@wpelevator/wp-release 0.15.0 → 0.17.0

package/dist/i18n/translation-json.js

@@ -0,0 +1,96 @@
+import { createHash } from 'node:crypto';
+import { posix } from 'node:path';
+import { ValidationError } from "../errors.js";
+import { compareText } from "./catalog.js";
+import { translationKey } from "./po.js";
+function normalizedPath(path) {
+    if (!path ||
+        path.includes('\\') ||
+        path.includes('\0') ||
+        posix.isAbsolute(path) ||
+        /^[A-Za-z]:/.test(path) ||
+        path
+            .split('/')
+            .some((component) => ['', '.', '..'].includes(component))) {
+        throw new ValidationError(`Script translation paths must be normalized package-relative paths: ${path}.`);
+    }
+    return path;
+}
+/**
+ * Compile deterministic Jed catalogs using explicit source/build mapping or unbundled identity paths.
+ * @param catalog
+ * @param mapping
+ */
+export function compileScriptTranslations(catalog, mapping) {
+    if (!/^[A-Za-z0-9][A-Za-z0-9_.-]*$/.test(catalog.domain)) {
+        throw new ValidationError('JSON compilation requires a safe text domain filename component.');
+    }
+    if (mapping) {
+        for (const [source, scripts] of Object.entries(mapping)) {
+            normalizedPath(source);
+            if (!Array.isArray(scripts) ||
+                scripts.some((script) => 'string' !== typeof script)) {
+                throw new ValidationError('Script maps must contain arrays of runtime script paths.');
+            }
+            scripts.forEach(normalizedPath);
+        }
+    }
+    const groups = new Map();
+    for (const message of catalog.messages) {
+        for (const reference of message.references) {
+            const source = normalizedPath(reference.file);
+            let scripts = [];
+            if (mapping) {
+                scripts = Object.hasOwn(mapping, source)
+                    ? mapping[source] ?? []
+                    : [];
+            }
+            else if (/\.(?:js|mjs|cjs)$/.test(source)) {
+                scripts = [source];
+            }
+            else if (/\.(?:jsx|tsx?|mts|cts)$/.test(source)) {
+                throw new ValidationError(`A source-to-runtime script map is required for ${source}.`);
+            }
+            for (const script of scripts) {
+                // WordPress hashes the unminified script path when the registered URL ends in .min.js.
+                const runtime = normalizedPath(script).replace(/\.min\.js$/, '.js');
+                if (!/\.(?:js|mjs|cjs)$/.test(runtime)) {
+                    throw new ValidationError(`Runtime translation target must be a JavaScript file: ${runtime}.`);
+                }
+                const entries = groups.get(runtime) ??
+                    new Map();
+                entries.set(translationKey(message), message);
+                groups.set(runtime, entries);
+            }
+        }
+    }
+    return [...groups.entries()]
+        .sort(([a], [b]) => compareText(a, b))
+        .map(([source, entries]) => {
+        const translations = Object.create(null);
+        translations[''] = {
+            domain: catalog.domain,
+            lang: catalog.locale,
+            'plural-forms': catalog.pluralForms,
+        };
+        for (const [key, message] of [...entries].sort(([a], [b]) => compareText(a, b))) {
+            translations[key] = [...message.translations];
+        }
+        const data = {
+            'translation-revision-date': catalog.headers['po-revision-date'] ?? '',
+            generator: '@wpelevator/wp-release',
+            domain: catalog.domain,
+            locale_data: { messages: translations },
+            source,
+        };
+        return {
+            source,
+            file: `${'default' === catalog.domain
+                ? catalog.locale
+                : `${catalog.domain}-${catalog.locale}`}-${createHash('md5')
+                .update(source)
+                .digest('hex')}.json`,
+            bytes: Buffer.from(JSON.stringify(data) + '\n'),
+        };
+    });
+}

package/dist/i18n/translation-php.d.ts

@@ -0,0 +1,6 @@
+import type { TranslatedCatalog } from './po.ts';
+/**
+ * WordPress 6.5+ translation-array format; catalog text is never interpolated as PHP code.
+ * @param catalog
+ */
+export declare function compilePhpTranslations(catalog: TranslatedCatalog): Buffer;

package/dist/i18n/translation-php.js

@@ -0,0 +1,35 @@
+import { compareText } from "./catalog.js";
+import { translationKey } from "./po.js";
+/**
+ * Single-quoted PHP data values; NUL separators use an explicit safe literal expression.
+ * @param value
+ */
+function phpString(value) {
+    return value
+        .split('\0')
+        .map((part) => `'${part
+        .replaceAll('\\', '\\\\')
+        .replaceAll("'", "\\'")}'`)
+        .join(' . "\\0" . ');
+}
+/**
+ * WordPress 6.5+ translation-array format; catalog text is never interpolated as PHP code.
+ * @param catalog
+ */
+export function compilePhpTranslations(catalog) {
+    const headers = Object.entries(catalog.headers)
+        .filter(([key]) => 'messages' !== key)
+        .sort(([a], [b]) => compareText(a, b));
+    const messages = catalog.messages.map((message) => `\t\t${phpString(translationKey(message))} => ${phpString(message.translations.join('\0'))},`);
+    const lines = [
+        '<?php',
+        'return [',
+        ...headers.map(([key, value]) => `\t${phpString(key)} => ${phpString(value)},`),
+        "\t'messages' => [",
+        ...messages,
+        '\t],',
+        '];',
+        '',
+    ];
+    return Buffer.from(lines.join('\n'));
+}

package/dist/index.d.ts

@@ -59,3 +59,31 @@ export type { SummaryContext } from './summary.ts';
 export type { CheckoutPath, DeployResult } from './svn-deploy.ts';
 export type { GitCommandInput, GitCommandOutput, GitRunner, RepositoryLocation, } from './git.ts';
 export type { GitDeployInput, GitDeployOptions, GitDeployResult, } from './git-deploy.ts';
+export type { SingleProjectOptions } from './single-project.ts';
+export { buildPackage } from './package-build.ts';
+export type { BuildPackageInput, BuildPackageResult } from './package-build.ts';
+export type { BuildResult } from './commands/build.ts';
+export { wordpressCodec, sha256sumCodec, resolveManifestCodec, readIntegrity, } from './integrity.ts';
+export type { ManifestCodec, IntegrityConfig } from './integrity.ts';
+export { aggregateCatalog, hasFatalDiagnostics } from './i18n/catalog.ts';
+export type { Catalog, CatalogMessage, ExtractedMessage, SourceReference, I18nDiagnostic, ExtractionResult, CatalogResult, } from './i18n/catalog.ts';
+export { parsePhpTranslations } from './i18n/php.ts';
+export { parseJavascriptTranslations } from './i18n/javascript.ts';
+export { parseMetadataTranslations, extractHeaderTranslations, } from './i18n/metadata.ts';
+export type { ParseSourceInput } from './i18n/extraction.ts';
+export { auditCatalog } from './i18n/audit.ts';
+export { serializePot } from './i18n/pot.ts';
+export { discoverI18nFiles } from './i18n/files.ts';
+export { resolveI18nOptions, DEFAULT_I18N_INCLUDE, DEFAULT_I18N_EXCLUDE, } from './i18n/options.ts';
+export type { I18nHeaders, I18nOptions } from './i18n/options.ts';
+export { extractCatalog, generatePackagePot, resolvePotPath, validatePotDestinations, } from './i18n/generate.ts';
+export type { ExtractCatalogInput, ExtractCatalogResult, PackagePotInput, PackagePotResult, } from './i18n/generate.ts';
+export { resolveI18nPackages } from './i18n/packages.ts';
+export type { I18nPackageInput, I18nPackage } from './i18n/packages.ts';
+export { parseTranslatedPo, compileMo } from './i18n/po.ts';
+export type { TranslatedCatalog } from './i18n/po.ts';
+export { compileScriptTranslations } from './i18n/translation-json.ts';
+export type { ScriptTranslationMap, ScriptTranslationOutput, } from './i18n/translation-json.ts';
+export { compilePhpTranslations } from './i18n/translation-php.ts';
+export { compileTranslations } from './i18n/compile.ts';
+export type { CompileTranslationsInput, CompileTranslationsResult, } from './i18n/compile.ts';

package/dist/index.js

@@ -27,3 +27,19 @@ export { GitDeploy, getDefaultToken, getGitAuthEnv, isValidRefName, resolveGitDe
 export { getGitDeployInputFromArgs } from "./commands/deploy-git.js";
 export { getDeployPackages, getGitDeploys, getPackageFiles, getSvnDeploys, } from "./package-deploy.js";
 export { zipPackage } from "./package-zip.js";
+export { buildPackage } from "./package-build.js";
+export { wordpressCodec, sha256sumCodec, resolveManifestCodec, readIntegrity, } from "./integrity.js";
+export { aggregateCatalog, hasFatalDiagnostics } from "./i18n/catalog.js";
+export { parsePhpTranslations } from "./i18n/php.js";
+export { parseJavascriptTranslations } from "./i18n/javascript.js";
+export { parseMetadataTranslations, extractHeaderTranslations, } from "./i18n/metadata.js";
+export { auditCatalog } from "./i18n/audit.js";
+export { serializePot } from "./i18n/pot.js";
+export { discoverI18nFiles } from "./i18n/files.js";
+export { resolveI18nOptions, DEFAULT_I18N_INCLUDE, DEFAULT_I18N_EXCLUDE, } from "./i18n/options.js";
+export { extractCatalog, generatePackagePot, resolvePotPath, validatePotDestinations, } from "./i18n/generate.js";
+export { resolveI18nPackages } from "./i18n/packages.js";
+export { parseTranslatedPo, compileMo } from "./i18n/po.js";
+export { compileScriptTranslations } from "./i18n/translation-json.js";
+export { compilePhpTranslations } from "./i18n/translation-php.js";
+export { compileTranslations } from "./i18n/compile.js";

package/dist/integrity.d.ts

@@ -0,0 +1,33 @@
+import type { ChecksumsManifest, ChecksumAlgorithm } from './checksums.ts';
+import type { SignatureFormat } from './signing.ts';
+/** Custom codecs receive the validated WordPress-compatible integrity model. */
+export interface ManifestCodec {
+    id: string;
+    filename: string;
+    encode: (manifest: ChecksumsManifest) => Uint8Array | Promise<Uint8Array>;
+    decode: (bytes: Uint8Array) => ChecksumsManifest | Promise<ChecksumsManifest>;
+}
+export interface IntegrityConfig {
+    codec?: 'wordpress-json' | 'sha256sum' | ManifestCodec;
+    algorithms?: ChecksumAlgorithm[];
+    file?: string;
+    embed?: boolean;
+    sign?: false | {
+        formats?: SignatureFormat[];
+    };
+}
+export declare const wordpressCodec: ManifestCodec;
+export declare const sha256sumCodec: ManifestCodec;
+export declare function resolveManifestCodec(value?: IntegrityConfig['codec']): ManifestCodec;
+/**
+ * Relative artifact paths cannot escape their destination or use Windows paths.
+ * @param file
+ */
+export declare function checkChecksumsFile(file: string): string;
+export declare function readIntegrity(path: string, codec?: IntegrityConfig['codec']): Promise<ChecksumsManifest>;
+/**
+ * Encode once and ensure the format preserves the selected payload hashes.
+ * @param codec
+ * @param manifest
+ */
+export declare function encodeIntegrity(codec: ManifestCodec, manifest: ChecksumsManifest): Promise<Buffer>;

package/dist/integrity.js

@@ -0,0 +1,115 @@
+import { readFile } from 'node:fs/promises';
+import { basename } from 'node:path';
+import { parseChecksums, readChecksums } from "./checksums.js";
+import { ValidationError } from "./errors.js";
+export const wordpressCodec = {
+    id: 'wordpress-json',
+    filename: 'checksums.json',
+    encode: (manifest) => Buffer.from(JSON.stringify(manifest, null, '\t') + '\n'),
+    decode: (bytes) => parseChecksums(Buffer.from(bytes).toString('utf8')),
+};
+export const sha256sumCodec = {
+    id: 'sha256sum',
+    filename: 'SHA256SUMS',
+    encode(manifest) {
+        const lines = Object.entries(manifest.files)
+            .sort()
+            .map(([path, hashes]) => {
+            if ('string' !== typeof hashes.sha256) {
+                throw new ValidationError('sha256sum requires one SHA-256 digest per file.');
+            }
+            const escaped = /[\\\n\r]/.test(path);
+            const name = path
+                .replaceAll('\\', '\\\\')
+                .replaceAll('\n', '\\n')
+                .replaceAll('\r', '\\r');
+            return `${escaped ? '\\' : ''}${hashes.sha256}  ${name}`;
+        });
+        return Buffer.from(lines.join('\n') + '\n');
+    },
+    decode(bytes) {
+        const files = Object.create(null);
+        for (const line of Buffer.from(bytes)
+            .toString('utf8')
+            .split('\n')
+            .filter(Boolean)) {
+            const match = /^(\\?)([a-fA-F0-9]{64}) [ *](.+)$/.exec(line);
+            if (!match) {
+                throw new ValidationError('Invalid SHA256SUMS entry.');
+            }
+            const path = match[1]
+                ? (match[3] ?? '').replace(/\\([\\nr])/g, (_, char) => ({ n: '\n', r: '\r', '\\': '\\' })[char] ?? '')
+                : match[3] ?? '';
+            if (Object.hasOwn(files, path)) {
+                throw new ValidationError(`Duplicate checksum path: ${path}`);
+            }
+            files[path] = { sha256: (match[2] ?? '').toLowerCase() };
+        }
+        return parseChecksums(JSON.stringify({ files }));
+    },
+};
+export function resolveManifestCodec(value = 'wordpress-json') {
+    if (typeof value === 'string') {
+        if (!['wordpress-json', 'sha256sum'].includes(value)) {
+            throw new ValidationError(`Unknown checksums format: ${value}.`);
+        }
+        return value === 'sha256sum' ? sha256sumCodec : wordpressCodec;
+    }
+    if (!value ||
+        typeof value.encode !== 'function' ||
+        typeof value.decode !== 'function' ||
+        !value.id ||
+        !value.filename) {
+        throw new ValidationError('A checksums codec needs id, filename, encode and decode.');
+    }
+    return value;
+}
+/**
+ * Relative artifact paths cannot escape their destination or use Windows paths.
+ * @param file
+ */
+export function checkChecksumsFile(file) {
+    if (!file ||
+        /[\\\x00-\x1f:]/.test(file) ||
+        file
+            .split('/')
+            .some((part) => !part || part === '.' || part === '..')) {
+        throw new ValidationError('--checksums-file must be a relative file path with forward slashes and no dot segments.');
+    }
+    return file;
+}
+export async function readIntegrity(path, codec) {
+    const selected = resolveManifestCodec(codec ??
+        (basename(path) === 'SHA256SUMS'
+            ? 'sha256sum'
+            : 'wordpress-json'));
+    const manifest = selected === wordpressCodec
+        ? await readChecksums(path)
+        : await selected.decode(await readFile(path));
+    return parseChecksums(JSON.stringify(manifest), path);
+}
+/**
+ * Encode once and ensure the format preserves the selected payload hashes.
+ * @param codec
+ * @param manifest
+ */
+export async function encodeIntegrity(codec, manifest) {
+    const bytes = Buffer.from(await codec.encode(manifest));
+    const decoded = parseChecksums(JSON.stringify(await codec.decode(bytes)));
+    const expected = Object.keys(manifest.files);
+    const actual = Object.keys(decoded.files);
+    const preserved = expected.length === actual.length &&
+        actual.every((path) => {
+            const hashes = decoded.files[path];
+            return (Boolean(manifest.files[path]) &&
+                Object.entries(hashes ?? {}).every(([algorithm, digest]) => digest ===
+                    manifest.files[path]?.[algorithm]));
+        });
+    if (!preserved ||
+        ['plugin', 'theme', 'version'].some((key) => decoded[key] !== undefined &&
+            decoded[key] !==
+                manifest[key])) {
+        throw new ValidationError('The checksums codec must preserve payload paths, digests and any represented package identity.');
+    }
+    return bytes;
+}

package/dist/output-files.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Validate generated file destinations before writing release artifacts.
+ *
+ * @param paths Output file paths.
+ * @param force Whether existing regular files can be overwritten.
+ */
+export declare function checkOutputFiles(paths: string[], force: boolean): void;

package/dist/output-files.js

@@ -0,0 +1,25 @@
+import { lstatSync } from 'node:fs';
+import { ValidationError } from "./errors.js";
+import { isErrorCode } from "./file-selection.js";
+/**
+ * Validate generated file destinations before writing release artifacts.
+ *
+ * @param paths Output file paths.
+ * @param force Whether existing regular files can be overwritten.
+ */
+export function checkOutputFiles(paths, force) {
+    for (const path of paths) {
+        let existing;
+        try {
+            existing = lstatSync(path);
+        }
+        catch (error) {
+            if (!isErrorCode(error, 'ENOENT')) {
+                throw error;
+            }
+        }
+        if (existing && (!force || !existing.isFile())) {
+            throw new ValidationError(`${path} already exists, pass --force to overwrite a regular file.`);
+        }
+    }
+}

package/dist/package-build.d.ts

@@ -0,0 +1,33 @@
+import type { PackageType } from './checksums.ts';
+import type { FileSelection } from './file-selection.ts';
+export interface BuildPackageInput {
+    sourceDir: string;
+    selection: FileSelection;
+    outputDir: string;
+    force?: boolean;
+    /** Write a checksums manifest alongside the build directory. */
+    checksums?: boolean;
+    /** Slug and version for the manifest. */
+    slug?: string;
+    version?: string | null;
+    type?: PackageType;
+}
+export interface BuildPackageResult {
+    outputDir: string;
+    files: number;
+    checksumsPath?: string;
+}
+/**
+ * Get the manifest path alongside a build directory.
+ *
+ * @param outputDir Build directory path.
+ * @return Absolute manifest path.
+ */
+export declare function getBuildChecksumsPath(outputDir: string): string;
+/**
+ * Copy the release selection into a directory, replacing an existing build only with force.
+ *
+ * @param input Source selection, destination and overwrite option.
+ * @return Destination and number of copied files.
+ */
+export declare function buildPackage(input: BuildPackageInput): Promise<BuildPackageResult>;

package/dist/package-build.js

@@ -0,0 +1,112 @@
+import { CHECKSUMS_EXTENSION, createChecksums, writeChecksums, } from "./checksums.js";
+import { checkOutputFiles } from "./output-files.js";
+import { copyFile, lstat, mkdir, mkdtemp, realpath, rename, rm, } from 'node:fs/promises';
+import { basename, dirname, isAbsolute, join, relative, resolve, } from 'node:path';
+import { ValidationError } from "./errors.js";
+import { isErrorCode } from "./file-selection.js";
+import { getPackageFilesToRelease } from "./package-files.js";
+/**
+ * Get the manifest path alongside a build directory.
+ *
+ * @param outputDir Build directory path.
+ * @return Absolute manifest path.
+ */
+export function getBuildChecksumsPath(outputDir) {
+    return resolve(outputDir) + CHECKSUMS_EXTENSION;
+}
+/**
+ * Resolve existing ancestors too, so symlinked parents cannot overlap the source.
+ *
+ * @param path Directory path.
+ * @return Canonical path, including any missing child directories.
+ */
+async function resolveDirectoryPath(path) {
+    try {
+        return await realpath(path);
+    }
+    catch (error) {
+        if (isErrorCode(error, 'ENOENT')) {
+            return join(await resolveDirectoryPath(dirname(path)), basename(path));
+        }
+        throw error;
+    }
+}
+/**
+ * Copy the release selection into a directory, replacing an existing build only with force.
+ *
+ * @param input Source selection, destination and overwrite option.
+ * @return Destination and number of copied files.
+ */
+export async function buildPackage(input) {
+    const sourceDir = await realpath(input.sourceDir);
+    const outputDir = resolve(input.outputDir);
+    const canonicalOutput = await resolveDirectoryPath(outputDir);
+    const sourceFromOutput = relative(canonicalOutput, sourceDir);
+    const outputContainsSource = !sourceFromOutput ||
+        (!isAbsolute(sourceFromOutput) &&
+            sourceFromOutput !== '..' &&
+            !sourceFromOutput.startsWith('../'));
+    if (outputContainsSource) {
+        throw new ValidationError('The build output must not be the source directory or an ancestor of it.');
+    }
+    const existing = await lstat(outputDir).catch((error) => {
+        if (isErrorCode(error, 'ENOENT')) {
+            return null;
+        }
+        throw error;
+    });
+    if (existing && (!input.force || !existing.isDirectory())) {
+        throw new ValidationError(`${outputDir} already exists; use --force to replace an existing directory.`);
+    }
+    const checksumsPath = input.checksums
+        ? getBuildChecksumsPath(outputDir)
+        : null;
+    if (checksumsPath) {
+        checkOutputFiles([checksumsPath], input.force ?? false);
+    }
+    const { files, rules } = await getPackageFilesToRelease({
+        sourceDir,
+        selection: input.selection,
+        outputs: [
+            canonicalOutput,
+            ...(checksumsPath
+                ? [canonicalOutput + CHECKSUMS_EXTENSION]
+                : []),
+        ],
+        excludeSignatures: !!checksumsPath,
+        operation: 'build',
+    });
+    await mkdir(dirname(outputDir), { recursive: true });
+    const staging = await mkdtemp(join(dirname(outputDir), '.wp-release-build-'));
+    try {
+        for (const file of files) {
+            const target = join(staging, file);
+            await mkdir(dirname(target), { recursive: true });
+            await copyFile(join(sourceDir, file), target);
+        }
+        const manifest = checksumsPath
+            ? await createChecksums({
+                sourceDir: staging,
+                rules,
+                slug: input.slug ?? basename(sourceDir),
+                version: input.version,
+                type: input.type,
+            })
+            : null;
+        if (existing) {
+            await rm(outputDir, { recursive: true });
+        }
+        await rename(staging, outputDir);
+        if (checksumsPath && manifest) {
+            await writeChecksums(checksumsPath, manifest, input.force);
+        }
+    }
+    finally {
+        await rm(staging, { recursive: true, force: true });
+    }
+    return {
+        outputDir,
+        files: files.length,
+        ...(checksumsPath ? { checksumsPath } : {}),
+    };
+}

package/dist/package-files.d.ts

@@ -0,0 +1,25 @@
+import type { FileRules, FileSelection } from './file-selection.ts';
+interface PackageFilesInput {
+    /** Directory whose release files are selected. */
+    sourceDir: string;
+    /** Resolved ignore file and exclusion options. */
+    selection: FileSelection;
+    /** Absolute output paths to leave out of the release. */
+    outputs: string[];
+    /** Also exclude signatures of the output files. */
+    excludeSignatures?: boolean;
+    /** Operation name used in an empty-selection error. */
+    operation: 'build' | 'archive';
+}
+/**
+ * Prepare the release file selection shared by directory builds and ZIPs.
+ *
+ * @param  input Source, file selection and output exclusions.
+ * @return Sorted file paths and the rules used to select them.
+ * @throws {ValidationError} When no release files are selected.
+ */
+export declare function getPackageFilesToRelease(input: PackageFilesInput): Promise<{
+    files: string[];
+    rules: FileRules;
+}>;
+export {};

package/dist/package-files.js

@@ -0,0 +1,24 @@
+import { ValidationError } from "./errors.js";
+import { ignoreOwnFile, ignoreOwnSignature, loadFileRules, selectFiles, } from "./file-selection.js";
+/**
+ * Prepare the release file selection shared by directory builds and ZIPs.
+ *
+ * @param  input Source, file selection and output exclusions.
+ * @return Sorted file paths and the rules used to select them.
+ * @throws {ValidationError} When no release files are selected.
+ */
+export async function getPackageFilesToRelease(input) {
+    const { sourceDir, selection, outputs, excludeSignatures, operation } = input;
+    const rules = await loadFileRules(selection);
+    outputs.forEach((path) => {
+        ignoreOwnFile(rules, sourceDir, path);
+        if (excludeSignatures) {
+            ignoreOwnSignature(rules, sourceDir, path);
+        }
+    });
+    const files = await selectFiles(sourceDir, rules);
+    if (!files.length) {
+        throw new ValidationError(`No files to ${operation} in ${sourceDir}.`);
+    }
+    return { files, rules };
+}

package/dist/package-zip.d.ts

@@ -1,3 +1,5 @@
+import type { IntegrityConfig } from './integrity.ts';
+import type { SignFilesResult, SignatureFormat } from './signing.ts';
 import type { PackageType } from './checksums.ts';
 import type { FileSelection } from './file-selection.ts';
 export interface ZipPackageInput {
@@ -15,8 +17,13 @@ export interface ZipPackageInput {
     version?: string | null;
     /** Package type for the checksums manifest. */
     type?: PackageType;
-    /** Also write the checksums manifest next to the archive. */
+    /** Generate a checksums manifest beside the archive or embedded in it. */
     checksums?: boolean;
+    checksumsFile?: string;
+    embedChecksums?: boolean;
+    integrity?: IntegrityConfig;
+    /** Sign the manifest only, before embedding it. */
+    signChecksums?: SignatureFormat[];
     /** Overwrite existing output files. */
     force?: boolean;
 }
@@ -24,8 +31,13 @@ export interface ZipPackageInput {
 export interface ZipPackageResult {
     /** Absolute path of the ZIP. */
     zipPath: string;
-    /** Absolute path of the checksums manifest, set with checksums. */
+    /** Absolute path of the external manifest; absent when disabled or embedded. */
     checksumsPath?: string;
+    /** Relative path inside the package, only in embedded mode. */
+    checksumsEmbedded?: string;
+    /** Manifest signatures, external paths or package-relative embedded paths. */
+    checksumsSignatures?: string[];
+    checksumsSigning?: SignFilesResult;
     /** Number of archived files. */
     files: number;
 }