@wpelevator/wp-release 0.7.0 → 0.9.0

package/README.md

@@ -14,7 +14,7 @@ Option names follow the existing community tools (10up WordPress.org actions, `w
 npm install --save-dev @wpelevator/wp-release
 ```
 
-Requires Node.js 22.12 or later. `deploy-svn` also needs the `svn` command line client.
+Requires Node.js 22.12 or later. `deploy-svn` also needs the `svn` command line client; the optional `--exclude-gitattributes` flag needs Git.
 
 The package is an ES module with TypeScript type definitions. CommonJS projects can load it with `require( '@wpelevator/wp-release' )`, which Node.js supports for ES modules without top-level `await` since 22.12.
 
@@ -29,6 +29,7 @@ npx wp-release --help
 | `wp-release zip [<source-dir>] [options]` | Create a ZIP archive with a `{slug}/` root folder, respecting `.distignore`. |
 | `wp-release checksums [<source-dir>] [options]` | Write the MD5 and SHA-256 hashes of every distributed file to a checksums manifest. |
 | `wp-release sign <file>... [options]` | Sign files with Ed25519, writing a detached `<file>.sig` next to each. |
+| `wp-release keygen` | Generate a base64 Ed25519 private seed and public key for signing and verification. |
 | `wp-release verify [<source-dir>] --checksums <file> [options]` | Check a plugin or theme directory, or a ZIP, against a checksums manifest. |
 | `wp-release version-check [<source-dir>] [options]` | Check that the `Version` header, readme `Stable tag`, PHP constants and git tag agree. |
 | `wp-release deploy-svn [<source-dir>] [options]` | Deploy a plugin to the WordPress.org plugin SVN repository. |
@@ -131,6 +132,16 @@ Add release notes in a feature PR with `npx wp-release changeset-add --package @
 
 On the release branch, preview with `changeset-version --dry-run`, then run `changeset-version` to update version targets and changelogs. By default, new Markdown entries go before the first version heading; `changelogInsertAfter` sets a literal insertion marker for `CHANGELOG.md` and, with `readmeChangelog`, the plugin readme. Put the marker in both files; a missing marker is an error. Without a marker, plugin readmes use the `== Changelog ==` heading. Failed updates are rolled back for safe retries.
 
+Configure `changelogEntry( { package, changeset, commit } )` to format the changelog entry of each changeset, where `commit` is the `{ hash, shortHash, subject }` of the commit that added the changeset file, if it's committed. The formatted entries go into `CHANGELOG.md`, the `changelog` of each release in the `changeset-version` result, and so the release notes; plugin readmes keep the plain summaries. `getGitHubPullRequest( { cwd, commit } )` finds the `{ number, url, author }` of the pull request that merged a commit with the authenticated `gh` CLI, for example to credit it:
+
+```js
+changelogEntry: async ( { changeset, commit } ) => {
+	const pullRequest = commit && ( await getGitHubPullRequest( { cwd: import.meta.dirname, commit: commit.hash } ) );
+
+	return pullRequest ? `${ changeset.summary } (#${ pullRequest.number } by @${ pullRequest.author })` : changeset.summary;
+},
+```
+
 To release packages separately, for example with a release pull request for each, pass `--package <name>`, repeatable, to version only those packages. A changeset that also names other packages keeps only their entries and its summary, so it still applies to their releases with the same bump. Changesets without packages are left for a run without `--package`.
 
 The `changeset-version` result lists each release with its `package`, `bump`, `currentVersion`, `nextVersion` and `changelog` entries, a Markdown list like the one added to `CHANGELOG.md`. Use it to name and describe the release pull request in a repository script, or call `versionChangesets()` from the library and format the entries of each release with `formatChangelogEntries( release.changesets )`.
@@ -178,15 +189,16 @@ CLI JSON results use camelCase keys like `zipPath`, and GitHub Action outputs us
 
 ### File selection
 
-`zip`, `checksums` and `deploy-svn` select files the same way:
+`zip`, `checksums`, `deploy-svn` and `deploy-git` select files the same way:
 
 | Option | Description |
 |---|---|
 | `--distignore <file>` | Path to the ignore file. Defaults to `.distignore` in the source directory when present; an explicitly passed file must exist. |
 | `--no-distignore` | Don't read any ignore file. |
 | `--exclude <patterns>` | Extra gitignore-style patterns, comma-separated or repeated, like `--exclude build/,assets/*,images/**/*`. They're applied after the ignore file, so a `!` pattern can also re-include a file. |
+| `--exclude-gitattributes` | Also exclude paths marked `export-ignore` by Git attributes. This is opt-in and requires the source directory to be inside a Git repository. |
 
-Both use full gitignore syntax, including `!` negation. Version control metadata (`.git`, `.svn` and `.hg`, at any depth, including the `.git` files of worktrees and submodules) is always left out, also without an ignore file and when deploying from a ZIP, and no `!` pattern can re-include it. This keeps a repository's history out of ZIPs and SVN deploys when the source directory is the repository root. The comma-separated `--exclude` list works like `--exclude` in `wp i18n make-pot`. `deploy-svn --from-zip` ignores both options, since the ZIP is already filtered. Symbolic links that aren't excluded are an error, since ZIP archives and WordPress.org SVN don't support them.
+`.distignore` and `--exclude` use full gitignore syntax, including `!` negation. `--exclude-gitattributes` asks Git to evaluate `export-ignore` attributes, including nested `.gitattributes` files, then adds those paths to the exclusions. It is off by default, so releases don't unexpectedly depend on Git or change selection when a repository adds attributes. Git must be installed and the source directory must be inside a working tree; the flag is ignored by `deploy-svn --from-zip`, since the ZIP is already filtered. Version control metadata (`.git`, `.svn` and `.hg`, at any depth, including the `.git` files of worktrees and submodules) is always left out, also without an ignore file and when deploying from a ZIP, and no `!` pattern can re-include it. This keeps a repository's history out of ZIPs and deploys when the source directory is the repository root. The comma-separated `--exclude` list works like `--exclude` in `wp i18n make-pot`. Selected symbolic links are an error, since ZIP archives and WordPress.org SVN don't support them.
 
 ### Plugin and theme headers
 
@@ -294,7 +306,7 @@ WP_RELEASE_SIGNING_KEY=… wp-release sign my-plugin.1.2.0.zip my-plugin.1.2.0.c
 - `--verbose` prints the public key of the signing key, which `--json` also returns as `publicKey`. Pass it to `verify --public-key` and to the plugin that checks the signatures.
 - An existing `.sig` file isn't overwritten without `--force`.
 
-Generating a key pair isn't part of the package yet. With PHP: `php -r 'echo base64_encode( random_bytes( 32 ) );'` gives a seed, and the public key is printed by `sign --verbose`.
+Generate a key pair with `wp-release keygen`. It prints the private seed once as `WP_RELEASE_SIGNING_KEY=…` and the matching public key. Store the private seed securely; never commit it or put it in a workflow log. Don't run `keygen` in CI or with `--github-output`, since those outputs can expose the private seed. The public key can be distributed to verifiers.
 
 ### Version check
 
@@ -528,7 +540,7 @@ const { valid, changed, missing, extra } = await verifyChecksums( {
 } );
 ```
 
-`loadFileRules()` reads the ignore file and `--exclude` patterns into a gitignore matcher and `selectFiles()` lists the files it doesn't ignore. `compareChecksums()` compares two hash maps without reading any files, and `parseChecksums()` validates manifest JSON. `extractZip()` extracts a ZIP after the same checks as `deploy-svn --from-zip`.
+`loadFileRules()` reads the ignore file and `--exclude` patterns into a gitignore matcher, optionally adds Git `export-ignore` paths, and `selectFiles()` lists the files it doesn't ignore. `compareChecksums()` compares two hash maps without reading any files, and `parseChecksums()` validates manifest JSON. `extractZip()` extracts a ZIP after the same checks as `deploy-svn --from-zip`.
 
 ## Development
 
@@ -550,9 +562,9 @@ The `wpelevator-source` export condition points at `src/index.ts`. The tests and
 
 | Tool | What it does | How `wp-release` differs |
 |---|---|---|
-| [10up WordPress.org plugin deploy](https://github.com/10up/action-wordpress-plugin-deploy) and [readme/asset update](https://github.com/10up/action-wordpress-plugin-asset-update) actions | Two separate GitHub Actions configured through env vars. A deploy always syncs the build to `trunk/` and copies it to the tag; readme and asset updates need the second action. Assets come from `.wordpress-org` by default, and files are selected with `.distignore` or `.gitattributes`. Files are synced with `rsync`. | One `deploy-svn` command with independent write flags, so a release, a readme-only update and an assets-only update are the same command with different flags. Runs locally and in any CI, not only GitHub Actions, and syncs in Node.js without `rsync`. Checks that the `Version` header, readme `Stable tag` and SVN tag agree before writing, which the 10up actions don't. Assets are deployed only when `--assets-dir` is passed, instead of always syncing `.wordpress-org` when it exists, so a plugin's own `assets/` folder is never uploaded by accident. Adds `--exclude` for patterns without an ignore file and `--from-zip` to deploy the exact files of a ZIP. |
+| [10up WordPress.org plugin deploy](https://github.com/10up/action-wordpress-plugin-deploy) and [readme/asset update](https://github.com/10up/action-wordpress-plugin-asset-update) actions | Two separate GitHub Actions configured through env vars. A deploy always syncs the build to `trunk/` and copies it to the tag; readme and asset updates need the second action. Assets come from `.wordpress-org` by default, and files are selected with `.distignore` or `.gitattributes`. Files are synced with `rsync`. | One `deploy-svn` command with independent write flags, so a release, a readme-only update and an assets-only update are the same command with different flags. Runs locally and in any CI, not only GitHub Actions, and syncs in Node.js without `rsync`. Checks that the `Version` header, readme `Stable tag` and SVN tag agree before writing, which the 10up actions don't. Assets are deployed only when `--assets-dir` is passed, instead of always syncing `.wordpress-org` when it exists, so a plugin's own `assets/` folder is never uploaded by accident. Adds `--exclude` for patterns without an ignore file, opt-in Git `export-ignore` support and `--from-zip` to deploy the exact files of a ZIP. |
 | [`grunt-wp-deploy`](https://github.com/stephenharris/grunt-wp-deploy) | Grunt task with `deploy_trunk` and `deploy_tag` booleans, interactive password prompts and a `Stable tag` check. | No Grunt dependency and never interactive. `--readme-only` is a separate flag, where `grunt-wp-deploy` can only update trunk with the full build. Assets are independent of trunk writes. |
 | [codeinwp theme deploy](https://github.com/codeinwp/action-wordpress-theme-deploy) | Fork of the 10up plugin action that commits themes to the themes SVN repository. | Doesn't deploy themes. Theme releases are ZIP uploads on WordPress.org; `zip` builds the upload with the theme folder as the root. |
 | [`wp dist-archive`](https://github.com/wp-cli/dist-archive-command) | WP-CLI command that zips a project using `.distignore`, with `--plugin-dirname` and `--filename-format`. | Same `.distignore` file and `{name}.{version}` style filename format, but needs only Node.js instead of PHP and WP-CLI. `.distignore` is matched with full gitignore syntax, including `!` negation, and `--distignore` / `--exclude` let you point at another ignore file or add patterns on the command line. Builds are reproducible, and `--checksums` writes a manifest next to the ZIP. |
 | [`wp plugin verify-checksums`](https://developer.wordpress.org/cli/commands/plugin/verify-checksums/) | WP-CLI command that checks installed plugins against the WordPress.org checksums API. | Reads the same manifest format, but from a file, so it also works for plugins and themes that aren't hosted on WordPress.org and for build directories in CI. `checksums` writes the manifest that WordPress.org generates for its own plugins. |
-| [`wp-scripts plugin-zip`](https://github.com/WordPress/gutenberg/tree/trunk/packages/scripts#plugin-zip) | Zips files from `package.json` `files` or a fixed allowlist, named after the npm package, with `--root-folder` / `--no-root-folder`. | Reuses the root folder flags, selects files with `.distignore` instead of an allowlist, puts the version from the plugin headers in the filename and streams the archive instead of building it in memory. |
+| [`wp-scripts plugin-zip`](https://github.com/WordPress/gutenberg/tree/trunk/packages/scripts#plugin-zip) | Zips files from `package.json` `files` or a fixed allowlist, named after the npm package, with `--root-folder` / `--no-root-folder`. | Reuses the root folder flags, selects files with `.distignore` by default and can optionally honor Git `export-ignore` attributes, puts the version from the plugin headers in the filename and streams the archive instead of building it in memory. |

package/dist/changeset-config.d.ts

@@ -89,6 +89,8 @@ export interface ChangesetConfig {
     nextVersion?: (input: NextVersionInput) => string;
     /** Format the release notes of a tag, for example to add links. */
     releaseNotes?: (input: ReleaseNotesInput) => string | Promise<string>;
+    /** Format the CHANGELOG.md entry of a changeset, for example to credit its pull request. */
+    changelogEntry?: (input: ChangelogEntryInput) => string | Promise<string>;
 }
 /** Inputs supplied to a custom next-version strategy. */
 export interface NextVersionInput {
@@ -117,6 +119,13 @@ export interface ReleaseNotesInput {
     /** The default release notes: the changelog section, or the commit list without one. */
     notes: string;
 }
+/** Inputs supplied to a custom changelog entry formatter. */
+export interface ChangelogEntryInput {
+    package: ChangesetPackage;
+    changeset: Changeset;
+    /** Commit that added the changeset file, unless it isn't committed yet. */
+    commit?: ReleaseCommit;
+}
 export type WpReleaseConfig = ChangesetConfig;
 export interface PackageJsonVersionOptions {
     file?: string;

package/dist/changeset-config.js

@@ -194,6 +194,10 @@ function validateChangesetConfig(config, configFile) {
         'function' !== typeof candidate.nextVersion) {
         throw new ValidationError(`wp-release config ${configFile}.nextVersion must be a function.`);
     }
+    if (undefined !== candidate.changelogEntry &&
+        'function' !== typeof candidate.changelogEntry) {
+        throw new ValidationError(`wp-release config ${configFile}.changelogEntry must be a function.`);
+    }
     if (undefined !== candidate.releaseNotes &&
         'function' !== typeof candidate.releaseNotes) {
         throw new ValidationError(`wp-release config ${configFile}.releaseNotes must be a function.`);

package/dist/changeset-release.d.ts

@@ -1,4 +1,4 @@
-import type { Changeset, ChangesetPackage, ChangesetReleasePlan, PackageRelease } from './changesets.ts';
+import type { Changeset, ChangesetPackage, ChangesetReleasePlan, PackageRelease, VersionedRelease } from './changesets.ts';
 export interface ChangesetRepository {
     cwd: string;
     configFile?: string;
@@ -9,6 +9,13 @@ export interface ChangesetVersionInput extends ChangesetRepository {
     /** Version only these packages, leaving the other changesets pending. */
     packages?: string[];
 }
+/** Versioned releases, the applied changesets and whether files were changed. */
+export interface VersionChangesetsResult {
+    changesets: Changeset[];
+    releases: VersionedRelease[];
+    date: string;
+    changed: boolean;
+}
 export interface ChangesetTagInput extends ChangesetRepository {
     dryRun?: boolean;
     untagged?: boolean;
@@ -64,10 +71,7 @@ export declare function addChangeset(input: ChangesetRepository & {
  * @param input Repository and versioning options.
  * @return Planned releases and whether files were changed.
  */
-export declare function versionChangesets(input: ChangesetVersionInput): Promise<ChangesetReleasePlan & {
-    date: string;
-    changed: boolean;
-}>;
+export declare function versionChangesets(input: ChangesetVersionInput): Promise<VersionChangesetsResult>;
 /**
  * Create missing release tags, optionally pushing them to the configured remote.
  *

package/dist/changeset-release.js

@@ -6,7 +6,7 @@ import { promisify } from 'node:util';
 import { loadChangesetConfig } from "./changeset-config.js";
 import { findMainPluginFile } from "./package-meta.js";
 import { findConstantValues } from "./version-check.js";
-import { formatChangelogEntries, formatChangeset, getChangesetBump, getNextVersion, parseChangeset, } from "./changesets.js";
+import { formatChangelogList, formatChangeset, getChangesetBump, getNextVersion, parseChangeset, } from "./changesets.js";
 import { ValidationError } from "./errors.js";
 const execFileAsync = promisify(execFile);
 /**
@@ -127,10 +127,12 @@ export async function versionChangesets(input) {
         ? selectReleasePlan(context.plan, packages, input.packages)
         : context.plan;
     const date = input.date ?? new Date().toISOString().slice(0, 10);
+    const changesetDirectory = path.resolve(input.cwd, config.changesets ?? '.changeset');
+    const releases = await getVersionedReleases(input.cwd, config, releasePlan.releases, changesetDirectory);
     if (!input.dryRun) {
         const journal = new Map();
         try {
-            for (const release of releasePlan.releases) {
+            for (const release of releases) {
                 const configured = packages.find((pkg) => pkg.name === release.package.name);
                 if (!configured) {
                     throw new ValidationError(`Unknown package "${release.package.name}".`);
@@ -141,7 +143,6 @@ export async function versionChangesets(input) {
                 await verifyVersionTargets(input.cwd, configured, release.nextVersion);
                 await prependChangelog(configured.directory, release, date, config.readmeChangelog ?? false, config.changelogInsertAfter, journal);
             }
-            const changesetDirectory = path.resolve(input.cwd, config.changesets ?? '.changeset');
             for (const changeset of releasePlan.changesets) {
                 await consumeChangeset(path.join(changesetDirectory, changeset.fileName), changeset, input.packages, journal);
             }
@@ -155,11 +156,76 @@ export async function versionChangesets(input) {
         }
     }
     return {
-        ...releasePlan,
+        changesets: releasePlan.changesets,
+        releases,
         date,
         changed: !input.dryRun && releasePlan.changesets.length > 0,
     };
 }
+/**
+ * Format the changelog entries of each release, with the configured
+ * formatter and the commit that added each changeset.
+ *
+ * @param cwd                Repository root.
+ * @param config             Repository release configuration.
+ * @param releases           Package releases.
+ * @param changesetDirectory Directory of the changeset files.
+ * @return Releases with their changelog entries.
+ */
+async function getVersionedReleases(cwd, config, releases, changesetDirectory) {
+    const commits = new Map();
+    const getCommit = (changeset) => {
+        const cached = commits.get(changeset.fileName) ??
+            getChangesetCommit(cwd, path.join(changesetDirectory, changeset.fileName));
+        commits.set(changeset.fileName, cached);
+        return cached;
+    };
+    return Promise.all(releases.map(async (release) => {
+        const entries = [];
+        // Format one at a time, so that formatters calling an API aren't rate limited.
+        for (const changeset of release.changesets) {
+            entries.push(await getChangelogEntry(config, release.package, changeset, getCommit));
+        }
+        return { ...release, changelog: formatChangelogList(entries) };
+    }));
+}
+async function getChangelogEntry(config, pkg, changeset, getCommit) {
+    const summary = changeset.summary.trim();
+    if (!summary || !config.changelogEntry) {
+        return summary;
+    }
+    const commit = await getCommit(changeset);
+    const entry = await config.changelogEntry({
+        package: pkg,
+        changeset,
+        ...(commit ? { commit } : {}),
+    });
+    if ('string' !== typeof entry) {
+        throw new ValidationError(`The changelogEntry formatter didn't return a string for changeset ${changeset.fileName}.`);
+    }
+    return entry.trim();
+}
+/**
+ * Find the commit that added a changeset file.
+ *
+ * @param cwd  Repository root.
+ * @param file Changeset file.
+ * @return Commit, or undefined when the file isn't committed.
+ */
+async function getChangesetCommit(cwd, file) {
+    const output = await git(cwd, [
+        'log',
+        '--diff-filter=A',
+        '--format=%H%x1f%h%x1f%s',
+        '-1',
+        '--',
+        path.relative(cwd, file).split(path.sep).join('/'),
+    ]);
+    const [hash, shortHash = '', subject = ''] = output
+        .trim()
+        .split('\x1f');
+    return hash ? { hash, shortHash, subject } : undefined;
+}
 /**
  * Limit a release plan to some packages and the changesets that name them.
  *
@@ -749,7 +815,7 @@ async function prependChangelog(directory, release, date, readmeChangelog, chang
     const summaries = release.changesets
         .map((item) => item.summary.trim())
         .filter(Boolean);
-    const section = `## ${release.nextVersion} (${date})\n\n${formatChangelogEntries(release.changesets)}\n\n`;
+    const section = `## ${release.nextVersion} (${date})\n\n${release.changelog}\n\n`;
     const changelog = path.join(directory, 'CHANGELOG.md');
     let previous = '';
     try {

package/dist/changesets.d.ts

@@ -32,6 +32,11 @@ export interface PackageRelease {
     nextVersion: string;
     changesets: Changeset[];
 }
+/** A package release with its formatted changelog entries, once versioned. */
+export interface VersionedRelease extends PackageRelease {
+    /** Changelog entries as a Markdown list, as added to CHANGELOG.md. */
+    changelog: string;
+}
 /** Deterministic release plan assembled from pending changesets. */
 export interface ChangesetReleasePlan {
     changesets: Changeset[];
@@ -60,6 +65,13 @@ export declare function formatChangeset(changeset: Omit<Changeset, 'fileName'>):
  * @return Markdown list, empty without summaries.
  */
 export declare function formatChangelogEntries(changesets: Changeset[]): string;
+/**
+ * Format changelog entries as a Markdown list, indenting their extra lines.
+ *
+ * @param entries Changelog entries; empty ones are left out.
+ * @return Markdown list, empty without entries.
+ */
+export declare function formatChangelogList(entries: string[]): string;
 /**
  * Return the strongest bump requested for a package across changesets.
  *

package/dist/changesets.js

@@ -71,8 +71,16 @@ export function formatChangeset(changeset) {
  * @return Markdown list, empty without summaries.
  */
 export function formatChangelogEntries(changesets) {
-    return changesets
-        .map((item) => item.summary.trim())
+    return formatChangelogList(changesets.map((item) => item.summary.trim()));
+}
+/**
+ * Format changelog entries as a Markdown list, indenting their extra lines.
+ *
+ * @param entries Changelog entries; empty ones are left out.
+ * @return Markdown list, empty without entries.
+ */
+export function formatChangelogList(entries) {
+    return entries
         .filter(Boolean)
         .map((item) => `- ${item.replaceAll(/\r?\n/g, '\n  ')}`)
         .join('\n');

package/dist/cli.d.ts

@@ -1,5 +1,6 @@
 import type { ChecksumsResult } from './commands/checksums.ts';
 import type { SignResult } from './commands/sign.ts';
+import type { KeygenResult } from './commands/keygen.ts';
 import type { ZipResult } from './commands/zip.ts';
 import type { ChangesetVersionResult } from './commands/changeset-version.ts';
 import { Logger } from './logger.ts';
@@ -44,6 +45,7 @@ export interface CommandResults {
     zip: ZipResult;
     checksums: ChecksumsResult;
     sign: SignResult;
+    keygen: KeygenResult;
     'changeset-add': import('./commands/changeset-add.ts').ChangesetAddResult;
     'changeset-status': import('./commands/changeset-status.ts').ChangesetStatusResult;
     'changeset-version': ChangesetVersionResult;

package/dist/cli.js

@@ -3,6 +3,7 @@ import { parseArgs } from 'node:util';
 import zip from "./commands/zip.js";
 import checksums from "./commands/checksums.js";
 import sign from "./commands/sign.js";
+import keygen from "./commands/keygen.js";
 import verify from "./commands/verify.js";
 import versionCheck from "./commands/version-check.js";
 import deploySvn from "./commands/deploy-svn.js";
@@ -23,6 +24,7 @@ export const commands = [
     zip,
     checksums,
     sign,
+    keygen,
     verify,
     versionCheck,
     deploySvn,

package/dist/commands/args.d.ts

@@ -15,6 +15,7 @@ export declare const fileSelectionArgs: ParseArgsOptionsConfig;
 export declare function getFileSelectionInput(values: ParsedValues): {
     distignore: string | false | undefined;
     exclude: string[];
+    excludeGitattributes: boolean;
 };
 /**
  * Check that a command got no more positional arguments than it accepts.

package/dist/commands/args.js

@@ -11,6 +11,7 @@ export const fileSelectionArgs = {
     distignore: { type: 'string' },
     'no-distignore': { type: 'boolean' },
     exclude: { type: 'string', multiple: true },
+    'exclude-gitattributes': { type: 'boolean' },
 };
 /**
  * Map the parsed file selection flags to resolveFileSelection() input.
@@ -24,6 +25,7 @@ export function getFileSelectionInput(values) {
             ? false
             : getString(values, 'distignore'),
         exclude: getStrings(values, 'exclude'),
+        excludeGitattributes: getBoolean(values, 'exclude-gitattributes'),
     };
 }
 /**

package/dist/commands/changeset-version.js

@@ -1,5 +1,4 @@
 import { versionChangesets } from "../changeset-release.js";
-import { formatChangelogEntries } from "../changesets.js";
 import { getChangesetVersionSummary } from "../summary.js";
 import { parseChangesetVersionArgs, changesetVersionArgs, } from "./changeset-args.js";
 export default {
@@ -38,7 +37,7 @@ changesets without packages are left for a run without --package.`,
                     bump: item.bump,
                     currentVersion: item.currentVersion,
                     nextVersion: item.nextVersion,
-                    changelog: formatChangelogEntries(item.changesets),
+                    changelog: item.changelog,
                 })),
             },
         };

package/dist/commands/checksums.js

@@ -28,6 +28,8 @@ Options:
   --no-distignore             Don't read any ignore file
   --exclude <patterns>        Extra gitignore-style patterns, comma-separated or
                               repeated, like build/,assets/*,images/**/*
+  --exclude-gitattributes     Also exclude paths marked export-ignore in Git
+                              attributes (requires a Git working tree)
   --force                     Overwrite an existing --output file
 
 The manifest uses the WordPress.org plugin checksums format, with paths

package/dist/commands/deploy-git.js

@@ -46,6 +46,7 @@ Options:
   --distignore <file>     Ignore file (default: <source-dir>/.distignore when present)
   --no-distignore         Don't read any ignore file
   --exclude <patterns>    Extra gitignore-style patterns, comma-separated or repeated
+  --exclude-gitattributes Also exclude paths marked export-ignore in Git attributes
   --message <text>        Release commit message
   --dry-run               Run everything except the push
 

package/dist/commands/deploy-svn.js

@@ -60,6 +60,7 @@ Options:
   --distignore <file>     Ignore file (default: <source-dir>/.distignore when present)
   --no-distignore         Don't read any ignore file
   --exclude <patterns>    Extra gitignore-style patterns, comma-separated or repeated
+  --exclude-gitattributes Also exclude paths marked export-ignore in Git attributes
   --svn-url <url>         Repository URL with {slug}
                           (default: https://plugins.svn.wordpress.org/{slug}/)
   --svn-username <name>   SVN username (env: SVN_USERNAME, password: SVN_PASSWORD)

package/dist/commands/keygen.d.ts

@@ -0,0 +1,17 @@
+import type { CommandOutcome } from './command.ts';
+/** Generated Ed25519 signing keys. */
+export interface KeygenResult {
+    /** Base64 Ed25519 seed for WP_RELEASE_SIGNING_KEY. */
+    privateKey: string;
+    /** Base64 Ed25519 public key for verification. */
+    publicKey: string;
+}
+declare const _default: {
+    name: string;
+    usage: string;
+    summary: string;
+    help: string;
+    options: {};
+    run({ values, logger }: import("./command.ts").CommandContext): Promise<CommandOutcome<KeygenResult>>;
+};
+export default _default;

package/dist/commands/keygen.js

@@ -0,0 +1,23 @@
+import { ValidationError } from "../errors.js";
+import { generateSigningKeyPair } from "../signing.js";
+import { getBoolean } from "./command.js";
+export default {
+    name: 'keygen',
+    usage: 'keygen',
+    summary: 'Generate an Ed25519 signing key pair.',
+    help: `Generate a signing key pair for "wp-release sign" and "wp-release verify".
+
+The private seed is printed once as WP_RELEASE_SIGNING_KEY. Store it securely
+and never commit it or share it. The public key can be distributed to verifiers.`,
+    options: {},
+    async run({ values, logger }) {
+        if (getBoolean(values, 'github-output')) {
+            throw new ValidationError('keygen cannot be used with --github-output, which would store the private seed in a workflow output.');
+        }
+        const result = generateSigningKeyPair();
+        logger.info(`WP_RELEASE_SIGNING_KEY=${result.privateKey}`);
+        logger.info(`Public key: ${result.publicKey}`);
+        logger.info('Store the private seed securely; it cannot be recovered from the public key.');
+        return { exitCode: 0, result };
+    },
+};

package/dist/commands/zip.js

@@ -56,6 +56,8 @@ Options:
   --no-distignore             Don't read any ignore file
   --exclude <patterns>        Extra gitignore-style patterns, comma-separated or
                               repeated, like build/,assets/*,images/**/*
+  --exclude-gitattributes     Also exclude paths marked export-ignore in Git
+                              attributes (requires a Git working tree)
   --checksums                 Also write the checksums manifest of the archived
                               files next to the ZIP, with .checksums.json
                               instead of .zip

package/dist/deploy-options.d.ts

@@ -27,6 +27,8 @@ export interface DeployInput {
     distignore?: string | false;
     /** Extra gitignore-style patterns. */
     exclude?: string | string[];
+    /** Also exclude paths marked export-ignore by Git attributes. */
+    excludeGitattributes?: boolean;
     /** Readme file name. */
     readme?: string;
     /** ZIP archive to deploy instead of sourceDir. */

package/dist/deploy-options.js

@@ -139,6 +139,7 @@ export function resolveDeployOptions(input = {}) {
             sourceDir,
             distignore: input.distignore,
             exclude: input.exclude,
+            excludeGitattributes: input.excludeGitattributes,
         }),
         assetsDir,
         readme: input.readme || 'readme.txt',

package/dist/file-selection.d.ts

@@ -21,6 +21,8 @@ export interface FileSelectionInput {
     distignore?: string | false;
     /** Extra gitignore-style patterns, comma or newline separated. */
     exclude?: string | string[];
+    /** Also exclude paths marked export-ignore by Git attributes. */
+    excludeGitattributes?: boolean;
 }
 export interface FileSelection {
     /** Ignore file path, or null when disabled. */
@@ -29,6 +31,10 @@ export interface FileSelection {
     distignoreRequired: boolean;
     /** Extra gitignore-style patterns. */
     exclude: string[];
+    /** Source directory, needed to resolve Git attributes. */
+    sourceDir?: string;
+    /** Also exclude paths marked export-ignore by Git attributes. */
+    excludeGitattributes?: boolean;
 }
 /**
  * Parse exclude patterns from a comma or newline separated string, an array

package/dist/file-selection.js

@@ -1,7 +1,8 @@
-import { readdir, readFile } from 'node:fs/promises';
-import { join, posix, resolve } from 'node:path';
+import { realpath, readdir, readFile } from 'node:fs/promises';
+import { isAbsolute, join, posix, relative, resolve } from 'node:path';
 import ignore from 'ignore';
 import { ValidationError } from "./errors.js";
+import { createGitRunner } from "./git.js";
 export const DISTIGNORE_FILENAME = '.distignore';
 /**
  * Version control metadata that is never released, at any depth. Without
@@ -35,11 +36,13 @@ export function parseExclude(value) {
  * @return Ignore file path (or null), whether it's required, and the patterns.
  */
 export function resolveFileSelection(input) {
-    const { cwd, sourceDir, distignore, exclude } = input;
+    const { cwd, sourceDir, distignore, exclude, excludeGitattributes = false, } = input;
     const selection = {
         distignore: join(sourceDir, DISTIGNORE_FILENAME),
         distignoreRequired: false,
         exclude: parseExclude(exclude),
+        sourceDir,
+        excludeGitattributes,
     };
     if (false === distignore) {
         selection.distignore = null;
@@ -61,8 +64,101 @@ export function resolveFileSelection(input) {
  */
 export async function loadFileRules(selection) {
     const { distignore = null, distignoreRequired = false, exclude = [], } = selection;
-    const rules = await readIgnoreFile(distignore, distignoreRequired);
-    return ignore().add(rules).add(exclude).add(ALWAYS_EXCLUDED);
+    const rules = ignore()
+        .add(await readIgnoreFile(distignore, distignoreRequired))
+        .add(exclude);
+    if (selection.excludeGitattributes) {
+        if (!selection.sourceDir) {
+            throw new ValidationError('--exclude-gitattributes requires a source directory.');
+        }
+        const excluded = await getExportIgnoredPaths(selection.sourceDir, rules);
+        rules.add(excluded.map((path) => `/${escapePattern(path)}`));
+    }
+    return rules.add(ALWAYS_EXCLUDED);
+}
+/**
+ * Read Git's export-ignore attribute for the source files selected by the
+ * other ignore rules. Git itself evaluates .gitattributes, including nested
+ * files and its pattern syntax.
+ *
+ * @param sourceDir Directory whose files are being selected.
+ * @param rules     Rules already loaded from .distignore and --exclude.
+ * @return Source-relative paths marked export-ignore.
+ */
+async function getExportIgnoredPaths(sourceDir, rules) {
+    const runner = createGitRunner();
+    let root;
+    try {
+        ({ stdout: root } = await runner({
+            args: ['rev-parse', '--show-toplevel'],
+            cwd: sourceDir,
+        }));
+    }
+    catch {
+        throw new ValidationError('--exclude-gitattributes requires the source directory to be inside a Git repository.');
+    }
+    root = await realpath(root.trim());
+    const sourceFromRoot = relative(root, await realpath(sourceDir));
+    if (isAbsolute(sourceFromRoot) ||
+        sourceFromRoot === '..' ||
+        sourceFromRoot.startsWith(`..${posix.sep}`)) {
+        throw new ValidationError('--exclude-gitattributes requires the source directory to be inside a Git repository.');
+    }
+    const candidates = await findAttributeCandidates(sourceDir, '', rules);
+    if (!candidates.length) {
+        return [];
+    }
+    const pathsFromRoot = candidates.map((path) => posix.join(sourceFromRoot.split('\\').join('/'), path));
+    const { stdout } = await runner({
+        args: ['check-attr', '-z', '--stdin', 'export-ignore'],
+        cwd: root,
+        input: pathsFromRoot.map((path) => `${path}\0`).join(''),
+    });
+    const fields = stdout.split('\0');
+    const ignored = [];
+    for (let index = 0; index + 2 < fields.length; index += 3) {
+        const candidate = candidates[index / 3];
+        if (fields[index + 2] === 'set' && candidate) {
+            ignored.push(candidate);
+        }
+    }
+    return ignored;
+}
+/**
+ * List regular files and symbolic links not already excluded by ignore rules.
+ * Symbolic links are included here so Git can exclude them before selectFiles
+ * applies its unsupported-link validation.
+ *
+ * @param sourceDir Source directory.
+ * @param dir       Relative directory being traversed.
+ * @param rules     Ignore rules.
+ * @return Relative paths to candidate files.
+ */
+async function findAttributeCandidates(sourceDir, dir, rules) {
+    const entries = await readdir(join(sourceDir, dir), {
+        withFileTypes: true,
+    });
+    const paths = await Promise.all(entries.map(async (entry) => {
+        const path = posix.join(dir, entry.name);
+        if (entry.isDirectory() && !rules.ignores(`${path}/`)) {
+            return findAttributeCandidates(sourceDir, path, rules);
+        }
+        if ((entry.isFile() || entry.isSymbolicLink()) &&
+            !rules.ignores(path)) {
+            return [path];
+        }
+        return [];
+    }));
+    return paths.flat();
+}
+/**
+ * Escape a path for an anchored gitignore pattern.
+ *
+ * @param path Relative path.
+ * @return Pattern-safe path.
+ */
+function escapePattern(path) {
+    return path.replace(/[\\*?[\\]!#]/g, '\\$&');
 }
 /**
  * Read the ignore file, or nothing when there's no file to read.

package/dist/git-deploy.d.ts

@@ -24,6 +24,8 @@ export interface GitDeployInput {
     distignore?: string | false;
     /** Extra gitignore-style patterns. */
     exclude?: string | string[];
+    /** Also exclude paths marked export-ignore by Git attributes. */
+    excludeGitattributes?: boolean;
     /** Commit message of the release. */
     message?: string;
     /** Run everything except the push. */

package/dist/git-deploy.js

@@ -55,6 +55,7 @@ export function resolveGitDeployOptions(input = {}) {
             sourceDir,
             distignore: input.distignore,
             exclude: input.exclude,
+            excludeGitattributes: input.excludeGitattributes,
         }),
     };
 }

package/dist/github.d.ts

@@ -0,0 +1,24 @@
+/**
+ * A GitHub pull request of a commit.
+ */
+export interface GitHubPullRequest {
+    number: number;
+    url: string;
+    /** GitHub handle of the pull request author, without the @. */
+    author: string;
+}
+export interface GetGitHubPullRequestInput {
+    /** Directory of the repository, whose GitHub remote `gh` uses. */
+    cwd: string;
+    /** Commit hash. */
+    commit: string;
+}
+/**
+ * Find the pull request that merged a commit, with the authenticated `gh`
+ * command line client.
+ *
+ * @param  input Repository directory and commit.
+ * @return The first pull request of the commit, or undefined without one.
+ * @throws {ValidationError} If `gh` fails, like without authentication.
+ */
+export declare function getGitHubPullRequest(input: GetGitHubPullRequestInput): Promise<GitHubPullRequest | undefined>;

package/dist/github.js

@@ -0,0 +1,30 @@
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+import { ValidationError } from "./errors.js";
+const execFileAsync = promisify(execFile);
+/**
+ * Find the pull request that merged a commit, with the authenticated `gh`
+ * command line client.
+ *
+ * @param  input Repository directory and commit.
+ * @return The first pull request of the commit, or undefined without one.
+ * @throws {ValidationError} If `gh` fails, like without authentication.
+ */
+export async function getGitHubPullRequest(input) {
+    let stdout;
+    try {
+        ({ stdout } = await execFileAsync('gh', ['api', `repos/{owner}/{repo}/commits/${input.commit}/pulls`], { cwd: input.cwd }));
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        throw new ValidationError(`Could not find the pull request of commit ${input.commit}: ${message}`);
+    }
+    const [pullRequest] = JSON.parse(stdout);
+    return pullRequest
+        ? {
+            number: pullRequest.number,
+            url: pullRequest.html_url,
+            author: pullRequest.user?.login ?? '',
+        }
+        : undefined;
+}

package/dist/index.d.ts

@@ -9,12 +9,12 @@ export { DISTIGNORE_FILENAME, parseExclude, resolveFileSelection, loadFileRules,
 export { FILENAME_FORMAT, formatFilename } from './filename.ts';
 export { CHECKSUMS_EXTENSION, CHECKSUM_ALGORITHMS, hashFile, hashFiles, createChecksums, writeChecksums, readChecksums, parseChecksums, compareChecksums, verifyChecksums, } from './checksums.ts';
 export { HEADER_BYTES, PLUGIN_HEADERS, THEME_HEADERS, README_HEADERS, README_FILENAMES, parseFileHeaders, parseReadmeHeaders, readFileStart, findFileHeaderLine, findReadmeHeaderLine, findMainPluginFile, readPackageMeta, } from './package-meta.ts';
-export { SIGNATURE_EXTENSION, SIGNING_KEY_ENV, parseSigningKey, parsePublicKey, getPublicKey, getFileDigest, signFile, writeSignature, verifyFileSignature, } from './signing.ts';
+export { SIGNATURE_EXTENSION, SIGNING_KEY_ENV, parseSigningKey, parsePublicKey, generateSigningKeyPair, getPublicKey, getFileDigest, signFile, writeSignature, verifyFileSignature, } from './signing.ts';
 export { ZIP_MTIME, ZIP_FILE_MODE, createZip } from './zip.ts';
 export { isUrl, downloadFile } from './download.ts';
 export { readZipEntries, getZipEntryErrors, extractZip } from './unzip.ts';
 export { GIT_TAG_FORMAT, VersionMismatchError, getGitTagVersion, findConstantValues, findConstantDefinitions, findVersionMismatches, getVersionMismatchProblems, } from './version-check.ts';
-export { CHANGESET_BUMPS, parseChangeset, formatChangeset, formatChangelogEntries, getChangesetBump, getNextVersion, } from './changesets.ts';
+export { CHANGESET_BUMPS, parseChangeset, formatChangeset, formatChangelogEntries, formatChangelogList, getChangesetBump, getNextVersion, } from './changesets.ts';
 export { addChangeset, getChangesetPackages, getChangesetReleasePlan, getChangesetStatus, versionChangesets, tagChangesets, } from './changeset-release.ts';
 export { defineConfig, packageJsonVersion, composerJsonVersion, wordpressPluginVersion, wordpressThemeVersion, wordpressStableTag, gitTagVersion, phpConstantVersion, loadChangesetConfig, } from './changeset-config.ts';
 export { Svn, SvnError, createSvnRunner, parseStatus, toSvnPath, } from './svn.ts';
@@ -26,6 +26,7 @@ export { getGitDeployInputFromArgs } from './commands/deploy-git.ts';
 export type { CliIo, CommandResults } from './cli.ts';
 export type { ChecksumsResult } from './commands/checksums.ts';
 export type { SignResult } from './commands/sign.ts';
+export type { KeygenResult } from './commands/keygen.ts';
 export type { ZipResult } from './commands/zip.ts';
 export type { Command, CommandContext, CommandOutcome, ParsedValues, } from './commands/command.ts';
 export type { DeployArgsInput } from './commands/deploy-svn.ts';
@@ -40,12 +41,14 @@ export type { FindMainPluginFileInput, HeaderValues, PackageMeta, ParseFileHeade
 export type { CreateZipInput } from './zip.ts';
 export type { ExtractZipInput, ZipEntryInfo, ZipEntryType } from './unzip.ts';
 export type { FindVersionMismatchesInput, GitTagInput, VersionCheckResult, VersionMismatch, } from './version-check.ts';
-export type { Changeset, ChangesetBump, ChangesetPackages, ChangesetConfig, ChangesetPackageType, ChangesetPackage, PackageRelease, ChangesetReleasePlan, } from './changesets.ts';
-export type { ChangesetRepository, ChangesetVersionInput, ChangesetTagInput, ChangesetTagResult, } from './changeset-release.ts';
-export type { WpReleaseConfig, ChangesetPackageGroup, PackageVersionConfig, PackageVersionSource, PackageVersionTarget, PackageIdSource, NextVersionInput, ReleaseCommit, ReleaseNotesInput, PackageJsonVersionOptions, ComposerJsonVersionOptions, WordPressVersionFileOptions, GitTagVersionOptions, PhpConstantVersionOptions, LoadChangesetConfigInput, } from './changeset-config.ts';
+export type { Changeset, ChangesetBump, ChangesetPackages, ChangesetConfig, ChangesetPackageType, ChangesetPackage, PackageRelease, VersionedRelease, ChangesetReleasePlan, } from './changesets.ts';
+export type { ChangesetRepository, ChangesetVersionInput, VersionChangesetsResult, ChangesetTagInput, ChangesetTagResult, } from './changeset-release.ts';
+export type { WpReleaseConfig, ChangesetPackageGroup, PackageVersionConfig, PackageVersionSource, PackageVersionTarget, PackageIdSource, NextVersionInput, ReleaseCommit, ReleaseNotesInput, ChangelogEntryInput, PackageJsonVersionOptions, ComposerJsonVersionOptions, WordPressVersionFileOptions, GitTagVersionOptions, PhpConstantVersionOptions, LoadChangesetConfigInput, } from './changeset-config.ts';
 export type { SvnCheckoutInput, SvnCommandInput, SvnCommandOutput, SvnCommitInput, SvnCopyInput, SvnDepth, SvnOptions, SvnPathsInput, SvnPropsetInput, SvnRunner, SvnStatusEntry, SvnStatusType, SvnUpdateInput, } from './svn.ts';
 export type { SyncDirectoryInput, SyncResult } from './sync.ts';
 export type { SummaryContext } from './summary.ts';
+export { getGitHubPullRequest } from './github.ts';
+export type { GitHubPullRequest, GetGitHubPullRequestInput } from './github.ts';
 export type { CheckoutPath, DeployResult } from './svn-deploy.ts';
 export type { GitCommandInput, GitCommandOutput, GitRunner } from './git.ts';
 export type { GitDeployInput, GitDeployOptions, GitDeployResult, } from './git-deploy.ts';

package/dist/index.js

@@ -9,12 +9,12 @@ export { DISTIGNORE_FILENAME, parseExclude, resolveFileSelection, loadFileRules,
 export { FILENAME_FORMAT, formatFilename } from "./filename.js";
 export { CHECKSUMS_EXTENSION, CHECKSUM_ALGORITHMS, hashFile, hashFiles, createChecksums, writeChecksums, readChecksums, parseChecksums, compareChecksums, verifyChecksums, } from "./checksums.js";
 export { HEADER_BYTES, PLUGIN_HEADERS, THEME_HEADERS, README_HEADERS, README_FILENAMES, parseFileHeaders, parseReadmeHeaders, readFileStart, findFileHeaderLine, findReadmeHeaderLine, findMainPluginFile, readPackageMeta, } from "./package-meta.js";
-export { SIGNATURE_EXTENSION, SIGNING_KEY_ENV, parseSigningKey, parsePublicKey, getPublicKey, getFileDigest, signFile, writeSignature, verifyFileSignature, } from "./signing.js";
+export { SIGNATURE_EXTENSION, SIGNING_KEY_ENV, parseSigningKey, parsePublicKey, generateSigningKeyPair, getPublicKey, getFileDigest, signFile, writeSignature, verifyFileSignature, } from "./signing.js";
 export { ZIP_MTIME, ZIP_FILE_MODE, createZip } from "./zip.js";
 export { isUrl, downloadFile } from "./download.js";
 export { readZipEntries, getZipEntryErrors, extractZip } from "./unzip.js";
 export { GIT_TAG_FORMAT, VersionMismatchError, getGitTagVersion, findConstantValues, findConstantDefinitions, findVersionMismatches, getVersionMismatchProblems, } from "./version-check.js";
-export { CHANGESET_BUMPS, parseChangeset, formatChangeset, formatChangelogEntries, getChangesetBump, getNextVersion, } from "./changesets.js";
+export { CHANGESET_BUMPS, parseChangeset, formatChangeset, formatChangelogEntries, formatChangelogList, getChangesetBump, getNextVersion, } from "./changesets.js";
 export { addChangeset, getChangesetPackages, getChangesetReleasePlan, getChangesetStatus, versionChangesets, tagChangesets, } from "./changeset-release.js";
 export { defineConfig, packageJsonVersion, composerJsonVersion, wordpressPluginVersion, wordpressThemeVersion, wordpressStableTag, gitTagVersion, phpConstantVersion, loadChangesetConfig, } from "./changeset-config.js";
 export { Svn, SvnError, createSvnRunner, parseStatus, toSvnPath, } from "./svn.js";
@@ -23,3 +23,4 @@ export { ASSET_MIME_TYPES, SvnDeploy } from "./svn-deploy.js";
 export { GitError, createGitRunner, redactUrls } from "./git.js";
 export { GitDeploy, isValidRefName, resolveGitDeployOptions, } from "./git-deploy.js";
 export { getGitDeployInputFromArgs } from "./commands/deploy-git.js";
+export { getGitHubPullRequest } from "./github.js";

package/dist/signing.d.ts

@@ -4,6 +4,15 @@ export declare const SIGNATURE_EXTENSION = ".sig";
  * Environment variable with the base64 Ed25519 signing key.
  */
 export declare const SIGNING_KEY_ENV = "WP_RELEASE_SIGNING_KEY";
+/**
+ * Generate an Ed25519 key pair in the base64 formats used by wp-release.
+ *
+ * @return Private seed for WP_RELEASE_SIGNING_KEY and public verification key.
+ */
+export declare function generateSigningKeyPair(): {
+    privateKey: string;
+    publicKey: string;
+};
 /**
  * Get an Ed25519 private key from the base64 format that sodium and the
  * update-client signing_key setting use: a 32-byte seed or a 64-byte

package/dist/signing.js

@@ -1,4 +1,4 @@
-import { createHash, createPrivateKey, createPublicKey, sign, verify, } from 'node:crypto';
+import { createHash, createPrivateKey, generateKeyPairSync, createPublicKey, sign, verify, } from 'node:crypto';
 import { createReadStream } from 'node:fs';
 import { readFile, writeFile } from 'node:fs/promises';
 import { ValidationError } from "./errors.js";
@@ -14,6 +14,23 @@ const PUBLIC_KEY_BYTES = 32;
 const PKCS8_PREFIX = Buffer.from('302e020100300506032b657004220420', 'hex');
 // DER prefix of a SPKI Ed25519 public key, followed by the 32-byte key.
 const SPKI_PREFIX = Buffer.from('302a300506032b6570032100', 'hex');
+/**
+ * Generate an Ed25519 key pair in the base64 formats used by wp-release.
+ *
+ * @return Private seed for WP_RELEASE_SIGNING_KEY and public verification key.
+ */
+export function generateSigningKeyPair() {
+    const { privateKey, publicKey } = generateKeyPairSync('ed25519');
+    const privateJwk = privateKey.export({ format: 'jwk' });
+    const publicJwk = publicKey.export({ format: 'jwk' });
+    if (!privateJwk.d || !publicJwk.x) {
+        throw new ValidationError('Could not export the generated Ed25519 key pair.');
+    }
+    return {
+        privateKey: Buffer.from(privateJwk.d, 'base64url').toString('base64'),
+        publicKey: Buffer.from(publicJwk.x, 'base64url').toString('base64'),
+    };
+}
 /**
  * Decode a base64 key, accepting the base64url alphabet and whitespace.
  *

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@wpelevator/wp-release",
-	"version": "0.7.0",
+	"version": "0.9.0",
 	"description": "Package, checksum, sign, verify and version-check WordPress plugins and themes, and deploy plugins to WordPress.org SVN",
 	"license": "MIT",
 	"repository": {