@wpelevator/wp-release 0.8.0 → 0.9.0

package/README.md

@@ -14,7 +14,7 @@ Option names follow the existing community tools (10up WordPress.org actions, `w
 npm install --save-dev @wpelevator/wp-release
 ```
 
-Requires Node.js 22.12 or later. `deploy-svn` also needs the `svn` command line client.
+Requires Node.js 22.12 or later. `deploy-svn` also needs the `svn` command line client; the optional `--exclude-gitattributes` flag needs Git.
 
 The package is an ES module with TypeScript type definitions. CommonJS projects can load it with `require( '@wpelevator/wp-release' )`, which Node.js supports for ES modules without top-level `await` since 22.12.
 
@@ -29,6 +29,7 @@ npx wp-release --help
 | `wp-release zip [<source-dir>] [options]` | Create a ZIP archive with a `{slug}/` root folder, respecting `.distignore`. |
 | `wp-release checksums [<source-dir>] [options]` | Write the MD5 and SHA-256 hashes of every distributed file to a checksums manifest. |
 | `wp-release sign <file>... [options]` | Sign files with Ed25519, writing a detached `<file>.sig` next to each. |
+| `wp-release keygen` | Generate a base64 Ed25519 private seed and public key for signing and verification. |
 | `wp-release verify [<source-dir>] --checksums <file> [options]` | Check a plugin or theme directory, or a ZIP, against a checksums manifest. |
 | `wp-release version-check [<source-dir>] [options]` | Check that the `Version` header, readme `Stable tag`, PHP constants and git tag agree. |
 | `wp-release deploy-svn [<source-dir>] [options]` | Deploy a plugin to the WordPress.org plugin SVN repository. |
@@ -188,15 +189,16 @@ CLI JSON results use camelCase keys like `zipPath`, and GitHub Action outputs us
 
 ### File selection
 
-`zip`, `checksums` and `deploy-svn` select files the same way:
+`zip`, `checksums`, `deploy-svn` and `deploy-git` select files the same way:
 
 | Option | Description |
 |---|---|
 | `--distignore <file>` | Path to the ignore file. Defaults to `.distignore` in the source directory when present; an explicitly passed file must exist. |
 | `--no-distignore` | Don't read any ignore file. |
 | `--exclude <patterns>` | Extra gitignore-style patterns, comma-separated or repeated, like `--exclude build/,assets/*,images/**/*`. They're applied after the ignore file, so a `!` pattern can also re-include a file. |
+| `--exclude-gitattributes` | Also exclude paths marked `export-ignore` by Git attributes. This is opt-in and requires the source directory to be inside a Git repository. |
 
-Both use full gitignore syntax, including `!` negation. Version control metadata (`.git`, `.svn` and `.hg`, at any depth, including the `.git` files of worktrees and submodules) is always left out, also without an ignore file and when deploying from a ZIP, and no `!` pattern can re-include it. This keeps a repository's history out of ZIPs and SVN deploys when the source directory is the repository root. The comma-separated `--exclude` list works like `--exclude` in `wp i18n make-pot`. `deploy-svn --from-zip` ignores both options, since the ZIP is already filtered. Symbolic links that aren't excluded are an error, since ZIP archives and WordPress.org SVN don't support them.
+`.distignore` and `--exclude` use full gitignore syntax, including `!` negation. `--exclude-gitattributes` asks Git to evaluate `export-ignore` attributes, including nested `.gitattributes` files, then adds those paths to the exclusions. It is off by default, so releases don't unexpectedly depend on Git or change selection when a repository adds attributes. Git must be installed and the source directory must be inside a working tree; the flag is ignored by `deploy-svn --from-zip`, since the ZIP is already filtered. Version control metadata (`.git`, `.svn` and `.hg`, at any depth, including the `.git` files of worktrees and submodules) is always left out, also without an ignore file and when deploying from a ZIP, and no `!` pattern can re-include it. This keeps a repository's history out of ZIPs and deploys when the source directory is the repository root. The comma-separated `--exclude` list works like `--exclude` in `wp i18n make-pot`. Selected symbolic links are an error, since ZIP archives and WordPress.org SVN don't support them.
 
 ### Plugin and theme headers
 
@@ -304,7 +306,7 @@ WP_RELEASE_SIGNING_KEY=… wp-release sign my-plugin.1.2.0.zip my-plugin.1.2.0.c
 - `--verbose` prints the public key of the signing key, which `--json` also returns as `publicKey`. Pass it to `verify --public-key` and to the plugin that checks the signatures.
 - An existing `.sig` file isn't overwritten without `--force`.
 
-Generating a key pair isn't part of the package yet. With PHP: `php -r 'echo base64_encode( random_bytes( 32 ) );'` gives a seed, and the public key is printed by `sign --verbose`.
+Generate a key pair with `wp-release keygen`. It prints the private seed once as `WP_RELEASE_SIGNING_KEY=…` and the matching public key. Store the private seed securely; never commit it or put it in a workflow log. Don't run `keygen` in CI or with `--github-output`, since those outputs can expose the private seed. The public key can be distributed to verifiers.
 
 ### Version check
 
@@ -538,7 +540,7 @@ const { valid, changed, missing, extra } = await verifyChecksums( {
 } );
 ```
 
-`loadFileRules()` reads the ignore file and `--exclude` patterns into a gitignore matcher and `selectFiles()` lists the files it doesn't ignore. `compareChecksums()` compares two hash maps without reading any files, and `parseChecksums()` validates manifest JSON. `extractZip()` extracts a ZIP after the same checks as `deploy-svn --from-zip`.
+`loadFileRules()` reads the ignore file and `--exclude` patterns into a gitignore matcher, optionally adds Git `export-ignore` paths, and `selectFiles()` lists the files it doesn't ignore. `compareChecksums()` compares two hash maps without reading any files, and `parseChecksums()` validates manifest JSON. `extractZip()` extracts a ZIP after the same checks as `deploy-svn --from-zip`.
 
 ## Development
 
@@ -560,9 +562,9 @@ The `wpelevator-source` export condition points at `src/index.ts`. The tests and
 
 | Tool | What it does | How `wp-release` differs |
 |---|---|---|
-| [10up WordPress.org plugin deploy](https://github.com/10up/action-wordpress-plugin-deploy) and [readme/asset update](https://github.com/10up/action-wordpress-plugin-asset-update) actions | Two separate GitHub Actions configured through env vars. A deploy always syncs the build to `trunk/` and copies it to the tag; readme and asset updates need the second action. Assets come from `.wordpress-org` by default, and files are selected with `.distignore` or `.gitattributes`. Files are synced with `rsync`. | One `deploy-svn` command with independent write flags, so a release, a readme-only update and an assets-only update are the same command with different flags. Runs locally and in any CI, not only GitHub Actions, and syncs in Node.js without `rsync`. Checks that the `Version` header, readme `Stable tag` and SVN tag agree before writing, which the 10up actions don't. Assets are deployed only when `--assets-dir` is passed, instead of always syncing `.wordpress-org` when it exists, so a plugin's own `assets/` folder is never uploaded by accident. Adds `--exclude` for patterns without an ignore file and `--from-zip` to deploy the exact files of a ZIP. |
+| [10up WordPress.org plugin deploy](https://github.com/10up/action-wordpress-plugin-deploy) and [readme/asset update](https://github.com/10up/action-wordpress-plugin-asset-update) actions | Two separate GitHub Actions configured through env vars. A deploy always syncs the build to `trunk/` and copies it to the tag; readme and asset updates need the second action. Assets come from `.wordpress-org` by default, and files are selected with `.distignore` or `.gitattributes`. Files are synced with `rsync`. | One `deploy-svn` command with independent write flags, so a release, a readme-only update and an assets-only update are the same command with different flags. Runs locally and in any CI, not only GitHub Actions, and syncs in Node.js without `rsync`. Checks that the `Version` header, readme `Stable tag` and SVN tag agree before writing, which the 10up actions don't. Assets are deployed only when `--assets-dir` is passed, instead of always syncing `.wordpress-org` when it exists, so a plugin's own `assets/` folder is never uploaded by accident. Adds `--exclude` for patterns without an ignore file, opt-in Git `export-ignore` support and `--from-zip` to deploy the exact files of a ZIP. |
 | [`grunt-wp-deploy`](https://github.com/stephenharris/grunt-wp-deploy) | Grunt task with `deploy_trunk` and `deploy_tag` booleans, interactive password prompts and a `Stable tag` check. | No Grunt dependency and never interactive. `--readme-only` is a separate flag, where `grunt-wp-deploy` can only update trunk with the full build. Assets are independent of trunk writes. |
 | [codeinwp theme deploy](https://github.com/codeinwp/action-wordpress-theme-deploy) | Fork of the 10up plugin action that commits themes to the themes SVN repository. | Doesn't deploy themes. Theme releases are ZIP uploads on WordPress.org; `zip` builds the upload with the theme folder as the root. |
 | [`wp dist-archive`](https://github.com/wp-cli/dist-archive-command) | WP-CLI command that zips a project using `.distignore`, with `--plugin-dirname` and `--filename-format`. | Same `.distignore` file and `{name}.{version}` style filename format, but needs only Node.js instead of PHP and WP-CLI. `.distignore` is matched with full gitignore syntax, including `!` negation, and `--distignore` / `--exclude` let you point at another ignore file or add patterns on the command line. Builds are reproducible, and `--checksums` writes a manifest next to the ZIP. |
 | [`wp plugin verify-checksums`](https://developer.wordpress.org/cli/commands/plugin/verify-checksums/) | WP-CLI command that checks installed plugins against the WordPress.org checksums API. | Reads the same manifest format, but from a file, so it also works for plugins and themes that aren't hosted on WordPress.org and for build directories in CI. `checksums` writes the manifest that WordPress.org generates for its own plugins. |
-| [`wp-scripts plugin-zip`](https://github.com/WordPress/gutenberg/tree/trunk/packages/scripts#plugin-zip) | Zips files from `package.json` `files` or a fixed allowlist, named after the npm package, with `--root-folder` / `--no-root-folder`. | Reuses the root folder flags, selects files with `.distignore` instead of an allowlist, puts the version from the plugin headers in the filename and streams the archive instead of building it in memory. |
+| [`wp-scripts plugin-zip`](https://github.com/WordPress/gutenberg/tree/trunk/packages/scripts#plugin-zip) | Zips files from `package.json` `files` or a fixed allowlist, named after the npm package, with `--root-folder` / `--no-root-folder`. | Reuses the root folder flags, selects files with `.distignore` by default and can optionally honor Git `export-ignore` attributes, puts the version from the plugin headers in the filename and streams the archive instead of building it in memory. |

package/dist/cli.d.ts

@@ -1,5 +1,6 @@
 import type { ChecksumsResult } from './commands/checksums.ts';
 import type { SignResult } from './commands/sign.ts';
+import type { KeygenResult } from './commands/keygen.ts';
 import type { ZipResult } from './commands/zip.ts';
 import type { ChangesetVersionResult } from './commands/changeset-version.ts';
 import { Logger } from './logger.ts';
@@ -44,6 +45,7 @@ export interface CommandResults {
     zip: ZipResult;
     checksums: ChecksumsResult;
     sign: SignResult;
+    keygen: KeygenResult;
     'changeset-add': import('./commands/changeset-add.ts').ChangesetAddResult;
     'changeset-status': import('./commands/changeset-status.ts').ChangesetStatusResult;
     'changeset-version': ChangesetVersionResult;

package/dist/cli.js

@@ -3,6 +3,7 @@ import { parseArgs } from 'node:util';
 import zip from "./commands/zip.js";
 import checksums from "./commands/checksums.js";
 import sign from "./commands/sign.js";
+import keygen from "./commands/keygen.js";
 import verify from "./commands/verify.js";
 import versionCheck from "./commands/version-check.js";
 import deploySvn from "./commands/deploy-svn.js";
@@ -23,6 +24,7 @@ export const commands = [
     zip,
     checksums,
     sign,
+    keygen,
     verify,
     versionCheck,
     deploySvn,

package/dist/commands/args.d.ts

@@ -15,6 +15,7 @@ export declare const fileSelectionArgs: ParseArgsOptionsConfig;
 export declare function getFileSelectionInput(values: ParsedValues): {
     distignore: string | false | undefined;
     exclude: string[];
+    excludeGitattributes: boolean;
 };
 /**
  * Check that a command got no more positional arguments than it accepts.

package/dist/commands/args.js

@@ -11,6 +11,7 @@ export const fileSelectionArgs = {
     distignore: { type: 'string' },
     'no-distignore': { type: 'boolean' },
     exclude: { type: 'string', multiple: true },
+    'exclude-gitattributes': { type: 'boolean' },
 };
 /**
  * Map the parsed file selection flags to resolveFileSelection() input.
@@ -24,6 +25,7 @@ export function getFileSelectionInput(values) {
             ? false
             : getString(values, 'distignore'),
         exclude: getStrings(values, 'exclude'),
+        excludeGitattributes: getBoolean(values, 'exclude-gitattributes'),
     };
 }
 /**

package/dist/commands/checksums.js

@@ -28,6 +28,8 @@ Options:
   --no-distignore             Don't read any ignore file
   --exclude <patterns>        Extra gitignore-style patterns, comma-separated or
                               repeated, like build/,assets/*,images/**/*
+  --exclude-gitattributes     Also exclude paths marked export-ignore in Git
+                              attributes (requires a Git working tree)
   --force                     Overwrite an existing --output file
 
 The manifest uses the WordPress.org plugin checksums format, with paths

package/dist/commands/deploy-git.js

@@ -46,6 +46,7 @@ Options:
   --distignore <file>     Ignore file (default: <source-dir>/.distignore when present)
   --no-distignore         Don't read any ignore file
   --exclude <patterns>    Extra gitignore-style patterns, comma-separated or repeated
+  --exclude-gitattributes Also exclude paths marked export-ignore in Git attributes
   --message <text>        Release commit message
   --dry-run               Run everything except the push
 

package/dist/commands/deploy-svn.js

@@ -60,6 +60,7 @@ Options:
   --distignore <file>     Ignore file (default: <source-dir>/.distignore when present)
   --no-distignore         Don't read any ignore file
   --exclude <patterns>    Extra gitignore-style patterns, comma-separated or repeated
+  --exclude-gitattributes Also exclude paths marked export-ignore in Git attributes
   --svn-url <url>         Repository URL with {slug}
                           (default: https://plugins.svn.wordpress.org/{slug}/)
   --svn-username <name>   SVN username (env: SVN_USERNAME, password: SVN_PASSWORD)

package/dist/commands/keygen.d.ts

@@ -0,0 +1,17 @@
+import type { CommandOutcome } from './command.ts';
+/** Generated Ed25519 signing keys. */
+export interface KeygenResult {
+    /** Base64 Ed25519 seed for WP_RELEASE_SIGNING_KEY. */
+    privateKey: string;
+    /** Base64 Ed25519 public key for verification. */
+    publicKey: string;
+}
+declare const _default: {
+    name: string;
+    usage: string;
+    summary: string;
+    help: string;
+    options: {};
+    run({ values, logger }: import("./command.ts").CommandContext): Promise<CommandOutcome<KeygenResult>>;
+};
+export default _default;

package/dist/commands/keygen.js

@@ -0,0 +1,23 @@
+import { ValidationError } from "../errors.js";
+import { generateSigningKeyPair } from "../signing.js";
+import { getBoolean } from "./command.js";
+export default {
+    name: 'keygen',
+    usage: 'keygen',
+    summary: 'Generate an Ed25519 signing key pair.',
+    help: `Generate a signing key pair for "wp-release sign" and "wp-release verify".
+
+The private seed is printed once as WP_RELEASE_SIGNING_KEY. Store it securely
+and never commit it or share it. The public key can be distributed to verifiers.`,
+    options: {},
+    async run({ values, logger }) {
+        if (getBoolean(values, 'github-output')) {
+            throw new ValidationError('keygen cannot be used with --github-output, which would store the private seed in a workflow output.');
+        }
+        const result = generateSigningKeyPair();
+        logger.info(`WP_RELEASE_SIGNING_KEY=${result.privateKey}`);
+        logger.info(`Public key: ${result.publicKey}`);
+        logger.info('Store the private seed securely; it cannot be recovered from the public key.');
+        return { exitCode: 0, result };
+    },
+};

package/dist/commands/zip.js

@@ -56,6 +56,8 @@ Options:
   --no-distignore             Don't read any ignore file
   --exclude <patterns>        Extra gitignore-style patterns, comma-separated or
                               repeated, like build/,assets/*,images/**/*
+  --exclude-gitattributes     Also exclude paths marked export-ignore in Git
+                              attributes (requires a Git working tree)
   --checksums                 Also write the checksums manifest of the archived
                               files next to the ZIP, with .checksums.json
                               instead of .zip

package/dist/deploy-options.d.ts

@@ -27,6 +27,8 @@ export interface DeployInput {
     distignore?: string | false;
     /** Extra gitignore-style patterns. */
     exclude?: string | string[];
+    /** Also exclude paths marked export-ignore by Git attributes. */
+    excludeGitattributes?: boolean;
     /** Readme file name. */
     readme?: string;
     /** ZIP archive to deploy instead of sourceDir. */

package/dist/deploy-options.js

@@ -139,6 +139,7 @@ export function resolveDeployOptions(input = {}) {
             sourceDir,
             distignore: input.distignore,
             exclude: input.exclude,
+            excludeGitattributes: input.excludeGitattributes,
         }),
         assetsDir,
         readme: input.readme || 'readme.txt',

package/dist/file-selection.d.ts

@@ -21,6 +21,8 @@ export interface FileSelectionInput {
     distignore?: string | false;
     /** Extra gitignore-style patterns, comma or newline separated. */
     exclude?: string | string[];
+    /** Also exclude paths marked export-ignore by Git attributes. */
+    excludeGitattributes?: boolean;
 }
 export interface FileSelection {
     /** Ignore file path, or null when disabled. */
@@ -29,6 +31,10 @@ export interface FileSelection {
     distignoreRequired: boolean;
     /** Extra gitignore-style patterns. */
     exclude: string[];
+    /** Source directory, needed to resolve Git attributes. */
+    sourceDir?: string;
+    /** Also exclude paths marked export-ignore by Git attributes. */
+    excludeGitattributes?: boolean;
 }
 /**
  * Parse exclude patterns from a comma or newline separated string, an array

package/dist/file-selection.js

@@ -1,7 +1,8 @@
-import { readdir, readFile } from 'node:fs/promises';
-import { join, posix, resolve } from 'node:path';
+import { realpath, readdir, readFile } from 'node:fs/promises';
+import { isAbsolute, join, posix, relative, resolve } from 'node:path';
 import ignore from 'ignore';
 import { ValidationError } from "./errors.js";
+import { createGitRunner } from "./git.js";
 export const DISTIGNORE_FILENAME = '.distignore';
 /**
  * Version control metadata that is never released, at any depth. Without
@@ -35,11 +36,13 @@ export function parseExclude(value) {
  * @return Ignore file path (or null), whether it's required, and the patterns.
  */
 export function resolveFileSelection(input) {
-    const { cwd, sourceDir, distignore, exclude } = input;
+    const { cwd, sourceDir, distignore, exclude, excludeGitattributes = false, } = input;
     const selection = {
         distignore: join(sourceDir, DISTIGNORE_FILENAME),
         distignoreRequired: false,
         exclude: parseExclude(exclude),
+        sourceDir,
+        excludeGitattributes,
     };
     if (false === distignore) {
         selection.distignore = null;
@@ -61,8 +64,101 @@ export function resolveFileSelection(input) {
  */
 export async function loadFileRules(selection) {
     const { distignore = null, distignoreRequired = false, exclude = [], } = selection;
-    const rules = await readIgnoreFile(distignore, distignoreRequired);
-    return ignore().add(rules).add(exclude).add(ALWAYS_EXCLUDED);
+    const rules = ignore()
+        .add(await readIgnoreFile(distignore, distignoreRequired))
+        .add(exclude);
+    if (selection.excludeGitattributes) {
+        if (!selection.sourceDir) {
+            throw new ValidationError('--exclude-gitattributes requires a source directory.');
+        }
+        const excluded = await getExportIgnoredPaths(selection.sourceDir, rules);
+        rules.add(excluded.map((path) => `/${escapePattern(path)}`));
+    }
+    return rules.add(ALWAYS_EXCLUDED);
+}
+/**
+ * Read Git's export-ignore attribute for the source files selected by the
+ * other ignore rules. Git itself evaluates .gitattributes, including nested
+ * files and its pattern syntax.
+ *
+ * @param sourceDir Directory whose files are being selected.
+ * @param rules     Rules already loaded from .distignore and --exclude.
+ * @return Source-relative paths marked export-ignore.
+ */
+async function getExportIgnoredPaths(sourceDir, rules) {
+    const runner = createGitRunner();
+    let root;
+    try {
+        ({ stdout: root } = await runner({
+            args: ['rev-parse', '--show-toplevel'],
+            cwd: sourceDir,
+        }));
+    }
+    catch {
+        throw new ValidationError('--exclude-gitattributes requires the source directory to be inside a Git repository.');
+    }
+    root = await realpath(root.trim());
+    const sourceFromRoot = relative(root, await realpath(sourceDir));
+    if (isAbsolute(sourceFromRoot) ||
+        sourceFromRoot === '..' ||
+        sourceFromRoot.startsWith(`..${posix.sep}`)) {
+        throw new ValidationError('--exclude-gitattributes requires the source directory to be inside a Git repository.');
+    }
+    const candidates = await findAttributeCandidates(sourceDir, '', rules);
+    if (!candidates.length) {
+        return [];
+    }
+    const pathsFromRoot = candidates.map((path) => posix.join(sourceFromRoot.split('\\').join('/'), path));
+    const { stdout } = await runner({
+        args: ['check-attr', '-z', '--stdin', 'export-ignore'],
+        cwd: root,
+        input: pathsFromRoot.map((path) => `${path}\0`).join(''),
+    });
+    const fields = stdout.split('\0');
+    const ignored = [];
+    for (let index = 0; index + 2 < fields.length; index += 3) {
+        const candidate = candidates[index / 3];
+        if (fields[index + 2] === 'set' && candidate) {
+            ignored.push(candidate);
+        }
+    }
+    return ignored;
+}
+/**
+ * List regular files and symbolic links not already excluded by ignore rules.
+ * Symbolic links are included here so Git can exclude them before selectFiles
+ * applies its unsupported-link validation.
+ *
+ * @param sourceDir Source directory.
+ * @param dir       Relative directory being traversed.
+ * @param rules     Ignore rules.
+ * @return Relative paths to candidate files.
+ */
+async function findAttributeCandidates(sourceDir, dir, rules) {
+    const entries = await readdir(join(sourceDir, dir), {
+        withFileTypes: true,
+    });
+    const paths = await Promise.all(entries.map(async (entry) => {
+        const path = posix.join(dir, entry.name);
+        if (entry.isDirectory() && !rules.ignores(`${path}/`)) {
+            return findAttributeCandidates(sourceDir, path, rules);
+        }
+        if ((entry.isFile() || entry.isSymbolicLink()) &&
+            !rules.ignores(path)) {
+            return [path];
+        }
+        return [];
+    }));
+    return paths.flat();
+}
+/**
+ * Escape a path for an anchored gitignore pattern.
+ *
+ * @param path Relative path.
+ * @return Pattern-safe path.
+ */
+function escapePattern(path) {
+    return path.replace(/[\\*?[\\]!#]/g, '\\$&');
 }
 /**
  * Read the ignore file, or nothing when there's no file to read.

package/dist/git-deploy.d.ts

@@ -24,6 +24,8 @@ export interface GitDeployInput {
     distignore?: string | false;
     /** Extra gitignore-style patterns. */
     exclude?: string | string[];
+    /** Also exclude paths marked export-ignore by Git attributes. */
+    excludeGitattributes?: boolean;
     /** Commit message of the release. */
     message?: string;
     /** Run everything except the push. */

package/dist/git-deploy.js

@@ -55,6 +55,7 @@ export function resolveGitDeployOptions(input = {}) {
             sourceDir,
             distignore: input.distignore,
             exclude: input.exclude,
+            excludeGitattributes: input.excludeGitattributes,
         }),
     };
 }

package/dist/index.d.ts

@@ -9,7 +9,7 @@ export { DISTIGNORE_FILENAME, parseExclude, resolveFileSelection, loadFileRules,
 export { FILENAME_FORMAT, formatFilename } from './filename.ts';
 export { CHECKSUMS_EXTENSION, CHECKSUM_ALGORITHMS, hashFile, hashFiles, createChecksums, writeChecksums, readChecksums, parseChecksums, compareChecksums, verifyChecksums, } from './checksums.ts';
 export { HEADER_BYTES, PLUGIN_HEADERS, THEME_HEADERS, README_HEADERS, README_FILENAMES, parseFileHeaders, parseReadmeHeaders, readFileStart, findFileHeaderLine, findReadmeHeaderLine, findMainPluginFile, readPackageMeta, } from './package-meta.ts';
-export { SIGNATURE_EXTENSION, SIGNING_KEY_ENV, parseSigningKey, parsePublicKey, getPublicKey, getFileDigest, signFile, writeSignature, verifyFileSignature, } from './signing.ts';
+export { SIGNATURE_EXTENSION, SIGNING_KEY_ENV, parseSigningKey, parsePublicKey, generateSigningKeyPair, getPublicKey, getFileDigest, signFile, writeSignature, verifyFileSignature, } from './signing.ts';
 export { ZIP_MTIME, ZIP_FILE_MODE, createZip } from './zip.ts';
 export { isUrl, downloadFile } from './download.ts';
 export { readZipEntries, getZipEntryErrors, extractZip } from './unzip.ts';
@@ -26,6 +26,7 @@ export { getGitDeployInputFromArgs } from './commands/deploy-git.ts';
 export type { CliIo, CommandResults } from './cli.ts';
 export type { ChecksumsResult } from './commands/checksums.ts';
 export type { SignResult } from './commands/sign.ts';
+export type { KeygenResult } from './commands/keygen.ts';
 export type { ZipResult } from './commands/zip.ts';
 export type { Command, CommandContext, CommandOutcome, ParsedValues, } from './commands/command.ts';
 export type { DeployArgsInput } from './commands/deploy-svn.ts';

package/dist/index.js

@@ -9,7 +9,7 @@ export { DISTIGNORE_FILENAME, parseExclude, resolveFileSelection, loadFileRules,
 export { FILENAME_FORMAT, formatFilename } from "./filename.js";
 export { CHECKSUMS_EXTENSION, CHECKSUM_ALGORITHMS, hashFile, hashFiles, createChecksums, writeChecksums, readChecksums, parseChecksums, compareChecksums, verifyChecksums, } from "./checksums.js";
 export { HEADER_BYTES, PLUGIN_HEADERS, THEME_HEADERS, README_HEADERS, README_FILENAMES, parseFileHeaders, parseReadmeHeaders, readFileStart, findFileHeaderLine, findReadmeHeaderLine, findMainPluginFile, readPackageMeta, } from "./package-meta.js";
-export { SIGNATURE_EXTENSION, SIGNING_KEY_ENV, parseSigningKey, parsePublicKey, getPublicKey, getFileDigest, signFile, writeSignature, verifyFileSignature, } from "./signing.js";
+export { SIGNATURE_EXTENSION, SIGNING_KEY_ENV, parseSigningKey, parsePublicKey, generateSigningKeyPair, getPublicKey, getFileDigest, signFile, writeSignature, verifyFileSignature, } from "./signing.js";
 export { ZIP_MTIME, ZIP_FILE_MODE, createZip } from "./zip.js";
 export { isUrl, downloadFile } from "./download.js";
 export { readZipEntries, getZipEntryErrors, extractZip } from "./unzip.js";

package/dist/signing.d.ts

@@ -4,6 +4,15 @@ export declare const SIGNATURE_EXTENSION = ".sig";
  * Environment variable with the base64 Ed25519 signing key.
  */
 export declare const SIGNING_KEY_ENV = "WP_RELEASE_SIGNING_KEY";
+/**
+ * Generate an Ed25519 key pair in the base64 formats used by wp-release.
+ *
+ * @return Private seed for WP_RELEASE_SIGNING_KEY and public verification key.
+ */
+export declare function generateSigningKeyPair(): {
+    privateKey: string;
+    publicKey: string;
+};
 /**
  * Get an Ed25519 private key from the base64 format that sodium and the
  * update-client signing_key setting use: a 32-byte seed or a 64-byte

package/dist/signing.js

@@ -1,4 +1,4 @@
-import { createHash, createPrivateKey, createPublicKey, sign, verify, } from 'node:crypto';
+import { createHash, createPrivateKey, generateKeyPairSync, createPublicKey, sign, verify, } from 'node:crypto';
 import { createReadStream } from 'node:fs';
 import { readFile, writeFile } from 'node:fs/promises';
 import { ValidationError } from "./errors.js";
@@ -14,6 +14,23 @@ const PUBLIC_KEY_BYTES = 32;
 const PKCS8_PREFIX = Buffer.from('302e020100300506032b657004220420', 'hex');
 // DER prefix of a SPKI Ed25519 public key, followed by the 32-byte key.
 const SPKI_PREFIX = Buffer.from('302a300506032b6570032100', 'hex');
+/**
+ * Generate an Ed25519 key pair in the base64 formats used by wp-release.
+ *
+ * @return Private seed for WP_RELEASE_SIGNING_KEY and public verification key.
+ */
+export function generateSigningKeyPair() {
+    const { privateKey, publicKey } = generateKeyPairSync('ed25519');
+    const privateJwk = privateKey.export({ format: 'jwk' });
+    const publicJwk = publicKey.export({ format: 'jwk' });
+    if (!privateJwk.d || !publicJwk.x) {
+        throw new ValidationError('Could not export the generated Ed25519 key pair.');
+    }
+    return {
+        privateKey: Buffer.from(privateJwk.d, 'base64url').toString('base64'),
+        publicKey: Buffer.from(publicJwk.x, 'base64url').toString('base64'),
+    };
+}
 /**
  * Decode a base64 key, accepting the base64url alphabet and whitespace.
  *

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@wpelevator/wp-release",
-	"version": "0.8.0",
+	"version": "0.9.0",
 	"description": "Package, checksum, sign, verify and version-check WordPress plugins and themes, and deploy plugins to WordPress.org SVN",
 	"license": "MIT",
 	"repository": {