fix: harden profile imports and release dependencies

internal/storage/storage_test.go

@@ -561,9 +561,7 @@ func TestImportDuplicateHandling(t *testing.T) {
 
 func TestImportInvalidStrategy(t *testing.T) {
 	store := setupTestStore(t)
-	// The strategy check is inside the per-profile loop, so we need at least
-	// one profile in the import data for it to trigger.
-	data := []byte(`[{"id":"x","displayName":"X","protocol":"ssh","host":"h","port":22,"tags":[],"createdAt":"2024-01-01T00:00:00Z","updatedAt":"2024-01-01T00:00:00Z"}]`)
+	data := []byte(`[]`)
 	_, err := store.ImportProfiles(data, "badstrategy")
 	if err == nil {
 		t.Error("expected error for invalid import strategy")
@@ -578,6 +576,17 @@ func TestImportInvalidJSON(t *testing.T) {
 	}
 }
 
+func TestImportRejectsNullProfileEntry(t *testing.T) {
+	store := setupTestStore(t)
+	_, err := store.ImportProfiles([]byte(`[null]`), "skip")
+	if err == nil {
+		t.Fatal("expected error for null profile entry")
+	}
+	if !strings.Contains(err.Error(), "entry 0 is null") {
+		t.Fatalf("error = %q, want null entry detail", err.Error())
+	}
+}
+
 // ---------------------------------------------------------------------------
 // Migration idempotency
 // ---------------------------------------------------------------------------

internal/storage/store.go

@@ -363,13 +363,23 @@ func (s *Store) ExportProfiles(includeSecrets bool) ([]byte, error) {
 // and "duplicate" creates new entries with fresh IDs. Returns the number of
 // profiles imported.
 func (s *Store) ImportProfiles(data []byte, strategy string) (int, error) {
+	switch strategy {
+	case "skip", "overwrite", "duplicate":
+	default:
+		return 0, fmt.Errorf("storage: unknown import strategy %q", strategy)
+	}
+
 	var profiles []*models.Profile
 	if err := json.Unmarshal(data, &profiles); err != nil {
 		return 0, fmt.Errorf("storage: invalid import data: %w", err)
 	}
 
 	imported := 0
-	for _, p := range profiles {
+	for i, p := range profiles {
+		if p == nil {
+			return imported, fmt.Errorf("storage: import profile entry %d is null", i)
+		}
+
 		existing, _ := s.GetProfile(p.ID)
 
 		switch strategy {
@@ -391,8 +401,6 @@ func (s *Store) ImportProfiles(data []byte, strategy string) (int, error) {
 				p.CreatedAt = time.Now()
 				p.UpdatedAt = time.Now()
 			}
-		default:
-			return 0, fmt.Errorf("storage: unknown import strategy %q", strategy)
 		}
 
 		if err := s.CreateProfile(p); err != nil {