Add Microsoft Store multi-arch MSIX packaging for EvilFox 4.2.8.1 (x64+Arm64).

Stage Partner Center folder with listing assets and Arm64 binary; MakeAppx not present so README includes pack/bundle commands.

Co-authored-by: Cursor <cursoragent@cursor.com>

packaging/msix/AppxManifest.xml

@@ -30,6 +30,7 @@
   xmlns:rescap="http://schemas.microsoft.com/appx/manifest/foundation/windows10/restrictedcapabilities"
   IgnorableNamespaces="uap rescap">
 
+  <!-- ProcessorArchitecture is substituted by scripts/pack-msix.ps1 (x64 | arm64). Do not ship x86/AArch32. -->
   <Identity
     Name="EvilFox.EvilFox"
     Publisher="CN=EvilFox"

packaging/msix/README.md

@@ -1,13 +1,37 @@
-# MSIX packaging for Navis (Microsoft Store)
+# MSIX packaging for EvilFox (Microsoft Store)
 
-Navis ships as a **full-trust Win32 + WebView2** app. Prefer **MSIX** over a PWA:
+EvilFox ships as a **full-trust Win32 + WebView2** app. Prefer **MSIX** over a PWA:
 system proxy and protocol cores cannot be delivered as a Store PWA alone.
 
+## Multi-arch (x64 + Arm64)
+
+- Device family: `Windows.Desktop` (Win10 19041+ / Win11; `MaxVersionTested` 10.0.26100.0).
+- Architectures: **x64** and **arm64** only (no x86 / AArch32).
+- Pack script writes final artifacts to **`dist\microsoft-store\`**:
+  - `EvilFox_<ver>_x64.msix`
+  - `EvilFox_<ver>_arm64.msix`
+  - `EvilFox_<ver>.msixbundle` (when MakeAppx can bundle both)
+  - `README.txt` (Partner Center upload notes, RU+EN)
+  - `listing\` (store.csv + screenshots) — filled by the submission prep step
+
+If MakeAppx is missing, the script still stages under `packaging/msix/_staging_<arch>` and prints exact `makeappx` commands in `README.txt`.
+
 ## Prerequisites
 
-1. Build Windows binaries: `build.bat` → `dist\navis-release\windows\Navis.exe`
-2. [Windows SDK](https://developer.microsoft.com/windows/downloads/windows-sdk/) with `MakeAppx.exe` (and `SignTool.exe` for sideload signing)
-3. Optional: a code-signing certificate whose **Subject CN** matches `Identity/@Publisher` in `AppxManifest.xml`
+1. Build Windows x64: `build.bat` → `dist\navis-release\windows\EvilFox.exe`
+2. Cross-build Arm64 (`CGO_ENABLED=0`). **Important:** `goversioninfo -64` produces an **amd64** `cmd/vpnapp/resource.syso` — temporarily rename it aside for the arm64 link, then restore:
+
+   ```bat
+   set GOOS=windows
+   set GOARCH=arm64
+   set CGO_ENABLED=0
+   move cmd\vpnapp\resource.syso cmd\vpnapp\resource.syso.amd64.bak
+   go build -ldflags="-H windowsgui -s -w" -trimpath -o dist\navis-release\windows\arm64\EvilFox.exe ./cmd/vpnapp
+   move cmd\vpnapp\resource.syso.amd64.bak cmd\vpnapp\resource.syso
+   ```
+
+3. [Windows SDK](https://developer.microsoft.com/windows/downloads/windows-sdk/) with `MakeAppx.exe` (and `SignTool.exe` for sideload signing)
+4. Optional: code-signing certificate whose **Subject CN** matches `Identity/@Publisher`
 
 ## Pack
 
@@ -15,38 +39,39 @@ From the repo root (PowerShell):
 
 ```powershell
 .\scripts\pack-msix.ps1
+.\scripts\pack-msix.ps1 -Arch x64 -Version 4.2.8.1
+.\scripts\pack-msix.ps1 -Arch arm64 -ExePath dist\navis-release\windows\arm64\EvilFox.exe
+.\scripts\pack-msix.ps1 -Arch all -OutDir dist\microsoft-store
+.\scripts\pack-msix.ps1 -Publisher "CN=Your Store Publisher" -Name "EvilFox.EvilFox"
+.\scripts\pack-msix.ps1 -CertPath ".\certs\evilfox-msix.pfx" -CertPassword "..."
 ```
 
-Options:
-
-```powershell
-.\scripts\pack-msix.ps1 -ExePath "dist\navis-release\windows\Navis.exe" -Version "2.9.0.1"
-.\scripts\pack-msix.ps1 -Publisher "CN=Your Store Publisher" -Name "EvilFox.Navis"
-.\scripts\pack-msix.ps1 -CertPath ".\certs\navis-msix.pfx" -CertPassword "..."
-```
-
-Output: `dist\navis-release\windows\Navis_<version>.msix`
+Parameters: `-Arch x64|arm64|all`, `-OutDir`, `-Version`, `-Name`, `-Publisher`.
 
 ## Store submission
 
 1. Create the app in [Partner Center](https://partner.microsoft.com/dashboard).
-2. Copy **Package/Identity Name** and **Publisher** into `AppxManifest.xml` (or pass `-Name` / `-Publisher` to the script).
-3. Upload the `.msix` (Partner Center can re-sign with the Store cert).
-4. Declare **runFullTrust** and network capabilities; answer Store questions about VPN/proxy use.
-5. Privacy policy URL required (document system-proxy changes and outbound tunnel traffic).
-6. **Do not enable in-app self-update** for Store builds — Navis detects MSIX package identity and hides the updater (Store updates only).
+2. Copy **Package/Identity Name** and **Publisher** into `AppxManifest.xml` (or pass `-Name` / `-Publisher`).
+3. Upload **`.msixbundle`** if available, else both **`.msix`** files. Partner Center can re-sign with the Store cert.
+4. Device family: **Windows 10/11 Desktop** only. Arm64 covers Windows on ARM.
+5. Declare **runFullTrust** and network capabilities; answer Store questions about VPN/proxy use.
+6. Privacy policy URL on [evilfox.win](https://evilfox.win) required.
+7. Sign in to Visual Studio / Partner Center with the **same Store developer account** if using VS packaging / Store association.
+8. **Do not enable in-app self-update** for Store builds — EvilFox detects MSIX package identity and hides the updater (Store updates only).
+
+Optional: place arch-specific `wintun.dll` under `assets/wintun/<arch>/`. Without it, packaging still succeeds; TUN/VPN mode needs the dll next to the exe (proxy mode works without it).
 
 ## Sideload test
 
 ```powershell
-Add-AppxPackage -Path .\dist\navis-release\windows\Navis_3.9.0.1.msix
+Add-AppxPackage -Path .\dist\microsoft-store\EvilFox_4.2.8.1_x64.msix
 ```
 
 Unsigned packages need a trusted cert or developer mode / sideloading enabled.
 
 ## Remnawave notes
 
-Navis can pull configs from a Remnawave panel:
+EvilFox can pull configs from a Remnawave panel:
 
 1. Public subscription: paste `https://<panel>/api/sub/<shortUuid>` (or use panel URL + short UUID in the Remnawave block).
 2. Optional API token (panel → API Tokens) enables authenticated lookups:

packaging/msix/STORE_README_TEMPLATE.txt

@@ -0,0 +1,50 @@
+EvilFox Microsoft Store package folder
+Version: {{VERSION}}
+Generated: {{GENERATED}}
+
+=== Partner Center upload (EN) ===
+1. Sign in to Partner Center with the same Microsoft Store developer account
+   you use for Visual Studio packaging / Store association (same tenant).
+2. Open the EvilFox product -> Packages (Windows 10 / 11).
+3. Prefer uploading EvilFox_{{VERSION}}.msixbundle if present.
+   Otherwise upload each EvilFox_{{VERSION}}_<arch>.msix (x64 + arm64).
+4. Device family: check Windows 10 / 11 Desktop ONLY
+   (do NOT select Xbox, HoloLens, Surface Hub, IoT, Team, etc.).
+5. Arm64 package covers Windows on ARM. Do not ship x86 / AArch32;
+   Microsoft is dropping AArch32 on future WoA.
+6. Before final Store signing, replace Identity Name/Publisher with the
+   exact values from Partner Center (or let Partner Center re-sign).
+7. Privacy policy URL on https://evilfox.win is required for Store listing.
+
+=== Partner Center (RU) ===
+1. Войдите в Partner Center тем же аккаунтом разработчика Store,
+   что и в Visual Studio (ассоциация приложения / упаковка).
+2. Загрузите EvilFox_{{VERSION}}.msixbundle, если есть; иначе оба .msix
+   (x64 и arm64).
+3. Семейство устройств: только Windows 10/11 Desktop
+   (без Xbox / HoloLens / IoT и т.п.).
+4. Arm64 = Windows on ARM; x86/AArch32 не публикуем.
+5. Name/Publisher в манифесте должны совпадать с Partner Center
+   (или Store переподпишет пакет).
+6. Нужен URL политики конфиденциальности на evilfox.win.
+
+=== Artifacts ===
+{{ARTIFACTS}}
+
+=== MakeAppx ===
+{{MAKEAPPX}}
+
+=== wintun.dll ===
+{{WINTUN}}
+
+=== Listing assets ===
+listing\store.csv  - Partner Center bulk listing fields
+listing\screen\    - screenshots for Store listing
+
+=== Arm64 build note ===
+Cross-build (CGO_ENABLED=0):
+  set GOOS=windows
+  set GOARCH=arm64
+  rem temporarily move cmd\vpnapp\resource.syso (amd64 from goversioninfo -64)
+  go build -ldflags="-H windowsgui -s -w" -trimpath -o dist\navis-release\windows\arm64\EvilFox.exe ./cmd/vpnapp
+  rem restore resource.syso