@wpelevator/wp-release 0.13.0 → 0.15.0

package/dist/ed25519.js

@@ -0,0 +1,44 @@
+import { createHash, createPublicKey } from 'node:crypto';
+import { createReadStream } from 'node:fs';
+export const PUBLIC_KEY_BYTES = 32;
+// DER prefix of a SPKI Ed25519 public key, followed by the 32-byte key.
+const SPKI_PREFIX = Buffer.from('302a300506032b6570032100', 'hex');
+/**
+ * Get the raw 32 bytes of an Ed25519 public key.
+ *
+ * @param key Private or public key.
+ * @return Public key bytes.
+ */
+export function getRawPublicKey(key) {
+    return ('private' === key.type ? createPublicKey(key) : key)
+        .export({ format: 'der', type: 'spki' })
+        .subarray(SPKI_PREFIX.length);
+}
+/**
+ * Get an Ed25519 public key from its raw 32 bytes.
+ *
+ * @param bytes Public key bytes.
+ * @return Public key.
+ */
+export function createRawPublicKey(bytes) {
+    return createPublicKey({
+        key: Buffer.concat([SPKI_PREFIX, bytes]),
+        format: 'der',
+        type: 'spki',
+    });
+}
+/**
+ * Get the raw digest of a file, which the signature formats sign instead of
+ * the whole file.
+ *
+ * @param path      File path.
+ * @param algorithm Node.js hash algorithm, like sha384 or blake2b512.
+ * @return Digest bytes.
+ */
+export async function digestFile(path, algorithm) {
+    const hash = createHash(algorithm);
+    for await (const chunk of createReadStream(path)) {
+        hash.update(chunk);
+    }
+    return hash.digest();
+}

package/dist/file-selection.d.ts

@@ -82,3 +82,24 @@ export declare function isErrorCode(error: unknown, code: string): boolean;
  * @throws {ValidationError} For selected symbolic links, which ZIP archives and WordPress.org SVN don't support.
  */
 export declare function selectFiles(sourceDir: string, rules: FileRules): Promise<string[]>;
+/**
+ * Ignore a file that a command writes or reads, such as the checksums
+ * manifest, when it's inside the selected directory.
+ *
+ * @param rules     Matcher from loadFileRules().
+ * @param sourceDir Selected directory.
+ * @param path      Absolute file path.
+ * @return The same matcher.
+ */
+export declare function ignoreOwnFile(rules: FileRules, sourceDir: string, path: string): FileRules;
+/**
+ * Ignore the signature files of every format that "wp-release sign" writes
+ * next to a file a command writes, when they're inside the selected
+ * directory.
+ *
+ * @param rules     Matcher from loadFileRules().
+ * @param sourceDir Selected directory.
+ * @param path      Absolute path of the signed file.
+ * @return The same matcher.
+ */
+export declare function ignoreOwnSignature(rules: FileRules, sourceDir: string, path: string): FileRules;

package/dist/file-selection.js

@@ -3,6 +3,7 @@ import { isAbsolute, join, posix, relative, resolve } from 'node:path';
 import ignore from 'ignore';
 import { ValidationError } from "./errors.js";
 import { createGitRunner } from "./git.js";
+import { SIGNATURE_FORMATS } from "./signing.js";
 export const DISTIGNORE_FILENAME = '.distignore';
 /**
  * Version control metadata that is never released, at any depth. Without
@@ -227,3 +228,37 @@ async function findEntryFiles(sourceDir, path, entry, rules) {
     }
     return [];
 }
+/**
+ * Ignore a file that a command writes or reads, such as the checksums
+ * manifest, when it's inside the selected directory.
+ *
+ * @param rules     Matcher from loadFileRules().
+ * @param sourceDir Selected directory.
+ * @param path      Absolute file path.
+ * @return The same matcher.
+ */
+export function ignoreOwnFile(rules, sourceDir, path) {
+    const relativePath = relative(sourceDir, path).split('\\').join('/');
+    const isInside = relativePath &&
+        '..' !== relativePath &&
+        !relativePath.startsWith('../') &&
+        !isAbsolute(relativePath);
+    if (isInside) {
+        // Escape the gitignore wildcards so that the pattern matches only this file.
+        rules.add(`/${relativePath.replace(/[\\*?[\]!#]/g, '\\$&')}`);
+    }
+    return rules;
+}
+/**
+ * Ignore the signature files of every format that "wp-release sign" writes
+ * next to a file a command writes, when they're inside the selected
+ * directory.
+ *
+ * @param rules     Matcher from loadFileRules().
+ * @param sourceDir Selected directory.
+ * @param path      Absolute path of the signed file.
+ * @return The same matcher.
+ */
+export function ignoreOwnSignature(rules, sourceDir, path) {
+    return Object.values(SIGNATURE_FORMATS).reduce((matcher, { extension }) => ignoreOwnFile(matcher, sourceDir, path + extension), rules);
+}

package/dist/git.d.ts

@@ -26,6 +26,23 @@ export type GitRunner = (input: GitCommandInput) => Promise<GitCommandOutput>;
  * @return Text with the user info of URLs replaced by ***.
  */
 export declare function redactUrls(text: string): string;
+/** Host and path of a repository URL. */
+export interface RepositoryLocation {
+    /** Host with the port, like github.com or git.example.test:8443. */
+    host: string;
+    /** Path without the leading slash and the .git suffix, like owner/repo or group/subgroup/project. */
+    path: string;
+}
+/**
+ * Get the host and path of a remote repository URL, like github.com and
+ * owner/repo for https://github.com/owner/repo.git or
+ * git@github.com:owner/repo.git, for steps that call the API of the forge
+ * that hosts it. Credentials in the URL aren't part of either.
+ *
+ * @param url Repository URL: HTTP(S), SSH or git, or the scp-like SSH form.
+ * @return Host and path, or undefined for a local repository or another URL.
+ */
+export declare function parseRepositoryUrl(url: string): RepositoryLocation | undefined;
 /**
  * Failed git command.
  */

package/dist/git.js

@@ -9,6 +9,29 @@ import { spawn } from 'node:child_process';
 export function redactUrls(text) {
     return text.replace(/(\w+:\/\/)[^/@\s]+@/g, '$1***@');
 }
+/**
+ * Get the host and path of a remote repository URL, like github.com and
+ * owner/repo for https://github.com/owner/repo.git or
+ * git@github.com:owner/repo.git, for steps that call the API of the forge
+ * that hosts it. Credentials in the URL aren't part of either.
+ *
+ * @param url Repository URL: HTTP(S), SSH or git, or the scp-like SSH form.
+ * @return Host and path, or undefined for a local repository or another URL.
+ */
+export function parseRepositoryUrl(url) {
+    const scpLike = url.match(/^(?:[^@/:]+@)?([^/:\\]{2,}):(?!\/\/)(.+)$/);
+    const parsed = !scpLike && URL.canParse(url) ? new URL(url) : undefined;
+    const isRemote = ['http:', 'https:', 'ssh:', 'git:'].includes(parsed?.protocol ?? '');
+    const location = scpLike
+        ? { host: scpLike[1] ?? '', path: scpLike[2] ?? '' }
+        : { host: parsed?.host ?? '', path: parsed?.pathname ?? '' };
+    const path = location.path
+        .replace(/^\/+|\/+$/g, '')
+        .replace(/\.git$/, '');
+    return (scpLike || isRemote) && location.host && path
+        ? { host: location.host, path }
+        : undefined;
+}
 /**
  * Failed git command.
  */

package/dist/index.d.ts

@@ -9,7 +9,10 @@ export { DISTIGNORE_FILENAME, parseExclude, resolveFileSelection, loadFileRules,
 export { FILENAME_FORMAT, formatFilename } from './filename.ts';
 export { CHECKSUMS_EXTENSION, CHECKSUM_ALGORITHMS, hashFile, hashFiles, createChecksums, writeChecksums, readChecksums, parseChecksums, compareChecksums, verifyChecksums, } from './checksums.ts';
 export { HEADER_BYTES, PLUGIN_HEADERS, THEME_HEADERS, README_HEADERS, README_FILENAMES, parseFileHeaders, parseReadmeHeaders, readFileStart, findFileHeaderLine, findReadmeHeaderLine, findMainPluginFile, readPackageMeta, } from './package-meta.ts';
-export { SIGNATURE_EXTENSION, SIGNING_KEY_ENV, parseSigningKey, parsePublicKey, generateSigningKeyPair, getPublicKey, getFileDigest, signFile, writeSignature, verifyFileSignature, } from './signing.ts';
+export { DEFAULT_SIGNATURE_FORMAT, SIGNATURE_EXTENSION, SIGNATURE_FORMATS, SIGNING_KEY_ENV, parseSigningKey, parsePublicKey, generateSigningKeyPair, getPublicKey, getPublicKeys, getFileDigest, getSignaturePath, isSignatureFormat, signFile, writeSignature, signFiles, verifyFileSignature, } from './signing.ts';
+export type { SignatureFormat, SignatureFormatHandler } from './signing.ts';
+export { MINISIGN_EXTENSION, createMinisignSignature, getMinisignPublicKey, parseMinisignPublicKey, verifyMinisignSignature, } from './minisign.ts';
+export { SSH_SIGNATURE_EXTENSION, SSH_SIGNATURE_NAMESPACE, createSshSignature, getSshPublicKey, parseSshPublicKey, verifySshSignature, } from './ssh-signature.ts';
 export { ZIP_MTIME, ZIP_FILE_MODE, createZip } from './zip.ts';
 export { isUrl, downloadFile } from './download.ts';
 export { readZipEntries, getZipEntryErrors, extractZip } from './unzip.ts';
@@ -20,19 +23,22 @@ export { defineConfig, packageJsonVersion, composerJsonVersion, wordpressPluginV
 export { Svn, SvnError, createSvnRunner, parseStatus, toSvnPath, } from './svn.ts';
 export { syncDirectory, copyFileIfChanged } from './sync.ts';
 export { ASSET_MIME_TYPES, SvnDeploy } from './svn-deploy.ts';
-export { GitError, createGitRunner, redactUrls } from './git.ts';
+export { GitError, createGitRunner, parseRepositoryUrl, redactUrls, } from './git.ts';
 export { GitDeploy, getDefaultToken, getGitAuthEnv, isValidRefName, resolveGitDeployOptions, } from './git-deploy.ts';
 export { getGitDeployInputFromArgs } from './commands/deploy-git.ts';
-export { getDeployPackages, getGitDeploys, getSvnDeploys, } from './package-deploy.ts';
+export { getDeployPackages, getGitDeploys, getPackageFiles, getSvnDeploys, } from './package-deploy.ts';
+export { zipPackage } from './package-zip.ts';
+export type { ZipPackageInput, ZipPackageResult } from './package-zip.ts';
 export type { PackageDeploy, PackageDeployFiles, PackageDeployOptions, PackageFileSelection, PackageDeployPlanItem, PackageDeployRelease, } from './package-deploy.ts';
 export type { PackageDeployOutcome } from './commands/package-deploys.ts';
 export type { CliIo, CommandResults } from './cli.ts';
 export type { ChecksumsResult } from './commands/checksums.ts';
 export type { SignResult } from './commands/sign.ts';
+export type { SignFilesInput, SignFilesResult } from './signing.ts';
 export type { KeygenResult } from './commands/keygen.ts';
 export type { ZipResult } from './commands/zip.ts';
 export type { Command, CommandContext, CommandOutcome, ParsedValues, } from './commands/command.ts';
-export type { DeployArgsInput } from './commands/deploy-svn.ts';
+export type { DeployArgsInput, DeploySvnResult, } from './commands/deploy-svn.ts';
 export type { Annotation, LogEntry, LogLevel, LogWriter, LoggerOptions, OutputStream, SummaryBuilder, TextWriterOptions, } from './logger.ts';
 export type { GitHubActionsWriterOptions } from './github-actions-writer.ts';
 export type { Problem } from './errors.ts';
@@ -51,5 +57,5 @@ export type { SvnCheckoutInput, SvnCommandInput, SvnCommandOutput, SvnCommitInpu
 export type { SyncDirectoryInput, SyncResult } from './sync.ts';
 export type { SummaryContext } from './summary.ts';
 export type { CheckoutPath, DeployResult } from './svn-deploy.ts';
-export type { GitCommandInput, GitCommandOutput, GitRunner } from './git.ts';
+export type { GitCommandInput, GitCommandOutput, GitRunner, RepositoryLocation, } from './git.ts';
 export type { GitDeployInput, GitDeployOptions, GitDeployResult, } from './git-deploy.ts';

package/dist/index.js

@@ -9,7 +9,9 @@ export { DISTIGNORE_FILENAME, parseExclude, resolveFileSelection, loadFileRules,
 export { FILENAME_FORMAT, formatFilename } from "./filename.js";
 export { CHECKSUMS_EXTENSION, CHECKSUM_ALGORITHMS, hashFile, hashFiles, createChecksums, writeChecksums, readChecksums, parseChecksums, compareChecksums, verifyChecksums, } from "./checksums.js";
 export { HEADER_BYTES, PLUGIN_HEADERS, THEME_HEADERS, README_HEADERS, README_FILENAMES, parseFileHeaders, parseReadmeHeaders, readFileStart, findFileHeaderLine, findReadmeHeaderLine, findMainPluginFile, readPackageMeta, } from "./package-meta.js";
-export { SIGNATURE_EXTENSION, SIGNING_KEY_ENV, parseSigningKey, parsePublicKey, generateSigningKeyPair, getPublicKey, getFileDigest, signFile, writeSignature, verifyFileSignature, } from "./signing.js";
+export { DEFAULT_SIGNATURE_FORMAT, SIGNATURE_EXTENSION, SIGNATURE_FORMATS, SIGNING_KEY_ENV, parseSigningKey, parsePublicKey, generateSigningKeyPair, getPublicKey, getPublicKeys, getFileDigest, getSignaturePath, isSignatureFormat, signFile, writeSignature, signFiles, verifyFileSignature, } from "./signing.js";
+export { MINISIGN_EXTENSION, createMinisignSignature, getMinisignPublicKey, parseMinisignPublicKey, verifyMinisignSignature, } from "./minisign.js";
+export { SSH_SIGNATURE_EXTENSION, SSH_SIGNATURE_NAMESPACE, createSshSignature, getSshPublicKey, parseSshPublicKey, verifySshSignature, } from "./ssh-signature.js";
 export { ZIP_MTIME, ZIP_FILE_MODE, createZip } from "./zip.js";
 export { isUrl, downloadFile } from "./download.js";
 export { readZipEntries, getZipEntryErrors, extractZip } from "./unzip.js";
@@ -20,7 +22,8 @@ export { defineConfig, packageJsonVersion, composerJsonVersion, wordpressPluginV
 export { Svn, SvnError, createSvnRunner, parseStatus, toSvnPath, } from "./svn.js";
 export { syncDirectory, copyFileIfChanged } from "./sync.js";
 export { ASSET_MIME_TYPES, SvnDeploy } from "./svn-deploy.js";
-export { GitError, createGitRunner, redactUrls } from "./git.js";
+export { GitError, createGitRunner, parseRepositoryUrl, redactUrls, } from "./git.js";
 export { GitDeploy, getDefaultToken, getGitAuthEnv, isValidRefName, resolveGitDeployOptions, } from "./git-deploy.js";
 export { getGitDeployInputFromArgs } from "./commands/deploy-git.js";
-export { getDeployPackages, getGitDeploys, getSvnDeploys, } from "./package-deploy.js";
+export { getDeployPackages, getGitDeploys, getPackageFiles, getSvnDeploys, } from "./package-deploy.js";
+export { zipPackage } from "./package-zip.js";

package/dist/minisign.d.ts

@@ -0,0 +1,41 @@
+import type { KeyObject } from 'node:crypto';
+export declare const MINISIGN_EXTENSION = ".minisig";
+/**
+ * Get the minisign public key of a key, the base64 line that `minisign -P`
+ * takes and that the second line of a minisign .pub file holds.
+ *
+ * @param key Private or public key.
+ * @return Base64 minisign public key.
+ */
+export declare function getMinisignPublicKey(key: KeyObject): string;
+/**
+ * Get the raw public key from a minisign public key, the base64 line or the
+ * whole two-line .pub file.
+ *
+ * @param encoded Minisign public key.
+ * @return Public key bytes, or null when it isn't a minisign public key.
+ */
+export declare function parseMinisignPublicKey(encoded: string): Buffer | null;
+/**
+ * Create a minisign signature of a file: an Ed25519 signature of its
+ * BLAKE2b-512 digest, and a global signature that also covers the trusted
+ * comment with the signing time and file name.
+ *
+ * @param path       File path.
+ * @param privateKey Private key.
+ * @return Contents of the .minisig file.
+ */
+export declare function createMinisignSignature(path: string, privateKey: KeyObject): Promise<string>;
+/**
+ * Check a file against a minisign signature file, including the global
+ * signature of the trusted comment. Both the BLAKE2b-512 prehashed (ED)
+ * and the legacy (Ed) signatures of minisign are accepted. The key ID isn't
+ * compared, since it only tells minisign which key to use, so signatures of
+ * keys that minisign generated with a random ID are accepted too.
+ *
+ * @param path          File path.
+ * @param signaturePath Signature file path.
+ * @param publicKey     Public key.
+ * @return Whether the signature matches.
+ */
+export declare function verifyMinisignSignature(path: string, signaturePath: string, publicKey: KeyObject): Promise<boolean>;

package/dist/minisign.js

@@ -0,0 +1,128 @@
+import { createHash, sign, verify } from 'node:crypto';
+import { readFile } from 'node:fs/promises';
+import { basename } from 'node:path';
+import { PUBLIC_KEY_BYTES, digestFile, getRawPublicKey } from "./ed25519.js";
+export const MINISIGN_EXTENSION = '.minisig';
+// Algorithm of a public key, and of a signature of the BLAKE2b-512 digest.
+const KEY_ALGORITHM = 'Ed';
+const HASHED_ALGORITHM = 'ED';
+const KEY_ID_BYTES = 8;
+const SIGNATURE_BYTES = 64;
+const UNTRUSTED_PREFIX = 'untrusted comment: ';
+const TRUSTED_PREFIX = 'trusted comment: ';
+/**
+ * Get the minisign key ID of a public key. minisign picks a random ID when
+ * it generates a key, so wp-release derives one from the public key instead,
+ * which keeps it the same for every signature of the key.
+ *
+ * @param publicKey Public key bytes.
+ * @return 8-byte key ID.
+ */
+function getKeyId(publicKey) {
+    return createHash('blake2b512')
+        .update(publicKey)
+        .digest()
+        .subarray(0, KEY_ID_BYTES);
+}
+/**
+ * Format a key ID like minisign prints it: the hex of the little-endian
+ * 64-bit number.
+ *
+ * @param keyId Key ID bytes.
+ * @return Uppercase hex key ID.
+ */
+function formatKeyId(keyId) {
+    return Buffer.from(keyId).reverse().toString('hex').toUpperCase();
+}
+/**
+ * Get the minisign public key of a key, the base64 line that `minisign -P`
+ * takes and that the second line of a minisign .pub file holds.
+ *
+ * @param key Private or public key.
+ * @return Base64 minisign public key.
+ */
+export function getMinisignPublicKey(key) {
+    const publicKey = getRawPublicKey(key);
+    return Buffer.concat([
+        Buffer.from(KEY_ALGORITHM),
+        getKeyId(publicKey),
+        publicKey,
+    ]).toString('base64');
+}
+/**
+ * Get the raw public key from a minisign public key, the base64 line or the
+ * whole two-line .pub file.
+ *
+ * @param encoded Minisign public key.
+ * @return Public key bytes, or null when it isn't a minisign public key.
+ */
+export function parseMinisignPublicKey(encoded) {
+    const line = encoded
+        .trim()
+        .split('\n')
+        .map((text) => text.trim())
+        .filter((text) => text && !text.startsWith(UNTRUSTED_PREFIX));
+    const bytes = Buffer.from(line.join(''), 'base64');
+    const isMinisign = 1 === line.length &&
+        2 + KEY_ID_BYTES + PUBLIC_KEY_BYTES === bytes.length &&
+        KEY_ALGORITHM === bytes.subarray(0, 2).toString();
+    return isMinisign ? bytes.subarray(2 + KEY_ID_BYTES) : null;
+}
+/**
+ * Create a minisign signature of a file: an Ed25519 signature of its
+ * BLAKE2b-512 digest, and a global signature that also covers the trusted
+ * comment with the signing time and file name.
+ *
+ * @param path       File path.
+ * @param privateKey Private key.
+ * @return Contents of the .minisig file.
+ */
+export async function createMinisignSignature(path, privateKey) {
+    const keyId = getKeyId(getRawPublicKey(privateKey));
+    const signature = sign(null, await digestFile(path, 'blake2b512'), privateKey);
+    const name = basename(path).replace(/[\r\n]/g, ' ');
+    const trustedComment = `timestamp:${Math.floor(Date.now() / 1000)}\tfile:${name}\thashed`;
+    const globalSignature = sign(null, Buffer.concat([signature, Buffer.from(trustedComment)]), privateKey);
+    return [
+        `${UNTRUSTED_PREFIX}signature from wp-release key ${formatKeyId(keyId)}`,
+        Buffer.concat([
+            Buffer.from(HASHED_ALGORITHM),
+            keyId,
+            signature,
+        ]).toString('base64'),
+        `${TRUSTED_PREFIX}${trustedComment}`,
+        globalSignature.toString('base64'),
+        '',
+    ].join('\n');
+}
+/**
+ * Check a file against a minisign signature file, including the global
+ * signature of the trusted comment. Both the BLAKE2b-512 prehashed (ED)
+ * and the legacy (Ed) signatures of minisign are accepted. The key ID isn't
+ * compared, since it only tells minisign which key to use, so signatures of
+ * keys that minisign generated with a random ID are accepted too.
+ *
+ * @param path          File path.
+ * @param signaturePath Signature file path.
+ * @param publicKey     Public key.
+ * @return Whether the signature matches.
+ */
+export async function verifyMinisignSignature(path, signaturePath, publicKey) {
+    const [, encoded = '', trusted = '', encodedGlobal = ''] = (await readFile(signaturePath, 'utf8'))
+        .split('\n')
+        .map((line) => line.trim());
+    const bytes = Buffer.from(encoded, 'base64');
+    const algorithm = bytes.subarray(0, 2).toString();
+    const signature = bytes.subarray(2 + KEY_ID_BYTES);
+    const isValidShape = 2 + KEY_ID_BYTES + SIGNATURE_BYTES === bytes.length &&
+        [HASHED_ALGORITHM, KEY_ALGORITHM].includes(algorithm) &&
+        trusted.startsWith(TRUSTED_PREFIX);
+    return (isValidShape &&
+        verify(null, HASHED_ALGORITHM === algorithm
+            ? await digestFile(path, 'blake2b512')
+            : await readFile(path), publicKey, signature) &&
+        verify(null, Buffer.concat([
+            signature,
+            Buffer.from(trusted.slice(TRUSTED_PREFIX.length)),
+        ]), publicKey, Buffer.from(encodedGlobal, 'base64')));
+}

package/dist/package-deploy.d.ts

@@ -7,6 +7,8 @@ export interface PackageDeployOptions {
     cwd: string;
     /** Config file, instead of the conventional one at the root. */
     configFile?: string;
+    /** Tag format that replaces the tagFormat of the config. */
+    tagFormat?: string;
     /**
      * Ref to deploy: a package release tag, like refs/tags/plugins/alpha/1.2.0,
      * or a branch, like refs/heads/main. A name without refs/ is a release tag
@@ -35,6 +37,10 @@ export interface PackageDeploy<Input> {
     target: string;
     /** Tag or branch that the deploy writes in the target. */
     targetRef: string;
+    /** Host of a remote target repository, like github.com. */
+    targetHost?: string;
+    /** Path of a remote target repository on its host, like owner/repo. */
+    targetPath?: string;
     /** Package, target and ref, with credentials redacted, for logs. */
     label: string;
     /** Options of the deploy. */
@@ -79,6 +85,24 @@ export declare function getDeployPackages(options: {
     cwd: string;
     configFile?: string;
 }): Promise<PackageDeployFiles[]>;
+/**
+ * Get a configured package with the files that its releases ship, from the
+ * files config of its package group, which its deploys use too, for example
+ * to build its ZIP with the same files. Any package of the config works, with
+ * or without a version or deploy targets.
+ *
+ * @param  options            Repository root, config file and package.
+ * @param  options.cwd        Repository root with the wp-release config.
+ * @param  options.configFile Config file, instead of the conventional one at the root.
+ * @param  options.package    Package identifier or path under the configured root.
+ * @return The package and its file selection.
+ * @throws {ValidationError} Without a config, for an invalid one or an unknown package.
+ */
+export declare function getPackageFiles(options: {
+    cwd: string;
+    configFile?: string;
+    package: string;
+}): Promise<PackageDeployFiles>;
 /** Ignore file and patterns that select the files of a package. */
 export interface PackageFileSelection {
     /** Absolute ignore file path, or false to not read one. */
@@ -93,6 +117,10 @@ export interface PackageDeployPlanItem extends PackageDeployRelease {
     targets: Array<{
         target: string;
         ref: string;
+        /** Host of a remote target repository. */
+        host?: string;
+        /** Path of a remote target repository on its host. */
+        path?: string;
     }>;
 }
 /**

package/dist/package-deploy.js

@@ -1,11 +1,11 @@
 import { realpath } from 'node:fs/promises';
 import path from 'node:path';
 import { loadChangesetConfig, toTargetList } from "./changeset-config.js";
-import { discoverDeployPackages, findPackage } from "./changeset-packages.js";
+import { discoverDeployPackages, discoverConfiguredPackages, findPackage, } from "./changeset-packages.js";
 import { ValidationError } from "./errors.js";
-import { redactUrls } from "./git.js";
+import { parseRepositoryUrl, redactUrls } from "./git.js";
 import { ReleaseRepository } from "./release-repository.js";
-import { formatTag } from "./tag-format.js";
+import { DEFAULT_TAG_FORMAT, formatTag, formatTemplate } from "./tag-format.js";
 import { isPrerelease, isVersion } from "./versions.js";
 /**
  * Get the Git deploys of the configured packages that a ref releases: every
@@ -65,10 +65,35 @@ export async function getDeployPackages(options) {
         files: getFileSelection(pkg, config),
     }));
 }
+/**
+ * Get a configured package with the files that its releases ship, from the
+ * files config of its package group, which its deploys use too, for example
+ * to build its ZIP with the same files. Any package of the config works, with
+ * or without a version or deploy targets.
+ *
+ * @param  options            Repository root, config file and package.
+ * @param  options.cwd        Repository root with the wp-release config.
+ * @param  options.configFile Config file, instead of the conventional one at the root.
+ * @param  options.package    Package identifier or path under the configured root.
+ * @return The package and its file selection.
+ * @throws {ValidationError} Without a config, for an invalid one or an unknown package.
+ */
+export async function getPackageFiles(options) {
+    const config = await requireConfig(options);
+    const pkg = findPackage(await discoverConfiguredPackages(new ReleaseRepository({ cwd: options.cwd }), config), options.package);
+    if (!pkg) {
+        throw new ValidationError(`Unknown package "${options.package}".`);
+    }
+    return {
+        ...toDeployPackage(pkg),
+        files: getFileSelection(pkg, config),
+    };
+}
 async function requireConfig(options) {
     const loaded = await loadChangesetConfig({
         cwd: options.cwd,
         ...(options.configFile ? { configFile: options.configFile } : {}),
+        ...(options.tagFormat ? { tagFormat: options.tagFormat } : {}),
     });
     if (!loaded) {
         throw new ValidationError('No wp-release config found. Add wp-release.config.js or pass --config <path>.');
@@ -112,7 +137,7 @@ function selectPackages(packages, identifiers) {
  * @return Releases.
  */
 function getReleases(packages, config, ref) {
-    const tagFormat = config.tagFormat ?? '{path}/{version}';
+    const tagFormat = config.tagFormat ?? DEFAULT_TAG_FORMAT;
     const tag = ref.startsWith('refs/tags/')
         ? ref.slice('refs/tags/'.length)
         : ref;
@@ -156,12 +181,16 @@ async function getGitDeploy(target, release, config, root, options) {
             .relative(root, await realpath(pkg.directory))
             .split(path.sep)
             .join('/');
+    const location = repository ? parseRepositoryUrl(repository) : undefined;
     return repository
         ? {
             package: toDeployPackage(pkg),
             release: toRelease(release),
             target: redactUrls(repository),
             targetRef: ref,
+            ...(location
+                ? { targetHost: location.host, targetPath: location.path }
+                : {}),
             label: `${pkg.name} to ${redactUrls(repository)} ${ref}`,
             input: {
                 cwd: options.cwd,
@@ -181,7 +210,10 @@ async function getSvnDeploy(target, release, config, options) {
     const pkg = release.package;
     const version = release.version ?? '';
     const stable = !isPrerelease(version);
-    const slug = await resolveTemplate(target.slug ?? '{slug}', release, version);
+    // The WordPress.org slug is the name of the package directory by default.
+    const slug = target.slug
+        ? await resolveTemplate(target.slug, release, version)
+        : path.basename(pkg.directory);
     const message = target.message
         ? await resolveTemplate(target.message, release, version)
         : '';
@@ -230,7 +262,7 @@ async function resolveTemplate(template, release, ref) {
             ref,
             revision: release.revision,
         })
-        : formatTag(template, release.package, release.version ?? '')
+        : formatTemplate(template, release.package, release.version ?? '')
             .replaceAll('{branch}', release.branch ?? '')
             .replaceAll('{ref}', ref)
             .replaceAll('{revision}', release.revision);
@@ -282,6 +314,9 @@ export function getDeployPlan(deploys) {
             targets: items.map((item) => ({
                 target: item.target,
                 ref: item.targetRef,
+                ...(item.targetHost
+                    ? { host: item.targetHost, path: item.targetPath }
+                    : {}),
             })),
         };
     });

package/dist/package-zip.d.ts

@@ -0,0 +1,52 @@
+import type { PackageType } from './checksums.ts';
+import type { FileSelection } from './file-selection.ts';
+export interface ZipPackageInput {
+    /** Directory to archive. */
+    sourceDir: string;
+    /** File selection from resolveFileSelection(). */
+    selection: FileSelection;
+    /** Archive path. */
+    zipPath: string;
+    /** Folder inside the archive, or null for the root. */
+    rootFolder: string | null;
+    /** Plugin or theme slug, for the checksums manifest. */
+    slug: string;
+    /** Version for the checksums manifest. */
+    version?: string | null;
+    /** Package type for the checksums manifest. */
+    type?: PackageType;
+    /** Also write the checksums manifest next to the archive. */
+    checksums?: boolean;
+    /** Overwrite existing output files. */
+    force?: boolean;
+}
+/** Result of zipPackage(). */
+export interface ZipPackageResult {
+    /** Absolute path of the ZIP. */
+    zipPath: string;
+    /** Absolute path of the checksums manifest, set with checksums. */
+    checksumsPath?: string;
+    /** Number of archived files. */
+    files: number;
+}
+/**
+ * Get the checksums manifest path next to an archive, with .checksums.json
+ * instead of .zip.
+ *
+ * @param zipPath Archive path.
+ * @return Manifest path.
+ */
+export declare function getChecksumsPath(zipPath: string): string;
+/**
+ * Write a ZIP of the selected files of a plugin, theme or package, and
+ * optionally the checksums manifest of the same files next to it. The zip
+ * command, with a directory or a configured package release, and the
+ * snapshot builds of a monorepo all use it, so that every ZIP of a package
+ * selects its files the same way. Output files inside the source directory,
+ * and their signatures, are never archived.
+ *
+ * @param  input Files, archive path and manifest options.
+ * @return Paths of the written files and the number of archived files.
+ * @throws {ValidationError} Without selected files, or when an output file exists without force.
+ */
+export declare function zipPackage(input: ZipPackageInput): Promise<ZipPackageResult>;