[Init] Initial commit - NetMesh terminal manager

domain/pluginImporter.ts

@@ -0,0 +1,743 @@
+import type { ImporterRecord, JsonValue } from '@netcatty/plugin-contract';
+import { sanitizeHost } from './host';
+import { isBuiltInHostProtocol, isPluginHostProtocol } from './pluginConnection';
+import type { Host, Identity, Snippet, SSHKey } from './models';
+import { applyVaultImportDestination, type VaultImportDestination } from './vaultImport';
+import { buildVaultHostMergeKey } from './vaultHostCreate';
+
+export interface PluginImporterDrafts {
+  hosts: Host[];
+  identities: Identity[];
+  keys: SSHKey[];
+  snippets: Snippet[];
+  groups: string[];
+  warnings: string[];
+  errors: string[];
+}
+
+export interface PluginImporterPreviewItem {
+  kind: 'host' | 'identity' | 'key' | 'snippet' | 'group';
+  label: string;
+  detail?: string;
+}
+
+export interface PluginImporterSafePreview {
+  items: PluginImporterPreviewItem[];
+  warnings: string[];
+  errors: string[];
+  omittedItemCount: number;
+  omittedDiagnosticCount: number;
+}
+
+const unicodeLength = (value: string): number => [...value].length;
+const truncateUnicode = (value: string, maximum: number): string => [...value].slice(0, maximum).join('');
+
+const visiblePreviewText = (value: string, maximum = 512): string => (
+  truncateUnicode([...value]
+    .map((character) => {
+      const code = character.charCodeAt(0);
+      return code <= 31 || code === 127 ? ' ' : character;
+    })
+    .join('')
+    .replace(/\s+/g, ' ')
+    .trim(), maximum)
+);
+
+export function buildPluginImporterSafePreview(
+  drafts: PluginImporterDrafts,
+  maximumItems = 50,
+  maximumDiagnostics = 20,
+): PluginImporterSafePreview {
+  const items: PluginImporterPreviewItem[] = [
+    ...drafts.hosts.map((host): PluginImporterPreviewItem => ({
+      kind: 'host',
+      label: visiblePreviewText(host.label),
+      detail: visiblePreviewText(host.pluginConnection?.providerId ?? host.hostname, 1024),
+    })),
+    ...drafts.identities.map((identity): PluginImporterPreviewItem => ({
+      kind: 'identity',
+      label: visiblePreviewText(identity.label),
+      detail: visiblePreviewText(`${identity.username} · ${identity.authMethod}`),
+    })),
+    ...drafts.keys.map((key): PluginImporterPreviewItem => ({
+      kind: 'key',
+      label: visiblePreviewText(key.label),
+      detail: visiblePreviewText(`${key.type} · ${key.source}`),
+    })),
+    ...drafts.snippets.map((snippet): PluginImporterPreviewItem => ({
+      kind: 'snippet',
+      label: visiblePreviewText(snippet.label),
+      detail: visiblePreviewText(snippet.kind),
+    })),
+    ...drafts.groups.map((group): PluginImporterPreviewItem => ({
+      kind: 'group',
+      label: visiblePreviewText(group),
+    })),
+  ];
+  const diagnostics = [
+    ...drafts.warnings.map((message) => ({ kind: 'warning' as const, message: visiblePreviewText(message, 2048) })),
+    ...drafts.errors.map((message) => ({ kind: 'error' as const, message: visiblePreviewText(message, 2048) })),
+  ];
+  const boundedDiagnostics = diagnostics.slice(0, Math.max(0, maximumDiagnostics));
+  return {
+    items: items.slice(0, Math.max(0, maximumItems)),
+    warnings: boundedDiagnostics.filter(({ kind }) => kind === 'warning').map(({ message }) => message),
+    errors: boundedDiagnostics.filter(({ kind }) => kind === 'error').map(({ message }) => message),
+    omittedItemCount: Math.max(0, items.length - maximumItems),
+    omittedDiagnosticCount: Math.max(0, diagnostics.length - maximumDiagnostics),
+  };
+}
+
+const asObject = (value: JsonValue): Record<string, JsonValue> | null => (
+  value && typeof value === 'object' && !Array.isArray(value)
+    ? value as Record<string, JsonValue>
+    : null
+);
+
+const INVALID_FIELD = Symbol('invalid-plugin-importer-field');
+type InvalidField = typeof INVALID_FIELD;
+
+const stringValue = (value: JsonValue | undefined, maximum: number): string | undefined => {
+  if (typeof value !== 'string') return undefined;
+  const result = value.trim();
+  return result && unicodeLength(result) <= maximum && !result.includes('\0') ? result : undefined;
+};
+
+const optionalRawStringValue = (
+  object: Record<string, JsonValue>,
+  key: string,
+  maximum: number,
+): string | undefined | InvalidField => {
+  if (!Object.prototype.hasOwnProperty.call(object, key)) return undefined;
+  const value = object[key];
+  return typeof value === 'string' && unicodeLength(value) <= maximum
+    ? value
+    : INVALID_FIELD;
+};
+
+const optionalStringValue = (
+  object: Record<string, JsonValue>,
+  key: string,
+  maximum: number,
+): string | undefined | InvalidField => {
+  if (!Object.prototype.hasOwnProperty.call(object, key)) return undefined;
+  if (typeof object[key] !== 'string') return INVALID_FIELD;
+  const result = stringValue(object[key], maximum);
+  return result ?? undefined;
+};
+
+const optionalBooleanValue = (
+  object: Record<string, JsonValue>,
+  key: string,
+): boolean | undefined | InvalidField => {
+  if (!Object.prototype.hasOwnProperty.call(object, key)) return undefined;
+  return typeof object[key] === 'boolean' ? object[key] : INVALID_FIELD;
+};
+
+const optionalIntegerValue = (
+  object: Record<string, JsonValue>,
+  key: string,
+  minimum: number,
+  maximum: number,
+): number | undefined | InvalidField => {
+  if (!Object.prototype.hasOwnProperty.call(object, key)) return undefined;
+  const value = object[key];
+  return typeof value === 'number' && Number.isSafeInteger(value) && value >= minimum && value <= maximum
+    ? value
+    : INVALID_FIELD;
+};
+
+const optionalEnumValue = <T extends string>(
+  object: Record<string, JsonValue>,
+  key: string,
+  allowed: readonly T[],
+): T | undefined | InvalidField => {
+  if (!Object.prototype.hasOwnProperty.call(object, key)) return undefined;
+  const value = object[key];
+  return typeof value === 'string' && (allowed as readonly string[]).includes(value) ? value as T : INVALID_FIELD;
+};
+
+const stringArray = (value: JsonValue | undefined, maximumItems = 128): string[] => (
+  Array.isArray(value)
+    ? [...new Set(value.slice(0, maximumItems).flatMap((item) => {
+      const normalized = stringValue(item, 256);
+      return normalized ? [normalized] : [];
+    }))]
+    : []
+);
+
+const normalizeHost = (value: JsonValue): Host | null => {
+  const object = asObject(value);
+  if (!object) return null;
+  const hasProtocol = Object.prototype.hasOwnProperty.call(object, 'protocol');
+  const protocolValue = hasProtocol ? stringValue(object.protocol, 199) : undefined;
+  if (hasProtocol && !protocolValue) return null;
+  if (protocolValue && !isBuiltInHostProtocol(protocolValue) && !isPluginHostProtocol(protocolValue)) return null;
+  const protocol = protocolValue as Host['protocol'] | undefined;
+  const pluginProtocol = isPluginHostProtocol(protocol);
+  const providerId = asObject(object.pluginConnection)
+    ? stringValue(asObject(object.pluginConnection)?.providerId, 192)
+    : undefined;
+  const hostname = stringValue(object.hostname, 1024) ?? (pluginProtocol ? providerId : undefined);
+  const label = stringValue(object.label, 512) ?? hostname;
+  if (!hostname || !label) return null;
+  const pluginConnection = Object.prototype.hasOwnProperty.call(object, 'pluginConnection')
+    ? asObject(object.pluginConnection)
+    : undefined;
+  if (pluginConnection === null) return null;
+  const sourceCredentialId = pluginConnection
+    ? optionalStringValue(pluginConnection, 'credentialId', 256)
+    : undefined;
+  if (sourceCredentialId === INVALID_FIELD) return null;
+  const tags = Object.prototype.hasOwnProperty.call(object, 'tags') && !Array.isArray(object.tags)
+    ? null
+    : stringArray(object.tags);
+  if (!tags) return null;
+  const optionalStrings = {
+    group: optionalStringValue(object, 'group', 512),
+    identityId: optionalStringValue(object, 'identityId', 256),
+    identityFileId: optionalStringValue(object, 'identityFileId', 256),
+    telnetIdentityId: optionalStringValue(object, 'telnetIdentityId', 256),
+    notes: optionalStringValue(object, 'notes', 65_536),
+    theme: optionalStringValue(object, 'theme', 256),
+    sftpEncoding: optionalStringValue(object, 'sftpEncoding', 64),
+  };
+  if (Object.values(optionalStrings).some((item) => item === INVALID_FIELD)) return null;
+  const optionalBooleans = {
+    moshEnabled: optionalBooleanValue(object, 'moshEnabled'),
+    etEnabled: optionalBooleanValue(object, 'etEnabled'),
+    telnetEnabled: optionalBooleanValue(object, 'telnetEnabled'),
+    sftpSudo: optionalBooleanValue(object, 'sftpSudo'),
+    requiresMfa: optionalBooleanValue(object, 'requiresMfa'),
+    useSshAgent: optionalBooleanValue(object, 'useSshAgent'),
+    identitiesOnly: optionalBooleanValue(object, 'identitiesOnly'),
+    agentForwarding: optionalBooleanValue(object, 'agentForwarding'),
+    x11Forwarding: optionalBooleanValue(object, 'x11Forwarding'),
+    showLineTimestamps: optionalBooleanValue(object, 'showLineTimestamps'),
+    disableDynamicTabTitle: optionalBooleanValue(object, 'disableDynamicTabTitle'),
+    pinned: optionalBooleanValue(object, 'pinned'),
+    autoOpenSftpPanel: optionalBooleanValue(object, 'autoOpenSftpPanel'),
+    sftpFollowTerminalCwd: optionalBooleanValue(object, 'sftpFollowTerminalCwd'),
+  };
+  if (Object.values(optionalBooleans).some((item) => item === INVALID_FIELD)) return null;
+  const optionalIntegers = {
+    port: optionalIntegerValue(object, 'port', 1, 65535),
+    telnetPort: optionalIntegerValue(object, 'telnetPort', 1, 65535),
+    etPort: optionalIntegerValue(object, 'etPort', 1, 65535),
+    keepaliveInterval: optionalIntegerValue(object, 'keepaliveInterval', 0, 3600),
+    keepaliveCountMax: optionalIntegerValue(object, 'keepaliveCountMax', 1, 100),
+  };
+  if (Object.values(optionalIntegers).some((item) => item === INVALID_FIELD)) return null;
+  const deviceType = optionalEnumValue(object, 'deviceType', ['general', 'network'] as const);
+  if (deviceType === INVALID_FIELD) return null;
+  const sftpFileProtocol = optionalEnumValue(object, 'sftpFileProtocol', ['auto', 'sftp', 'scp'] as const);
+  if (sftpFileProtocol === INVALID_FIELD) return null;
+  const draft = {
+    id: crypto.randomUUID(),
+    label,
+    hostname,
+    username: stringValue(object.username, 512) ?? '',
+    tags,
+    os: ['linux', 'windows', 'macos'].includes(String(object.os)) ? object.os : 'linux',
+    createdAt: Date.now(),
+    ephemeral: false,
+    managedSourceId: undefined,
+    ...(protocol ? { protocol } : {}),
+    ...(pluginConnection ? { pluginConnection: structuredClone(pluginConnection) } : {}),
+    ...(deviceType ? { deviceType } : {}),
+    ...(sftpFileProtocol ? { sftpFileProtocol } : {}),
+    ...Object.fromEntries(Object.entries(optionalStrings).filter(([, item]) => item !== undefined)),
+    ...Object.fromEntries(Object.entries(optionalBooleans).filter(([, item]) => item !== undefined)),
+    ...Object.fromEntries(Object.entries(optionalIntegers).filter(([, item]) => item !== undefined)),
+  } as unknown as Host;
+  const sanitized = sanitizeHost(draft);
+  if (!sanitized.hostname || (pluginProtocol && !sanitized.pluginConnection)) return null;
+  return sanitized.pluginConnection && sourceCredentialId
+    ? {
+        ...sanitized,
+        pluginConnection: { ...sanitized.pluginConnection, credentialId: sourceCredentialId },
+      }
+    : sanitized;
+};
+
+const normalizeIdentity = (value: JsonValue): Identity | null => {
+  const object = asObject(value);
+  if (!object) return null;
+  const label = stringValue(object.label, 512);
+  const username = stringValue(object.username, 512);
+  const authMethod = stringValue(object.authMethod, 32);
+  const password = optionalRawStringValue(object, 'password', 65_536);
+  if (!label || !username || !['password', 'key', 'certificate'].includes(authMethod ?? '')
+    || password === INVALID_FIELD) return null;
+  return {
+    id: crypto.randomUUID(),
+    label,
+    username,
+    authMethod: authMethod as Identity['authMethod'],
+    ...(password !== undefined ? { password } : {}),
+    ...(stringValue(object.keyId, 256) ? { keyId: stringValue(object.keyId, 256) } : {}),
+    created: Date.now(),
+  };
+};
+
+const normalizeKey = (value: JsonValue): SSHKey | null => {
+  const object = asObject(value);
+  if (!object) return null;
+  const label = stringValue(object.label, 512);
+  const type = stringValue(object.type, 32);
+  const privateKey = optionalRawStringValue(object, 'privateKey', 2 * 1024 * 1024);
+  const publicKey = optionalRawStringValue(object, 'publicKey', 1024 * 1024);
+  const certificate = optionalRawStringValue(object, 'certificate', 1024 * 1024);
+  const passphrase = optionalRawStringValue(object, 'passphrase', 65_536);
+  const filePath = stringValue(object.filePath, 8192);
+  if (!label || !['RSA', 'ECDSA', 'ED25519'].includes(type ?? '')
+    || [privateKey, publicKey, certificate, passphrase].some((item) => item === INVALID_FIELD)
+    || (!privateKey && !filePath)) return null;
+  return {
+    id: crypto.randomUUID(),
+    label,
+    type: type as SSHKey['type'],
+    privateKey: privateKey ?? '',
+    ...(publicKey !== undefined ? { publicKey } : {}),
+    ...(certificate !== undefined ? { certificate } : {}),
+    ...(passphrase !== undefined ? { passphrase } : {}),
+    ...(filePath ? { filePath } : {}),
+    source: filePath && !privateKey ? 'reference' : 'imported',
+    category: ['key', 'certificate', 'identity'].includes(String(object.category))
+      ? object.category as SSHKey['category']
+      : 'key',
+    created: Date.now(),
+  };
+};
+
+const normalizeSnippet = (value: JsonValue): Snippet | null => {
+  const object = asObject(value);
+  if (!object) return null;
+  const label = stringValue(object.label, 512);
+  const command = optionalRawStringValue(object, 'command', 1024 * 1024);
+  if (!label || !command || command === INVALID_FIELD || command.includes('\0')) return null;
+  return {
+    id: crypto.randomUUID(),
+    label,
+    command,
+    tags: stringArray(object.tags),
+    kind: object.kind === 'script' ? 'script' : 'snippet',
+    ...(stringValue(object.description, 4096) ? { description: stringValue(object.description, 4096) } : {}),
+  };
+};
+
+export function normalizePluginImporterRecords(records: ReadonlyArray<ImporterRecord>): PluginImporterDrafts {
+  const result: PluginImporterDrafts = {
+    hosts: [], identities: [], keys: [], snippets: [], groups: [], warnings: [], errors: [],
+  };
+  const keyIds = new Map<string, string | null>();
+  const identityIds = new Map<string, string | null>();
+  const registerSourceId = (
+    index: Map<string, string | null>,
+    sourceId: string,
+    id: string,
+    kind: 'identity' | 'key',
+  ): void => {
+    if (!index.has(sourceId)) {
+      index.set(sourceId, id);
+      return;
+    }
+    if (index.get(sourceId) !== null) {
+      result.errors.push(`Importer returned a duplicate ${kind} source ID.`);
+    }
+    index.set(sourceId, null);
+  };
+  const sourceIds = (value: JsonValue): string | undefined => {
+    const object = asObject(value);
+    return object ? stringValue(object.id, 256) : undefined;
+  };
+  for (const record of records) {
+    if (record.type === 'warning') {
+      result.warnings.push(record.message);
+      continue;
+    }
+    if (record.type === 'error') {
+      result.errors.push(record.message);
+      continue;
+    }
+    if (record.type !== 'draft') continue;
+    const { kind, value } = record.draft;
+    if (kind === 'group') {
+      const object = asObject(value);
+      const group = typeof value === 'string'
+        ? stringValue(value, 512)
+        : object ? stringValue(object.path ?? object.label, 512) : undefined;
+      if (group) result.groups.push(group);
+      else result.errors.push('Importer returned an invalid group draft.');
+      continue;
+    }
+    const normalized = kind === 'host'
+      ? normalizeHost(value)
+      : kind === 'identity'
+        ? normalizeIdentity(value)
+        : kind === 'key'
+          ? normalizeKey(value)
+          : normalizeSnippet(value);
+    if (!normalized) {
+      result.errors.push(`Importer returned an invalid ${kind} draft.`);
+      continue;
+    }
+    if (kind === 'host') result.hosts.push(normalized as Host);
+    else if (kind === 'identity') {
+      const identity = normalized as Identity;
+      result.identities.push(identity);
+      const sourceId = sourceIds(value);
+      if (sourceId) registerSourceId(identityIds, sourceId, identity.id, 'identity');
+    } else if (kind === 'key') {
+      const key = normalized as SSHKey;
+      result.keys.push(key);
+      const sourceId = sourceIds(value);
+      if (sourceId) registerSourceId(keyIds, sourceId, key.id, 'key');
+    }
+    else result.snippets.push(normalized as Snippet);
+  }
+  const resolveReference = (
+    index: Map<string, string | null>,
+    sourceId: string | undefined,
+    label: string,
+  ): string | undefined => {
+    if (!sourceId) return undefined;
+    const resolved = index.get(sourceId);
+    if (typeof resolved === 'string') return resolved;
+    result.errors.push(resolved === null
+      ? `Importer returned an ambiguous ${label} reference.`
+      : `Importer returned an unresolved ${label} reference.`);
+    return undefined;
+  };
+  result.identities = result.identities.map((identity) => {
+    const keyId = resolveReference(keyIds, identity.keyId, 'identity key');
+    return {
+      ...identity,
+      ...(typeof keyId === 'string' ? { keyId } : { keyId: undefined }),
+    };
+  });
+  result.hosts = result.hosts.map((host) => {
+    const sourceCredentialId = host.pluginConnection?.credentialId;
+    const identityCredentialId = sourceCredentialId ? identityIds.get(sourceCredentialId) : undefined;
+    const keyCredentialId = sourceCredentialId ? keyIds.get(sourceCredentialId) : undefined;
+    const hasAmbiguousCredential = identityCredentialId === null
+      || keyCredentialId === null
+      || (typeof identityCredentialId === 'string' && typeof keyCredentialId === 'string');
+    const credentialId = hasAmbiguousCredential
+      ? undefined
+      : identityCredentialId ?? keyCredentialId;
+    if (sourceCredentialId && !credentialId) {
+      result.errors.push(hasAmbiguousCredential
+        ? 'Importer returned an ambiguous plugin credential reference.'
+        : 'Importer returned an unresolved plugin credential reference.');
+    }
+    const identityId = resolveReference(identityIds, host.identityId, 'host identity');
+    const telnetIdentityId = resolveReference(identityIds, host.telnetIdentityId, 'host Telnet identity');
+    const identityFileId = resolveReference(keyIds, host.identityFileId, 'host key');
+    return {
+      ...host,
+      ...(typeof identityId === 'string'
+        ? { identityId }
+        : { identityId: undefined }),
+      ...(typeof telnetIdentityId === 'string'
+        ? { telnetIdentityId }
+        : { telnetIdentityId: undefined }),
+      ...(typeof identityFileId === 'string'
+        ? { identityFileId }
+        : { identityFileId: undefined }),
+      ...(host.pluginConnection
+        ? {
+            pluginConnection: {
+              ...host.pluginConnection,
+              ...(credentialId ? { credentialId } : { credentialId: undefined }),
+            },
+          }
+        : {}),
+    };
+  });
+  result.groups = [...new Set(result.groups)];
+  return result;
+}
+
+export interface PluginImporterMergeResult {
+  hosts: Host[];
+  identities: Identity[];
+  keys: SSHKey[];
+  snippets: Snippet[];
+  customGroups: string[];
+  duplicateCount: number;
+  addedCount: number;
+}
+
+export function applyPluginImporterDestination(
+  merged: PluginImporterMergeResult,
+  existingHostCount: number,
+  destination?: VaultImportDestination,
+  existingCustomGroups: ReadonlyArray<string> = [],
+  existingCounts: {
+    identities?: number;
+    keys?: number;
+  } = {},
+): PluginImporterMergeResult {
+  if (!destination || destination.mode === 'preserve') return merged;
+  const splitAt = Math.max(0, Math.min(existingHostCount, merged.hosts.length));
+  const existingHosts = merged.hosts.slice(0, splitAt);
+  const importedHosts = merged.hosts.slice(splitAt);
+  const existingIdentityCount = Math.max(
+    0,
+    Math.min(existingCounts.identities ?? 0, merged.identities.length),
+  );
+  const existingKeyCount = Math.max(
+    0,
+    Math.min(existingCounts.keys ?? 0, merged.keys.length),
+  );
+  const existingIdentityIds = new Set(
+    merged.identities.slice(0, existingIdentityCount).map((identity) => identity.id),
+  );
+  const existingKeyIds = new Set(
+    merged.keys.slice(0, existingKeyCount).map((key) => key.id),
+  );
+  const targeted = applyVaultImportDestination({
+    hosts: importedHosts,
+    groups: [],
+    issues: [],
+    stats: {
+      parsed: importedHosts.length,
+      imported: importedHosts.length,
+      skipped: 0,
+      duplicates: 0,
+    },
+  }, destination, {
+    // Plugin hosts that differ by configuration/credentials must survive a
+    // shared destination group; classic vault hosts still collapse by endpoint.
+    isCollapsible: (host) => !host.pluginConnection,
+  });
+  // Destination rewrite can make an imported vault host collide with an existing
+  // one (same endpoint, now same group). Re-check like the CSV import path.
+  const existingFingerprints = new Set(existingHosts.map(hostFingerprint));
+  const retainedImported: Host[] = [];
+  for (const host of targeted.hosts) {
+    const fingerprint = hostFingerprint(host);
+    if (existingFingerprints.has(fingerprint)) continue;
+    existingFingerprints.add(fingerprint);
+    retainedImported.push(host);
+  }
+  const retainedImportedIds = new Set(retainedImported.map((host) => host.id));
+  const droppedImported = importedHosts.filter((host) => !retainedImportedIds.has(host.id));
+  const collectHostCredentialIds = (hosts: ReadonlyArray<Host>): Set<string> => {
+    const ids = new Set<string>();
+    for (const host of hosts) {
+      if (host.identityId) ids.add(host.identityId);
+      if (host.telnetIdentityId) ids.add(host.telnetIdentityId);
+      if (host.identityFileId) ids.add(host.identityFileId);
+      const pluginCredentialId = host.pluginConnection?.credentialId;
+      if (pluginCredentialId) ids.add(pluginCredentialId);
+    }
+    return ids;
+  };
+  const keptCredentialIds = collectHostCredentialIds([...existingHosts, ...retainedImported]);
+  const droppedOnlyCredentialIds = new Set(
+    [...collectHostCredentialIds(droppedImported)].filter((id) => !keptCredentialIds.has(id)),
+  );
+  // Only prune credentials introduced by this import. Remapped duplicates that
+  // point at pre-existing vault identities/keys must stay in the vault.
+  const nextIdentities = merged.identities.filter((identity) => (
+    existingIdentityIds.has(identity.id)
+    || !droppedOnlyCredentialIds.has(identity.id)
+  ));
+  const keptIdentityKeyIds = new Set(
+    nextIdentities.flatMap((identity) => (identity.keyId ? [identity.keyId] : [])),
+  );
+  const prunedIdentityKeyIds = new Set(
+    merged.identities
+      .filter((identity) => (
+        !existingIdentityIds.has(identity.id)
+        && droppedOnlyCredentialIds.has(identity.id)
+      ))
+      .flatMap((identity) => (identity.keyId ? [identity.keyId] : [])),
+  );
+  const nextKeys = merged.keys.filter((key) => {
+    if (existingKeyIds.has(key.id)) return true;
+    if (keptCredentialIds.has(key.id) || keptIdentityKeyIds.has(key.id)) return true;
+    if (droppedOnlyCredentialIds.has(key.id) || prunedIdentityKeyIds.has(key.id)) return false;
+    return true;
+  });
+  const prunedIdentityCount = merged.identities.length - nextIdentities.length;
+  const prunedKeyCount = merged.keys.length - nextKeys.length;
+  const existingGroupSet = new Set([
+    ...existingCustomGroups,
+    ...existingHosts.flatMap((host) => host.group ? [host.group] : []),
+  ]);
+  const previousAddedGroupCount = merged.customGroups.filter(
+    (group) => !existingGroupSet.has(group),
+  ).length;
+  const customGroups = [...new Set([...existingCustomGroups, ...targeted.groups])];
+  const nextAddedGroupCount = customGroups.filter(
+    (group) => !existingGroupSet.has(group),
+  ).length;
+  // Destination rewriting can collapse same-endpoint hosts into one group;
+  // keep added/duplicate counts aligned with the hosts actually retained.
+  const collapsedHostCount = Math.max(0, importedHosts.length - retainedImported.length);
+  return {
+    ...merged,
+    hosts: [...existingHosts, ...retainedImported],
+    identities: nextIdentities,
+    keys: nextKeys,
+    customGroups,
+    duplicateCount: merged.duplicateCount + collapsedHostCount,
+    addedCount: merged.addedCount
+      - previousAddedGroupCount
+      + nextAddedGroupCount
+      - collapsedHostCount
+      - prunedIdentityCount
+      - prunedKeyCount,
+  };
+}
+
+const stableJson = (value: unknown): string => {
+  if (Array.isArray(value)) return `[${value.map(stableJson).join(',')}]`;
+  if (value && typeof value === 'object') {
+    return `{${Object.entries(value as Record<string, unknown>)
+      .sort(([left], [right]) => left.localeCompare(right))
+      .map(([key, item]) => `${JSON.stringify(key)}:${stableJson(item)}`)
+      .join(',')}}`;
+  }
+  return JSON.stringify(value) ?? 'undefined';
+};
+
+const keyFingerprint = (key: SSHKey): string => stableJson({
+  type: key.type,
+  privateKey: key.privateKey,
+  publicKey: key.publicKey,
+  certificate: key.certificate,
+  filePath: key.filePath,
+});
+
+const identityFingerprint = (identity: Identity): string => stableJson({
+  username: identity.username.trim().toLowerCase(),
+  authMethod: identity.authMethod,
+  keyId: identity.keyId,
+  password: identity.password,
+});
+
+const hostFingerprint = (host: Host): string => host.pluginConnection
+  ? stableJson({
+    protocol: host.protocol,
+    providerId: host.pluginConnection.providerId,
+    authenticationProviderId: host.pluginConnection.authenticationProviderId,
+    credentialId: host.pluginConnection.credentialId,
+    configuration: host.pluginConnection.configuration,
+    username: host.username.trim().toLowerCase(),
+    identityId: host.identityId,
+    telnetIdentityId: host.telnetIdentityId,
+    identityFileId: host.identityFileId,
+  })
+  : buildVaultHostMergeKey(host);
+
+const snippetFingerprint = (snippet: Snippet): string => stableJson({
+  label: snippet.label.trim().toLowerCase(),
+  kind: snippet.kind,
+  command: snippet.command,
+});
+
+export function mergePluginImporterDrafts(
+  existing: Pick<PluginImporterMergeResult, 'hosts' | 'identities' | 'keys' | 'snippets' | 'customGroups'>,
+  drafts: PluginImporterDrafts,
+): PluginImporterMergeResult {
+  let duplicateCount = 0;
+  const keyByFingerprint = new Map(existing.keys.map((key) => [keyFingerprint(key), key]));
+  const keyIdRemap = new Map<string, string>();
+  const addedKeys: SSHKey[] = [];
+  for (const key of drafts.keys) {
+    const fingerprint = keyFingerprint(key);
+    const duplicate = keyByFingerprint.get(fingerprint);
+    if (duplicate) {
+      duplicateCount += 1;
+      keyIdRemap.set(key.id, duplicate.id);
+      continue;
+    }
+    keyByFingerprint.set(fingerprint, key);
+    addedKeys.push(key);
+  }
+
+  const identityByFingerprint = new Map(existing.identities.map((identity) => [identityFingerprint(identity), identity]));
+  const identityIdRemap = new Map<string, string>();
+  const addedIdentities: Identity[] = [];
+  for (const source of drafts.identities) {
+    const identity = source.keyId && keyIdRemap.has(source.keyId)
+      ? { ...source, keyId: keyIdRemap.get(source.keyId) }
+      : source;
+    const fingerprint = identityFingerprint(identity);
+    const duplicate = identityByFingerprint.get(fingerprint);
+    if (duplicate) {
+      duplicateCount += 1;
+      identityIdRemap.set(source.id, duplicate.id);
+      continue;
+    }
+    identityByFingerprint.set(fingerprint, identity);
+    addedIdentities.push(identity);
+  }
+
+  const hostFingerprints = new Set(existing.hosts.map(hostFingerprint));
+  const addedHosts: Host[] = [];
+  for (const source of drafts.hosts) {
+    const pluginCredentialId = source.pluginConnection?.credentialId;
+    const remappedPluginCredentialId = pluginCredentialId
+      ? identityIdRemap.get(pluginCredentialId) ?? keyIdRemap.get(pluginCredentialId)
+      : undefined;
+    const host = sanitizeHost({
+      ...source,
+      ...(source.identityId && identityIdRemap.has(source.identityId)
+        ? { identityId: identityIdRemap.get(source.identityId) }
+        : {}),
+      ...(source.telnetIdentityId && identityIdRemap.has(source.telnetIdentityId)
+        ? { telnetIdentityId: identityIdRemap.get(source.telnetIdentityId) }
+        : {}),
+      ...(source.identityFileId && keyIdRemap.has(source.identityFileId)
+        ? { identityFileId: keyIdRemap.get(source.identityFileId) }
+        : {}),
+      ...(source.pluginConnection && remappedPluginCredentialId
+        ? {
+            pluginConnection: {
+              ...source.pluginConnection,
+              credentialId: remappedPluginCredentialId,
+            },
+          }
+        : {}),
+    });
+    const fingerprint = hostFingerprint(host);
+    if (hostFingerprints.has(fingerprint)) {
+      duplicateCount += 1;
+      continue;
+    }
+    hostFingerprints.add(fingerprint);
+    addedHosts.push(host);
+  }
+
+  const snippetFingerprints = new Set(existing.snippets.map(snippetFingerprint));
+  const addedSnippets = drafts.snippets.filter((snippet) => {
+    const fingerprint = snippetFingerprint(snippet);
+    if (snippetFingerprints.has(fingerprint)) {
+      duplicateCount += 1;
+      return false;
+    }
+    snippetFingerprints.add(fingerprint);
+    return true;
+  });
+  const customGroups = [...new Set([
+    ...existing.customGroups,
+    ...drafts.groups,
+    ...addedHosts.flatMap((host) => host.group ? [host.group] : []),
+  ])];
+  const addedCount = addedKeys.length + addedIdentities.length + addedHosts.length + addedSnippets.length
+    + Math.max(0, customGroups.length - existing.customGroups.length);
+  return {
+    keys: [...existing.keys, ...addedKeys],
+    identities: [...existing.identities, ...addedIdentities],
+    hosts: [...existing.hosts, ...addedHosts],
+    snippets: [...existing.snippets, ...addedSnippets],
+    customGroups,
+    duplicateCount,
+    addedCount,
+  };
+}