@wpelevator/wp-release 0.8.0 → 0.10.0

package/dist/changesets.d.ts

@@ -31,6 +31,8 @@ export interface PackageRelease {
     currentVersion: string;
     nextVersion: string;
     changesets: Changeset[];
+    /** Names of released source packages that this dependent release bundles; absent for changeset-driven releases. */
+    sources?: string[];
 }
 /** A package release with its formatted changelog entries, once versioned. */
 export interface VersionedRelease extends PackageRelease {

package/dist/cli.d.ts

@@ -1,5 +1,6 @@
 import type { ChecksumsResult } from './commands/checksums.ts';
 import type { SignResult } from './commands/sign.ts';
+import type { KeygenResult } from './commands/keygen.ts';
 import type { ZipResult } from './commands/zip.ts';
 import type { ChangesetVersionResult } from './commands/changeset-version.ts';
 import { Logger } from './logger.ts';
@@ -44,6 +45,7 @@ export interface CommandResults {
     zip: ZipResult;
     checksums: ChecksumsResult;
     sign: SignResult;
+    keygen: KeygenResult;
     'changeset-add': import('./commands/changeset-add.ts').ChangesetAddResult;
     'changeset-status': import('./commands/changeset-status.ts').ChangesetStatusResult;
     'changeset-version': ChangesetVersionResult;

package/dist/cli.js

@@ -3,6 +3,7 @@ import { parseArgs } from 'node:util';
 import zip from "./commands/zip.js";
 import checksums from "./commands/checksums.js";
 import sign from "./commands/sign.js";
+import keygen from "./commands/keygen.js";
 import verify from "./commands/verify.js";
 import versionCheck from "./commands/version-check.js";
 import deploySvn from "./commands/deploy-svn.js";
@@ -23,6 +24,7 @@ export const commands = [
     zip,
     checksums,
     sign,
+    keygen,
     verify,
     versionCheck,
     deploySvn,

package/dist/commands/args.d.ts

@@ -15,6 +15,7 @@ export declare const fileSelectionArgs: ParseArgsOptionsConfig;
 export declare function getFileSelectionInput(values: ParsedValues): {
     distignore: string | false | undefined;
     exclude: string[];
+    excludeGitattributes: boolean;
 };
 /**
  * Check that a command got no more positional arguments than it accepts.

package/dist/commands/args.js

@@ -11,6 +11,7 @@ export const fileSelectionArgs = {
     distignore: { type: 'string' },
     'no-distignore': { type: 'boolean' },
     exclude: { type: 'string', multiple: true },
+    'exclude-gitattributes': { type: 'boolean' },
 };
 /**
  * Map the parsed file selection flags to resolveFileSelection() input.
@@ -24,6 +25,7 @@ export function getFileSelectionInput(values) {
             ? false
             : getString(values, 'distignore'),
         exclude: getStrings(values, 'exclude'),
+        excludeGitattributes: getBoolean(values, 'exclude-gitattributes'),
     };
 }
 /**

package/dist/commands/changeset-args.d.ts

@@ -65,12 +65,17 @@ export declare const changesetVersionArgs: {
         readonly type: "string";
         readonly multiple: true;
     };
+    readonly 'no-dependents': {
+        readonly type: "boolean";
+    };
 };
 /** Parsed input for `changeset-version`. */
 export interface ChangesetVersionArgs {
     dryRun: boolean;
     date?: string;
     packages?: string[];
+    /** Whether the selected sources release their configured dependents; defaults to true. */
+    dependents: boolean;
 }
 /**
  * Validate and normalize a release date option.

package/dist/commands/changeset-args.js

@@ -75,6 +75,7 @@ export const changesetVersionArgs = {
     'dry-run': { type: 'boolean' },
     date: { type: 'string' },
     package: { type: 'string', multiple: true },
+    'no-dependents': { type: 'boolean' },
 };
 /**
  * Validate and normalize a release date option.
@@ -111,6 +112,7 @@ export function parseChangesetVersionArgs(values) {
     }
     return {
         dryRun: getBoolean(values, 'dry-run'),
+        dependents: !getBoolean(values, 'no-dependents'),
         ...(date ? { date } : {}),
         ...(packages.length ? { packages } : {}),
     };

package/dist/commands/changeset-status.d.ts

@@ -13,6 +13,7 @@ export interface ChangesetStatusResult {
     changedPackages: string[];
     changedPackageFiles: Record<string, string[]>;
     missingChangesets: string[];
+    warnings: string[];
 }
 declare const _default: {
     name: string;
@@ -37,6 +38,7 @@ declare const _default: {
             changedPackages: string[];
             changedPackageFiles: Record<string, string[]>;
             missingChangesets: string[];
+            warnings: string[];
         };
     }>;
 };

package/dist/commands/changeset-status.js

@@ -20,8 +20,11 @@ An empty changeset added since the comparison base counts as an explicit no-rele
         logger.summary(() => {
             const rows = result.changedPackages.map((name) => {
                 let status = 'no release requested';
-                if (result.releases.some((release) => release.package.name === name)) {
-                    status = 'changeset found';
+                const release = result.releases.find((item) => item.package.name === name);
+                if (release) {
+                    status = release.changesets.length
+                        ? 'changeset found'
+                        : 'releases with its sources';
                 }
                 if (result.missingChangesets.includes(name)) {
                     status = 'missing changeset';
@@ -49,6 +52,7 @@ An empty changeset added since the comparison base counts as an explicit no-rele
         else if (!result.releases.length) {
             logger.info('No pending package releases.');
         }
+        result.warnings.forEach((warning) => logger.warning(warning));
         return {
             exitCode: result.missingChangesets.length ? 2 : 0,
             result: {

package/dist/commands/changeset-version.d.ts

@@ -26,6 +26,9 @@ declare const _default: {
             readonly type: "string";
             readonly multiple: true;
         };
+        readonly 'no-dependents': {
+            readonly type: "boolean";
+        };
     };
     run({ values, cwd, configFile, logger }: import("./command.ts").CommandContext): Promise<{
         exitCode: number;

package/dist/commands/changeset-version.js

@@ -3,12 +3,13 @@ import { getChangesetVersionSummary } from "../summary.js";
 import { parseChangesetVersionArgs, changesetVersionArgs, } from "./changeset-args.js";
 export default {
     name: 'changeset-version',
-    usage: 'changeset-version [--dry-run] [--date <YYYY-MM-DD>] [--package <name>]',
+    usage: 'changeset-version [--dry-run] [--date <YYYY-MM-DD>] [--package <name>] [--no-dependents]',
     summary: 'Apply pending version bumps and changelog entries.',
     help: `Options:
   --dry-run              Print the release plan without writing files
   --date <YYYY-MM-DD>    Changelog date (default: today)
   --package <name>       Version only this package (repeatable)
+  --no-dependents        Leave the configured dependents of the selected sources out
 
 Updates configured version files, prepends changelog entries and removes the
 applied changeset files. With --package, a changeset that also names other

package/dist/commands/checksums.js

@@ -28,6 +28,8 @@ Options:
   --no-distignore             Don't read any ignore file
   --exclude <patterns>        Extra gitignore-style patterns, comma-separated or
                               repeated, like build/,assets/*,images/**/*
+  --exclude-gitattributes     Also exclude paths marked export-ignore in Git
+                              attributes (requires a Git working tree)
   --force                     Overwrite an existing --output file
 
 The manifest uses the WordPress.org plugin checksums format, with paths

package/dist/commands/deploy-git.js

@@ -46,6 +46,7 @@ Options:
   --distignore <file>     Ignore file (default: <source-dir>/.distignore when present)
   --no-distignore         Don't read any ignore file
   --exclude <patterns>    Extra gitignore-style patterns, comma-separated or repeated
+  --exclude-gitattributes Also exclude paths marked export-ignore in Git attributes
   --message <text>        Release commit message
   --dry-run               Run everything except the push
 

package/dist/commands/deploy-svn.js

@@ -60,6 +60,7 @@ Options:
   --distignore <file>     Ignore file (default: <source-dir>/.distignore when present)
   --no-distignore         Don't read any ignore file
   --exclude <patterns>    Extra gitignore-style patterns, comma-separated or repeated
+  --exclude-gitattributes Also exclude paths marked export-ignore in Git attributes
   --svn-url <url>         Repository URL with {slug}
                           (default: https://plugins.svn.wordpress.org/{slug}/)
   --svn-username <name>   SVN username (env: SVN_USERNAME, password: SVN_PASSWORD)

package/dist/commands/keygen.d.ts

@@ -0,0 +1,17 @@
+import type { CommandOutcome } from './command.ts';
+/** Generated Ed25519 signing keys. */
+export interface KeygenResult {
+    /** Base64 Ed25519 seed for WP_RELEASE_SIGNING_KEY. */
+    privateKey: string;
+    /** Base64 Ed25519 public key for verification. */
+    publicKey: string;
+}
+declare const _default: {
+    name: string;
+    usage: string;
+    summary: string;
+    help: string;
+    options: {};
+    run({ values, logger }: import("./command.ts").CommandContext): Promise<CommandOutcome<KeygenResult>>;
+};
+export default _default;

package/dist/commands/keygen.js

@@ -0,0 +1,23 @@
+import { ValidationError } from "../errors.js";
+import { generateSigningKeyPair } from "../signing.js";
+import { getBoolean } from "./command.js";
+export default {
+    name: 'keygen',
+    usage: 'keygen',
+    summary: 'Generate an Ed25519 signing key pair.',
+    help: `Generate a signing key pair for "wp-release sign" and "wp-release verify".
+
+The private seed is printed once as WP_RELEASE_SIGNING_KEY. Store it securely
+and never commit it or share it. The public key can be distributed to verifiers.`,
+    options: {},
+    async run({ values, logger }) {
+        if (getBoolean(values, 'github-output')) {
+            throw new ValidationError('keygen cannot be used with --github-output, which would store the private seed in a workflow output.');
+        }
+        const result = generateSigningKeyPair();
+        logger.info(`WP_RELEASE_SIGNING_KEY=${result.privateKey}`);
+        logger.info(`Public key: ${result.publicKey}`);
+        logger.info('Store the private seed securely; it cannot be recovered from the public key.');
+        return { exitCode: 0, result };
+    },
+};

package/dist/commands/zip.js

@@ -56,6 +56,8 @@ Options:
   --no-distignore             Don't read any ignore file
   --exclude <patterns>        Extra gitignore-style patterns, comma-separated or
                               repeated, like build/,assets/*,images/**/*
+  --exclude-gitattributes     Also exclude paths marked export-ignore in Git
+                              attributes (requires a Git working tree)
   --checksums                 Also write the checksums manifest of the archived
                               files next to the ZIP, with .checksums.json
                               instead of .zip

package/dist/deploy-options.d.ts

@@ -27,6 +27,8 @@ export interface DeployInput {
     distignore?: string | false;
     /** Extra gitignore-style patterns. */
     exclude?: string | string[];
+    /** Also exclude paths marked export-ignore by Git attributes. */
+    excludeGitattributes?: boolean;
     /** Readme file name. */
     readme?: string;
     /** ZIP archive to deploy instead of sourceDir. */

package/dist/deploy-options.js

@@ -139,6 +139,7 @@ export function resolveDeployOptions(input = {}) {
             sourceDir,
             distignore: input.distignore,
             exclude: input.exclude,
+            excludeGitattributes: input.excludeGitattributes,
         }),
         assetsDir,
         readme: input.readme || 'readme.txt',

package/dist/file-selection.d.ts

@@ -21,6 +21,8 @@ export interface FileSelectionInput {
     distignore?: string | false;
     /** Extra gitignore-style patterns, comma or newline separated. */
     exclude?: string | string[];
+    /** Also exclude paths marked export-ignore by Git attributes. */
+    excludeGitattributes?: boolean;
 }
 export interface FileSelection {
     /** Ignore file path, or null when disabled. */
@@ -29,6 +31,10 @@ export interface FileSelection {
     distignoreRequired: boolean;
     /** Extra gitignore-style patterns. */
     exclude: string[];
+    /** Source directory, needed to resolve Git attributes. */
+    sourceDir?: string;
+    /** Also exclude paths marked export-ignore by Git attributes. */
+    excludeGitattributes?: boolean;
 }
 /**
  * Parse exclude patterns from a comma or newline separated string, an array

package/dist/file-selection.js

@@ -1,7 +1,8 @@
-import { readdir, readFile } from 'node:fs/promises';
-import { join, posix, resolve } from 'node:path';
+import { realpath, readdir, readFile } from 'node:fs/promises';
+import { isAbsolute, join, posix, relative, resolve } from 'node:path';
 import ignore from 'ignore';
 import { ValidationError } from "./errors.js";
+import { createGitRunner } from "./git.js";
 export const DISTIGNORE_FILENAME = '.distignore';
 /**
  * Version control metadata that is never released, at any depth. Without
@@ -35,11 +36,13 @@ export function parseExclude(value) {
  * @return Ignore file path (or null), whether it's required, and the patterns.
  */
 export function resolveFileSelection(input) {
-    const { cwd, sourceDir, distignore, exclude } = input;
+    const { cwd, sourceDir, distignore, exclude, excludeGitattributes = false, } = input;
     const selection = {
         distignore: join(sourceDir, DISTIGNORE_FILENAME),
         distignoreRequired: false,
         exclude: parseExclude(exclude),
+        sourceDir,
+        excludeGitattributes,
     };
     if (false === distignore) {
         selection.distignore = null;
@@ -61,8 +64,101 @@ export function resolveFileSelection(input) {
  */
 export async function loadFileRules(selection) {
     const { distignore = null, distignoreRequired = false, exclude = [], } = selection;
-    const rules = await readIgnoreFile(distignore, distignoreRequired);
-    return ignore().add(rules).add(exclude).add(ALWAYS_EXCLUDED);
+    const rules = ignore()
+        .add(await readIgnoreFile(distignore, distignoreRequired))
+        .add(exclude);
+    if (selection.excludeGitattributes) {
+        if (!selection.sourceDir) {
+            throw new ValidationError('--exclude-gitattributes requires a source directory.');
+        }
+        const excluded = await getExportIgnoredPaths(selection.sourceDir, rules);
+        rules.add(excluded.map((path) => `/${escapePattern(path)}`));
+    }
+    return rules.add(ALWAYS_EXCLUDED);
+}
+/**
+ * Read Git's export-ignore attribute for the source files selected by the
+ * other ignore rules. Git itself evaluates .gitattributes, including nested
+ * files and its pattern syntax.
+ *
+ * @param sourceDir Directory whose files are being selected.
+ * @param rules     Rules already loaded from .distignore and --exclude.
+ * @return Source-relative paths marked export-ignore.
+ */
+async function getExportIgnoredPaths(sourceDir, rules) {
+    const runner = createGitRunner();
+    let root;
+    try {
+        ({ stdout: root } = await runner({
+            args: ['rev-parse', '--show-toplevel'],
+            cwd: sourceDir,
+        }));
+    }
+    catch {
+        throw new ValidationError('--exclude-gitattributes requires the source directory to be inside a Git repository.');
+    }
+    root = await realpath(root.trim());
+    const sourceFromRoot = relative(root, await realpath(sourceDir));
+    if (isAbsolute(sourceFromRoot) ||
+        sourceFromRoot === '..' ||
+        sourceFromRoot.startsWith(`..${posix.sep}`)) {
+        throw new ValidationError('--exclude-gitattributes requires the source directory to be inside a Git repository.');
+    }
+    const candidates = await findAttributeCandidates(sourceDir, '', rules);
+    if (!candidates.length) {
+        return [];
+    }
+    const pathsFromRoot = candidates.map((path) => posix.join(sourceFromRoot.split('\\').join('/'), path));
+    const { stdout } = await runner({
+        args: ['check-attr', '-z', '--stdin', 'export-ignore'],
+        cwd: root,
+        input: pathsFromRoot.map((path) => `${path}\0`).join(''),
+    });
+    const fields = stdout.split('\0');
+    const ignored = [];
+    for (let index = 0; index + 2 < fields.length; index += 3) {
+        const candidate = candidates[index / 3];
+        if (fields[index + 2] === 'set' && candidate) {
+            ignored.push(candidate);
+        }
+    }
+    return ignored;
+}
+/**
+ * List regular files and symbolic links not already excluded by ignore rules.
+ * Symbolic links are included here so Git can exclude them before selectFiles
+ * applies its unsupported-link validation.
+ *
+ * @param sourceDir Source directory.
+ * @param dir       Relative directory being traversed.
+ * @param rules     Ignore rules.
+ * @return Relative paths to candidate files.
+ */
+async function findAttributeCandidates(sourceDir, dir, rules) {
+    const entries = await readdir(join(sourceDir, dir), {
+        withFileTypes: true,
+    });
+    const paths = await Promise.all(entries.map(async (entry) => {
+        const path = posix.join(dir, entry.name);
+        if (entry.isDirectory() && !rules.ignores(`${path}/`)) {
+            return findAttributeCandidates(sourceDir, path, rules);
+        }
+        if ((entry.isFile() || entry.isSymbolicLink()) &&
+            !rules.ignores(path)) {
+            return [path];
+        }
+        return [];
+    }));
+    return paths.flat();
+}
+/**
+ * Escape a path for an anchored gitignore pattern.
+ *
+ * @param path Relative path.
+ * @return Pattern-safe path.
+ */
+function escapePattern(path) {
+    return path.replace(/[\\*?[\\]!#]/g, '\\$&');
 }
 /**
  * Read the ignore file, or nothing when there's no file to read.

package/dist/git-deploy.d.ts

@@ -24,6 +24,8 @@ export interface GitDeployInput {
     distignore?: string | false;
     /** Extra gitignore-style patterns. */
     exclude?: string | string[];
+    /** Also exclude paths marked export-ignore by Git attributes. */
+    excludeGitattributes?: boolean;
     /** Commit message of the release. */
     message?: string;
     /** Run everything except the push. */

package/dist/git-deploy.js

@@ -55,6 +55,7 @@ export function resolveGitDeployOptions(input = {}) {
             sourceDir,
             distignore: input.distignore,
             exclude: input.exclude,
+            excludeGitattributes: input.excludeGitattributes,
         }),
     };
 }

package/dist/index.d.ts

@@ -9,7 +9,7 @@ export { DISTIGNORE_FILENAME, parseExclude, resolveFileSelection, loadFileRules,
 export { FILENAME_FORMAT, formatFilename } from './filename.ts';
 export { CHECKSUMS_EXTENSION, CHECKSUM_ALGORITHMS, hashFile, hashFiles, createChecksums, writeChecksums, readChecksums, parseChecksums, compareChecksums, verifyChecksums, } from './checksums.ts';
 export { HEADER_BYTES, PLUGIN_HEADERS, THEME_HEADERS, README_HEADERS, README_FILENAMES, parseFileHeaders, parseReadmeHeaders, readFileStart, findFileHeaderLine, findReadmeHeaderLine, findMainPluginFile, readPackageMeta, } from './package-meta.ts';
-export { SIGNATURE_EXTENSION, SIGNING_KEY_ENV, parseSigningKey, parsePublicKey, getPublicKey, getFileDigest, signFile, writeSignature, verifyFileSignature, } from './signing.ts';
+export { SIGNATURE_EXTENSION, SIGNING_KEY_ENV, parseSigningKey, parsePublicKey, generateSigningKeyPair, getPublicKey, getFileDigest, signFile, writeSignature, verifyFileSignature, } from './signing.ts';
 export { ZIP_MTIME, ZIP_FILE_MODE, createZip } from './zip.ts';
 export { isUrl, downloadFile } from './download.ts';
 export { readZipEntries, getZipEntryErrors, extractZip } from './unzip.ts';
@@ -26,6 +26,7 @@ export { getGitDeployInputFromArgs } from './commands/deploy-git.ts';
 export type { CliIo, CommandResults } from './cli.ts';
 export type { ChecksumsResult } from './commands/checksums.ts';
 export type { SignResult } from './commands/sign.ts';
+export type { KeygenResult } from './commands/keygen.ts';
 export type { ZipResult } from './commands/zip.ts';
 export type { Command, CommandContext, CommandOutcome, ParsedValues, } from './commands/command.ts';
 export type { DeployArgsInput } from './commands/deploy-svn.ts';
@@ -42,7 +43,7 @@ export type { ExtractZipInput, ZipEntryInfo, ZipEntryType } from './unzip.ts';
 export type { FindVersionMismatchesInput, GitTagInput, VersionCheckResult, VersionMismatch, } from './version-check.ts';
 export type { Changeset, ChangesetBump, ChangesetPackages, ChangesetConfig, ChangesetPackageType, ChangesetPackage, PackageRelease, VersionedRelease, ChangesetReleasePlan, } from './changesets.ts';
 export type { ChangesetRepository, ChangesetVersionInput, VersionChangesetsResult, ChangesetTagInput, ChangesetTagResult, } from './changeset-release.ts';
-export type { WpReleaseConfig, ChangesetPackageGroup, PackageVersionConfig, PackageVersionSource, PackageVersionTarget, PackageIdSource, NextVersionInput, ReleaseCommit, ReleaseNotesInput, ChangelogEntryInput, PackageJsonVersionOptions, ComposerJsonVersionOptions, WordPressVersionFileOptions, GitTagVersionOptions, PhpConstantVersionOptions, LoadChangesetConfigInput, } from './changeset-config.ts';
+export type { WpReleaseConfig, ChangesetPackageGroup, PackageVersionConfig, PackageVersionSource, PackageVersionTarget, PackageIdSource, NextVersionInput, ReleaseCommit, ReleaseNotesInput, ChangelogEntryInput, DependentsChangelogInput, DependentsConfig, PackageJsonVersionOptions, ComposerJsonVersionOptions, WordPressVersionFileOptions, GitTagVersionOptions, PhpConstantVersionOptions, LoadChangesetConfigInput, } from './changeset-config.ts';
 export type { SvnCheckoutInput, SvnCommandInput, SvnCommandOutput, SvnCommitInput, SvnCopyInput, SvnDepth, SvnOptions, SvnPathsInput, SvnPropsetInput, SvnRunner, SvnStatusEntry, SvnStatusType, SvnUpdateInput, } from './svn.ts';
 export type { SyncDirectoryInput, SyncResult } from './sync.ts';
 export type { SummaryContext } from './summary.ts';

package/dist/index.js

@@ -9,7 +9,7 @@ export { DISTIGNORE_FILENAME, parseExclude, resolveFileSelection, loadFileRules,
 export { FILENAME_FORMAT, formatFilename } from "./filename.js";
 export { CHECKSUMS_EXTENSION, CHECKSUM_ALGORITHMS, hashFile, hashFiles, createChecksums, writeChecksums, readChecksums, parseChecksums, compareChecksums, verifyChecksums, } from "./checksums.js";
 export { HEADER_BYTES, PLUGIN_HEADERS, THEME_HEADERS, README_HEADERS, README_FILENAMES, parseFileHeaders, parseReadmeHeaders, readFileStart, findFileHeaderLine, findReadmeHeaderLine, findMainPluginFile, readPackageMeta, } from "./package-meta.js";
-export { SIGNATURE_EXTENSION, SIGNING_KEY_ENV, parseSigningKey, parsePublicKey, getPublicKey, getFileDigest, signFile, writeSignature, verifyFileSignature, } from "./signing.js";
+export { SIGNATURE_EXTENSION, SIGNING_KEY_ENV, parseSigningKey, parsePublicKey, generateSigningKeyPair, getPublicKey, getFileDigest, signFile, writeSignature, verifyFileSignature, } from "./signing.js";
 export { ZIP_MTIME, ZIP_FILE_MODE, createZip } from "./zip.js";
 export { isUrl, downloadFile } from "./download.js";
 export { readZipEntries, getZipEntryErrors, extractZip } from "./unzip.js";

package/dist/signing.d.ts

@@ -4,6 +4,15 @@ export declare const SIGNATURE_EXTENSION = ".sig";
  * Environment variable with the base64 Ed25519 signing key.
  */
 export declare const SIGNING_KEY_ENV = "WP_RELEASE_SIGNING_KEY";
+/**
+ * Generate an Ed25519 key pair in the base64 formats used by wp-release.
+ *
+ * @return Private seed for WP_RELEASE_SIGNING_KEY and public verification key.
+ */
+export declare function generateSigningKeyPair(): {
+    privateKey: string;
+    publicKey: string;
+};
 /**
  * Get an Ed25519 private key from the base64 format that sodium and the
  * update-client signing_key setting use: a 32-byte seed or a 64-byte

package/dist/signing.js

@@ -1,4 +1,4 @@
-import { createHash, createPrivateKey, createPublicKey, sign, verify, } from 'node:crypto';
+import { createHash, createPrivateKey, generateKeyPairSync, createPublicKey, sign, verify, } from 'node:crypto';
 import { createReadStream } from 'node:fs';
 import { readFile, writeFile } from 'node:fs/promises';
 import { ValidationError } from "./errors.js";
@@ -14,6 +14,23 @@ const PUBLIC_KEY_BYTES = 32;
 const PKCS8_PREFIX = Buffer.from('302e020100300506032b657004220420', 'hex');
 // DER prefix of a SPKI Ed25519 public key, followed by the 32-byte key.
 const SPKI_PREFIX = Buffer.from('302a300506032b6570032100', 'hex');
+/**
+ * Generate an Ed25519 key pair in the base64 formats used by wp-release.
+ *
+ * @return Private seed for WP_RELEASE_SIGNING_KEY and public verification key.
+ */
+export function generateSigningKeyPair() {
+    const { privateKey, publicKey } = generateKeyPairSync('ed25519');
+    const privateJwk = privateKey.export({ format: 'jwk' });
+    const publicJwk = publicKey.export({ format: 'jwk' });
+    if (!privateJwk.d || !publicJwk.x) {
+        throw new ValidationError('Could not export the generated Ed25519 key pair.');
+    }
+    return {
+        privateKey: Buffer.from(privateJwk.d, 'base64url').toString('base64'),
+        publicKey: Buffer.from(publicJwk.x, 'base64url').toString('base64'),
+    };
+}
 /**
  * Decode a base64 key, accepting the base64url alphabet and whitespace.
  *

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@wpelevator/wp-release",
-	"version": "0.8.0",
+	"version": "0.10.0",
 	"description": "Package, checksum, sign, verify and version-check WordPress plugins and themes, and deploy plugins to WordPress.org SVN",
 	"license": "MIT",
 	"repository": {
@@ -41,11 +41,13 @@
 	],
 	"dependencies": {
 		"ignore": "^7.0.12",
+		"semver": "^7.7.1",
 		"yauzl": "^3.4.0",
 		"yazl": "^3.3.1"
 	},
 	"devDependencies": {
 		"@types/node": "^22.20.5",
+		"@types/semver": "^7.8.0",
 		"@types/yauzl": "^3.4.0",
 		"@types/yazl": "^3.3.1",
 		"@wordpress/scripts": "^33.0",