Import & Export

Bring content in safely with validation, preview, mapping, and confirmation.

The Import Center lets you bring operational content into your workspace from uploaded packages. Export lets you download content you own when provenance policy and workspace export entitlement both allow it.

Marketplace install and Import Center upload are different paths with different trust models — see Marketplace and Export policy.

Import Center overview

Open Import Center from your workspace sidebar.
Upload or paste a WorkCheats Package v1 JSON file from your local machine.
Follow the guided flow: validate → preview → map → resolve duplicates → confirm.

Nothing is written to your workspace until you explicitly confirm import.

Screenshot placeholder: Import Center landing page with upload area and recent import history.

Uploaded packages are always untrusted

Any package you upload is untrusted user content until you review and confirm it:

Package JSON cannot declare trusted Marketplace origin, publication, billing, entitlements, or unlock rights — those fields are rejected or ignored.
Do not import packages from unknown sources without inspection.
Read preview summaries before confirming writes.
Commands, scripts, workflow steps, and notes are content artifacts — WorkCheats stores them but does not execute them during import or afterward.

See Security & Responsible Use for full guidance.

Safe import flow

Step	What happens
Upload	Paste or upload JSON. No writes yet.
Analyze	WorkCheats validates package structure, registry references, item kinds, and forbidden metadata.
Review	Inspect validation issues, warnings, and item families before planning writes.
Resolve	Map unknown category/section references to existing workspace locations, exclude items, or fix blockers that require source-file changes.
Preview	See planned creates, skips, and import blockers. Refresh after Resolve changes.
Confirm	Read safety acknowledgements and approve the import explicitly.
Results	Per-item outcomes: created, skipped, or blocked. No silent overwrite.

If any step fails, stop and fix the package or contact support.

WorkCheats Package v1 (user-facing)

User imports must use the canonical package envelope:

Field	Requirement
`type`	Must be `workcheats-package`
`version`	Must be `1.0`
Items	Each item needs a stable `externalId` (lowercase slug-style reference)

Item payloads use controlled registry IDs where applicable:

categoryId and sectionId must match the WorkCheats taxonomy registry
groupTitle is an optional workspace group hint (sanitized on apply)
iconId must be from the allowed icon registry when present

Supported import kinds

Kind	Import writes
`command`	Yes — requires resolved workspace taxonomy
`field_preset`	Yes — duplicates skipped
`report_template`	Yes — duplicates skipped
`workflow`	Yes — command steps import as embedded text only (not linked to library commands in this release)
`script`	Analyze/preview only — not imported as executable content
Mixed kinds in one package	Analyze supported; execute import unsupported

Nothing runs during import. Scripts remain non-executable content artifacts.

Forbidden package metadata

User-uploaded packages must not include:

Billing, Stripe, subscription, price, payment, or coupon fields
Entitlement grants, unlock flags, or promo codes
Trusted-origin, publication, listing, or Marketplace trust declarations
Account, user, workspace, or database object IDs
Secrets, tokens, API keys, passwords, private keys, recovery codes
Storage paths, signed URLs, raw attachment bytes, or similar leak fields

Packages containing forbidden keys fail validation. Do not embed real credentials in package JSON.

Category and section mapping

WorkCheats does not silently invent library locations during import:

Unknown categoryId or sectionId values must be mapped in Resolve or corrected in the source file
There is no automatic fallback to a default category such as Misc or Review
You may use Create missing locations for this package as an explicit workspace setup step when offered — that is separate from the import write

Confirm import stays blocked until mappings and blockers are resolved.

Duplicate handling

Duplicates are skipped, never merged
Existing workspace rows are not overwritten
Workflow re-import skips when source key or name matches an existing workflow
Confirm import may require acknowledgements for duplicates, no-overwrite rules, and workflow embedded-content boundaries

Export overview

Export availability depends on two separate checks:

Item export policy — where the content came from (provenance)
Export entitlement — whether your workspace has the product feature for that export type

Having one does not guarantee the other. During closed beta, export entitlement may require a grant or override — this is not live production billing.

See Export policy for the provenance matrix and user-facing rules.

Marketplace install vs user import

	Marketplace install	User import (Import Center)
Source	Server-published Marketplace listing	File you upload
Trust model	Server-side trusted copy after editorial review	Always untrusted until you validate and confirm
Typical use	Curated starter or operational packs	Your own exports, migrations, third-party JSON
Export policy	Often restricted by provenance	User-created/imported provenance may be exportable if policy allows
Learn more	Marketplace	This page

Never treat Marketplace install and Import Center upload as the same security boundary.

Current

Import Center with analyze, review, resolve, preview, confirm, and results
WorkCheats Package v1 validation with forbidden-key scanning
Export of supported content types where export policy and export entitlement both allow
Clear separation from Marketplace curated install

Roadmap

The following are not available yet:

Bulk import scheduling and automated sync from external repos
Fine-grained per-organisation export policy UI
Import from non-package formats

See Troubleshooting for common import errors.