From c441b0d528d9f474d9e3a8281343a62e16f92ce3 Mon Sep 17 00:00:00 2001
From: thierrypigot <contact@wearewp.pro>
Date: Tue, 13 Oct 2026 13:53:14 +0200
Subject: [PATCH 01/12] =?UTF-8?q?Th=C3=A8mes=20:=20constats=20sur=20le=20c?=
 =?UTF-8?q?=C5=93ur=20de=20WordPress=20fig=C3=A9s=20par=20un=20test=20(fil?=
 =?UTF-8?q?tre=20update=5Fthemes,=20hook=5Fextra,=20upgrader=5Fpre=5Fdownl?=
 =?UTF-8?q?oad),=20recontr=C3=B4l=C3=A9s=20en=206.1.7?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Recontrôle 6.1.7 : filtre update_themes_{$hostname} (update.php l.793), 'theme' => $theme dans upgrade() et bulk_upgrade() (l.331 et 446, sans temp_backup), upgrader_pre_download avec $hook_extra (l.270) : identique à 7.1.3.
---
 tests/Unit/WordPressThemeContractTest.php | 78 +++++++++++++++++++++++
 1 file changed, 78 insertions(+)
 create mode 100644 tests/Unit/WordPressThemeContractTest.php

diff --git a/tests/Unit/WordPressThemeContractTest.php b/tests/Unit/WordPressThemeContractTest.php
new file mode 100644
index 0000000..837a8bc
--- /dev/null
+++ b/tests/Unit/WordPressThemeContractTest.php
@@ -0,0 +1,78 @@
+<?php
+
+declare(strict_types=1);
+
+namespace WAWP\ReleaseTools\Tests\Unit;
+
+use PHPUnit\Framework\TestCase;
+
+/**
+ * Comportements du cœur de WordPress sur lesquels repose wawp-theme-updater (spec thèmes, section 11),
+ * vérifiés dans l'archive de la version épinglée pour le bout en bout.
+ */
+final class WordPressThemeContractTest extends TestCase
+{
+    private static function source(string $path): string
+    {
+        $versions = json_decode((string) file_get_contents(dirname(__DIR__) . '/e2e/versions.json'), true);
+        self::assertIsArray($versions);
+        $zip = dirname(__DIR__) . '/e2e/cache/wordpress-' . $versions['wordpress']['version'] . '.zip';
+        if (!is_file($zip)) {
+            self::markTestSkipped('Archive WordPress absente du cache e2e (lancer composer e2e une fois).');
+        }
+        $archive = new \ZipArchive();
+        self::assertTrue($archive->open($zip));
+        $content = (string) $archive->getFromName('wordpress/' . $path);
+        $archive->close();
+        self::assertNotSame('', $content, $path);
+
+        return str_replace("\r", '', $content);
+    }
+
+    public function testUpdateThemesFilterSignatureAndResultHandling(): void
+    {
+        $update = self::source('wp-includes/update.php');
+        self::assertStringContainsString('$update = apply_filters( "update_themes_{$hostname}", false, $theme_data, $theme_stylesheet, $locales );', $update);
+        self::assertStringContainsString('if ( ! isset( $update->version ) ) {', $update);
+        self::assertStringContainsString('$update->new_version = $update->version;', $update);
+        self::assertStringContainsString('$new_update->response[ $theme_stylesheet ] = (array) $update;', $update);
+        self::assertStringContainsString('$new_update->no_update[ $theme_stylesheet ] = (array) $update;', $update);
+        self::assertSame(1, preg_match('/\'UpdateURI\'\s+=>\s*\$theme->get\( \'UpdateURI\' \),/', $update));
+    }
+
+    public function testThemeUpgradesCarryTheStylesheetInHookExtra(): void
+    {
+        $upgrader = self::source('wp-admin/includes/class-theme-upgrader.php');
+        // upgrade() (écran Thèmes sans AJAX, mises à jour automatiques) et bulk_upgrade() (Mises à jour, AJAX, WP-CLI).
+        self::assertSame(2, preg_match_all('/\'hook_extra\'\s*=>\s*array\(\s*\'theme\'\s*=>\s*\$theme,/', $upgrader));
+        // Téléversement d'un zip : pas de clé 'theme', paquet local.
+        self::assertSame(1, preg_match('/\'hook_extra\'\s*=>\s*array\(\s*\'type\'\s*=>\s*\'theme\',\s*\'action\'\s*=>\s*\'install\',\s*\)/', $upgrader));
+        self::assertSame(1, preg_match('/\'overwrite_package\'\s*=>\s*false,\s*\/\/ Do not overwrite files\./', $upgrader));
+    }
+
+    public function testPreDownloadFilterRunsBeforeTheLocalFileShortcut(): void
+    {
+        $base = self::source('wp-admin/includes/class-wp-upgrader.php');
+        $filter = strpos($base, "\$reply = apply_filters( 'upgrader_pre_download', false, \$package, \$this, \$hook_extra );");
+        $local = strpos($base, "if ( ! preg_match( '!^(http|https|ftp)://!i', \$package ) && file_exists( \$package ) ) { // Local file or remote?");
+        self::assertIsInt($filter);
+        self::assertIsInt($local);
+        self::assertLessThan($local, $filter);
+    }
+
+    public function testAutomaticUpdatesUpgradeTheThemeByItsStylesheet(): void
+    {
+        $auto = self::source('wp-admin/includes/class-wp-automatic-updater.php');
+        self::assertStringContainsString('$upgrader_item = $item->theme;', $auto);
+        self::assertStringContainsString('$upgrade_result = $upgrader->upgrade(', $auto);
+    }
+
+    public function testFrozenPluginClientRefusesEveryServerDownloadUrlOutsideAPluginUpdate(): void
+    {
+        // Raison de Config::PACKAGE_MARKER dans wawp-theme-updater.
+        $plugin = str_replace("\r", '', (string) file_get_contents(dirname(__DIR__, 2) . '/wawp-updater/src/class-updater.php'));
+        self::assertStringContainsString("0 !== strpos( \$package, Config::ENDPOINT . '/v1/download/' )", $plugin);
+        self::assertStringContainsString("return new \WP_Error( 'wawp_unknown_package'", $plugin);
+        self::assertStringContainsString("add_filter( 'upgrader_pre_download', array( \$this, 'filter_pre_download' ), 1, 4 );", $plugin);
+    }
+}

From 83ade9440e7af3649f1a427ac58e5e57db60ce71 Mon Sep 17 00:00:00 2001
From: thierrypigot <contact@wearewp.pro>
Date: Tue, 13 Oct 2026 13:58:07 +0200
Subject: [PATCH 02/12] =?UTF-8?q?wawp-theme-updater=20:=20configuration,?=
 =?UTF-8?q?=20copies=20contr=C3=B4l=C3=A9es=20de=20la=20signature=20et=20d?=
 =?UTF-8?q?u=20validateur,=20validation=20de=20la=20cl=C3=A9=20themes?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 phpcs.xml.dist                                |   6 +-
 phpstan.neon.dist                             |   1 +
 tests/Support/Http.php                        |  20 ++
 tests/Unit/SharedCodeTest.php                 |  48 +++++
 tests/Unit/ThemeValidatorTest.php             |  96 +++++++++
 tests/bootstrap.php                           |   7 +
 wawp-theme-updater/src/class-config.php       |  55 +++++
 wawp-theme-updater/src/class-signature.php    |  48 +++++
 .../src/class-theme-validator.php             |  79 +++++++
 wawp-theme-updater/src/class-validator.php    | 203 ++++++++++++++++++
 10 files changed, 562 insertions(+), 1 deletion(-)
 create mode 100644 tests/Unit/SharedCodeTest.php
 create mode 100644 tests/Unit/ThemeValidatorTest.php
 create mode 100644 wawp-theme-updater/src/class-config.php
 create mode 100644 wawp-theme-updater/src/class-signature.php
 create mode 100644 wawp-theme-updater/src/class-theme-validator.php
 create mode 100644 wawp-theme-updater/src/class-validator.php

diff --git a/phpcs.xml.dist b/phpcs.xml.dist
index aa3a56f..a31fa46 100644
--- a/phpcs.xml.dist
+++ b/phpcs.xml.dist
@@ -1,7 +1,8 @@
 <?xml version="1.0"?>
 <ruleset name="WAWP Updater">
-    <description>Standard WordPress et compatibilité PHP 7.4 pour la bibliothèque embarquée.</description>
+    <description>Standard WordPress et compatibilité PHP 7.4 pour les bibliothèques embarquées.</description>
     <file>wawp-updater</file>
+    <file>wawp-theme-updater</file>
     <arg name="extensions" value="php"/>
     <arg value="sp"/>
     <config name="testVersion" value="7.4-"/>
@@ -12,6 +13,7 @@
         <properties>
             <property name="text_domain" type="array">
                 <element value="wawp-updater"/>
+                <element value="wawp-theme-updater"/>
             </property>
         </properties>
     </rule>
@@ -20,6 +22,8 @@
             <property name="prefixes" type="array">
                 <element value="WAWP\Updater"/>
                 <element value="wawp_updater"/>
+                <element value="WAWP\ThemeUpdater"/>
+                <element value="wawp_theme_updater"/>
             </property>
         </properties>
     </rule>
diff --git a/phpstan.neon.dist b/phpstan.neon.dist
index bac3a86..07e9325 100644
--- a/phpstan.neon.dist
+++ b/phpstan.neon.dist
@@ -5,6 +5,7 @@ parameters:
     phpVersion: 70400
     paths:
         - wawp-updater
+        - wawp-theme-updater
         - scripts
         - bin
     bootstrapFiles:
diff --git a/tests/Support/Http.php b/tests/Support/Http.php
index d9a8391..24af99a 100644
--- a/tests/Support/Http.php
+++ b/tests/Support/Http.php
@@ -31,4 +31,24 @@ public static function offer(string $version, string $signature, string $token =
             'signature' => $signature,
         ];
     }
+
+    /** @param array<string, array<string, mixed>> $offers */
+    public static function theme_body(array $offers): string
+    {
+        return (string) json_encode(['themes' => (object) $offers], JSON_UNESCAPED_SLASHES);
+    }
+
+    /** @return array<string, mixed> Offre de thème au format de /v1/check (spec thèmes 5.2). */
+    public static function theme_offer(string $slug, string $version, string $signature, string $token = 'abc.def'): array
+    {
+        return [
+            'theme' => $slug,
+            'new_version' => $version,
+            'requires' => '6.1',
+            'requires_php' => '7.4',
+            'url' => 'https://www.wearewp.pro/',
+            'package' => 'https://updates.wearewp.pro/v1/download/' . $token,
+            'signature' => $signature,
+        ];
+    }
 }
diff --git a/tests/Unit/SharedCodeTest.php b/tests/Unit/SharedCodeTest.php
new file mode 100644
index 0000000..3713544
--- /dev/null
+++ b/tests/Unit/SharedCodeTest.php
@@ -0,0 +1,48 @@
+<?php
+
+declare(strict_types=1);
+
+namespace WAWP\ReleaseTools\Tests\Unit;
+
+use PHPUnit\Framework\Attributes\DataProvider;
+use PHPUnit\Framework\TestCase;
+
+/**
+ * Spec thèmes 6.6 : deux copies du code de sécurité, identiques à l'espace de noms près.
+ * wawp-updater/ fait foi et n'est jamais modifié.
+ */
+final class SharedCodeTest extends TestCase
+{
+    /** @return array<string, array{string}> */
+    public static function sharedFiles(): array
+    {
+        return [
+            'signature' => ['src/class-signature.php'],
+            'validateur' => ['src/class-validator.php'],
+        ];
+    }
+
+    #[DataProvider('sharedFiles')]
+    public function testThemeCopyIsIdenticalToThePluginOneExceptTheNamespace(string $file): void
+    {
+        $root = dirname(__DIR__, 2);
+        $plugin = (string) file_get_contents("$root/wawp-updater/$file");
+        $theme = (string) file_get_contents("$root/wawp-theme-updater/$file");
+        self::assertStringContainsString("\nnamespace WAWP\ThemeUpdater;\n", $theme);
+        self::assertStringNotContainsString('WAWP\Updater', $theme);
+        self::assertSame($plugin, str_replace('WAWP\ThemeUpdater', 'WAWP\Updater', $theme));
+    }
+
+    public function testSameServerAndSameSigningKeys(): void
+    {
+        self::assertSame(\WAWP\Updater\Config::PUBLIC_KEYS, \WAWP\ThemeUpdater\Config::PUBLIC_KEYS);
+        self::assertSame(\WAWP\Updater\Config::ENDPOINT, \WAWP\ThemeUpdater\Config::ENDPOINT);
+        self::assertSame(\WAWP\Updater\Config::HOST, \WAWP\ThemeUpdater\Config::HOST);
+    }
+
+    public function testThemeMarkerIsOutsideThePrefixInterceptedByThePluginClient(): void
+    {
+        self::assertStringStartsNotWith(\WAWP\Updater\Config::ENDPOINT . '/v1/download/', \WAWP\ThemeUpdater\Config::PACKAGE_MARKER);
+        self::assertStringStartsWith(\WAWP\ThemeUpdater\Config::ENDPOINT . '/', \WAWP\ThemeUpdater\Config::PACKAGE_MARKER);
+    }
+}
diff --git a/tests/Unit/ThemeValidatorTest.php b/tests/Unit/ThemeValidatorTest.php
new file mode 100644
index 0000000..92fd94f
--- /dev/null
+++ b/tests/Unit/ThemeValidatorTest.php
@@ -0,0 +1,96 @@
+<?php
+
+declare(strict_types=1);
+
+namespace WAWP\ReleaseTools\Tests\Unit;
+
+use PHPUnit\Framework\TestCase;
+use WAWP\ReleaseTools\Tests\Support\Http;
+use WAWP\ThemeUpdater\Config;
+use WAWP\ThemeUpdater\Theme_Validator;
+
+final class ThemeValidatorTest extends TestCase
+{
+    private const SLUG = 'wawp-demo-theme';
+
+    private static function signature(): string
+    {
+        return base64_encode(str_repeat('s', 64));
+    }
+
+    /** @param array<string, mixed> $changes */
+    private static function body(array $changes = []): string
+    {
+        return Http::theme_body([self::SLUG => $changes + Http::theme_offer(self::SLUG, '1.4.0', self::signature())]);
+    }
+
+    public function testConfigValues(): void
+    {
+        self::assertSame('1.0.0', Config::VERSION);
+        self::assertSame('updates.wearewp.pro', Config::HOST);
+        self::assertSame('https://updates.wearewp.pro', Config::ENDPOINT);
+        self::assertSame('https://updates.wearewp.pro/v1/theme-update/', Config::PACKAGE_MARKER);
+        self::assertSame('wawp_theme_updater_check', Config::CACHE_KEY);
+        self::assertNotSame(\WAWP\Updater\Config::CACHE_KEY, Config::CACHE_KEY);
+        self::assertSame(43200, Config::CACHE_TTL);
+        self::assertSame(3600, Config::ERROR_TTL);
+        self::assertSame(10, Config::TIMEOUT);
+        self::assertSame(300, Config::DOWNLOAD_TIMEOUT);
+    }
+
+    public function testValidCheckResponse(): void
+    {
+        self::assertSame(
+            [self::SLUG => [
+                'version' => '1.4.0',
+                'requires' => '6.1',
+                'requires_php' => '7.4',
+                'url' => 'https://www.wearewp.pro/',
+                'package' => 'https://updates.wearewp.pro/v1/download/abc.def',
+                'signature' => self::signature(),
+            ]],
+            Theme_Validator::check_response(self::body(), [self::SLUG])
+        );
+    }
+
+    public function testEmptyListsEmptyUrlAndNullRequirementsAreAccepted(): void
+    {
+        self::assertSame([], Theme_Validator::check_response('{"themes":{}}', [self::SLUG]));
+        self::assertSame([], Theme_Validator::check_response('{"themes":[]}', [self::SLUG]));
+        $offers = Theme_Validator::check_response(self::body(['url' => '', 'requires' => null, 'requires_php' => null]), [self::SLUG]);
+        self::assertNotNull($offers);
+        self::assertSame('', $offers[self::SLUG]['url']);
+        self::assertNull($offers[self::SLUG]['requires']);
+        self::assertNull($offers[self::SLUG]['requires_php']);
+    }
+
+    public function testAnyAnomalyRejectsTheWholeResponse(): void
+    {
+        $good = Http::theme_offer(self::SLUG, '1.4.0', self::signature());
+        $cases = [
+            'pas du JSON' => 'nope',
+            'réponse de plugins' => '{"plugins":{}}',
+            'thème non demandé' => Http::theme_body(['theme-intrus' => ['theme' => 'theme-intrus'] + $good]),
+            'champ theme différent de la clé' => self::body(['theme' => 'autre-theme']),
+            'champ theme absent' => Http::theme_body([self::SLUG => array_diff_key($good, ['theme' => true])]),
+            'version invalide' => self::body(['new_version' => '1.4.0-beta']),
+            'version absente' => Http::theme_body([self::SLUG => array_diff_key($good, ['new_version' => true])]),
+            'version numérique' => self::body(['new_version' => 1.4]),
+            'hôte de paquet étranger' => self::body(['package' => 'https://evil.example/v1/download/abc']),
+            'préfixe trompeur' => self::body(['package' => 'https://updates.wearewp.pro.evil.example/v1/download/abc']),
+            'chemin de paquet détourné' => self::body(['package' => 'https://updates.wearewp.pro/v1/download/../x']),
+            'marqueur au lieu d\'un jeton' => self::body(['package' => 'https://updates.wearewp.pro/v1/theme-update/wawp-demo-theme']),
+            'signature trop courte' => self::body(['signature' => base64_encode('court')]),
+            'requires invalide' => self::body(['requires' => 'latest']),
+            'url javascript' => self::body(['url' => 'javascript:alert(1)']),
+            'url avec espace' => self::body(['url' => 'https://www.wearewp.pro/a b']),
+            'url avec chevron' => self::body(['url' => 'https://www.wearewp.pro/<script>']),
+            'url non texte' => self::body(['url' => 42]),
+            'url absente' => Http::theme_body([self::SLUG => array_diff_key($good, ['url' => true])]),
+            'corps trop volumineux' => '{"themes":{},"x":"' . str_repeat('a', 1048577) . '"}',
+        ];
+        foreach ($cases as $label => $body) {
+            self::assertNull(Theme_Validator::check_response($body, [self::SLUG]), $label);
+        }
+    }
+}
diff --git a/tests/bootstrap.php b/tests/bootstrap.php
index 043eedd..8af3bc3 100644
--- a/tests/bootstrap.php
+++ b/tests/bootstrap.php
@@ -11,3 +11,10 @@
         require_once $file;
     }
 }
+
+foreach (['config', 'validator', 'theme-validator', 'signature', 'client', 'package', 'updater'] as $class) {
+    $file = dirname(__DIR__) . "/wawp-theme-updater/src/class-$class.php";
+    if (is_file($file)) {
+        require_once $file;
+    }
+}
diff --git a/wawp-theme-updater/src/class-config.php b/wawp-theme-updater/src/class-config.php
new file mode 100644
index 0000000..1083748
--- /dev/null
+++ b/wawp-theme-updater/src/class-config.php
@@ -0,0 +1,55 @@
+<?php
+/**
+ * Configuration du client de mise à jour des thèmes WeAre[WP].
+ *
+ * @package WAWP\ThemeUpdater
+ */
+
+namespace WAWP\ThemeUpdater;
+
+defined( 'ABSPATH' ) || exit;
+
+/**
+ * Valeurs fixes du client. Elles ne changent qu'avec une nouvelle version de la bibliothèque.
+ */
+final class Config {
+
+	/** Version de la bibliothèque. */
+	const VERSION = '1.0.0';
+
+	/** Hôte de l'en-tête Update URI des thèmes WeAre[WP]. */
+	const HOST = 'updates.wearewp.pro';
+
+	/** Adresse du serveur de mises à jour. */
+	const ENDPOINT = 'https://updates.wearewp.pro';
+
+	/**
+	 * Préfixe de l'adresse de paquet confiée au cache de WordPress (suivi du slug). Ce n'est pas une adresse de
+	 * téléchargement : le vrai paquet est demandé avec un jeton frais au moment de l'installation. Elle ne doit
+	 * jamais commencer par ENDPOINT . '/v1/download/', préfixe que wawp-updater 1.0.0 (plugins) intercepte et
+	 * refuse hors d'une mise à jour de plugin.
+	 */
+	const PACKAGE_MARKER = self::ENDPOINT . '/v1/theme-update/';
+
+	/**
+	 * Clés publiques Ed25519 en base64 : clé active, puis clé de secours. Identiques à celles de wawp-updater.
+	 *
+	 * @var list<string>
+	 */
+	const PUBLIC_KEYS = array( 'LHRLyVYY0wTP/uuvzX/VVI0KVdfncIXAnZ/UIPu/xN4=', 'fW/d3eKzXpvuKKeOQEC/RevDVr91YOmgBRXlGVh8e50=' );
+
+	/** Cache de la réponse /v1/check (transient de site), distinct de celui des plugins. */
+	const CACHE_KEY = 'wawp_theme_updater_check';
+
+	/** Durée du cache après succès (12 h). */
+	const CACHE_TTL = 43200;
+
+	/** Durée du cache après échec ou refus (1 h), pour ne pas inonder le serveur. */
+	const ERROR_TTL = 3600;
+
+	/** Délai réseau des appels à l'API. */
+	const TIMEOUT = 10;
+
+	/** Délai de téléchargement d'un paquet. */
+	const DOWNLOAD_TIMEOUT = 300;
+}
diff --git a/wawp-theme-updater/src/class-signature.php b/wawp-theme-updater/src/class-signature.php
new file mode 100644
index 0000000..10f6394
--- /dev/null
+++ b/wawp-theme-updater/src/class-signature.php
@@ -0,0 +1,48 @@
+<?php
+/**
+ * Vérification des signatures Ed25519 des paquets.
+ *
+ * @package WAWP\ThemeUpdater
+ */
+
+namespace WAWP\ThemeUpdater;
+
+defined( 'ABSPATH' ) || exit;
+
+/**
+ * Même mécanisme que WordPress pour ses propres paquets : Ed25519 détachée sur le SHA-384 binaire du fichier.
+ */
+final class Signature {
+
+	/**
+	 * @param string   $path            Fichier téléchargé.
+	 * @param string   $signature_b64   Signature en base64.
+	 * @param string[] $public_keys_b64 Clés publiques en base64.
+	 */
+	public static function verify_file( string $path, string $signature_b64, array $public_keys_b64 ): bool {
+		$signature = base64_decode( trim( $signature_b64 ), true ); // phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions.obfuscation_base64_decode -- signature binaire.
+		if ( false === $signature || 64 !== strlen( $signature ) || ! is_file( $path ) ) {
+			return false;
+		}
+		$digest = hash_file( 'sha384', $path, true );
+		if ( false === $digest ) {
+			return false;
+		}
+
+		foreach ( $public_keys_b64 as $public_key_b64 ) {
+			$public_key = base64_decode( (string) $public_key_b64, true ); // phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions.obfuscation_base64_decode -- clé publique binaire.
+			if ( false === $public_key || 32 !== strlen( $public_key ) ) {
+				continue;
+			}
+			try {
+				if ( sodium_crypto_sign_verify_detached( $signature, $digest, $public_key ) ) {
+					return true;
+				}
+			} catch ( \Throwable $e ) {
+				continue;
+			}
+		}
+
+		return false;
+	}
+}
diff --git a/wawp-theme-updater/src/class-theme-validator.php b/wawp-theme-updater/src/class-theme-validator.php
new file mode 100644
index 0000000..a480143
--- /dev/null
+++ b/wawp-theme-updater/src/class-theme-validator.php
@@ -0,0 +1,79 @@
+<?php
+/**
+ * Validation stricte de la réponse /v1/check pour les thèmes.
+ *
+ * @package WAWP\ThemeUpdater
+ */
+
+namespace WAWP\ThemeUpdater;
+
+defined( 'ABSPATH' ) || exit;
+
+/**
+ * Contrôle ce qui est propre aux thèmes (clé « themes », champ « theme », adresse « url »), puis délègue tous les
+ * contrôles communs (version, adresse de paquet, signature, versions requises) à Validator, copie conforme de celle
+ * de wawp-updater. La moindre anomalie fait rejeter la réponse entière.
+ */
+final class Theme_Validator {
+
+	/** Adresse du thème (Theme URI) : http ou https, sans espace, guillemet, chevron, barre oblique inverse ni caractère de contrôle. */
+	const URL = '/^https?:\/\/[^\s"<>\\\\\p{Cc}]{1,2040}\z/u';
+
+	/**
+	 * Valide le corps d'une réponse /v1/check limitée aux thèmes.
+	 *
+	 * @param mixed    $body           Corps brut.
+	 * @param string[] $expected_slugs Slugs envoyés au serveur.
+	 * @return array<string, array{version: string, requires: ?string, requires_php: ?string, url: string, package: string, signature: string}>|null
+	 */
+	public static function check_response( $body, array $expected_slugs ): ?array {
+		if ( ! is_string( $body ) || strlen( $body ) > Validator::MAX_BODY ) {
+			return null;
+		}
+		$data = json_decode( $body, true, 8 );
+		if ( ! is_array( $data ) || ! isset( $data['themes'] ) || ! is_array( $data['themes'] ) ) {
+			return null;
+		}
+
+		$plugins = array();
+		$urls    = array();
+		foreach ( $data['themes'] as $slug => $offer ) {
+			$slug = (string) $slug;
+			if ( ! Validator::is_slug( $slug ) || ! in_array( $slug, $expected_slugs, true ) || ! is_array( $offer ) ) {
+				return null;
+			}
+			$url = $offer['url'] ?? null;
+			if ( ( $offer['theme'] ?? null ) !== $slug || ! is_string( $url ) || ( '' !== $url && 1 !== preg_match( self::URL, $url ) ) ) {
+				return null;
+			}
+			$plugins[ $slug ] = array(
+				'version'      => $offer['new_version'] ?? null,
+				'requires'     => $offer['requires'] ?? null,
+				'requires_php' => $offer['requires_php'] ?? null,
+				'package'      => $offer['package'] ?? null,
+				'signature'    => $offer['signature'] ?? null,
+			);
+			$urls[ $slug ]    = $url;
+		}
+
+		// Contrôles communs avec les plugins, sur la même structure que leur réponse.
+		$checked = Validator::check_response( (string) wp_json_encode( array( 'plugins' => (object) $plugins ) ), $expected_slugs );
+		if ( null === $checked ) {
+			return null;
+		}
+
+		$offers = array();
+		foreach ( $checked as $slug => $offer ) {
+			$offers[ $slug ] = array(
+				'version'      => $offer['version'],
+				'requires'     => $offer['requires'],
+				'requires_php' => $offer['requires_php'],
+				'url'          => $urls[ $slug ] ?? '',
+				'package'      => $offer['package'],
+				'signature'    => $offer['signature'],
+			);
+		}
+
+		return $offers;
+	}
+}
diff --git a/wawp-theme-updater/src/class-validator.php b/wawp-theme-updater/src/class-validator.php
new file mode 100644
index 0000000..9d3ce7f
--- /dev/null
+++ b/wawp-theme-updater/src/class-validator.php
@@ -0,0 +1,203 @@
+<?php
+/**
+ * Validation stricte des valeurs reçues du serveur et de la configuration.
+ *
+ * @package WAWP\ThemeUpdater
+ */
+
+namespace WAWP\ThemeUpdater;
+
+defined( 'ABSPATH' ) || exit;
+
+/**
+ * Toute réponse du serveur est traitée comme non fiable : la moindre anomalie la fait rejeter entièrement.
+ */
+final class Validator {
+
+	const SLUG              = '/^[a-z0-9-]{1,64}\z/';
+	const VERSION           = '/^\d{1,5}(?:\.\d{1,5}){1,3}\z/';
+	const INSTALLED_VERSION = '/^[0-9A-Za-z.+-]{1,32}\z/';
+	const KEY               = '/^wawp_[A-Za-z0-9_-]{43}\z/';
+	const DATE              = '/^\d{4}-\d{2}-\d{2}\z/';
+	const TOKEN             = '/^[A-Za-z0-9_.-]{1,512}\z/';
+	const NAME              = '/^[^\p{Cc}]{1,200}\z/u';
+	const MAX_BODY          = 1048576;
+	const MAX_SECTION       = 262144;
+
+	/**
+	 * @param mixed $value Valeur à tester.
+	 * @phpstan-assert-if-true string $value
+	 */
+	public static function is_key( $value ): bool {
+		return self::matches( self::KEY, $value );
+	}
+
+	/**
+	 * @param mixed $value Valeur à tester.
+	 */
+	public static function is_slug( $value ): bool {
+		return self::matches( self::SLUG, $value );
+	}
+
+	/**
+	 * @param mixed $value Valeur à tester.
+	 */
+	public static function is_installed_version( $value ): bool {
+		return self::matches( self::INSTALLED_VERSION, $value );
+	}
+
+	/**
+	 * Valide le corps d'une réponse /v1/check.
+	 *
+	 * @param mixed    $body           Corps brut.
+	 * @param string[] $expected_slugs Slugs envoyés au serveur.
+	 * @return array<string, array{version: string, requires: ?string, tested: ?string, requires_php: ?string, last_updated: ?string, package: string, signature: string}>|null
+	 */
+	public static function check_response( $body, array $expected_slugs ): ?array {
+		$data = self::decode( $body );
+		if ( null === $data || ! isset( $data['plugins'] ) || ! is_array( $data['plugins'] ) ) {
+			return null;
+		}
+
+		$offers = array();
+		foreach ( $data['plugins'] as $slug => $offer ) {
+			$slug = (string) $slug;
+			if ( ! self::is_slug( $slug ) || ! in_array( $slug, $expected_slugs, true ) || ! is_array( $offer ) ) {
+				return null;
+			}
+			$version      = $offer['version'] ?? null;
+			$package      = $offer['package'] ?? null;
+			$signature    = $offer['signature'] ?? null;
+			$requires     = $offer['requires'] ?? null;
+			$tested       = $offer['tested'] ?? null;
+			$requires_php = $offer['requires_php'] ?? null;
+			$last_updated = $offer['last_updated'] ?? null;
+			if ( ! self::matches( self::VERSION, $version )
+				|| ! self::is_package_url( $package )
+				|| ! self::is_signature( $signature )
+				|| ! self::optional( self::VERSION, $requires )
+				|| ! self::optional( self::VERSION, $tested )
+				|| ! self::optional( self::VERSION, $requires_php )
+				|| ! self::optional( self::DATE, $last_updated ) ) {
+				return null;
+			}
+			$offers[ $slug ] = array(
+				'version'      => $version,
+				'requires'     => $requires,
+				'tested'       => $tested,
+				'requires_php' => $requires_php,
+				'last_updated' => $last_updated,
+				'package'      => $package,
+				'signature'    => $signature,
+			);
+		}
+
+		return $offers;
+	}
+
+	/**
+	 * Valide le corps d'une réponse /v1/info.
+	 *
+	 * @param mixed  $body Corps brut.
+	 * @param string $slug Slug demandé.
+	 * @return array{name: string, slug: string, version: string, requires: ?string, tested: ?string, requires_php: ?string, last_updated: ?string, sections: array{description: string, changelog: string}}|null
+	 */
+	public static function info_response( $body, string $slug ): ?array {
+		$data = self::decode( $body );
+		if ( null === $data ) {
+			return null;
+		}
+		$name         = $data['name'] ?? null;
+		$version      = $data['version'] ?? null;
+		$requires     = $data['requires'] ?? null;
+		$tested       = $data['tested'] ?? null;
+		$requires_php = $data['requires_php'] ?? null;
+		$last_updated = $data['last_updated'] ?? null;
+		$sections     = $data['sections'] ?? null;
+		if ( ! self::matches( self::NAME, $name )
+			|| ( $data['slug'] ?? null ) !== $slug
+			|| ! self::matches( self::VERSION, $version )
+			|| ! self::optional( self::VERSION, $requires )
+			|| ! self::optional( self::VERSION, $tested )
+			|| ! self::optional( self::VERSION, $requires_php )
+			|| ! self::optional( self::DATE, $last_updated )
+			|| ! is_array( $sections ) ) {
+			return null;
+		}
+		$description = $sections['description'] ?? null;
+		$changelog   = $sections['changelog'] ?? null;
+		if ( ! is_string( $description ) || ! is_string( $changelog ) || strlen( $description ) > self::MAX_SECTION || strlen( $changelog ) > self::MAX_SECTION ) {
+			return null;
+		}
+
+		return array(
+			'name'         => $name,
+			'slug'         => $slug,
+			'version'      => $version,
+			'requires'     => $requires,
+			'tested'       => $tested,
+			'requires_php' => $requires_php,
+			'last_updated' => $last_updated,
+			'sections'     => array(
+				'description' => $description,
+				'changelog'   => $changelog,
+			),
+		);
+	}
+
+	/**
+	 * @param mixed $body Corps brut.
+	 * @return array<mixed>|null
+	 */
+	private static function decode( $body ): ?array {
+		if ( ! is_string( $body ) || strlen( $body ) > self::MAX_BODY ) {
+			return null;
+		}
+		$data = json_decode( $body, true, 8 );
+
+		return is_array( $data ) ? $data : null;
+	}
+
+	/**
+	 * @param mixed $value Valeur à tester.
+	 * @phpstan-assert-if-true string $value
+	 */
+	private static function is_package_url( $value ): bool {
+		$prefix = Config::ENDPOINT . '/v1/download/';
+
+		return is_string( $value )
+			&& 0 === strpos( $value, $prefix )
+			&& 1 === preg_match( self::TOKEN, (string) substr( $value, strlen( $prefix ) ) );
+	}
+
+	/**
+	 * @param mixed $value Valeur à tester.
+	 * @phpstan-assert-if-true string $value
+	 */
+	private static function is_signature( $value ): bool {
+		if ( ! is_string( $value ) ) {
+			return false;
+		}
+		$raw = base64_decode( $value, true ); // phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions.obfuscation_base64_decode -- décodage d'une signature binaire.
+
+		return false !== $raw && 64 === strlen( $raw );
+	}
+
+	/**
+	 * @param string $pattern Motif.
+	 * @param mixed  $value   Valeur à tester.
+	 * @phpstan-assert-if-true string|null $value
+	 */
+	private static function optional( string $pattern, $value ): bool {
+		return null === $value || self::matches( $pattern, $value );
+	}
+
+	/**
+	 * @param string $pattern Motif.
+	 * @param mixed  $value   Valeur à tester.
+	 * @phpstan-assert-if-true string $value
+	 */
+	private static function matches( string $pattern, $value ): bool {
+		return is_string( $value ) && 1 === preg_match( $pattern, $value );
+	}
+}

From f08b6ddc0bd20c1b505f7dcd902d1e054b7de133 Mon Sep 17 00:00:00 2001
From: thierrypigot <contact@wearewp.pro>
Date: Tue, 13 Oct 2026 14:01:18 +0200
Subject: [PATCH 03/12] =?UTF-8?q?wawp-theme-updater=20:=20appel=20/v1/chec?=
 =?UTF-8?q?k=20limit=C3=A9=20au=20th=C3=A8me,=20statut=20HTTP=20rendu?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 tests/Unit/ThemeClientTest.php          | 65 +++++++++++++++++++++++
 wawp-theme-updater/src/class-client.php | 68 +++++++++++++++++++++++++
 2 files changed, 133 insertions(+)
 create mode 100644 tests/Unit/ThemeClientTest.php
 create mode 100644 wawp-theme-updater/src/class-client.php

diff --git a/tests/Unit/ThemeClientTest.php b/tests/Unit/ThemeClientTest.php
new file mode 100644
index 0000000..97354e6
--- /dev/null
+++ b/tests/Unit/ThemeClientTest.php
@@ -0,0 +1,65 @@
+<?php
+
+declare(strict_types=1);
+
+namespace WAWP\ReleaseTools\Tests\Unit;
+
+use PHPUnit\Framework\TestCase;
+use WAWP\ReleaseTools\Tests\Support\Http;
+use WAWP\ThemeUpdater\Client;
+use WawpTestState;
+use WP_Error;
+
+final class ThemeClientTest extends TestCase
+{
+    private const KEY = 'wawp_AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA';
+
+    protected function setUp(): void
+    {
+        WawpTestState::reset();
+    }
+
+    public function testCheckSendsOnlyTheThemeAndValidatesTheAnswer(): void
+    {
+        $signature = base64_encode(str_repeat('s', 64));
+        WawpTestState::$http = static fn (): array => Http::response(200, Http::theme_body(['wawp-demo-theme' => Http::theme_offer('wawp-demo-theme', '1.4.0', $signature)]));
+
+        $result = (new Client())->check(self::KEY, 'https://client.fr', ['wawp-demo-theme' => '1.3.0']);
+
+        self::assertSame(200, $result['status']);
+        self::assertNotNull($result['offers']);
+        self::assertSame('1.4.0', $result['offers']['wawp-demo-theme']['version']);
+        self::assertSame('https://www.wearewp.pro/', $result['offers']['wawp-demo-theme']['url']);
+        [$method, $url, $args] = WawpTestState::$requests[0];
+        self::assertSame('POST', $method);
+        self::assertSame('https://updates.wearewp.pro/v1/check', $url);
+        self::assertSame('Bearer ' . self::KEY, $args['headers']['Authorization']);
+        self::assertSame('application/json', $args['headers']['Content-Type']);
+        self::assertSame(10, $args['timeout']);
+        self::assertSame(0, $args['redirection']);
+        self::assertTrue($args['sslverify']);
+        self::assertSame(
+            ['site' => 'https://client.fr', 'themes' => ['wawp-demo-theme' => '1.3.0'], 'wp' => '6.8.1', 'php' => PHP_VERSION, 'client' => '1.0.0'],
+            json_decode($args['body'], true)
+        );
+        self::assertStringStartsWith('wawp-theme-updater/1.0.0; ', $args['user-agent']);
+        self::assertStringNotContainsString(self::KEY, $args['user-agent']);
+    }
+
+    public function testStatusIsReportedAndOffersAreNullOnFailure(): void
+    {
+        $cases = [
+            'réseau' => [static fn () => new WP_Error('http_request_failed', 'timeout'), 0],
+            'licence refusée' => [static fn (): array => Http::response(401, '{"status":"unauthorized"}'), 401],
+            'serveur indisponible' => [static fn (): array => Http::response(503, '{"status":"unavailable"}'), 503],
+            'réponse invalide' => [static fn (): array => Http::response(200, 'pas du JSON'), 200],
+            'réponse de plugins' => [static fn (): array => Http::response(200, '{"plugins":{}}'), 200],
+        ];
+        foreach ($cases as $label => [$http, $status]) {
+            WawpTestState::$http = $http;
+            $result = (new Client())->check(self::KEY, 'https://client.fr', ['wawp-demo-theme' => '1.3.0']);
+            self::assertSame($status, $result['status'], $label);
+            self::assertNull($result['offers'], $label);
+        }
+    }
+}
diff --git a/wawp-theme-updater/src/class-client.php b/wawp-theme-updater/src/class-client.php
new file mode 100644
index 0000000..8c0327a
--- /dev/null
+++ b/wawp-theme-updater/src/class-client.php
@@ -0,0 +1,68 @@
+<?php
+/**
+ * Appel HTTP au serveur de mises à jour pour le thème actif.
+ *
+ * @package WAWP\ThemeUpdater
+ */
+
+namespace WAWP\ThemeUpdater;
+
+defined( 'ABSPATH' ) || exit;
+
+/**
+ * Seules les fonctions HTTP « safe » de WordPress sont utilisées, sans redirection, TLS vérifié.
+ */
+final class Client {
+
+	/**
+	 * Interroge /v1/check pour le thème inscrit. Le statut HTTP est rendu pour distinguer un refus de licence (401)
+	 * d'une panne.
+	 *
+	 * @param string                $key       Clé de licence.
+	 * @param string                $site      Adresse du site.
+	 * @param array<string, string> $installed Slug vers version installée.
+	 * @return array{status: int, offers: array<string, array{version: string, requires: ?string, requires_php: ?string, url: string, package: string, signature: string}>|null}
+	 */
+	public function check( string $key, string $site, array $installed ): array {
+		$response = wp_safe_remote_post(
+			Config::ENDPOINT . '/v1/check',
+			array(
+				'timeout'     => Config::TIMEOUT,
+				'redirection' => 0,
+				'sslverify'   => true,
+				'user-agent'  => 'wawp-theme-updater/' . Config::VERSION . '; ' . $site,
+				'headers'     => array(
+					'Authorization' => 'Bearer ' . $key,
+					'Content-Type'  => 'application/json',
+				),
+				'body'        => (string) wp_json_encode(
+					array(
+						'site'   => $site,
+						'themes' => (object) $installed,
+						'wp'     => (string) get_bloginfo( 'version' ),
+						'php'    => PHP_VERSION,
+						'client' => Config::VERSION,
+					)
+				),
+			)
+		);
+		if ( is_wp_error( $response ) ) {
+			return array(
+				'status' => 0,
+				'offers' => null,
+			);
+		}
+		$status = (int) wp_remote_retrieve_response_code( $response );
+		if ( 200 !== $status ) {
+			return array(
+				'status' => $status,
+				'offers' => null,
+			);
+		}
+
+		return array(
+			'status' => 200,
+			'offers' => Theme_Validator::check_response( wp_remote_retrieve_body( $response ), array_map( 'strval', array_keys( $installed ) ) ),
+		);
+	}
+}

From 5c1db38014078a20e55fd758b5433b51b5f670da Mon Sep 17 00:00:00 2001
From: thierrypigot <contact@wearewp.pro>
Date: Tue, 13 Oct 2026 14:04:09 +0200
Subject: [PATCH 04/12] =?UTF-8?q?wawp-theme-updater=20:=20contr=C3=B4le=20?=
 =?UTF-8?q?du=20paquet=20(style.css,=20dossier=20unique,=20entr=C3=A9es=20?=
 =?UTF-8?q?en=20double=20ou=20pi=C3=A9g=C3=A9es=20refus=C3=A9es)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 tests/Unit/SharedCodeTest.php            |  29 +++++
 tests/Unit/ThemePackageTest.php          | 140 +++++++++++++++++++++
 wawp-theme-updater/src/class-package.php | 152 +++++++++++++++++++++++
 3 files changed, 321 insertions(+)
 create mode 100644 tests/Unit/ThemePackageTest.php
 create mode 100644 wawp-theme-updater/src/class-package.php

diff --git a/tests/Unit/SharedCodeTest.php b/tests/Unit/SharedCodeTest.php
index 3713544..031f6a9 100644
--- a/tests/Unit/SharedCodeTest.php
+++ b/tests/Unit/SharedCodeTest.php
@@ -33,6 +33,35 @@ public function testThemeCopyIsIdenticalToThePluginOneExceptTheNamespace(string
         self::assertSame($plugin, str_replace('WAWP\ThemeUpdater', 'WAWP\Updater', $theme));
     }
 
+    /** @return array<string, array{string}> */
+    public static function sharedMethods(): array
+    {
+        return [
+            'read' => ['read'],
+            'call' => ['call'],
+            'header' => ['header'],
+        ];
+    }
+
+    /** Corps d'une méthode : de sa signature à l'accolade fermante de même indentation. */
+    private static function methodBody(string $source, string $method): string
+    {
+        $found = preg_match('/^\tprivate static function ' . $method . '\(.*?^\t}$/ms', $source, $match);
+        self::assertSame(1, $found, "méthode $method introuvable");
+
+        return $match[0];
+    }
+
+    /** Troisième copie partagée : les méthodes read(), call() et header() de Package. */
+    #[DataProvider('sharedMethods')]
+    public function testPackageHelperMethodBodiesAreIdenticalInBothUpdaters(string $method): void
+    {
+        $root = dirname(__DIR__, 2);
+        $plugin = self::methodBody((string) file_get_contents("$root/wawp-updater/src/class-package.php"), $method);
+        $theme = self::methodBody((string) file_get_contents("$root/wawp-theme-updater/src/class-package.php"), $method);
+        self::assertSame($plugin, $theme);
+    }
+
     public function testSameServerAndSameSigningKeys(): void
     {
         self::assertSame(\WAWP\Updater\Config::PUBLIC_KEYS, \WAWP\ThemeUpdater\Config::PUBLIC_KEYS);
diff --git a/tests/Unit/ThemePackageTest.php b/tests/Unit/ThemePackageTest.php
new file mode 100644
index 0000000..64f3dd8
--- /dev/null
+++ b/tests/Unit/ThemePackageTest.php
@@ -0,0 +1,140 @@
+<?php
+
+declare(strict_types=1);
+
+namespace WAWP\ReleaseTools\Tests\Unit;
+
+use PHPUnit\Framework\TestCase;
+use WAWP\ThemeUpdater\Package;
+
+final class ThemePackageTest extends TestCase
+{
+    private const SLUG = 'wawp-demo-theme';
+
+    private string $dir;
+
+    protected function setUp(): void
+    {
+        $this->dir = sys_get_temp_dir() . '/wawp-theme-package-' . bin2hex(random_bytes(4));
+        mkdir($this->dir, 0777, true);
+    }
+
+    protected function tearDown(): void
+    {
+        $it = new \RecursiveIteratorIterator(new \RecursiveDirectoryIterator($this->dir, \FilesystemIterator::SKIP_DOTS), \RecursiveIteratorIterator::CHILD_FIRST);
+        foreach ($it as $file) {
+            $file->isDir() ? rmdir($file->getPathname()) : unlink($file->getPathname());
+        }
+        rmdir($this->dir);
+    }
+
+    public static function style(string $version, string $slug = self::SLUG, string $eol = "\n"): string
+    {
+        return str_replace("\n", $eol, "/*\nTheme Name: WAWP Démo\nVersion: $version\nRequires at least: 6.1\nRequires PHP: 7.4\nText Domain: $slug\nUpdate URI: https://updates.wearewp.pro\n*/\n");
+    }
+
+    /** @return array<string, string> */
+    public static function entries(string $slug, string $version): array
+    {
+        return [
+            "$slug/" => '',
+            "$slug/style.css" => self::style($version, $slug),
+            "$slug/functions.php" => "<?php\n",
+            "$slug/templates/index.html" => "<!-- wp:post-content /-->\n",
+            "$slug/wawp-theme-updater/load.php" => '<?php',
+        ];
+    }
+
+    public function testConformingPackageMatches(): void
+    {
+        self::assertTrue(Package::matches(PackageTest::zip("{$this->dir}/a.zip", self::entries(self::SLUG, '1.4.0')), self::SLUG, '1.4.0'));
+        self::assertTrue(Package::matches(PackageTest::zip("{$this->dir}/b.zip", [self::SLUG . '/style.css' => self::style('1.4.0', self::SLUG, "\r\n")]), self::SLUG, '1.4.0'), 'fin de ligne CRLF');
+    }
+
+    public function testEachMismatchIsRefused(): void
+    {
+        $valid = self::entries(self::SLUG, '1.4.0');
+        $cases = [
+            'autre version' => [self::entries(self::SLUG, '1.3.5'), self::SLUG, '1.4.0'],
+            'autre slug' => [$valid, 'theme-autre', '1.4.0'],
+            'entrée hors du dossier' => [$valid + ['autre/x.php' => '<?php'], self::SLUG, '1.4.0'],
+            'préfixe trompeur' => [$valid + ['wawp-demo-themex/x.php' => '<?php'], self::SLUG, '1.4.0'],
+            'segment ..' => [$valid + ['wawp-demo-theme/../x.php' => '<?php'], self::SLUG, '1.4.0'],
+            'segment .' => [$valid + ['wawp-demo-theme/./x.php' => '<?php'], self::SLUG, '1.4.0'],
+            'casse en double' => [$valid + ['wawp-demo-theme/Functions.php' => '<?php'], self::SLUG, '1.4.0'],
+            'style.css absent' => [[self::SLUG . '/functions.php' => '<?php'], self::SLUG, '1.4.0'],
+            'style.css sans Version' => [[self::SLUG . '/style.css' => "body { color: red; }\n"], self::SLUG, '1.4.0'],
+            'en-tête au-delà de 8 Ko' => [[self::SLUG . '/style.css' => '/*' . str_repeat("remplissage\n", 700) . '*/' . self::style('1.4.0')], self::SLUG, '1.4.0'],
+            'slug invalide' => [$valid, '../wawp-demo-theme', '1.4.0'],
+            'version vide' => [$valid, self::SLUG, ''],
+        ];
+        $i = 0;
+        foreach ($cases as $label => [$entries, $slug, $version]) {
+            $zip = PackageTest::zip("{$this->dir}/c" . $i++ . '.zip', $entries);
+            self::assertFalse(Package::matches($zip, $slug, $version), $label);
+        }
+    }
+
+    public function testDuplicateEntryIsRefused(): void
+    {
+        // Deux entrées « style.css » : à l'extraction, la seconde (9.9.9) écraserait celle qui a été contrôlée.
+        $zip = PackageTest::zip("{$this->dir}/d.zip", self::entries(self::SLUG, '1.4.0') + [self::SLUG . '/style.csz' => self::style('9.9.9')]);
+        file_put_contents($zip, str_replace(self::SLUG . '/style.csz', self::SLUG . '/style.css', (string) file_get_contents($zip)));
+        $archive = new \ZipArchive();
+        self::assertTrue($archive->open($zip), 'archive toujours lisible');
+        $archive->close();
+
+        self::assertFalse(Package::matches($zip, self::SLUG, '1.4.0'));
+    }
+
+    public function testUnreadableArchiveIsRefused(): void
+    {
+        file_put_contents("{$this->dir}/faux.zip", random_bytes(512));
+        self::assertFalse(Package::matches("{$this->dir}/faux.zip", self::SLUG, '1.4.0'));
+        self::assertFalse(Package::matches("{$this->dir}/absent.zip", self::SLUG, '1.4.0'));
+    }
+
+    /** Sous-processus sans php.ini (php -n) : ZipArchive indisponible. */
+    private function withoutZipArchive(string $abspath, string $zip, string $version): string
+    {
+        $src = dirname(__DIR__, 2) . '/wawp-theme-updater/src';
+        $code = 'define("ABSPATH", ' . var_export($abspath, true) . ');'
+            . 'require ' . var_export("$src/class-config.php", true) . ';'
+            . 'require ' . var_export("$src/class-validator.php", true) . ';'
+            . 'require ' . var_export("$src/class-package.php", true) . ';'
+            . 'echo class_exists("ZipArchive", false) ? "zip:" : "", var_export(\WAWP\ThemeUpdater\Package::matches(' . var_export($zip, true) . ', "wawp-demo-theme", ' . var_export($version, true) . '), true);';
+        $process = proc_open([PHP_BINARY, '-n', '-r', $code], [1 => ['pipe', 'w'], 2 => ['pipe', 'w']], $pipes);
+        self::assertIsResource($process);
+        $out = (string) stream_get_contents($pipes[1]) . (string) stream_get_contents($pipes[2]);
+        fclose($pipes[1]);
+        fclose($pipes[2]);
+        proc_close($process);
+
+        return $out;
+    }
+
+    public function testWithoutZipArchiveNorPclZipThePackageIsRefused(): void
+    {
+        $zip = PackageTest::zip("{$this->dir}/a.zip", self::entries(self::SLUG, '1.4.0'));
+        self::assertSame('false', $this->withoutZipArchive($this->dir . '/', $zip, '1.4.0'));
+    }
+
+    public function testPclZipFromCoreIsUsedWhenZipArchiveIsMissing(): void
+    {
+        $wordpress = dirname(__DIR__) . '/e2e/cache/wordpress-' . json_decode((string) file_get_contents(dirname(__DIR__) . '/e2e/versions.json'), true)['wordpress']['version'] . '.zip';
+        if (!is_file($wordpress)) {
+            self::markTestSkipped('Archive WordPress absente du cache e2e (lancer composer e2e une fois).');
+        }
+        $core = new \ZipArchive();
+        $core->open($wordpress);
+        mkdir("{$this->dir}/wp/wp-admin/includes", 0777, true);
+        file_put_contents("{$this->dir}/wp/wp-admin/includes/class-pclzip.php", (string) $core->getFromName('wordpress/wp-admin/includes/class-pclzip.php'));
+        $core->close();
+
+        $zip = PackageTest::zip("{$this->dir}/a.zip", self::entries(self::SLUG, '1.4.0'));
+        self::assertSame('true', $this->withoutZipArchive("{$this->dir}/wp/", $zip, '1.4.0'));
+        self::assertSame('false', $this->withoutZipArchive("{$this->dir}/wp/", $zip, '1.5.0'));
+        $foreign = PackageTest::zip("{$this->dir}/b.zip", self::entries(self::SLUG, '1.4.0') + ['autre/x.php' => '<?php']);
+        self::assertSame('false', $this->withoutZipArchive("{$this->dir}/wp/", $foreign, '1.4.0'));
+    }
+}
diff --git a/wawp-theme-updater/src/class-package.php b/wawp-theme-updater/src/class-package.php
new file mode 100644
index 0000000..15edfa4
--- /dev/null
+++ b/wawp-theme-updater/src/class-package.php
@@ -0,0 +1,152 @@
+<?php
+/**
+ * Contrôle du contenu d'un paquet de thème téléchargé.
+ *
+ * Les méthodes read(), call() et header() sont une troisième copie partagée avec
+ * wawp-updater/src/class-package.php : tests/Unit/SharedCodeTest.php vérifie que leurs corps restent identiques.
+ *
+ * @package WAWP\ThemeUpdater
+ */
+
+namespace WAWP\ThemeUpdater;
+
+defined( 'ABSPATH' ) || exit;
+
+/**
+ * Vérifie qu'un paquet signé correspond bien à la mise à jour proposée (slug et version), pour refuser un retour
+ * arrière, une substitution ou une archive piégée. Lecture seule, aucune extraction sur disque.
+ */
+final class Package {
+
+	/** Taille lue pour les en-têtes de style.css, comme WordPress. */
+	const HEADER_BYTES = 8192;
+
+	/**
+	 * Toutes les entrées sont sous `<slug>/`, sans segment `.` ou `..` ni barre oblique inverse ; aucune n'apparaît
+	 * deux fois, casse ignorée (sur un disque insensible à la casse, la seconde écraserait la première) ; l'en-tête
+	 * Version de `<slug>/style.css` vaut `$version`.
+	 *
+	 * @param string $file    Archive zip téléchargée.
+	 * @param string $slug    Slug du thème.
+	 * @param string $version Version de l'offre.
+	 */
+	public static function matches( string $file, string $slug, string $version ): bool {
+		try {
+			if ( ! Validator::is_slug( $slug ) || '' === $version || ! is_file( $file ) ) {
+				return false;
+			}
+			$archive = self::read( $file, $slug . '/style.css' );
+			if ( null === $archive ) {
+				return false;
+			}
+			$seen = array();
+			foreach ( $archive['entries'] as $entry ) {
+				$key = strtolower( $entry );
+				if ( 0 !== strpos( $entry, $slug . '/' ) || false !== strpos( $entry, '\\' ) || 1 === preg_match( '#(^|/)\.\.?(/|\z)#', $entry ) || isset( $seen[ $key ] ) ) {
+					return false;
+				}
+				$seen[ $key ] = true;
+			}
+
+			return self::header( $archive['main'], 'Version' ) === $version;
+		} catch ( \Throwable $e ) {
+			return false;
+		}
+	}
+
+	/**
+	 * Liste des entrées et début de style.css, par ZipArchive ou, à défaut, par PclZip du cœur.
+	 *
+	 * Corps partagé à l'identique avec wawp-updater/src/class-package.php (voir SharedCodeTest).
+	 *
+	 * @param string $file Archive zip.
+	 * @param string $main Chemin de style.css dans l'archive.
+	 * @return array{entries: list<string>, main: string}|null Null si l'archive est illisible ou le fichier absent.
+	 */
+	private static function read( string $file, string $main ): ?array {
+		if ( class_exists( 'ZipArchive' ) ) {
+			$zip = new \ZipArchive();
+			if ( true !== $zip->open( $file ) ) {
+				return null;
+			}
+			$entries = array();
+			$count   = $zip->count();
+			for ( $i = 0; $i < $count; $i++ ) {
+				$name = $zip->getNameIndex( $i );
+				if ( false === $name ) {
+					$zip->close();
+					return null;
+				}
+				$entries[] = $name;
+			}
+			$content = $zip->getFromName( $main, self::HEADER_BYTES );
+			$zip->close();
+
+			return false === $content ? null : array(
+				'entries' => $entries,
+				'main'    => $content,
+			);
+		}
+
+		if ( ! class_exists( 'PclZip' ) ) {
+			$pclzip = ABSPATH . 'wp-admin/includes/class-pclzip.php';
+			if ( ! is_readable( $pclzip ) ) {
+				return null;
+			}
+			require_once $pclzip;
+		}
+		$archive = new \PclZip( $file );
+		$list    = $archive->listContent();
+		if ( ! is_array( $list ) ) {
+			return null;
+		}
+		$entries = array();
+		foreach ( $list as $item ) {
+			if ( ! is_array( $item ) || ! isset( $item['filename'] ) || ! is_string( $item['filename'] ) ) {
+				return null;
+			}
+			$entries[] = $item['filename'];
+		}
+		$extracted = self::call( array( $archive, 'extract' ), array( PCLZIP_OPT_BY_NAME, $main, PCLZIP_OPT_EXTRACT_AS_STRING ) );
+		if ( ! is_array( $extracted ) || ! isset( $extracted[0] ) || ! is_array( $extracted[0] ) || ! isset( $extracted[0]['content'] ) || ! is_string( $extracted[0]['content'] ) ) {
+			return null;
+		}
+
+		return array(
+			'entries' => $entries,
+			'main'    => substr( $extracted[0]['content'], 0, self::HEADER_BYTES ),
+		);
+	}
+
+	/**
+	 * Appel d'une méthode à options variadiques : PclZip lit ses options par func_get_args(), alors que les
+	 * stubs WordPress déclarent extract() sans paramètre.
+	 *
+	 * Corps partagé à l'identique avec wawp-updater/src/class-package.php (voir SharedCodeTest).
+	 *
+	 * @param callable    $method    Méthode à appeler.
+	 * @param list<mixed> $arguments Arguments.
+	 * @return mixed
+	 */
+	private static function call( callable $method, array $arguments ) {
+		return call_user_func_array( $method, $arguments );
+	}
+
+	/**
+	 * Valeur d'un en-tête, extraite comme get_file_data() de WordPress.
+	 *
+	 * Corps partagé à l'identique avec wawp-updater/src/class-package.php (voir SharedCodeTest).
+	 *
+	 * @param string $content Début du fichier.
+	 * @param string $name    Nom de l'en-tête.
+	 */
+	private static function header( string $content, string $name ): ?string {
+		$content = str_replace( "\r", "\n", $content );
+		if ( 1 !== preg_match( '/^(?:[ \t]*<\?php)?[ \t\/*#@]*' . preg_quote( $name, '/' ) . ':(.*)$/mi', $content, $match ) ) {
+			return null;
+		}
+		$value = trim( (string) preg_replace( '/\s*(?:\*\/|\?>).*/', '', $match[1] ) );
+
+		return '' === $value ? null : $value;
+	}
+}

From 3592129171436801dee82c123a80d123cadb4de8 Mon Sep 17 00:00:00 2001
From: thierrypigot <contact@wearewp.pro>
Date: Tue, 13 Oct 2026 14:09:58 +0200
Subject: [PATCH 05/12] =?UTF-8?q?wawp-theme-updater=20:=20offre=20sur=20up?=
 =?UTF-8?q?date=5Fthemes,=20t=C3=A9l=C3=A9chargement=20=C3=A0=20jeton=20fr?=
 =?UTF-8?q?ais=20derri=C3=A8re=20un=20marqueur,=20notices=20de=20l'=C3=A9c?=
 =?UTF-8?q?ran=20Th=C3=A8mes?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 tests/Unit/ThemeUpdaterKeyTest.php       |  62 ++++
 tests/Unit/ThemeUpdaterTest.php          | 342 ++++++++++++++++++++++
 tests/wp-stubs.php                       |  15 +-
 wawp-theme-updater/src/class-updater.php | 352 +++++++++++++++++++++++
 4 files changed, 770 insertions(+), 1 deletion(-)
 create mode 100644 tests/Unit/ThemeUpdaterKeyTest.php
 create mode 100644 tests/Unit/ThemeUpdaterTest.php
 create mode 100644 wawp-theme-updater/src/class-updater.php

diff --git a/tests/Unit/ThemeUpdaterKeyTest.php b/tests/Unit/ThemeUpdaterKeyTest.php
new file mode 100644
index 0000000..026dd9c
--- /dev/null
+++ b/tests/Unit/ThemeUpdaterKeyTest.php
@@ -0,0 +1,62 @@
+<?php
+
+declare(strict_types=1);
+
+namespace WAWP\ReleaseTools\Tests\Unit;
+
+use PHPUnit\Framework\Attributes\DataProvider;
+use PHPUnit\Framework\Attributes\RunTestsInSeparateProcesses;
+use PHPUnit\Framework\TestCase;
+use WAWP\ThemeUpdater\Client;
+use WAWP\ThemeUpdater\Updater;
+use WawpTestState;
+
+#[RunTestsInSeparateProcesses]
+final class ThemeUpdaterKeyTest extends TestCase
+{
+    private const DIR = '/var/www/wp-content/themes/wawp-demo-theme';
+
+    /** @return array<string, array{mixed}> */
+    public static function invalidKeys(): array
+    {
+        return [
+            'absente' => [null],
+            'espaces' => [' wawp_' . str_repeat('A', 43) . ' '],
+            'entier' => [12345],
+            'tronquée' => ['wawp_' . str_repeat('A', 40)],
+        ];
+    }
+
+    #[DataProvider('invalidKeys')]
+    public function testInvalidKeyMeansNoRequestAndNotice(mixed $key): void
+    {
+        if ($key !== null) {
+            define('WAWP_LICENSE_KEY', $key);
+        }
+        WawpTestState::reset();
+        WawpTestState::$versions[self::DIR . '/style.css'] = '1.3.0';
+        WawpTestState::$headers[self::DIR . '/style.css'] = ['Text Domain' => 'wawp-demo-theme'];
+        WawpTestState::$http = static function (): array {
+            throw new \LogicException('aucune requête attendue');
+        };
+        $updater = new Updater('wawp-demo-theme', self::DIR, new Client(), []);
+
+        self::assertFalse($updater->filter_update(false, [], 'wawp-demo-theme', []));
+        self::assertSame([], WawpTestState::$requests);
+        $result = $updater->filter_pre_download(false, 'https://updates.wearewp.pro/v1/theme-update/wawp-demo-theme', null, ['theme' => 'wawp-demo-theme']);
+        self::assertSame('wawp_theme_token_unavailable', $result->get_error_code());
+        self::assertSame([], WawpTestState::$requests);
+
+        WawpTestState::$screen = (object) ['id' => 'themes'];
+        ob_start();
+        $updater->admin_notice();
+        $notice = (string) ob_get_clean();
+        self::assertStringContainsString('WAWP_LICENSE_KEY', $notice);
+        self::assertStringContainsString('notice-warning', $notice);
+
+        WawpTestState::$can = false;
+        ob_start();
+        $updater->admin_notice();
+        self::assertSame('', ob_get_clean(), 'rien pour un utilisateur sans droit de mise à jour des thèmes');
+    }
+}
diff --git a/tests/Unit/ThemeUpdaterTest.php b/tests/Unit/ThemeUpdaterTest.php
new file mode 100644
index 0000000..7bb35e3
--- /dev/null
+++ b/tests/Unit/ThemeUpdaterTest.php
@@ -0,0 +1,342 @@
+<?php
+
+declare(strict_types=1);
+
+namespace WAWP\ReleaseTools\Tests\Unit;
+
+use PHPUnit\Framework\Attributes\DataProvider;
+use PHPUnit\Framework\Attributes\RunTestsInSeparateProcesses;
+use PHPUnit\Framework\TestCase;
+use WAWP\ReleaseTools\Tests\Support\Http;
+use WAWP\ReleaseTools\Tests\Support\Keys;
+use WAWP\ThemeUpdater\Client;
+use WAWP\ThemeUpdater\Updater;
+use WawpTestState;
+use WP_Error;
+
+#[RunTestsInSeparateProcesses]
+final class ThemeUpdaterTest extends TestCase
+{
+    private const KEY = 'wawp_AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA';
+    private const SLUG = 'wawp-demo-theme';
+    private const DIR = '/var/www/wp-content/themes/wawp-demo-theme';
+    private const STYLE = self::DIR . '/style.css';
+    private const MARKER = 'https://updates.wearewp.pro/v1/theme-update/wawp-demo-theme';
+
+    /** @var array{secret: string, public: string} */
+    private array $pair;
+    private string $zip;
+    private int $token = 0;
+
+    protected function setUp(): void
+    {
+        define('WAWP_LICENSE_KEY', self::KEY);
+        WawpTestState::reset();
+        WawpTestState::$versions[self::STYLE] = '1.3.0';
+        WawpTestState::$headers[self::STYLE] = ['Text Domain' => self::SLUG];
+        $this->pair = Keys::pair();
+        $this->zip = sys_get_temp_dir() . '/wawp-theme-upd-' . bin2hex(random_bytes(4)) . '.zip';
+        $this->serve('1.4.0', ThemePackageTest::entries(self::SLUG, '1.4.0'));
+        $zip = $this->zip;
+        WawpTestState::$download = static function () use ($zip): string {
+            copy($zip, $zip . '.dl');
+
+            return $zip . '.dl';
+        };
+    }
+
+    /**
+     * Le serveur propose $offer ; le paquet signé contient $entries.
+     *
+     * @param array<string, string> $entries
+     */
+    private function serve(string $offer, array $entries): void
+    {
+        if (is_file($this->zip)) {
+            unlink($this->zip);
+        }
+        PackageTest::zip($this->zip, $entries);
+        $signature = Keys::sign_file($this->zip, $this->pair['secret']);
+        WawpTestState::$http = function () use ($signature, $offer): array {
+            $this->token++;
+
+            return Http::response(200, Http::theme_body([self::SLUG => Http::theme_offer(self::SLUG, $offer, $signature, 'jeton' . $this->token)]));
+        };
+    }
+
+    protected function tearDown(): void
+    {
+        foreach ([$this->zip, $this->zip . '.dl'] as $file) {
+            if (is_file($file)) {
+                unlink($file);
+            }
+        }
+    }
+
+    /** @param list<string>|null $keys */
+    private function updater(?array $keys = null): Updater
+    {
+        return new Updater(self::SLUG, self::DIR, new Client(), $keys ?? [$this->pair['public']]);
+    }
+
+    private function notice(Updater $updater, string $screen): string
+    {
+        WawpTestState::$screen = (object) ['id' => $screen];
+        ob_start();
+        $updater->admin_notice();
+
+        return (string) ob_get_clean();
+    }
+
+    public function testHooksAreRegistered(): void
+    {
+        $this->updater()->hooks();
+        foreach (['update_themes_updates.wearewp.pro', 'upgrader_pre_download', 'upgrader_process_complete', 'load-update-core.php', 'admin_notices', 'network_admin_notices'] as $hook) {
+            self::assertArrayHasKey($hook, WawpTestState::$hooks, $hook);
+        }
+        self::assertSame([1], WawpTestState::$priorities['upgrader_pre_download']);
+        self::assertSame([9], WawpTestState::$priorities['load-update-core.php']);
+        self::assertArrayNotHasKey('update_plugins_updates.wearewp.pro', WawpTestState::$hooks);
+    }
+
+    public function testUpdateIsOfferedFromOneCachedRequestWithoutTokenInWordPressCache(): void
+    {
+        $updater = $this->updater();
+        $update = $updater->filter_update(false, [], self::SLUG, []);
+        self::assertSame(
+            [
+                'theme' => self::SLUG,
+                'version' => '1.4.0',
+                'url' => 'https://www.wearewp.pro/',
+                'package' => self::MARKER,
+                'requires' => '6.1',
+                'requires_php' => '7.4',
+            ],
+            $update
+        );
+
+        $updater->filter_update(false, [], self::SLUG, []);
+        self::assertCount(1, WawpTestState::$requests, 'la seconde lecture vient du cache');
+        $cache = WawpTestState::$transients['wawp_theme_updater_check'];
+        self::assertSame(43200, $cache['ttl']);
+        self::assertFalse($cache['value']['denied']);
+        self::assertStringNotContainsString(self::KEY, (string) json_encode(WawpTestState::$transients));
+
+        [, $url, $args] = WawpTestState::$requests[0];
+        self::assertSame('https://updates.wearewp.pro/v1/check', $url);
+        $body = json_decode($args['body'], true);
+        self::assertSame([self::SLUG => '1.3.0'], $body['themes']);
+        self::assertArrayNotHasKey('plugins', $body);
+        self::assertSame('https://client.fr', $body['site']);
+    }
+
+    public function testOtherThemesAreLeftAlone(): void
+    {
+        self::assertSame('intact', $this->updater()->filter_update('intact', [], 'twentytwentyfive', []));
+        self::assertSame([], WawpTestState::$requests);
+    }
+
+    public function testUpToDateThemeIsReportedAsNoUpdate(): void
+    {
+        WawpTestState::$http = static fn () => Http::response(200, Http::theme_body([]));
+        self::assertSame(
+            ['theme' => self::SLUG, 'version' => '1.3.0', 'url' => '', 'package' => ''],
+            $this->updater()->filter_update(false, [], self::SLUG, [])
+        );
+    }
+
+    public function testServerFailureIsCachedOneHourAndBreaksNothing(): void
+    {
+        WawpTestState::$http = static fn () => new WP_Error('http_request_failed', 'timeout');
+        $updater = $this->updater();
+        $update = $updater->filter_update(false, [], self::SLUG, []);
+        self::assertSame('', $update['package'], 'aucun paquet proposé');
+        self::assertSame(3600, WawpTestState::$transients['wawp_theme_updater_check']['ttl']);
+        self::assertFalse(WawpTestState::$transients['wawp_theme_updater_check']['value']['denied']);
+        self::assertSame('', $this->notice($updater, 'themes'), 'panne réseau : aucune notice de licence');
+    }
+
+    public function testRefusedLicenceIsCachedAndShownOnTheThemesScreen(): void
+    {
+        WawpTestState::$http = static fn () => Http::response(401, '{"status":"unauthorized"}');
+        $updater = $this->updater();
+        $updater->filter_update(false, [], self::SLUG, []);
+        self::assertTrue(WawpTestState::$transients['wawp_theme_updater_check']['value']['denied']);
+        self::assertSame(3600, WawpTestState::$transients['wawp_theme_updater_check']['ttl']);
+
+        self::assertStringContainsString('a refusé la licence', $this->notice($updater, 'themes'));
+        self::assertStringContainsString('a refusé la licence', $this->notice($updater, 'themes-network'));
+        self::assertSame('', $this->notice($updater, 'plugins'), 'uniquement sur l\'écran Thèmes');
+        WawpTestState::$can = false;
+        self::assertSame('', $this->notice($updater, 'themes'), 'rien sans le droit update_themes');
+    }
+
+    public function testFolderNotMatchingTheTextDomainDisablesUpdatesAndShowsNotice(): void
+    {
+        WawpTestState::$headers[self::STYLE] = ['Text Domain' => 'theme-client-x'];
+        $updater = $this->updater();
+        self::assertFalse($updater->filter_update(false, [], self::SLUG, []));
+        self::assertSame([], WawpTestState::$requests, 'aucune requête avec un slug faux');
+        self::assertStringContainsString('dossier du thème actif', $this->notice($updater, 'themes'));
+    }
+
+    public function testInvalidFolderNameIsIgnored(): void
+    {
+        $updater = new Updater('Wawp Demo Theme-main', self::DIR, new Client(), [$this->pair['public']]);
+        self::assertFalse($updater->filter_update(false, [], 'Wawp Demo Theme-main', []));
+        self::assertSame([], WawpTestState::$requests);
+        self::assertStringContainsString('dossier du thème actif', $this->notice($updater, 'themes'));
+    }
+
+    public function testMultisiteSendsNetworkUrl(): void
+    {
+        WawpTestState::$multisite = true;
+        $this->updater()->filter_update(false, [], self::SLUG, []);
+        self::assertSame('https://reseau-client.fr', json_decode(WawpTestState::$requests[0][2]['body'], true)['site']);
+    }
+
+    public function testExceptionInsideTheHttpLayerNeverEscapes(): void
+    {
+        WawpTestState::$http = static function (): array {
+            throw new \RuntimeException('panne');
+        };
+        $updater = $this->updater();
+        self::assertFalse($updater->filter_update(false, [], self::SLUG, []));
+        $result = $updater->filter_pre_download(false, self::MARKER, null, ['theme' => self::SLUG]);
+        self::assertInstanceOf(WP_Error::class, $result);
+        self::assertSame('wawp_theme_updater_error', $result->get_error_code());
+    }
+
+    public function testPreDownloadUsesFreshTokenAndVerifiesSignature(): void
+    {
+        $updater = $this->updater();
+        $package = $updater->filter_update(false, [], self::SLUG, [])['package'];
+
+        $urls = [];
+        $zip = $this->zip;
+        WawpTestState::$download = static function (string $url) use ($zip, &$urls): string {
+            $urls[] = $url;
+            copy($zip, $zip . '.dl');
+
+            return $zip . '.dl';
+        };
+        $path = $updater->filter_pre_download(false, $package, null, ['theme' => self::SLUG, 'type' => 'theme', 'action' => 'update']);
+
+        self::assertSame($this->zip . '.dl', $path);
+        self::assertCount(2, WawpTestState::$requests, 'un /v1/check frais au téléchargement');
+        self::assertSame(['https://updates.wearewp.pro/v1/download/jeton2'], $urls);
+    }
+
+    public function testPreDownloadWorksWithBulkUpgradeContext(): void
+    {
+        // bulk_upgrade() (écran Mises à jour, AJAX, WP-CLI) ne passe que 'theme' et 'temp_backup'.
+        $path = $this->updater()->filter_pre_download(false, self::MARKER, null, ['theme' => self::SLUG, 'temp_backup' => ['slug' => self::SLUG]]);
+        self::assertSame($this->zip . '.dl', $path);
+    }
+
+    public function testPreDownloadIgnoresPackagesThatAreNotThemeMarkers(): void
+    {
+        $updater = $this->updater();
+        self::assertFalse($updater->filter_pre_download(false, 'https://downloads.wordpress.org/theme/x.zip', null, ['theme' => 'x']));
+        self::assertSame('deja', $updater->filter_pre_download('deja', 'https://downloads.wordpress.org/theme/x.zip', null, []));
+        self::assertFalse($updater->filter_pre_download(false, 'https://updates.wearewp.pro/v1/download/abc.def', null, ['plugin' => 'wawp-demo/wawp-demo.php']), 'paquet de plugin laissé à wawp-updater');
+        self::assertFalse($updater->filter_pre_download(false, '/tmp/televerse.zip', null, ['type' => 'theme', 'action' => 'install']), 'téléversement manuel');
+        self::assertSame([], WawpTestState::$requests);
+    }
+
+    public function testPreDownloadRefusesUnknownOrHijackedMarkers(): void
+    {
+        $updater = $this->updater();
+        self::assertSame('wawp_theme_unknown_package', $updater->filter_pre_download(false, self::MARKER, null, ['theme' => 'autre-theme'])->get_error_code());
+        self::assertSame('wawp_theme_unknown_package', $updater->filter_pre_download(false, 'https://updates.wearewp.pro/v1/theme-update/autre-theme', null, ['theme' => self::SLUG])->get_error_code());
+        self::assertSame('wawp_theme_unknown_package', $updater->filter_pre_download(false, self::MARKER, null, null)->get_error_code());
+        self::assertSame('wawp_theme_package_hijacked', $updater->filter_pre_download('/tmp/autre.zip', self::MARKER, null, ['theme' => self::SLUG])->get_error_code());
+        self::assertSame([], WawpTestState::$requests);
+    }
+
+    public function testFrozenPluginClientLeavesTheThemeMarkerAlone(): void
+    {
+        $file = WP_PLUGIN_DIR . '/wawp-demo/wawp-demo.php';
+        WawpTestState::$versions[$file] = '1.0.0';
+        (new \WAWP\Updater\Updater([$file], new \WAWP\Updater\Client(), []))->hooks();
+        $this->updater()->hooks();
+
+        // Ordre réel sur un site : wawp-updater s'inscrit d'abord (plugins_loaded), à la même priorité 1.
+        $reply = false;
+        foreach (WawpTestState::$hooks['upgrader_pre_download'] as $callback) {
+            $reply = $callback($reply, self::MARKER, null, ['theme' => self::SLUG, 'type' => 'theme', 'action' => 'update']);
+        }
+        self::assertSame($this->zip . '.dl', $reply, 'wawp-updater laisse passer le marqueur, wawp-theme-updater fournit le paquet vérifié');
+    }
+
+    public function testPreDownloadRefusesBadSignatureAndDeletesTheFile(): void
+    {
+        $result = $this->updater([Keys::pair()['public']])->filter_pre_download(false, self::MARKER, null, ['theme' => self::SLUG]);
+        self::assertInstanceOf(WP_Error::class, $result);
+        self::assertSame('wawp_theme_signature_invalid', $result->get_error_code());
+        self::assertSame('Signature du thème WeAre[WP] invalide : mise à jour annulée.', $result->get_error_message());
+        self::assertFileDoesNotExist($this->zip . '.dl');
+
+        $empty = $this->updater([])->filter_pre_download(false, self::MARKER, null, ['theme' => self::SLUG]);
+        self::assertSame('wawp_theme_signature_invalid', $empty->get_error_code(), 'aucune clé configurée : refus');
+    }
+
+    /** @return array<string, array{string, array<string, string>, string}> */
+    public static function mismatches(): array
+    {
+        return [
+            'autre version signée (retour arrière)' => ['1.4.0', ThemePackageTest::entries(self::SLUG, '1.2.0'), '1.3.0'],
+            'autre slug signé (substitution)' => ['1.4.0', ThemePackageTest::entries('theme-autre', '1.4.0'), '1.3.0'],
+            'version égale à l\'installée' => ['1.4.0', ThemePackageTest::entries(self::SLUG, '1.4.0'), '1.4.0'],
+            'version inférieure à l\'installée' => ['1.4.0', ThemePackageTest::entries(self::SLUG, '1.4.0'), '1.5.0'],
+            'entrée hors du dossier du thème' => ['1.4.0', ThemePackageTest::entries(self::SLUG, '1.4.0') + ['autre/x.php' => '<?php'], '1.3.0'],
+        ];
+    }
+
+    /** @param array<string, string> $entries */
+    #[DataProvider('mismatches')]
+    public function testPreDownloadRefusesSignedPackageThatDoesNotMatchTheOffer(string $offer, array $entries, string $installed): void
+    {
+        WawpTestState::$versions[self::STYLE] = $installed;
+        $this->serve($offer, $entries);
+        $result = $this->updater()->filter_pre_download(false, self::MARKER, null, ['theme' => self::SLUG]);
+        self::assertInstanceOf(WP_Error::class, $result);
+        self::assertSame('wawp_theme_package_mismatch', $result->get_error_code());
+        self::assertFileDoesNotExist($this->zip . '.dl');
+    }
+
+    public function testPreDownloadReportsFailuresWithoutLeakingTheToken(): void
+    {
+        WawpTestState::$download = static fn () => new WP_Error('http_404', 'https://updates.wearewp.pro/v1/download/secret');
+        $result = $this->updater()->filter_pre_download(false, self::MARKER, null, ['theme' => self::SLUG]);
+        self::assertSame('wawp_theme_download_failed', $result->get_error_code());
+        self::assertStringNotContainsString('download/', $result->get_error_message());
+
+        WawpTestState::$http = static fn () => Http::response(401, '{"status":"unauthorized"}');
+        $refused = $this->updater()->filter_pre_download(false, self::MARKER, null, ['theme' => self::SLUG]);
+        self::assertSame('wawp_theme_token_unavailable', $refused->get_error_code());
+    }
+
+    public function testCacheIsFlushedAfterUpgradesAndOnForceCheck(): void
+    {
+        $updater = $this->updater();
+        $updater->filter_update(false, [], self::SLUG, []);
+        $updater->flush_cache();
+        self::assertArrayNotHasKey('wawp_theme_updater_check', WawpTestState::$transients);
+
+        $updater->filter_update(false, [], self::SLUG, []);
+        $updater->maybe_flush_on_force_check();
+        self::assertArrayHasKey('wawp_theme_updater_check', WawpTestState::$transients, 'sans force-check, cache conservé');
+        $_GET['force-check'] = '1';
+        $updater->maybe_flush_on_force_check();
+        unset($_GET['force-check']);
+        self::assertArrayNotHasKey('wawp_theme_updater_check', WawpTestState::$transients);
+    }
+
+    public function testNoNoticeWhenEverythingIsFine(): void
+    {
+        $updater = $this->updater();
+        $updater->filter_update(false, [], self::SLUG, []);
+        self::assertSame('', $this->notice($updater, 'themes'));
+    }
+}
diff --git a/tests/wp-stubs.php b/tests/wp-stubs.php
index bbb6f39..f13d6d0 100644
--- a/tests/wp-stubs.php
+++ b/tests/wp-stubs.php
@@ -26,6 +26,8 @@ final class WawpTestState
     /** @var array<string, string> */
     public static array $versions = [];
     public static bool $multisite = false;
+    /** @var array<string, array<string, string>> chemin de fichier vers en-têtes (hors Version) */
+    public static array $headers = [];
 
     public static function reset(): void
     {
@@ -40,6 +42,7 @@ public static function reset(): void
         self::$screen = null;
         self::$versions = [];
         self::$multisite = false;
+        self::$headers = [];
     }
 }
 
@@ -86,7 +89,12 @@ function plugin_basename(string $file): string
 /** @param array<string, string> $headers @return array<string, string> */
 function get_file_data(string $file, array $headers): array
 {
-    return ['Version' => WawpTestState::$versions[$file] ?? ''];
+    $data = [];
+    foreach ($headers as $field => $name) {
+        $data[$field] = $name === 'Version' ? (WawpTestState::$versions[$file] ?? '') : (WawpTestState::$headers[$file][$name] ?? '');
+    }
+
+    return $data;
 }
 
 function get_site_transient(string $key): mixed
@@ -222,6 +230,11 @@ function esc_html__(string $text, string $domain = 'default'): string
     return htmlspecialchars($text, ENT_QUOTES, 'UTF-8');
 }
 
+function esc_html(string $text): string
+{
+    return htmlspecialchars($text, ENT_QUOTES, 'UTF-8');
+}
+
 function current_user_can(string $capability): bool
 {
     return WawpTestState::$can;
diff --git a/wawp-theme-updater/src/class-updater.php b/wawp-theme-updater/src/class-updater.php
new file mode 100644
index 0000000..bd854d3
--- /dev/null
+++ b/wawp-theme-updater/src/class-updater.php
@@ -0,0 +1,352 @@
+<?php
+/**
+ * Points d'accroche WordPress du client de mise à jour des thèmes.
+ *
+ * @package WAWP\ThemeUpdater
+ */
+
+namespace WAWP\ThemeUpdater;
+
+defined( 'ABSPATH' ) || exit;
+
+/**
+ * Gère le thème actif inscrit. Aucune erreur ne doit interrompre WordPress.
+ */
+final class Updater {
+
+	/**
+	 * Nom du dossier du thème actif (get_stylesheet()).
+	 *
+	 * @var string
+	 */
+	private $stylesheet;
+
+	/**
+	 * Chemin du dossier du thème actif.
+	 *
+	 * @var string
+	 */
+	private $dir;
+
+	/**
+	 * @var Client
+	 */
+	private $client;
+
+	/**
+	 * @var string[]
+	 */
+	private $public_keys;
+
+	/**
+	 * @param string   $stylesheet  Nom du dossier du thème actif.
+	 * @param string   $dir         Chemin du dossier du thème actif.
+	 * @param Client   $client      Client HTTP.
+	 * @param string[] $public_keys Clés publiques Ed25519 en base64.
+	 */
+	public function __construct( string $stylesheet, string $dir, Client $client, array $public_keys ) {
+		$this->stylesheet  = $stylesheet;
+		$this->dir         = $dir;
+		$this->client      = $client;
+		$this->public_keys = $public_keys;
+	}
+
+	/**
+	 * Enregistre les points d'accroche.
+	 */
+	public function hooks(): void {
+		add_filter( 'update_themes_' . Config::HOST, array( $this, 'filter_update' ), 10, 4 );
+		add_filter( 'upgrader_pre_download', array( $this, 'filter_pre_download' ), 1, 4 );
+		add_action( 'upgrader_process_complete', array( $this, 'flush_cache' ), 10, 0 );
+		add_action( 'load-update-core.php', array( $this, 'maybe_flush_on_force_check' ), 9 );
+		add_action( 'admin_notices', array( $this, 'admin_notice' ) );
+		add_action( 'network_admin_notices', array( $this, 'admin_notice' ) );
+	}
+
+	/**
+	 * Filtre update_themes_{hôte} : données de mise à jour du thème inscrit.
+	 *
+	 * @param mixed $update           Valeur reçue (false par défaut).
+	 * @param mixed $theme_data       En-têtes du thème.
+	 * @param mixed $theme_stylesheet Nom du dossier du thème.
+	 * @param mixed $locales          Langues installées.
+	 * @return mixed
+	 */
+	// phpcs:ignore Generic.CodeAnalysis.UnusedFunctionParameter.FoundAfterLastUsed -- signature imposée par le filtre update_themes_{hôte} (4 arguments).
+	public function filter_update( $update, $theme_data, $theme_stylesheet, $locales ) {
+		try {
+			$slug = $this->slug();
+			if ( null === $slug || $theme_stylesheet !== $slug ) {
+				return $update;
+			}
+			$offers = $this->offers( false );
+			if ( ! isset( $offers[ $slug ] ) ) {
+				$installed = $this->installed();
+				if ( null === $this->key() || null === $installed ) {
+					return $update;
+				}
+
+				// Thème à jour : WordPress le range dans no_update (bascule des mises à jour automatiques).
+				return array(
+					'theme'   => $slug,
+					'version' => $installed,
+					'url'     => '',
+					'package' => '',
+				);
+			}
+			$offer = $offers[ $slug ];
+
+			// Aucun jeton dans le cache de WordPress : le paquet est demandé avec un jeton frais au téléchargement.
+			return array_filter(
+				array(
+					'theme'        => $slug,
+					'version'      => $offer['version'],
+					'url'          => $offer['url'],
+					'package'      => Config::PACKAGE_MARKER . $slug,
+					'requires'     => $offer['requires'],
+					'requires_php' => $offer['requires_php'],
+				),
+				static function ( $value ) {
+					return null !== $value;
+				}
+			);
+		} catch ( \Throwable $e ) {
+			return $update;
+		}
+	}
+
+	/**
+	 * Filtre upgrader_pre_download : jeton frais, téléchargement, signature, contrôle du paquet.
+	 *
+	 * @param mixed $reply      Valeur reçue (false si personne n'a encore traité le paquet).
+	 * @param mixed $package    Adresse du paquet (marqueur PACKAGE_MARKER pour le thème inscrit).
+	 * @param mixed $upgrader   Instance de WP_Upgrader.
+	 * @param mixed $hook_extra Contexte de la mise à jour.
+	 * @return mixed Chemin du fichier vérifié, WP_Error, ou la valeur reçue.
+	 */
+	public function filter_pre_download( $reply, $package, $upgrader, $hook_extra ) {
+		if ( ! is_string( $package ) || 0 !== strpos( $package, Config::PACKAGE_MARKER ) ) {
+			return $reply;
+		}
+		try {
+			if ( false !== $reply ) {
+				// Enregistré en priorité 1 : un autre filtre qui a déjà fourni un fichier court-circuiterait la signature.
+				return new \WP_Error( 'wawp_theme_package_hijacked', __( 'Paquet de thème WeAre[WP] déjà pris en charge par une autre extension : mise à jour annulée.', 'wawp-theme-updater' ) );
+			}
+			$slug  = $this->slug();
+			$theme = is_array( $hook_extra ) && isset( $hook_extra['theme'] ) && is_string( $hook_extra['theme'] ) ? $hook_extra['theme'] : '';
+			if ( null === $slug || $theme !== $slug || Config::PACKAGE_MARKER . $slug !== $package ) {
+				return new \WP_Error( 'wawp_theme_unknown_package', __( 'Paquet de thème WeAre[WP] inconnu : mise à jour annulée.', 'wawp-theme-updater' ) );
+			}
+			$offers = $this->offers( true );
+			if ( ! isset( $offers[ $slug ] ) ) {
+				return new \WP_Error( 'wawp_theme_token_unavailable', __( 'Mise à jour du thème WeAre[WP] indisponible : licence refusée ou serveur injoignable.', 'wawp-theme-updater' ) );
+			}
+			$offer = $offers[ $slug ];
+			$file  = download_url( $offer['package'], Config::DOWNLOAD_TIMEOUT );
+			if ( is_wp_error( $file ) ) {
+				return new \WP_Error( 'wawp_theme_download_failed', __( 'Téléchargement du thème WeAre[WP] impossible.', 'wawp-theme-updater' ) );
+			}
+			if ( ! Signature::verify_file( $file, $offer['signature'], $this->public_keys ) ) {
+				wp_delete_file( $file );
+				return new \WP_Error( 'wawp_theme_signature_invalid', __( 'Signature du thème WeAre[WP] invalide : mise à jour annulée.', 'wawp-theme-updater' ) );
+			}
+			// Paquet signé mais différent de l'offre (retour arrière ou substitution par un serveur compromis).
+			$installed = $this->installed();
+			if ( null === $installed || ! version_compare( $offer['version'], $installed, '>' ) || ! Package::matches( $file, $slug, $offer['version'] ) ) {
+				wp_delete_file( $file );
+				return new \WP_Error( 'wawp_theme_package_mismatch', __( 'Paquet du thème WeAre[WP] non conforme à la mise à jour proposée : mise à jour annulée.', 'wawp-theme-updater' ) );
+			}
+
+			return $file;
+		} catch ( \Throwable $e ) {
+			return new \WP_Error( 'wawp_theme_updater_error', __( 'Erreur du client de mise à jour des thèmes WeAre[WP] : mise à jour annulée.', 'wawp-theme-updater' ) );
+		}
+	}
+
+	/**
+	 * Vide le cache du client.
+	 */
+	public function flush_cache(): void {
+		try {
+			delete_site_transient( Config::CACHE_KEY );
+		} catch ( \Throwable $e ) {
+			return;
+		}
+	}
+
+	/**
+	 * Vide le cache quand l'administrateur clique « Rechercher les mises à jour ».
+	 */
+	public function maybe_flush_on_force_check(): void {
+		try {
+			// phpcs:ignore WordPress.Security.NonceVerification.Recommended -- lecture seule : isset() sans lire la valeur, vide uniquement un cache local.
+			if ( isset( $_GET['force-check'] ) ) {
+				$this->flush_cache();
+			}
+		} catch ( \Throwable $e ) {
+			return;
+		}
+	}
+
+	/**
+	 * Avertit les administrateurs, sur l'écran Thèmes, d'une clé absente, d'un dossier mal nommé ou d'une licence refusée.
+	 */
+	public function admin_notice(): void {
+		try {
+			if ( ! current_user_can( 'update_themes' ) ) {
+				return;
+			}
+			$screen = function_exists( 'get_current_screen' ) ? get_current_screen() : null;
+			if ( null === $screen || ! in_array( $screen->id, array( 'themes', 'themes-network' ), true ) ) {
+				return;
+			}
+			$message = null;
+			if ( null === $this->key() ) {
+				$message = __( 'WeAre[WP] : la constante WAWP_LICENSE_KEY est absente ou invalide dans wp-config.php. Les mises à jour du thème WeAre[WP] sont désactivées.', 'wawp-theme-updater' );
+			} elseif ( null === $this->slug() ) {
+				$message = __( 'WeAre[WP] : le nom du dossier du thème actif ne correspond pas à son slug (en-tête Text Domain de style.css). Réinstaller le thème à partir du zip publié pour réactiver ses mises à jour.', 'wawp-theme-updater' );
+			} elseif ( $this->denied() ) {
+				$message = __( 'WeAre[WP] : le serveur de mises à jour a refusé la licence de ce site. Vérifier la clé WAWP_LICENSE_KEY ou contacter WeAre[WP].', 'wawp-theme-updater' );
+			}
+			if ( null === $message ) {
+				return;
+			}
+			printf( '<div class="notice notice-warning"><p>%s</p></div>', esc_html( $message ) );
+		} catch ( \Throwable $e ) {
+			return;
+		}
+	}
+
+	/**
+	 * Offres du serveur pour le thème inscrit, depuis le cache ou une requête.
+	 *
+	 * @param bool $fresh Ignorer le cache (jeton frais pour un téléchargement).
+	 * @return array<string, array{version: string, requires: ?string, requires_php: ?string, url: string, package: string, signature: string}>
+	 */
+	private function offers( bool $fresh ): array {
+		$key       = $this->key();
+		$slug      = $this->slug();
+		$installed = $this->installed();
+		if ( null === $key || null === $slug || null === $installed ) {
+			return array();
+		}
+		$site = $this->site();
+		$hash = self::cache_hash( $key, $site, $slug, $installed );
+
+		if ( ! $fresh ) {
+			$cached = get_site_transient( Config::CACHE_KEY );
+			if ( is_array( $cached ) && isset( $cached['hash'], $cached['body'] ) && $hash === $cached['hash'] && is_string( $cached['body'] ) ) {
+				$offers = Theme_Validator::check_response( $cached['body'], array( $slug ) );
+				if ( null !== $offers ) {
+					return $offers;
+				}
+			}
+		}
+
+		$result = $this->client->check( $key, $site, array( $slug => $installed ) );
+		$offers = $result['offers'];
+		set_site_transient(
+			Config::CACHE_KEY,
+			array(
+				'hash'   => $hash,
+				'body'   => (string) wp_json_encode( array( 'themes' => (object) ( null === $offers ? array() : self::to_response( $offers ) ) ) ),
+				'denied' => 401 === $result['status'],
+			),
+			null === $offers ? Config::ERROR_TTL : Config::CACHE_TTL
+		);
+
+		return null === $offers ? array() : $offers;
+	}
+
+	/**
+	 * Offres validées remises au format de la réponse du serveur, pour le cache.
+	 *
+	 * @param array<string, array{version: string, requires: ?string, requires_php: ?string, url: string, package: string, signature: string}> $offers Offres.
+	 * @return array<string, array<string, string|null>>
+	 */
+	private static function to_response( array $offers ): array {
+		$themes = array();
+		foreach ( $offers as $slug => $offer ) {
+			$themes[ $slug ] = array(
+				'theme'        => (string) $slug,
+				'new_version'  => $offer['version'],
+				'requires'     => $offer['requires'],
+				'requires_php' => $offer['requires_php'],
+				'url'          => $offer['url'],
+				'package'      => $offer['package'],
+				'signature'    => $offer['signature'],
+			);
+		}
+
+		return $themes;
+	}
+
+	/**
+	 * Empreinte du contexte de la requête mise en cache (la clé n'y figure que hachée).
+	 *
+	 * @param string $key       Clé de licence.
+	 * @param string $site      Adresse du site.
+	 * @param string $slug      Slug du thème.
+	 * @param string $installed Version installée.
+	 */
+	private static function cache_hash( string $key, string $site, string $slug, string $installed ): string {
+		return md5( (string) wp_json_encode( array( $site, $slug, $installed, Config::VERSION, hash( 'sha256', $key ) ) ) );
+	}
+
+	/**
+	 * Vrai si la dernière réponse en cache, pour le contexte actuel, est un refus de licence (401).
+	 */
+	private function denied(): bool {
+		$key       = $this->key();
+		$slug      = $this->slug();
+		$installed = $this->installed();
+		if ( null === $key || null === $slug || null === $installed ) {
+			return false;
+		}
+		$cached = get_site_transient( Config::CACHE_KEY );
+
+		return is_array( $cached ) && isset( $cached['hash'] ) && self::cache_hash( $key, $this->site(), $slug, $installed ) === $cached['hash'] && true === ( $cached['denied'] ?? false );
+	}
+
+	/**
+	 * Slug du thème, ou null si le nom du dossier n'est pas un slug valide ou diffère du Text Domain de style.css.
+	 */
+	private function slug(): ?string {
+		if ( ! Validator::is_slug( $this->stylesheet ) ) {
+			return null;
+		}
+		$data = get_file_data( $this->dir . '/style.css', array( 'TextDomain' => 'Text Domain' ) );
+
+		return ( $data['TextDomain'] ?? '' ) === $this->stylesheet ? $this->stylesheet : null;
+	}
+
+	/**
+	 * Version installée du thème, lue dans style.css, ou null si elle est illisible.
+	 */
+	private function installed(): ?string {
+		$data    = get_file_data( $this->dir . '/style.css', array( 'Version' => 'Version' ) );
+		$version = $data['Version'] ?? '';
+
+		return Validator::is_installed_version( $version ) ? $version : null;
+	}
+
+	/**
+	 * Clé de licence lue dans wp-config.php, ou null si absente ou invalide.
+	 */
+	private function key(): ?string {
+		if ( ! defined( 'WAWP_LICENSE_KEY' ) ) {
+			return null;
+		}
+		$key = constant( 'WAWP_LICENSE_KEY' );
+
+		return Validator::is_key( $key ) ? $key : null;
+	}
+
+	/**
+	 * Adresse du site envoyée au serveur (celle du réseau en multisite).
+	 */
+	private function site(): string {
+		return is_multisite() ? network_home_url() : home_url();
+	}
+}

From c78c62896098fc83a9e9ac2d38127eb63a1adad9 Mon Sep 17 00:00:00 2001
From: thierrypigot <contact@wearewp.pro>
Date: Tue, 13 Oct 2026 14:14:43 +0200
Subject: [PATCH 06/12] =?UTF-8?q?wawp-theme-updater=20:=20register()=20dep?=
 =?UTF-8?q?uis=20functions.php,=20sans=20effet=20hors=20du=20th=C3=A8me=20?=
 =?UTF-8?q?actif,=20jamais=20d'erreur=20fatale?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 tests/Unit/ThemeBootstrapTest.php |  70 +++++++++++++++++++++
 tests/Unit/ThemeLoaderTest.php    | 101 ++++++++++++++++++++++++++++++
 wawp-theme-updater/bootstrap.php  |  30 +++++++++
 wawp-theme-updater/load.php       |  48 ++++++++++++++
 4 files changed, 249 insertions(+)
 create mode 100644 tests/Unit/ThemeBootstrapTest.php
 create mode 100644 tests/Unit/ThemeLoaderTest.php
 create mode 100644 wawp-theme-updater/bootstrap.php
 create mode 100644 wawp-theme-updater/load.php

diff --git a/tests/Unit/ThemeBootstrapTest.php b/tests/Unit/ThemeBootstrapTest.php
new file mode 100644
index 0000000..11cd65c
--- /dev/null
+++ b/tests/Unit/ThemeBootstrapTest.php
@@ -0,0 +1,70 @@
+<?php
+
+declare(strict_types=1);
+
+namespace WAWP\ReleaseTools\Tests\Unit;
+
+use PHPUnit\Framework\TestCase;
+
+/**
+ * bootstrap.php réel, dans un sous-processus : un fichier de src/ absent (quarantaine antivirus
+ * d'hébergeur) ne doit jamais provoquer d'erreur fatale.
+ */
+final class ThemeBootstrapTest extends TestCase
+{
+    private const CLASSES = ['config', 'validator', 'theme-validator', 'signature', 'client', 'package', 'updater'];
+
+    private string $dir;
+
+    protected function setUp(): void
+    {
+        $this->dir = sys_get_temp_dir() . '/wawp-theme-bootstrap-' . bin2hex(random_bytes(4));
+        $source = dirname(__DIR__, 2) . '/wawp-theme-updater';
+        mkdir("{$this->dir}/src", 0777, true);
+        copy("$source/bootstrap.php", "{$this->dir}/bootstrap.php");
+        foreach (self::CLASSES as $class) {
+            copy("$source/src/class-$class.php", "{$this->dir}/src/class-$class.php");
+        }
+    }
+
+    protected function tearDown(): void
+    {
+        foreach (glob("{$this->dir}/src/*") ?: [] as $file) {
+            unlink($file);
+        }
+        @unlink("{$this->dir}/bootstrap.php");
+        @rmdir("{$this->dir}/src");
+        @rmdir($this->dir);
+    }
+
+    private function start(): string
+    {
+        $code = 'require ' . var_export(dirname(__DIR__) . '/wp-stubs.php', true) . ';'
+            . '$start = require ' . var_export("{$this->dir}/bootstrap.php", true) . ';'
+            . '$start("wawp-demo-theme", "/var/www/wp-content/themes/wawp-demo-theme");'
+            . 'echo "hooks:" . count(WawpTestState::$hooks);';
+        $process = proc_open([PHP_BINARY, '-r', $code], [1 => ['pipe', 'w'], 2 => ['pipe', 'w']], $pipes);
+        self::assertIsResource($process);
+        $out = (string) stream_get_contents($pipes[1]) . (string) stream_get_contents($pipes[2]);
+        fclose($pipes[1]);
+        fclose($pipes[2]);
+        proc_close($process);
+
+        return $out;
+    }
+
+    public function testCompleteCopyRegistersHooks(): void
+    {
+        self::assertSame('hooks:6', $this->start());
+    }
+
+    public function testMissingSourceFileRegistersNothingAndNeverFails(): void
+    {
+        foreach (self::CLASSES as $class) {
+            $this->tearDown();
+            $this->setUp();
+            unlink("{$this->dir}/src/class-$class.php");
+            self::assertSame('hooks:0', $this->start(), "class-$class.php absent");
+        }
+    }
+}
diff --git a/tests/Unit/ThemeLoaderTest.php b/tests/Unit/ThemeLoaderTest.php
new file mode 100644
index 0000000..8bac061
--- /dev/null
+++ b/tests/Unit/ThemeLoaderTest.php
@@ -0,0 +1,101 @@
+<?php
+
+declare(strict_types=1);
+
+namespace WAWP\ReleaseTools\Tests\Unit;
+
+use PHPUnit\Framework\TestCase;
+
+/**
+ * load.php réel, dans un sous-processus, avec un bootstrap.php factice qui affiche ses arguments.
+ */
+final class ThemeLoaderTest extends TestCase
+{
+    private string $dir;
+    private string $theme;
+    private string $parent;
+
+    protected function setUp(): void
+    {
+        $this->dir = sys_get_temp_dir() . '/wawp-theme-loader-' . bin2hex(random_bytes(4));
+        $this->theme = "{$this->dir}/themes/wawp-demo-theme";
+        $this->parent = "{$this->dir}/themes/theme-parent";
+        foreach ([$this->theme, $this->parent] as $root) {
+            mkdir("$root/wawp-theme-updater", 0777, true);
+            copy(dirname(__DIR__, 2) . '/wawp-theme-updater/load.php', "$root/wawp-theme-updater/load.php");
+            file_put_contents("$root/wawp-theme-updater/bootstrap.php", "<?php\nreturn static function (string \$stylesheet, string \$dir): void { echo 'start:' . \$stylesheet . ':' . basename(\$dir) . ';'; };\n");
+        }
+    }
+
+    protected function tearDown(): void
+    {
+        $it = new \RecursiveIteratorIterator(new \RecursiveDirectoryIterator($this->dir, \FilesystemIterator::SKIP_DOTS), \RecursiveIteratorIterator::CHILD_FIRST);
+        foreach ($it as $file) {
+            $file->isDir() ? rmdir($file->getPathname()) : unlink($file->getPathname());
+        }
+        rmdir($this->dir);
+    }
+
+    private function runPhp(string $calls): string
+    {
+        $code = 'define("ABSPATH", "/");'
+            . 'function get_stylesheet() { return "wawp-demo-theme"; }'
+            . 'function get_stylesheet_directory() { return ' . var_export($this->theme, true) . '; }'
+            . $calls;
+        $process = proc_open([PHP_BINARY, '-r', $code], [1 => ['pipe', 'w'], 2 => ['pipe', 'w']], $pipes);
+        self::assertIsResource($process);
+        $out = (string) stream_get_contents($pipes[1]) . (string) stream_get_contents($pipes[2]);
+        fclose($pipes[1]);
+        fclose($pipes[2]);
+        proc_close($process);
+
+        return $out;
+    }
+
+    private static function load(string $root): string
+    {
+        return 'require ' . var_export("$root/wawp-theme-updater/load.php", true) . ';';
+    }
+
+    private static function register(mixed $dir): string
+    {
+        return '\WAWP\ThemeUpdater\register(' . var_export($dir, true) . ');';
+    }
+
+    public function testActiveThemeStartsTheClientOnce(): void
+    {
+        $out = $this->runPhp(self::load($this->theme) . self::register($this->theme) . self::register($this->theme . '/'));
+        self::assertSame('start:wawp-demo-theme:wawp-demo-theme;', $out);
+    }
+
+    public function testParentThemeForeignDirectoryOrBadArgumentIsIgnored(): void
+    {
+        $out = $this->runPhp(
+            self::load($this->parent) . self::load($this->theme)
+            . self::register($this->parent)
+            . self::register($this->dir . '/absent')
+            . self::register(42)
+            . self::register(null)
+            . 'echo "fin";'
+        );
+        self::assertSame('fin', $out, 'deux copies chargées sans « Cannot redeclare », aucun démarrage');
+    }
+
+    public function testMissingBootstrapIsSilent(): void
+    {
+        unlink("{$this->theme}/wawp-theme-updater/bootstrap.php");
+        self::assertSame('fin', $this->runPhp(self::load($this->theme) . self::register($this->theme) . 'echo "fin";'));
+    }
+
+    public function testThrowingBootstrapNeverBreaksTheSite(): void
+    {
+        file_put_contents("{$this->theme}/wawp-theme-updater/bootstrap.php", "<?php\nthrow new \\RuntimeException('panne');\n");
+        self::assertSame('fin', $this->runPhp(self::load($this->theme) . self::register($this->theme) . 'echo "fin";'));
+    }
+
+    public function testLoaderLeavesNoVariableInGlobalScope(): void
+    {
+        $out = $this->runPhp(self::load($this->theme) . 'echo count(array_filter(array_keys(get_defined_vars()), static fn ($name) => str_starts_with((string) $name, "wawp")));');
+        self::assertSame('0', $out);
+    }
+}
diff --git a/wawp-theme-updater/bootstrap.php b/wawp-theme-updater/bootstrap.php
new file mode 100644
index 0000000..1727ca7
--- /dev/null
+++ b/wawp-theme-updater/bootstrap.php
@@ -0,0 +1,30 @@
+<?php
+/**
+ * Démarrage de wawp-theme-updater.
+ *
+ * @package WAWP\ThemeUpdater
+ */
+
+namespace WAWP\ThemeUpdater;
+
+defined( 'ABSPATH' ) || exit;
+
+// Un fichier manquant (quarantaine antivirus d'hébergeur) ne doit jamais provoquer d'erreur fatale.
+foreach ( array( 'config', 'validator', 'theme-validator', 'signature', 'client', 'package', 'updater' ) as $wawp_theme_updater_class ) {
+	if ( ! is_readable( __DIR__ . '/src/class-' . $wawp_theme_updater_class . '.php' ) ) {
+		// phpcs:ignore Generic.CodeAnalysis.UnusedFunctionParameter.Found -- signature attendue par register().
+		return static function ( string $stylesheet, string $dir ): void {};
+	}
+}
+
+require_once __DIR__ . '/src/class-config.php';
+require_once __DIR__ . '/src/class-validator.php';
+require_once __DIR__ . '/src/class-theme-validator.php';
+require_once __DIR__ . '/src/class-signature.php';
+require_once __DIR__ . '/src/class-client.php';
+require_once __DIR__ . '/src/class-package.php';
+require_once __DIR__ . '/src/class-updater.php';
+
+return static function ( string $stylesheet, string $dir ): void {
+	( new Updater( $stylesheet, $dir, new Client(), Config::PUBLIC_KEYS ) )->hooks();
+};
diff --git a/wawp-theme-updater/load.php b/wawp-theme-updater/load.php
new file mode 100644
index 0000000..554aabe
--- /dev/null
+++ b/wawp-theme-updater/load.php
@@ -0,0 +1,48 @@
+<?php
+/**
+ * Chargeur de wawp-theme-updater, appelé par le functions.php du thème actif :
+ *
+ *     require __DIR__ . '/wawp-theme-updater/load.php';
+ *     \WAWP\ThemeUpdater\register( __DIR__ );
+ *
+ * Un seul thème est actif : aucun registre partagé ni sélection de copie.
+ *
+ * @package WAWP\ThemeUpdater
+ */
+
+namespace WAWP\ThemeUpdater;
+
+defined( 'ABSPATH' ) || exit;
+
+if ( ! function_exists( __NAMESPACE__ . '\register' ) ) {
+
+	/**
+	 * Inscrit le thème actif auprès du client de mise à jour. Sans effet si $theme_dir n'est pas le dossier du thème
+	 * actif (thème parent, appel parasite), si le client est incomplet ou au second appel. Ne lève jamais d'erreur.
+	 * Les points d'accroche sont posés aussitôt : functions.php est chargé avant after_setup_theme, et tous sont
+	 * déclenchés plus tard.
+	 *
+	 * @param mixed $theme_dir Dossier du thème (__DIR__ dans functions.php).
+	 * @return void
+	 */
+	function register( $theme_dir ) {
+		try {
+			if ( ! empty( $GLOBALS['wawp_theme_updater_registered'] ) || ! is_string( $theme_dir ) || ! function_exists( 'get_stylesheet_directory' ) || ! function_exists( 'get_stylesheet' ) ) {
+				return;
+			}
+			$dir    = realpath( $theme_dir );
+			$active = realpath( get_stylesheet_directory() );
+			if ( false === $dir || false === $active || $dir !== $active || ! is_readable( __DIR__ . '/bootstrap.php' ) ) {
+				return;
+			}
+			$GLOBALS['wawp_theme_updater_registered'] = true;
+
+			$start = require __DIR__ . '/bootstrap.php';
+			if ( is_callable( $start ) ) {
+				$start( (string) get_stylesheet(), $active );
+			}
+		} catch ( \Throwable $e ) {
+			return;
+		}
+	}
+}

From 85dac86948b3ed89acd829a89f0c6055735259f7 Mon Sep 17 00:00:00 2001
From: thierrypigot <contact@wearewp.pro>
Date: Tue, 13 Oct 2026 14:17:48 +0200
Subject: [PATCH 07/12] =?UTF-8?q?wawp-theme-updater=20:=20drapeau=20d'insc?=
 =?UTF-8?q?ription=20local=20=C3=A0=20register()=20(plus=20de=20variable?=
 =?UTF-8?q?=20globale),=20dossier=20vide=20refus=C3=A9?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 tests/Unit/ThemeLoaderTest.php | 19 +++++++++++++++++--
 wawp-theme-updater/load.php    |  6 ++++--
 2 files changed, 21 insertions(+), 4 deletions(-)

diff --git a/tests/Unit/ThemeLoaderTest.php b/tests/Unit/ThemeLoaderTest.php
index 8bac061..c00d386 100644
--- a/tests/Unit/ThemeLoaderTest.php
+++ b/tests/Unit/ThemeLoaderTest.php
@@ -95,7 +95,22 @@ public function testThrowingBootstrapNeverBreaksTheSite(): void
 
     public function testLoaderLeavesNoVariableInGlobalScope(): void
     {
-        $out = $this->runPhp(self::load($this->theme) . 'echo count(array_filter(array_keys(get_defined_vars()), static fn ($name) => str_starts_with((string) $name, "wawp")));');
-        self::assertSame('0', $out);
+        $out = $this->runPhp(
+            self::load($this->theme) . self::register($this->theme)
+            . 'echo count(array_filter(array_keys(get_defined_vars()), static fn ($name) => str_starts_with((string) $name, "wawp")));'
+        );
+        self::assertSame('start:wawp-demo-theme:wawp-demo-theme;0', $out, 'chargement et register() ne laissent aucune variable globale');
+    }
+
+    public function testEmptyDirectoryIsIgnored(): void
+    {
+        $cwd = (string) getcwd();
+        chdir($this->theme);
+        try {
+            $out = $this->runPhp(self::load($this->theme) . self::register('') . 'echo "fin";');
+        } finally {
+            chdir($cwd);
+        }
+        self::assertSame('fin', $out, "'' ne doit pas se résoudre au dossier courant");
     }
 }
diff --git a/wawp-theme-updater/load.php b/wawp-theme-updater/load.php
index 554aabe..cefa90c 100644
--- a/wawp-theme-updater/load.php
+++ b/wawp-theme-updater/load.php
@@ -26,8 +26,10 @@
 	 * @return void
 	 */
 	function register( $theme_dir ) {
+		static $registered = false;
+
 		try {
-			if ( ! empty( $GLOBALS['wawp_theme_updater_registered'] ) || ! is_string( $theme_dir ) || ! function_exists( 'get_stylesheet_directory' ) || ! function_exists( 'get_stylesheet' ) ) {
+			if ( $registered || ! is_string( $theme_dir ) || '' === $theme_dir || ! function_exists( 'get_stylesheet_directory' ) || ! function_exists( 'get_stylesheet' ) ) {
 				return;
 			}
 			$dir    = realpath( $theme_dir );
@@ -35,7 +37,7 @@ function register( $theme_dir ) {
 			if ( false === $dir || false === $active || $dir !== $active || ! is_readable( __DIR__ . '/bootstrap.php' ) ) {
 				return;
 			}
-			$GLOBALS['wawp_theme_updater_registered'] = true;
+			$registered = true;
 
 			$start = require __DIR__ . '/bootstrap.php';
 			if ( is_callable( $start ) ) {

From d4f419e35b9b6c1274515b6dc61e4f1a598491a0 Mon Sep 17 00:00:00 2001
From: thierrypigot <contact@wearewp.pro>
Date: Tue, 13 Oct 2026 14:21:33 +0200
Subject: [PATCH 08/12] =?UTF-8?q?check-headers=20:=20contr=C3=B4les=20d'un?=
 =?UTF-8?q?=20th=C3=A8me=20avec=20--type=3Dtheme,=20comportement=20des=20p?=
 =?UTF-8?q?lugins=20inchang=C3=A9?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 config/min-theme-updater-version.txt |   1 +
 scripts/check-headers.php            | 157 +++++++++++++++++++--------
 tests/Unit/CheckHeadersTest.php      |  45 ++++++++
 tests/Unit/ThemeCheckHeadersTest.php | 152 ++++++++++++++++++++++++++
 4 files changed, 312 insertions(+), 43 deletions(-)
 create mode 100644 config/min-theme-updater-version.txt
 create mode 100644 tests/Unit/ThemeCheckHeadersTest.php

diff --git a/config/min-theme-updater-version.txt b/config/min-theme-updater-version.txt
new file mode 100644
index 0000000..3eefcb9
--- /dev/null
+++ b/config/min-theme-updater-version.txt
@@ -0,0 +1 @@
+1.0.0
diff --git a/scripts/check-headers.php b/scripts/check-headers.php
index 380bcee..151b5dc 100644
--- a/scripts/check-headers.php
+++ b/scripts/check-headers.php
@@ -1,7 +1,8 @@
 <?php
 /**
- * Contrôles d'un plugin avant construction du paquet. Lit les fichiers, n'exécute jamais le code du plugin.
- * Usage : php check-headers.php <dossier-plugin> <slug> <tag vX.Y.Z> <version minimale de wawp-updater>
+ * Contrôles d'un plugin ou d'un thème avant construction du paquet. Lit les fichiers, n'exécute jamais leur code.
+ * Usage : php check-headers.php [--type=plugin|theme] <dossier> <slug> <tag vX.Y.Z> <version minimale de la bibliothèque cliente>
+ * Sans --type : plugin (comportement d'origine). Pour un thème, la bibliothèque est wawp-theme-updater.
  */
 
 declare(strict_types=1);
@@ -10,10 +11,28 @@
     exit(1);
 }
 
-$dir = rtrim($argv[1] ?? '', '/\\');
-$slug = $argv[2] ?? '';
-$tag = $argv[3] ?? '';
-$minUpdater = trim($argv[4] ?? '');
+$type = 'plugin';
+$args = [];
+foreach (array_slice($argv, 1) as $arg) {
+    if (strncmp($arg, '--type=', 7) === 0) {
+        $type = substr($arg, 7);
+    } else {
+        $args[] = $arg;
+    }
+}
+if ($type !== 'plugin' && $type !== 'theme') {
+    fwrite(STDERR, "Type invalide : « $type » (plugin ou theme).\n");
+    exit(1);
+}
+$isTheme = $type === 'theme';
+$kind = $isTheme ? 'thème' : 'plugin';
+$library = $isTheme ? 'wawp-theme-updater' : 'wawp-updater';
+$minFile = $isTheme ? 'min-theme-updater-version.txt' : 'min-updater-version.txt';
+
+$dir = rtrim($args[0] ?? '', '/\\');
+$slug = $args[1] ?? '';
+$tag = $args[2] ?? '';
+$minUpdater = trim($args[3] ?? '');
 $errors = [];
 $version = '';
 
@@ -36,15 +55,15 @@
 };
 
 if ($dir === '' || !is_dir($dir)) {
-    fwrite(STDERR, "Dossier du plugin introuvable : « $dir ».\n");
+    fwrite(STDERR, "Dossier du $kind introuvable : « $dir ».\n");
     exit(1);
 }
 if (preg_match('/^\d+\.\d+\.\d+\z/', $minUpdater) !== 1) {
-    fwrite(STDERR, "Version minimale de wawp-updater invalide : « $minUpdater » (format attendu X.Y.Z, config/min-updater-version.txt).\n");
+    fwrite(STDERR, "Version minimale de $library invalide : « $minUpdater » (format attendu X.Y.Z, config/$minFile).\n");
     exit(1);
 }
 if (preg_match('/^[a-z0-9-]{1,64}\z/', $slug) !== 1) {
-    $errors[] = "Slug invalide : « $slug » (le nom du dépôt doit être le slug du plugin, en minuscules).";
+    $errors[] = "Slug invalide : « $slug » (le nom du dépôt doit être le slug du $kind, en minuscules).";
 }
 if (preg_match('/^v(\d{1,5}\.\d{1,5}\.\d{1,5})\z/', $tag, $m) === 1) {
     $version = $m[1];
@@ -52,48 +71,100 @@
     $errors[] = "Tag invalide : « $tag » (format attendu vX.Y.Z).";
 }
 
-$main = $read("$dir/$slug.php", 8192);
-if ($main === null) {
-    $errors[] = "Fichier principal $slug.php absent.";
-} else {
-    $name = $header($main, 'Plugin Name');
-    if ($name === null || preg_match('/^[^\p{Cc}]{1,200}\z/u', $name) !== 1) {
-        $errors[] = 'En-tête Plugin Name absent ou invalide (UTF-8, 200 caractères au plus, sans caractère de contrôle).';
+if ($isTheme) {
+    $style = $read("$dir/style.css", 8192);
+    if ($style === null) {
+        $errors[] = 'style.css absent.';
+    } else {
+        $name = $header($style, 'Theme Name');
+        if ($name === null || preg_match('/^[^\p{Cc}]{1,200}\z/u', $name) !== 1) {
+            $errors[] = 'En-tête Theme Name absent ou invalide (UTF-8, 200 caractères au plus, sans caractère de contrôle).';
+        }
+        $declared = $header($style, 'Version');
+        if ($version !== '' && $declared !== $version) {
+            $errors[] = 'En-tête Version (' . ($declared ?? 'absent') . ") différent du tag ($version).";
+        }
+        if ($header($style, 'Update URI') !== 'https://updates.wearewp.pro') {
+            $errors[] = 'En-tête Update URI absent ou différent de https://updates.wearewp.pro.';
+        }
+        $themeUri = $header($style, 'Theme URI');
+        if ($themeUri !== null && preg_match('/^https?:\/\/[^\s"<>\\\\\p{Cc}]{1,2040}\z/u', $themeUri) !== 1) {
+            $errors[] = 'En-tête Theme URI invalide (adresse http ou https, sans espace, guillemet, chevron, barre oblique inverse ni caractère de contrôle, 2048 caractères au plus).';
+        }
+        $requires = $header($style, 'Requires at least');
+        if ($requires === null || preg_match('/^\d+(?:\.\d+){0,2}\z/', $requires) !== 1 || version_compare($requires, '6.1', '<')) {
+            $errors[] = 'En-tête Requires at least absent ou inférieur à 6.1 (filtre update_themes_{hôte} de WordPress).';
+        }
+        $requiresPhp = $header($style, 'Requires PHP');
+        if ($requiresPhp === null || preg_match('/^\d+(?:\.\d+){0,2}\z/', $requiresPhp) !== 1) {
+            $errors[] = 'En-tête Requires PHP absent ou invalide.';
+        }
+        if ($header($style, 'Text Domain') !== $slug) {
+            $errors[] = "En-tête Text Domain absent ou différent du slug ($slug) : le client s'en sert pour vérifier le dossier du thème.";
+        }
+        if ($header($style, 'Template') !== null) {
+            $errors[] = 'En-tête Template présent : les thèmes enfants ne sont pas pris en charge.';
+        }
     }
-    $declared = $header($main, 'Version');
-    if ($version !== '' && $declared !== $version) {
-        $errors[] = 'En-tête Version (' . ($declared ?? 'absent') . ") différent du tag ($version).";
+    if (is_file("$dir/$slug.php")) {
+        $errors[] = "Fichier $slug.php présent à la racine : le serveur refuserait le paquet (plugin et thème ambigus).";
     }
-    if ($header($main, 'Update URI') !== 'https://updates.wearewp.pro') {
-        $errors[] = 'En-tête Update URI absent ou différent de https://updates.wearewp.pro.';
+    if (!is_file("$dir/functions.php")) {
+        $errors[] = 'functions.php absent.';
     }
-    if ($header($main, 'GitHub Plugin URI') !== null) {
-        $errors[] = 'En-tête GitHub Plugin URI présent : retirer les en-têtes Git Updater.';
+    if (!is_file("$dir/.distignore")) {
+        $errors[] = 'Fichier .distignore absent.';
+    }
+    $themeConfig = $read("$dir/wawp-theme-updater/src/class-config.php");
+    if ($themeConfig === null || preg_match("/const VERSION = '(\d+\.\d+\.\d+)';/", $themeConfig, $m) !== 1) {
+        $errors[] = 'wawp-theme-updater absent ou version illisible (wawp-theme-updater/src/class-config.php).';
+    } elseif (version_compare($m[1], $minUpdater, '<')) {
+        $errors[] = "wawp-theme-updater {$m[1]} trop ancien (minimum $minUpdater).";
+    }
+} else {
+    $main = $read("$dir/$slug.php", 8192);
+    if ($main === null) {
+        $errors[] = "Fichier principal $slug.php absent.";
+    } else {
+        $name = $header($main, 'Plugin Name');
+        if ($name === null || preg_match('/^[^\p{Cc}]{1,200}\z/u', $name) !== 1) {
+            $errors[] = 'En-tête Plugin Name absent ou invalide (UTF-8, 200 caractères au plus, sans caractère de contrôle).';
+        }
+        $declared = $header($main, 'Version');
+        if ($version !== '' && $declared !== $version) {
+            $errors[] = 'En-tête Version (' . ($declared ?? 'absent') . ") différent du tag ($version).";
+        }
+        if ($header($main, 'Update URI') !== 'https://updates.wearewp.pro') {
+            $errors[] = 'En-tête Update URI absent ou différent de https://updates.wearewp.pro.';
+        }
+        if ($header($main, 'GitHub Plugin URI') !== null) {
+            $errors[] = 'En-tête GitHub Plugin URI présent : retirer les en-têtes Git Updater.';
+        }
     }
-}
 
-$readme = $read("$dir/readme.txt");
-if ($readme === null) {
-    $errors[] = 'readme.txt absent.';
-} elseif (preg_match('/^Stable tag:[ \t]*(\S+)[ \t]*$/mi', $readme, $m) !== 1 || ($version !== '' && $m[1] !== $version)) {
-    $errors[] = "Stable tag du readme.txt absent ou différent de $version.";
-}
+    $readme = $read("$dir/readme.txt");
+    if ($readme === null) {
+        $errors[] = 'readme.txt absent.';
+    } elseif (preg_match('/^Stable tag:[ \t]*(\S+)[ \t]*$/mi', $readme, $m) !== 1 || ($version !== '' && $m[1] !== $version)) {
+        $errors[] = "Stable tag du readme.txt absent ou différent de $version.";
+    }
 
-if (!is_file("$dir/.distignore")) {
-    $errors[] = 'Fichier .distignore absent.';
-}
-if (is_dir("$dir/plugin-update-checker") || is_dir("$dir/vendor/yahnis-elsts/plugin-update-checker")) {
-    $errors[] = 'Plugin Update Checker encore embarqué : le retirer.';
-}
+    if (!is_file("$dir/.distignore")) {
+        $errors[] = 'Fichier .distignore absent.';
+    }
+    if (is_dir("$dir/plugin-update-checker") || is_dir("$dir/vendor/yahnis-elsts/plugin-update-checker")) {
+        $errors[] = 'Plugin Update Checker encore embarqué : le retirer.';
+    }
 
-$load = $read("$dir/wawp-updater/load.php");
-if ($load === null || preg_match("/\\\$wawp_updater_version = '(\d+\.\d+\.\d+)';/", $load, $m) !== 1) {
-    $errors[] = 'wawp-updater absent ou version illisible (wawp-updater/load.php).';
-} elseif (version_compare($m[1], $minUpdater, '<')) {
-    $errors[] = "wawp-updater {$m[1]} trop ancien (minimum $minUpdater).";
+    $load = $read("$dir/wawp-updater/load.php");
+    if ($load === null || preg_match("/\\\$wawp_updater_version = '(\d+\.\d+\.\d+)';/", $load, $m) !== 1) {
+        $errors[] = 'wawp-updater absent ou version illisible (wawp-updater/load.php).';
+    } elseif (version_compare($m[1], $minUpdater, '<')) {
+        $errors[] = "wawp-updater {$m[1]} trop ancien (minimum $minUpdater).";
+    }
 }
 
-$config = $read("$dir/wawp-updater/src/class-config.php");
+$config = $read("$dir/$library/src/class-config.php");
 $keys = [];
 if ($config !== null && preg_match('/const PUBLIC_KEYS = array\(([^)]*)\);/', $config, $m) === 1) {
     preg_match_all("/'([A-Za-z0-9+\\/=]+)'/", $m[1], $found);
@@ -105,7 +176,7 @@
     return $raw !== false && strlen($raw) === 32;
 });
 if (count($validKeys) !== 2 || count(array_unique($validKeys)) !== 2) {
-    $errors[] = 'PUBLIC_KEYS doit contenir exactement deux clés publiques Ed25519 distinctes (wawp-updater/src/class-config.php).';
+    $errors[] = "PUBLIC_KEYS doit contenir exactement deux clés publiques Ed25519 distinctes ($library/src/class-config.php).";
 }
 
 if ($errors !== []) {
diff --git a/tests/Unit/CheckHeadersTest.php b/tests/Unit/CheckHeadersTest.php
index a05272f..f8b0530 100644
--- a/tests/Unit/CheckHeadersTest.php
+++ b/tests/Unit/CheckHeadersTest.php
@@ -89,4 +89,49 @@ public function testEachDefectIsReported(): void
             self::assertStringContainsString($expected, $out, $label);
         }
     }
+
+    public function testFullErrorReportIsUnchanged(): void
+    {
+        unlink($this->dir . '/readme.txt');
+        unlink($this->dir . '/.distignore');
+        $this->write('wawp-demo.php', "<?php
+/* Plugin Name: X
+ * Version: 1.3.9
+ */
+");
+        [$code, $out, $err] = Cli::run([PHP_BINARY, Cli::php('scripts/check-headers.php'), $this->dir, 'wawp-demo', 'v1.4.0', '1.0.0']);
+        self::assertSame(1, $code);
+        self::assertSame('', $out);
+        self::assertSame(
+            "Contrôles en échec :
+- En-tête Version (1.3.9) différent du tag (1.4.0).
+- En-tête Update URI absent ou différent de https://updates.wearewp.pro.
+- readme.txt absent.
+- Fichier .distignore absent.
+",
+            $err
+        );
+    }
+
+    public function testExplicitPluginTypeIsTheDefault(): void
+    {
+        $script = Cli::php('scripts/check-headers.php');
+        self::assertSame(
+            Cli::run([PHP_BINARY, $script, $this->dir, 'wawp-demo', 'v1.4.0', '1.0.0']),
+            Cli::run([PHP_BINARY, $script, '--type=plugin', $this->dir, 'wawp-demo', 'v1.4.0', '1.0.0'])
+        );
+        $this->write('readme.txt', "Stable tag: 1.4.1
+");
+        self::assertSame(
+            Cli::run([PHP_BINARY, $script, $this->dir, 'wawp-demo', 'v1.4.0', '1.0.0']),
+            Cli::run([PHP_BINARY, $script, $this->dir, 'wawp-demo', 'v1.4.0', '1.0.0', '--type=plugin'])
+        );
+    }
+
+    public function testUnknownTypeIsRefused(): void
+    {
+        [$code, , $err] = Cli::run([PHP_BINARY, Cli::php('scripts/check-headers.php'), '--type=child', $this->dir, 'wawp-demo', 'v1.4.0', '1.0.0']);
+        self::assertSame(1, $code);
+        self::assertStringContainsString('Type invalide : « child » (plugin ou theme).', $err);
+    }
 }
diff --git a/tests/Unit/ThemeCheckHeadersTest.php b/tests/Unit/ThemeCheckHeadersTest.php
new file mode 100644
index 0000000..74d18d2
--- /dev/null
+++ b/tests/Unit/ThemeCheckHeadersTest.php
@@ -0,0 +1,152 @@
+<?php
+
+declare(strict_types=1);
+
+namespace WAWP\ReleaseTools\Tests\Unit;
+
+use PHPUnit\Framework\TestCase;
+use WAWP\ReleaseTools\Tests\Support\Cli;
+use WAWP\ReleaseTools\Tests\Support\Keys;
+
+final class ThemeCheckHeadersTest extends TestCase
+{
+    private string $dir;
+
+    protected function setUp(): void
+    {
+        $this->dir = sys_get_temp_dir() . '/wawp-check-theme-' . bin2hex(random_bytes(4)) . '/wawp-demo-theme';
+        mkdir($this->dir . '/wawp-theme-updater/src', 0777, true);
+        $this->write('style.css', self::style());
+        $this->write('functions.php', "<?php\nrequire __DIR__ . '/wawp-theme-updater/load.php';\n\\WAWP\\ThemeUpdater\\register( __DIR__ );\n");
+        $this->write('.distignore', "/.git\n/tests\n");
+        $this->write('wawp-theme-updater/load.php', "<?php\n");
+        $this->config([Keys::pair()['public'], Keys::pair()['public']]);
+    }
+
+    protected function tearDown(): void
+    {
+        $root = dirname($this->dir);
+        $it = new \RecursiveIteratorIterator(new \RecursiveDirectoryIterator($root, \FilesystemIterator::SKIP_DOTS), \RecursiveIteratorIterator::CHILD_FIRST);
+        foreach ($it as $file) {
+            $file->isDir() ? rmdir($file->getPathname()) : unlink($file->getPathname());
+        }
+        rmdir($root);
+    }
+
+    /** @param array<string, string|null> $headers null retire l'en-tête */
+    private static function style(array $headers = []): string
+    {
+        $headers += [
+            'Theme Name' => 'WAWP Démo',
+            'Version' => '1.4.0',
+            'Requires at least' => '6.1',
+            'Requires PHP' => '7.4',
+            'Text Domain' => 'wawp-demo-theme',
+            'Update URI' => 'https://updates.wearewp.pro',
+        ];
+        $lines = '';
+        foreach ($headers as $name => $value) {
+            if ($value !== null) {
+                $lines .= "$name: $value\n";
+            }
+        }
+
+        return "/*\n$lines*/\n";
+    }
+
+    private function write(string $path, string $content): void
+    {
+        file_put_contents($this->dir . '/' . $path, $content);
+    }
+
+    /** @param list<string> $keys */
+    private function config(array $keys, string $version = '1.0.0'): void
+    {
+        $list = implode(', ', array_map(static fn (string $key): string => "'$key'", $keys));
+        $this->write('wawp-theme-updater/src/class-config.php', "<?php\nfinal class Config {\n\tconst VERSION = '$version';\n\tconst PUBLIC_KEYS = array( $list );\n}\n");
+    }
+
+    /** @return array{int, string} */
+    private function check(string $slug = 'wawp-demo-theme', string $tag = 'v1.4.0', string $min = '1.0.0', string $type = '--type=theme'): array
+    {
+        [$code, $out, $err] = Cli::run([PHP_BINARY, Cli::php('scripts/check-headers.php'), $type, $this->dir, $slug, $tag, $min]);
+
+        return [$code, $out . $err];
+    }
+
+    public function testValidThemePasses(): void
+    {
+        [$code, $out] = $this->check();
+        self::assertSame(0, $code, $out);
+        self::assertSame("Contrôles réussis : wawp-demo-theme 1.4.0\n", $out);
+    }
+
+    public function testThemeUriIsOptionalButValidatedWhenPresent(): void
+    {
+        $this->write('style.css', self::style(['Theme URI' => 'https://example.com/theme']));
+        [$code, $out] = $this->check();
+        self::assertSame(0, $code, $out);
+    }
+
+    public function testTypeMayComeLast(): void
+    {
+        [$code, $out, $err] = Cli::run([PHP_BINARY, Cli::php('scripts/check-headers.php'), $this->dir, 'wawp-demo-theme', 'v1.4.0', '1.0.0', '--type=theme']);
+        self::assertSame(0, $code, $out . $err);
+    }
+
+    public function testAThemeIsNotAPlugin(): void
+    {
+        [$code, $out] = $this->check(type: '--type=plugin');
+        self::assertSame(1, $code);
+        self::assertStringContainsString('Fichier principal wawp-demo-theme.php absent.', $out);
+    }
+
+    public function testMinimumThemeUpdaterVersionIsPublished(): void
+    {
+        self::assertSame(\WAWP\ThemeUpdater\Config::VERSION, trim((string) file_get_contents(dirname(__DIR__, 2) . '/config/min-theme-updater-version.txt')));
+    }
+
+    public function testMalformedMinimumVersionOrMissingDirectory(): void
+    {
+        [$code, $out] = $this->check(min: '1.0');
+        self::assertSame(1, $code);
+        self::assertStringContainsString('Version minimale de wawp-theme-updater invalide : « 1.0 » (format attendu X.Y.Z, config/min-theme-updater-version.txt).', $out);
+
+        [$code, , $err] = Cli::run([PHP_BINARY, Cli::php('scripts/check-headers.php'), '--type=theme', '', 'wawp-demo-theme', 'v1.4.0', '1.0.0']);
+        self::assertSame(1, $code);
+        self::assertStringContainsString('Dossier du thème introuvable', $err);
+    }
+
+    public function testEachDefectIsReported(): void
+    {
+        $cases = [
+            'style.css absent' => [fn () => unlink($this->dir . '/style.css'), null, 'style.css absent.'],
+            'Theme Name' => [fn () => $this->write('style.css', self::style(['Theme Name' => null])), null, 'En-tête Theme Name'],
+            'version' => [fn () => $this->write('style.css', self::style(['Version' => '1.3.9'])), null, 'En-tête Version (1.3.9) différent du tag (1.4.0).'],
+            'update uri' => [fn () => $this->write('style.css', self::style(['Update URI' => 'https://updates.wearewp.pro/'])), null, 'Update URI'],
+            'theme uri invalide' => [fn () => $this->write('style.css', self::style(['Theme URI' => 'ftp://example.com/theme'])), null, 'Theme URI'],
+            'theme uri sans hôte' => [fn () => $this->write('style.css', self::style(['Theme URI' => 'not a url'])), null, 'Theme URI'],
+            'requires at least trop bas' => [fn () => $this->write('style.css', self::style(['Requires at least' => '6.0'])), null, 'Requires at least'],
+            'requires at least absent' => [fn () => $this->write('style.css', self::style(['Requires at least' => null])), null, 'Requires at least'],
+            'requires php absent' => [fn () => $this->write('style.css', self::style(['Requires PHP' => null])), null, 'Requires PHP'],
+            'text domain' => [fn () => $this->write('style.css', self::style(['Text Domain' => 'autre'])), null, 'Text Domain'],
+            'thème enfant' => [fn () => $this->write('style.css', self::style(['Template' => 'twentytwentyfive'])), null, 'En-tête Template présent'],
+            'fichier de plugin' => [fn () => $this->write('wawp-demo-theme.php', "<?php\n"), null, 'Fichier wawp-demo-theme.php présent à la racine'],
+            'functions.php absent' => [fn () => unlink($this->dir . '/functions.php'), null, 'functions.php absent.'],
+            'distignore' => [fn () => unlink($this->dir . '/.distignore'), null, 'Fichier .distignore absent.'],
+            'bibliothèque absente' => [fn () => unlink($this->dir . '/wawp-theme-updater/src/class-config.php'), null, 'wawp-theme-updater absent ou version illisible'],
+            'bibliothèque ancienne' => [fn () => null, ['wawp-demo-theme', 'v1.4.0', '1.1.0'], 'wawp-theme-updater 1.0.0 trop ancien (minimum 1.1.0).'],
+            'une seule clé' => [fn () => $this->config([Keys::pair()['public']]), null, 'PUBLIC_KEYS doit contenir exactement deux clés publiques Ed25519 distinctes (wawp-theme-updater/src/class-config.php).'],
+            'tag' => [fn () => null, ['wawp-demo-theme', 'v1.4', '1.0.0'], 'Tag invalide'],
+            'slug' => [fn () => null, ['Wawp_Demo', 'v1.4.0', '1.0.0'], 'slug du thème'],
+        ];
+        foreach ($cases as $label => [$mutate, $args, $expected]) {
+            $this->tearDown();
+            $this->setUp();
+            $mutate();
+            [$code, $out] = $args === null ? $this->check() : $this->check(...$args);
+            self::assertSame(1, $code, "$label : $out");
+            self::assertStringContainsString($expected, $out, $label);
+        }
+    }
+}

From e57e88b66bbb863c0133830483f06a9dfb4634b0 Mon Sep 17 00:00:00 2001
From: thierrypigot <contact@wearewp.pro>
Date: Tue, 13 Oct 2026 14:27:03 +0200
Subject: [PATCH 09/12] =?UTF-8?q?check-package=20:=20contr=C3=B4le=20d'un?=
 =?UTF-8?q?=20paquet=20de=20th=C3=A8me=20avec=20--type=3Dtheme,=20comporte?=
 =?UTF-8?q?ment=20des=20plugins=20inchang=C3=A9?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 scripts/check-package.php            | 115 +++++++++++++++++++-------
 tests/Unit/CheckPackageTest.php      |  27 ++++++
 tests/Unit/ThemeCheckPackageTest.php | 119 +++++++++++++++++++++++++++
 3 files changed, 232 insertions(+), 29 deletions(-)
 create mode 100644 tests/Unit/ThemeCheckPackageTest.php

diff --git a/scripts/check-package.php b/scripts/check-package.php
index 4cf49a1..9e6a8b7 100644
--- a/scripts/check-package.php
+++ b/scripts/check-package.php
@@ -1,7 +1,8 @@
 <?php
 /**
- * Contrôle du paquet construit, juste avant le zip. Lecture seule, n'exécute jamais le code du plugin.
- * Usage : php check-package.php <dossier-construit (build/<slug>)> <slug> <version X.Y.Z>
+ * Contrôle du paquet construit, juste avant le zip. Lecture seule, n'exécute jamais le code du plugin ou du thème.
+ * Usage : php check-package.php [--type=plugin|theme] <dossier-construit (build/<slug>)> <slug> <version X.Y.Z>
+ * Sans --type : plugin (comportement d'origine).
  */
 
 declare(strict_types=1);
@@ -10,9 +11,25 @@
     exit(1);
 }
 
-$dir = rtrim($argv[1] ?? '', '/\\');
-$slug = $argv[2] ?? '';
-$version = $argv[3] ?? '';
+$type = 'plugin';
+$args = [];
+foreach (array_slice($argv, 1) as $arg) {
+    if (strncmp($arg, '--type=', 7) === 0) {
+        $type = substr($arg, 7);
+    } else {
+        $args[] = $arg;
+    }
+}
+if ($type !== 'plugin' && $type !== 'theme') {
+    fwrite(STDERR, "Type invalide : « $type » (plugin ou theme).\n");
+    exit(1);
+}
+$isTheme = $type === 'theme';
+$library = $isTheme ? 'wawp-theme-updater' : 'wawp-updater';
+
+$dir = rtrim($args[0] ?? '', '/\\');
+$slug = $args[1] ?? '';
+$version = $args[2] ?? '';
 $errors = [];
 
 $read = static function (string $path, int $limit = 0): ?string {
@@ -45,37 +62,77 @@
     $errors[] = "Version invalide : « $version » (format attendu X.Y.Z).";
 }
 
-$required = ['wawp-updater/load.php', 'wawp-updater/bootstrap.php'];
-foreach (['config', 'validator', 'signature', 'client', 'updater', 'package'] as $class) {
-    $required[] = "wawp-updater/src/class-$class.php";
-}
-foreach ($required as $file) {
-    if (!is_file("$dir/$file")) {
-        $errors[] = "$file absent du paquet.";
+if ($isTheme) {
+    $required = ['wawp-theme-updater/load.php', 'wawp-theme-updater/bootstrap.php'];
+    foreach (['config', 'validator', 'theme-validator', 'signature', 'client', 'package', 'updater'] as $class) {
+        $required[] = "wawp-theme-updater/src/class-$class.php";
+    }
+    foreach ($required as $file) {
+        if (!is_file("$dir/$file")) {
+            $errors[] = "$file absent du paquet.";
+        }
     }
-}
 
-$main = $read("$dir/$slug.php");
-if ($main === null) {
-    $errors[] = "Fichier principal $slug.php absent du paquet.";
-} else {
-    if (strpos($main, 'wawp-updater/load.php') === false) {
-        $errors[] = "$slug.php ne charge pas wawp-updater/load.php.";
+    $functions = $read("$dir/functions.php");
+    if ($functions === null) {
+        $errors[] = 'functions.php absent du paquet.';
+    } else {
+        if (strpos($functions, 'wawp-theme-updater/load.php') === false) {
+            $errors[] = 'functions.php ne charge pas wawp-theme-updater/load.php.';
+        }
+        if (strpos($functions, '\WAWP\ThemeUpdater\register(') === false) {
+            $errors[] = "functions.php n'appelle pas \\WAWP\\ThemeUpdater\\register(.";
+        }
     }
-    if (strpos($main, '\WAWP\Updater\register(') === false) {
-        $errors[] = "$slug.php n'appelle pas \\WAWP\\Updater\\register(.";
+
+    $style = $read("$dir/style.css", 8192);
+    if ($style === null) {
+        $errors[] = 'style.css absent du paquet.';
+    } else {
+        $declared = $header($style, 'Version');
+        if ($declared !== $version) {
+            $errors[] = 'En-tête Version de style.css (' . ($declared ?? 'absent') . ") différent de la version publiée ($version).";
+        }
+        if ($header($style, 'Update URI') !== 'https://updates.wearewp.pro') {
+            $errors[] = 'En-tête Update URI de style.css absent ou différent de https://updates.wearewp.pro.';
+        }
     }
-    $head = substr($main, 0, 8192);
-    $declared = $header($head, 'Version');
-    if ($declared !== $version) {
-        $errors[] = 'En-tête Version (' . ($declared ?? 'absent') . ") différent de la version publiée ($version).";
+    if (is_file("$dir/$slug.php")) {
+        $errors[] = "$slug.php présent dans le paquet d'un thème : le serveur le refuserait.";
     }
-    if ($header($head, 'Update URI') !== 'https://updates.wearewp.pro') {
-        $errors[] = 'En-tête Update URI absent ou différent de https://updates.wearewp.pro.';
+} else {
+    $required = ['wawp-updater/load.php', 'wawp-updater/bootstrap.php'];
+    foreach (['config', 'validator', 'signature', 'client', 'updater', 'package'] as $class) {
+        $required[] = "wawp-updater/src/class-$class.php";
+    }
+    foreach ($required as $file) {
+        if (!is_file("$dir/$file")) {
+            $errors[] = "$file absent du paquet.";
+        }
+    }
+
+    $main = $read("$dir/$slug.php");
+    if ($main === null) {
+        $errors[] = "Fichier principal $slug.php absent du paquet.";
+    } else {
+        if (strpos($main, 'wawp-updater/load.php') === false) {
+            $errors[] = "$slug.php ne charge pas wawp-updater/load.php.";
+        }
+        if (strpos($main, '\WAWP\Updater\register(') === false) {
+            $errors[] = "$slug.php n'appelle pas \\WAWP\\Updater\\register(.";
+        }
+        $head = substr($main, 0, 8192);
+        $declared = $header($head, 'Version');
+        if ($declared !== $version) {
+            $errors[] = 'En-tête Version (' . ($declared ?? 'absent') . ") différent de la version publiée ($version).";
+        }
+        if ($header($head, 'Update URI') !== 'https://updates.wearewp.pro') {
+            $errors[] = 'En-tête Update URI absent ou différent de https://updates.wearewp.pro.';
+        }
     }
 }
 
-$config = $read("$dir/wawp-updater/src/class-config.php");
+$config = $read("$dir/$library/src/class-config.php");
 $keys = [];
 if ($config !== null && preg_match('/const PUBLIC_KEYS = array\(([^)]*)\);/', $config, $m) === 1) {
     preg_match_all("/'([A-Za-z0-9+\\/=]+)'/", $m[1], $found);
@@ -87,7 +144,7 @@
     return $raw !== false && strlen($raw) === 32;
 });
 if (count($keys) !== 2 || count($validKeys) !== 2 || count(array_unique($validKeys)) !== 2) {
-    $errors[] = 'PUBLIC_KEYS doit contenir exactement deux clés publiques Ed25519 distinctes (wawp-updater/src/class-config.php).';
+    $errors[] = "PUBLIC_KEYS doit contenir exactement deux clés publiques Ed25519 distinctes ($library/src/class-config.php).";
 }
 
 $entries = new RecursiveIteratorIterator(new RecursiveDirectoryIterator($dir, FilesystemIterator::SKIP_DOTS), RecursiveIteratorIterator::SELF_FIRST);
diff --git a/tests/Unit/CheckPackageTest.php b/tests/Unit/CheckPackageTest.php
index 12de841..7dd6770 100644
--- a/tests/Unit/CheckPackageTest.php
+++ b/tests/Unit/CheckPackageTest.php
@@ -103,4 +103,31 @@ public function testEachDefectIsReported(): void
             self::assertStringContainsString($expected, $out, $label);
         }
     }
+
+    public function testFullErrorReportIsUnchanged(): void
+    {
+        unlink($this->dir . '/wawp-updater/bootstrap.php');
+        $this->write('wawp-demo.php', self::main(version: '1.3.9', register: ''));
+        [$code, $out, $err] = Cli::run([PHP_BINARY, Cli::php('scripts/check-package.php'), $this->dir, 'wawp-demo', '1.4.0']);
+        self::assertSame(1, $code);
+        self::assertSame('', $out);
+        self::assertSame(
+            "Paquet non conforme :\n- wawp-updater/bootstrap.php absent du paquet.\n- wawp-demo.php n'appelle pas \\WAWP\\Updater\\register(.\n- En-tête Version (1.3.9) différent de la version publiée (1.4.0).\n",
+            $err
+        );
+    }
+
+    public function testExplicitPluginTypeIsTheDefault(): void
+    {
+        $script = Cli::php('scripts/check-package.php');
+        self::assertSame(
+            Cli::run([PHP_BINARY, $script, $this->dir, 'wawp-demo', '1.4.0']),
+            Cli::run([PHP_BINARY, $script, '--type=plugin', $this->dir, 'wawp-demo', '1.4.0'])
+        );
+        unlink($this->dir . '/wawp-updater/load.php');
+        self::assertSame(
+            Cli::run([PHP_BINARY, $script, $this->dir, 'wawp-demo', '1.4.0']),
+            Cli::run([PHP_BINARY, $script, '--type=plugin', $this->dir, 'wawp-demo', '1.4.0'])
+        );
+    }
 }
diff --git a/tests/Unit/ThemeCheckPackageTest.php b/tests/Unit/ThemeCheckPackageTest.php
new file mode 100644
index 0000000..b45fad8
--- /dev/null
+++ b/tests/Unit/ThemeCheckPackageTest.php
@@ -0,0 +1,119 @@
+<?php
+
+declare(strict_types=1);
+
+namespace WAWP\ReleaseTools\Tests\Unit;
+
+use PHPUnit\Framework\TestCase;
+use WAWP\ReleaseTools\Tests\Support\Cli;
+use WAWP\ReleaseTools\Tests\Support\Keys;
+
+final class ThemeCheckPackageTest extends TestCase
+{
+    private const CLASSES = ['config', 'validator', 'theme-validator', 'signature', 'client', 'package', 'updater'];
+
+    private string $dir;
+    /** @var array{string, string} */
+    private array $keys;
+
+    protected function setUp(): void
+    {
+        $this->dir = sys_get_temp_dir() . '/wawp-theme-pkg-' . bin2hex(random_bytes(4)) . '/build/wawp-demo-theme';
+        mkdir($this->dir . '/wawp-theme-updater/src', 0777, true);
+        $this->keys = [Keys::pair()['public'], Keys::pair()['public']];
+        $this->write('style.css', self::style());
+        $this->write('functions.php', self::functions());
+        $this->write('wawp-theme-updater/load.php', "<?php\n");
+        $this->write('wawp-theme-updater/bootstrap.php', "<?php\n");
+        foreach (self::CLASSES as $class) {
+            $this->write("wawp-theme-updater/src/class-$class.php", "<?php\n");
+        }
+        $this->config($this->keys);
+    }
+
+    protected function tearDown(): void
+    {
+        $root = dirname($this->dir, 2);
+        $it = new \RecursiveIteratorIterator(new \RecursiveDirectoryIterator($root, \FilesystemIterator::SKIP_DOTS), \RecursiveIteratorIterator::CHILD_FIRST);
+        foreach ($it as $file) {
+            $file->isDir() ? rmdir($file->getPathname()) : unlink($file->getPathname());
+        }
+        rmdir($root);
+    }
+
+    private static function style(string $version = '1.4.0', string $uri = 'https://updates.wearewp.pro'): string
+    {
+        return "/*\nTheme Name: WAWP Démo\nVersion: $version\nRequires at least: 6.1\nRequires PHP: 7.4\nText Domain: wawp-demo-theme\nUpdate URI: $uri\n*/\n";
+    }
+
+    private static function functions(string $load = "require __DIR__ . '/wawp-theme-updater/load.php';", string $register = '\WAWP\ThemeUpdater\register( __DIR__ );'): string
+    {
+        return "<?php\ndefined( 'ABSPATH' ) || exit;\n\n$load\n$register\n";
+    }
+
+    private function write(string $path, string $content): void
+    {
+        file_put_contents($this->dir . '/' . $path, $content);
+    }
+
+    /** @param list<string> $keys */
+    private function config(array $keys): void
+    {
+        $list = implode(', ', array_map(static fn (string $key): string => "'$key'", $keys));
+        $this->write('wawp-theme-updater/src/class-config.php', "<?php\nfinal class Config {\n\tconst VERSION = '1.0.0';\n\tconst PUBLIC_KEYS = array( $list );\n}\n");
+    }
+
+    /** @return array{int, string} */
+    private function check(?string $dir = null, string $slug = 'wawp-demo-theme', string $version = '1.4.0', string $type = '--type=theme'): array
+    {
+        [$code, $out, $err] = Cli::run([PHP_BINARY, Cli::php('scripts/check-package.php'), $type, $dir ?? $this->dir, $slug, $version]);
+
+        return [$code, $out . $err];
+    }
+
+    public function testValidThemePackagePasses(): void
+    {
+        [$code, $out] = $this->check();
+        self::assertSame(0, $code, $out);
+        self::assertSame("Paquet conforme : wawp-demo-theme 1.4.0\n", $out);
+    }
+
+    public function testAThemePackageIsNotAPluginPackage(): void
+    {
+        [$code, $out] = $this->check(type: '--type=plugin');
+        self::assertSame(1, $code);
+        self::assertStringContainsString('Fichier principal wawp-demo-theme.php absent du paquet.', $out);
+    }
+
+    public function testEachDefectIsReported(): void
+    {
+        $cases = [
+            'load.php absent' => [fn () => unlink($this->dir . '/wawp-theme-updater/load.php'), null, 'wawp-theme-updater/load.php absent du paquet.'],
+            'bootstrap.php absent' => [fn () => unlink($this->dir . '/wawp-theme-updater/bootstrap.php'), null, 'wawp-theme-updater/bootstrap.php absent du paquet.'],
+            'functions.php absent' => [fn () => unlink($this->dir . '/functions.php'), null, 'functions.php absent du paquet.'],
+            'chargement absent' => [fn () => $this->write('functions.php', self::functions(load: '')), null, 'functions.php ne charge pas wawp-theme-updater/load.php.'],
+            'inscription absente' => [fn () => $this->write('functions.php', self::functions(register: '')), null, 'functions.php n\'appelle pas \\WAWP\\ThemeUpdater\\register(.'],
+            'style.css absent' => [fn () => unlink($this->dir . '/style.css'), null, 'style.css absent du paquet.'],
+            'version' => [fn () => $this->write('style.css', self::style(version: '1.3.9')), null, 'En-tête Version de style.css (1.3.9) différent de la version publiée (1.4.0).'],
+            'update uri' => [fn () => $this->write('style.css', self::style(uri: 'https://updates.wearewp.pro/')), null, 'Update URI'],
+            'fichier de plugin' => [fn () => $this->write('wawp-demo-theme.php', "<?php\n"), null, 'wawp-demo-theme.php présent'],
+            'une seule clé' => [fn () => $this->config([$this->keys[0]]), null, 'PUBLIC_KEYS doit contenir exactement deux clés publiques Ed25519 distinctes (wawp-theme-updater/src/class-config.php).'],
+            'clés identiques' => [fn () => $this->config([$this->keys[0], $this->keys[0]]), null, 'PUBLIC_KEYS'],
+            'dossier .git' => [fn () => mkdir($this->dir . '/vendor/lib/.git', 0777, true), null, '.git'],
+            'slug invalide' => [fn () => null, [null, 'Wawp_Demo', '1.4.0'], 'Slug invalide'],
+            'version invalide' => [fn () => null, [null, 'wawp-demo-theme', '1.4'], 'Version invalide'],
+            'dossier vide' => [fn () => null, ['', 'wawp-demo-theme', '1.4.0'], 'Dossier'],
+        ];
+        foreach (self::CLASSES as $class) {
+            $cases["class-$class.php absent"] = [fn () => unlink($this->dir . "/wawp-theme-updater/src/class-$class.php"), null, "wawp-theme-updater/src/class-$class.php absent du paquet."];
+        }
+        foreach ($cases as $label => [$mutate, $args, $expected]) {
+            $this->tearDown();
+            $this->setUp();
+            $mutate();
+            [$code, $out] = $args === null ? $this->check() : $this->check(...$args);
+            self::assertSame(1, $code, "$label : $out");
+            self::assertStringContainsString($expected, $out, $label);
+        }
+    }
+}

From 0779648b39c46ecea9d3e660d8cd9268ea9fd59a Mon Sep 17 00:00:00 2001
From: thierrypigot <contact@wearewp.pro>
Date: Tue, 13 Oct 2026 14:31:15 +0200
Subject: [PATCH 10/12] =?UTF-8?q?Pipeline=20des=20th=C3=A8mes=20:=20workfl?=
 =?UTF-8?q?ow=20theme-release.yml=20(v1.1),=20mod=C3=A8le,=20d=C3=A9tectio?=
 =?UTF-8?q?n=20dans=20setup-repo,=20proc=C3=A9dure?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .github/workflows/theme-release.yml | 187 ++++++++++++++++++++++++++++
 README.md                           |   9 +-
 bin/setup-repo.sh                   |  42 +++++--
 docs/mise-en-place.md               |  35 +++++-
 templates/theme-release.yml         |  14 +++
 tests/Unit/SetupRepoTest.php        |  19 +++
 tests/Unit/WorkflowPolicyTest.php   |  55 +++++++-
 7 files changed, 344 insertions(+), 17 deletions(-)
 create mode 100644 .github/workflows/theme-release.yml
 create mode 100644 templates/theme-release.yml

diff --git a/.github/workflows/theme-release.yml b/.github/workflows/theme-release.yml
new file mode 100644
index 0000000..63ed079
--- /dev/null
+++ b/.github/workflows/theme-release.yml
@@ -0,0 +1,187 @@
+name: Publication d'un thème
+
+on:
+  workflow_call:
+    inputs:
+      tools-ref:
+        description: Version de release-tools utilisée pour les scripts (doit correspondre à la version du workflow).
+        type: string
+        default: v1.1
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    name: Contrôles et paquet
+    if: startsWith(github.ref, 'refs/tags/v')
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
+    permissions:
+      contents: read
+    outputs:
+      slug: ${{ steps.meta.outputs.slug }}
+      version: ${{ steps.meta.outputs.version }}
+    steps:
+      - name: Code du thème
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          path: theme
+          persist-credentials: false
+
+      - name: Outils de publication
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          repository: wearewp/release-tools
+          ref: ${{ inputs.tools-ref }}
+          path: tools
+          persist-credentials: false
+
+      # Un relèvement de la version minimale sur main s'applique même aux appels épinglés sur un ancien tag.
+      - name: Version minimale de wawp-theme-updater exigée sur main
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          repository: wearewp/release-tools
+          ref: main
+          path: tools-main
+          sparse-checkout: config
+          persist-credentials: false
+
+      - name: Slug et version
+        id: meta
+        run: |
+          echo "slug=${GITHUB_REPOSITORY#*/}" >> "$GITHUB_OUTPUT"
+          echo "version=${GITHUB_REF_NAME#v}" >> "$GITHUB_OUTPUT"
+
+      - name: Contrôles avant publication
+        env:
+          SLUG: ${{ steps.meta.outputs.slug }}
+        run: |
+          ref_min="$(cat tools/config/min-theme-updater-version.txt)"
+          main_min="$(cat tools-main/config/min-theme-updater-version.txt)"
+          min="$(printf '%s\n%s\n' "$ref_min" "$main_min" | sort -V | tail -n 1)"
+          php tools/scripts/check-headers.php --type=theme theme "$SLUG" "$GITHUB_REF_NAME" "$min"
+
+      - name: Syntaxe PHP
+        run: find theme -name '*.php' -not -path '*/node_modules/*' -print0 | xargs -0 -n1 php -l > /dev/null
+
+      - name: Dépendances Composer
+        if: hashFiles('theme/composer.json') != ''
+        working-directory: theme
+        run: composer install --no-dev --prefer-dist --no-interaction --no-progress --optimize-autoloader
+
+      - name: Assets
+        if: hashFiles('theme/package.json') != ''
+        working-directory: theme
+        run: npm ci && npm run build
+
+      - name: Paquet
+        env:
+          SLUG: ${{ steps.meta.outputs.slug }}
+          VERSION: ${{ steps.meta.outputs.version }}
+        run: |
+          mkdir -p "build/$SLUG" dist
+          rsync -a --exclude-from=theme/.distignore --exclude=.git --exclude=.github theme/ "build/$SLUG/"
+          php tools/scripts/check-package.php --type=theme "build/$SLUG" "$SLUG" "$VERSION"
+          (cd build && zip -rqX "../dist/$SLUG-$VERSION.zip" "$SLUG")
+
+      - name: Conservation du paquet
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: paquet
+          path: dist/
+          retention-days: 1
+          if-no-files-found: error
+          overwrite: true
+
+  sign-upload:
+    name: Signature et envoi
+    needs: build
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    permissions:
+      contents: read
+    concurrency:
+      group: release-upload-${{ github.repository }}
+      cancel-in-progress: false
+    steps:
+      - name: Outils de publication
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          repository: wearewp/release-tools
+          ref: ${{ inputs.tools-ref }}
+          path: tools
+          persist-credentials: false
+
+      - name: Récupération du paquet
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          name: paquet
+          path: dist
+
+      - name: Installation de lftp
+        run: |
+          sudo apt-get update -qq
+          sudo apt-get install -y -qq lftp > /dev/null
+
+      - name: Signature
+        env:
+          SIGNING_KEY: ${{ secrets.SIGNING_KEY }}
+          ZIP: dist/${{ needs.build.outputs.slug }}-${{ needs.build.outputs.version }}.zip
+        run: php tools/scripts/sign.php "$ZIP"
+
+      - name: Envoi FTPS vers le serveur de mises à jour
+        env:
+          FTP_HOST: ${{ secrets.FTP_HOST }}
+          FTP_USER: ${{ secrets.FTP_USER }}
+          LFTP_PASSWORD: ${{ secrets.FTP_PASSWORD }}
+          ZIP: dist/${{ needs.build.outputs.slug }}-${{ needs.build.outputs.version }}.zip
+        run: bash tools/scripts/upload-ftps.sh "$ZIP"
+
+      - name: Conservation de la signature
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: signature
+          path: dist/*.sig
+          retention-days: 1
+          if-no-files-found: error
+          overwrite: true
+
+  publish-release:
+    name: Archive dans la Release GitHub
+    needs: [build, sign-upload]
+    runs-on: ubuntu-24.04
+    timeout-minutes: 5
+    permissions:
+      contents: write
+    steps:
+      - name: Récupération du paquet
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          name: paquet
+          path: dist
+
+      - name: Récupération de la signature
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          name: signature
+          path: dist
+
+      - name: Release
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          if gh release view "$GITHUB_REF_NAME" --repo "$GITHUB_REPOSITORY" > /dev/null 2>&1; then
+            assets="$(gh release view "$GITHUB_REF_NAME" --repo "$GITHUB_REPOSITORY" --json assets --jq '.assets[].name')"
+            for file in dist/*; do
+              while IFS= read -r asset; do
+                if [ "$asset" = "$(basename "$file")" ]; then
+                  echo "La Release $GITHUB_REF_NAME contient déjà $asset : aucun remplacement automatique. Vérifier l'asset existant et le supprimer à la main s'il doit être remplacé, puis relancer le job." >&2
+                  exit 1
+                fi
+              done <<< "$assets"
+            done
+            gh release upload "$GITHUB_REF_NAME" dist/* --repo "$GITHUB_REPOSITORY"
+          else
+            gh release create "$GITHUB_REF_NAME" dist/* --repo "$GITHUB_REPOSITORY" --title "$GITHUB_REF_NAME" --notes "Paquet signé publié sur updates.wearewp.pro."
+          fi
diff --git a/README.md b/README.md
index 66558d4..7d3b50d 100644
--- a/README.md
+++ b/README.md
@@ -1,10 +1,11 @@
 # release-tools
 
-Outils de publication des plugins WeAre[WP] et client de mise à jour `wawp-updater`.
+Outils de publication des plugins et des thèmes WeAre[WP], clients de mise à jour `wawp-updater` (plugins) et `wawp-theme-updater` (thèmes).
 
-- `wawp-updater/` : bibliothèque embarquée dans chaque plugin (PHP 7.4+, WordPress 5.8+). Vérifie les mises à jour sur `updates.wearewp.pro` avec la clé `WAWP_LICENSE_KEY` et refuse tout paquet dont la signature Ed25519 est invalide.
-- `.github/workflows/plugin-release.yml` : workflow réutilisable, déclenché par un tag `vX.Y.Z` dans le dépôt d'un plugin.
-- `scripts/`, `bin/` : contrôles, signature, envoi FTPS, génération des clés, préparation d'un dépôt.
+- `wawp-updater/` : bibliothèque embarquée dans chaque plugin (PHP 7.4+, WordPress 5.8+). Vérifie les mises à jour sur `updates.wearewp.pro` avec la clé `WAWP_LICENSE_KEY` et refuse tout paquet dont la signature Ed25519 est invalide. Figée en version 1.0.0.
+- `wawp-theme-updater/` : bibliothèque embarquée dans le thème FSE autonome d'un client (PHP 7.4+, WordPress 6.1+), mêmes garanties, chargée par `functions.php`.
+- `.github/workflows/plugin-release.yml` (tag `v1`) et `.github/workflows/theme-release.yml` (tag `v1.1`) : workflows réutilisables, déclenchés par un tag `vX.Y.Z` dans le dépôt d'un plugin ou d'un thème.
+- `scripts/`, `bin/` : contrôles (`--type=theme` pour un thème), signature, envoi FTPS, génération des clés, préparation d'un dépôt.
 
 Ce dépôt ne contient aucun secret. Mise en place : `docs/mise-en-place.md`.
 
diff --git a/bin/setup-repo.sh b/bin/setup-repo.sh
index 4fab521..1110fd4 100644
--- a/bin/setup-repo.sh
+++ b/bin/setup-repo.sh
@@ -1,6 +1,6 @@
 #!/usr/bin/env bash
-# Prépare un dépôt de plugin pour la publication automatique. Ne manipule jamais la valeur d'un secret.
-# Usage : bash bin/setup-repo.sh wearewp/<slug> <chemin-local-du-plugin>
+# Prépare un dépôt de plugin ou de thème pour la publication automatique. Ne manipule jamais la valeur d'un secret.
+# Usage : bash bin/setup-repo.sh wearewp/<slug> <chemin-local-du-plugin-ou-du-thème>
 set -euo pipefail
 
 repo="${1:-}"
@@ -17,6 +17,15 @@ if [ -z "$path" ] || [ ! -d "$path" ]; then
 fi
 slug="${repo#wearewp/}"
 
+# Thème : style.css avec Theme Name et pas de <slug>.php (même règle que l'ingestion du serveur).
+kind=plugin
+template="release.yml"
+if [ -f "$path/style.css" ] && grep -q 'Theme Name:' "$path/style.css" && [ ! -f "$path/$slug.php" ]; then
+    kind=theme
+    template="theme-release.yml"
+fi
+echo "Type détecté : $kind."
+
 visibility="$(gh api "repos/$repo" --jq '.visibility')"
 if [ "$visibility" != "private" ]; then
     echo "Le dépôt $repo doit être privé (visibilité actuelle : $visibility)." >&2
@@ -49,8 +58,8 @@ mkdir -p "$path/.github/workflows"
 if [ -f "$path/.github/workflows/release.yml" ]; then
     echo "release.yml déjà présent : non modifié."
 else
-    cp "$tools/templates/release.yml" "$path/.github/workflows/release.yml"
-    echo "release.yml créé : à commiter."
+    cp "$tools/templates/$template" "$path/.github/workflows/release.yml"
+    echo "release.yml créé à partir de templates/$template : à commiter."
 fi
 
 status=0
@@ -58,12 +67,23 @@ if [ ! -f "$path/.distignore" ]; then
     echo "À faire : créer $path/.distignore (fichiers exclus du paquet)." >&2
     status=1
 fi
-if ! grep -qE '^[[:space:]*#@/]*Update URI:[[:space:]]*https://updates\.wearewp\.pro[[:space:]]*$' "$path/$slug.php" 2>/dev/null; then
-    echo "À faire : ajouter l'en-tête « Update URI: https://updates.wearewp.pro » dans $slug.php." >&2
-    status=1
-fi
-if [ ! -f "$path/wawp-updater/load.php" ]; then
-    echo "À faire : copier wawp-updater/ dans le plugin et ajouter le chargement (voir docs/mise-en-place.md)." >&2
-    status=1
+if [ "$kind" = theme ]; then
+    if ! grep -qE '^[[:space:]*#@/]*Update URI:[[:space:]]*https://updates\.wearewp\.pro[[:space:]]*$' "$path/style.css" 2>/dev/null; then
+        echo "À faire : ajouter l'en-tête « Update URI: https://updates.wearewp.pro » dans style.css." >&2
+        status=1
+    fi
+    if [ ! -f "$path/wawp-theme-updater/load.php" ]; then
+        echo "À faire : copier wawp-theme-updater/ dans le thème et ajouter le chargement dans functions.php (voir docs/mise-en-place.md)." >&2
+        status=1
+    fi
+else
+    if ! grep -qE '^[[:space:]*#@/]*Update URI:[[:space:]]*https://updates\.wearewp\.pro[[:space:]]*$' "$path/$slug.php" 2>/dev/null; then
+        echo "À faire : ajouter l'en-tête « Update URI: https://updates.wearewp.pro » dans $slug.php." >&2
+        status=1
+    fi
+    if [ ! -f "$path/wawp-updater/load.php" ]; then
+        echo "À faire : copier wawp-updater/ dans le plugin et ajouter le chargement (voir docs/mise-en-place.md)." >&2
+        status=1
+    fi
 fi
 exit "$status"
diff --git a/docs/mise-en-place.md b/docs/mise-en-place.md
index 67fc6db..c557ce4 100644
--- a/docs/mise-en-place.md
+++ b/docs/mise-en-place.md
@@ -1,4 +1,4 @@
-# Mise en place de la publication des plugins WeAre[WP]
+# Mise en place de la publication des plugins et des thèmes WeAre[WP]
 
 Procédure unique, à suivre dans l'ordre. Les étapes marquées 🔒 manipulent des secrets : Thierry les exécute lui-même, dans son propre terminal, jamais dans une session automatisée.
 
@@ -98,6 +98,39 @@ Suivre la section 11 de la spec (`docs/superpowers/specs/2026-10-12-serveur-mise
 
 La version de rotation de `wawp-updater` incrémente `$wawp_updater_version` dans `load.php` et `Config::VERSION` dans `src/class-config.php`, toujours égales (par exemple `1.0.0` vers `1.1.0`) : c'est la copie la plus récente qui est chargée sur un site. Une fois cette version taguée, relever `config/min-updater-version.txt` sur la branche `main` de release-tools à cette même version : chaque publication lit aussi ce fichier sur `main` et retient la plus haute des deux valeurs, ce qui bloque la publication d'un plugin qui embarque encore l'ancien client, même si son workflow est épinglé sur un ancien tag.
 
+## 9. Tag `v1.1` de release-tools (une seule fois)
+
+Les thèmes utilisent `theme-release.yml@v1.1` ; les plugins restent sur `@v1`. Après fusion sur `main` de la branche qui ajoute `wawp-theme-updater/` et `theme-release.yml`, depuis un clone de release-tools, dans Git Bash (`gh` authentifié comme à l'étape 5) :
+
+```
+git checkout main && git pull
+git tag v1.1
+git push origin v1.1
+```
+
+Le ruleset de l'étape 5 protège aussi ce tag (motif `refs/tags/v*`) : il ne pourra être ni déplacé ni supprimé.
+
+## 10. Préparer un dépôt de thème
+
+Le thème est un thème FSE autonome (pas de thème parent, pas d'en-tête `Template`), actif sur un seul site. Le dépôt appartient à l'organisation `wearewp`, est privé et porte le nom du slug du thème, qui est aussi le nom de son dossier et son `Text Domain`.
+
+1. Copier `wawp-theme-updater/` (version taguée `v1.1`) à la racine du thème : `git -C <release-tools> archive v1.1 wawp-theme-updater | tar -x -C <thème>`.
+2. Dans `functions.php`, après le contrôle `ABSPATH` :
+   ```php
+   require __DIR__ . '/wawp-theme-updater/load.php';
+   \WAWP\ThemeUpdater\register( __DIR__ );
+   ```
+3. Dans `style.css` : `Update URI: https://updates.wearewp.pro`, `Requires at least: 6.1` (ou plus), `Requires PHP`, `Text Domain: <slug>`, `Version` à la prochaine version mineure.
+4. Créer `.distignore` avec des motifs racine ancrés par `/` (`/.git`, `/.github`, `/node_modules`, `/src`…).
+5. Contrôler localement : `php <release-tools>/scripts/check-headers.php --type=theme <thème> <slug> v<version> 1.0.0` → `Contrôles réussis`.
+6. Lancer, dans Git Bash, depuis le dossier de release-tools : `bash bin/setup-repo.sh wearewp/<slug> <chemin-local-du-thème>` (`Type détecté : theme.`), puis commiter `.github/workflows/release.yml`.
+7. Ajouter le slug à la liste `themes` de la licence du site (`bin/new-key.php --theme=<slug>` pour une nouvelle licence, ou édition du registre puis `bin/check-licences.php`).
+8. Publier comme un plugin (section 7, sans `readme.txt`), puis, après sauvegarde du site, installer une fois le zip publié à la main (Apparence › Thèmes › Ajouter › Téléverser, remplacer le thème actif). Les versions suivantes passent par les mises à jour de WordPress.
+
+Le client des thèmes ne place jamais l'adresse de téléchargement dans le cache de WordPress, mais un marqueur `https://updates.wearewp.pro/v1/theme-update/<slug>` : `wawp-updater` 1.0.0, embarqué dans les plugins, refuse toute adresse `/v1/download/` hors d'une mise à jour de plugin. Une rotation de clé de signature (section 8) concerne aussi `wawp-theme-updater/src/class-config.php` (même `PUBLIC_KEYS`) et `config/min-theme-updater-version.txt`.
+
 ## Limite connue
 
 WordPress n'appelle les filtres `Update URI` qu'après une réponse réussie d'`api.wordpress.org`. Si ce service est injoignable depuis un site, les mises à jour WeAre[WP] n'y apparaissent pas tant que la situation dure ; elles réapparaissent dès le contrôle suivant.
+
+Il en va de même pour les thèmes (filtre `update_themes_updates.wearewp.pro`). WordPress envoie aussi à api.wordpress.org la liste des thèmes installés, dont le slug du thème client : si un thème public de wordpress.org portait le même slug, sa mise à jour serait proposée à la place. Choisir des slugs de thèmes propres au client.
diff --git a/templates/theme-release.yml b/templates/theme-release.yml
new file mode 100644
index 0000000..1bdf1be
--- /dev/null
+++ b/templates/theme-release.yml
@@ -0,0 +1,14 @@
+name: Publication
+
+on:
+  push:
+    tags: ['v*.*.*']
+
+permissions: {}
+
+jobs:
+  release:
+    permissions:
+      contents: write
+    uses: wearewp/release-tools/.github/workflows/theme-release.yml@v1.1
+    secrets: inherit
diff --git a/tests/Unit/SetupRepoTest.php b/tests/Unit/SetupRepoTest.php
index 9973e22..f5f312e 100644
--- a/tests/Unit/SetupRepoTest.php
+++ b/tests/Unit/SetupRepoTest.php
@@ -56,4 +56,23 @@ public function testRefusesBadArguments(): void
         self::assertSame(1, $code);
         self::assertStringContainsString('wearewp/', $err);
     }
+
+    public function testThemesAreDetectedAndGetTheThemeWorkflow(): void
+    {
+        $script = self::script();
+        foreach ([
+            'if [ -f "$path/style.css" ] && grep -q \'Theme Name:\' "$path/style.css" && [ ! -f "$path/$slug.php" ]; then',
+            'template="theme-release.yml"',
+            'cp "$tools/templates/$template" "$path/.github/workflows/release.yml"',
+            'echo "Type détecté : $kind."',
+            "\"\$path/style.css\" 2>/dev/null",
+            'wawp-theme-updater/load.php',
+        ] as $needle) {
+            self::assertStringContainsString($needle, $script, $needle);
+        }
+        // Contrôles d'origine des plugins conservés.
+        foreach (['template="release.yml"', '"$path/$slug.php" 2>/dev/null', '"$path/wawp-updater/load.php"'] as $needle) {
+            self::assertStringContainsString($needle, $script, $needle);
+        }
+    }
 }
diff --git a/tests/Unit/WorkflowPolicyTest.php b/tests/Unit/WorkflowPolicyTest.php
index bfaf135..bb99c4e 100644
--- a/tests/Unit/WorkflowPolicyTest.php
+++ b/tests/Unit/WorkflowPolicyTest.php
@@ -28,7 +28,7 @@ private static function jobs(string $yaml): array
 
     public function testEveryActionIsOfficialAndPinnedBySha(): void
     {
-        foreach (['.github/workflows/plugin-release.yml', 'templates/release.yml'] as $path) {
+        foreach (['.github/workflows/plugin-release.yml', 'templates/release.yml', '.github/workflows/theme-release.yml', 'templates/theme-release.yml'] as $path) {
             preg_match_all('/^\s*(?:-\s*)?uses:\s*(\S+)/m', self::file($path), $m);
             foreach ($m[1] as $uses) {
                 if (str_starts_with($uses, 'wearewp/release-tools/')) {
@@ -168,4 +168,57 @@ public function testUploadScriptValidatesThePackageNameBeforeLftp(): void
         self::assertSame(1, $code);
         self::assertStringNotContainsString('Nom de paquet invalide', $err);
     }
+
+    public function testThemeWorkflowSharesSigningAndReleaseJobsWithThePluginOne(): void
+    {
+        $yaml = self::file('.github/workflows/theme-release.yml');
+        $plugin = self::jobs(self::file('.github/workflows/plugin-release.yml'));
+        $theme = self::jobs($yaml);
+        self::assertSame(['build', 'sign-upload', 'publish-release'], array_keys($theme));
+        self::assertSame($plugin['sign-upload'], $theme['sign-upload'], 'signature et envoi : aucun écart avec les plugins');
+        self::assertSame($plugin['publish-release'], $theme['publish-release']);
+        self::assertStringContainsString("permissions:
+  contents: read
+", $yaml);
+        self::assertStringContainsString("        default: v1.1
+", $yaml);
+        self::assertSame(2, substr_count($yaml, 'overwrite: true'));
+        self::assertStringNotContainsString('--clobber', $yaml);
+    }
+
+    public function testThemeBuildJobChecksTheThemeWithoutSecrets(): void
+    {
+        $build = self::jobs(self::file('.github/workflows/theme-release.yml'))['build'];
+        self::assertStringNotContainsString('secrets.', $build);
+        self::assertStringContainsString("if: startsWith(github.ref, 'refs/tags/v')", $build);
+        self::assertStringContainsString('timeout-minutes:', $build);
+        self::assertSame(substr_count($build, 'actions/checkout@'), substr_count($build, 'persist-credentials: false'));
+
+        $steps = self::steps($build);
+        $main = $steps['Version minimale de wawp-theme-updater exigée sur main'] ?? '';
+        foreach (['repository: wearewp/release-tools', 'ref: main', 'path: tools-main', 'sparse-checkout: config', 'persist-credentials: false'] as $needle) {
+            self::assertStringContainsString($needle, $main, $needle);
+        }
+        $checks = $steps['Contrôles avant publication'] ?? '';
+        foreach (['tools/config/min-theme-updater-version.txt', 'tools-main/config/min-theme-updater-version.txt', 'sort -V | tail -n 1', 'php tools/scripts/check-headers.php --type=theme theme "$SLUG" "$GITHUB_REF_NAME" "$min"'] as $needle) {
+            self::assertStringContainsString($needle, $checks, $needle);
+        }
+        $package = $steps['Paquet'] ?? '';
+        $rsync = (int) strpos($package, 'rsync -a --exclude-from=theme/.distignore');
+        $check = (int) strpos($package, 'php tools/scripts/check-package.php --type=theme "build/$SLUG" "$SLUG" "$VERSION"');
+        $zip = (int) strpos($package, 'zip -rqX');
+        self::assertGreaterThan(0, $rsync);
+        self::assertLessThan($check, $rsync);
+        self::assertLessThan($zip, $check);
+    }
+
+    public function testThemeCallerTemplate(): void
+    {
+        $yaml = self::file('templates/theme-release.yml');
+        self::assertStringContainsString("tags: ['v*.*.*']", $yaml);
+        self::assertStringContainsString('permissions: {}', $yaml);
+        self::assertStringContainsString('uses: wearewp/release-tools/.github/workflows/theme-release.yml@v1.1', $yaml);
+        self::assertStringContainsString('secrets: inherit', $yaml);
+        self::assertStringContainsString('uses: wearewp/release-tools/.github/workflows/plugin-release.yml@v1', self::file('templates/release.yml'), 'les plugins restent sur v1');
+    }
 }

From ccddc9f1bd4ed74b2ed2addcc8c5d408d9952bf7 Mon Sep 17 00:00:00 2001
From: thierrypigot <contact@wearewp.pro>
Date: Tue, 13 Oct 2026 14:39:03 +0200
Subject: [PATCH 11/12] =?UTF-8?q?E2E=20:=20mise=20=C3=A0=20jour=20d'un=20t?=
 =?UTF-8?q?h=C3=A8me=20sur=20un=20vrai=20WordPress,=20avec=20wawp-updater?=
 =?UTF-8?q?=20actif,=20paquet=20alt=C3=A9r=C3=A9=20refus=C3=A9?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Le faux api.wordpress.org du harnais répond désormais {"error":"Theme not found"} aux requêtes themes/info, comme wordpress.org pour un thème inconnu : sinon themes_api() renvoie un objet sans version et WP-CLI refuse la mise à jour (« version higher than expected »).
---
 .../e2e/fixture/wawp-test-theme/functions.php | 11 +++
 tests/e2e/fixture/wawp-test-theme/style.css   |  9 ++
 .../wawp-test-theme/templates/index.html      |  1 +
 tests/e2e/fixture/wawp-test-theme/theme.json  |  4 +
 tests/e2e/run.php                             | 90 ++++++++++++++++++-
 5 files changed, 113 insertions(+), 2 deletions(-)
 create mode 100644 tests/e2e/fixture/wawp-test-theme/functions.php
 create mode 100644 tests/e2e/fixture/wawp-test-theme/style.css
 create mode 100644 tests/e2e/fixture/wawp-test-theme/templates/index.html
 create mode 100644 tests/e2e/fixture/wawp-test-theme/theme.json

diff --git a/tests/e2e/fixture/wawp-test-theme/functions.php b/tests/e2e/fixture/wawp-test-theme/functions.php
new file mode 100644
index 0000000..ff934c9
--- /dev/null
+++ b/tests/e2e/fixture/wawp-test-theme/functions.php
@@ -0,0 +1,11 @@
+<?php
+/**
+ * Thème de validation de la chaîne de mise à jour WeAre[WP].
+ *
+ * @package wawp-test-theme
+ */
+
+defined( 'ABSPATH' ) || exit;
+
+require __DIR__ . '/wawp-theme-updater/load.php';
+\WAWP\ThemeUpdater\register( __DIR__ );
diff --git a/tests/e2e/fixture/wawp-test-theme/style.css b/tests/e2e/fixture/wawp-test-theme/style.css
new file mode 100644
index 0000000..f9f6c4a
--- /dev/null
+++ b/tests/e2e/fixture/wawp-test-theme/style.css
@@ -0,0 +1,9 @@
+/*
+Theme Name: WAWP Test Theme
+Description: Thème de validation de la chaîne de mise à jour WeAre[WP].
+Version: {{VERSION}}
+Requires at least: 6.1
+Requires PHP: 7.4
+Text Domain: wawp-test-theme
+Update URI: https://updates.wearewp.pro
+*/
diff --git a/tests/e2e/fixture/wawp-test-theme/templates/index.html b/tests/e2e/fixture/wawp-test-theme/templates/index.html
new file mode 100644
index 0000000..888d746
--- /dev/null
+++ b/tests/e2e/fixture/wawp-test-theme/templates/index.html
@@ -0,0 +1 @@
+<!-- wp:post-content /-->
diff --git a/tests/e2e/fixture/wawp-test-theme/theme.json b/tests/e2e/fixture/wawp-test-theme/theme.json
new file mode 100644
index 0000000..93f20c3
--- /dev/null
+++ b/tests/e2e/fixture/wawp-test-theme/theme.json
@@ -0,0 +1,4 @@
+{
+	"$schema": "https://schemas.wp.org/wp/6.1/theme.json",
+	"version": 2
+}
diff --git a/tests/e2e/run.php b/tests/e2e/run.php
index 1c7e7c9..eae0c75 100644
--- a/tests/e2e/run.php
+++ b/tests/e2e/run.php
@@ -18,6 +18,7 @@
 $endpoint = "http://127.0.0.1:$port";
 $slug = 'wawp-test-plugin';
 $basename = "$slug/$slug.php";
+$themeSlug = 'wawp-test-theme';
 $failures = 0;
 $masks = array();
 
@@ -133,10 +134,10 @@
 $key = \WAWP\UpdateServer\Licence\KeyGenerator::key();
 $masks[] = $key;
 $hasher = new \WAWP\UpdateServer\Licence\KeyHasher(\WAWP\UpdateServer\Secrets::loadHex("$data/secrets/key_pepper"));
-$writeLicences = static function (bool $active) use ($data, $hasher, $key, $slug): void {
+$writeLicences = static function (bool $active, bool $withTheme = true) use ($data, $hasher, $key, $slug, $themeSlug): void {
     file_put_contents("$data/licences.json", (string) json_encode(['schema' => 1, 'licences' => [[
         'id' => 'lic_e2eclient', 'key_hash' => $hasher->hash($key), 'client' => 'E2E', 'domains' => ['127.0.0.1'],
-        'plugins' => [$slug], 'expires' => null, 'active' => $active,
+        'plugins' => [$slug], 'themes' => $withTheme ? [$themeSlug] : [], 'expires' => null, 'active' => $active,
     ]]], JSON_PRETTY_PRINT));
 };
 $writeLicences(true);
@@ -192,6 +193,42 @@
     return $signCode === 0 && $ingestCode === 0 && $published;
 };
 
+// 3 bis. Construction et publication d'une version du thème de test.
+$makeTheme = static function (string $version, string $target) use ($e2e, $root, $copy, $endpoint, $public): void {
+    foreach (['style.css', 'functions.php', 'theme.json', 'templates/index.html'] as $file) {
+        @mkdir(dirname("$target/$file"), 0777, true);
+        file_put_contents("$target/$file", str_replace('{{VERSION}}', $version, (string) file_get_contents("$e2e/fixture/wawp-test-theme/$file")));
+    }
+    $copy("$root/wawp-theme-updater", "$target/wawp-theme-updater");
+    $config = (string) file_get_contents("$target/wawp-theme-updater/src/class-config.php");
+    $config = (string) preg_replace("/const ENDPOINT = '[^']*';/", "const ENDPOINT = '$endpoint';", $config);
+    $config = (string) preg_replace('/const PUBLIC_KEYS = array\([^)]*\);/', "const PUBLIC_KEYS = array( '$public' );", $config);
+    file_put_contents("$target/wawp-theme-updater/src/class-config.php", $config);
+};
+
+$publishTheme = static function (string $version, bool $corruptAfter = false) use ($tmp, $data, $themeSlug, $makeTheme, $remove, $run, $root, $secret): bool {
+    $build = "$tmp/build-theme/$themeSlug";
+    $remove("$tmp/build-theme");
+    $makeTheme($version, $build);
+    $zipPath = "$data/incoming/$themeSlug-$version.zip";
+    $zip = new ZipArchive();
+    $zip->open($zipPath, ZipArchive::CREATE | ZipArchive::OVERWRITE);
+    $files = new RecursiveIteratorIterator(new RecursiveDirectoryIterator($build, FilesystemIterator::SKIP_DOTS));
+    foreach ($files as $file) {
+        $relative = str_replace('\\', '/', substr($file->getPathname(), strlen("$tmp/build-theme/")));
+        $zip->addFile($file->getPathname(), $relative);
+    }
+    $zip->close();
+    [$signCode] = $run([PHP_BINARY, "$root/scripts/sign.php", $zipPath], ['SIGNING_KEY' => $secret]);
+    [$ingestCode] = $run([PHP_BINARY, "$data/bin/ingest.php"]);
+    $published = is_file("$data/packages/$themeSlug/$themeSlug-$version.zip");
+    if ($corruptAfter && $published) {
+        file_put_contents("$data/packages/$themeSlug/$themeSlug-$version.zip", 'corruption', FILE_APPEND);
+    }
+
+    return $signCode === 0 && $ingestCode === 0 && $published;
+};
+
 // 4. WordPress avec SQLite.
 $wpDir = "$tmp/wp";
 $unzip($wpZip, $tmp);
@@ -228,6 +265,7 @@
     . "add_filter( 'pre_http_request', static function ( \$pre, \$args, \$url ) {\n"
     . "\t\$host = (string) wp_parse_url( \$url, PHP_URL_HOST );\n"
     . "\tif ( '127.0.0.1' === \$host ) { return \$pre; }\n"
+    . "\tif ( 'api.wordpress.org' === \$host && false !== strpos( \$url, '/themes/info/' ) ) { return array( 'headers' => array(), 'body' => '{\"error\":\"Theme not found\"}', 'response' => array( 'code' => 200, 'message' => 'OK' ), 'cookies' => array(), 'filename' => null ); }\n"
     . "\tif ( 'api.wordpress.org' === \$host ) { return array( 'headers' => array(), 'body' => '{\"plugins\":[],\"translations\":[],\"no_update\":[],\"themes\":[]}', 'response' => array( 'code' => 200, 'message' => 'OK' ), 'cookies' => array(), 'filename' => null ); }\n"
     . "\treturn new WP_Error( 'e2e_reseau_bloque', \$host );\n"
     . "}, 10, 3 );\n");
@@ -235,6 +273,10 @@
 $wp = static function (string ...$args) use ($run, $wpcli, $wpDir): array {
     return $run(array_merge([PHP_BINARY, $wpcli, "--path=$wpDir", '--skip-themes'], $args));
 };
+// Commandes WP-CLI avec le thème actif chargé (son functions.php charge wawp-theme-updater).
+$wpTheme = static function (string ...$args) use ($run, $wpcli, $wpDir): array {
+    return $run(array_merge([PHP_BINARY, $wpcli, "--path=$wpDir"], $args));
+};
 [$code, $out] = $wp('core', 'install', '--url=http://127.0.0.1:8768', '--title=E2E', '--admin_user=e2e', '--admin_password=' . bin2hex(random_bytes(16)), '--admin_email=e2e@example.test', '--skip-email');
 $check('installation de WordPress (SQLite)', $code === 0, $out);
 
@@ -339,6 +381,50 @@
     $check('licence révoquée : refus inactive journalisé', count($denied) >= 1);
     $writeLicences(true);
 
+    // f. Thème : offre, marqueur dans le cache, jeton frais, installation avec wawp-updater actif, paquet altéré refusé.
+    $makeTheme('1.0.0', "$wpDir/wp-content/themes/$themeSlug");
+    [$code, $out] = $wpTheme('theme', 'activate', $themeSlug);
+    $check('activation du thème de test 1.0.0', $code === 0, $out);
+    $themeVersion = static function () use ($wpTheme, $themeSlug): string {
+        return trim($wpTheme('theme', 'get', $themeSlug, '--field=version')[1]);
+    };
+    // Renvoie la version proposée ('' si aucune) ou '#erreur' si WP-CLI échoue.
+    $themeUpdateVersion = static function () use ($wpTheme, $themeSlug): string {
+        [$code, $out] = $wpTheme('theme', 'list', "--name=$themeSlug", '--fields=name,update_version', '--format=json');
+        $list = $code === 0 ? json_decode($out, true) : null;
+        if (!is_array($list) || !isset($list[0]['name'], $list[0]['update_version']) || $list[0]['name'] !== $themeSlug) {
+            return '#erreur';
+        }
+
+        return (string) $list[0]['update_version'];
+    };
+    $flushTheme = static function () use ($wp): void {
+        $wp('eval', 'delete_site_transient( "wawp_theme_updater_check" ); delete_site_transient( "update_themes" );');
+    };
+
+    $check('publication du thème 1.1.0', $publishTheme('1.1.0'));
+    $flushTheme();
+    $check('mise à jour du thème 1.1.0 proposée', $themeUpdateVersion() === '1.1.0');
+    [$markerCode, $marker] = $wpTheme('eval', '$t = get_site_transient( "update_themes" ); echo $t->response["' . $themeSlug . '"]["package"] ?? "absent";');
+    $check('cache de WordPress : marqueur de paquet, aucun jeton', $markerCode === 0 && trim($marker) === "$endpoint/v1/theme-update/$themeSlug", $marker);
+    $linesBefore = count($accessLines());
+    [$code, $out] = $wpTheme('theme', 'update', $themeSlug);
+    $check('mise à jour du thème 1.1.0 installée', $code === 0 && $themeVersion() === '1.1.0', $out);
+    $joined = implode("\n", array_slice($accessLines(), $linesBefore));
+    $check('journal : check frais du thème puis téléchargement de type theme', str_contains($joined, '"installed_themes":{"' . $themeSlug . '":"1.0.0"}') && str_contains($joined, '"slug":"' . $themeSlug . '","version":"1.1.0","type":"theme"'), $joined);
+    $check('wawp-updater (plugin de test) actif pendant la mise à jour du thème', $wp('plugin', 'is-active', $slug)[0] === 0);
+
+    $check('publication du thème 1.2.0 puis altération', $publishTheme('1.2.0', true));
+    $flushTheme();
+    [$code, $out] = $wpTheme('theme', 'update', $themeSlug);
+    $check('thème altéré refusé', $code !== 0 && str_contains($out, 'Signature du thème WeAre[WP] invalide') && $themeVersion() === '1.1.0', $out);
+    $check('thème toujours actif', trim($wp('option', 'get', 'stylesheet')[1]) === $themeSlug);
+
+    $writeLicences(true, false);
+    $flushTheme();
+    $check('thème non couvert par la licence : aucune offre', $themeUpdateVersion() === '');
+    $writeLicences(true);
+
     // e. Clé retirée de wp-config.php : aucune requête vers le serveur.
     $logs = static function () use ($accessLines): int {
         return count($accessLines());

From 3023a42ed1ae6cb9df39f9d222484cd410e3b3eb Mon Sep 17 00:00:00 2001
From: thierrypigot <contact@wearewp.pro>
Date: Tue, 13 Oct 2026 14:53:17 +0200
Subject: [PATCH 12/12] =?UTF-8?q?Revue=20finale=20:=20nettoyage=20du=20fic?=
 =?UTF-8?q?hier=20temporaire=20sur=20exception,=20motifs=20d'en-t=C3=AAtes?=
 =?UTF-8?q?=20align=C3=A9s=20sur=20le=20serveur,=20contr=C3=B4les=20de=20c?=
 =?UTF-8?q?heck-package=20pour=20les=20th=C3=A8mes,=20tests=20de=20rejet?=
 =?UTF-8?q?=20et=20documentation=20de=20Theme=20URI?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 docs/mise-en-place.md                    |  2 +-
 scripts/check-headers.php                |  4 ++--
 scripts/check-package.php                |  6 ++++++
 tests/Unit/SharedCodeTest.php            |  9 +++++++++
 tests/Unit/ThemeCheckHeadersTest.php     |  3 +++
 tests/Unit/ThemeCheckPackageTest.php     |  6 ++++--
 tests/Unit/ThemePackageTest.php          |  3 +++
 tests/Unit/ThemeUpdaterTest.php          | 18 ++++++++++++++++++
 tests/Unit/ThemeValidatorTest.php        |  3 +++
 tests/wp-stubs.php                       |  9 +++++++--
 wawp-theme-updater/src/class-updater.php |  6 ++++++
 11 files changed, 62 insertions(+), 7 deletions(-)

diff --git a/docs/mise-en-place.md b/docs/mise-en-place.md
index c557ce4..78f6ffa 100644
--- a/docs/mise-en-place.md
+++ b/docs/mise-en-place.md
@@ -120,7 +120,7 @@ Le thème est un thème FSE autonome (pas de thème parent, pas d'en-tête `Temp
    require __DIR__ . '/wawp-theme-updater/load.php';
    \WAWP\ThemeUpdater\register( __DIR__ );
    ```
-3. Dans `style.css` : `Update URI: https://updates.wearewp.pro`, `Requires at least: 6.1` (ou plus), `Requires PHP`, `Text Domain: <slug>`, `Version` à la prochaine version mineure.
+3. Dans `style.css` : `Update URI: https://updates.wearewp.pro`, `Requires at least: 6.1` (ou plus), `Requires PHP`, `Text Domain: <slug>`, `Version` à la prochaine version mineure. `Theme URI` est facultatif, mais s'il est vide le lien « Voir les détails de la version » de WordPress ne mène nulle part d'utile : renseigner `Theme URI: https://www.wearewp.pro/` (recommandé).
 4. Créer `.distignore` avec des motifs racine ancrés par `/` (`/.git`, `/.github`, `/node_modules`, `/src`…).
 5. Contrôler localement : `php <release-tools>/scripts/check-headers.php --type=theme <thème> <slug> v<version> 1.0.0` → `Contrôles réussis`.
 6. Lancer, dans Git Bash, depuis le dossier de release-tools : `bash bin/setup-repo.sh wearewp/<slug> <chemin-local-du-thème>` (`Type détecté : theme.`), puis commiter `.github/workflows/release.yml`.
diff --git a/scripts/check-headers.php b/scripts/check-headers.php
index 151b5dc..5579315 100644
--- a/scripts/check-headers.php
+++ b/scripts/check-headers.php
@@ -92,11 +92,11 @@
             $errors[] = 'En-tête Theme URI invalide (adresse http ou https, sans espace, guillemet, chevron, barre oblique inverse ni caractère de contrôle, 2048 caractères au plus).';
         }
         $requires = $header($style, 'Requires at least');
-        if ($requires === null || preg_match('/^\d+(?:\.\d+){0,2}\z/', $requires) !== 1 || version_compare($requires, '6.1', '<')) {
+        if ($requires === null || preg_match('/^\d{1,5}(?:\.\d{1,5}){1,3}\z/', $requires) !== 1 || version_compare($requires, '6.1', '<')) {
             $errors[] = 'En-tête Requires at least absent ou inférieur à 6.1 (filtre update_themes_{hôte} de WordPress).';
         }
         $requiresPhp = $header($style, 'Requires PHP');
-        if ($requiresPhp === null || preg_match('/^\d+(?:\.\d+){0,2}\z/', $requiresPhp) !== 1) {
+        if ($requiresPhp === null || preg_match('/^\d{1,5}(?:\.\d{1,5}){1,3}\z/', $requiresPhp) !== 1) {
             $errors[] = 'En-tête Requires PHP absent ou invalide.';
         }
         if ($header($style, 'Text Domain') !== $slug) {
diff --git a/scripts/check-package.php b/scripts/check-package.php
index 9e6a8b7..889e844 100644
--- a/scripts/check-package.php
+++ b/scripts/check-package.php
@@ -96,6 +96,12 @@
         if ($header($style, 'Update URI') !== 'https://updates.wearewp.pro') {
             $errors[] = 'En-tête Update URI de style.css absent ou différent de https://updates.wearewp.pro.';
         }
+        if ($header($style, 'Text Domain') !== $slug) {
+            $errors[] = "En-tête Text Domain absent ou différent du slug ($slug) : le client s'en sert pour vérifier le dossier du thème.";
+        }
+        if ($header($style, 'Template') !== null) {
+            $errors[] = 'En-tête Template présent : les thèmes enfants ne sont pas pris en charge.';
+        }
     }
     if (is_file("$dir/$slug.php")) {
         $errors[] = "$slug.php présent dans le paquet d'un thème : le serveur le refuserait.";
diff --git a/tests/Unit/SharedCodeTest.php b/tests/Unit/SharedCodeTest.php
index 031f6a9..cbc1960 100644
--- a/tests/Unit/SharedCodeTest.php
+++ b/tests/Unit/SharedCodeTest.php
@@ -69,6 +69,15 @@ public function testSameServerAndSameSigningKeys(): void
         self::assertSame(\WAWP\Updater\Config::HOST, \WAWP\ThemeUpdater\Config::HOST);
     }
 
+    /** Le contrôle de Theme URI de check-headers.php doit refuser exactement ce que le client et le serveur refusent. */
+    public function testThemeUriPatternOfCheckHeadersMatchesTheClientOne(): void
+    {
+        $source = (string) file_get_contents(dirname(__DIR__, 2) . '/scripts/check-headers.php');
+        self::assertSame(1, preg_match("/preg_match\\('([^']+)', \\\$themeUri\\)/", $source, $match), 'motif de Theme URI introuvable dans check-headers.php');
+        // Le motif est un littéral PHP entre apostrophes : les doubles barres obliques inverses y valent une seule.
+        self::assertSame(\WAWP\ThemeUpdater\Theme_Validator::URL, strtr($match[1], ['\\\\' => '\\']));
+    }
+
     public function testThemeMarkerIsOutsideThePrefixInterceptedByThePluginClient(): void
     {
         self::assertStringStartsNotWith(\WAWP\Updater\Config::ENDPOINT . '/v1/download/', \WAWP\ThemeUpdater\Config::PACKAGE_MARKER);
diff --git a/tests/Unit/ThemeCheckHeadersTest.php b/tests/Unit/ThemeCheckHeadersTest.php
index 74d18d2..58043c0 100644
--- a/tests/Unit/ThemeCheckHeadersTest.php
+++ b/tests/Unit/ThemeCheckHeadersTest.php
@@ -128,6 +128,9 @@ public function testEachDefectIsReported(): void
             'theme uri sans hôte' => [fn () => $this->write('style.css', self::style(['Theme URI' => 'not a url'])), null, 'Theme URI'],
             'requires at least trop bas' => [fn () => $this->write('style.css', self::style(['Requires at least' => '6.0'])), null, 'Requires at least'],
             'requires at least absent' => [fn () => $this->write('style.css', self::style(['Requires at least' => null])), null, 'Requires at least'],
+            'requires at least sans point (le serveur exige au moins deux nombres)' => [fn () => $this->write('style.css', self::style(['Requires at least' => '7'])), null, 'Requires at least'],
+            'requires php sans point (le serveur exige au moins deux nombres)' => [fn () => $this->write('style.css', self::style(['Requires PHP' => '8'])), null, 'En-tête Requires PHP absent ou invalide.'],
+            'requires php à quatre points' => [fn () => $this->write('style.css', self::style(['Requires PHP' => '7.4.1.2.3'])), null, 'En-tête Requires PHP absent ou invalide.'],
             'requires php absent' => [fn () => $this->write('style.css', self::style(['Requires PHP' => null])), null, 'Requires PHP'],
             'text domain' => [fn () => $this->write('style.css', self::style(['Text Domain' => 'autre'])), null, 'Text Domain'],
             'thème enfant' => [fn () => $this->write('style.css', self::style(['Template' => 'twentytwentyfive'])), null, 'En-tête Template présent'],
diff --git a/tests/Unit/ThemeCheckPackageTest.php b/tests/Unit/ThemeCheckPackageTest.php
index b45fad8..64aa3b9 100644
--- a/tests/Unit/ThemeCheckPackageTest.php
+++ b/tests/Unit/ThemeCheckPackageTest.php
@@ -41,9 +41,9 @@ protected function tearDown(): void
         rmdir($root);
     }
 
-    private static function style(string $version = '1.4.0', string $uri = 'https://updates.wearewp.pro'): string
+    private static function style(string $version = '1.4.0', string $uri = 'https://updates.wearewp.pro', string $textDomain = 'wawp-demo-theme', string $extra = ''): string
     {
-        return "/*\nTheme Name: WAWP Démo\nVersion: $version\nRequires at least: 6.1\nRequires PHP: 7.4\nText Domain: wawp-demo-theme\nUpdate URI: $uri\n*/\n";
+        return "/*\nTheme Name: WAWP Démo\nVersion: $version\nRequires at least: 6.1\nRequires PHP: 7.4\nText Domain: $textDomain\nUpdate URI: $uri\n$extra*/\n";
     }
 
     private static function functions(string $load = "require __DIR__ . '/wawp-theme-updater/load.php';", string $register = '\WAWP\ThemeUpdater\register( __DIR__ );'): string
@@ -96,6 +96,8 @@ public function testEachDefectIsReported(): void
             'style.css absent' => [fn () => unlink($this->dir . '/style.css'), null, 'style.css absent du paquet.'],
             'version' => [fn () => $this->write('style.css', self::style(version: '1.3.9')), null, 'En-tête Version de style.css (1.3.9) différent de la version publiée (1.4.0).'],
             'update uri' => [fn () => $this->write('style.css', self::style(uri: 'https://updates.wearewp.pro/')), null, 'Update URI'],
+            'text domain différent du slug' => [fn () => $this->write('style.css', self::style(textDomain: 'autre')), null, 'En-tête Text Domain absent ou différent du slug (wawp-demo-theme) : le client s\'en sert pour vérifier le dossier du thème.'],
+            'thème enfant' => [fn () => $this->write('style.css', self::style(extra: "Template: twentytwentyfive\n")), null, 'En-tête Template présent : les thèmes enfants ne sont pas pris en charge.'],
             'fichier de plugin' => [fn () => $this->write('wawp-demo-theme.php', "<?php\n"), null, 'wawp-demo-theme.php présent'],
             'une seule clé' => [fn () => $this->config([$this->keys[0]]), null, 'PUBLIC_KEYS doit contenir exactement deux clés publiques Ed25519 distinctes (wawp-theme-updater/src/class-config.php).'],
             'clés identiques' => [fn () => $this->config([$this->keys[0], $this->keys[0]]), null, 'PUBLIC_KEYS'],
diff --git a/tests/Unit/ThemePackageTest.php b/tests/Unit/ThemePackageTest.php
index 64f3dd8..fc25c6d 100644
--- a/tests/Unit/ThemePackageTest.php
+++ b/tests/Unit/ThemePackageTest.php
@@ -61,6 +61,9 @@ public function testEachMismatchIsRefused(): void
             'préfixe trompeur' => [$valid + ['wawp-demo-themex/x.php' => '<?php'], self::SLUG, '1.4.0'],
             'segment ..' => [$valid + ['wawp-demo-theme/../x.php' => '<?php'], self::SLUG, '1.4.0'],
             'segment .' => [$valid + ['wawp-demo-theme/./x.php' => '<?php'], self::SLUG, '1.4.0'],
+            'entrée avec antislash' => [$valid + ['wawp-demo-theme\\x.php' => '<?php'], self::SLUG, '1.4.0'],
+            'antislash après le dossier du thème' => [$valid + ['wawp-demo-theme/sub\\x.php' => '<?php'], self::SLUG, '1.4.0'],
+            'style.css imbriqué dont la version diffère du style.css racine' => [[self::SLUG . '/style.css' => self::style('1.3.5'), self::SLUG . '/sub/style.css' => self::style('1.4.0')], self::SLUG, '1.4.0'],
             'casse en double' => [$valid + ['wawp-demo-theme/Functions.php' => '<?php'], self::SLUG, '1.4.0'],
             'style.css absent' => [[self::SLUG . '/functions.php' => '<?php'], self::SLUG, '1.4.0'],
             'style.css sans Version' => [[self::SLUG . '/style.css' => "body { color: red; }\n"], self::SLUG, '1.4.0'],
diff --git a/tests/Unit/ThemeUpdaterTest.php b/tests/Unit/ThemeUpdaterTest.php
index 7bb35e3..60bc91b 100644
--- a/tests/Unit/ThemeUpdaterTest.php
+++ b/tests/Unit/ThemeUpdaterTest.php
@@ -227,6 +227,23 @@ public function testPreDownloadUsesFreshTokenAndVerifiesSignature(): void
         self::assertSame(['https://updates.wearewp.pro/v1/download/jeton2'], $urls);
     }
 
+    public function testExceptionAfterTheDownloadDeletesTheTemporaryFile(): void
+    {
+        $zip = $this->zip;
+        WawpTestState::$download = static function () use ($zip): string {
+            copy($zip, $zip . '.dl');
+            // La lecture de style.css échoue une fois le fichier téléchargé et signé.
+            WawpTestState::$versions[self::STYLE] = new \RuntimeException('panne');
+
+            return $zip . '.dl';
+        };
+        $result = $this->updater()->filter_pre_download(false, self::MARKER, null, ['theme' => self::SLUG]);
+
+        self::assertInstanceOf(WP_Error::class, $result);
+        self::assertSame('wawp_theme_updater_error', $result->get_error_code());
+        self::assertFileDoesNotExist($this->zip . '.dl', 'le fichier temporaire ne doit pas rester sur le disque');
+    }
+
     public function testPreDownloadWorksWithBulkUpgradeContext(): void
     {
         // bulk_upgrade() (écran Mises à jour, AJAX, WP-CLI) ne passe que 'theme' et 'temp_backup'.
@@ -262,6 +279,7 @@ public function testFrozenPluginClientLeavesTheThemeMarkerAlone(): void
         $this->updater()->hooks();
 
         // Ordre réel sur un site : wawp-updater s'inscrit d'abord (plugins_loaded), à la même priorité 1.
+        self::assertCount(2, WawpTestState::$hooks['upgrader_pre_download'], 'wawp-updater et wawp-theme-updater sont tous deux inscrits');
         $reply = false;
         foreach (WawpTestState::$hooks['upgrader_pre_download'] as $callback) {
             $reply = $callback($reply, self::MARKER, null, ['theme' => self::SLUG, 'type' => 'theme', 'action' => 'update']);
diff --git a/tests/Unit/ThemeValidatorTest.php b/tests/Unit/ThemeValidatorTest.php
index 92fd94f..db96732 100644
--- a/tests/Unit/ThemeValidatorTest.php
+++ b/tests/Unit/ThemeValidatorTest.php
@@ -85,6 +85,9 @@ public function testAnyAnomalyRejectsTheWholeResponse(): void
             'url javascript' => self::body(['url' => 'javascript:alert(1)']),
             'url avec espace' => self::body(['url' => 'https://www.wearewp.pro/a b']),
             'url avec chevron' => self::body(['url' => 'https://www.wearewp.pro/<script>']),
+            'url avec antislash' => self::body(['url' => 'https://www.wearewp.pro/a\\b']),
+            'url avec guillemet double' => self::body(['url' => 'https://www.wearewp.pro/a"b']),
+            'url avec caractère de contrôle DEL' => self::body(['url' => "https://www.wearewp.pro/a\x7Fb"]),
             'url non texte' => self::body(['url' => 42]),
             'url absente' => Http::theme_body([self::SLUG => array_diff_key($good, ['url' => true])]),
             'corps trop volumineux' => '{"themes":{},"x":"' . str_repeat('a', 1048577) . '"}',
diff --git a/tests/wp-stubs.php b/tests/wp-stubs.php
index f13d6d0..bddc443 100644
--- a/tests/wp-stubs.php
+++ b/tests/wp-stubs.php
@@ -23,7 +23,7 @@ final class WawpTestState
     public static array $requests = [];
     public static bool $can = true;
     public static ?object $screen = null;
-    /** @var array<string, string> */
+    /** @var array<string, string|\Throwable> */
     public static array $versions = [];
     public static bool $multisite = false;
     /** @var array<string, array<string, string>> chemin de fichier vers en-têtes (hors Version) */
@@ -91,7 +91,12 @@ function get_file_data(string $file, array $headers): array
 {
     $data = [];
     foreach ($headers as $field => $name) {
-        $data[$field] = $name === 'Version' ? (WawpTestState::$versions[$file] ?? '') : (WawpTestState::$headers[$file][$name] ?? '');
+        $version = WawpTestState::$versions[$file] ?? '';
+        if ($version instanceof \Throwable) {
+            // Permet de provoquer une exception à la lecture de style.css (voir ThemeUpdaterTest).
+            throw $version;
+        }
+        $data[$field] = $name === 'Version' ? $version : (WawpTestState::$headers[$file][$name] ?? '');
     }
 
     return $data;
diff --git a/wawp-theme-updater/src/class-updater.php b/wawp-theme-updater/src/class-updater.php
index bd854d3..316ac25 100644
--- a/wawp-theme-updater/src/class-updater.php
+++ b/wawp-theme-updater/src/class-updater.php
@@ -128,6 +128,7 @@ public function filter_pre_download( $reply, $package, $upgrader, $hook_extra )
 		if ( ! is_string( $package ) || 0 !== strpos( $package, Config::PACKAGE_MARKER ) ) {
 			return $reply;
 		}
+		$file = null;
 		try {
 			if ( false !== $reply ) {
 				// Enregistré en priorité 1 : un autre filtre qui a déjà fourni un fichier court-circuiterait la signature.
@@ -160,6 +161,11 @@ public function filter_pre_download( $reply, $package, $upgrader, $hook_extra )
 
 			return $file;
 		} catch ( \Throwable $e ) {
+			if ( is_string( $file ) ) {
+				// Exception après le téléchargement : ne pas laisser le paquet dans le dossier temporaire.
+				wp_delete_file( $file );
+			}
+
 			return new \WP_Error( 'wawp_theme_updater_error', __( 'Erreur du client de mise à jour des thèmes WeAre[WP] : mise à jour annulée.', 'wawp-theme-updater' ) );
 		}
 	}