@mpgd/cli 0.13.0 → 0.14.0

package/dist/microsoft-store-package-generation-zip.js

@@ -0,0 +1,180 @@
+import { closeSync, openSync, readSync } from 'node:fs';
+export function assertMicrosoftStorePackageZip(file, sizeBytes) {
+    if (sizeBytes < 22) {
+        throw new Error('PWABuilder package archive is truncated.');
+    }
+    const descriptor = openSync(file, 'r');
+    try {
+        const header = Buffer.allocUnsafe(4);
+        readExactly(descriptor, header, 0);
+        if (header.readUInt32LE(0) !== 0x04034b50) {
+            throw new Error('PWABuilder package archive must start with a ZIP local file header.');
+        }
+        const tailLength = Math.min(sizeBytes, 65557);
+        const tail = Buffer.allocUnsafe(tailLength);
+        readExactly(descriptor, tail, sizeBytes - tailLength);
+        const endOffset = findEndOfCentralDirectory(tail);
+        if (endOffset < 0) {
+            throw new Error('PWABuilder package archive is missing its ZIP end record.');
+        }
+        const commentLength = tail.readUInt16LE(endOffset + 20);
+        if (endOffset + 22 + commentLength !== tail.length) {
+            throw new Error('PWABuilder package archive has a truncated or trailing ZIP end record.');
+        }
+        const diskNumber = tail.readUInt16LE(endOffset + 4);
+        const centralDirectoryDisk = tail.readUInt16LE(endOffset + 6);
+        const entriesOnDisk = tail.readUInt16LE(endOffset + 8);
+        const totalEntries = tail.readUInt16LE(endOffset + 10);
+        const centralDirectorySize = tail.readUInt32LE(endOffset + 12);
+        const centralDirectoryOffset = tail.readUInt32LE(endOffset + 16);
+        const absoluteEndOffset = sizeBytes - tailLength + endOffset;
+        if (diskNumber === 0xffff
+            || centralDirectoryDisk === 0xffff
+            || entriesOnDisk === 0xffff
+            || totalEntries === 0xffff
+            || centralDirectorySize === 0xffffffff
+            || centralDirectoryOffset === 0xffffffff) {
+            throw new Error('PWABuilder package archive must not use ZIP64 extensions.');
+        }
+        if (diskNumber !== 0
+            || centralDirectoryDisk !== 0
+            || entriesOnDisk === 0
+            || entriesOnDisk !== totalEntries
+            || centralDirectoryOffset + centralDirectorySize !== absoluteEndOffset) {
+            throw new Error('PWABuilder package archive has an unsupported ZIP directory layout.');
+        }
+        assertSafeZipEntries(descriptor, centralDirectoryOffset, absoluteEndOffset, totalEntries);
+    }
+    finally {
+        closeSync(descriptor);
+    }
+}
+function assertSafeZipEntries(descriptor, centralDirectoryOffset, centralDirectoryEnd, totalEntries) {
+    let cursor = centralDirectoryOffset;
+    const seenEntryNames = new Set();
+    for (let index = 0; index < totalEntries; index += 1) {
+        const header = Buffer.allocUnsafe(46);
+        if (cursor + header.length > centralDirectoryEnd) {
+            throw new Error('PWABuilder package archive has a truncated ZIP central directory.');
+        }
+        readExactly(descriptor, header, cursor);
+        if (header.readUInt32LE(0) !== 0x02014b50) {
+            throw new Error('PWABuilder package archive has an invalid ZIP central directory.');
+        }
+        const fileNameLength = header.readUInt16LE(28);
+        const extraLength = header.readUInt16LE(30);
+        const commentLength = header.readUInt16LE(32);
+        const diskStart = header.readUInt16LE(34);
+        const flags = header.readUInt16LE(8);
+        const compressionMethod = header.readUInt16LE(10);
+        const compressedSize = header.readUInt32LE(20);
+        const uncompressedSize = header.readUInt32LE(24);
+        const localHeaderOffset = header.readUInt32LE(42);
+        const entryLength = header.length + fileNameLength + extraLength + commentLength;
+        if (diskStart === 0xffff
+            || compressedSize === 0xffffffff
+            || uncompressedSize === 0xffffffff
+            || localHeaderOffset === 0xffffffff) {
+            throw new Error('PWABuilder package archive must not use ZIP64 extensions.');
+        }
+        if (diskStart !== 0) {
+            throw new Error('PWABuilder package archive must keep every entry on disk 0.');
+        }
+        if (cursor + entryLength > centralDirectoryEnd) {
+            throw new Error('PWABuilder package archive has a truncated ZIP central directory entry.');
+        }
+        const fileNameBytes = Buffer.allocUnsafe(fileNameLength);
+        readExactly(descriptor, fileNameBytes, cursor + header.length);
+        const fileName = fileNameBytes.toString('utf8');
+        assertSafeZipEntryName(fileName);
+        const canonicalName = canonicalizeZipEntryName(fileName);
+        if (seenEntryNames.has(canonicalName)) {
+            throw new Error(`PWABuilder package archive contains a duplicate or case-colliding ZIP entry: ${fileName}`);
+        }
+        seenEntryNames.add(canonicalName);
+        const unixMode = (header.readUInt32LE(38) >>> 16) & 0o170000;
+        if (unixMode === 0o120000) {
+            throw new Error('PWABuilder package archive must not contain symbolic links.');
+        }
+        if (localHeaderOffset + 30 > centralDirectoryOffset) {
+            throw new Error('PWABuilder package archive has an invalid ZIP local header offset.');
+        }
+        const localHeader = Buffer.allocUnsafe(30);
+        readExactly(descriptor, localHeader, localHeaderOffset);
+        if (localHeader.readUInt32LE(0) !== 0x04034b50) {
+            throw new Error('PWABuilder package archive has an invalid ZIP local file header.');
+        }
+        const localFileNameLength = localHeader.readUInt16LE(26);
+        const localExtraLength = localHeader.readUInt16LE(28);
+        const localFlags = localHeader.readUInt16LE(6);
+        const localCompressionMethod = localHeader.readUInt16LE(8);
+        const localCompressedSize = localHeader.readUInt32LE(18);
+        const localUncompressedSize = localHeader.readUInt32LE(22);
+        const localMetadataEnd = localHeaderOffset + localHeader.length
+            + localFileNameLength
+            + localExtraLength;
+        if (localCompressedSize === 0xffffffff || localUncompressedSize === 0xffffffff) {
+            throw new Error('PWABuilder package archive must not use ZIP64 extensions.');
+        }
+        const usesDataDescriptor = (flags & 0x0008) !== 0;
+        if (localFlags !== flags
+            || localCompressionMethod !== compressionMethod
+            || (!usesDataDescriptor
+                && (localCompressedSize !== compressedSize
+                    || localUncompressedSize !== uncompressedSize))
+            || (usesDataDescriptor
+                && ((localCompressedSize !== 0 && localCompressedSize !== compressedSize)
+                    || (localUncompressedSize !== 0 && localUncompressedSize !== uncompressedSize)))) {
+            throw new Error('PWABuilder package archive local metadata must match its central directory entry.');
+        }
+        if (localMetadataEnd > centralDirectoryOffset
+            || localMetadataEnd + compressedSize > centralDirectoryOffset) {
+            throw new Error('PWABuilder package archive has a truncated ZIP local file entry.');
+        }
+        const localFileNameBytes = Buffer.allocUnsafe(localFileNameLength);
+        readExactly(descriptor, localFileNameBytes, localHeaderOffset + localHeader.length);
+        assertSafeZipEntryName(localFileNameBytes.toString('utf8'));
+        if (!localFileNameBytes.equals(fileNameBytes)) {
+            throw new Error('PWABuilder package archive local filename must match its central directory entry.');
+        }
+        cursor += entryLength;
+    }
+    if (cursor !== centralDirectoryEnd) {
+        throw new Error('PWABuilder package archive has an inconsistent ZIP central directory.');
+    }
+}
+function canonicalizeZipEntryName(input) {
+    return input.replaceAll('\\', '/').replace(/\/+$/u, '').normalize('NFC').toLowerCase();
+}
+function assertSafeZipEntryName(input) {
+    const normalized = input.replaceAll('\\', '/');
+    const components = normalized.split('/');
+    if (input.length === 0
+        || input.includes('\0')
+        || normalized.startsWith('/')
+        || /^[A-Za-z]:/u.test(normalized)
+        || components.some((component) => component.includes(':'))
+        || components.some((component, index) => (component === '.'
+            || component === '..'
+            || (component.length === 0 && index !== components.length - 1)))) {
+        throw new Error(`PWABuilder package archive contains an unsafe ZIP entry path: ${input}`);
+    }
+}
+function findEndOfCentralDirectory(input) {
+    for (let offset = input.length - 22; offset >= 0; offset -= 1) {
+        if (input.readUInt32LE(offset) === 0x06054b50) {
+            return offset;
+        }
+    }
+    return -1;
+}
+function readExactly(descriptor, output, position) {
+    let offset = 0;
+    while (offset < output.length) {
+        const bytesRead = readSync(descriptor, output, offset, output.length - offset, position + offset);
+        if (bytesRead === 0) {
+            throw new Error('PWABuilder package archive is truncated.');
+        }
+        offset += bytesRead;
+    }
+}

package/dist/microsoft-store-package-generation.d.ts

@@ -0,0 +1,24 @@
+import { type MicrosoftStoreFileSnapshot, type MicrosoftStorePackageGenerationEvidence, type MicrosoftStorePackageGenerationRuntime, type RunMicrosoftStorePackageGenerationInput } from './microsoft-store-package-generation-contract.js';
+export { microsoftStorePackageGenerationSchemaVersion, microsoftStorePackageGeneratorEndpoint, microsoftStorePackageGeneratorSourceRevision, type CreateMicrosoftStorePackageGenerationRuntimeInput, type MicrosoftStoreAddressResolver, type MicrosoftStorePackageGenerationEvidence, type MicrosoftStorePackageGenerationRuntime, type MicrosoftStoreResolvedAddress, type RunMicrosoftStorePackageGenerationInput, } from './microsoft-store-package-generation-contract.js';
+export { createMicrosoftStorePackageGenerationRuntime } from './microsoft-store-package-generation-download.js';
+export declare function runMicrosoftStorePackageGeneration(input: RunMicrosoftStorePackageGenerationInput, runtime?: MicrosoftStorePackageGenerationRuntime): Promise<MicrosoftStorePackageGenerationEvidence>;
+interface MicrosoftStoreFileNodeIdentity {
+  readonly dev: number;
+  readonly ino: number;
+}
+interface MicrosoftStoreEvidenceFileIdentity extends MicrosoftStoreFileNodeIdentity, MicrosoftStoreFileSnapshot {
+  readonly mtimeMs: number;
+  readonly ctimeMs: number;
+}
+interface MicrosoftStoreEvidencePublicationHooks {
+  readonly afterPlacement?: (file: string) => void;
+}
+export declare function writeMicrosoftStorePackageGenerationEvidenceFiles(input: {
+  readonly jsonFile: string;
+  readonly markdownFile: string;
+  readonly report: unknown;
+  readonly markdown: string;
+}, hooks?: MicrosoftStoreEvidencePublicationHooks): void;
+export declare function microsoftStoreEvidenceFileMatchesIdentity(file: string, expected: MicrosoftStoreEvidenceFileIdentity): boolean;
+export declare function removeMicrosoftStoreEvidenceLockIfOwned(file: string, expected: MicrosoftStoreFileNodeIdentity | undefined, token: string | undefined): void;
+export declare function renderMicrosoftStorePackageGenerationMarkdown(evidence: MicrosoftStorePackageGenerationEvidence): string;

package/dist/microsoft-store-package-generation.js

@@ -0,0 +1,430 @@
+import { randomUUID } from 'node:crypto';
+import { closeSync, copyFileSync, existsSync, constants as fsConstants, fstatSync, linkSync, lstatSync, mkdirSync, openSync, readSync, renameSync, unlinkSync, writeFileSync, } from 'node:fs';
+import path from 'node:path';
+import { escapeMarkdownInline, escapeMarkdownTable, formatError, relativeOrAbsolute, } from './evidence-io.js';
+import { microsoftStorePackageGenerationSchemaVersion, microsoftStorePackageGeneratorEndpoint, microsoftStorePackageGeneratorSourceRevision, } from './microsoft-store-package-generation-contract.js';
+import { createMicrosoftStorePackageGenerationRuntime, withMicrosoftStorePackageArchive, } from './microsoft-store-package-generation-download.js';
+import { assertMicrosoftStorePackageGenerationInputUnchanged, prepareMicrosoftStorePackageGenerationInput, } from './microsoft-store-package-generation-input.js';
+import { hashMicrosoftStoreBytes, hashMicrosoftStoreFileSnapshot, } from './microsoft-store-package-generation-integrity.js';
+export { microsoftStorePackageGenerationSchemaVersion, microsoftStorePackageGeneratorEndpoint, microsoftStorePackageGeneratorSourceRevision, } from './microsoft-store-package-generation-contract.js';
+export { createMicrosoftStorePackageGenerationRuntime } from './microsoft-store-package-generation-download.js';
+export async function runMicrosoftStorePackageGeneration(input, runtime = createMicrosoftStorePackageGenerationRuntime()) {
+    const prepared = prepareMicrosoftStorePackageGenerationInput(input);
+    const pinnedManifest = createMicrosoftStoreGeneratorManifest(prepared.submission.manifest, prepared.submission.manifestIcons.map((icon) => icon.url));
+    const request = {
+        name: prepared.submission.identity.reservedName,
+        packageId: prepared.submission.identity.packageId,
+        applicationId: 'App',
+        url: prepared.pwaUrl,
+        version: prepared.modernVersion,
+        allowSigning: true,
+        publisher: {
+            displayName: prepared.submission.identity.publisherDisplayName,
+            commonName: prepared.submission.identity.publisherId,
+        },
+        generateModernPackage: true,
+        classicPackage: {
+            generate: true,
+            version: prepared.classicVersion,
+            url: prepared.pwaUrl,
+        },
+        edgeChannel: 'stable',
+        manifestUrl: prepared.manifestUrl,
+        manifest: pinnedManifest,
+        resourceLanguage: prepared.submission.resourceLanguage,
+        targetDeviceFamilies: ['Desktop'],
+        usePwaBuilderWithCustomManifest: true,
+    };
+    const requestBody = JSON.stringify(request);
+    const requestSha256 = hashMicrosoftStoreBytes(Buffer.from(requestBody));
+    return withMicrosoftStorePackageArchive({
+        runtime,
+        manifestUrl: prepared.manifestUrl,
+        manifestSha256: prepared.submission.manifestSha256,
+        manifestIcons: prepared.submission.manifestIcons,
+        requestBody,
+        outputFile: prepared.outputFile,
+        assertInputsUnchanged: () => {
+            assertMicrosoftStorePackageGenerationInputUnchanged(prepared);
+        },
+    }, (archive) => {
+        const evidence = {
+            schemaVersion: microsoftStorePackageGenerationSchemaVersion,
+            target: 'microsoft-store',
+            pwaUrl: prepared.pwaUrl,
+            modernVersion: prepared.modernVersion,
+            classicVersion: prepared.classicVersion,
+            submissionEvidenceFile: relativeOrAbsolute(prepared.gameRoot, prepared.submissionEvidenceFile),
+            submissionEvidenceSha256: prepared.submissionBefore.sha256,
+            productIdentity: prepared.submission.identity,
+            manifest: {
+                file: relativeOrAbsolute(prepared.gameRoot, prepared.submission.manifestFile),
+                url: prepared.manifestUrl,
+                sha256: prepared.submission.manifestSha256,
+                pinnedInGeneratorRequest: true,
+                icons: {
+                    count: prepared.submission.manifestIcons.length,
+                    verification: 'before-and-after-generator',
+                    entries: prepared.submission.manifestIcons.map((icon) => ({
+                        file: relativeOrAbsolute(prepared.gameRoot, icon.file),
+                        url: icon.url,
+                        sha256: icon.snapshot.sha256,
+                        width: icon.width,
+                        height: icon.height,
+                    })),
+                },
+            },
+            generator: {
+                endpoint: microsoftStorePackageGeneratorEndpoint,
+                sourceRevision: microsoftStorePackageGeneratorSourceRevision,
+                contract: 'unversioned-best-effort',
+                requestSha256,
+            },
+            archive: {
+                file: relativeOrAbsolute(prepared.gameRoot, prepared.outputFile),
+                sizeBytes: archive.sizeBytes,
+                sha256: archive.sha256,
+                contentType: 'application/zip',
+            },
+            packageInspectionRequired: true,
+        };
+        mkdirSync(path.dirname(prepared.jsonFile), { recursive: true });
+        mkdirSync(path.dirname(prepared.markdownFile), { recursive: true });
+        writeMicrosoftStorePackageGenerationEvidenceFiles({
+            jsonFile: prepared.jsonFile,
+            markdownFile: prepared.markdownFile,
+            report: evidence,
+            markdown: renderMicrosoftStorePackageGenerationMarkdown(evidence),
+        });
+        return evidence;
+    });
+}
+function createMicrosoftStoreGeneratorManifest(manifest, iconUrls) {
+    const icons = manifest.icons;
+    if (!Array.isArray(icons) || icons.length !== iconUrls.length) {
+        throw new Error('Microsoft Store generator manifest icons must match verified icon URLs.');
+    }
+    return {
+        ...manifest,
+        icons: icons.map((icon, index) => {
+            if (icon === null || typeof icon !== 'object' || Array.isArray(icon)) {
+                throw new Error(`Microsoft Store generator manifest icon[${index}] must be an object.`);
+            }
+            const url = iconUrls[index];
+            if (url === undefined) {
+                throw new Error(`Microsoft Store generator manifest icon[${index}] URL is missing.`);
+            }
+            return {
+                ...icon,
+                src: url,
+            };
+        }),
+    };
+}
+export function writeMicrosoftStorePackageGenerationEvidenceFiles(input, hooks = {}) {
+    const transactionId = `${process.pid}.${randomUUID()}`;
+    const files = [
+        createEvidenceFilePublication(input.jsonFile, `${JSON.stringify(input.report, null, 2)}\n`, transactionId),
+        createEvidenceFilePublication(input.markdownFile, input.markdown, transactionId),
+    ];
+    let completed = false;
+    try {
+        for (const file of files) {
+            acquireEvidenceFileLock(file, transactionId);
+        }
+        for (const file of files) {
+            const descriptor = openSync(file.temporaryFile, 'wx', 0o600);
+            file.temporaryExists = true;
+            try {
+                writeFileSync(descriptor, file.contents);
+            }
+            finally {
+                closeSync(descriptor);
+            }
+        }
+        for (const file of files) {
+            const metadata = lstatIfExists(file.finalFile);
+            if (metadata === undefined) {
+                continue;
+            }
+            if (metadata.isSymbolicLink() || !metadata.isFile()) {
+                throw new Error(`Microsoft Store package generation evidence must be a regular file: ${file.finalFile}`);
+            }
+            copyFileSync(file.finalFile, file.backupFile, fsConstants.COPYFILE_EXCL);
+            file.backupExists = true;
+            const backupSnapshot = hashMicrosoftStoreFileSnapshot(file.backupFile, 'Microsoft Store package generation evidence backup');
+            file.previousIdentity = evidenceFileIdentity(metadata, backupSnapshot);
+            if (!microsoftStoreEvidenceFileMatchesIdentity(file.finalFile, file.previousIdentity)) {
+                throw new Error(`Microsoft Store package generation evidence changed while it was backed up: ${file.finalFile}`);
+            }
+        }
+        for (const file of files) {
+            const publishedIdentity = publishedEvidenceFileIdentity(lstatSync(file.temporaryFile), file.contentsSnapshot);
+            if (file.previousIdentity === undefined) {
+                linkSync(file.temporaryFile, file.finalFile);
+                file.publishedIdentity = publishedIdentity;
+                hooks.afterPlacement?.(file.finalFile);
+                unlinkSync(file.temporaryFile);
+            }
+            else {
+                if (!microsoftStoreEvidenceFileMatchesIdentity(file.finalFile, file.previousIdentity)) {
+                    throw new Error(`Microsoft Store package generation evidence changed before publication: ${file.finalFile}`);
+                }
+                renameSync(file.temporaryFile, file.finalFile);
+                file.publishedIdentity = publishedIdentity;
+                hooks.afterPlacement?.(file.finalFile);
+            }
+            file.temporaryExists = false;
+        }
+        completed = true;
+    }
+    catch (error) {
+        throw new Error(`Failed to write Microsoft Store package generation evidence: ${formatError(error)}`, { cause: error });
+    }
+    finally {
+        if (!completed) {
+            for (const file of [...files].reverse()) {
+                rollbackEvidenceFilePublication(file);
+            }
+        }
+        for (const file of files) {
+            unlinkIfPresent(file.temporaryFile, file.temporaryExists);
+            unlinkIfPresent(file.backupFile, file.backupExists);
+            removeMicrosoftStoreEvidenceLockIfOwned(file.lockFile, file.lockIdentity, file.lockToken);
+        }
+    }
+}
+function createEvidenceFilePublication(finalFile, contents, transactionId) {
+    const prefix = `.${path.basename(finalFile)}.${transactionId}`;
+    const contentsBytes = Buffer.from(contents);
+    return {
+        finalFile,
+        temporaryFile: path.join(path.dirname(finalFile), `${prefix}.tmp`),
+        backupFile: path.join(path.dirname(finalFile), `${prefix}.bak`),
+        lockFile: path.join(path.dirname(finalFile), `.${path.basename(finalFile)}.mpgd-package-generation.lock`),
+        contents,
+        contentsSnapshot: {
+            sizeBytes: contentsBytes.length,
+            sha256: hashMicrosoftStoreBytes(contentsBytes),
+        },
+        temporaryExists: false,
+        backupExists: false,
+    };
+}
+function acquireEvidenceFileLock(file, transactionId) {
+    let descriptor;
+    try {
+        descriptor = openSync(file.lockFile, 'wx', 0o600);
+    }
+    catch (error) {
+        if (hasErrorCode(error, 'EEXIST')) {
+            throw new Error(`Microsoft Store package generation evidence is already being written: ${file.finalFile}`);
+        }
+        throw error;
+    }
+    file.lockToken = transactionId;
+    let initialized = false;
+    try {
+        file.lockIdentity = fileNodeIdentity(fstatSync(descriptor));
+        writeFileSync(descriptor, `${transactionId}\n`);
+        initialized = true;
+    }
+    finally {
+        try {
+            closeSync(descriptor);
+        }
+        finally {
+            if (!initialized && unlinkImmediately(file.lockFile)) {
+                delete file.lockIdentity;
+                delete file.lockToken;
+            }
+        }
+    }
+}
+function rollbackEvidenceFilePublication(file) {
+    if (file.publishedIdentity === undefined) {
+        return;
+    }
+    let matchesIdentity = false;
+    try {
+        matchesIdentity = microsoftStorePublishedEvidenceFileMatchesIdentity(file.finalFile, file.publishedIdentity);
+    }
+    catch {
+        // Preserve the backup for manual recovery when rollback inspection fails.
+        file.backupExists = false;
+        return;
+    }
+    if (!matchesIdentity) {
+        // A concurrent writer replaced the final file; preserve the backup for manual recovery.
+        file.backupExists = false;
+        return;
+    }
+    if (file.backupExists) {
+        try {
+            renameSync(file.backupFile, file.finalFile);
+            file.backupExists = false;
+        }
+        catch {
+            // Preserve the backup for manual recovery when an atomic rollback cannot complete.
+            file.backupExists = false;
+        }
+        return;
+    }
+    try {
+        unlinkSync(file.finalFile);
+    }
+    catch {
+        // Do not mask the original evidence publication failure.
+    }
+}
+function microsoftStorePublishedEvidenceFileMatchesIdentity(file, expected) {
+    const metadata = lstatIfExists(file);
+    if (metadata === undefined
+        || !metadata.isFile()
+        || metadata.dev !== expected.dev
+        || (expected.ino !== 0 && metadata.ino !== expected.ino)) {
+        return false;
+    }
+    const actual = hashMicrosoftStoreFileSnapshot(file, 'published Microsoft Store package generation evidence ownership check');
+    return actual.sizeBytes === expected.sizeBytes
+        && actual.sha256 === expected.sha256;
+}
+export function microsoftStoreEvidenceFileMatchesIdentity(file, expected) {
+    const metadata = lstatIfExists(file);
+    if (metadata === undefined || !metadata.isFile() || metadata.dev !== expected.dev) {
+        return false;
+    }
+    if (expected.ino !== 0) {
+        return metadata.ino === expected.ino
+            && metadata.size === expected.sizeBytes
+            && metadata.mtimeMs === expected.mtimeMs
+            && metadata.ctimeMs === expected.ctimeMs;
+    }
+    const actual = hashMicrosoftStoreFileSnapshot(file, 'Microsoft Store package generation evidence ownership check');
+    return actual.sizeBytes === expected.sizeBytes
+        && actual.sha256 === expected.sha256;
+}
+function fileNodeIdentity(metadata) {
+    return { dev: metadata.dev, ino: metadata.ino };
+}
+function metadataMatchesNodeIdentity(metadata, expected) {
+    return expected.ino !== 0
+        && metadata.dev === expected.dev
+        && metadata.ino === expected.ino;
+}
+function evidenceFileIdentity(metadata, snapshot) {
+    return {
+        dev: metadata.dev,
+        ino: metadata.ino,
+        ...snapshot,
+        mtimeMs: metadata.mtimeMs,
+        ctimeMs: metadata.ctimeMs,
+    };
+}
+function publishedEvidenceFileIdentity(metadata, snapshot) {
+    if (metadata.size !== snapshot.sizeBytes) {
+        throw new Error('Microsoft Store package generation temporary evidence size changed.');
+    }
+    return {
+        dev: metadata.dev,
+        ino: metadata.ino,
+        ...snapshot,
+    };
+}
+function lstatIfExists(file) {
+    try {
+        return lstatSync(file);
+    }
+    catch (error) {
+        if (hasErrorCode(error, 'ENOENT')) {
+            return undefined;
+        }
+        throw error;
+    }
+}
+function unlinkIfPresent(file, expectedToExist) {
+    if (!expectedToExist || !existsSync(file)) {
+        return;
+    }
+    try {
+        unlinkSync(file);
+    }
+    catch {
+        // Temporary cleanup must not invalidate otherwise consistent evidence outputs.
+    }
+}
+function unlinkImmediately(file) {
+    try {
+        unlinkSync(file);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+export function removeMicrosoftStoreEvidenceLockIfOwned(file, expected, token) {
+    if (expected === undefined || token === undefined) {
+        return;
+    }
+    try {
+        const metadata = lstatIfExists(file);
+        if (metadata !== undefined
+            && metadata.isFile()
+            && (metadataMatchesNodeIdentity(metadata, expected)
+                || (expected.ino === 0
+                    && microsoftStoreEvidenceLockMatchesToken(file, token)))) {
+            unlinkSync(file);
+        }
+    }
+    catch {
+        // Do not remove a lock whose ownership can no longer be proven.
+    }
+}
+function microsoftStoreEvidenceLockMatchesToken(file, token) {
+    const expected = Buffer.from(`${token}\n`);
+    const descriptor = openSync(file, 'r');
+    try {
+        const metadata = fstatSync(descriptor);
+        if (!metadata.isFile() || metadata.size !== expected.length) {
+            return false;
+        }
+        const contents = Buffer.allocUnsafe(expected.length);
+        let offset = 0;
+        while (offset < contents.length) {
+            const bytesRead = readSync(descriptor, contents, offset, contents.length - offset, offset);
+            if (bytesRead === 0) {
+                return false;
+            }
+            offset += bytesRead;
+        }
+        return contents.equals(expected);
+    }
+    finally {
+        closeSync(descriptor);
+    }
+}
+function hasErrorCode(error, code) {
+    return error instanceof Error && 'code' in error && error.code === code;
+}
+export function renderMicrosoftStorePackageGenerationMarkdown(evidence) {
+    return `# Microsoft Store Package Generation
+
+- PWA URL: ${escapeMarkdownInline(evidence.pwaUrl)}
+- Manifest URL: ${escapeMarkdownInline(evidence.manifest.url)}
+- Manifest SHA-256: \`${evidence.manifest.sha256}\`
+- Manifest pinned in generator request: yes
+- Manifest icons verified before and after generator: ${evidence.manifest.icons.count}
+- Modern version: \`${evidence.modernVersion}\`
+- Classic version: \`${evidence.classicVersion}\`
+- Package ID: ${escapeMarkdownInline(evidence.productIdentity.packageId)}
+- Publisher ID: ${escapeMarkdownInline(evidence.productIdentity.publisherId)}
+- Generator endpoint: ${escapeMarkdownInline(evidence.generator.endpoint)}
+- Generator contract: ${evidence.generator.contract}
+- Generator request SHA-256: \`${evidence.generator.requestSha256}\`
+- Package inspection: required before submission
+
+| Archive | Bytes | SHA-256 |
+| --- | ---: | --- |
+| ${escapeMarkdownTable(evidence.archive.file)} | ${evidence.archive.sizeBytes} | \`${evidence.archive.sha256}\` |
+`;
+}