storebase-cli 1.0.0 → 1.2.0

package/lib/gateway-client.js

@@ -0,0 +1,259 @@
+'use strict';
+
+const {
+  createDecipheriv,
+  generateKeyPairSync,
+  privateDecrypt,
+  constants,
+  sign,
+  randomUUID,
+} = require('node:crypto');
+
+const PROTOCOL = 'STOREBASE_GATEWAY_V1';
+const APP_ID = 'com.nexuss0781.storebase';
+const CATALOG_BOOTSTRAP_PATH = '/api/v1/catalog/bootstrap';
+const PUBLISHER_BOOTSTRAP_PATH = '/api/v1/publisher/bootstrap';
+const TOKEN_PATTERN = /^[A-Za-z0-9_-]{32,256}$/;
+const MAX_RESPONSE_BYTES = 2 * 1024 * 1024 + 64 * 1024;
+
+function fail(message) {
+  throw new Error(message);
+}
+
+function base64Bytes(value, label, maxBytes) {
+  if (typeof value !== 'string' || !value || value.length > Math.ceil(maxBytes * 4 / 3) + 8) {
+    fail(`Gateway response has an invalid ${label}.`);
+  }
+  const decoded = Buffer.from(value, 'base64');
+  if (!decoded.length || decoded.length > maxBytes || decoded.toString('base64') !== value) {
+    fail(`Gateway response has an invalid ${label}.`);
+  }
+  return decoded;
+}
+
+function canonicalRequest({ appId, requestId, timestamp, publicKey, publishToken, path }) {
+  const fields = [PROTOCOL, 'POST', path, appId, requestId, String(timestamp), publicKey];
+  if (path === PUBLISHER_BOOTSTRAP_PATH) fields.push(publishToken || '');
+  return fields.join('\n');
+}
+
+function canonicalPublisherRequest(request) {
+  return canonicalRequest({ ...request, path: PUBLISHER_BOOTSTRAP_PATH });
+}
+
+function envelopeAad(envelope) {
+  return [PROTOCOL, APP_ID, envelope.requestId, envelope.issuedAt].join('\n');
+}
+
+function validateCatalogSettings(settings) {
+  const telegram = settings?.telegram;
+  if (!settings || settings.schemaVersion !== 1 || settings.settingsVersion !== 1
+      || !telegram || !Number.isSafeInteger(telegram.apiId) || telegram.apiId <= 0
+      || typeof telegram.apiHash !== 'string' || !telegram.apiHash
+      || typeof telegram.readSession !== 'string' || !telegram.readSession
+      || typeof telegram.channel !== 'string' || !telegram.channel.trim()
+      || Object.hasOwn(telegram, 'botSession') || Object.hasOwn(telegram, 'botToken')) {
+    fail('Gateway returned invalid read-only Telegram settings.');
+  }
+  return settings;
+}
+
+function validatePublisherSettings(settings) {
+  const telegram = settings?.telegram;
+  if (!settings || settings.schemaVersion !== 1 || settings.settingsVersion !== 1
+      || !telegram || !Number.isSafeInteger(telegram.apiId) || telegram.apiId <= 0
+      || typeof telegram.apiHash !== 'string' || !telegram.apiHash
+      || typeof telegram.botSession !== 'string' || !telegram.botSession
+      || typeof telegram.readSession !== 'string' || !telegram.readSession
+      || typeof telegram.channel !== 'string' || !telegram.channel.trim()
+      || Object.hasOwn(telegram, 'botToken')) {
+    fail('Gateway returned invalid Telegram publisher settings.');
+  }
+  return settings;
+}
+
+function decryptSettings(envelope, privateKey, requestId, validator = validatePublisherSettings) {
+  if (!envelope || envelope.protocol !== PROTOCOL || envelope.appId !== APP_ID
+      || envelope.requestId !== requestId || typeof envelope.issuedAt !== 'string'
+      || envelope.keyWrap !== 'RSA-OAEP-SHA256' || envelope.contentEncryption !== 'AES-256-GCM') {
+    fail('Gateway returned an invalid or mismatched encrypted settings envelope.');
+  }
+  const wrappedKey = base64Bytes(envelope.encryptedKey, 'wrapped key', 16 * 1024);
+  const iv = base64Bytes(envelope.iv, 'initialization vector', 32);
+  const ciphertext = base64Bytes(envelope.ciphertext, 'ciphertext', MAX_RESPONSE_BYTES);
+  const tag = base64Bytes(envelope.tag, 'authentication tag', 32);
+  if (iv.length !== 12 || tag.length !== 16) fail('Gateway returned an invalid encryption envelope.');
+
+  let contentKey;
+  let plaintext;
+  try {
+    contentKey = privateDecrypt({
+      key: privateKey,
+      padding: constants.RSA_PKCS1_OAEP_PADDING,
+      oaepHash: 'sha256',
+    }, wrappedKey);
+    if (contentKey.length !== 32) fail('Gateway returned an invalid content key.');
+    const decipher = createDecipheriv('aes-256-gcm', contentKey, iv);
+    decipher.setAAD(Buffer.from(envelopeAad(envelope), 'utf8'));
+    decipher.setAuthTag(tag);
+    plaintext = Buffer.concat([decipher.update(ciphertext), decipher.final()]);
+    return validator(JSON.parse(plaintext.toString('utf8')));
+  } catch {
+    fail('Could not authenticate or decrypt the gateway settings response.');
+  } finally {
+    contentKey?.fill(0);
+    plaintext?.fill(0);
+    wrappedKey.fill(0);
+    iv.fill(0);
+    ciphertext.fill(0);
+    tag.fill(0);
+  }
+}
+
+function resolveGatewayUrl(env, pathname) {
+  const configured = env.STOREBASE_GATEWAY_URL || 'https://storebase.wasmer.app';
+  let base;
+  try {
+    base = new URL(configured);
+  } catch {
+    fail('STOREBASE_GATEWAY_URL must be a valid HTTPS URL.');
+  }
+  const loopback = ['localhost', '127.0.0.1', '::1', '[::1]'].includes(base.hostname);
+  if ((base.protocol !== 'https:' && !loopback) || base.username || base.password || base.search || base.hash) {
+    fail('STOREBASE_GATEWAY_URL must use HTTPS and must not contain credentials, query parameters, or a fragment.');
+  }
+  return new URL(pathname, base);
+}
+
+async function fetchEncryptedSettings(env, pathname, validator, options = {}) {
+  const publisher = pathname === PUBLISHER_BOOTSTRAP_PATH;
+  const publishToken = publisher ? env.STOREBASE_GATEWAY_PUBLISH_TOKEN : undefined;
+  if (publisher && (typeof publishToken !== 'string' || !TOKEN_PATTERN.test(publishToken))) {
+    fail('Set STOREBASE_GATEWAY_PUBLISH_TOKEN to the high-entropy publisher access token.');
+  }
+  const endpoint = resolveGatewayUrl(env, pathname);
+  const keyPair = generateKeyPairSync('rsa', { modulusLength: 2048 });
+  const publicKey = keyPair.publicKey.export({ format: 'der', type: 'spki' }).toString('base64');
+  const requestId = (options.randomUUID || randomUUID)();
+  const timestamp = (options.now || Date.now)();
+  const unsigned = {
+    appId: APP_ID,
+    requestId,
+    timestamp,
+    publicKey,
+    ...(publisher ? { publishToken } : {}),
+  };
+  const signature = sign(
+    'RSA-SHA256',
+    Buffer.from(canonicalRequest({ ...unsigned, path: pathname }), 'utf8'),
+    keyPair.privateKey,
+  ).toString('base64');
+  const controller = new AbortController();
+  const timeout = setTimeout(() => controller.abort(), options.timeoutMs || 15_000);
+  timeout.unref?.();
+
+  try {
+    const response = await (options.fetch || globalThis.fetch)(endpoint, {
+      method: 'POST',
+      redirect: 'error',
+      signal: controller.signal,
+      headers: { 'content-type': 'application/json', accept: 'application/json' },
+      body: JSON.stringify({ ...unsigned, signature }),
+    });
+    const length = Number(response.headers?.get?.('content-length'));
+    if (Number.isFinite(length) && length > MAX_RESPONSE_BYTES) fail('Gateway response exceeded the allowed size.');
+    if (!response.ok) fail(`Gateway bootstrap failed with HTTP ${response.status}.`);
+    const text = await response.text();
+    if (Buffer.byteLength(text, 'utf8') > MAX_RESPONSE_BYTES) fail('Gateway response exceeded the allowed size.');
+    let envelope;
+    try { envelope = JSON.parse(text); } catch { fail('Gateway returned an invalid response.'); }
+    return decryptSettings(envelope, keyPair.privateKey, requestId, validator);
+  } catch (error) {
+    if (/^Gateway |^Set STOREBASE_|^Could not authenticate|^Gateway response/.test(error.message || '')) throw error;
+    if (error?.name === 'AbortError') fail('Gateway bootstrap timed out.');
+    fail('Could not connect to the StoreBase gateway bootstrap.');
+  } finally {
+    clearTimeout(timeout);
+  }
+}
+
+async function fetchPublisherSettings(env = process.env, options = {}) {
+  return fetchEncryptedSettings(env, PUBLISHER_BOOTSTRAP_PATH, validatePublisherSettings, options);
+}
+
+async function fetchCatalogSettings(env = process.env, options = {}) {
+  return fetchEncryptedSettings(env, CATALOG_BOOTSTRAP_PATH, validateCatalogSettings, options);
+}
+
+function scrubConnectionError(error, runtimeEnv) {
+  let message = String(error?.message || 'Telegram connection failed.');
+  for (const secret of Object.values(runtimeEnv)) {
+    if (secret && secret.length > 8) message = message.split(secret).join('[redacted]');
+  }
+  return new Error(message);
+}
+
+async function connectTelegramFromGateway(env = process.env, options = {}) {
+  const settings = await (options.fetchSettings || fetchPublisherSettings)(env, options);
+  const telegram = settings.telegram;
+  const runtimeEnv = {
+    STOREBASE_TELEGRAM_API_ID: String(telegram.apiId),
+    STOREBASE_TELEGRAM_API_HASH: telegram.apiHash,
+    STOREBASE_TELEGRAM_SESSION: telegram.botSession,
+    STOREBASE_TELEGRAM_READ_SESSION: telegram.readSession,
+    STOREBASE_TELEGRAM_CHANNEL: telegram.channel,
+  };
+  try {
+    const connector = options.connectTelegram || require('./telegram-client').connectTelegram;
+    const connection = await connector(runtimeEnv, { requireReader: true });
+    delete connection.session;
+    delete connection.readSession;
+    delete connection.hasStoredSession;
+    return connection;
+  } catch (error) {
+    throw scrubConnectionError(error, runtimeEnv);
+  } finally {
+    for (const key of Object.keys(runtimeEnv)) runtimeEnv[key] = '';
+    telegram.apiHash = '';
+    telegram.botSession = '';
+    telegram.readSession = '';
+    telegram.channel = '';
+  }
+}
+
+async function connectTelegramReaderFromGateway(env = process.env, options = {}) {
+  const settings = await (options.fetchSettings || fetchCatalogSettings)(env, options);
+  const telegram = settings.telegram;
+  const runtimeEnv = {
+    STOREBASE_TELEGRAM_API_ID: String(telegram.apiId),
+    STOREBASE_TELEGRAM_API_HASH: telegram.apiHash,
+    STOREBASE_TELEGRAM_READ_SESSION: telegram.readSession,
+    STOREBASE_TELEGRAM_CHANNEL: telegram.channel,
+  };
+  try {
+    const connector = options.connectTelegramReader || require('./telegram-client').connectTelegramReader;
+    return await connector(runtimeEnv);
+  } catch (error) {
+    throw scrubConnectionError(error, runtimeEnv);
+  } finally {
+    for (const key of Object.keys(runtimeEnv)) runtimeEnv[key] = '';
+    telegram.apiHash = '';
+    telegram.readSession = '';
+    telegram.channel = '';
+  }
+}
+
+module.exports = {
+  APP_ID,
+  CATALOG_BOOTSTRAP_PATH,
+  PUBLISHER_BOOTSTRAP_PATH,
+  canonicalPublisherRequest,
+  canonicalRequest,
+  connectTelegramFromGateway,
+  connectTelegramReaderFromGateway,
+  decryptSettings,
+  fetchCatalogSettings,
+  fetchPublisherSettings,
+  validateCatalogSettings,
+  validatePublisherSettings,
+};

package/lib/publisher-token.js

@@ -0,0 +1,58 @@
+'use strict';
+const { stdin, stdout } = require('node:process');
+const TOKEN_PATTERN = /^[A-Za-z0-9_-]{32,256}$/;
+
+function fail(message) {
+  throw new Error(message);
+}
+
+function readHiddenToken(input = stdin, output = stdout) {
+  if (!input.isTTY || typeof input.setRawMode !== 'function' || !output.isTTY) {
+    return Promise.reject(new Error('Set STOREBASE_GATEWAY_PUBLISH_TOKEN in the environment for non-interactive use.'));
+  }
+  return new Promise((resolve, reject) => {
+    let value = '';
+    let finished = false;
+    const cleanup = () => {
+      input.removeListener('data', onData);
+      try { input.setRawMode(false); } catch {}
+      input.pause();
+      output.write('\n');
+    };
+    const finish = (error) => {
+      if (finished) return;
+      finished = true;
+      cleanup();
+      if (error) reject(error);
+      else resolve(value);
+    };
+    const onData = (chunk) => {
+      for (const character of String(chunk)) {
+        if (character === '\u0003') return finish(new Error('Cancelled.'));
+        if (character === '\r' || character === '\n') return finish();
+        if (character === '\u007f' || character === '\b') value = value.slice(0, -1);
+        else if (character >= ' ' && value.length < 256) value += character;
+      }
+    };
+    output.write('StoreBase gateway publisher key (input hidden): ');
+    input.setRawMode(true);
+    input.setEncoding('utf8');
+    input.resume();
+    input.on('data', onData);
+  });
+}
+
+async function getPublisherEnvironment(env = process.env, input = stdin, output = stdout) {
+  let token = env.STOREBASE_GATEWAY_PUBLISH_TOKEN;
+  if (token === undefined || token === '') token = await readHiddenToken(input, output);
+  if (typeof token !== 'string' || !TOKEN_PATTERN.test(token)) {
+    fail('STOREBASE_GATEWAY_PUBLISH_TOKEN must be a high-entropy 32–256 character token using letters, numbers, underscores, or hyphens.');
+  }
+  const runtimeEnv = { STOREBASE_GATEWAY_PUBLISH_TOKEN: token };
+  if (typeof env.STOREBASE_GATEWAY_URL === 'string' && env.STOREBASE_GATEWAY_URL) {
+    runtimeEnv.STOREBASE_GATEWAY_URL = env.STOREBASE_GATEWAY_URL;
+  }
+  return runtimeEnv;
+}
+
+module.exports = { TOKEN_PATTERN, getPublisherEnvironment, readHiddenToken };

package/lib/publisher.js

@@ -13,9 +13,6 @@ const { createReadStream } = require('node:fs');
 const { createHash, randomBytes } = require('node:crypto');
 const path = require('node:path');
 const { spawnSync } = require('node:child_process');
-const { createInterface } = require('node:readline/promises');
-const { stdin, stdout } = require('node:process');
-const { tmpdir } = require('node:os');
 
 const CATEGORIES = Object.freeze([
   'Education',
@@ -89,6 +86,23 @@ async function validateInput(raw, options = {}) {
   if (!/^[A-Za-z0-9][A-Za-z0-9.+_-]{0,63}$/.test(version)) {
     fail('Version is required and must be 1–64 safe characters (letters, numbers, dot, plus, underscore, or hyphen).');
   }
+  const id = slugify(name);
+  const androidVersionCode = raw.androidVersionCode === undefined || raw.androidVersionCode === ''
+    ? undefined : Number(raw.androidVersionCode);
+  const minimumAndroidVersionCode = raw.minimumAndroidVersionCode === undefined || raw.minimumAndroidVersionCode === ''
+    ? 0 : Number(raw.minimumAndroidVersionCode);
+  if (id === 'storebase' && !Number.isSafeInteger(androidVersionCode)) {
+    fail('StoreBase Telegram releases require --android-version-code.');
+  }
+  if (id !== 'storebase' && androidVersionCode !== undefined) {
+    fail('Android updater version metadata is reserved for the StoreBase app ID.');
+  }
+  if ((androidVersionCode !== undefined && (!Number.isSafeInteger(androidVersionCode) || androidVersionCode <= 0 || androidVersionCode > 2147483647))
+      || !Number.isSafeInteger(minimumAndroidVersionCode) || minimumAndroidVersionCode < 0
+      || (androidVersionCode === undefined && minimumAndroidVersionCode !== 0)
+      || (androidVersionCode !== undefined && minimumAndroidVersionCode > androidVersionCode)) {
+    fail('Android version codes must be valid positive integers and the minimum cannot exceed the release code.');
+  }
 
   const description = typeof raw.description === 'string' ? raw.description.trim() : '';
   if (!description) fail('Description is required.');
@@ -110,10 +124,35 @@ async function validateInput(raw, options = {}) {
   } finally {
     await apkHandle.close();
   }
-  const keystorePath = await requireFile(raw.keystore, 'Signed keystore file', cwd);
+  let deltaPath;
+  let deltaBaseVersionCode;
+  if (raw.delta) {
+    if (id !== 'storebase') fail('Telegram delta artifacts are currently supported only for the StoreBase Android app.');
+    if (!Number.isSafeInteger(androidVersionCode)) fail('A StoreBase delta requires --android-version-code.');
+    deltaBaseVersionCode = Number(raw.deltaBaseVersionCode);
+    if (!Number.isSafeInteger(deltaBaseVersionCode) || deltaBaseVersionCode <= 0 || deltaBaseVersionCode >= androidVersionCode) {
+      fail('--delta-base-version-code must be a positive version lower than --android-version-code.');
+    }
+    deltaPath = await requireFile(raw.delta, 'Delta patch file', cwd);
+    if (path.extname(deltaPath).toLowerCase() !== '.sbd') fail('Delta patch file must have the .sbd extension.');
+    const patchFile = await require('node:fs/promises').open(deltaPath, 'r');
+    try {
+      const patchHeader = Buffer.alloc(2);
+      const { bytesRead } = await patchFile.read(patchHeader, 0, 2, 0);
+      if (bytesRead !== 2 || patchHeader[0] !== 0x1f || patchHeader[1] !== 0x8b) {
+        fail('Delta patch must be a gzip-compressed SBD file.');
+      }
+    } finally {
+      await patchFile.close();
+    }
+  } else if (raw.deltaBaseVersionCode !== undefined && raw.deltaBaseVersionCode !== '') {
+    fail('--delta-base-version-code requires --delta.');
+  }
+  if (options.signingProfile && (!/^[A-F0-9]{64}$/.test(options.signingProfile.fingerprint) || typeof options.signingProfile.alias !== 'string' || !options.signingProfile.alias)) fail('Invalid signing profile certificate.');
+  const keystorePath = options.signingProfile ? undefined : await requireFile(raw.keystore, 'Signed keystore file', cwd);
 
   return {
-    id: slugify(name),
+    id,
     name,
     avatarPath,
     avatarExtension,
@@ -123,6 +162,10 @@ async function validateInput(raw, options = {}) {
     description,
     keystorePath,
     alias: typeof raw.alias === 'string' && raw.alias.trim() ? raw.alias.trim() : undefined,
+    androidVersionCode,
+    minimumAndroidVersionCode,
+    deltaPath,
+    deltaBaseVersionCode,
   };
 }
 
@@ -159,35 +202,31 @@ function parseApkSignerFingerprints(output) {
 }
 
 async function inspectKeystore(keystorePath, password) {
-  if (typeof password !== 'string') fail('A keystore password is required to verify the signing certificate.');
-  if (password.includes('\n') || password.includes('\r')) fail('Keystore passwords cannot contain line breaks.');
-  const fs = require('node:fs');
-  const folder = await require('node:fs/promises').mkdtemp(path.join(tmpdir(), 'storebase-keystore-'));
-  const passwordFile = path.join(folder, 'password');
+  if (typeof password !== 'string' || /[\r\n\0]/.test(password)) fail('A valid keystore password is required.');
   try {
-    await writeFile(passwordFile, `${password}\n`, { mode: 0o600, flag: 'wx' });
     const output = runTool('keytool', [
-      '-J-Duser.language=en',
-      '-J-Duser.country=US',
-      '-list',
-      '-v',
-      '-keystore',
-      keystorePath,
-      '-storepass:file',
-      passwordFile,
-    ]);
+      '-J-Duser.language=en', '-J-Duser.country=US', '-list', '-v',
+      '-keystore', keystorePath, '-storepass:env', 'STOREBASE_KEYTOOL_STORE_PASSWORD',
+    ], { env: { ...process.env, LC_ALL: 'C', LANG: 'C', STOREBASE_KEYTOOL_STORE_PASSWORD: password } });
     const entries = parseKeystoreEntries(output);
-    if (!entries.length) fail('The keystore has no readable private-key entry with a SHA-256 certificate.');
+    if (!entries.length) fail('No private-key certificate found.');
     return entries;
-  } finally {
-    // Best-effort overwrite before removal; the temporary directory is private (0700).
-    try {
-      const fd = fs.openSync(passwordFile, 'r+');
-      const size = fs.fstatSync(fd).size;
-      fs.writeSync(fd, Buffer.alloc(size));
-      fs.closeSync(fd);
-    } catch {}
-    await rm(folder, { recursive: true, force: true });
+  } catch {
+    fail('Could not inspect keystore. Check the password, file format, and Java keytool installation.');
+  }
+}
+
+async function verifyKeystoreKeyPassword(keystorePath, storePassword, alias, keyPassword) {
+  if (typeof keyPassword !== 'string' || /[\r\n\0]/.test(keyPassword)) fail('A valid private-key password is required.');
+  try {
+    runTool('keytool', [
+      '-J-Duser.language=en', '-J-Duser.country=US', '-certreq', '-keystore', keystorePath,
+      '-alias', alias, '-storepass:env', 'STOREBASE_KEYTOOL_STORE_PASSWORD',
+      '-keypass:env', 'STOREBASE_KEYTOOL_KEY_PASSWORD',
+    ], { env: { ...process.env, LC_ALL: 'C', LANG: 'C', STOREBASE_KEYTOOL_STORE_PASSWORD: storePassword,
+      STOREBASE_KEYTOOL_KEY_PASSWORD: keyPassword } });
+  } catch {
+    fail('Could not unlock the private key. Check its password and alias.');
   }
 }
 
@@ -345,4 +384,5 @@ module.exports = {
   validateInput,
   verifyApkSignature,
   inspectKeystore,
+  verifyKeystoreKeyPassword,
 };

package/lib/secure-prompt.js

@@ -0,0 +1,60 @@
+'use strict';
+const { stdin, stdout } = require('node:process');
+const { createInterface } = require('node:readline/promises');
+
+function hidden(label, input = stdin, output = stdout) {
+  if (!input.isTTY || !output.isTTY || typeof input.setRawMode !== 'function') {
+    return Promise.reject(new Error('Signing secrets require an interactive terminal; no password arguments or project files are accepted.'));
+  }
+  return new Promise((resolve, reject) => {
+    let value = '';
+    let done = false;
+    const wasRaw = Boolean(input.isRaw);
+    const finish = (error) => {
+      if (done) return;
+      done = true;
+      input.removeListener('data', onData);
+      input.removeListener('end', onEnd);
+      input.removeListener('error', onEnd);
+      try { input.setRawMode(wasRaw); } catch {}
+      input.pause();
+      output.write('\n');
+      const result = value;
+      value = '';
+      if (error) reject(error); else resolve(result);
+    };
+    const onEnd = () => finish(new Error('Secret input cancelled.'));
+    const onData = (chunk) => {
+      for (const ch of String(chunk)) {
+        if (ch === '\u0003' || ch === '\u0004') return onEnd();
+        if (ch === '\r' || ch === '\n') return finish();
+        if (ch === '\u007f' || ch === '\b') value = [...value].slice(0, -1).join('');
+        else if (ch >= ' ' && ch !== '\u001b') {
+          if (value.length >= 4096) return finish(new Error('Secret input is too long.'));
+          value += ch;
+        }
+      }
+    };
+    output.write(`${label} (input hidden): `);
+    input.setEncoding('utf8');
+    input.on('data', onData);
+    input.once('end', onEnd);
+    input.once('error', onEnd);
+    try { input.setRawMode(true); input.resume(); } catch { onEnd(); }
+  });
+}
+
+async function question(label) {
+  if (!stdin.isTTY || !stdout.isTTY) throw new Error('This operation requires an interactive terminal.');
+  const rl = createInterface({ input: stdin, output: stdout });
+  try { return (await rl.question(label)).trim(); } finally { rl.close(); }
+}
+
+async function newPassphrase() {
+  const passphrase = await hidden('New vault passphrase (at least 12 characters)');
+  if ([...passphrase].length < 12) throw new Error('Vault passphrase must be at least 12 characters.');
+  const confirm = await hidden('Confirm vault passphrase');
+  if (passphrase !== confirm) throw new Error('Vault passphrases do not match.');
+  return passphrase;
+}
+module.exports = { hidden, question, newPassphrase };

package/lib/signing-profiles.js

@@ -0,0 +1,83 @@
+'use strict';
+const fs = require('node:fs/promises');
+const path = require('node:path');
+const os = require('node:os');
+const { inspectKeystore, verifyKeystoreKeyPassword } = require('./publisher');
+
+function profileName(value) {
+  if (typeof value !== 'string' || !/^[a-zA-Z0-9][a-zA-Z0-9_-]{0,63}$/.test(value)) {
+    throw new Error('Profile names must be 1–64 letters, numbers, underscores, or hyphens.');
+  }
+  if (['__proto__', 'constructor', 'prototype'].includes(value)) throw new Error('Reserved profile name.');
+  return value;
+}
+
+async function importProfile(file, storePassword, keyPassword, alias, options = {}) {
+  const handle = await fs.open(path.resolve(file), 'r');
+  let bytes;
+  let folder;
+  try {
+    const info = await handle.stat();
+    if (!info.isFile() || info.size < 1 || info.size > 8 * 1024 * 1024) throw new Error('Keystore must be a non-empty file of at most 8 MiB.');
+    const bounded = Buffer.alloc(8 * 1024 * 1024 + 1);
+    let count = 0;
+    try {
+      while (count < bounded.length) {
+        const { bytesRead } = await handle.read(bounded, count, bounded.length - count, null);
+        if (!bytesRead) break;
+        count += bytesRead;
+      }
+      if (count > 8 * 1024 * 1024) throw new Error('Keystore exceeds the size limit.');
+      if (!count) throw new Error('Keystore is empty.');
+      bytes = Buffer.from(bounded.subarray(0, count));
+    } finally { bounded.fill(0); }
+    folder = await fs.mkdtemp(path.join(os.tmpdir(), 'storebase-signing-import-'));
+    await fs.chmod(folder, 0o700);
+    const temporary = path.join(folder, 'keystore');
+    await fs.writeFile(temporary, bytes, { mode: 0o600, flag: 'wx' });
+    const entries = await (options.inspect || inspectKeystore)(temporary, storePassword);
+    let selected;
+    if (alias) selected = entries.find((entry) => entry.alias === alias);
+    else if (entries.length === 1) selected = entries[0];
+    if (!selected) throw new Error('Choose a valid private-key alias with --alias (required for multiple entries).');
+    await (options.verify || verifyKeystoreKeyPassword)(temporary, storePassword, selected.alias, keyPassword);
+    return { keystore: bytes.toString('base64'), storePassword, keyPassword,
+      alias: selected.alias, fingerprint: selected.fingerprint };
+  } finally {
+    await handle.close();
+    if (folder) {
+      try {
+        const file = path.join(folder, 'keystore');
+        const handle = await fs.open(file, 'r+');
+        try { await handle.write(Buffer.alloc(bytes?.length || 0), 0, bytes?.length || 0, 0); } finally { await handle.close(); }
+      } catch {}
+      await fs.rm(folder, { recursive: true, force: true });
+    }
+    bytes?.fill(0);
+  }
+}
+
+function entryForProfile(data, name) {
+  profileName(name);
+  if (!Object.hasOwn(data.profiles, name)) throw new Error('Signing profile not found. Import it with storebase-keystore import.');
+  const profile = data.profiles[name];
+  // Publishing only needs the certificate verified at import time, not a plaintext private key.
+  return { alias: profile.alias, fingerprint: profile.fingerprint };
+}
+
+function clearProfiles(data) {
+  if (!data?.profiles) return;
+  for (const profile of Object.values(data.profiles)) {
+    profile.keystore = ''; profile.storePassword = ''; profile.keyPassword = '';
+  }
+}
+async function loadProfileEntry(name, options = {}) {
+  profileName(name);
+  const vault = options.vault || new (require('./signing-vault').SigningVault)();
+  const prompt = options.prompt || require('./secure-prompt').hidden;
+  let passphrase = await prompt('Vault passphrase');
+  let data;
+  try { data = await vault.read(passphrase); return entryForProfile(data, name); }
+  finally { passphrase = ''; clearProfiles(data); }
+}
+module.exports = { profileName, importProfile, entryForProfile, clearProfiles, loadProfileEntry };