@mpgd/cli 0.28.1 → 0.29.0

package/dist/index.d.ts

@@ -1,6 +1,7 @@
 export { renderGameAcceptanceMarkdown, resolveGameAcceptanceReleaseManifestFile, runGameAcceptance, defaultGameAcceptanceCommandTimeoutMs, maximumGameplayE2EReportBytes, type GameAcceptanceCommandResult, type GameAcceptanceCommandRunner, type GameAcceptanceReport, type GameAcceptanceStatus, type GameAcceptanceStep, type GameAcceptanceStepResult, type GameAcceptanceStepStatus, type RunGameAcceptanceInput, type RunGameAcceptanceResult, } from './game-acceptance.js';
 export { createBrowserGameplayE2EDriver, type BrowserGameplayE2EInspectInput, type BrowserGameplayE2EPage, type BrowserGameplayE2EScreenshotOptions, type BrowserGameplayE2EViewport, type CreateBrowserGameplayE2EDriverInput, } from './browser-gameplay-e2e.js';
 export { collectGameplayE2EPathEvidence, defaultGameplayE2EReportFile, maximumGameplayE2EStates, parseGameplayE2EPlan, readGameplayE2EPlan, renderGameplayE2EMarkdown, resolveGameplayE2EReportFile, runGameplayE2E, type GameplayE2EAction, type GameplayE2EActionResult, type GameplayE2EDriver, type GameplayE2EHashLimits, type GameplayE2EInputAction, type GameplayE2EObservation, type GameplayE2EPauseResumeAction, type GameplayE2EPathEvidence, type GameplayE2EPlan, type GameplayE2EReport, type GameplayE2EResultStatus, type GameplayE2EState, type GameplayE2EStateResult, type GameplayE2EStatus, type RunGameplayE2EInput, type RunGameplayE2EResult, } from './gameplay-e2e.js';
+export { cloudflarePagesDeploymentProfiles, hostedPwaDeploymentHosts, isSupportedHostedPwaProfile, verifyHostedPwaDeployment, type CloudflarePagesDeploymentProfile, type HostedPwaDeploymentHost, type HostedPwaDeploymentVerification, type VerifyHostedPwaDeploymentInput, } from './hosted-pwa-deployment.js';
 export { defaultOfflinePlaytestArtifactDir, defaultOfflinePlaytestMaximumBytes, defaultOfflinePlaytestOutputDir, offlinePlaytestSchemaVersion, runOfflinePlaytestPackaging, type OfflinePlaytestEvidence, type RunOfflinePlaytestPackagingInput, type RunOfflinePlaytestPackagingResult, } from './offline-playtest.js';
 export { assertMicrosoftStorePwaCacheTransition, assertMicrosoftStorePwaPrecacheUrl, assertMicrosoftStorePwaReleaseEvidence, inspectMicrosoftStorePwaBrowserCacheTransition, microsoftStorePwaCacheSchema, readMicrosoftStorePwaBrowserReleaseEvidence, requestMicrosoftStorePwaBrowserUpdate, resolveMicrosoftStorePwaScopedCacheName, type AssertMicrosoftStorePwaCacheTransitionInput, type InspectMicrosoftStorePwaCacheTransitionInput, type MicrosoftStorePwaBrowserPage, type MicrosoftStorePwaCachedIndexObservation, type MicrosoftStorePwaCacheTransitionEvidence, type MicrosoftStorePwaCacheTransitionObservation, type MicrosoftStorePwaReleaseEvidence, } from './microsoft-store-pwa-e2e.js';
 export { createMicrosoftStorePackageAcceptanceRuntime, microsoftStorePackageAcceptanceSchemaVersion, parseMicrosoftStorePackageIdentity, parseWindowsAppCertificationResult, renderMicrosoftStorePackageAcceptanceMarkdown, runMicrosoftStorePackageAcceptance, type CreateMicrosoftStorePackageAcceptanceRuntimeInput, type MicrosoftStorePackageAcceptanceEvidence, type MicrosoftStorePackageAcceptanceRuntime, type MicrosoftStorePackageIdentity, type RunMicrosoftStorePackageAcceptanceInput, } from './microsoft-store-package-acceptance.js';

package/dist/index.js

@@ -1,5 +1,5 @@
 import { spawnSync } from 'node:child_process';
-import { existsSync, mkdirSync, readdirSync, readFileSync, realpathSync, rmSync, writeFileSync, } from 'node:fs';
+import { existsSync, lstatSync, mkdirSync, readdirSync, readFileSync, realpathSync, rmSync, writeFileSync, } from 'node:fs';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 import completion from '@gunshi/plugin-completion';
@@ -7,8 +7,10 @@ import i18n, { defineI18n } from '@gunshi/plugin-i18n';
 import resources from '@gunshi/resources';
 import { cli } from 'gunshi';
 import { normalizeConfiguredBuildTargets, normalizeBuildTarget as normalizeConfiguredTargetName, supportedBuildTargets, } from './build-targets.js';
+import { escapeMarkdownInline as escapeEvidenceMarkdownInline, writeEvidenceReportFiles, } from './evidence-io.js';
 import { defaultGameAcceptanceCommandTimeoutMs, resolveGameAcceptanceReleaseManifestFile, runGameAcceptance, } from './game-acceptance.js';
 import { resolveGameplayE2EReportFile } from './gameplay-e2e.js';
+import { cloudflarePagesDeploymentProfiles, hostedPwaDeploymentHosts, verifyHostedPwaDeployment, } from './hosted-pwa-deployment.js';
 import { createMicrosoftStorePackageAcceptanceRuntime, runMicrosoftStorePackageAcceptance, } from './microsoft-store-package-acceptance.js';
 import { runMicrosoftStorePackageGeneration } from './microsoft-store-package-generation.js';
 import { defaultMpgdKitPath, initializeMicrosoftStoreStarter, listMicrosoftStoreInitializerTemplateFiles, prepareBaseGameTemplateFile, resolveMicrosoftStoreAdapterDependencyVersion, } from './microsoft-store-starter.js';
@@ -18,6 +20,7 @@ import { targetConfigExtensionsFileEnv } from './target-config-env.js';
 export { renderGameAcceptanceMarkdown, resolveGameAcceptanceReleaseManifestFile, runGameAcceptance, defaultGameAcceptanceCommandTimeoutMs, maximumGameplayE2EReportBytes, } from './game-acceptance.js';
 export { createBrowserGameplayE2EDriver, } from './browser-gameplay-e2e.js';
 export { collectGameplayE2EPathEvidence, defaultGameplayE2EReportFile, maximumGameplayE2EStates, parseGameplayE2EPlan, readGameplayE2EPlan, renderGameplayE2EMarkdown, resolveGameplayE2EReportFile, runGameplayE2E, } from './gameplay-e2e.js';
+export { cloudflarePagesDeploymentProfiles, hostedPwaDeploymentHosts, isSupportedHostedPwaProfile, verifyHostedPwaDeployment, } from './hosted-pwa-deployment.js';
 export { defaultOfflinePlaytestArtifactDir, defaultOfflinePlaytestMaximumBytes, defaultOfflinePlaytestOutputDir, offlinePlaytestSchemaVersion, runOfflinePlaytestPackaging, } from './offline-playtest.js';
 export { assertMicrosoftStorePwaCacheTransition, assertMicrosoftStorePwaPrecacheUrl, assertMicrosoftStorePwaReleaseEvidence, inspectMicrosoftStorePwaBrowserCacheTransition, microsoftStorePwaCacheSchema, readMicrosoftStorePwaBrowserReleaseEvidence, requestMicrosoftStorePwaBrowserUpdate, resolveMicrosoftStorePwaScopedCacheName, } from './microsoft-store-pwa-e2e.js';
 export { createMicrosoftStorePackageAcceptanceRuntime, microsoftStorePackageAcceptanceSchemaVersion, parseMicrosoftStorePackageIdentity, parseWindowsAppCertificationResult, renderMicrosoftStorePackageAcceptanceMarkdown, runMicrosoftStorePackageAcceptance, } from './microsoft-store-package-acceptance.js';
@@ -989,6 +992,111 @@ const targetCommand = defineI18n({
                 });
             },
         }),
+        'verify-deployment': defineI18n({
+            name: 'verify-deployment',
+            description: 'Verify that a hosted deployment directory serves a verified PWA artifact unchanged.',
+            resource: commandResource({
+                en: 'Verify that a hosted deployment directory serves a verified PWA artifact unchanged.',
+                ko: '호스트 배포 디렉터리가 검증된 PWA 산출물을 변조 없이 서비스하는지 검증합니다.',
+            }, {
+                target: {
+                    en: 'Target that produced the source PWA artifact (microsoft-store).',
+                    ko: '원본 PWA 산출물을 생성한 타깃(microsoft-store).',
+                },
+                'deployment-root': {
+                    en: 'Host deployment directory to verify.',
+                    ko: '검증할 호스트 배포 디렉터리.',
+                },
+                'source-artifact-root': {
+                    en: 'Directory of the verified source PWA artifact.',
+                    ko: '검증된 원본 PWA 산출물 디렉터리.',
+                },
+                host: {
+                    en: `Hosting profile (${hostedPwaDeploymentHosts.join(', ')}).`,
+                    ko: `호스팅 프로필(${hostedPwaDeploymentHosts.join(', ')}).`,
+                },
+                profile: {
+                    en: `Host routing profile (${cloudflarePagesDeploymentProfiles.join(', ')}).`,
+                    ko: `호스트 라우팅 프로필(${cloudflarePagesDeploymentProfiles.join(', ')}).`,
+                },
+                'report-dir': {
+                    en: 'Directory for verification evidence files (defaults to the working directory).',
+                    ko: '검증 결과 파일을 기록할 디렉터리(기본값은 작업 디렉터리).',
+                },
+            }),
+            args: {
+                target: {
+                    type: 'positional',
+                    required: true,
+                    description: 'Target that produced the source PWA artifact (microsoft-store)',
+                },
+                'deployment-root': {
+                    type: 'string',
+                    required: true,
+                    description: 'Host deployment directory to verify.',
+                },
+                'source-artifact-root': {
+                    type: 'string',
+                    required: true,
+                    description: 'Directory of the verified source PWA artifact.',
+                },
+                host: {
+                    type: 'string',
+                    required: false,
+                    default: 'cloudflare-pages',
+                    description: `Hosting profile (${hostedPwaDeploymentHosts.join(', ')}).`,
+                },
+                profile: {
+                    type: 'string',
+                    required: false,
+                    default: 'api-only',
+                    description: `Host routing profile (${cloudflarePagesDeploymentProfiles.join(', ')}).`,
+                },
+                'report-dir': {
+                    type: 'string',
+                    required: false,
+                    description: 'Directory for verification evidence files (defaults to the working directory).',
+                },
+            },
+            run: (ctx) => {
+                const positionals = readLocalPositionals(ctx.positionals, [
+                    'target',
+                    'verify-deployment',
+                ]);
+                const target = normalizeConfiguredTargetName(readRequiredPositional(positionals, 0, 'target'));
+                if (target !== 'microsoft-store') {
+                    throw new Error(`Hosted deployment verification is not available for target: ${target}`);
+                }
+                const deploymentRoot = readRequiredCliOption(ctx.values['deployment-root'], '--deployment-root');
+                const sourceArtifactRoot = readRequiredCliOption(ctx.values['source-artifact-root'], '--source-artifact-root');
+                const host = readOptionalString(ctx.values.host) ?? 'cloudflare-pages';
+                const profile = readOptionalString(ctx.values.profile) ?? 'api-only';
+                if (!hostedPwaDeploymentHosts.includes(host)) {
+                    throw new Error(`Unsupported hosted PWA deployment host: ${host} `
+                        + `(supported: ${hostedPwaDeploymentHosts.join(', ')}).`);
+                }
+                if (!cloudflarePagesDeploymentProfiles.includes(profile)) {
+                    throw new Error(`Unsupported ${host} deployment profile: ${profile} `
+                        + `(supported: ${cloudflarePagesDeploymentProfiles.join(', ')}).`);
+                }
+                const reportDir = path.resolve(readOptionalString(ctx.values['report-dir']) ?? process.cwd());
+                assertReportDirectoryOutsideVerifiedTrees(reportDir, sourceArtifactRoot, deploymentRoot);
+                assertReportFilesSafeToWrite(reportDir);
+                const verification = verifyHostedPwaDeployment({
+                    sourceArtifactRoot,
+                    deploymentRoot,
+                    host: host,
+                    profile: profile,
+                });
+                mkdirSync(reportDir, { recursive: true });
+                writeEvidenceReportFiles({
+                    jsonFile: path.join(reportDir, 'hosted-pwa-verification.json'),
+                    markdownFile: path.join(reportDir, 'hosted-pwa-verification.md'),
+                    report: verification,
+                    markdown: renderHostedPwaVerificationMarkdown(verification),
+                });
+            },
+        }),
         'generate-package': defineI18n({
             name: 'generate-package',
             description: 'Generate a packaged target artifact with an external platform service.',
@@ -2258,6 +2366,109 @@ function readLocalPositionals(positionals, commandPath) {
     }
     return positionals.slice(commandPath.length);
 }
+/** Reject existing evidence destinations that are links into verified trees. */
+function assertReportFilesSafeToWrite(reportDir) {
+    for (const name of ['hosted-pwa-verification.json', 'hosted-pwa-verification.md']) {
+        const destination = path.join(reportDir, name);
+        let stat;
+        try {
+            stat = lstatSync(destination);
+        }
+        catch {
+            continue;
+        }
+        if (stat.isSymbolicLink()) {
+            throw new Error(`The report destination ${destination} is a symbolic link; refusing to follow `
+                + 'it because the report write must stay outside the verified trees.');
+        }
+        if (!stat.isFile()) {
+            throw new Error(`The report destination ${destination} is not a regular file; refusing to `
+                + 'write evidence through sockets, FIFOs, devices, or directories.');
+        }
+        if (stat.nlink > 1) {
+            throw new Error(`The report destination ${destination} has ${String(stat.nlink)} hard links; `
+                + 'refusing to write through a shared inode into the verified trees.');
+        }
+    }
+}
+function assertReportDirectoryOutsideVerifiedTrees(reportDir, sourceArtifactRoot, deploymentRoot) {
+    const canonicalReportDir = realpathThroughExistingAncestor(reportDir);
+    for (const [label, root] of [
+        ['source artifact', sourceArtifactRoot],
+        ['deployment', deploymentRoot],
+    ]) {
+        const resolvedRoot = realpathThroughExistingAncestor(root);
+        const distance = path.relative(resolvedRoot, canonicalReportDir);
+        if (distance === '' || (!distance.startsWith('..') && !path.isAbsolute(distance))) {
+            throw new Error(`The --report-dir must stay outside the verified ${label} directory; `
+                + `${reportDir} is inside ${resolvedRoot}, and writing evidence there would `
+                + 'mutate a read-only verification input.');
+        }
+    }
+}
+/** Canonicalize a possibly missing path through its nearest existing ancestor. */
+function realpathThroughExistingAncestor(candidate) {
+    let absolute = path.resolve(candidate);
+    while (true) {
+        try {
+            return realpathSync(absolute);
+        }
+        catch {
+            const parent = path.dirname(absolute);
+            if (parent === absolute) {
+                return absolute;
+            }
+            absolute = parent;
+        }
+    }
+}
+/** Markdown-escape a verification value, normalizing CR line endings first. */
+function escapeVerificationMarkdown(value) {
+    return escapeEvidenceMarkdownInline(value.replaceAll('\r\n', ' ').replaceAll('\r', ' '));
+}
+function renderHostedPwaVerificationMarkdown(verification) {
+    return [
+        '# Hosted PWA Deployment Verification',
+        '',
+        `- Host: ${escapeVerificationMarkdown(verification.host)} (${escapeVerificationMarkdown(verification.profile)} profile)`,
+        `- Source artifact: ${escapeVerificationMarkdown(verification.sourceArtifactRoot)}`,
+        `- Deployment: ${escapeVerificationMarkdown(verification.deploymentRoot)}`,
+        '- Release: '
+            + `${escapeVerificationMarkdown(verification.appVersion)} (build `
+            + `${escapeVerificationMarkdown(verification.buildId)}, revision `
+            + `${escapeVerificationMarkdown(verification.revision)})`,
+        `- Verified game files: ${verification.verifiedGameFileCount}`,
+        `- Recognized host files: ${verification.hostFileCount}`,
+        `- Worker routes (include): ${escapeVerificationMarkdown(verification.workerRoutes.include.join(', '))}`,
+        '',
+        '## Verified',
+        '',
+        '- Every source artifact file is present in the deployment with an identical sha256 digest.',
+        '- The source artifact release evidence revision recomputes from its own files.',
+        '- All local index.html references resolve inside the deployment.',
+        '- The `_routes.json` worker routing matches the reviewed profile exactly.',
+        '- Cache-Control policies are explicit for every asset URL: immutable',
+        '  (content-hashed pipelines) or revalidation (stable names) both satisfy',
+        '  the contract; missing or conflicting policies fail. The service worker',
+        '  and stable-name icons use no-store; the index, manifest, release',
+        '  evidence, and legal pages use revalidation.',
+        '- No redirect moves the PWA entry point or PWA-critical files.',
+        '',
+        '## Not verified',
+        '',
+        '- The Pages worker runtime behavior; exercise it with the host preview',
+        '  (for example `wrangler pages dev`) before deploying.',
+        '- CDN or account-level cache settings outside the deployment directory.',
+        '',
+    ].join('\n');
+}
+function readRequiredCliOption(value, label) {
+    const read = readOptionalString(value);
+    if (read === undefined) {
+        throw new Error(`${label} is required.`);
+    }
+    return read;
+}
 function readOptionalString(value) {
     return typeof value === 'string' && value.length > 0 ? value : undefined;
 }

package/dist/microsoft-store-pwa-release.d.ts

@@ -0,0 +1,58 @@
+import { type MicrosoftStorePwaReleaseEvidence } from './microsoft-store-pwa-e2e.js';
+/**
+* Release-evidence primitives shared by the build-time artifact writer and the
+* hosted-deployment verifier. Kept free of repo-internal imports so the public
+* CLI can verify deployments without the mpgd-kit checkout.
+*/
+export interface PrecacheEntry {
+  readonly url: string;
+  readonly source: string | Uint8Array;
+}
+export interface MicrosoftStorePwaProvenance {
+  readonly appVersion: string;
+  readonly buildId: string;
+  readonly sourceGitSha: string;
+  readonly kitGitSha: string;
+}
+export declare function assertMicrosoftStorePwaProvenance(input: MicrosoftStorePwaProvenance): MicrosoftStorePwaProvenance;
+export declare function createMicrosoftStorePwaRevision(input: {
+  readonly appVersion: string;
+  readonly buildId: string;
+  readonly sourceGitSha: string;
+  readonly kitGitSha: string;
+  readonly precacheEntries: readonly PrecacheEntry[];
+}): string;
+/**
+* Recompute a release revision by streaming each precached file through the
+* digest instead of materializing every payload in memory, for verifiers
+* that only have the artifact root and the recorded URL list.
+*/
+export declare function createMicrosoftStorePwaRevisionFromFiles(input: {
+  readonly appVersion: string;
+  readonly buildId: string;
+  readonly sourceGitSha: string;
+  readonly kitGitSha: string;
+  readonly precacheUrls: readonly string[];
+  readonly artifactRoot: string;
+}): string;
+export declare function createMicrosoftStorePwaReleaseEvidence(input: {
+  readonly pwaId: string;
+  readonly appVersion: string;
+  readonly buildId: string;
+  readonly sourceGitSha: string;
+  readonly kitGitSha: string;
+  readonly revision: string;
+  readonly precacheUrls: readonly string[];
+}): MicrosoftStorePwaReleaseEvidence;
+export declare function createMicrosoftStorePwaServiceWorker(evidence: MicrosoftStorePwaReleaseEvidence): string;
+export declare function readMicrosoftStorePwaReleaseEvidence(path: string): MicrosoftStorePwaReleaseEvidence;
+/**
+* Enumerate the precacheable files of a PWA artifact. Sourcemaps, the release
+* evidence document, and the service worker itself are excluded because the
+* release revision only covers the precached payload. Symbolic links are
+* rejected so callers cannot be tricked into hashing files outside the root.
+*/
+/** Enumerate only precache URLs without reading any payload bytes. */
+export declare function listPrecacheUrls(artifactRoot: string): readonly string[];
+export declare function listPrecacheEntries(artifactRoot: string): readonly PrecacheEntry[];
+export declare function requireGameSpecificPwaId(value: unknown): string;

package/dist/microsoft-store-pwa-release.js

@@ -0,0 +1,343 @@
+import { createHash } from 'node:crypto';
+import { closeSync, existsSync, openSync, readdirSync, readFileSync, readSync, statSync, } from 'node:fs';
+import { relative, resolve, sep } from 'node:path';
+import { assertMicrosoftStorePwaPrecacheUrl, assertMicrosoftStorePwaReleaseEvidence, microsoftStorePwaCacheSchema, } from './microsoft-store-pwa-e2e.js';
+export function assertMicrosoftStorePwaProvenance(input) {
+    return {
+        appVersion: requireNonEmptyString(input.appVersion, 'PWA app version'),
+        buildId: requireNonEmptyString(input.buildId, 'PWA build ID'),
+        sourceGitSha: requireGitSha(input.sourceGitSha, 'PWA source Git SHA'),
+        kitGitSha: requireGitSha(input.kitGitSha, 'PWA kit Git SHA'),
+    };
+}
+export function createMicrosoftStorePwaRevision(input) {
+    const hash = createHash('sha256');
+    const release = {
+        appVersion: requireNonEmptyString(input.appVersion, 'PWA app version'),
+        buildId: requireNonEmptyString(input.buildId, 'PWA build ID'),
+        sourceGitSha: requireGitSha(input.sourceGitSha, 'PWA source Git SHA'),
+        kitGitSha: requireGitSha(input.kitGitSha, 'PWA kit Git SHA'),
+    };
+    updateRevisionField(hash, microsoftStorePwaCacheSchema);
+    updateRevisionField(hash, JSON.stringify(release));
+    for (const entry of normalizePrecacheEntries(input.precacheEntries)) {
+        updateRevisionField(hash, entry.url);
+        updateRevisionField(hash, entry.source);
+    }
+    return hash.digest('hex').slice(0, 16);
+}
+/**
+ * Recompute a release revision by streaming each precached file through the
+ * digest instead of materializing every payload in memory, for verifiers
+ * that only have the artifact root and the recorded URL list.
+ */
+export function createMicrosoftStorePwaRevisionFromFiles(input) {
+    const hash = createHash('sha256');
+    const release = {
+        appVersion: requireNonEmptyString(input.appVersion, 'PWA app version'),
+        buildId: requireNonEmptyString(input.buildId, 'PWA build ID'),
+        sourceGitSha: requireGitSha(input.sourceGitSha, 'PWA source Git SHA'),
+        kitGitSha: requireGitSha(input.kitGitSha, 'PWA kit Git SHA'),
+    };
+    updateRevisionField(hash, microsoftStorePwaCacheSchema);
+    updateRevisionField(hash, JSON.stringify(release));
+    const urls = [...input.precacheUrls]
+        .filter((url) => url !== './pwa-release.json' && !url.endsWith('.map'))
+        .map(assertMicrosoftStorePwaPrecacheUrl)
+        .sort(compareCodeUnits);
+    for (const url of urls) {
+        const file = resolve(input.artifactRoot, url.replace(/^\.\//u, ''));
+        if (!existsSync(file)) {
+            throw new Error(`PWA precache URL has no artifact file: ${url}`);
+        }
+        updateRevisionField(hash, url);
+        hash.update(`${String(statSync(file).size)}:`);
+        hashStreamInto(hash, file);
+    }
+    return hash.digest('hex').slice(0, 16);
+}
+function hashStreamInto(hash, file) {
+    const handle = openSync(file, 'r');
+    const chunk = Buffer.allocUnsafe(1024 * 1024);
+    try {
+        let read = readSync(handle, chunk, 0, chunk.length, null);
+        while (read > 0) {
+            hash.update(chunk.subarray(0, read));
+            read = readSync(handle, chunk, 0, chunk.length, null);
+        }
+    }
+    finally {
+        closeSync(handle);
+    }
+}
+export function createMicrosoftStorePwaReleaseEvidence(input) {
+    const pwaId = requireGameSpecificPwaId(input.pwaId);
+    const revision = requireRevision(input.revision);
+    const cachePrefix = `mpgd-pwa-${createHash('sha256').update(pwaId).digest('hex').slice(0, 12)}-`;
+    return {
+        schemaVersion: 1,
+        cacheSchema: microsoftStorePwaCacheSchema,
+        pwaId,
+        appVersion: requireNonEmptyString(input.appVersion, 'PWA app version'),
+        buildId: requireNonEmptyString(input.buildId, 'PWA build ID'),
+        sourceGitSha: requireGitSha(input.sourceGitSha, 'PWA source Git SHA'),
+        kitGitSha: requireGitSha(input.kitGitSha, 'PWA kit Git SHA'),
+        configTarget: 'microsoft-store',
+        revision,
+        cachePrefix,
+        cacheNamePattern: `${cachePrefix}{scope}-${revision}`,
+        precacheUrls: normalizePrecacheUrls(input.precacheUrls),
+    };
+}
+export function createMicrosoftStorePwaServiceWorker(evidence) {
+    const revision = requireRevision(evidence.revision);
+    const cachePrefix = requireNonEmptyString(evidence.cachePrefix, 'PWA cache prefix');
+    const cacheNamePattern = requireNonEmptyString(evidence.cacheNamePattern, 'PWA cache name pattern');
+    const precacheUrls = normalizePrecacheUrls(evidence.precacheUrls);
+    if (cacheNamePattern !== `${cachePrefix}{scope}-${revision}`) {
+        throw new Error('PWA cache name pattern is inconsistent.');
+    }
+    return `'use strict';
+
+const CACHE_NAMESPACE = ${JSON.stringify(cachePrefix)};
+const CACHE_SCOPE = encodeURIComponent(self.registration.scope);
+const CACHE_PREFIX = CACHE_NAMESPACE + CACHE_SCOPE + '-';
+const CACHE_NAME = ${JSON.stringify(cacheNamePattern)}.replace('{scope}', CACHE_SCOPE);
+const PRECACHE_URLS = ${JSON.stringify(precacheUrls, null, 2)};
+const INDEX_URL = new URL('./index.html', self.registration.scope).href;
+const APP_BASE_URL = self.registration.scope;
+
+function escapeHtmlAttribute(value) {
+  return value
+    .replaceAll('&', '&')
+    .replaceAll('"', '"')
+    .replaceAll('<', '&lt;')
+    .replaceAll('>', '&gt;');
+}
+
+async function normalizeCachedNavigationResponse(response) {
+  if (!response.redirected) {
+    return response;
+  }
+
+  // Static hosts commonly canonicalize /index.html to /. A redirected response
+  // can be stored by Cache API, but Chromium rejects it when a service worker
+  // later returns it for a navigation whose URL is different. Reconstructing
+  // clears Response.url, so inject an explicit deployment-scope base before
+  // returning the same-origin app shell for a nested SPA route.
+  const html = await response.text();
+  const headPattern = /<head(?:\\s[^>]*)?>/iu;
+
+  if (!headPattern.test(html)) {
+    throw new Error('Cached PWA app shell is missing a head element.');
+  }
+
+  const headers = new Headers(response.headers);
+  headers.delete('content-encoding');
+  headers.delete('content-length');
+  const base = '<base href="' + escapeHtmlAttribute(APP_BASE_URL) + '">';
+  return new Response(html.replace(headPattern, (head) => head + base), {
+    headers,
+    status: response.status,
+    statusText: response.statusText,
+  });
+}
+
+self.addEventListener('install', (event) => {
+  event.waitUntil((async () => {
+    const cache = await caches.open(CACHE_NAME);
+
+    try {
+      const requests = PRECACHE_URLS.map((url) => new Request(
+        new URL(url, self.registration.scope),
+        { cache: 'reload' },
+      ));
+      await cache.addAll(requests);
+    } catch (error) {
+      try {
+        await caches.delete(CACHE_NAME);
+      } catch {
+        // Preserve the original installation error when cleanup also fails.
+      }
+      throw error;
+    }
+  })());
+});
+
+self.addEventListener('activate', (event) => {
+  event.waitUntil((async () => {
+    const cacheNames = await caches.keys();
+    await Promise.all(
+      cacheNames
+        .filter((name) => name.startsWith(CACHE_PREFIX) && name !== CACHE_NAME)
+        .map((name) => caches.delete(name)),
+    );
+    await self.clients.claim();
+  })());
+});
+
+self.addEventListener('fetch', (event) => {
+  const request = event.request;
+
+  if (request.method !== 'GET') {
+    return;
+  }
+
+  const url = new URL(request.url);
+
+  if (url.origin !== self.location.origin) {
+    return;
+  }
+
+  if (request.mode === 'navigate') {
+    event.respondWith((async () => {
+      const cache = await caches.open(CACHE_NAME);
+      const cachedIndex = await cache.match(INDEX_URL);
+      return cachedIndex === undefined
+        ? fetch(request)
+        : normalizeCachedNavigationResponse(cachedIndex);
+    })());
+    return;
+  }
+
+  event.respondWith((async () => {
+    const cache = await caches.open(CACHE_NAME);
+    return await cache.match(request, { ignoreSearch: true }) ?? fetch(request);
+  })());
+});
+`;
+}
+export function readMicrosoftStorePwaReleaseEvidence(path) {
+    return assertMicrosoftStorePwaReleaseEvidence(readJsonFile(path));
+}
+/**
+ * Enumerate the precacheable files of a PWA artifact. Sourcemaps, the release
+ * evidence document, and the service worker itself are excluded because the
+ * release revision only covers the precached payload. Symbolic links are
+ * rejected so callers cannot be tricked into hashing files outside the root.
+ */
+/** Enumerate only precache URLs without reading any payload bytes. */
+export function listPrecacheUrls(artifactRoot) {
+    const files = [];
+    const pendingDirectories = [artifactRoot];
+    while (pendingDirectories.length > 0) {
+        const directory = pendingDirectories.pop();
+        if (directory === undefined) {
+            throw new Error('PWA artifact traversal lost its directory.');
+        }
+        for (const entry of readdirSync(directory, { withFileTypes: true })) {
+            const path = resolve(directory, entry.name);
+            if (entry.isSymbolicLink()) {
+                throw new Error(`PWA artifact must not contain symbolic links: ${path}`);
+            }
+            if (entry.isDirectory()) {
+                pendingDirectories.push(path);
+            }
+            else if (entry.isFile()) {
+                files.push(path);
+            }
+        }
+    }
+    return files
+        .filter((path) => !path.endsWith('.map')
+        && !path.endsWith(`${sep}pwa-release.json`)
+        && !path.endsWith(`${sep}service-worker.js`))
+        .map((path) => toPrecacheUrl(artifactRoot, path))
+        .sort(compareCodeUnits);
+}
+export function listPrecacheEntries(artifactRoot) {
+    const files = [];
+    const pendingDirectories = [artifactRoot];
+    while (pendingDirectories.length > 0) {
+        const directory = pendingDirectories.pop();
+        if (directory === undefined) {
+            throw new Error('PWA artifact traversal lost its directory.');
+        }
+        for (const entry of readdirSync(directory, { withFileTypes: true })) {
+            const path = resolve(directory, entry.name);
+            if (entry.isSymbolicLink()) {
+                throw new Error(`PWA artifact must not contain symbolic links: ${path}`);
+            }
+            if (entry.isDirectory()) {
+                pendingDirectories.push(path);
+            }
+            else if (entry.isFile()) {
+                files.push(path);
+            }
+        }
+    }
+    return files
+        .filter((path) => !path.endsWith('.map')
+        && !path.endsWith(`${sep}pwa-release.json`)
+        && !path.endsWith(`${sep}service-worker.js`))
+        .map((path) => ({
+        url: toPrecacheUrl(artifactRoot, path),
+        source: readFileSync(path),
+    }))
+        .sort((left, right) => compareCodeUnits(left.url, right.url));
+}
+function normalizePrecacheEntries(entries) {
+    const entriesByUrl = new Map();
+    for (const entry of entries) {
+        const url = assertMicrosoftStorePwaPrecacheUrl(entry.url);
+        if (entriesByUrl.has(url)) {
+            throw new Error(`Duplicate PWA precache URL: ${url}`);
+        }
+        if (typeof entry.source !== 'string' && !(entry.source instanceof Uint8Array)) {
+            throw new Error(`PWA precache source must be bytes or text: ${url}`);
+        }
+        entriesByUrl.set(url, entry.source);
+    }
+    return [...entriesByUrl.entries()]
+        .sort(([left], [right]) => compareCodeUnits(left, right))
+        .map(([url, source]) => ({ url, source }));
+}
+function normalizePrecacheUrls(urls) {
+    const normalized = urls.map(assertMicrosoftStorePwaPrecacheUrl);
+    if (new Set(normalized).size !== normalized.length) {
+        throw new Error('PWA precache URLs must be unique.');
+    }
+    return normalized.sort(compareCodeUnits);
+}
+function toPrecacheUrl(root, path) {
+    const portablePath = relative(root, path).split(sep).join('/');
+    return assertMicrosoftStorePwaPrecacheUrl(`./${portablePath}`);
+}
+export function requireGameSpecificPwaId(value) {
+    const pwaId = requireNonEmptyString(value, 'Microsoft Store PWA manifest id');
+    if (pwaId === '.' || pwaId === './' || pwaId === '/') {
+        throw new Error('Microsoft Store PWA manifest id must be game-specific.');
+    }
+    return pwaId;
+}
+function updateRevisionField(hash, value) {
+    const bytes = typeof value === 'string' ? Buffer.from(value, 'utf8') : value;
+    hash.update(`${String(bytes.byteLength)}:`);
+    hash.update(bytes);
+}
+function requireGitSha(value, label) {
+    const sha = requireNonEmptyString(value, label);
+    if (!/^[0-9a-f]{40}$/u.test(sha)) {
+        throw new Error(`${label} must be a full 40-character hexadecimal SHA.`);
+    }
+    return sha;
+}
+function requireRevision(value) {
+    const revision = requireNonEmptyString(value, 'PWA revision');
+    if (!/^[0-9a-f]{16}$/u.test(revision)) {
+        throw new Error('PWA revision must be a 16-character hexadecimal digest.');
+    }
+    return revision;
+}
+function requireNonEmptyString(value, label) {
+    if (typeof value !== 'string' || value.trim().length === 0) {
+        throw new Error(`${label} must be a non-empty string.`);
+    }
+    return value.trim();
+}
+function compareCodeUnits(left, right) {
+    return left < right ? -1 : left > right ? 1 : 0;
+}
+function readJsonFile(path) {
+    return JSON.parse(readFileSync(path, 'utf8'));
+}