sf-plugin-cms 0.3.1 → 0.5.0

package/lib/services/import-workspace.js

@@ -3,8 +3,17 @@ import { lstat, mkdir, open, readFile, readdir, realpath } from 'node:fs/promise
 import path from 'node:path';
 import { cleanupOwnedPath, replaceFileByAtomicRename, } from './atomic-publish.js';
 import { CmsRequestError } from '../transport/json-request.js';
-import { assertWorkspaceExportManifest, } from '../contracts/workspace-export.js';
+import { assertWorkspaceExportManifest, UnsupportedWorkspacePackageVersionError, } from '../contracts/workspace-export.js';
 import { getContent } from './read.js';
+import { variantIdentity } from './variant-identity.js';
+import { inventoryExportReferences } from './export-references.js';
+import { planImportIdentities, planNativeCopies, } from './import-identities.js';
+import { planEmailFragmentCopies } from './email-fragment.js';
+import { planWebFragmentCopies, validateDataGraphPrerequisites, } from './web-fragment.js';
+import { planLandingPageTemplateCopies, validateLandingPageTemplatePrerequisites, } from './landing-page-template.js';
+import { planLandingPageCopies, validateLandingPagePrerequisites } from './landing-page.js';
+import { loadEditableRawHtml } from './editable-raw-html-import.js';
+import { isDeepStrictEqual } from 'node:util';
 import { createContent, createVariant, } from './write.js';
 export class WorkspaceImportOwnershipUncertainError extends Error {
     operation;
@@ -93,7 +102,13 @@ async function assertRegularFile(file, label) {
         throw new TypeError(`${label} must be a regular file and not a symlink or reparse point`);
     }
 }
-async function readStableRegularFile(file, label) {
+/**
+ * Read a regular file while detecting observed replacement or modification.
+ * @param {string} file - Absolute file path.
+ * @param {string} label - Error context.
+ * @returns {Promise<Buffer>} Original file bytes.
+ */
+export async function readStableRegularFile(file, label) {
     await assertRegularFile(file, label);
     const before = await lstat(file);
     const bytes = await readFile(file);
@@ -103,7 +118,13 @@ async function readStableRegularFile(file, label) {
     }
     return bytes;
 }
-async function enumeratePackageFiles(directory, packageRoot) {
+/**
+ * Enumerate regular package files without following symlinks.
+ * @param {string} directory - Directory to inspect.
+ * @param {string} packageRoot - Root for relative paths.
+ * @returns {Promise<string[]>} Sorted portable relative filenames.
+ */
+export async function enumeratePackageFiles(directory, packageRoot) {
     const files = [];
     for (const entry of await readdir(directory, { withFileTypes: true })) {
         const absolute = path.join(directory, entry.name);
@@ -123,12 +144,24 @@ async function enumeratePackageFiles(directory, packageRoot) {
     }
     return files.toSorted();
 }
-function validateItem(value, variantId, workspaceId) {
-    if (!isRecord(value))
+function validateItem(raw, variantId, workspaceId) {
+    if (!isRecord(raw))
         throw new TypeError(`Item ${variantId} must contain an object`);
-    assertIdentifier(value.id, `Item ${variantId}.id`);
-    if (value.id !== variantId)
-        throw new TypeError(`Item ${variantId} does not match its manifest variant ID`);
+    const identity = variantIdentity(raw, variantId);
+    assertIdentifier(identity.variantId, `Item ${variantId}.id`);
+    // Normalize only the in-memory import view after raw-byte integrity verification.
+    const normalized = { ...raw, id: identity.variantId };
+    if (isRecord(normalized.contentType)) {
+        if (Object.keys(normalized.contentType).some((key) => key !== 'fullyQualifiedName' && key !== 'name')) {
+            throw new TypeError(`Item ${variantId}.contentType contains unsupported summary fields`);
+        }
+        normalized.contentType = normalized.contentType.fullyQualifiedName;
+    }
+    if (normalized.externalId === null)
+        delete normalized.externalId;
+    if (normalized.externalSource === null)
+        delete normalized.externalSource;
+    const value = normalized;
     for (const key of ['contentKey', 'language', 'contentType', 'title']) {
         if (!nonemptyString(value[key]))
             throw new TypeError(`Item ${variantId}.${key} is required`);
@@ -158,7 +191,20 @@ function validateRelationships(items) {
     const pairIds = new Map();
     const keyToApiName = new Map();
     const apiNameToKey = new Map();
+    const contentIdToKey = new Map();
+    const keyToContentId = new Map();
     for (const item of items) {
+        const { contentId } = variantIdentity(item, item.id);
+        if (contentId !== undefined) {
+            const priorKey = contentIdToKey.get(contentId);
+            const priorId = keyToContentId.get(item.contentKey);
+            if ((priorKey !== undefined && priorKey !== item.contentKey) ||
+                (priorId !== undefined && priorId !== contentId)) {
+                throw new TypeError('Content keys have conflicting parent content identities');
+            }
+            contentIdToKey.set(contentId, item.contentKey);
+            keyToContentId.set(item.contentKey, contentId);
+        }
         const pair = `${item.contentKey}\u0000${item.language}`;
         if (pairIds.has(pair)) {
             throw new TypeError(`Duplicate contentKey/language mapping: ${item.contentKey}/${item.language}`);
@@ -191,6 +237,9 @@ export async function loadWorkspaceExport(sourceDirectory, options = {}) {
     const manifestValue = parseJson(manifestBytes, 'manifest.json');
     assertWorkspaceExportManifest(manifestValue);
     const manifest = manifestValue;
+    if (options.profile === 'image' && manifest.schemaVersion !== 2) {
+        throw new UnsupportedWorkspacePackageVersionError('Image import profile requires workspace package manifest version 2');
+    }
     const packageFiles = await enumeratePackageFiles(canonicalSource, canonicalSource);
     const expectedFiles = [
         'manifest.json',
@@ -200,6 +249,19 @@ export async function loadWorkspaceExport(sourceDirectory, options = {}) {
         throw new TypeError('Workspace package contains missing, substituted, or unlisted regular files');
     }
     const manifestItems = new Map(manifest.items.map((item_) => [item_.path, item_]));
+    for (const [index, declared] of manifest.items.entries()) {
+        const segments = declared.path.split('/');
+        const file = path.join(canonicalSource, ...segments);
+        const normalized = path.normalize(file);
+        if (!normalized.startsWith(`${canonicalSource}${path.sep}`)) {
+            throw new TypeError(`manifest.items[${index}].path escapes the source directory`);
+        }
+        const bytes = await readStableRegularFile(file, `Manifest item ${declared.path}`);
+        const actualSha256 = createHash('sha256').update(bytes).digest('hex');
+        if (actualSha256 !== declared.sha256) {
+            throw new TypeError(`Manifest item ${declared.path} failed SHA-256 verification`);
+        }
+    }
     const seenFiles = new Set();
     const seenIds = new Set();
     const items = [];
@@ -374,6 +436,81 @@ function variantPayload(item, contentKey) {
 function isProvenNotFound(error) {
     return (error instanceof CmsRequestError && error.operationKey === 'content.get' && error.status === 404);
 }
+function assertTransportableBody(value) {
+    if (Array.isArray(value)) {
+        for (const child of value)
+            assertTransportableBody(child);
+        return;
+    }
+    if (!isRecord(value))
+        return;
+    if ('ref' in value ||
+        value.type === 'file' ||
+        (typeof value.type === 'string' && value.type.endsWith('Reference'))) {
+        throw new TypeError('Unresolved content reference or media transport; import is blocked');
+    }
+    for (const child of Object.values(value))
+        assertTransportableBody(child);
+}
+function selectedLandingPageTemplateReferences(source, selectedItems) {
+    const selectedIds = new Set(selectedItems.map(({ id }) => id));
+    return source.manifest.externalReferences.filter((reference) => reference.kind !== 'cms.relationship' || !selectedIds.has(reference.source.sourceId));
+}
+function selectedNativeReferences(source, selectedItems) {
+    const selectedIds = new Set(selectedItems.map(({ id }) => id));
+    const inventory = inventoryExportReferences(source.manifest.workspaceId, 
+    // The inventory only reads JSON; its transport type uses mutable array annotations.
+    new Map(source.items.map((item) => [item.id, item])));
+    const evidenced = new Map(inventory.externalReferences
+        .filter(({ kind }) => kind === 'cms.relationship')
+        .map((reference) => [reference.referenceId, reference]));
+    return source.manifest.externalReferences.filter((reference) => {
+        // Only the exporter-proven variant-owned relationship shape can be excluded.
+        // Unknown kinds, mismatched identities and contradictory associations fail closed.
+        const ownerId = reference.source.sourceId;
+        if (selectedIds.has(ownerId) ||
+            !isDeepStrictEqual(reference, evidenced.get(reference.referenceId)))
+            return true;
+        const ownerEntry = source.manifest.entries.find(({ variantId }) => variantId === ownerId);
+        return (ownerEntry === undefined ||
+            source.manifest.items.some((item) => item.referenceId === reference.referenceId && item.path !== ownerEntry.file));
+    });
+}
+function preflightReferences(plan, references = plan.source.manifest.externalReferences, allowValidatedStructuredReferences = false) {
+    if (references.some((reference) => reference.required && reference.resolution !== 'included') ||
+        plan.source.manifest.dependencies.length > 0) {
+        throw new TypeError('Unresolved required package reference; import is blocked');
+    }
+    const urls = new Set();
+    for (const group of plan.groups) {
+        if (new Set([group.primary, ...group.variants].map((item) => item.contentType)).size !== 1) {
+            throw new TypeError('Parent variants have conflicting content types');
+        }
+        for (const item of [group.primary, ...group.variants]) {
+            if ('references' in item ||
+                'referencesList' in item ||
+                item.contentType === 'sfdc_cms__image' ||
+                item.contentType === 'sfdc_cms__doc') {
+                throw new TypeError('Unresolved content reference or media transport; import is blocked');
+            }
+            if (!allowValidatedStructuredReferences)
+                assertTransportableBody(item.contentBody);
+            if (item.externalSource !== undefined)
+                assertTransportableBody(item.externalSource);
+            const bodyUrl = item.contentBody['sfdc_cms:urlName'];
+            if (bodyUrl !== undefined &&
+                (typeof bodyUrl !== 'string' || (item.urlName !== undefined && item.urlName !== bodyUrl))) {
+                throw new TypeError('Conflicting body and variant URL names');
+            }
+            const url = item.urlName ?? bodyUrl;
+            if (typeof url === 'string') {
+                if (urls.has(url))
+                    throw new TypeError('Target URL names must be unique across variants');
+                urls.add(url);
+            }
+        }
+    }
+}
 async function preflightConflicts(connection, plan, requestOptions) {
     for (const group of plan.groups) {
         try {
@@ -387,6 +524,20 @@ async function preflightConflicts(connection, plan, requestOptions) {
         }
     }
 }
+function soqlString(value) {
+    return `'${value.replaceAll('\\', '\\\\').replaceAll("'", String.raw `\'`)}'`;
+}
+async function preflightApiNames(connection, plan) {
+    if (connection.query === undefined) {
+        throw new TypeError('Destination API-name absence cannot be proven; email-fragment apply is blocked');
+    }
+    for (const apiName of new Set(plan.groups.flatMap(({ primary, variants }) => [primary, ...variants].flatMap((item) => (item.apiName === undefined ? [] : [item.apiName]))))) {
+        const result = await connection.query(`SELECT ApiName FROM ManagedContent WHERE ApiName = ${soqlString(apiName)} LIMIT 1`);
+        if (result.totalSize !== 0 || result.records.length > 0) {
+            throw new Error(`API name ${apiName} already exists`);
+        }
+    }
+}
 function compareMappingIdentity(left, right) {
     return `${left.kind}\u0000${left.referenceId}`.localeCompare(`${right.kind}\u0000${right.referenceId}`);
 }
@@ -446,6 +597,39 @@ function validateParentResponse(response, expectedContentKey) {
         primaryVariantId: responseIdentifier(response, ['primaryVariantId', 'managedContentVariantId', 'variantId'], 'primary variant ID'),
     };
 }
+function verifyNativeCopy(response, payload, created, language) {
+    const type = isRecord(response.contentType)
+        ? response.contentType.fullyQualifiedName
+        : response.contentType;
+    if (response.contentKey !== created.contentKey ||
+        responseIdentifier(response, ['managedContentId', 'id'], 'content ID') !== created.contentId ||
+        response.apiName !== payload.apiName ||
+        response.urlName !== payload.urlName ||
+        response.language !== language ||
+        response.title !== payload.title ||
+        type !== payload.contentType ||
+        !isRecord(response.contentSpace) ||
+        response.contentSpace.id !== payload.contentSpaceOrFolderId ||
+        response.isPublished !== false ||
+        !isRecord(response.status) ||
+        response.status.status !== 'Draft' ||
+        !isRecord(response.contentBody))
+        throw new TypeError('Native copy readback identity or draft verification failed');
+    for (const [key, value] of Object.entries(payload.contentBody)) {
+        // Salesforce entity-encodes raw HTML on retrieval; compare one encoding layer only.
+        const encoded = key === 'rawHtml' && typeof value === 'string'
+            ? value
+                .replaceAll('&', '&amp;')
+                .replaceAll('<', '&lt;')
+                .replaceAll('>', '&gt;')
+                .replaceAll('"', '&quot;')
+                .replaceAll("'", '&#39;')
+            : value;
+        if (!isDeepStrictEqual(response.contentBody[key], value) &&
+            !isDeepStrictEqual(response.contentBody[key], encoded))
+            throw new TypeError(`Native copy readback body differs: ${key}`);
+    }
+}
 function validateChildResponse(response) {
     return responseIdentifier(response, ['id', 'variantId', 'managedContentVariantId'], 'variant ID');
 }
@@ -488,6 +672,33 @@ async function persistOperationResult(reportFile, report, operation, rewrite) {
         throw new WorkspaceImportOwnershipUncertainError(operation, error);
     }
 }
+/**
+ * Reconstruct editable HTML before native validation, retaining all original identity inventory.
+ * @param {LoadedWorkspaceExport} source - Complete verified original package.
+ * @param {unknown} mappings - Native copy selections and fresh identities.
+ * @param {string} editableDirectory - Optional verified HTML companion.
+ * @returns {Promise<object>} Native proposal and optional all-companion evidence.
+ */
+export async function planNativeWorkspaceImport(source, mappings, editableDirectory) {
+    if (editableDirectory === undefined)
+        return { proposal: planNativeCopies(source, mappings) };
+    const editable = await loadEditableRawHtml(source, editableDirectory);
+    const editedById = new Map(editable.items.map((item) => [item.id, item]));
+    const proposal = planNativeCopies({ ...source, items: source.items.map((item) => editedById.get(item.id) ?? item) }, mappings, editable.literalHtmlVariantIds);
+    for (const item of proposal.items) {
+        if (!editedById.has(item.id))
+            throw new TypeError(`Selected variant ${item.id} is missing from the editable companion`);
+    }
+    preflightReferences({
+        source,
+        groups: proposal.items.map((primary) => ({
+            contentKey: primary.contentKey,
+            primary,
+            variants: [],
+        })),
+    }, selectedNativeReferences(source, proposal.items));
+    return { proposal, editableSource: editable.editableSource };
+}
 export async function executeWorkspaceImport(options) {
     if (!nonemptyString(options.destinationOrgId)) {
         throw new TypeError('destinationOrgId must be the nonempty destination org ID');
@@ -496,9 +707,112 @@ export async function executeWorkspaceImport(options) {
         (await loadWorkspaceExport(options.sourceDirectory, {
             allowPartial: options.allowPartial,
         }));
-    const plan = planWorkspaceImport(source, options.destinationWorkspace, options.workspaceId);
+    if (!source.integrity.verified)
+        throw new TypeError('Source integrity must be verified first');
+    if (source.isPartial && options.allowPartial !== true) {
+        throw new TypeError('Workspace export is partial; explicit allowPartial is required');
+    }
+    validateRelationships(source.items);
+    const native = options.nativeCopyMappings !== undefined;
+    const emailFragment = options.emailFragmentMappings !== undefined;
+    const webFragment = options.webFragmentMappings !== undefined;
+    const landingPageTemplate = options.landingPageTemplateMappings !== undefined;
+    const landingPage = options.landingPageMappings !== undefined;
+    if (Number(native) +
+        Number(emailFragment) +
+        Number(webFragment) +
+        Number(landingPageTemplate) +
+        Number(landingPage) +
+        Number(options.identityMappings !== undefined) >
+        1)
+        throw new TypeError('Choose one identity profile');
+    if (options.editableDirectory !== undefined && !native)
+        throw new TypeError('editableDirectory requires nativeCopyMappings');
+    let proposal;
+    let editableSource;
+    let landingPageTemplateProposal;
+    let landingPageProposal;
+    let webFragmentProposal;
+    if (native) {
+        ({ proposal, editableSource } = await planNativeWorkspaceImport(source, options.nativeCopyMappings, options.editableDirectory));
+    }
+    else if (emailFragment) {
+        proposal = planEmailFragmentCopies(source, options.emailFragmentMappings);
+    }
+    else if (webFragment) {
+        webFragmentProposal = planWebFragmentCopies(source, options.webFragmentMappings);
+        proposal = webFragmentProposal;
+    }
+    else if (landingPageTemplate) {
+        landingPageTemplateProposal = planLandingPageTemplateCopies(source, options.landingPageTemplateMappings);
+        proposal = landingPageTemplateProposal;
+    }
+    else if (landingPage) {
+        landingPageProposal = planLandingPageCopies(source, options.landingPageMappings);
+        proposal = landingPageProposal;
+    }
+    else if (options.identityMappings !== undefined)
+        proposal = planImportIdentities(source, options.identityMappings);
+    const selectedIds = new Set(proposal?.items.map((item) => item.id));
+    const editableDiagnostics = editableSource === undefined
+        ? []
+        : [
+            {
+                code: 'EDITABLE_HTML_INPUT',
+                message: `Editable HTML input: original package integrity and references describe only the unchanged baseline, not the edited payload. ${editableSource.entries.filter((entry) => entry.changed && selectedIds.has(entry.variantId)).length} selected HTML modification(s) ${options.dryRun === true ? 'planned' : 'applied'}; ${editableSource.entries.filter((entry) => entry.changed).length} changed entry/entries across all ${editableSource.entries.length} companion entries. No CMS reference rewriting is established by HTML edits.`,
+                retryable: false,
+            },
+        ];
+    const selectedSource = native || emailFragment || webFragment || landingPageTemplate || landingPage
+        ? { ...source, items: proposal.items }
+        : source;
+    const sourcePlan = planWorkspaceImport(selectedSource, options.destinationWorkspace, options.workspaceId);
+    // Keep original variant IDs and source manifest associations; never substitute the raw package.
+    const proposedById = new Map(proposal?.items.map((item) => [item.id, item]));
+    const plan = proposal === undefined
+        ? sourcePlan
+        : {
+            ...sourcePlan,
+            source,
+            groups: sourcePlan.groups.map((group) => ({
+                contentKey: proposedById.get(group.primary.id).contentKey,
+                primary: proposedById.get(group.primary.id),
+                variants: group.variants.map((variant) => proposedById.get(variant.id)),
+            })),
+        };
+    let selectedReferences;
+    if (native)
+        selectedReferences = selectedNativeReferences(source, proposal.items);
+    else if (landingPageTemplate || landingPage) {
+        selectedReferences = selectedLandingPageTemplateReferences(source, proposal.items);
+    }
+    preflightReferences(plan, selectedReferences, landingPageTemplate || landingPage);
     const requestOptions = options.requestOptions ?? {};
-    await preflightConflicts(options.connection, plan, requestOptions);
+    if (!native)
+        await preflightConflicts(options.connection, plan, requestOptions);
+    if (emailFragment || webFragment || landingPageTemplate || landingPage)
+        await preflightApiNames(options.connection, plan);
+    if (webFragment) {
+        await validateDataGraphPrerequisites(options.connection, webFragmentProposal.dataGraphs);
+    }
+    if (landingPageTemplate) {
+        await validateLandingPageTemplatePrerequisites(options.connection, plan.destinationWorkspaceId, landingPageTemplateProposal, requestOptions);
+    }
+    if (landingPage) {
+        await validateLandingPagePrerequisites(options.connection, plan.destinationWorkspaceId, landingPageProposal, requestOptions);
+    }
+    const hasNamedIdentities = plan.groups.some((group) => [group.primary, ...group.variants].some((item) => item.apiName !== undefined ||
+        item.urlName !== undefined ||
+        item.contentBody['sfdc_cms:urlName'] !== undefined));
+    if (!native &&
+        !emailFragment &&
+        !webFragment &&
+        !landingPageTemplate &&
+        !landingPage &&
+        hasNamedIdentities &&
+        options.dryRun !== true) {
+        throw new TypeError('Destination API-name/URL-name uniqueness cannot be verified by the supported CMS APIs; import is blocked');
+    }
     const references = source.manifest.externalReferences
         .filter(({ resolution }) => resolution !== 'included')
         .map(({ kind, referenceId, resolution }) => ({
@@ -508,7 +822,32 @@ export async function executeWorkspaceImport(options) {
     }))
         .toSorted(compareMappingIdentity);
     if (options.dryRun === true) {
+        const diagnostics = [
+            ...editableDiagnostics,
+            {
+                code: 'SERVER_CONFLICT_CHECK_UNVERIFIED',
+                message: native
+                    ? 'Native copy omits contentKey. API-name conflicts can reject; duplicate URLs can create distinct objects. Destination name availability is not prevalidated.'
+                    : 'Content-key absence was checked, but complete server conflict validation is unverified; this is a read-only proposal.',
+                retryable: false,
+            },
+            {
+                code: 'APPLY_READINESS_UNVERIFIED',
+                message: 'Dry-run success is not deploy readiness and does not authorize apply.',
+                retryable: false,
+            },
+        ];
+        if (hasNamedIdentities && !native) {
+            diagnostics.unshift({
+                code: 'NAME_AVAILABILITY_UNVERIFIED',
+                message: emailFragment || webFragment || landingPageTemplate || landingPage
+                    ? `Destination API-name absence was proven by exact ManagedContent.ApiName equality lookup;${webFragment || landingPageTemplate || landingPage ? ' every named prerequisite was proven in exact type/workspace scope;' : ''} other server conflict behavior remains unverified.`
+                    : 'Destination API-name/URL-name availability is unverified; named apply remains blocked until collision evidence is available.',
+                retryable: false,
+            });
+        }
         return {
+            diagnostics,
             contractResult: importContractResult(source, options.destinationOrgId, plan, [], references),
             dryRun: true,
             plan,
@@ -521,6 +860,21 @@ export async function executeWorkspaceImport(options) {
     await mkdir(reportDirectory);
     const reportFile = path.join(reportDirectory, 'workspace-import-run.json');
     const report = {
+        ...(editableSource === undefined ? {} : { editableSource }),
+        ...(landingPageTemplateProposal === undefined && landingPageProposal === undefined
+            ? {}
+            : {
+                cmsPrerequisites: landingPageTemplateProposal?.cmsPrerequisites ?? landingPageProposal.cmsPrerequisites,
+            }),
+        ...(webFragmentProposal === undefined &&
+            landingPageTemplateProposal === undefined &&
+            landingPageProposal === undefined
+            ? {}
+            : {
+                dataGraphPrerequisites: webFragmentProposal?.dataGraphs ??
+                    landingPageTemplateProposal?.dataGraphs ??
+                    landingPageProposal.dataGraphs,
+            }),
         createdParents: [],
         destinationOrgId: options.destinationOrgId,
         destinationWorkspaceId: plan.destinationWorkspaceId,
@@ -548,11 +902,31 @@ export async function executeWorkspaceImport(options) {
     ]));
     const sourceReferenceValues = new Set(sourceReferencesByValue.keys());
     const unresolvedMappingIds = new Set();
+    // Editable native copies have no reference-bearing body or child variants. Bind every
+    // exact CREATE payload in the initial durable journal, before any mutation.
+    if (editableSource !== undefined) {
+        for (const group of plan.groups) {
+            const payload = createPayload(group, plan.destinationWorkspaceId);
+            delete payload.contentKey;
+            delete payload.externalId;
+            delete payload.externalSource;
+            report.operations.push(pendingOperation(report, 'create-parent', group.contentKey, group.primary.language, payload));
+        }
+    }
     await writeExclusive(reportFile, report);
     try {
         for (const group of plan.groups) {
+            if (landingPageTemplate) {
+                await validateLandingPageTemplatePrerequisites(options.connection, plan.destinationWorkspaceId, landingPageTemplateProposal, requestOptions);
+            }
+            else if (landingPage) {
+                await validateLandingPagePrerequisites(options.connection, plan.destinationWorkspaceId, landingPageProposal, requestOptions);
+            }
+            const finalPrimary = proposal?.items.find((item) => item.id === group.primary.id) ?? group.primary;
+            const finalVariants = group.variants.map((variant) => proposal?.items.find((item) => item.id === variant.id) ?? variant);
+            const finalGroup = { ...group, primary: finalPrimary, variants: finalVariants };
             const groupReferenceKeys = new Set();
-            for (const item_ of [group.primary, ...group.variants]) {
+            for (const item_ of [finalGroup.primary, ...finalGroup.variants]) {
                 for (const key of cmsContentBodyReferenceKeys(item_.contentBody, sourceReferenceValues)) {
                     groupReferenceKeys.add(key);
                 }
@@ -569,22 +943,46 @@ export async function executeWorkspaceImport(options) {
                 }
             }
             const rewrittenGroup = hasUnknownRequiredMapping
-                ? group
+                ? finalGroup
                 : {
-                    ...group,
-                    primary: rewriteItem(group.primary, replacements),
-                    variants: group.variants.map((variant) => rewriteItem(variant, replacements)),
+                    ...finalGroup,
+                    primary: rewriteItem(finalGroup.primary, replacements),
+                    variants: finalGroup.variants.map((variant) => rewriteItem(variant, replacements)),
+                };
+            const parentPayload = createPayload(rewrittenGroup, native ? plan.destinationWorkspaceId : plan.rootFolderId);
+            if (native) {
+                delete parentPayload.contentKey;
+                delete parentPayload.externalId;
+                delete parentPayload.externalSource;
+            }
+            if (emailFragment || webFragment || landingPageTemplate || landingPage) {
+                const currentPlan = {
+                    ...plan,
+                    groups: [rewrittenGroup],
                 };
-            const parentPayload = createPayload(rewrittenGroup, plan.rootFolderId);
-            const parentOperation = pendingOperation(report, 'create-parent', group.contentKey, group.primary.language, parentPayload);
-            report.operations.push(parentOperation);
+                await preflightConflicts(options.connection, currentPlan, requestOptions);
+                await preflightApiNames(options.connection, currentPlan);
+                if (webFragment) {
+                    await validateDataGraphPrerequisites(options.connection, webFragmentProposal.dataGraphs);
+                }
+            }
+            const parentOperation = editableSource === undefined
+                ? pendingOperation(report, 'create-parent', group.contentKey, group.primary.language, parentPayload)
+                : report.operations.find((operation) => operation.contentKey === group.contentKey);
+            if (editableSource === undefined)
+                report.operations.push(parentOperation);
+            else if (parentOperation.requestSha256 !==
+                operationIdentity(report.runId, 'create-parent', group.contentKey, group.primary.language, parentPayload).requestSha256)
+                throw new TypeError('Editable CREATE payload changed after initial journal');
             await rewrite(reportFile, report);
             let parentResponse;
             try {
                 parentResponse = await createContent(options.connection, parentPayload, requestOptions);
             }
             catch (error) {
-                parentOperation.state = 'failed';
+                parentOperation.state = native ? 'pending' : 'failed';
+                if (native)
+                    report.state = 'ownership-uncertain';
                 parentOperation.error = error instanceof Error ? error.message : String(error);
                 try {
                     await rewrite(reportFile, report);
@@ -594,14 +992,38 @@ export async function executeWorkspaceImport(options) {
                 }
                 throw error;
             }
-            const created = validateParentResponse(parentResponse, group.contentKey);
+            // Persist returned identity before any semantic verification or further requests.
+            if (native) {
+                parentOperation.result = {
+                    contentKey: typeof parentResponse.contentKey === 'string' ? parentResponse.contentKey : undefined,
+                    contentId: [parentResponse.managedContentId, parentResponse.id].find(nonemptyString),
+                    primaryVariantId: [
+                        parentResponse.managedContentVariantId,
+                        parentResponse.primaryVariantId,
+                    ].find(nonemptyString),
+                };
+                report.state = 'ownership-uncertain';
+                await persistOperationResult(reportFile, report, parentOperation, rewrite);
+            }
+            const created = validateParentResponse(parentResponse, native
+                ? responseIdentifier(parentResponse, ['contentKey'], 'generated key')
+                : group.contentKey);
             report.createdParents.push(created);
             parentOperation.state = 'succeeded';
             parentOperation.result = {
                 contentId: created.contentId,
+                contentKey: created.contentKey,
                 primaryVariantId: created.primaryVariantId,
             };
             await persistOperationResult(reportFile, report, parentOperation, rewrite);
+            if (native) {
+                if (source.items.some((item) => item.contentKey === created.contentKey ||
+                    variantIdentity(item, item.id).contentId === created.contentId))
+                    throw new TypeError('Native response reused a source identity');
+                const readback = await getContent(options.connection, created.contentKey, {}, requestOptions);
+                verifyNativeCopy(readback, parentPayload, created, group.primary.language);
+                report.state = 'applying';
+            }
             const reference = referenceByVariantId.get(group.primary.id);
             if (reference !== undefined) {
                 replacements.set(reference.source.sourceId, created.contentId);
@@ -667,7 +1089,8 @@ export async function executeWorkspaceImport(options) {
         await rewrite(reportFile, report);
     }
     catch (error) {
-        if (!(error instanceof WorkspaceImportOwnershipUncertainError))
+        if (!(error instanceof WorkspaceImportOwnershipUncertainError) &&
+            report.state !== 'ownership-uncertain')
             report.state = 'failed';
         try {
             await rewrite(reportFile, report);
@@ -688,6 +1111,7 @@ export async function executeWorkspaceImport(options) {
         }
     }
     return {
+        diagnostics: editableDiagnostics,
         contractResult: importContractResult(source, options.destinationOrgId, plan, mappings, references),
         dryRun: false,
         plan,