@wpelevator/wp-release 0.12.0 → 0.14.0

package/dist/file-selection.d.ts

@@ -82,3 +82,24 @@ export declare function isErrorCode(error: unknown, code: string): boolean;
  * @throws {ValidationError} For selected symbolic links, which ZIP archives and WordPress.org SVN don't support.
  */
 export declare function selectFiles(sourceDir: string, rules: FileRules): Promise<string[]>;
+/**
+ * Ignore a file that a command writes or reads, such as the checksums
+ * manifest, when it's inside the selected directory.
+ *
+ * @param rules     Matcher from loadFileRules().
+ * @param sourceDir Selected directory.
+ * @param path      Absolute file path.
+ * @return The same matcher.
+ */
+export declare function ignoreOwnFile(rules: FileRules, sourceDir: string, path: string): FileRules;
+/**
+ * Ignore the signature files of every format that "wp-release sign" writes
+ * next to a file a command writes, when they're inside the selected
+ * directory.
+ *
+ * @param rules     Matcher from loadFileRules().
+ * @param sourceDir Selected directory.
+ * @param path      Absolute path of the signed file.
+ * @return The same matcher.
+ */
+export declare function ignoreOwnSignature(rules: FileRules, sourceDir: string, path: string): FileRules;

package/dist/file-selection.js

@@ -3,6 +3,7 @@ import { isAbsolute, join, posix, relative, resolve } from 'node:path';
 import ignore from 'ignore';
 import { ValidationError } from "./errors.js";
 import { createGitRunner } from "./git.js";
+import { SIGNATURE_FORMATS } from "./signing.js";
 export const DISTIGNORE_FILENAME = '.distignore';
 /**
  * Version control metadata that is never released, at any depth. Without
@@ -227,3 +228,37 @@ async function findEntryFiles(sourceDir, path, entry, rules) {
     }
     return [];
 }
+/**
+ * Ignore a file that a command writes or reads, such as the checksums
+ * manifest, when it's inside the selected directory.
+ *
+ * @param rules     Matcher from loadFileRules().
+ * @param sourceDir Selected directory.
+ * @param path      Absolute file path.
+ * @return The same matcher.
+ */
+export function ignoreOwnFile(rules, sourceDir, path) {
+    const relativePath = relative(sourceDir, path).split('\\').join('/');
+    const isInside = relativePath &&
+        '..' !== relativePath &&
+        !relativePath.startsWith('../') &&
+        !isAbsolute(relativePath);
+    if (isInside) {
+        // Escape the gitignore wildcards so that the pattern matches only this file.
+        rules.add(`/${relativePath.replace(/[\\*?[\]!#]/g, '\\$&')}`);
+    }
+    return rules;
+}
+/**
+ * Ignore the signature files of every format that "wp-release sign" writes
+ * next to a file a command writes, when they're inside the selected
+ * directory.
+ *
+ * @param rules     Matcher from loadFileRules().
+ * @param sourceDir Selected directory.
+ * @param path      Absolute path of the signed file.
+ * @return The same matcher.
+ */
+export function ignoreOwnSignature(rules, sourceDir, path) {
+    return Object.values(SIGNATURE_FORMATS).reduce((matcher, { extension }) => ignoreOwnFile(matcher, sourceDir, path + extension), rules);
+}

package/dist/git-deploy.d.ts

@@ -28,6 +28,13 @@ export interface GitDeployInput {
     excludeGitattributes?: boolean;
     /** Commit message of the release. */
     message?: string;
+    /**
+     * Token for an HTTPS repository on the GitHub host, sent as an
+     * authorization header instead of in the URL. Defaults to GITHUB_TOKEN for
+     * a URL on github.com, or on the host of GITHUB_SERVER_URL, without
+     * credentials of its own.
+     */
+    token?: string;
     /** Run everything except the push. */
     dryRun?: boolean;
 }
@@ -43,6 +50,8 @@ export interface GitDeployOptions extends FileSelection {
     splitPrefix: string | null;
     sourceRef: string;
     message: string | null;
+    /** Token sent as an authorization header to the repository. */
+    token: string | null;
     dryRun: boolean;
 }
 export interface GitDeployResult {
@@ -70,6 +79,29 @@ export interface GitDeployResult {
  * @return Whether the name can be used.
  */
 export declare function isValidRefName(name: string): boolean;
+/**
+ * Get GITHUB_TOKEN for an HTTPS repository URL on the GitHub host, like
+ * https://github.com/owner/repo.git, unless the URL has credentials.
+ *
+ * @param gitUrl Repository URL.
+ * @param env    Environment variables.
+ * @return The token, or undefined for another URL or without one.
+ */
+export declare function getDefaultToken(gitUrl: string, env?: NodeJS.ProcessEnv): string | undefined;
+/**
+ * Get the environment variables that make git send a token as the
+ * authorization header to a repository, like actions/checkout, so that the
+ * token stays out of the URL, the arguments and the repository config. An
+ * empty header first resets the headers that git is configured with, like
+ * the one that actions/checkout persists, since a second authorization
+ * header would fail.
+ *
+ * @param gitUrl Repository URL.
+ * @param token  Token, or null for none.
+ * @param env    Environment variables, for the existing GIT_CONFIG_COUNT.
+ * @return Environment variables for git.
+ */
+export declare function getGitAuthEnv(gitUrl: string, token: string | null, env?: NodeJS.ProcessEnv): Record<string, string>;
 /**
  * Apply the defaults to the Git deploy options and validate them.
  *

package/dist/git-deploy.js

@@ -18,6 +18,54 @@ export function isValidRefName(name) {
     return (/^[^\s~^:?*[\\]+$/.test(name) &&
         !/(^[-/.]|\/\.|\.\.|\/\/|@\{|\.lock$|[/.]$)/.test(name));
 }
+/**
+ * Get GITHUB_TOKEN for an HTTPS repository URL on the GitHub host, like
+ * https://github.com/owner/repo.git, unless the URL has credentials.
+ *
+ * @param gitUrl Repository URL.
+ * @param env    Environment variables.
+ * @return The token, or undefined for another URL or without one.
+ */
+export function getDefaultToken(gitUrl, env = process.env) {
+    const url = URL.canParse(gitUrl) ? new URL(gitUrl) : undefined;
+    const hosts = [
+        'github.com',
+        URL.canParse(env.GITHUB_SERVER_URL ?? '')
+            ? new URL(env.GITHUB_SERVER_URL ?? '').host
+            : '',
+    ];
+    const isGitHub = 'https:' === url?.protocol &&
+        !url.username &&
+        hosts.includes(url.host);
+    return isGitHub ? env.GITHUB_TOKEN || undefined : undefined;
+}
+/**
+ * Get the environment variables that make git send a token as the
+ * authorization header to a repository, like actions/checkout, so that the
+ * token stays out of the URL, the arguments and the repository config. An
+ * empty header first resets the headers that git is configured with, like
+ * the one that actions/checkout persists, since a second authorization
+ * header would fail.
+ *
+ * @param gitUrl Repository URL.
+ * @param token  Token, or null for none.
+ * @param env    Environment variables, for the existing GIT_CONFIG_COUNT.
+ * @return Environment variables for git.
+ */
+export function getGitAuthEnv(gitUrl, token, env = process.env) {
+    const count = Number(env.GIT_CONFIG_COUNT) || 0;
+    const key = token ? `http.${new URL(gitUrl).origin}/.extraheader` : '';
+    const credentials = Buffer.from(`x-access-token:${token}`).toString('base64');
+    return token
+        ? {
+            GIT_CONFIG_COUNT: String(count + 2),
+            [`GIT_CONFIG_KEY_${count}`]: key,
+            [`GIT_CONFIG_VALUE_${count}`]: '',
+            [`GIT_CONFIG_KEY_${count + 1}`]: key,
+            [`GIT_CONFIG_VALUE_${count + 1}`]: `AUTHORIZATION: basic ${credentials}`,
+        }
+        : {};
+}
 /**
  * Apply the defaults to the Git deploy options and validate them.
  *
@@ -49,6 +97,7 @@ export function resolveGitDeployOptions(input = {}) {
         splitPrefix: input.splitPrefix || null,
         sourceRef: input.sourceRef || 'HEAD',
         message: input.message || null,
+        token: input.token || getDefaultToken(input.gitUrl) || null,
         dryRun: Boolean(input.dryRun),
         ...resolveFileSelection({
             cwd,
@@ -415,7 +464,14 @@ export class GitDeploy {
     async git(input) {
         const cwd = await this.getRepoRoot();
         this.logger.debug(redactUrls(`git ${input.args.join(' ')}`));
-        const { stdout } = await this.runner({ ...input, cwd });
+        const { stdout } = await this.runner({
+            ...input,
+            cwd,
+            env: {
+                ...getGitAuthEnv(this.options.gitUrl, this.options.token),
+                ...input.env,
+            },
+        });
         return stdout.trim();
     }
 }

package/dist/git.d.ts

@@ -26,6 +26,23 @@ export type GitRunner = (input: GitCommandInput) => Promise<GitCommandOutput>;
  * @return Text with the user info of URLs replaced by ***.
  */
 export declare function redactUrls(text: string): string;
+/** Host and path of a repository URL. */
+export interface RepositoryLocation {
+    /** Host with the port, like github.com or git.example.test:8443. */
+    host: string;
+    /** Path without the leading slash and the .git suffix, like owner/repo or group/subgroup/project. */
+    path: string;
+}
+/**
+ * Get the host and path of a remote repository URL, like github.com and
+ * owner/repo for https://github.com/owner/repo.git or
+ * git@github.com:owner/repo.git, for steps that call the API of the forge
+ * that hosts it. Credentials in the URL aren't part of either.
+ *
+ * @param url Repository URL: HTTP(S), SSH or git, or the scp-like SSH form.
+ * @return Host and path, or undefined for a local repository or another URL.
+ */
+export declare function parseRepositoryUrl(url: string): RepositoryLocation | undefined;
 /**
  * Failed git command.
  */

package/dist/git.js

@@ -9,6 +9,29 @@ import { spawn } from 'node:child_process';
 export function redactUrls(text) {
     return text.replace(/(\w+:\/\/)[^/@\s]+@/g, '$1***@');
 }
+/**
+ * Get the host and path of a remote repository URL, like github.com and
+ * owner/repo for https://github.com/owner/repo.git or
+ * git@github.com:owner/repo.git, for steps that call the API of the forge
+ * that hosts it. Credentials in the URL aren't part of either.
+ *
+ * @param url Repository URL: HTTP(S), SSH or git, or the scp-like SSH form.
+ * @return Host and path, or undefined for a local repository or another URL.
+ */
+export function parseRepositoryUrl(url) {
+    const scpLike = url.match(/^(?:[^@/:]+@)?([^/:\\]{2,}):(?!\/\/)(.+)$/);
+    const parsed = !scpLike && URL.canParse(url) ? new URL(url) : undefined;
+    const isRemote = ['http:', 'https:', 'ssh:', 'git:'].includes(parsed?.protocol ?? '');
+    const location = scpLike
+        ? { host: scpLike[1] ?? '', path: scpLike[2] ?? '' }
+        : { host: parsed?.host ?? '', path: parsed?.pathname ?? '' };
+    const path = location.path
+        .replace(/^\/+|\/+$/g, '')
+        .replace(/\.git$/, '');
+    return (scpLike || isRemote) && location.host && path
+        ? { host: location.host, path }
+        : undefined;
+}
 /**
  * Failed git command.
  */

package/dist/index.d.ts

@@ -9,7 +9,10 @@ export { DISTIGNORE_FILENAME, parseExclude, resolveFileSelection, loadFileRules,
 export { FILENAME_FORMAT, formatFilename } from './filename.ts';
 export { CHECKSUMS_EXTENSION, CHECKSUM_ALGORITHMS, hashFile, hashFiles, createChecksums, writeChecksums, readChecksums, parseChecksums, compareChecksums, verifyChecksums, } from './checksums.ts';
 export { HEADER_BYTES, PLUGIN_HEADERS, THEME_HEADERS, README_HEADERS, README_FILENAMES, parseFileHeaders, parseReadmeHeaders, readFileStart, findFileHeaderLine, findReadmeHeaderLine, findMainPluginFile, readPackageMeta, } from './package-meta.ts';
-export { SIGNATURE_EXTENSION, SIGNING_KEY_ENV, parseSigningKey, parsePublicKey, generateSigningKeyPair, getPublicKey, getFileDigest, signFile, writeSignature, verifyFileSignature, } from './signing.ts';
+export { DEFAULT_SIGNATURE_FORMAT, SIGNATURE_EXTENSION, SIGNATURE_FORMATS, SIGNING_KEY_ENV, parseSigningKey, parsePublicKey, generateSigningKeyPair, getPublicKey, getPublicKeys, getFileDigest, getSignaturePath, isSignatureFormat, signFile, writeSignature, verifyFileSignature, } from './signing.ts';
+export type { SignatureFormat, SignatureFormatHandler } from './signing.ts';
+export { MINISIGN_EXTENSION, createMinisignSignature, getMinisignPublicKey, parseMinisignPublicKey, verifyMinisignSignature, } from './minisign.ts';
+export { SSH_SIGNATURE_EXTENSION, SSH_SIGNATURE_NAMESPACE, createSshSignature, getSshPublicKey, parseSshPublicKey, verifySshSignature, } from './ssh-signature.ts';
 export { ZIP_MTIME, ZIP_FILE_MODE, createZip } from './zip.ts';
 export { isUrl, downloadFile } from './download.ts';
 export { readZipEntries, getZipEntryErrors, extractZip } from './unzip.ts';
@@ -20,9 +23,14 @@ export { defineConfig, packageJsonVersion, composerJsonVersion, wordpressPluginV
 export { Svn, SvnError, createSvnRunner, parseStatus, toSvnPath, } from './svn.ts';
 export { syncDirectory, copyFileIfChanged } from './sync.ts';
 export { ASSET_MIME_TYPES, SvnDeploy } from './svn-deploy.ts';
-export { GitError, createGitRunner, redactUrls } from './git.ts';
-export { GitDeploy, isValidRefName, resolveGitDeployOptions, } from './git-deploy.ts';
+export { GitError, createGitRunner, parseRepositoryUrl, redactUrls, } from './git.ts';
+export { GitDeploy, getDefaultToken, getGitAuthEnv, isValidRefName, resolveGitDeployOptions, } from './git-deploy.ts';
 export { getGitDeployInputFromArgs } from './commands/deploy-git.ts';
+export { getDeployPackages, getGitDeploys, getPackageFiles, getSvnDeploys, } from './package-deploy.ts';
+export { zipPackage } from './package-zip.ts';
+export type { ZipPackageInput, ZipPackageResult } from './package-zip.ts';
+export type { PackageDeploy, PackageDeployFiles, PackageDeployOptions, PackageFileSelection, PackageDeployPlanItem, PackageDeployRelease, } from './package-deploy.ts';
+export type { PackageDeployOutcome } from './commands/package-deploys.ts';
 export type { CliIo, CommandResults } from './cli.ts';
 export type { ChecksumsResult } from './commands/checksums.ts';
 export type { SignResult } from './commands/sign.ts';
@@ -43,10 +51,10 @@ export type { ExtractZipInput, ZipEntryInfo, ZipEntryType } from './unzip.ts';
 export type { FindVersionMismatchesInput, GitTagInput, VersionCheckResult, VersionMismatch, } from './version-check.ts';
 export type { Changeset, ChangesetBump, ChangesetPackages, ChangesetConfig, ChangesetPackageType, ChangesetPackage, PackageRelease, VersionedRelease, ChangesetReleasePlan, } from './changesets.ts';
 export type { ChangesetRepository, ChangesetReleaseOptions, ChangesetAddOptions, ChangesetVersionOptions, ChangesetTagOptions, ChangesetStatusOptions, ChangesetStatusResult, ChangesetVersionInput, VersionChangesetsResult, ChangesetTagInput, ChangesetTagResult, } from './changeset-release.ts';
-export type { WpReleaseConfig, ChangesetPackageGroup, PackageVersionConfig, PackageVersionSource, PackageVersionTarget, PackageIdSource, NextVersionInput, ReleaseCommit, ReleaseNotesInput, ChangelogEntryInput, DependentsChangelogInput, DependentsConfig, PackageJsonVersionOptions, ComposerJsonVersionOptions, WordPressVersionFileOptions, GitTagVersionOptions, PhpConstantVersionOptions, LoadChangesetConfigInput, } from './changeset-config.ts';
+export type { WpReleaseConfig, ChangesetPackageGroup, PackageFilesConfig, PackageDeployConfig, GitDeployTarget, SvnDeployTarget, DeployTemplate, DeployTargetInput, DeployPackage, PackageVersionConfig, PackageVersionSource, PackageVersionTarget, PackageIdSource, NextVersionInput, ReleaseCommit, ReleaseNotesInput, ChangelogEntryInput, DependentsChangelogInput, DependentsConfig, PackageJsonVersionOptions, ComposerJsonVersionOptions, WordPressVersionFileOptions, GitTagVersionOptions, PhpConstantVersionOptions, LoadChangesetConfigInput, } from './changeset-config.ts';
 export type { SvnCheckoutInput, SvnCommandInput, SvnCommandOutput, SvnCommitInput, SvnCopyInput, SvnDepth, SvnOptions, SvnPathsInput, SvnPropsetInput, SvnRunner, SvnStatusEntry, SvnStatusType, SvnUpdateInput, } from './svn.ts';
 export type { SyncDirectoryInput, SyncResult } from './sync.ts';
 export type { SummaryContext } from './summary.ts';
 export type { CheckoutPath, DeployResult } from './svn-deploy.ts';
-export type { GitCommandInput, GitCommandOutput, GitRunner } from './git.ts';
+export type { GitCommandInput, GitCommandOutput, GitRunner, RepositoryLocation, } from './git.ts';
 export type { GitDeployInput, GitDeployOptions, GitDeployResult, } from './git-deploy.ts';

package/dist/index.js

@@ -9,7 +9,9 @@ export { DISTIGNORE_FILENAME, parseExclude, resolveFileSelection, loadFileRules,
 export { FILENAME_FORMAT, formatFilename } from "./filename.js";
 export { CHECKSUMS_EXTENSION, CHECKSUM_ALGORITHMS, hashFile, hashFiles, createChecksums, writeChecksums, readChecksums, parseChecksums, compareChecksums, verifyChecksums, } from "./checksums.js";
 export { HEADER_BYTES, PLUGIN_HEADERS, THEME_HEADERS, README_HEADERS, README_FILENAMES, parseFileHeaders, parseReadmeHeaders, readFileStart, findFileHeaderLine, findReadmeHeaderLine, findMainPluginFile, readPackageMeta, } from "./package-meta.js";
-export { SIGNATURE_EXTENSION, SIGNING_KEY_ENV, parseSigningKey, parsePublicKey, generateSigningKeyPair, getPublicKey, getFileDigest, signFile, writeSignature, verifyFileSignature, } from "./signing.js";
+export { DEFAULT_SIGNATURE_FORMAT, SIGNATURE_EXTENSION, SIGNATURE_FORMATS, SIGNING_KEY_ENV, parseSigningKey, parsePublicKey, generateSigningKeyPair, getPublicKey, getPublicKeys, getFileDigest, getSignaturePath, isSignatureFormat, signFile, writeSignature, verifyFileSignature, } from "./signing.js";
+export { MINISIGN_EXTENSION, createMinisignSignature, getMinisignPublicKey, parseMinisignPublicKey, verifyMinisignSignature, } from "./minisign.js";
+export { SSH_SIGNATURE_EXTENSION, SSH_SIGNATURE_NAMESPACE, createSshSignature, getSshPublicKey, parseSshPublicKey, verifySshSignature, } from "./ssh-signature.js";
 export { ZIP_MTIME, ZIP_FILE_MODE, createZip } from "./zip.js";
 export { isUrl, downloadFile } from "./download.js";
 export { readZipEntries, getZipEntryErrors, extractZip } from "./unzip.js";
@@ -20,6 +22,8 @@ export { defineConfig, packageJsonVersion, composerJsonVersion, wordpressPluginV
 export { Svn, SvnError, createSvnRunner, parseStatus, toSvnPath, } from "./svn.js";
 export { syncDirectory, copyFileIfChanged } from "./sync.js";
 export { ASSET_MIME_TYPES, SvnDeploy } from "./svn-deploy.js";
-export { GitError, createGitRunner, redactUrls } from "./git.js";
-export { GitDeploy, isValidRefName, resolveGitDeployOptions, } from "./git-deploy.js";
+export { GitError, createGitRunner, parseRepositoryUrl, redactUrls, } from "./git.js";
+export { GitDeploy, getDefaultToken, getGitAuthEnv, isValidRefName, resolveGitDeployOptions, } from "./git-deploy.js";
 export { getGitDeployInputFromArgs } from "./commands/deploy-git.js";
+export { getDeployPackages, getGitDeploys, getPackageFiles, getSvnDeploys, } from "./package-deploy.js";
+export { zipPackage } from "./package-zip.js";

package/dist/minisign.d.ts

@@ -0,0 +1,41 @@
+import type { KeyObject } from 'node:crypto';
+export declare const MINISIGN_EXTENSION = ".minisig";
+/**
+ * Get the minisign public key of a key, the base64 line that `minisign -P`
+ * takes and that the second line of a minisign .pub file holds.
+ *
+ * @param key Private or public key.
+ * @return Base64 minisign public key.
+ */
+export declare function getMinisignPublicKey(key: KeyObject): string;
+/**
+ * Get the raw public key from a minisign public key, the base64 line or the
+ * whole two-line .pub file.
+ *
+ * @param encoded Minisign public key.
+ * @return Public key bytes, or null when it isn't a minisign public key.
+ */
+export declare function parseMinisignPublicKey(encoded: string): Buffer | null;
+/**
+ * Create a minisign signature of a file: an Ed25519 signature of its
+ * BLAKE2b-512 digest, and a global signature that also covers the trusted
+ * comment with the signing time and file name.
+ *
+ * @param path       File path.
+ * @param privateKey Private key.
+ * @return Contents of the .minisig file.
+ */
+export declare function createMinisignSignature(path: string, privateKey: KeyObject): Promise<string>;
+/**
+ * Check a file against a minisign signature file, including the global
+ * signature of the trusted comment. Both the BLAKE2b-512 prehashed (ED)
+ * and the legacy (Ed) signatures of minisign are accepted. The key ID isn't
+ * compared, since it only tells minisign which key to use, so signatures of
+ * keys that minisign generated with a random ID are accepted too.
+ *
+ * @param path          File path.
+ * @param signaturePath Signature file path.
+ * @param publicKey     Public key.
+ * @return Whether the signature matches.
+ */
+export declare function verifyMinisignSignature(path: string, signaturePath: string, publicKey: KeyObject): Promise<boolean>;

package/dist/minisign.js

@@ -0,0 +1,128 @@
+import { createHash, sign, verify } from 'node:crypto';
+import { readFile } from 'node:fs/promises';
+import { basename } from 'node:path';
+import { PUBLIC_KEY_BYTES, digestFile, getRawPublicKey } from "./ed25519.js";
+export const MINISIGN_EXTENSION = '.minisig';
+// Algorithm of a public key, and of a signature of the BLAKE2b-512 digest.
+const KEY_ALGORITHM = 'Ed';
+const HASHED_ALGORITHM = 'ED';
+const KEY_ID_BYTES = 8;
+const SIGNATURE_BYTES = 64;
+const UNTRUSTED_PREFIX = 'untrusted comment: ';
+const TRUSTED_PREFIX = 'trusted comment: ';
+/**
+ * Get the minisign key ID of a public key. minisign picks a random ID when
+ * it generates a key, so wp-release derives one from the public key instead,
+ * which keeps it the same for every signature of the key.
+ *
+ * @param publicKey Public key bytes.
+ * @return 8-byte key ID.
+ */
+function getKeyId(publicKey) {
+    return createHash('blake2b512')
+        .update(publicKey)
+        .digest()
+        .subarray(0, KEY_ID_BYTES);
+}
+/**
+ * Format a key ID like minisign prints it: the hex of the little-endian
+ * 64-bit number.
+ *
+ * @param keyId Key ID bytes.
+ * @return Uppercase hex key ID.
+ */
+function formatKeyId(keyId) {
+    return Buffer.from(keyId).reverse().toString('hex').toUpperCase();
+}
+/**
+ * Get the minisign public key of a key, the base64 line that `minisign -P`
+ * takes and that the second line of a minisign .pub file holds.
+ *
+ * @param key Private or public key.
+ * @return Base64 minisign public key.
+ */
+export function getMinisignPublicKey(key) {
+    const publicKey = getRawPublicKey(key);
+    return Buffer.concat([
+        Buffer.from(KEY_ALGORITHM),
+        getKeyId(publicKey),
+        publicKey,
+    ]).toString('base64');
+}
+/**
+ * Get the raw public key from a minisign public key, the base64 line or the
+ * whole two-line .pub file.
+ *
+ * @param encoded Minisign public key.
+ * @return Public key bytes, or null when it isn't a minisign public key.
+ */
+export function parseMinisignPublicKey(encoded) {
+    const line = encoded
+        .trim()
+        .split('\n')
+        .map((text) => text.trim())
+        .filter((text) => text && !text.startsWith(UNTRUSTED_PREFIX));
+    const bytes = Buffer.from(line.join(''), 'base64');
+    const isMinisign = 1 === line.length &&
+        2 + KEY_ID_BYTES + PUBLIC_KEY_BYTES === bytes.length &&
+        KEY_ALGORITHM === bytes.subarray(0, 2).toString();
+    return isMinisign ? bytes.subarray(2 + KEY_ID_BYTES) : null;
+}
+/**
+ * Create a minisign signature of a file: an Ed25519 signature of its
+ * BLAKE2b-512 digest, and a global signature that also covers the trusted
+ * comment with the signing time and file name.
+ *
+ * @param path       File path.
+ * @param privateKey Private key.
+ * @return Contents of the .minisig file.
+ */
+export async function createMinisignSignature(path, privateKey) {
+    const keyId = getKeyId(getRawPublicKey(privateKey));
+    const signature = sign(null, await digestFile(path, 'blake2b512'), privateKey);
+    const name = basename(path).replace(/[\r\n]/g, ' ');
+    const trustedComment = `timestamp:${Math.floor(Date.now() / 1000)}\tfile:${name}\thashed`;
+    const globalSignature = sign(null, Buffer.concat([signature, Buffer.from(trustedComment)]), privateKey);
+    return [
+        `${UNTRUSTED_PREFIX}signature from wp-release key ${formatKeyId(keyId)}`,
+        Buffer.concat([
+            Buffer.from(HASHED_ALGORITHM),
+            keyId,
+            signature,
+        ]).toString('base64'),
+        `${TRUSTED_PREFIX}${trustedComment}`,
+        globalSignature.toString('base64'),
+        '',
+    ].join('\n');
+}
+/**
+ * Check a file against a minisign signature file, including the global
+ * signature of the trusted comment. Both the BLAKE2b-512 prehashed (ED)
+ * and the legacy (Ed) signatures of minisign are accepted. The key ID isn't
+ * compared, since it only tells minisign which key to use, so signatures of
+ * keys that minisign generated with a random ID are accepted too.
+ *
+ * @param path          File path.
+ * @param signaturePath Signature file path.
+ * @param publicKey     Public key.
+ * @return Whether the signature matches.
+ */
+export async function verifyMinisignSignature(path, signaturePath, publicKey) {
+    const [, encoded = '', trusted = '', encodedGlobal = ''] = (await readFile(signaturePath, 'utf8'))
+        .split('\n')
+        .map((line) => line.trim());
+    const bytes = Buffer.from(encoded, 'base64');
+    const algorithm = bytes.subarray(0, 2).toString();
+    const signature = bytes.subarray(2 + KEY_ID_BYTES);
+    const isValidShape = 2 + KEY_ID_BYTES + SIGNATURE_BYTES === bytes.length &&
+        [HASHED_ALGORITHM, KEY_ALGORITHM].includes(algorithm) &&
+        trusted.startsWith(TRUSTED_PREFIX);
+    return (isValidShape &&
+        verify(null, HASHED_ALGORITHM === algorithm
+            ? await digestFile(path, 'blake2b512')
+            : await readFile(path), publicKey, signature) &&
+        verify(null, Buffer.concat([
+            signature,
+            Buffer.from(trusted.slice(TRUSTED_PREFIX.length)),
+        ]), publicKey, Buffer.from(encodedGlobal, 'base64')));
+}

package/dist/package-deploy.d.ts

@@ -0,0 +1,133 @@
+import type { DeployPackage } from './changeset-config.ts';
+import type { DeployInput } from './deploy-options.ts';
+import type { GitDeployInput } from './git-deploy.ts';
+import type { GitRunner } from './git.ts';
+export interface PackageDeployOptions {
+    /** Repository root with the wp-release config. */
+    cwd: string;
+    /** Config file, instead of the conventional one at the root. */
+    configFile?: string;
+    /** Tag format that replaces the tagFormat of the config. */
+    tagFormat?: string;
+    /**
+     * Ref to deploy: a package release tag, like refs/tags/plugins/alpha/1.2.0,
+     * or a branch, like refs/heads/main. A name without refs/ is a release tag
+     * when it matches the tag format of a package, otherwise a branch.
+     */
+    ref: string;
+    /** Deploy only these packages, by identifier or path under the root. */
+    packages?: string[];
+    /** Run everything except the writes. */
+    dryRun?: boolean;
+    /** Git runner, spawning git by default. */
+    git?: GitRunner;
+}
+/** The release of a package that a ref deploys. */
+export interface PackageDeployRelease {
+    /** Released version, for a release tag. */
+    version?: string;
+    /** Deployed branch, for a branch. */
+    branch?: string;
+}
+/** One deploy of a package to one of its targets. */
+export interface PackageDeploy<Input> {
+    package: DeployPackage;
+    release: PackageDeployRelease;
+    /** Repository or WordPress.org plugin of the target, with credentials redacted. */
+    target: string;
+    /** Tag or branch that the deploy writes in the target. */
+    targetRef: string;
+    /** Host of a remote target repository, like github.com. */
+    targetHost?: string;
+    /** Path of a remote target repository on its host, like owner/repo. */
+    targetPath?: string;
+    /** Package, target and ref, with credentials redacted, for logs. */
+    label: string;
+    /** Options of the deploy. */
+    input: Input;
+}
+/**
+ * Get the Git deploys of the configured packages that a ref releases: every
+ * Git target of the package of a release tag that releases tags, or of every
+ * package with a Git target that releases the branch.
+ *
+ * @param  options Repository, ref and package selection.
+ * @return Deploys in the configured package and target order.
+ * @throws {ValidationError} Without a config, or for an invalid one or an unknown package.
+ */
+export declare function getGitDeploys(options: PackageDeployOptions): Promise<PackageDeploy<GitDeployInput>[]>;
+/**
+ * Get the WordPress.org SVN deploys of the configured package that a release
+ * tag releases. A stable release syncs trunk/, the tag and the assets, and a
+ * pre-release only creates its tag. Branches aren't deployed to SVN.
+ *
+ * @param  options Repository, ref and package selection.
+ * @return Deploys in the configured target order.
+ * @throws {ValidationError} Without a config, or for an invalid one or an unknown package.
+ */
+export declare function getSvnDeploys(options: PackageDeployOptions): Promise<PackageDeploy<DeployInput>[]>;
+/** A package with deploy targets and the files that its deploys ship. */
+export interface PackageDeployFiles extends DeployPackage {
+    /** File selection of the package, for resolveFileSelection(). */
+    files: PackageFileSelection;
+}
+/**
+ * Get the packages with deploy targets and the files that their deploys
+ * ship, for example to build a ZIP with the same files.
+ *
+ * @param  options            Repository root and config file.
+ * @param  options.cwd        Repository root with the wp-release config.
+ * @param  options.configFile Config file, instead of the conventional one at the root.
+ * @return Packages in the configured order.
+ * @throws {ValidationError} Without a config, or for an invalid one.
+ */
+export declare function getDeployPackages(options: {
+    cwd: string;
+    configFile?: string;
+}): Promise<PackageDeployFiles[]>;
+/**
+ * Get a configured package with the files that its releases ship, from the
+ * files config of its package group, which its deploys use too, for example
+ * to build its ZIP with the same files. Any package of the config works, with
+ * or without a version or deploy targets.
+ *
+ * @param  options            Repository root, config file and package.
+ * @param  options.cwd        Repository root with the wp-release config.
+ * @param  options.configFile Config file, instead of the conventional one at the root.
+ * @param  options.package    Package identifier or path under the configured root.
+ * @return The package and its file selection.
+ * @throws {ValidationError} Without a config, for an invalid one or an unknown package.
+ */
+export declare function getPackageFiles(options: {
+    cwd: string;
+    configFile?: string;
+    package: string;
+}): Promise<PackageDeployFiles>;
+/** Ignore file and patterns that select the files of a package. */
+export interface PackageFileSelection {
+    /** Absolute ignore file path, or false to not read one. */
+    distignore?: string | false;
+    /** Gitignore-style patterns relative to the package directory. */
+    exclude?: string[];
+}
+/** The deploys of one package in a deploy plan. */
+export interface PackageDeployPlanItem extends PackageDeployRelease {
+    package: string;
+    /** Targets with the tag or branch that each deploy writes. */
+    targets: Array<{
+        target: string;
+        ref: string;
+        /** Host of a remote target repository. */
+        host?: string;
+        /** Path of a remote target repository on its host. */
+        path?: string;
+    }>;
+}
+/**
+ * Group deploys by package, for a preview of what a ref deploys or a CI
+ * matrix with a job for each package.
+ *
+ * @param deploys Deploys from getGitDeploys() or getSvnDeploys().
+ * @return One item for each package, in the deploy order.
+ */
+export declare function getDeployPlan(deploys: PackageDeploy<unknown>[]): PackageDeployPlanItem[];