storebase-cli 1.0.0 → 1.1.0

package/lib/publisher-token.js

@@ -0,0 +1,58 @@
+'use strict';
+const { stdin, stdout } = require('node:process');
+const TOKEN_PATTERN = /^[A-Za-z0-9_-]{32,256}$/;
+
+function fail(message) {
+  throw new Error(message);
+}
+
+function readHiddenToken(input = stdin, output = stdout) {
+  if (!input.isTTY || typeof input.setRawMode !== 'function' || !output.isTTY) {
+    return Promise.reject(new Error('Set STOREBASE_GATEWAY_PUBLISH_TOKEN in the environment for non-interactive use.'));
+  }
+  return new Promise((resolve, reject) => {
+    let value = '';
+    let finished = false;
+    const cleanup = () => {
+      input.removeListener('data', onData);
+      try { input.setRawMode(false); } catch {}
+      input.pause();
+      output.write('\n');
+    };
+    const finish = (error) => {
+      if (finished) return;
+      finished = true;
+      cleanup();
+      if (error) reject(error);
+      else resolve(value);
+    };
+    const onData = (chunk) => {
+      for (const character of String(chunk)) {
+        if (character === '\u0003') return finish(new Error('Cancelled.'));
+        if (character === '\r' || character === '\n') return finish();
+        if (character === '\u007f' || character === '\b') value = value.slice(0, -1);
+        else if (character >= ' ' && value.length < 256) value += character;
+      }
+    };
+    output.write('StoreBase gateway publisher key (input hidden): ');
+    input.setRawMode(true);
+    input.setEncoding('utf8');
+    input.resume();
+    input.on('data', onData);
+  });
+}
+
+async function getPublisherEnvironment(env = process.env, input = stdin, output = stdout) {
+  let token = env.STOREBASE_GATEWAY_PUBLISH_TOKEN;
+  if (token === undefined || token === '') token = await readHiddenToken(input, output);
+  if (typeof token !== 'string' || !TOKEN_PATTERN.test(token)) {
+    fail('STOREBASE_GATEWAY_PUBLISH_TOKEN must be a high-entropy 32–256 character token using letters, numbers, underscores, or hyphens.');
+  }
+  const runtimeEnv = { STOREBASE_GATEWAY_PUBLISH_TOKEN: token };
+  if (typeof env.STOREBASE_GATEWAY_URL === 'string' && env.STOREBASE_GATEWAY_URL) {
+    runtimeEnv.STOREBASE_GATEWAY_URL = env.STOREBASE_GATEWAY_URL;
+  }
+  return runtimeEnv;
+}
+
+module.exports = { TOKEN_PATTERN, getPublisherEnvironment, readHiddenToken };

package/lib/publisher.js

@@ -89,6 +89,23 @@ async function validateInput(raw, options = {}) {
   if (!/^[A-Za-z0-9][A-Za-z0-9.+_-]{0,63}$/.test(version)) {
     fail('Version is required and must be 1–64 safe characters (letters, numbers, dot, plus, underscore, or hyphen).');
   }
+  const id = slugify(name);
+  const androidVersionCode = raw.androidVersionCode === undefined || raw.androidVersionCode === ''
+    ? undefined : Number(raw.androidVersionCode);
+  const minimumAndroidVersionCode = raw.minimumAndroidVersionCode === undefined || raw.minimumAndroidVersionCode === ''
+    ? 0 : Number(raw.minimumAndroidVersionCode);
+  if (id === 'storebase' && !Number.isSafeInteger(androidVersionCode)) {
+    fail('StoreBase Telegram releases require --android-version-code.');
+  }
+  if (id !== 'storebase' && androidVersionCode !== undefined) {
+    fail('Android updater version metadata is reserved for the StoreBase app ID.');
+  }
+  if ((androidVersionCode !== undefined && (!Number.isSafeInteger(androidVersionCode) || androidVersionCode <= 0 || androidVersionCode > 2147483647))
+      || !Number.isSafeInteger(minimumAndroidVersionCode) || minimumAndroidVersionCode < 0
+      || (androidVersionCode === undefined && minimumAndroidVersionCode !== 0)
+      || (androidVersionCode !== undefined && minimumAndroidVersionCode > androidVersionCode)) {
+    fail('Android version codes must be valid positive integers and the minimum cannot exceed the release code.');
+  }
 
   const description = typeof raw.description === 'string' ? raw.description.trim() : '';
   if (!description) fail('Description is required.');
@@ -110,10 +127,34 @@ async function validateInput(raw, options = {}) {
   } finally {
     await apkHandle.close();
   }
+  let deltaPath;
+  let deltaBaseVersionCode;
+  if (raw.delta) {
+    if (id !== 'storebase') fail('Telegram delta artifacts are currently supported only for the StoreBase Android app.');
+    if (!Number.isSafeInteger(androidVersionCode)) fail('A StoreBase delta requires --android-version-code.');
+    deltaBaseVersionCode = Number(raw.deltaBaseVersionCode);
+    if (!Number.isSafeInteger(deltaBaseVersionCode) || deltaBaseVersionCode <= 0 || deltaBaseVersionCode >= androidVersionCode) {
+      fail('--delta-base-version-code must be a positive version lower than --android-version-code.');
+    }
+    deltaPath = await requireFile(raw.delta, 'Delta patch file', cwd);
+    if (path.extname(deltaPath).toLowerCase() !== '.sbd') fail('Delta patch file must have the .sbd extension.');
+    const patchFile = await require('node:fs/promises').open(deltaPath, 'r');
+    try {
+      const patchHeader = Buffer.alloc(2);
+      const { bytesRead } = await patchFile.read(patchHeader, 0, 2, 0);
+      if (bytesRead !== 2 || patchHeader[0] !== 0x1f || patchHeader[1] !== 0x8b) {
+        fail('Delta patch must be a gzip-compressed SBD file.');
+      }
+    } finally {
+      await patchFile.close();
+    }
+  } else if (raw.deltaBaseVersionCode !== undefined && raw.deltaBaseVersionCode !== '') {
+    fail('--delta-base-version-code requires --delta.');
+  }
   const keystorePath = await requireFile(raw.keystore, 'Signed keystore file', cwd);
 
   return {
-    id: slugify(name),
+    id,
     name,
     avatarPath,
     avatarExtension,
@@ -123,6 +164,10 @@ async function validateInput(raw, options = {}) {
     description,
     keystorePath,
     alias: typeof raw.alias === 'string' && raw.alias.trim() ? raw.alias.trim() : undefined,
+    androidVersionCode,
+    minimumAndroidVersionCode,
+    deltaPath,
+    deltaBaseVersionCode,
   };
 }
 

package/lib/telegram-client.js

@@ -0,0 +1,178 @@
+'use strict';
+
+function fail(message) {
+  throw new Error(message);
+}
+
+function readTelegramConfig(env = process.env, options = {}) {
+  const apiIdText = env.STOREBASE_TELEGRAM_API_ID;
+  const apiHash = env.STOREBASE_TELEGRAM_API_HASH;
+  const botToken = env.STOREBASE_TELEGRAM_BOT_TOKEN;
+  const session = env.STOREBASE_TELEGRAM_SESSION || '';
+  const readSession = env.STOREBASE_TELEGRAM_READ_SESSION || '';
+  const channelValue = env.STOREBASE_TELEGRAM_CHANNEL;
+  const apiId = Number(apiIdText);
+
+  if (!apiIdText || !Number.isSafeInteger(apiId) || apiId <= 0) {
+    fail('Set STOREBASE_TELEGRAM_API_ID to the Telegram application API ID.');
+  }
+  if (typeof apiHash !== 'string' || !apiHash.trim()) {
+    fail('Set STOREBASE_TELEGRAM_API_HASH to the Telegram application API hash.');
+  }
+  if (options.requireChannel !== false && (!channelValue || !String(channelValue).trim())) {
+    fail('Set STOREBASE_TELEGRAM_CHANNEL to the target channel username (for example @StoreBaseApps) or channel ID.');
+  }
+  if (!session && !botToken) {
+    fail('Set STOREBASE_TELEGRAM_BOT_TOKEN for initial MTProto bot authorization, or provide an authorized STOREBASE_TELEGRAM_SESSION.');
+  }
+  if (options.requireReader !== false && !readSession) {
+    fail('Set STOREBASE_TELEGRAM_READ_SESSION to an authorized personal MTProto StringSession with read access to the channel. Telegram bots cannot read channel history.');
+  }
+
+  return {
+    apiId,
+    apiHash: apiHash.trim(),
+    botToken: botToken?.trim(),
+    session,
+    readSession,
+    channel: channelValue ? String(channelValue).trim() : undefined,
+  };
+}
+
+function createClient(StringSession, TelegramClient, session, config) {
+  return new TelegramClient(new StringSession(session), config.apiId, config.apiHash, {
+    connectionRetries: 5,
+    autoReconnect: true,
+  });
+}
+
+function requireBroadcastChannel(entity, label) {
+  if (!entity || entity.className !== 'Channel' || entity.broadcast !== true) {
+    fail(`${label} must resolve to a Telegram broadcast channel.`);
+  }
+}
+
+async function disconnectTelegram(connection) {
+  if (!connection) return;
+  const clients = [...new Set([connection.client, connection.readerClient].filter(Boolean))];
+  await Promise.allSettled(clients.map((client) => client.disconnect()));
+}
+
+async function disconnectTelegramReader(connection) {
+  if (!connection?.client) return;
+  await Promise.allSettled([connection.client.disconnect()]);
+}
+
+function readTelegramReaderConfig(env = process.env) {
+  const apiIdText = env.STOREBASE_TELEGRAM_API_ID;
+  const apiHash = env.STOREBASE_TELEGRAM_API_HASH;
+  const readSession = env.STOREBASE_TELEGRAM_READ_SESSION;
+  const channelValue = env.STOREBASE_TELEGRAM_CHANNEL;
+  const apiId = Number(apiIdText);
+  if (!apiIdText || !Number.isSafeInteger(apiId) || apiId <= 0) {
+    fail('Set STOREBASE_TELEGRAM_API_ID to the Telegram application API ID.');
+  }
+  if (typeof apiHash !== 'string' || !apiHash.trim()) {
+    fail('Set STOREBASE_TELEGRAM_API_HASH to the Telegram application API hash.');
+  }
+  if (typeof readSession !== 'string' || !readSession.trim()) {
+    fail('Set STOREBASE_TELEGRAM_READ_SESSION to an authorized personal MTProto StringSession with read access to the channel.');
+  }
+  if (!channelValue || !String(channelValue).trim()) {
+    fail('Set STOREBASE_TELEGRAM_CHANNEL to the target channel username or channel ID.');
+  }
+  return { apiId, apiHash: apiHash.trim(), readSession: readSession.trim(), channel: String(channelValue).trim() };
+}
+
+async function connectTelegramReader(env = process.env) {
+  const config = readTelegramReaderConfig(env);
+  const { TelegramClient } = require('teleproto');
+  const { StringSession } = require('teleproto/sessions');
+  const client = createClient(StringSession, TelegramClient, config.readSession, config);
+  try {
+    await client.connect();
+    if (!await client.checkAuthorization()) {
+      fail('STOREBASE_TELEGRAM_READ_SESSION is not authorized. Supply a valid user StringSession with access to the StoreBase channel.');
+    }
+    if (typeof client.isBot === 'function' && await client.isBot()) {
+      fail('STOREBASE_TELEGRAM_READ_SESSION must be a personal user session. Bot sessions cannot read channel history.');
+    }
+    const channelEntity = await client.getEntity(config.channel);
+    requireBroadcastChannel(channelEntity, 'STOREBASE_TELEGRAM_CHANNEL as seen by the reader session');
+    await client.getMessages(channelEntity, { limit: 1 });
+    return { client, channelEntity, channel: config.channel };
+  } catch (error) {
+    await disconnectTelegramReader({ client });
+    throw error;
+  }
+}
+
+async function connectTelegram(env = process.env, options = {}) {
+  const config = readTelegramConfig(env, options);
+  const { TelegramClient } = require('teleproto');
+  const { StringSession } = require('teleproto/sessions');
+  const client = createClient(StringSession, TelegramClient, config.session, config);
+  let readerClient;
+
+  try {
+    if (config.session) {
+      await client.connect();
+      const authorized = await client.checkAuthorization();
+      if (!authorized) {
+        if (!config.botToken) fail('The saved Telegram bot session is not authorized. Set STOREBASE_TELEGRAM_BOT_TOKEN to authenticate it again.');
+        await client.start({ botAuthToken: config.botToken });
+      }
+    } else {
+      await client.start({ botAuthToken: config.botToken });
+    }
+
+    if (typeof client.isBot === 'function' && !await client.isBot()) {
+      fail('STOREBASE_TELEGRAM_SESSION must belong to the StoreBase admin bot; use STOREBASE_TELEGRAM_READ_SESSION for a personal user session.');
+    }
+    const channelEntity = config.channel ? await client.getEntity(config.channel) : undefined;
+    if (config.channel) requireBroadcastChannel(channelEntity, 'STOREBASE_TELEGRAM_CHANNEL');
+
+    let readerChannel;
+    if (options.requireReader !== false) {
+      readerClient = createClient(StringSession, TelegramClient, config.readSession, config);
+      await readerClient.connect();
+      if (!await readerClient.checkAuthorization()) {
+        fail('STOREBASE_TELEGRAM_READ_SESSION is not authorized. Supply a valid user StringSession with access to the StoreBase channel.');
+      }
+      if (typeof readerClient.isBot === 'function' && await readerClient.isBot()) {
+        fail('STOREBASE_TELEGRAM_READ_SESSION must be a personal user session. Bot sessions cannot read channel history.');
+      }
+      readerChannel = await readerClient.getEntity(config.channel);
+      requireBroadcastChannel(readerChannel, 'STOREBASE_TELEGRAM_CHANNEL as seen by the reader session');
+      if (String(readerChannel.id) !== String(channelEntity.id)) {
+        fail('The bot and reader sessions resolved STOREBASE_TELEGRAM_CHANNEL to different channels.');
+      }
+      // Bot accounts are barred from reading channel history; a personal MTProto session
+      // performs this read-only check and handles catalog listing and artifact retrieval.
+      await readerClient.getMessages(readerChannel, { limit: 1 });
+    }
+
+    return {
+      client,
+      readerClient,
+      channelEntity,
+      readerChannel,
+      channel: config.channel,
+      session: client.session.save(),
+      readSession: config.readSession,
+      hasStoredSession: Boolean(config.session),
+    };
+  } catch (error) {
+    await disconnectTelegram({ client, readerClient });
+    throw error;
+  }
+}
+
+module.exports = {
+  connectTelegram,
+  connectTelegramReader,
+  disconnectTelegram,
+  disconnectTelegramReader,
+  readTelegramConfig,
+  readTelegramReaderConfig,
+};