue;
+    seen.add(key);
+    targets.push(item.target);
+  }
+  return targets;
+}
+
+/** 引擎通用快照（adapter 未实现 snapshot? 时兜底） */
+async function engineSnapshotEntry(ctx: HostContext, target: SnapshotTarget): Promise<SnapshotEntry> {
+  switch (target.adapter) {
+    case 'settings':
+    case 'ui':
+    case 'providers': {
+      try {
+        const info = await ctx.settings.describe(target.ref);
+        return { kind: 'settingsNamespace', adapter: target.adapter, ref: target.ref, before: info.value, revision: info.revision, existed: true };
+      } catch {
+        // 目标不存在该 namespace → 快照标记 existed:false（回滚时无法恢复「不存在」，如实处理）
+        return { kind: 'settingsNamespace', adapter: target.adapter, ref: target.ref, before: null, revision: 0, existed: false };
+      }
+    }
+    case 'credentialsStatus': {
+      const info = await ctx.credentials.describe(target.ref);
+      return { kind: 'credential', adapter: target.adapter, ref: target.ref, before: null, existed: info.configured };
+    }
+    case 'workspaces': {
+      const records = await ctx.workspace.listRecords();
+      const rec = records.find((r) => r.id === target.ref);
+      return { kind: 'workspaceRecord', adapter: target.adapter, ref: target.ref, before: rec ?? null };
+    }
+    case 'mcp':
+    case 'plugins':
+    case 'prompts': {
+      // patchLine：从组合 patch 文件读取原行（file 为必填的 file 字段约定为 'cordis.patch.yml'）
+      const file = 'cordis.patch.yml';
+      const lines = await ctx.patchFile.readPatchLines(file);
+      const line = lines.find((l) => l.lineId === target.ref);
+      return { kind: 'patchLine', adapter: target.adapter, ref: target.ref, before: line?.raw ?? null, existed: line !== undefined };
+    }
+    case 'skills':
+    case 'agentPresets':
+    case 'pluginFiles':
+    case 'sessions': {
+      const abs = resolveFileTarget(ctx, target.adapter, target.ref);
+      if (!(await ctx.fs.exists(abs))) {
+        return { kind: 'file', adapter: target.adapter, ref: target.ref, before: null, existed: false };
+      }
+      const data = await ctx.fs.readFile(abs);
+      // 文件字节不放进 SnapshotEntry（契约纯净），由 createSnapshot 收集进 blobs Map 统一落盘
+      return {
+        kind: 'file',
+        adapter: target.adapter,
+        ref: target.ref,
+        before: { contentHash: sha256Hex(data) },
+        existed: true,
+        copiedTo: `blobs/${crypto.randomUUID()}`,
+      };
+    }
+    default:
+      return { kind: 'settingsNamespace', adapter: target.adapter, ref: target.ref, before: null };
+  }
+}
+
+/**
+ * 生成并落盘快照：只覆盖将被写入的目标。
+ * 文件字节经 blobs Map 交给 store.save（SnapshotEntry 契约不含二进制）。
+ */
+export async function createSnapshot(opts: CreateSnapshotOptions): Promise<Snapshot> {
+  const { ctx, plan, sourceZip, store, adapters } = opts;
+  const targets = collectTargets(plan);
+
+  const entries: SnapshotEntry[] = [];
+  const blobs = new Map<string, Uint8Array>();
+
+  // 1) 有 adapter.snapshot? 的优先（adapter 更懂自己的数据）
+  const byAdapter = new Map<SectionId, SnapshotTarget[]>();
+  for (const t of targets) {
+    const list = byAdapter.get(t.adapter) ?? [];
+    list.push(t);
+    byAdapter.set(t.adapter, list);
+  }
+  for (const adapter of adapters) {
+    const adapterTargets = byAdapter.get(adapter.id);
+    if (!adapterTargets || adapterTargets.length === 0) continue;
+    if (adapter.snapshot) {
+      const adapterEntries = await adapter.snapshot(adapterTargets, ctx);
+      entries.push(...adapterEntries);
+      byAdapter.delete(adapter.id);
+    }
+  }
+
+  // 2) 引擎通用快照兜底
+  for (const [adapterId, remaining] of byAdapter) {
+    for (const target of remaining) {
+      const entry = await engineSnapshotEntry(ctx, target);
+      // 文件字节：文件类条目在引擎快照里读出内容 → blobs
+      if (entry.kind === 'file' && entry.copiedTo && entry.existed) {
+        const abs = resolveFileTarget(ctx, adapterId, target.ref);
+        blobs.set(entry.copiedTo, await ctx.fs.readFile(abs));
+      }
+      entries.push(entry);
+    }
+  }
+
+  const snapshot: Snapshot = {
+    id: crypto.randomUUID(),
+    createdAt: new Date().toISOString(),
+    sourceZip,
+    entries,
+  };
+  // file 条目登记 snapshotId，回滚读 blob 时定位快照目录
+  for (const entry of snapshot.entries) {
+    if (entry.kind === 'file') entry.snapshotId = snapshot.id;
+  }
+  await store.save(snapshot, blobs);
+  return snapshot;
+}
+
+/* ---------------- 默认文件快照存储 ---------------- */
+
+export interface FileSnapshotStoreOptions {
+  /** 快照根目录（宿主决定，如 ~/.dsh/dsh-config-manager/snapshots） */
+  dir: string;
+}
+
+/** 文件快照存储：<dir>/<id>/snapshot.json + <dir>/<id>/blobs/* */
+export class FileSnapshotStore implements SnapshotStore {
+  private readonly options: FileSnapshotStoreOptions;
+
+  constructor(options: FileSnapshotStoreOptions) {
+    this.options = options;
+  }
+
+  private snapshotDir(id: string): string {
+    return path.join(this.options.dir, id);
+  }
+
+  async save(snapshot: Snapshot, blobs: Map<string, Uint8Array> = new Map()): Promise<string> {
+    const dir = this.snapshotDir(snapshot.id);
+    await fs.mkdir(path.join(dir, 'blobs'), { recursive: true });
+    for (const [blobPath, data] of blobs) {
+      const target = path.join(dir, blobPath);
+      if (!target.startsWith(dir)) throw new Error(`快照 blob 路径越界: ${blobPath}`);
+      await fs.mkdir(path.dirname(target), { recursive: true });
+      await fs.writeFile(target, data);
+    }
+    await fs.writeFile(path.join(dir, 'snapshot.json'), JSON.stringify(snapshot, null, 2));
+    return snapshot.id;
+  }
+
+  async load(id: string): Promise<Snapshot> {
+    const raw = await fs.readFile(path.join(this.snapshotDir(id), 'snapshot.json'), 'utf8');
+    return parseJsonSafe(raw) as Snapshot;
+  }
+
+  async readBlob(id: string, blobPath: string): Promise<Uint8Array> {
+    const target = path.join(this.snapshotDir(id), blobPath);
+    const dir = this.options.dir;
+    if (!target.startsWith(dir)) throw new Error(`快照 blob 路径越界: ${blobPath}`);
+    return fs.readFile(target);
+  }
+}

package/src/core/exporter.ts

@@ -0,0 +1,246 @@
+/**
+ * Export 编排（规范 §1/§18/§21，设计 §4.4）：
+ *   adapter 收集各分区 → Secret 过滤 → manifest → checksum → ZIP。
+ *
+ * 安全不变量：
+ *  - Secret 值默认永不进入导出数据（结构化分区逐一过 SecretScanner）；
+ *  - includeSecrets=true 必须注入 EncryptionProvider（m4 实现），否则拒绝导出；
+ *  - 加密密码/秘密值绝不写入 manifest 与日志。
+ */
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { buildChecksums } from '../utils/hashing.ts';
+import { stringifyJsonSafe } from '../utils/json.ts';
+import { buildManifest, CHECKSUMS_FILE, MANIFEST_FILE, EXPORTER_NAME } from '../schema/manifest.ts';
+import { SECTION_JSON_PATHS, SECTION_FILE_PREFIXES, isFileSection } from '../schema/config.ts';
+import { writeZip } from '../utils/zip.ts';
+import type { Manifest, SectionId } from '../schema/types.ts';
+import type {
+  ConfigAdapter, EncryptionProvider, ExportOptions, ExportReport,
+  ExportSection, HostContext, SecretScanner, SensitiveHit,
+} from './types.ts';
+
+export interface ExporterOptions {
+  ctx: HostContext;
+  adapters: ConfigAdapter[];
+  /** Secret 扫描器；缺省用字段名黑名单剥离（m4 可注入强化版） */
+  scanner?: SecretScanner;
+  /** 加密提供者（m4 用 node:crypto 实现）；includeSecrets 时必填 */
+  encryption?: EncryptionProvider | null;
+  /** 插件自身版本（manifest.exporter.version） */
+  exporterVersion?: string;
+  now?: () => Date;
+}
+
+/** 缺省 SecretScanner：递归黑名单字段剥离（字段名大小写不敏感；二进制/Uint8Array 原样跳过） */
+export function defaultSecretScanner(): SecretScanner {
+  const SENSITIVE_FIELDS = [
+    'password', 'passwd', 'token', 'accesstoken', 'refreshtoken', 'apikey',
+    'secret', 'credential', 'authorization', 'cookie', 'privatekey', 'clientsecret',
+  ];
+  /** 仅存「引用名」而非值的字段（如 apiKeyEnv=DEEPSEEK_API_KEY 是环境变量名，不是秘密） */
+  const REFERENCE_FIELDS = new Set([
+    'apikeyenv', 'api_key_env', 'apikeyname', 'tokenenv', 'accesstokenenv',
+    'refreshtokenenv', 'clientsecretenv', 'passwordenv',
+  ]);
+  return {
+    scanAndRedact(data: unknown): { sanitized: unknown; hits: SensitiveHit[] } {
+      const hits: SensitiveHit[] = [];
+      const walk = (v: unknown, p: string): unknown => {
+        if (v === null || typeof v !== 'object') return v;
+        if (v instanceof Uint8Array) return v; // 二进制内容不按字段展开
+        if (Array.isArray(v)) return v.map((item, i) => walk(item, `${p}[${i}]`));
+        const out: Record<string, unknown> = {};
+        for (const [k, val] of Object.entries(v as Record<string, unknown>)) {
+          const lower = k.toLowerCase().replace(/[^a-z0-9]/g, '');
+          const isRefName = REFERENCE_FIELDS.has(lower);
+          const sensitive = !isRefName && SENSITIVE_FIELDS.some((f) => lower.includes(f));
+          if (sensitive && typeof val === 'string' && val !== '') {
+            hits.push({ path: p === '' ? k : `${p}.${k}`, field: k });
+            out[k] = ''; // 值剥离为空串（保留字段名与位置，供「需补录」提示）
+            continue;
+          }
+          out[k] = walk(val, p === '' ? k : `${p}.${k}`);
+        }
+        return out;
+      };
+      return { sanitized: walk(data, ''), hits };
+    },
+  };
+}
+
+export class Exporter {
+  private readonly ctx: HostContext;
+  private readonly adapters: ConfigAdapter[];
+  private readonly scanner: SecretScanner;
+  private readonly encryption: EncryptionProvider | null;
+  private readonly exporterVersion: string;
+  private readonly now: () => Date;
+
+  constructor(opts: ExporterOptions) {
+    this.ctx = opts.ctx;
+    this.adapters = opts.adapters;
+    this.scanner = opts.scanner ?? defaultSecretScanner();
+    this.encryption = opts.encryption ?? null;
+    this.exporterVersion = opts.exporterVersion ?? '0.1.0';
+    this.now = opts.now ?? (() => new Date());
+  }
+
+  /**
+   * 导出：收集 → 过滤 → checksum → manifest → ZIP。
+   * 返回 zipPath（含文件名）、manifest、报告。
+   */
+  async export(options: ExportOptions): Promise<{ zipPath: string; manifest: Manifest; report: ExportReport }> {
+    const { includeSecrets, only } = options;
+    if (includeSecrets && !this.encryption) {
+      throw new Error('导出包含秘密需要注入 EncryptionProvider（m4 实现），拒绝明文导出秘密');
+    }
+
+    // 1. 选定分区（only 过滤 + 默认包含）
+    const selected = this.adapters
+      .filter((a) => (only === undefined ? a.defaultIncluded : only.includes(a.id)))
+      .map((a) => a.id);
+
+    // 2. 逐 adapter 收集（导出数据）
+    const sections: ExportSection[] = [];
+    const warnings: string[] = [];
+    const redactedHits: SensitiveHit[] = [];
+    const included: ExportReport['included'] = [];
+    const excluded: SectionId[] = this.adapters.filter((a) => !selected.includes(a.id)).map((a) => a.id);
+
+    for (const adapter of this.adapters) {
+      if (!selected.includes(adapter.id)) continue;
+      let section: ExportSection;
+      try {
+        section = await adapter.export(this.ctx, options);
+      } catch (err) {
+        // 单个分区失败不拖垮整体（§34.17）；如实告警并跳过
+        warnings.push(`分区 ${adapter.id} 导出失败: ${err instanceof Error ? err.message : String(err)}`);
+        excluded.push(adapter.id);
+        continue;
+      }
+      // 3. Secret 过滤：结构化数据逐一过 scanner；
+      //    文件类分区（skills 等）内容为自由文本，扫描语义由 m4 强化，此处不动
+      let sanitized = section.data;
+      if (!isFileSection(adapter.id)) {
+        const scanned = this.scanner.scanAndRedact(section.data);
+        redactedHits.push(...scanned.hits);
+        sanitized = scanned.sanitized;
+      }
+      sections.push({ ...section, data: sanitized });
+      included.push({ section: adapter.id, counts: section.counts });
+      warnings.push(...section.warnings);
+    }
+
+    // 4. 组装 ZIP 条目（JSON 分区 + 文件类分区 + secrets.enc + checksums + manifest）
+    const entries: { name: string; data: Uint8Array }[] = [];
+    const sectionFlags = buildSectionFlags(sections);
+    let containsSecrets = false;
+    let encrypted = false;
+    let encryption: Manifest['security']['encryption'] = null;
+
+    for (const section of sections) {
+      if (isFileSection(section.sectionId)) {
+        const prefix = SECTION_FILE_PREFIXES[section.sectionId]!;
+        const files = (section.data as { files?: { relativePath: string; data: Uint8Array }[] }).files ?? [];
+        for (const file of files) {
+          entries.push({ name: `${prefix}${file.relativePath}`, data: file.data });
+        }
+        continue;
+      }
+      const jsonPath = SECTION_JSON_PATHS[section.sectionId];
+      if (jsonPath === undefined) continue;
+      entries.push({
+        name: jsonPath,
+        data: Buffer.from(stringifyJsonSafe(section.data, { space: 2 }), 'utf8'),
+      });
+    }
+
+    // secrets.enc：仅加密备份
+    if (includeSecrets && this.encryption) {
+      const credentialsFile = path.join(this.ctx.homeDir, '.credentials.yaml');
+      let plaintext: string;
+      try {
+        const raw = await this.ctx.fs.readFile(credentialsFile);
+        plaintext = Buffer.from(raw).toString('utf8');
+      } catch (err) {
+        warnings.push(`读取凭据文件失败，跳过秘密导出: ${err instanceof Error ? err.message : String(err)}`);
+        plaintext = '';
+      }
+      if (plaintext !== '') {
+        const result = await this.encryption.encrypt(plaintext);
+        entries.push({ name: 'security/secrets.enc', data: result.blob });
+        encryption = result.info;
+        containsSecrets = true;
+        encrypted = true;
+      }
+    }
+
+    // 5. checksums（覆盖除 manifest/checksums 外的全部条目）
+    const checksums = buildChecksums(entries);
+    entries.push({ name: CHECKSUMS_FILE, data: Buffer.from(stringifyJsonSafe(checksums, { space: 2 }), 'utf8') });
+
+    // 6. manifest（最后写：需要完整分区与安全信息）
+    const manifest = buildManifest({
+      exporterVersion: this.exporterVersion,
+      dshVersion: this.ctx.dshVersion,
+      platform: this.ctx.platform as Manifest['source']['platform'],
+      arch: this.ctx.arch,
+      sections: sectionFlags,
+      containsSecrets,
+      encrypted,
+      encryption,
+      exportedAt: this.now().toISOString(),
+    });
+    entries.push({ name: MANIFEST_FILE, data: Buffer.from(stringifyJsonSafe(manifest, { space: 2 }), 'utf8') });
+
+    // 7. 落盘
+    const outPath = options.outPath ?? defaultOutPath(this.now());
+    await writeZip(outPath, entries);
+    const stat = await fs.stat(outPath);
+
+    // 日志不泄值：只记分区与命中数量
+    this.ctx.log.info('导出完成', {
+      file: path.basename(outPath),
+      sizeBytes: stat.size,
+      sections: Object.keys(sectionFlags).filter((k) => sectionFlags[k as SectionId]),
+      redactedFields: redactedHits.length,
+      containsSecrets,
+      encrypted,
+    });
+
+    const report: ExportReport = {
+      included,
+      excluded,
+      security: {
+        secretsExcluded: !includeSecrets,
+        containsSecrets,
+        encrypted,
+        redactedHits: redactedHits.length,
+      },
+      file: { name: path.basename(outPath), sizeBytes: stat.size },
+      warnings,
+    };
+    return { zipPath: outPath, manifest, report };
+  }
+}
+
+/** 构建 manifest.sections 布尔表（只含实际导出分区） */
+function buildSectionFlags(sections: ExportSection[]): Manifest['sections'] {
+  const flags = {} as Manifest['sections'];
+  for (const id of Object.keys(SECTION_JSON_PATHS) as SectionId[]) flags[id] = false;
+  for (const id of Object.keys(SECTION_FILE_PREFIXES) as SectionId[]) flags[id] = false;
+  flags['secrets'] = false;
+  for (const section of sections) flags[section.sectionId] = true;
+  return flags;
+}
+
+function defaultOutPath(now: Date): string {
+  const y = now.getFullYear();
+  const m = String(now.getMonth() + 1).padStart(2, '0');
+  const d = String(now.getDate()).padStart(2, '0');
+  return `dsh-config-${y}-${m}-${d}.zip`;
+}
+
+/** 供报告使用：导出器身份（避免与 manifest 常量重复维护） */
+export const EXPORTER_INFO = { name: EXPORTER_NAME };

package/src/core/importer.ts

@@ -0,0 +1,66 @@
+/**
+ * Importer 门面：封装导入 14 步流程（规范 §9），委托 Analyzer 三段式。
+ *
+ *  1 选 ZIP → 2 校验 ZIP → 3 读 manifest → 4 完整性 → 5 schema → 6 兼容
+ *  → 7 扫描 → 8 ImportPlan → 9 Preview(Dry Run) → 10 用户确认
+ *  → 11 快照 → 12 执行 → 13 校验 → 14 结果（失败则回滚）
+ *
+ * 安全阀：executeImportPlan 必须显式 confirm，否则拒绝（ImportNotConfirmedError）。
+ * Dry Run：analyzeImport / createImportPlan 零写入（ZIP 全程内存解析，不进磁盘）。
+ */
+import type { ZipArchive, ZipSafetyLimits } from '../utils/zip.ts';
+import { Analyzer } from './analyzer.ts';
+import type {
+  ConfigAdapter, HostContext, ImportAnalysis, ImportDecisions, ImportPlan,
+  ImportResult, SnapshotStore,
+} from './types.ts';
+
+export interface ImporterOptions {
+  ctx: HostContext;
+  adapters: ConfigAdapter[];
+  snapshotStore: SnapshotStore;
+  limits?: ZipSafetyLimits;
+  /** 依赖存在性检查器（缺省不检查） */
+  dependencyChecker?: (command: string) => Promise<boolean>;
+  /** m4 可注入强化版 ZIP 安全解析 */
+  parseZipOverride?: (buf: Uint8Array, limits?: ZipSafetyLimits) => ZipArchive;
+}
+
+export interface ExecuteOptions {
+  /** 用户确认（UI 收集）；非 true 一律拒绝执行 */
+  confirm: boolean;
+  /** 用户补录的秘密值（仅内存） */
+  secretInputs?: Record<string, string>;
+  /** 加密备份解密结果（仅内存；解密必须经 m4 encryption provider） */
+  decryptedCredentials?: Map<string, string>;
+  /** 任一项失败立即整体回滚（默认 false：单项失败如实记录并继续其余项） */
+  rollbackOnError?: boolean;
+}
+
+export class Importer {
+  private readonly analyzer: Analyzer;
+
+  constructor(opts: ImporterOptions) {
+    this.analyzer = new Analyzer(opts);
+  }
+
+  /** 步骤 1-8 + 分析：只读，返回 ImportAnalysis（含兼容性/路径/依赖/秘密摘要） */
+  analyzeImport(zipPath: string): Promise<ImportAnalysis> {
+    return this.analyzer.analyzeImport(zipPath);
+  }
+
+  /** 步骤 9：Dry Run / Preview —— 合并用户冲突决策与路径映射，输出最终可执行计划（零写入） */
+  createImportPlan(zipPath: string, decisions: ImportDecisions): Promise<ImportPlan> {
+    return this.analyzer.createImportPlan(zipPath, decisions);
+  }
+
+  /** 步骤 10-14：确认 → 快照 → 执行 → 校验 → 结果；失败可整体回滚并如实报告 */
+  executeImportPlan(zipPath: string, plan: ImportPlan, opts: ExecuteOptions): Promise<ImportResult> {
+    return this.analyzer.executeImportPlan(zipPath, plan, {
+      confirm: opts.confirm,
+      secretInputs: opts.secretInputs,
+      decryptedCredentials: opts.decryptedCredentials,
+      rollbackOnError: opts.rollbackOnError,
+    });
+  }
+}

package/src/core/index.ts

@@ -0,0 +1,39 @@
+/**
+ * 核心引擎公共出口：m5（适配器）、m6（UI）、m7（测试）与宿主插件统一从这里引用。
+ */
+export {
+  Exporter, defaultSecretScanner, EXPORTER_INFO,
+  type ExporterOptions,
+} from './exporter.ts';
+export {
+  Importer, type ImporterOptions, type ExecuteOptions,
+} from './importer.ts';
+export {
+  Analyzer, type AnalyzerOptions,
+} from './analyzer.ts';
+export {
+  createSnapshot, FileSnapshotStore, resolveFileTarget,
+  type CreateSnapshotOptions, type FileSnapshotStoreOptions,
+} from './backup.ts';
+export { rollback, type RollbackOptions } from './rollback.ts';
+export {
+  computeCompatibility, describeCompatibility, describeSchemaStatus,
+  validateSections,
+} from './validator.ts';
+export {
+  ImportNotConfirmedError, ImportFailedError,
+} from './types.ts';
+export type * from './types.ts';
+
+/* —— 类型与工具的便捷重导出 —— */
+export type {
+  ExportOptions, ExportSection, ValidationResult, HostContext,
+  SettingsFacade, CredentialsFacade, PluginsFacade, WorkspaceFacade,
+  PatchFileFacade, FileSystemFacade, NamespaceInfo, PluginInfo,
+  ConfigAdapter, Portability, SecretScanner, SensitiveHit, EncryptionProvider,
+  PlanItem, PlanItemKind, ItemResolution, GlobalConflictStrategy,
+  ImportAnalysis, ImportDecisions, ImportPlan, ImportResult, ExecutedItem,
+  ImportContext, SnapshotTarget, SnapshotEntry, Snapshot, SnapshotStore,
+  RollbackReport, PathMapping, PathIssue, CompatibilityInput,
+  CompatibilityScore, ExportReport, ApplyResult, ConflictDecision,
+} from './types.ts';