feat(webid): add HTTP API server (releases, resolve, installer scripts)

Serves the HTTP API for webinstall.dev:
- GET /api/releases/{pkg}.json — classified release list from fsstore
- GET /v1/resolve/{pkg} — resolve OS/arch/version to a specific asset
- GET /api/installers/{pkg}.sh — render installer shell script
- GET /api/installers/{pkg}.ps1 — render installer PowerShell script

Git-clone packages include git_tag and git_commit_hash in responses.
UA detection infers OS/arch from User-Agent when not query-specified.

.github/ISSUE_TEMPLATE/new_installer.md

@@ -35,15 +35,18 @@ info, and doing a find and replace on a few file system path names.
    ```
 2. Copy the example template and update with info from Official Releases:
    <https://github.com/___CHANGE/ME___/releases>
+
    ```bash
    rsync -av _example/ CHANGE-ME/
    ```
+
    - [ ] update `CHANGE-ME/release.js` to use the official repo
    - [ ] Learn how `CHANGE-ME` unpacks (i.e. as a single file? as a .tar.gz? as
          a .tar.gz with a folder named CHANGE-ME?)
    - [ ] find and replace to change the name
      - [ ] update `CHANGE-ME/install.sh` (see `bat` and `jq` as examples)
      - [ ] update `CHANGE-ME/install.ps1` (see `bat` and `jq` as examples)
+
 3. Needs an updated tagline and cheat sheet
    - [ ] update `CHANGE-ME/README.md`
      - [ ] official URL

.gitignore

@@ -3,6 +3,16 @@ install-*.sh
 install-*.bat
 install-*.ps1
 
+# Go build outputs (from go run/build in repo root)
+/classify
+/e2etest
+/fetchraw
+/inspect
+/uaparse
+/webicached
+/zigtest
+/distributables.csv
+
 # local config
 .env.*
 *.env
@@ -18,7 +28,13 @@ node_modules/
 *.bak
 *.bak.*
 
+# agent session files
+agents/
+
 # other
 .DS_Store
 desktop.ini
 .directory
+LIVE_cache
+/webid
+bin/

AGENTS.md

@@ -0,0 +1,492 @@
+# Webi Installers — Agent Guide
+
+Webi installs dev tools to `~/.local/` without sudo. Each installer is a small
+package of 3-4 files. This guide tells you how to create and modify them.
+
+## Why Webi Exists
+
+Webi makes tool installation trivially repeatable for people who aren't
+sysadmins — freelance clients, junior devs, anyone who shouldn't have to care
+about PATH, permissions, or platform differences. Three things matter:
+
+1. **Install without friction.** No sudo, no manual PATH edits, no "necessary
+   but unimportant" steps leaking into the experience.
+2. **Know where things are.** The Files section tells you exactly what got
+   created or modified. Nothing should be mysterious.
+3. **Copy-paste recipes.** The cheat sheet is what you'd send someone less
+   experienced than yourself instead of a project's full README — scannable,
+   concrete, easy to reference by name.
+
+## Quick Start: Adding a New Installer
+
+1. Identify the **package type** (see [Categories](#categories) below)
+2. Find an existing installer of the same type to use as a template
+3. Create `<name>/releases.js`, `install.sh`, `install.ps1`, `README.md`
+4. Test with the command in [Testing releases.js](#testing-releasesjs)
+5. Run formatters before committing (see [Code Style](#code-style))
+
+## Directory Layout
+
+```
+<package-name>/
+  README.md          # YAML frontmatter + docs
+  releases.js        # Fetches release metadata (Node.js)
+  install.sh         # POSIX shell installer (macOS/Linux)
+  install.ps1        # PowerShell installer (Windows) — optional
+```
+
+Key infrastructure directories (do not modify without good reason):
+
+- `_webi/` — bootstrap templates, `normalize.js` (auto-detects OS/arch/ext from
+  filenames)
+- `_common/` — shared JS: `github.js`, `githubish.js`, `gitea.js`, `fetcher.js`
+- `_example/` — canonical template for new packages
+- `_examples/` — specialized templates (goreleaser, xz-compressed)
+
+## Categories
+
+Ref: <https://github.com/webinstall/webi-installers/issues/412>
+
+| Type  | Description                            | Template to copy |
+| ----- | -------------------------------------- | ---------------- |
+| `bin` | Single binary in tar/zip               | `koji`, `delta`  |
+| `bin` | Single bare binary (no archive)        | `arc`, `shfmt`   |
+| `bin` | Goreleaser-style archives              | `keypairs`       |
+| 📦    | Self-contained package (bin/man/share) | `node`, `go`     |
+| 📂    | Multiple binaries/scripts              | `pg`             |
+| 🔗    | Alias/redirect to another package      | `ripgrep` → `rg` |
+| 📝    | Bespoke / custom install               | `rustlang`       |
+
+## releases.js
+
+Fetches release metadata and returns a normalized object. Most packages use
+GitHub releases:
+
+```js
+'use strict';
+
+var github = require('../_common/github.js');
+var owner = 'OWNER';
+var repo = 'REPO';
+
+let Releases = module.exports;
+
+Releases.latest = async function () {
+  let all = await github(null, owner, repo);
+  return all;
+};
+
+Releases.sample = async function () {
+  let normalize = require('../_webi/normalize.js');
+  let all = await Releases.latest();
+  all = normalize(all);
+  all.releases = all.releases.slice(0, 5);
+  return all;
+};
+
+if (module === require.main) {
+  (async function () {
+    let samples = await Releases.sample();
+    console.info(JSON.stringify(samples, null, 2));
+  })();
+}
+```
+
+### Common release transformations
+
+**Strip version prefix** (monorepo or tool-prefixed tags):
+
+```js
+// e.g. "tools/monorel/v0.6.5" → "v0.6.5"
+rel.version = rel.version.replace(/^tools\/monorel\//, '');
+
+// e.g. "cli-v1.2.3" → "v1.2.3"
+rel.version = rel.version.replace(/^cli-/, '');
+```
+
+**Filter releases** (monorepo with multiple tools, or unwanted assets):
+
+```js
+all.releases = all.releases.filter(function (rel) {
+  // Keep only releases for this tool
+  return rel.version.startsWith('tools/monorel/');
+});
+```
+
+Apply transformations inside `Releases.latest`, before returning `all`.
+
+**Available sources** beyond `github.js`:
+
+- `_common/gitea.js` — Gitea servers
+- `_common/git-tag.js` — Git tag listing
+- Custom fetch from any JSON API (see `go/releases.js`, `terraform/releases.js`)
+
+### Testing releases.js
+
+```sh
+node -e "
+  let Releases = require('./<name>/releases.js');
+  Releases.sample().then(function (all) {
+    console.log(JSON.stringify(all, null, 2));
+  });
+"
+```
+
+Verify: versions are clean semver (`0.6.5` not `tools/monorel/v0.6.5`), OS/arch
+detected correctly, download URLs resolve.
+
+## install.sh
+
+POSIX shell (`sh`, not bash). Always wrapped in a function:
+
+```sh
+#!/bin/sh
+# shellcheck disable=SC2034
+
+set -e
+set -u
+
+__init_pkgname() {
+    # These 6 variables are required
+    pkg_cmd_name="cmd"
+
+    pkg_dst_cmd="$HOME/.local/bin/cmd"
+    pkg_dst="$pkg_dst_cmd"
+
+    pkg_src_cmd="$HOME/.local/opt/cmd-v$WEBI_VERSION/bin/cmd"
+    pkg_src_dir="$HOME/.local/opt/cmd-v$WEBI_VERSION"
+    pkg_src="$pkg_src_cmd"
+
+    pkg_install() {
+        mkdir -p "$(dirname "$pkg_src_cmd")"
+        mv ./cmd "$pkg_src_cmd"
+    }
+
+    pkg_get_current_version() {
+        cmd --version 2> /dev/null | head -n 1 | cut -d' ' -f2
+    }
+}
+
+__init_pkgname
+```
+
+### Framework variables available in install.sh
+
+Set by the webi bootstrap (`_webi/package-install.tpl.sh`):
+
+| Variable        | Example             | Description           |
+| --------------- | ------------------- | --------------------- |
+| `WEBI_VERSION`  | `1.2.3`             | Selected version      |
+| `WEBI_PKG_URL`  | `https://...`       | Download URL          |
+| `WEBI_PKG_FILE` | `foo-v1.2.3.tar.gz` | Download filename     |
+| `WEBI_OS`       | `linux`             | Detected OS           |
+| `WEBI_ARCH`     | `amd64`             | Detected architecture |
+| `WEBI_EXT`      | `tar.gz`            | Archive extension     |
+| `WEBI_CHANNEL`  | `stable`            | Release channel       |
+| `PKG_NAME`      | `foo`               | Package name          |
+
+### Override functions
+
+| Function                    | Purpose                                       |
+| --------------------------- | --------------------------------------------- |
+| `pkg_install()`             | **Required.** Move files to `$pkg_src`        |
+| `pkg_get_current_version()` | Parse installed version from command output   |
+| `pkg_post_install()`        | Post-install setup (git config, shell config) |
+| `pkg_done_message()`        | Custom completion message                     |
+| `pkg_link()`                | Override default symlink behavior             |
+| `pkg_pre_install()`         | Custom pre-install logic                      |
+
+### Framework helper functions
+
+| Function                 | Purpose                            |
+| ------------------------ | ---------------------------------- |
+| `webi_download()`        | Download package if not cached     |
+| `webi_extract()`         | Extract archive by extension       |
+| `webi_path_add <dir>`    | Add to PATH via envman             |
+| `webi_link()`            | Create versioned symlinks          |
+| `webi_check_installed()` | Check if version already installed |
+
+### pkg_install patterns
+
+**Bare binary in archive root:**
+
+```sh
+mv ./cmd "$pkg_src_cmd"
+```
+
+**Binary in a subdirectory (goreleaser-style `cmd-OS-arch/cmd`):**
+
+```sh
+mv ./cmd-*/cmd "$pkg_src_cmd"
+```
+
+**Flexible detection (handles multiple archive layouts):**
+
+```sh
+if test -f ./cmd; then
+    mv ./cmd "$pkg_src_cmd"
+elif test -e ./cmd-*/cmd; then
+    mv ./cmd-*/cmd "$pkg_src_cmd"
+elif test -e ./cmd-*; then
+    mv ./cmd-* "$pkg_src_cmd"
+fi
+```
+
+## install.ps1
+
+PowerShell for Windows. Uses `$Env:` variables. See `_example/install.ps1` for
+the full template. Key differences from install.sh:
+
+- Paths use backslashes, commands end in `.exe`
+- `$Env:USERPROFILE` instead of `$HOME`
+- `Test-Path`, `Move-Item`, `Copy-Item` instead of shell equivalents
+- Downloads go to `$Env:USERPROFILE\Downloads\webi\`
+- Temp work in `.local\tmp`, use `Push-Location`/`Pop-Location`
+- Symlinks done via `Copy-Item` (not actual symlinks)
+
+## README.md
+
+````markdown
+---
+title: toolname
+homepage: https://github.com/owner/repo
+tagline: |
+  toolname: A short one-line description.
+---
+
+To update or switch versions, run `webi toolname@stable` (or `@v2`, `@beta`,
+etc).
+
+### Files
+
+These are the files that are created and/or modified with this installer:
+
+```text
+~/.config/envman/PATH.env
+~/.local/bin/toolname
+~/.local/opt/toolname-VERSION/bin/toolname
+```
+
+## Cheat Sheet
+
+> `toolname` does X. Brief description.
+
+### How to use toolname
+
+```sh
+toolname --example
+```
+````
+
+Note: **Files goes above Cheat Sheet**, not inside it.
+
+### Cheat Sheet tone and style
+
+Webi cheat sheets are **opinionated quick-reference guides**, not comprehensive
+documentation. Think "colleague's sticky note" — not the project's official
+README.
+
+The tool is the topic, but **the problem is the reason**. Cheat sheets are
+organized around tasks the reader already wants to do — the tool is how they get
+there. Headings reference the tool (the reader came to this page on purpose),
+but the content solves the underlying problem completely:
+
+- "How to reverse proxy to Node" (caddy knowledge, not just node)
+- "How to run a Node app as a System Service" (serviceman knowledge)
+- "How to Enable Secure Remote Postgres Access" (openssl, pg_hba.conf, systemd)
+- "How to manually configure git to use delta" (gitconfig, not delta flags)
+- "How to make fish the default shell in iTerm2" (iTerm2 knowledge, not fish)
+
+The reader's question is "how do I do X?" and the cheat sheet answers it
+completely — including configs, adjacent tools, and platform-specific
+variations. A goreleaser cheat sheet teaches you goreleaser YAML. A postgres
+cheat sheet teaches you pg_hba.conf, openssl certs, and systemd units.
+
+Cheat sheets cross tool boundaries freely. Node's references caddy, serviceman,
+setcap-netbind, GitHub Actions. Postgres references serviceman, openrc, launchd.
+They link to each other's webi pages. The scope is "everything you need to
+accomplish this task," not "everything this one binary does."
+
+They show the actual files and configs that matter — not documentation _about_
+configs, but the configs themselves, copy-pasteable, with inline comments
+explaining the non-obvious parts.
+
+**Guidelines:**
+
+- **Show the 3-5 things someone will actually do**, with copy-pasteable
+  commands. Skip exhaustive flag lists and API docs.
+- **Lead with practical integration.** Show the exact `git config` lines, the
+  exact hook script, the exact shell alias — don't just explain the feature and
+  leave wiring up to the reader.
+- **Skip what they already know.** No need to re-explain what the tool is at
+  length — the tagline and one-liner blockquote handle that. Get to the
+  commands.
+- **Prefer concrete over abstract.** Instead of "you can configure X via a
+  config file", show the config file contents.
+
+## Shell Naming Conventions
+
+**Variables:**
+
+- `ALL_CAPS` — environment variables only (`PATH`, `HOME`, `WEBI_VERSION`)
+- `b_varname` — block-scoped (inside a function, loop, or conditional)
+- `g_varname` — global to the script (and sourced scripts)
+- `a_varname` — function arguments
+
+**Functions and commands:**
+
+- `fn_name` — helper functions (anything other than the script's main/entry
+  function)
+- `cmd_name` — command aliases, e.g. `cmd_curl='curl --fail-with-body -sSL'`
+
+## Code Style
+
+Requires `node`, `shfmt`, `pwsh`, and `pwsh-essentials` (install all via webi).
+Run before committing:
+
+```sh
+npm run fmt         # prettier (JS/MD) + shfmt (sh) + pwsh-fmt (ps1)
+npm run lint        # jshint + shellcheck + pwsh-lint
+```
+
+Commit messages: `feat(<pkg>): add installer`, `fix(<pkg>): update install.sh`,
+`docs(<pkg>): add cheat sheet`.
+
+## Naming Conventions
+
+- The canonical package name is the **command name** you type: `go`, `node`,
+  `rg`
+- The alternate/alias name is the project name: `golang`, `nodejs`, `ripgrep`
+- Package directories are lowercase with hyphens
+
+## Common Pitfalls
+
+- **Monorepo releases**: The GitHub API returns ALL releases for the repo. You
+  must filter in `releases.js` and strip the tag prefix from the version.
+- **No `--version` flag**: Some tools lack version introspection. Comment out
+  `pkg_get_current_version` — webi still works, it just can't skip reinstalls.
+- **normalize.js auto-detection**: OS/arch/ext are guessed from download
+  filenames. If the tool uses non-standard naming, you may need to set `os`,
+  `arch`, or `ext` explicitly in `releases.js`.
+- **Goreleaser archives**: Typically contain a bare binary at the archive root
+  (not nested in a directory). Use `mv ./cmd "$pkg_src_cmd"`.
+
+---
+
+## Go Cache Daemon
+
+The Go pipeline (`cmd/webicached`) replaces the Node.js release-fetching code.
+It reads `releases.conf` files, fetches upstream release metadata, classifies
+build assets, and writes to `~/.cache/webi/legacy/` in the format the Node.js server expects.
+
+### Canonical Vocabulary
+
+The classifier MUST use exactly these strings. They match the production API.
+
+**OS**: `macos` (NOT `darwin`), `linux`, `windows`, `freebsd`, `openbsd`,
+`netbsd`, `dragonfly`, `aix`, `illumos`, `plan9`, `solaris`, `posix_2017`
+
+**Arch** — exact equivalences:
+- `amd64` (NOT `x86_64`), `x86` (NOT `i386`/`i686`/`386`)
+- `arm64` (NOT `aarch64`)
+- `armv7l` (NOT `armv7`), `armv6l` (NOT `armv6`)
+- `mipsle` (NOT `mipsel`), `mips64le` (NOT `mips64el`)
+
+**Arch** — compatibility downcasts:
+- `armhf` → `armv7l`, `armv7a` → `armv7l`, `armel` → `arm`
+
+**Arch** — other: `arm`, `ppc64le`, `ppc64`, `loong64`, `riscv64`, `s390x`,
+`mips`, `mips64`
+
+**Libc**: `none` (never empty), `gnu`, `musl`, `msvc`
+
+**Ext**: `tar.gz`, `tar.xz`, `zip`, `exe`, `7z`, `pkg`, `msi`
+(no leading dot; `exe` for bare binaries)
+
+### releases.conf
+
+Each package directory contains a `releases.conf` that tells the daemon where
+to fetch releases. Format is `key = value`, one per line. `#` comments and
+blank lines are ignored.
+
+#### Source types (mutually exclusive — pick one)
+
+```ini
+# GitHub binary releases (most common)
+github_releases = sharkdp/bat
+
+# GitHub source tarballs (with optional git fallback)
+github_sources = bnnanet/serviceman
+git_url = https://github.com/bnnanet/serviceman.git
+
+# Git tag enumeration (vim plugins, shell scripts — git_url alone)
+git_url = https://github.com/tpope/vim-commentary.git
+
+# Gitea (full URL required, or short form + base_url)
+gitea_releases = https://git.rootprojects.org/root/pathman
+
+# GitLab (defaults to gitlab.com)
+gitlab_releases = owner/repo
+
+# HashiCorp releases API
+hashicorp_product = terraform
+
+# Custom source (servicemandist, nodedist, zigdist, etc.)
+source = nodedist
+url = https://nodejs.org/download/release
+```
+
+#### Filtering, versioning, and platform
+
+```ini
+tag_prefix = bun-                    # monorepo: strip prefix from version
+version_prefixes = jq-               # strip from version string (space-separated)
+asset_filter = MinGit                # filename must contain this substring
+exclude = busybox -src- -docs-       # skip assets containing these (space-separated)
+os = posix_2017                      # restrict ALL versions to this OS (blanket)
+alias_of = rg                        # mirrors another package's releases
+```
+
+#### Design rules
+
+- `os` is a blanket tag on ALL versions. Only use for packages that are always
+  POSIX-only. For version-dependent OS tagging, use a custom `TagVariants` in
+  `internal/releases/{pkg}/variants.go`.
+- `git_url` can be primary (gittag source when it's the only key) or secondary
+  fallback alongside `github_sources`/`gitea_sources`.
+- Full URL forms accepted for github/gitea/gitlab (e.g.
+  `github_releases = https://github.com/sharkdp/bat`).
+
+### Testing
+
+Test tools: `cmd/e2etest` (pipeline comparison), `cmd/comparecache` (cache diff),
+`cmd/inspect` (single-package debug). Run each with `--help` for usage.
+
+### Classifier vs Per-Package Tagger
+
+The general classifier (`internal/classify/`) handles patterns common across
+many projects. It MUST NOT contain one-off logic for a single package.
+
+Per-package taggers (`internal/releases/{pkg}/variants.go`) handle
+project-specific knowledge. Read the existing taggers for conventions.
+
+MUST: Derive arch/OS from concrete evidence — not blanket defaults.
+MUST: New general classifier patterns must apply to 2-3+ packages.
+
+### Deploying
+
+```sh
+./scripts/deploy-webicached.sh beta.webi.sh
+./scripts/deploy-webicached.sh next.webi.sh
+```
+
+First-time setup on a new host uses `serviceman`:
+
+```sh
+serviceman add --name webicached \
+  --workdir ~/srv/webid/installers/ -- \
+  ~/bin/webicached \
+    --envfile ~/srv/webid/.env.secret \
+    --conf ~/srv/webid/installers/ \
+    --raw ~/.cache/webi/raw
+```

CONTRIBUTING.md

@@ -10,7 +10,6 @@
 
 - You'll be asked to make changes if you don't run the code formatters and
   linters:
-
   - Node / JavaScript:
     - [prettier](https://webinstall.dev/prettier)
       ```sh
@@ -21,7 +20,6 @@
       npm run lint
       ```
   - Bash
-
     - [shfmt](https://webinstall.dev/shfmt)
       ```sh
       npm run shfmt

_common/brew.js

@@ -1,62 +0,0 @@
-'use strict';
-
-let Fetcher = require('../_common/fetcher.js');
-
-/**
- * Gets releases from 'brew'.
- *
- * @param {null} _
- * @param {string} formula
- * @returns {Promise<any>}
- */
-async function getDistributables(_, formula) {
-  if (!formula) {
-    return Promise.reject('missing formula for brew');
-  }
-
-  let resp;
-  try {
-    let url = `https://formulae.brew.sh/api/formula/${formula}.json`;
-    resp = await Fetcher.fetch(url, {
-      headers: { Accept: 'application/json' },
-    });
-  } catch (e) {
-    /** @type {Error & { code: string, response: { status: number, body: string } }} */ //@ts-expect-error
-    let err = e;
-    if (err.code === 'E_FETCH_RELEASES') {
-      err.message = `failed to fetch '${formula}' release data from 'brew': ${err.response.status} ${err.response.body}`;
-    }
-    throw e;
-  }
-  let body = JSON.parse(resp.body);
-
-  var ver = body.versions.stable;
-  var dl = (
-    body.bottle.stable.files.high_sierra || body.bottle.stable.files.catalina
-  ).url.replace(new RegExp(ver.replace(/\./g, '\\.'), 'g'), '{{ v }}');
-  return [
-    {
-      version: ver,
-      download: dl.replace(/{{ v }}/g, ver),
-    },
-  ].concat(
-    body.versioned_formulae.map(
-      /** @param {String} f */
-      function (f) {
-        var ver = f.replace(/.*@/, '');
-        return {
-          version: ver,
-          download: dl,
-        };
-      },
-    ),
-  );
-}
-
-module.exports = getDistributables;
-
-if (module === require.main) {
-  getDistributables(null, 'mariadb').then(function (all) {
-    console.info(JSON.stringify(all, null, 2));
-  });
-}

_common/fetcher.js

@@ -1,56 +0,0 @@
-'use strict';
-
-let Fetcher = module.exports;
-
-/**
- * @typedef ResponseSummary
- * @prop {Boolean} ok
- * @prop {Headers} headers
- * @prop {Number} status
- * @prop {String} body
- */
-
-/**
- * @param {String} url
- * @param {RequestInit} opts
- * @returns {Promise<ResponseSummary>}
- */
-Fetcher.fetch = async function (url, opts) {
-  let resp = await fetch(url, opts);
-  let summary = Fetcher.throwIfNotOk(resp);
-
-  return summary;
-};
-
-/**
- * @param {Response} resp
- * @returns {Promise<ResponseSummary>}
- */
-Fetcher.throwIfNotOk = async function (resp) {
-  let text = await resp.text();
-
-  if (!resp.ok) {
-    let headers = Array.from(resp.headers);
-    console.error('[Fetcher] error: Response Headers:', headers);
-    console.error('[Fetcher] error: Response Text:', text);
-    let err = new Error(`fetch was not ok`);
-    Object.assign({
-      status: 503,
-      code: 'E_FETCH_RELEASES',
-      response: {
-        status: resp.status,
-        headers: headers,
-        body: text,
-      },
-    });
-    throw err;
-  }
-
-  let summary = {
-    ok: resp.ok,
-    headers: resp.headers,
-    status: resp.status,
-    body: text,
-  };
-  return summary;
-};

_common/git-tag.js

@@ -1,218 +0,0 @@
-'use strict';
-
-require('dotenv').config({ path: '.env' });
-
-var Crypto = require('crypto');
-var util = require('util');
-var exec = util.promisify(require('child_process').exec);
-var Fs = require('node:fs/promises');
-var FsSync = require('node:fs');
-var Path = require('node:path');
-
-var repoBaseDir = process.env.REPO_BASE_DIR || '';
-if (!repoBaseDir) {
-  repoBaseDir = Path.resolve('./_repos');
-  // for stderr
-  console.error(`[Warn] REPO_BASE_DIR= not set, ${repoBaseDir}`);
-}
-
-var Repos = {};
-
-Repos.clone = async function (repoPath, gitUrl) {
-  let uuid = Crypto.randomUUID();
-  let tmpPath = `${repoPath}.${uuid}.tmp`;
-  let bakPath = `${repoPath}.${uuid}.dup`;
-  await exec(`git clone --bare --filter=tree:0 ${gitUrl} ${tmpPath}`);
-
-  try {
-    FsSync.accessSync(repoPath);
-    return;
-  } catch (e) {
-    if (e.code !== 'ENOENT') {
-      throw e;
-    }
-  }
-
-  // sync to avoid race conditions
-  try {
-    FsSync.renameSync(repoPath, bakPath);
-  } catch (e) {
-    if (e.code !== 'ENOENT') {
-      throw e;
-    }
-  }
-  FsSync.renameSync(tmpPath, repoPath);
-
-  await Fs.rm(bakPath, { force: true, recursive: true });
-};
-
-Repos.checkExists = async function (repoPath) {
-  let err = await Fs.access(repoPath).catch(Object);
-  if (!err) {
-    return true;
-  }
-
-  if (err.code !== 'ENOENT') {
-    throw err;
-  }
-  return false;
-};
-
-Repos.fetch = async function (repoPath) {
-  await exec(`git --git-dir=${repoPath} fetch`);
-};
-
-Repos.getTags = async function (repoPath) {
-  var { stdout } = await exec(`git --git-dir=${repoPath} tag`);
-  var rawTags = stdout.trim().split('\n');
-
-  let tags = [];
-  for (let tag of rawTags) {
-    // ex: v1, v2, v1.1, 1.1.0-rc
-    let maybeVersionRe = /^(v\d+|v?\d+\.\d+)/;
-    let maybeVersion = maybeVersionRe.test(tag);
-    if (maybeVersion) {
-      tags.push(tag);
-    }
-  }
-
-  tags = tags.reverse();
-  return tags;
-};
-
-Repos.getTipInfo = async function (repoPath) {
-  var { stdout } = await exec(
-    `git --git-dir=${repoPath} rev-parse --abbrev-ref HEAD`,
-  );
-  var branch = stdout.trim();
-
-  var info = await Repos.getCommitInfo(repoPath, 'HEAD');
-  info.commitish = branch;
-
-  return info;
-};
-
-Repos.getCommitInfo = async function (repoPath, commitish) {
-  var { stdout } = await exec(
-    `git --git-dir=${repoPath} log -1 --format="%h %H %ad %cd" --date=iso-strict ${commitish}`,
-  );
-  stdout = stdout.trim();
-  var commitParts = stdout.split(/\s+/g);
-  return {
-    commitish: commitish,
-    commit_id: `${commitParts[0]}`,
-    commit: `${commitParts[1]}`,
-    date: commitParts[2],
-    date_authored: commitParts[3],
-  };
-};
-
-/**
- * Lists GitHub Releases (w/ uploaded assets)
- *
- * @param request
- * @param {string} owner
- * @param {string} gitUrl
- * @returns {PromiseLike<any> | Promise<any>}
- */
-async function getDistributables(gitUrl) {
-  let all = {
-    releases: [],
-    download: '',
-  };
-
-  let repoName = gitUrl.split('/').pop();
-  repoName = repoName.replace(/\.git$/, '');
-
-  let repoPath = `${repoBaseDir}/${repoName}.git`;
-
-  let isCloned = await Repos.checkExists(repoPath);
-  if (!isCloned) {
-    await Repos.clone(repoPath, gitUrl);
-  } else {
-    await Repos.fetch(repoPath);
-  }
-
-  let commitInfos = [];
-  let tags = await Repos.getTags(repoPath);
-  for (let tag of tags) {
-    let commitInfo = await Repos.getCommitInfo(repoPath, tag);
-    Object.assign(commitInfo, { version: tag, channel: '' });
-    commitInfos.push(commitInfo);
-  }
-
-  {
-    let tipInfo = await Repos.getTipInfo(repoPath);
-    // "2024-01-01T00:00:00-05:00" => "2024-01-01T05:00:00"
-    let date = new Date(tipInfo.date);
-    // "2024-01-01T05:00:00" => "v2024.01.01-05.00.00"
-    let version = date.toISOString();
-    // strip '.000Z'
-    version = version.replace(/\.\d+Z/, '');
-    version = version.replace(/[:\-]/g, '.');
-    version = version.replace(/T/, '-');
-    Object.assign(tipInfo, { version: `v${version}`, channel: '' });
-    if (commitInfos.length > 1) {
-      tipInfo.channel = 'beta';
-    }
-    commitInfos.push(tipInfo);
-  }
-
-  let releases = [];
-  for (let commitInfo of commitInfos) {
-    let version = commitInfo.version.replace(/^v/, '');
-
-    let date = new Date(commitInfo.date);
-    let isoDate = date.toISOString();
-    isoDate = isoDate.replace(/\.\d+Z/, '');
-
-    // tags and HEAD qualify for '--branch <branchish>'
-    let branch = commitInfo.commitish;
-
-    let rel = {
-      name: `${repoName}-v${version}`,
-      version: version,
-      git_tag: branch,
-      git_commit_hash: commitInfo.commit_id,
-      lts: false,
-      channel: commitInfo.channel,
-      date: isoDate,
-      os: '*',
-      arch: '*',
-      ext: 'git',
-      download: gitUrl,
-    };
-
-    releases.push(rel);
-  }
-  all.releases = releases;
-
-  return all;
-}
-
-module.exports = getDistributables;
-
-if (module === require.main) {
-  (async function main() {
-    let testRepos = [
-      // just a few tags, and a different HEAD
-      'https://github.com/tpope/vim-commentary.git',
-      // no tags, just HEAD
-      'https://github.com/ziglang/zig.vim.git',
-      // many, many tags
-      //'https://github.com/dense-analysis/ale.git',
-    ];
-    for (let url of testRepos) {
-      let all = await getDistributables(url);
-
-      all = require('../_webi/normalize.js')(all);
-      console.info(JSON.stringify(all, null, 2));
-    }
-  })()
-    .then(function () {
-      process.exit(0);
-    })
-    .catch(function (err) {
-      console.error(err);
-    });
-}

_common/gitea.js

@@ -1,47 +0,0 @@
-'use strict';
-
-var GitHubish = require('./githubish.js');
-
-/**
- * Lists Gitea Releases (w/ uploaded assets)
- *
- * @param {null} _ - deprecated
- * @param {String} owner
- * @param {String} repo
- * @param {String} baseurl
- * @param {String} [username]
- * @param {String} [token]
- */
-async function getDistributables(
-  _,
-  owner,
-  repo,
-  baseurl,
-  username = '',
-  token = '',
-) {
-  baseurl = `${baseurl}/api/v1`;
-  let all = await GitHubish.getDistributables({
-    owner,
-    repo,
-    baseurl,
-    username,
-    token,
-  });
-  return all;
-}
-
-module.exports = getDistributables;
-
-if (module === require.main) {
-  getDistributables(
-    null,
-    'root',
-    'pathman',
-    'https://git.rootprojects.org',
-    '',
-    '',
-  ).then(function (all) {
-    console.info(JSON.stringify(all, null, 2));
-  });
-}

_common/github-source.js

@@ -1,40 +0,0 @@
-'use strict';
-
-require('dotenv').config({ path: '.env' });
-
-let GitHubSource = module.exports;
-
-let GitHubishSource = require('./githubish-source.js');
-
-/**
- * @param {Object} opts
- * @param {String} opts.owner
- * @param {String} opts.repo
- * @param {String} [opts.baseurl]
- * @param {String} [opts.username]
- * @param {String} [opts.token]
- */
-GitHubSource.getDistributables = async function ({
-  owner,
-  repo,
-  baseurl = 'https://api.github.com',
-  username = process.env.GITHUB_USERNAME || '',
-  token = process.env.GITHUB_TOKEN || '',
-}) {
-  let all = await GitHubishSource.getDistributables({
-    owner,
-    repo,
-    baseurl,
-    username,
-    token,
-  });
-  return all;
-};
-
-if (module === require.main) {
-  GitHubSource.getDistributables(null, 'BeyondCodeBootcamp', 'DuckDNS.sh').then(
-    function (all) {
-      console.info(JSON.stringify(all, null, 2));
-    },
-  );
-}

_common/github.js

@@ -1,42 +0,0 @@
-'use strict';
-
-require('dotenv').config({ path: '.env' });
-
-let GitHubish = require('./githubish.js');
-
-/**
- * Lists GitHub Releases (w/ uploaded assets)
- *
- * @param {null} _ - deprecated
- * @param {String} owner
- * @param {String} repo
- * @param {String} [baseurl]
- * @param {String} [username]
- * @param {String} [token]
- */
-module.exports = async function (
-  _,
-  owner,
-  repo,
-  baseurl = 'https://api.github.com',
-  username = process.env.GITHUB_USERNAME || '',
-  token = process.env.GITHUB_TOKEN || '',
-) {
-  let all = await GitHubish.getDistributables({
-    owner,
-    repo,
-    baseurl,
-    username,
-    token,
-  });
-  return all;
-};
-
-let GitHub = module.exports;
-GitHub.getDistributables = module.exports;
-
-if (module === require.main) {
-  GitHub.getDistributables(null, 'BurntSushi', 'ripgrep').then(function (all) {
-    console.info(JSON.stringify(all, null, 2));
-  });
-}

_common/githubish-source.js

@@ -1,174 +0,0 @@
-'use strict';
-
-let Fetcher = require('../_common/fetcher.js');
-
-let GitHubishSource = module.exports;
-
-/**
- * Lists GitHub-Like Releases (source tarball & zip)
- *
- * @param {Object} opts
- * @param {String} opts.owner
- * @param {String} opts.repo
- * @param {String} opts.baseurl
- * @param {String} [opts.username]
- * @param {String} [opts.token]
- */
-GitHubishSource.getDistributables = async function ({
-  owner,
-  repo,
-  baseurl,
-  username = '',
-  token = '',
-}) {
-  if (!owner) {
-    throw new Error('missing owner for repo');
-  }
-  if (!repo) {
-    throw new Error('missing repo name');
-  }
-  if (!baseurl) {
-    throw new Error('missing baseurl');
-  }
-
-  let url = `${baseurl}/repos/${owner}/${repo}/releases`;
-  let opts = {
-    headers: {
-      'Content-Type': 'appplication/json',
-    },
-  };
-
-  if (token) {
-    let userpass = `${username}:${token}`;
-    let basicAuth = btoa(userpass);
-    Object.assign(opts.headers, {
-      Authorization: `Basic ${basicAuth}`,
-    });
-  }
-
-  let resp;
-  try {
-    resp = await Fetcher.fetch(url, opts);
-  } catch (e) {
-    /** @type {Error & { code: string, response: { status: number, body: string } }} */ //@ts-expect-error
-    let err = e;
-    if (err.code === 'E_FETCH_RELEASES') {
-      err.message = `failed to fetch '${baseurl}' (githubish-source, user '${username}) release data: ${err.response.status} ${err.response.body}`;
-    }
-    throw e;
-  }
-  let gHubResp = JSON.parse(resp.body);
-
-  let all = {
-    /** @type {Array<BuildInfo>} */
-    releases: [],
-    download: '',
-  };
-
-  for (let release of gHubResp) {
-    let dists = GitHubishSource.releaseToDistributables(release);
-    for (let dist of dists) {
-      let updates =
-        await GitHubishSource.followDistributableDownloadAttachment(dist);
-      Object.assign(dist, updates);
-      all.releases.push(dist);
-    }
-  }
-
-  return all;
-};
-
-/**
- * @typedef BuildInfo
- * @prop {String} [name] - name to use instead of filename for hash urls
- * @prop {String} version
- * @prop {String} [_version]
- * @prop {String} [arch]
- * @prop {String} channel
- * @prop {String} date
- * @prop {String} download
- * @prop {String} [ext]
- * @prop {String} [_filename]
- * @prop {String} [hash]
- * @prop {String} [libc]
- * @prop {Boolean} [_musl]
- * @prop {Boolean} [lts]
- * @prop {String} [size]
- * @prop {String} os
- */
-
-/**
- * @param {any} ghRelease - TODO
- * @returns {Array<BuildInfo>}
- */
-GitHubishSource.releaseToDistributables = function (ghRelease) {
-  let ghTag = ghRelease['tag_name']; // TODO tags aren't always semver / sensical
-  let lts = /(\b|_)(lts)(\b|_)/.test(ghRelease['tag_name']);
-  let channel = 'stable';
-  if (ghRelease['prerelease']) {
-    channel = 'beta';
-  }
-  let date = ghRelease['published_at'] || '';
-  date = date.replace(/T.*/, '');
-
-  let urls = [ghRelease.tarball_url, ghRelease.zipball_url];
-  /** @type {Array<BuildInfo>} */
-  let dists = [];
-  for (let url of urls) {
-    dists.push({
-      name: '',
-      version: ghTag,
-      lts: lts,
-      channel: channel,
-      date: date,
-      os: '*',
-      arch: '*',
-      libc: '',
-      ext: '',
-      download: url,
-    });
-  }
-
-  return dists;
-};
-
-/**
- * @param {BuildInfo} dist
- */
-GitHubishSource.followDistributableDownloadAttachment = async function (dist) {
-  let abortCtrl = new AbortController();
-  let resp = await fetch(dist.download, {
-    method: 'HEAD',
-    redirect: 'follow',
-    signal: abortCtrl.signal,
-  });
-  let headers = Object.fromEntries(resp.headers);
-
-  // Workaround for bug where METHOD changes to GET
-  abortCtrl.abort();
-  await resp.text().catch(function (err) {
-    if (err.name !== 'AbortError') {
-      throw err;
-    }
-  });
-
-  // ex: content-disposition: attachment; filename=BeyondCodeBootcamp-DuckDNS.sh-v1.0.1-0-ga2f4bde.zip
-  //  => BeyondCodeBootcamp-DuckDNS.sh-v1.0.1-0-ga2f4bde.zip
-  let name = headers['content-disposition'].replace(
-    /.*filename=([^;]+)(;|$)/,
-    '$1',
-  );
-  let download = resp.url;
-
-  return { name, download };
-};
-
-if (module === require.main) {
-  GitHubishSource.getDistributables({
-    owner: 'BeyondCodeBootcamp',
-    repo: 'DuckDNS.sh',
-    baseurl: 'https://api.github.com',
-  }).then(function (all) {
-    console.info(JSON.stringify(all, null, 2));
-  });
-}

_common/githubish.js

@@ -1,137 +0,0 @@
-'use strict';
-
-let Fetcher = require('../_common/fetcher.js');
-
-/**
- * @typedef DistributableRaw
- * @prop {String} name
- * @prop {String} version
- * @prop {Boolean} lts
- * @prop {String} [channel]
- * @prop {String} date
- * @prop {String} os
- * @prop {String} arch
- * @prop {String} ext
- * @prop {String} download
- */
-
-let GitHubish = module.exports;
-
-/**
- * Lists GitHub-Like Releases (w/ uploaded assets)
- *
- * @param {Object} opts
- * @param {String} opts.owner
- * @param {String} opts.repo
- * @param {String} opts.baseurl
- * @param {String} [opts.username]
- * @param {String} [opts.token]
- */
-GitHubish.getDistributables = async function ({
-  owner,
-  repo,
-  baseurl,
-  username = '',
-  token = '',
-}) {
-  if (!owner) {
-    throw new Error('missing owner for repo');
-  }
-  if (!repo) {
-    throw new Error('missing repo name');
-  }
-  if (!baseurl) {
-    throw new Error('missing baseurl');
-  }
-
-  let url = `${baseurl}/repos/${owner}/${repo}/releases`;
-  let opts = {
-    headers: {
-      'Content-Type': 'appplication/json',
-    },
-  };
-
-  if (token) {
-    let userpass = `${username}:${token}`;
-    let basicAuth = btoa(userpass);
-    Object.assign(opts.headers, {
-      Authorization: `Basic ${basicAuth}`,
-    });
-  }
-
-  let resp;
-  try {
-    resp = await Fetcher.fetch(url, opts);
-  } catch (e) {
-    /** @type {Error & { code: string, response: { status: number, body: string } }} */ //@ts-expect-error
-    let err = e;
-    if (err.code === 'E_FETCH_RELEASES') {
-      err.message = `failed to fetch '${baseurl}' (githubish, user '${username}) release data: ${err.response.status} ${err.response.body}`;
-    }
-    throw e;
-  }
-  let gHubResp = JSON.parse(resp.body);
-
-  let all = {
-    /** @type {Array<DistributableRaw>} */
-    releases: [],
-    // todo make this ':baseurl' + ':releasename'
-    download: '',
-  };
-
-  try {
-    gHubResp.forEach(transformReleases);
-  } catch (e) {
-    /** @type {Error & { code: string, response: { status: number, body: string } }} */ //@ts-expect-error
-    let err = e;
-    console.error(err.message);
-    console.error('Error Headers:', resp.headers);
-    console.error('Error Body:', resp.body);
-    let msg = `failed to transform releases from '${baseurl}' with user '${username}'`;
-    throw new Error(msg);
-  }
-
-  /**
-   * @param {any} release - TODO
-   */
-  function transformReleases(release) {
-    for (let asset of release['assets']) {
-      let name = asset['name'];
-      let date = release['published_at']?.replace(/T.*/, '');
-      let download = asset['browser_download_url'];
-
-      // TODO tags aren't always semver / sensical
-      let version = release['tag_name'];
-      let channel;
-      if (release['prerelease']) {
-        // -rcX, -preview, -beta, etc will be checked in _webi/normalize.js
-        channel = 'beta';
-      }
-      let lts = /(\b|_)(lts)(\b|_)/.test(release['tag_name']);
-
-      all.releases.push({
-        name: name,
-        version: version,
-        lts: lts,
-        channel: channel,
-        date: date,
-        os: '', // will be guessed by download filename
-        arch: '', // will be guessed by download filename
-        ext: '', // will be normalized
-        download: download,
-      });
-    }
-  }
-
-  return all;
-};
-
-if (module === require.main) {
-  GitHubish.getDistributables({
-    owner: 'BurntSushi',
-    repo: 'ripgrep',
-    baseurl: 'https://api.github.com',
-  }).then(function (all) {
-    console.info(JSON.stringify(all, null, 2));
-  });
-}

_example/install.ps1

@@ -19,13 +19,13 @@ New-Item "$Env:USERPROFILE\Downloads\webi" -ItemType Directory -Force | Out-Null
 $pkg_download = "$Env:USERPROFILE\Downloads\webi\$Env:WEBI_PKG_FILE"
 
 # Fetch archive
-IF (!(Test-Path -Path "$Env:USERPROFILE\Downloads\webi\$Env:WEBI_PKG_FILE")) {
+if (!(Test-Path -Path "$Env:USERPROFILE\Downloads\webi\$Env:WEBI_PKG_FILE")) {
     Write-Output "Downloading foobar from $Env:WEBI_PKG_URL to $pkg_download"
     & curl.exe -A "$Env:WEBI_UA" -fsSL "$Env:WEBI_PKG_URL" -o "$pkg_download.part"
     & Move-Item "$pkg_download.part" "$pkg_download"
 }
 
-IF (!(Test-Path -Path "$pkg_src_cmd")) {
+if (!(Test-Path -Path "$pkg_src_cmd")) {
     Write-Output "Installing foobar"
 
     # TODO: create package-specific temp directory

_example/releases.conf

@@ -0,0 +1,3 @@
+# Example releases.conf — uses ripgrep as a sample project.
+# Copy this file into your package directory and adjust.
+github_releases = BurntSushi/ripgrep

_example/releases.js

@@ -1,37 +0,0 @@
-'use strict';
-
-var github = require('../_common/github.js');
-var owner = 'BurntSushi';
-var repo = 'ripgrep';
-
-/******************************************************************************/
-/** Note: Delete this Comment!                                               **/
-/**                                                                          **/
-/** Need a an example that filters out miscellaneous release files?          **/
-/**   See `deno`, `gitea`, or `caddy`                                        **/
-/**                                                                          **/
-/******************************************************************************/
-
-let Releases = module.exports;
-
-Releases.latest = async function () {
-  let all = await github(null, owner, repo);
-  return all;
-};
-
-Releases.sample = async function () {
-  let normalize = require('../_webi/normalize.js');
-  let all = await Releases.latest();
-  all = normalize(all);
-  // just select the first 5 for demonstration
-  all.releases = all.releases.slice(0, 5);
-  return all;
-};
-
-if (module === require.main) {
-  (async function () {
-    let samples = await Releases.sample();
-
-    console.info(JSON.stringify(samples, null, 2));
-  })();
-}

_scripts/pwsh-fmt.ps1

@@ -15,8 +15,8 @@ foreach ($my_dir in $my_dirs) {
         $my_ps1 = [System.IO.Path]::GetRelativePath($my_cwd, $my_file.FullName)
         $my_dir = [System.IO.Path]::GetDirectoryName($my_file.FullName)
 
-        if (-Not (Test-Path -PathType Leaf -Path $my_ps1) -or
-            -Not (Test-Path -PathType Container -Path $my_dir)) {
+        if (-not (Test-Path -PathType Leaf -Path $my_ps1) -or
+            -not (Test-Path -PathType Container -Path $my_dir)) {
             Write-Host ("    SKIP {0} (non-regular file or parent directory)" -f $my_ps1)
             continue
         }
@@ -31,7 +31,7 @@ foreach ($my_dir in $my_dirs) {
         $my_new_file | Set-Content -Path $my_ps1
 
         $my_new_file = $my_new_file + "`n"
-        IF ($text -ne $my_new_file) {
+        if ($text -ne $my_new_file) {
             $my_status = 1
         }
     }

_scripts/pwsh-lint.ps1

@@ -15,8 +15,8 @@ foreach ($my_dir in $my_dirs) {
         $my_ps1 = [System.IO.Path]::GetRelativePath($my_cwd, $my_file.FullName)
         $my_dir = [System.IO.Path]::GetDirectoryName($my_file.FullName)
 
-        if (-Not (Test-Path -PathType Leaf -Path $my_ps1) -or
-            -Not (Test-Path -PathType Container -Path $my_dir)) {
+        if (-not (Test-Path -PathType Leaf -Path $my_ps1) -or
+            -not (Test-Path -PathType Container -Path $my_dir)) {
             Write-Host ("    SKIP {0} (non-regular file or parent directory)" -f $my_ps1)
             continue
         }
@@ -39,7 +39,7 @@ foreach ($my_dir in $my_dirs) {
         $my_new_file | Set-Content -Path $my_ps1
 
         $my_new_file = $my_new_file + "`n"
-        IF ($my_old_file -ne $my_new_file) {
+        if ($my_old_file -ne $my_new_file) {
             $my_status = 1
         }
     }

_vim-example/install.ps1

@@ -1,6 +1,6 @@
 #!/usr/bin/env pwsh
 
-IF (!(Test-Path -Path "$Env:USERPROFILE\.vim\pack\plugins\start")) {
+if (!(Test-Path -Path "$Env:USERPROFILE\.vim\pack\plugins\start")) {
     New-Item -Path "$Env:USERPROFILE\.vim\pack\plugins\start" -ItemType Directory -Force | Out-Null
 }
 Remove-Item -Path "$Env:USERPROFILE\.vim\pack\plugins\start\example" -Recurse -ErrorAction Ignore

_webi/builds-cacher-test.js

@@ -13,7 +13,6 @@ async function main() {
     caches: CACHE_DIR,
     installers: INSTALLERS_DIR,
   });
-  bc.freshenRandomPackage(600 * 1000);
 
   // let dirs = await bc.getProjectsByType();
   // let projNames = Object.keys(dirs.valid);

_webi/builds-cacher.js

@@ -3,13 +3,16 @@
 var BuildsCacher = module.exports;
 
 let Fs = require('node:fs/promises');
+let Os = require('node:os');
 let Path = require('node:path');
 
+let LEGACY_CACHE_DIR = Path.join(Os.homedir(), '.cache/webi/legacy');
+
 let HostTargets = require('./build-classifier/host-targets.js');
 let Lexver = require('./build-classifier/lexver.js');
 let Triplet = require('./build-classifier/triplet.js');
 
-var ALIAS_RE = /^alias: (\w+)$/m;
+var ALIAS_RE = /^alias: ([\w.-]+)$/m;
 
 var LEGACY_ARCH_MAP = {
   '*': 'ANYARCH',
@@ -56,14 +59,15 @@ var TERMS_META = [
 /** @typedef {String} VersionString */
 /** @typedef {Object.<VersionString, Array<BuildAsset>>} PackagesByRelease */
 
-/** @typedef {ProjectMeta & ProjectInfoPartial} ProjectInfo */
 /**
- * @typedef ProjectMeta
+ * @typedef ProjectInfo
+ * @prop {Array<BuildAsset>} releases
  * @prop {Array<BuildAsset>} packages
  * @prop {Object.<TripletString, PackagesByRelease>} releasesByTriplet
  * @prop {Array<import('./build-classifier/types.js').ArchString>} arches
  * @prop {Array<import('./build-classifier/types.js').OsString>} oses
  * @prop {Array<import('./build-classifier/types.js').LibcString>} libcs
+ * @prop {Array<String>} channels
  * @prop {Array<String>} formats
  * @prop {Array<String>} triplets
  * @prop {Array<String>} versions
@@ -71,12 +75,6 @@ var TERMS_META = [
  * @prop {Object.<String, String>} lexversMap
  */
 
-/**
- * @typedef ProjectInfoPartial
- * @prop {Array<BuildAsset>} releases
- * @prop {Array<String>} channels
- */
-
 /**
  * @typedef BuildAsset
  * @prop {String} name
@@ -88,8 +86,6 @@ var TERMS_META = [
  * @prop {String} libc
  * @prop {String} ext
  * @prop {String} download
- * @prop {import('./build-classifier/types.js').TargetTriplet} [target]
- * @prop {String} [lexver]
  */
 
 /**
@@ -107,18 +103,6 @@ var TERMS_META = [
  * @prop {Error} target.error
  */
 
-/**
- * @typedef {Error & WebiErrorPartial} WebiError
- * @typedef WebiErrorPartial
- * @prop {String} code
- * @prop {Number} status
- */
-
-/** @typedef {String} PathString */
-
-/**
- * @param {PathString} path
- */
 async function getPartialHeader(path) {
   let readme = `${path}/README.md`;
   let head = await readFirstBytes(readme).catch(function (err) {
@@ -131,9 +115,8 @@ async function getPartialHeader(path) {
   return head;
 }
 
-/**
- * @param {PathString} path
- */
+// let fsOpen = util.promisify(Fs.open);
+// let fsRead = util.promisify(Fs.read);
 async function readFirstBytes(path) {
   let start = 0;
   let n = 1024;
@@ -146,81 +129,8 @@ async function readFirstBytes(path) {
   return str;
 }
 
-/** @type {Object.<String, Promise<void>>} */
-let promises = {};
-
-/**
- * @param {import('../_example/releases.js')?} Releases
- * @param {PathString} installersDir
- * @param {PathString} cacheDir
- * @param {PathString} name
- * @param {Date?} [date]
- */
-async function getLatestBuilds(Releases, installersDir, cacheDir, name, date) {
-  console.info(`[INFO] getLatestBuilds: ${name}`);
-
-  if (!Releases) {
-    Releases = require(`${installersDir}/${name}/releases.js`);
-  }
-  if (!Releases) {
-    throw new Error('unreachable: narrowing for type checker');
-  }
-
-  // TODO update all releases files with module.exports.xxxx = 'foo';
-  if (!Releases.latest) {
-    //@ts-expect-error
-    Releases.latest = Releases;
-  }
-
-  let id = `${cacheDir}/${name}`;
-  if (!promises[id]) {
-    promises[id] = Promise.resolve();
-  }
-
-  promises[id] = promises[id].then(async function () {
-    return await getLatestBuildsInner(Releases, cacheDir, name, date);
-  });
-
-  return await promises[id];
-}
-
-/**
- * @param {import('../_example/releases.js')} Releases
- * @param {PathString} cacheDir
- * @param {PathString} name
- * @param {Date?} [date]
- */
-async function getLatestBuildsInner(Releases, cacheDir, name, date) {
-  let data = await Releases.latest();
-
-  if (!date) {
-    date = new Date();
-  }
-  let isoDate = date.toISOString();
-  let yearMonth = isoDate.slice(0, 7);
-
-  // TODO hash file
-  let dataFile = `${cacheDir}/${yearMonth}/${name}.json`;
-  // TODO fsstat releases.js vs require-ing time as well
-  let tsFile = `${cacheDir}/${yearMonth}/${name}.updated.txt`;
-
-  let dirPath = Path.dirname(dataFile);
-  await Fs.mkdir(dirPath, { recursive: true });
-
-  let json = JSON.stringify(data, null, 2);
-  await Fs.writeFile(dataFile, json, 'utf8');
-
-  let seconds = date.valueOf();
-  let ms = seconds / 1000;
-  let msStr = ms.toFixed(3);
-  await Fs.writeFile(tsFile, msStr, 'utf8');
-
-  return data;
-}
-
-BuildsCacher.create = function ({ ALL_TERMS, installers, caches }) {
+BuildsCacher.create = function ({ ALL_TERMS, installers }) {
   let installersDir = installers;
-  let cacheDir = caches;
 
   if (!ALL_TERMS) {
     ALL_TERMS = Triplet.TERMS_PRIMARY_MAP;
@@ -231,16 +141,15 @@ BuildsCacher.create = function ({ ALL_TERMS, installers, caches }) {
   bc.orphanTerms = Object.assign({}, bc.ALL_TERMS);
   bc.unknownTerms = {};
   bc.usedTerms = {};
-  /** @type {Array<String>} */
   bc.formats = [];
   bc._triplets = {};
   bc._targetsByBuildIdCache = {};
-  /** @type {Object.<String, ProjectInfo>} */
   bc._caches = {};
-  bc._staleAge = 15 * 60 * 1000;
-  /** @type {Object.<String, Array<String>>} */
   bc._allFormats = {};
   bc._allTriplets = {};
+  // Per-name lock: serializes cold-cache getPackages so concurrent
+  // callers can't corrupt bc._caches[name] via a transformAndUpdate race.
+  bc._inflight = {};
 
   for (let term of TERMS_META) {
     delete bc.orphanTerms[term];
@@ -259,19 +168,6 @@ BuildsCacher.create = function ({ ALL_TERMS, installers, caches }) {
     let entries = await Fs.readdir(installersDir, { withFileTypes: true });
     for (let entry of entries) {
       let meta = await bc.getProjectTypeByEntry(entry);
-      if (meta.type === 'not_found') {
-        let err = meta.detail;
-        console.error('');
-        console.error('PROBLEM');
-        console.error(`    ${err.message}`);
-        console.error('');
-        console.error('SOLUTION');
-        console.error('    npm clean-install');
-        console.error('');
-        throw new Error(
-          '[SANITY FAIL] should never have missing modules in prod',
-        );
-      }
       dirs[meta.type][entry.name] = meta.detail;
     }
 
@@ -286,8 +182,8 @@ BuildsCacher.create = function ({ ALL_TERMS, installers, caches }) {
     let filepath = Path.join(installersDir, name);
     let entry;
     try {
-      let stat = await Fs.lstat(filepath);
-      entry = Object.assign(stat, { name: name });
+      entry = await Fs.lstat(filepath);
+      Object.assign(entry, { name: name });
     } catch (e) {
       return { type: 'errors', detail: 'not found' };
     }
@@ -298,7 +194,7 @@ BuildsCacher.create = function ({ ALL_TERMS, installers, caches }) {
 
   /**
    * Get project type and detail - alias, selfhosted, valid (and the invalids)
-   * @param {Omit<import('fs').Dirent, "path"|"parentPath">} entry
+   * @param {fs.Stats|fs.Dirent} entry
    */
   bc.getProjectTypeByEntry = async function (entry) {
     let path = Path.join(installersDir, entry.name);
@@ -340,43 +236,43 @@ BuildsCacher.create = function ({ ALL_TERMS, installers, caches }) {
       return { type: 'alias', detail: link };
     }
 
-    let releasesPath = Path.join(path, 'releases.js');
-    try {
-      void require(releasesPath);
-    } catch (_err) {
-      /** @type {WebiError} */ // @ts-expect-error
-      let err = _err;
-      if (err.code !== 'MODULE_NOT_FOUND') {
-        return { type: 'errors', detail: err };
-      }
-
-      if (err.message.includes(`Cannot find module '${releasesPath}'`)) {
-        return { type: 'selfhosted', detail: true };
-      }
-
-      return { type: 'not_found', detail: err };
+    let cacheFile = `${LEGACY_CACHE_DIR}/${entry.name}.json`;
+    let hasCacheFile = await Fs.access(cacheFile)
+      .then(function () {
+        return true;
+      })
+      .catch(function () {
+        return false;
+      });
+    if (!hasCacheFile) {
+      return { type: 'selfhosted', detail: true };
     }
 
     return { type: 'valid', detail: true };
   };
 
-  /**
-   * Typically a package is organized by release (ex: go has 1.20, 1.21, etc),
-   * but we will organize by the build (ex: go1.20-darwin-arm64.tar.gz, etc).
-   *
-   * @param {Object} opts
-   * @param {import('../_example/releases.js')?} [opts.Releases]
-   * @param {PathString} opts.name
-   * @param {Date} opts.date
-   */
-  bc.getPackages = async function ({ Releases = null, name, date }) {
-    if (!date) {
-      date = new Date();
+  // Typically a package is organized by release (ex: go has 1.20, 1.21, etc),
+  // but we will organize by the build (ex: go1.20-darwin-arm64.tar.gz, etc).
+  bc.getPackages = async function (args) {
+    let name = args.name;
+    let warm = bc._caches[name];
+    if (warm) {
+      return _doGetPackages(args);
     }
-    let isoDate = date.toISOString();
-    let yearMonth = isoDate.slice(0, 7);
-    let dataFile = `${cacheDir}/${yearMonth}/${name}.json`;
-    let tsFile = `${cacheDir}/${yearMonth}/${name}.updated.txt`;
+    let inflight = bc._inflight[name];
+    if (inflight) {
+      return inflight;
+    }
+    let p = _doGetPackages(args).finally(function () {
+      delete bc._inflight[name];
+    });
+    bc._inflight[name] = p;
+    return p;
+  };
+
+  async function _doGetPackages({ name }) {
+    let dataFile = `${LEGACY_CACHE_DIR}/${name}.json`;
+    let tsFile = `${LEGACY_CACHE_DIR}/${name}.updated.txt`;
 
     let tsDate;
     {
@@ -394,7 +290,6 @@ BuildsCacher.create = function ({ ALL_TERMS, installers, caches }) {
 
     let projInfo = bc._caches[name];
 
-    /** @type {ProjectMeta} */
     let meta = {
       // version info
       versions: projInfo?.versions || [],
@@ -413,28 +308,25 @@ BuildsCacher.create = function ({ ALL_TERMS, installers, caches }) {
     };
 
     if (!projInfo) {
-      let NULLSTRING = 'null';
       let json = await Fs.readFile(dataFile, 'ascii').catch(
         async function (err) {
           if (err.code !== 'ENOENT') {
             throw err;
           }
 
-          return NULLSTRING;
+          return null;
         },
       );
 
       try {
         projInfo = JSON.parse(json);
-      } catch (_err) {
-        /** @type {WebiError} */ // @ts-expect-error
-        let err = _err;
-        console.error(`error: ${dataFile}:\n\t${err.message}`);
+      } catch (e) {
+        console.error(`error: ${dataFile}:\n\t${e.message}`);
         projInfo = null;
       }
     }
     if (!projInfo) {
-      projInfo = await getLatestBuilds(Releases, installersDir, cacheDir, name);
+      return meta;
     }
     let latestProjInfo = await BuildsCacher.transformAndUpdate(
       name,
@@ -445,76 +337,8 @@ BuildsCacher.create = function ({ ALL_TERMS, installers, caches }) {
     );
     bc._caches[name] = latestProjInfo;
 
-    process.nextTick(async function () {
-      let now = date.valueOf();
-      let age = now - projInfo.updated;
-
-      let fresh = age < bc._staleAge;
-      if (fresh) {
-        return;
-      }
-
-      projInfo = await getLatestBuilds(Releases, installersDir, cacheDir, name)
-        .then(function () {
-          let latestProjInfo = BuildsCacher.transformAndUpdate(
-            name,
-            projInfo,
-            meta,
-            date,
-            bc,
-          );
-          bc._caches[name] = latestProjInfo;
-        })
-        .catch(function (err) {
-          console.error(`Fail when fetching latest builds for '${name}'`);
-          console.error(err);
-        });
-    });
-
-    return projInfo;
-  };
-
-  // Makes sure that packages are updated once an hour, on average
-  /** @type {Array<String>} */
-  bc._staleNames = [];
-  /** @type {ReturnType<typeof setTimeout>?} */
-  bc._freshenTimeout = null;
-  /**
-   * @param {Number?} [minDelay]
-   */
-  bc.freshenRandomPackage = async function (minDelay) {
-    if (!minDelay) {
-      minDelay = 15 * 1000;
-    }
-
-    if (bc._staleNames.length === 0) {
-      let dirs = await bc.getProjectsByType();
-      bc._staleNames = Object.keys(dirs.valid);
-      bc._staleNames.sort(function () {
-        return 0.5 - Math.random();
-      });
-    }
-
-    let name = bc._staleNames.pop();
-    void (await bc.getPackages({
-      //Releases: Releases,
-      name: name || '',
-      date: new Date(),
-    }));
-    console.info(`[INFO] freshenRandomPackage: ${name}`);
-
-    let hour = 60 * 60 * 1000;
-    let delay = minDelay;
-    let spread = hour / bc._staleNames.length;
-    let seed = Math.random();
-    delay += seed * spread;
-
-    if (bc._freshenTimeout) {
-      clearTimeout(bc._freshenTimeout);
-    }
-    bc._freshenTimeout = setTimeout(bc.freshenRandomPackage, delay);
-    bc._freshenTimeout.unref();
-  };
+    return latestProjInfo;
+  }
 
   /**
    * Given a list of acceptable formats, get the sorted list of of formats.
@@ -534,8 +358,6 @@ BuildsCacher.create = function ({ ALL_TERMS, installers, caches }) {
    *     .tar.xz
    *     .xz
    *     .zip
-   *
-   * @param {Array<String>} formats
    */
   bc.getSortedFormats = function (formats) {
     /* jshint maxcomplexity: 25 */
@@ -608,7 +430,10 @@ BuildsCacher.create = function ({ ALL_TERMS, installers, caches }) {
       exts.push('.gz');
       exts.push('.sh');
     }
-    exts.push('.git');
+    let hasGit = formats.includes('git') || formats.includes('.git');
+    if (hasGit) {
+      exts.push('.git');
+    }
 
     // Fallbacks
     // (we include everything to bubble an extract error over not found)
@@ -644,10 +469,6 @@ BuildsCacher.create = function ({ ALL_TERMS, installers, caches }) {
     return exts;
   };
 
-  /**
-   * @param {Array<BuildAsset>} packages
-   * @param {Array<String>} formats
-   */
   bc.selectPackage = function (packages, formats) {
     if (packages.length === 1) {
       return packages[0];
@@ -721,29 +542,19 @@ BuildsCacher.create = function ({ ALL_TERMS, installers, caches }) {
       return null;
     }
 
-    for (let _triplet of triplets) {
-      let targetReleases = projInfo.releasesByTriplet[_triplet];
-      if (!targetReleases) {
-        continue;
-      }
+    // Version-first iteration, not triplet-first: take the newest
+    // version even when its only build lives in a fallback triplet
+    // (e.g. serviceman v1.0.1 only exists at posix_2017-ANYARCH-none).
+    for (let lexver of projInfo.lexvers) {
+      let ver = projInfo.lexversMap[lexver] || lexver;
 
-      let versions = Object.keys(targetReleases);
-      //console.log('dbg: targetRelease versions', versions);
-      let lexvers = [];
-      for (let version of versions) {
-        let lexPrefix = Lexver.parseVersion(version);
-        lexvers.push(lexPrefix);
-      }
-      lexvers.sort();
-      lexvers.reverse();
-      // TODO get the other matchInfo props
+      for (let _triplet of triplets) {
+        let targetReleases = projInfo.releasesByTriplet[_triplet];
+        if (!targetReleases) {
+          continue;
+        }
 
-      // Make sure that these releases are the expected version
-      // (ex: jq1.7 => darwin-arm64-libc, jq1.6 => darwin-x86_64-libc)
-      for (let matchver of lexvers) {
-        let ver = projInfo.lexversMap[matchver] || matchver;
         let packages = targetReleases[ver];
-        //console.log('dbg: packages', packages);
         if (!packages) {
           continue;
         }
@@ -794,21 +605,33 @@ BuildsCacher.create = function ({ ALL_TERMS, installers, caches }) {
       return triplets;
     }
 
+    // Prefer platform-specific matches over ANYOS/ANYARCH fallbacks.
+    // This ensures e.g. darwin-aarch64-none matches before
+    // ANYOS-ANYARCH-none (.git source URLs from old releases).
     let oses = [];
     if (hostTarget.os === 'windows') {
-      oses = ['ANYOS', 'windows'];
+      oses = ['windows', 'ANYOS'];
     } else if (hostTarget.os === 'android') {
-      oses = ['ANYOS', 'posix_2017', 'posix_2024', 'android', 'linux'];
+      oses = ['android', 'linux', 'posix_2017', 'posix_2024', 'ANYOS'];
     } else {
-      oses = ['ANYOS', 'posix_2017', 'posix_2024', hostTarget.os];
+      oses = [hostTarget.os, 'posix_2017', 'posix_2024', 'ANYOS'];
     }
 
     let waterfall = HostTargets.WATERFALL[hostTarget.os] || {};
     let arches = waterfall[hostTarget.arch] ||
       HostTargets.WATERFALL.ANYOS[hostTarget.arch] || [hostTarget.arch];
-    arches = ['ANYARCH'].concat(arches);
-    let libcs = waterfall[hostTarget.libc] ||
-      HostTargets.WATERFALL.ANYOS[hostTarget.libc] || [hostTarget.libc];
+    arches = arches.concat(['ANYARCH']);
+    // termsToTarget omits libc for plain UAs; 'libc' → waterfall ['none','libc',...]
+    let libc = hostTarget.libc || 'libc';
+    let libcs = waterfall[libc] ||
+      HostTargets.WATERFALL.ANYOS[libc] || [libc];
+
+    // Extend the glibc-host waterfall: the table only lists [none, libc]
+    // but Rust projects (bat, rg) and node ship libc='gnu' builds, and
+    // static musl builds also run on glibc hosts.
+    if (libc === 'libc' && !libcs.includes('gnu')) {
+      libcs = ['none', 'gnu', 'musl', 'libc'];
+    }
 
     for (let os of oses) {
       for (let arch of arches) {
@@ -836,16 +659,18 @@ BuildsCacher.create = function ({ ALL_TERMS, installers, caches }) {
   return bc;
 };
 
-/**
- * @param {ReturnType<typeof BuildsCacher.create>} bc
- * @param {ProjectInfo} projInfo
- * @param {BuildAsset} build
- */
 BuildsCacher._classify = function (bc, projInfo, build) {
-  /* jshint maxcomplexity: 25 */
-  let maybeInstallable = Triplet.maybeInstallable(projInfo, build);
-  if (!maybeInstallable) {
-    return null;
+  /* jshint maxcomplexity: 30 */
+  // Cache entries arrive pre-classified (os/arch/libc/ext set). Skip
+  // maybeInstallable for those — it false-rejects names ending in a
+  // version tag (`serviceman-v1.0.1`, `v1.0.1.zip`).
+  let cacheClassified =
+    build.os && build.arch && build.libc && build.ext;
+  if (!cacheClassified) {
+    let maybeInstallable = Triplet.maybeInstallable(projInfo, build);
+    if (!maybeInstallable) {
+      return null;
+    }
   }
 
   if (LEGACY_OS_MAP[build.os]) {
@@ -909,16 +734,26 @@ BuildsCacher._classify = function (bc, projInfo, build) {
     bc.unknownTerms[term] = true;
   }
 
-  // {NAME}.windows.x86_64v2.musl.exe
-  //     windows-x86_64_v2-musl
+  // Skip termsToTarget for cache-classified entries: it false-flags
+  // e.g. .git URLs as os=ANYOS while the cache says os=posix_2017,
+  // and the mismatch check throws.
   target = { triplet: '' };
-  try {
-    void Triplet.termsToTarget(target, projInfo, build, terms);
-  } catch (e) {
-    console.error(`PACKAGE FORMAT CHANGE for '${projInfo.name}':`);
-    console.error(e.message);
-    console.error(build);
-    return null;
+  if (cacheClassified) {
+    target.os = build.os;
+    target.arch = build.arch;
+    target.libc = build.libc;
+    target.vendor = build.vendor || 'unknown';
+    target.android = false;
+    target.unknownTerms = [];
+  } else {
+    try {
+      void Triplet.termsToTarget(target, projInfo, build, terms);
+    } catch (e) {
+      console.error(`PACKAGE FORMAT CHANGE for '${projInfo.name}':`);
+      console.error(e.message);
+      console.error(build);
+      return null;
+    }
   }
 
   target.triplet = `${target.arch}-${target.vendor}-${target.os}-${target.libc}`;
@@ -1021,11 +856,7 @@ BuildsCacher.transformAndUpdate = function (name, projInfo, meta, date, bc) {
 };
 
 // TODO
-//  - tag channels
-/**
- * @param {ProjectInfo} projInfo
- * @param {ProjectMeta} meta
- */
+//   - tag channels
 BuildsCacher.updateAndSortVersions = function (projInfo, meta) {
   for (let build of projInfo.packages) {
     let hasVersion = meta.versions.includes(build.version);
@@ -1045,31 +876,17 @@ BuildsCacher.updateAndSortVersions = function (projInfo, meta) {
     meta.versions.push(version);
   }
 
-  projInfo.packages.sort(BuildsCacher.sortByLexver);
+  projInfo.packages.sort(function (a, b) {
+    if (a.lexver > b.lexver) {
+      return -1;
+    }
+    if (a.lexver < b.lexver) {
+      return 1;
+    }
+    return 0;
+  });
 };
 
-/**
- * @typedef HasLexver
- * @prop {String} lexver
- */
-
-/**
- * @param {HasLexver} a
- * @param {HasLexver} b
- */
-BuildsCacher.sortByLexver = function (a, b) {
-  if (a.lexver > b.lexver) {
-    return -1;
-  }
-  if (a.lexver < b.lexver) {
-    return 1;
-  }
-  return 0;
-};
-
-/**
- * @param {ProjectMeta} meta
- */
 BuildsCacher.updateReleasesByTriplet = function (meta) {
   for (let build of meta.packages) {
     let target = build.target;

_webi/builds.js

@@ -15,11 +15,8 @@ let bc = BuildsCacher.create({
   caches: CACHE_DIR,
   installers: INSTALLERS_DIR,
 });
-bc.freshenRandomPackage(600 * 1000);
 
 Builds.init = async function () {
-  bc.freshenRandomPackage(600 * 1000);
-
   let dirs = await bc.getProjectsByType();
   let projNames = Object.keys(dirs.valid);
 
@@ -27,7 +24,6 @@ Builds.init = async function () {
   await Parallel.run(parallel, projNames, getAll);
   async function getAll(name) {
     void (await bc.getPackages({
-      //Releases: Releases,
       name: name,
       date: new Date(),
     }));

_webi/classify-one.js

@@ -1,11 +1,14 @@
 'use strict';
 
+let Fs = require('node:fs/promises');
+let Os = require('node:os');
 let Path = require('node:path');
 
-// let Builds = require('./builds.js');
 let BuildsCacher = require('./builds-cacher.js');
 let Triplet = require('./build-classifier/triplet.js');
 
+let LEGACY_CACHE_DIR = Path.join(Os.homedir(), '.cache/webi/legacy');
+
 async function main() {
   let projName = process.argv[2];
   if (!projName) {
@@ -36,16 +39,11 @@ async function main() {
     arches: [],
     libcs: [],
     formats: [],
-    // TODO channels: [],
   };
 
-  let installersDir = Path.join(__dirname, '..');
-  let Releases = require(`${installersDir}/${projName}/releases.js`);
-  if (!Releases.latest) {
-    Releases.latest = Releases;
-  }
-
-  let projInfo = await Releases.latest();
+  let dataFile = Path.join(LEGACY_CACHE_DIR, `${projName}.json`);
+  let json = await Fs.readFile(dataFile, 'utf8');
+  let projInfo = JSON.parse(json);
 
   // let packages = await Builds.getPackage({ name: projName });
   // console.log(packages);
@@ -70,9 +68,11 @@ async function main() {
   console.log(`[DEBUG] transformed`);
   let sample = transformed.packages.slice(0, 20);
   console.log('packages:', sample, ':packages');
+  let firstTriplet = Object.keys(transformed.releasesByTriplet)[0];
+  let firstVersion = transformed.versions[0];
   console.log(
-    'releasesByTriplet:',
-    transformed.releasesByTriplet['linux-x86_64-none'][transformed.versions[0]],
+    `releasesByTriplet[${firstTriplet}][${firstVersion}]:`,
+    transformed.releasesByTriplet[firstTriplet]?.[firstVersion],
     ':releasesByTriplet',
   );
   console.log('versions:', transformed.versions, ':versions');

_webi/curl-pipe-bootstrap.tpl.ps1

@@ -6,7 +6,7 @@
 ############################################################
 New-Item -Path "$Env:USERPROFILE\Downloads\webi" -ItemType Directory -Force | Out-Null
 New-Item -Path "$Env:USERPROFILE\.local\bin" -ItemType Directory -Force | Out-Null
-IF ($null -eq $Env:WEBI_HOST -or $Env:WEBI_HOST -eq "") { $Env:WEBI_HOST = "https://webinstall.dev" }
+if ($null -eq $Env:WEBI_HOST -or $Env:WEBI_HOST -eq "") { $Env:WEBI_HOST = "https://webinstall.dev" }
 curl.exe -s -A "windows" "$Env:WEBI_HOST/packages/webi/webi-pwsh.ps1" -o "$Env:USERPROFILE\.local\bin\webi-pwsh.ps1"
 Set-ExecutionPolicy -Scope Process Bypass
 & "$Env:USERPROFILE\.local\bin\webi-pwsh.ps1" "{{ exename }}"

_webi/lint-builds.js

@@ -139,8 +139,6 @@ async function main() {
     console.info('');
   }
 
-  bc.freshenRandomPackage(600 * 1000);
-
   let rows = [];
   let triples = [];
   let valids = Object.keys(dirs.valid);

_webi/normalize.js

@@ -1,259 +0,0 @@
-'use strict';
-
-// this may need customizations between packages
-var osMap = {
-  macos: /(\b|_)(apple|os(\s_-)?x\b|mac|darwin|iPhone|iOS|iPad)/i,
-  linux: /(\b|_)(linux)/i,
-  freebsd: /(\b|_)(freebsd)/i,
-  windows: /(\b|_)(win|microsoft|msft)/i,
-  sunos: /(\b|_)(sun)/i,
-  aix: /(\b|_)(aix)/i,
-};
-
-var maps = {
-  oses: {},
-  arches: {},
-  libcs: {},
-  formats: {},
-};
-
-Object.keys(osMap).forEach(function (name) {
-  maps.oses[name] = true;
-});
-
-var formats = ['zip', 'xz', 'tar', 'pkg', 'msi', 'git', 'exe', 'dmg', 'git'];
-formats.forEach(function (name) {
-  maps.formats[name] = true;
-});
-
-// evaluation order matters
-// (i.e. otherwise x86 and x64 can cross match)
-var arches = [
-  // arm64/aarch64 has very high specificity, so it comes first
-  'arm64',
-  // arm 7 is also generic aarch/arm/arm32
-  'armv7l',
-  // arm6 can run on armv7
-  'armv6l',
-  // amd64 is more likely and less often specified than arm64
-  'amd64',
-  'x86',
-  'ppc64le',
-  'ppc64',
-  's390x',
-];
-// Used for detecting system arch from package download url, for example:
-//
-// https://git.com/org/foo/releases/v0.7.9/foo-aarch64-linux-musl.tar.gz
-// https://git.com/org/foo/releases/v0.7.9/foo-arm-linux-musleabihf.tar.gz
-// https://git.com/org/foo/releases/v0.7.9/foo-armv7-linux-musleabihf.tar.gz
-// https://git.com/org/foo/releases/v0.7.9/foo-x86_64-linux-musl.tar.gz
-//
-var archMap = {
-  arm64: /(\b|_)(aarch64|arm64)/i,
-  armv7l: /(\b|_)(arm32|arm[_\-]?v?7l?)/i,
-  armv6l: /(\b|_)(arm|aarch32|arm[_\-]?v?6l?)(\b|_)/i,
-  //amd64: /(amd.?64|x64|[_\-]64)/i,
-  amd64:
-    /(\b|_|amd|(dar)?win(dows)?|mac(os)?|linux|osx|x)64([_\-]?bit)?(\b|_)/i,
-  //x86: /(86)(\b|_)/i,
-  x86: /(\b|_|amd|(dar)?win(dows)?|mac(os)?|linux|osx|x)(86|32|i?386)([_\-]?bit)?(\b|_)/i,
-  ppc64le: /(\b|_)(ppc64le)/i,
-  ppc64: /(\b|_)(ppc64)(\b|_)/i,
-  s390x: /(\b|_)(s390x)/i,
-};
-arches.forEach(function (name) {
-  maps.arches[name] = true;
-});
-
-var libcs = ['none', 'musl', 'gnu', 'msvc', 'libc'];
-libcs.forEach(function (name) {
-  maps.libcs[name] = true;
-});
-
-function normalize(all) {
-  /* jshint maxcomplexity:50 */
-  /* jshint maxdepth:10 */
-  var supported = {
-    oses: {},
-    arches: {},
-    libcs: {},
-    formats: {},
-  };
-
-  for (let rel of all.releases) {
-    rel.version = rel.version.replace(/^v/i, '');
-
-    if (!rel.name) {
-      rel.name = rel.download.replace(/.*\//, '');
-    }
-
-    if (!rel.os) {
-      rel.os = 'unknown';
-
-      let osNames = Object.keys(osMap);
-      for (let osName of osNames) {
-        let relName = rel.name || rel.download;
-        let osRegExp = osMap[osName];
-        let matches = osRegExp.test(relName);
-        if (matches) {
-          rel.os = osName;
-          break;
-        }
-      }
-    }
-    supported.oses[rel.os] = true;
-
-    if (!rel.arch) {
-      for (let arch of arches) {
-        let name = rel.name || rel.download;
-        let isArch = name.match(archMap[arch]);
-        if (isArch) {
-          rel.arch = arch;
-          break;
-        }
-      }
-    }
-    if (!rel.arch) {
-      if ('macos' === rel.os) {
-        rel.arch = 'amd64';
-      }
-    }
-    supported.arches[rel.arch] = true;
-
-    // note: depends on rel.os
-    if (!rel.libc) {
-      let isMusl;
-      let isMsvc;
-      let isStatic;
-      let isGnu;
-
-      // extra blocks to prevent copy pasta errors
-
-      {
-        let muslRe = /(\b|_)(musl)(\b|_)/i;
-        isMusl = muslRe.test(rel.download) || muslRe.test(rel.name);
-      }
-
-      {
-        let msvcRe = /(\b|_)(msvc)(\b|_)/i;
-        isMsvc = msvcRe.test(rel.download) || msvcRe.test(rel.name);
-      }
-
-      {
-        let staticRe = /(\b|_)(static)(\b|_)/i;
-        isStatic = staticRe.test(rel.download) || staticRe.test(rel.name);
-      }
-
-      {
-        let gnuRe = /(\b|_)(gnu|glibc|libc)(\b|_)/i;
-        isGnu = gnuRe.test(rel.download) || gnuRe.test(rel.name);
-      }
-
-      if (isMusl) {
-        // we specifically tag things that need musl++ in their own releases
-        rel.libc = 'none';
-      } else if (isStatic) {
-        rel.libc = 'none';
-      } else if (isGnu) {
-        rel.libc = 'gnu';
-        if (rel.os === 'windows') {
-          // windows gnu is static
-          rel.libc = 'none';
-        } else if (rel.os === 'darwin') {
-          // if glibc is required on macos, it'll be static
-          rel.libc = 'none';
-        }
-      } else if (isMsvc) {
-        rel.libc = 'msvc';
-      } else {
-        // The default is no requirement for any particular libc
-        // (Go, Zig, POSIX Shell, JS, etc)
-        // and hopefully we never have to worry about mingw and friends
-        rel.libc = 'none';
-      }
-    }
-    supported.libcs[rel.libc] = true;
-
-    var tarExt;
-    if (!rel.ext) {
-      // pkg-v1.0.tar.gz => ['gz', 'tar', '0', 'pkg-v1']
-      // pkg-v1.0.tar => ['tar', '0' ,'pkg-v1']
-      // pkg-v1.0.zip => ['zip', '0', 'pkg-v1']
-      var exts = (rel.name || rel.download).split('.');
-      if (1 === exts.length) {
-        // for bare releases in the format of foo-linux-amd64
-        rel.ext = 'exe';
-      }
-      exts = exts.reverse().slice(0, 2);
-      if ('tar' === exts[1]) {
-        rel.ext = exts.reverse().join('.');
-        tarExt = 'tar';
-      } else if ('tgz' === exts[0]) {
-        rel.ext = 'tar.gz';
-        tarExt = 'tar';
-      } else {
-        rel.ext = exts[0];
-      }
-      if (/\-|linux|mac|os[_\-]?x|arm|amd|86|64|mip/i.test(rel.ext)) {
-        // for bare releases in the format of foo.linux-amd64
-        rel.ext = 'exe';
-      }
-    }
-    supported.formats[tarExt || rel.ext] = true;
-
-    if (!rel.channel) {
-      // basically like this: (+.-_)(beta|rc)(0-9)(+.-_)
-      // matches:
-      //   - v1.0-beta
-      //   - v1.0-beta1.1
-      //   - v1.0-beta-11
-      // won't match:
-      //   - v1.0beta
-      //   - v1.0-beta1b
-      let isBetaRe =
-        /(\b|_)(alpha|beta|dev|developer|prev|preview|rc)(\d+)(\b|_)/;
-      let isBeta = isBetaRe.test(rel.name);
-      if (isBeta) {
-        rel.channel = 'beta';
-      } else {
-        rel.channel = 'stable';
-      }
-    }
-
-    if (all.download) {
-      rel.download = all.download.replace(/{{ download }}/, rel.download);
-    }
-  }
-
-  all.oses = Object.keys(supported.oses).filter(function (name) {
-    return maps.oses[name];
-  });
-  all.arches = Object.keys(supported.arches).filter(function (name) {
-    return maps.arches[name];
-  });
-  all.libcs = Object.keys(supported.libcs).filter(function (name) {
-    return maps.libcs[name];
-  });
-  all.formats = Object.keys(supported.formats).filter(function (name) {
-    return maps.formats[name];
-  });
-
-  return all;
-}
-
-module.exports = normalize;
-module.exports._debug = function (all) {
-  all = normalize(all);
-  all.releases = all.releases
-    .filter(function (r) {
-      return ['windows', 'macos', 'linux'].includes(r.os) && 'amd64' === r.arch;
-    })
-    .slice(0, 10);
-  return all;
-};
-// NOT in order of priority (which would be tar, xz, zip, ...)
-module.exports.formats = formats;
-module.exports.arches = arches;
-module.exports.libcs = libcs;
-module.exports.formatsMap = maps.formats;

_webi/package-install.tpl.ps1

@@ -17,6 +17,7 @@ $Env:WEBI_HOST = 'https://webinstall.dev'
 #$Env:PKG_NAME = node
 #$Env:WEBI_VERSION = v12.16.2
 #$Env:WEBI_GIT_TAG = 12.16.2
+#$Env:WEBI_GIT_COMMIT_HASH =
 #$Env:WEBI_PKG_URL = "https://.../node-....zip"
 #$Env:WEBI_PKG_FILE = "node-v12.16.2-win-x64.zip"
 #$Env:WEBI_PKG_PATHNAME = "node-v12.16.2-win-x64.zip"
@@ -45,15 +46,15 @@ $TDim = "${Esc}[2m"
 $TReset = "${Esc}[0m"
 
 function Invoke-DownloadUrl {
-    Param (
+    param (
         [string]$URL,
         [string]$Params,
         [string]$Path,
         [switch]$Force
     )
 
-    IF (Test-Path -Path "$Path") {
-        IF (-Not $Force.IsPresent) {
+    if (Test-Path -Path "$Path") {
+        if (-not $Force.IsPresent) {
             Write-Host "    ${TDim}Found${TReset} $Path"
             return
         }
@@ -65,7 +66,7 @@ function Invoke-DownloadUrl {
 
     Write-Host "    Downloading ${TDim}from${TReset}"
     Write-Host "      ${TDim}${URL}${TReset}"
-    IF ($Params.Length -ne 0) {
+    if ($Params.Length -ne 0) {
         Write-Host "        ?$Params"
         $URL = "${URL}?${Params}"
     }
@@ -80,18 +81,18 @@ function Get-UserAgent {
     # This is the canonical CPU arch when the process is emulated
     $my_arch = "$Env:PROCESSOR_ARCHITEW6432"
 
-    IF ($my_arch -eq $null -or $my_arch -eq "") {
+    if ($my_arch -eq $null -or $my_arch -eq "") {
         # This is the canonical CPU arch when the process is native
         $my_arch = "$Env:PROCESSOR_ARCHITECTURE"
     }
 
-    IF ($my_arch -eq "AMD64") {
+    if ($my_arch -eq "AMD64") {
         # Because PowerShell is sometimes AMD64 on Windows 10 ARM
         # See https://oofhours.com/2020/02/04/powershell-on-windows-10-arm64/
         $my_os_arch = (Get-CimInstance -ClassName Win32_OperatingSystem).OSArchitecture
 
         # Using -clike because of the trailing newline
-        IF ($my_os_arch -clike "ARM 64*") {
+        if ($my_os_arch -clike "ARM 64*") {
             $my_arch = "ARM64"
         }
     }
@@ -124,7 +125,7 @@ function webi_path_add($pathname) {
             $exists_in_path = $true
         }
     }
-    if (-Not $exists_in_path) {
+    if (-not $exists_in_path) {
         $all_user_paths = "${pathname};${all_user_paths}".Trim(';')
         [Environment]::SetEnvironmentVariable("Path", $all_user_paths, "User")
         $null = Sync-EnvPath

_webi/package-install.tpl.sh

@@ -15,6 +15,7 @@ __bootstrap_webi() {
     # TODO not sure if BUILD is the best name for this
     #WEBI_BUILD=
     #WEBI_GIT_TAG=
+    #WEBI_GIT_COMMIT_HASH=
     #WEBI_LTS=
     #WEBI_CHANNEL=
     #WEBI_EXT=

_webi/test.js

@@ -49,7 +49,7 @@ var baseurl = 'https://webinstall.dev';
 var maxLen = 0;
 console.info('');
 console.info('Has the necessary files?');
-['README.md', 'releases.js', 'install.sh', 'install.ps1']
+['README.md', 'install.sh', 'install.ps1']
   .map(function (node) {
     maxLen = Math.max(maxLen, node.length);
     return node;

_webi/transform-releases.js

@@ -2,75 +2,30 @@
 
 var Releases = module.exports;
 
+var Fs = require('node:fs/promises');
+var Os = require('node:os');
 var path = require('path');
-var _normalize = require('./normalize.js');
-
 var cache = {};
-//var staleAge = 5 * 1000;
-//var expiredAge = 15 * 1000;
-var staleAge = 5 * 60 * 1000;
-var expiredAge = 15 * 60 * 1000;
 
-let installerDir = path.join(__dirname, '..');
+var LEGACY_CACHE_DIR = path.join(Os.homedir(), '.cache/webi/legacy');
 
-Releases.get = async function (pkgdir) {
-  let get;
-  try {
-    get = require(`${pkgdir}/releases.js`);
-    // TODO update all releases files with module.exports.xxxx = 'foo';
-    if (!get.latest) {
-      get.latest = get;
-    }
-  } catch (e) {
-    let err = new Error('no releases.js for', pkgdir.split(/[\/\\]+/).pop());
-    err.code = 'E_NO_RELEASE';
-    throw err;
-  }
-
-  let all = await get.latest();
-
-  return _normalize(all);
-};
-
-// TODO needs a proper test, and more accurate (though perhaps far less simple) code
+// Sort releases by ext preference and libc within the same version.
+// The cache is already sorted by version (stable before beta, newest first),
+// so we only re-order within the same version string.
 function createFormatsSorter(formats) {
-  return function sortByVerExt(a, b) {
-    function lexver(semver) {
-      // v1.20.156 => 00001.00020.00156.zzzzz
-      // TODO BUG: v1.20.156-rc2 => 00001.00020.00156.rc2zz
-      var parts = semver.split(/[+\.\-]/g);
-      while (parts.length < 4) {
-        parts.push('');
-      }
-      return parts
-        .map(function (num, i) {
-          if (3 === i) {
-            return num.toString().padEnd(10, 'z');
-          }
-          return num.toString().padStart(10, '0');
-        })
-        .join('.');
-    }
-
-    var aver = lexver(a.version);
-    var bver = lexver(b.version);
-    if (aver > bver) {
-      //console.log(aver, '>', bver);
-      return -1;
-    }
-    if (aver < bver) {
-      //console.log(aver, '<', bver);
-      return 1;
+  return function sortByExtLibc(a, b) {
+    if (a.version !== b.version) {
+      // Array.sort is stable (V8, ES2019), so returning 0 across
+      // versions preserves the cache's pre-sorted version-desc order.
+      return 0;
     }
 
     var aExtPri = formats.indexOf(a.ext.replace(/tar\..*/, 'tar'));
     var bExtPri = formats.indexOf(b.ext.replace(/tar\..*/, 'tar'));
     if (aExtPri > bExtPri) {
-      //console.log(a.ext, aExtPri, '>', b.ext, bExtPri);
       return -1;
     }
     if (aExtPri < bExtPri) {
-      //console.log(a.ext, aExtPri, '<', b.ext, bExtPri);
       return 1;
     }
 
@@ -87,99 +42,39 @@ function createFormatsSorter(formats) {
 }
 
 async function getCachedReleases(pkg) {
-  // returns { download: '<template string>', releases: [{ version, date, os, arch, lts, channel, download}] }
+  // returns { download: '', releases: [{ version, date, os, arch, lts, channel, download}] }
 
-  async function chainCachePromise(fn) {
-    cache[pkg].promise = cache[pkg].promise.then(fn);
-    return cache[pkg].promise;
+  if (cache[pkg]) {
+    return cache[pkg];
   }
 
-  async function sleep(ms) {
-    return await new Promise(function (resolve, reject) {
-      setTimeout(resolve, ms);
-    });
-  }
+  let dataFile = `${LEGACY_CACHE_DIR}/${pkg}.json`;
 
-  async function putCache() {
-    var age = Date.now() - cache[pkg].updatedAt;
-    if (age < staleAge) {
-      //console.debug('NOT STALE ANYMORE - updated in previous promise');
-      return cache[pkg].all;
+  let json = await Fs.readFile(dataFile, 'utf8').catch(function (err) {
+    if (err.code === 'ENOENT') {
+      return null;
     }
+    throw err;
+  });
 
-    //console.debug('DOWNLOADING NEW "%s" releases', pkg);
-    var pkgdir = path.join(installerDir, pkg);
-
-    // workaround for request timeout seeming to not work
-    let complete = false;
-    await Promise.race([
-      Releases.get(pkgdir)
-        .catch(function (err) {
-          if ('E_NO_RELEASE' === err.code) {
-            let all = { _error: 'E_NO_RELEASE', download: '', releases: [] };
-            return all;
-          }
-
-          throw err;
-        })
-        .catch(function (err) {
-          let hasReleases = cache[pkg].all?.releases?.length > 1;
-          if (!hasReleases) {
-            throw err;
-          }
-
-          console.error(`Error: the BOOGEYMAN got us!`);
-          console.error(err.stack);
-
-          return cache[pkg].all;
-        })
-        .then(function (all) {
-          // Note: it is possible for slightly older data
-          // to replace slightly newer data, but this is better
-          // than being in a cycle where release updates _always_
-          // take longer than expected.
-          //console.debug('DOWNLOADED NEW "%s" releases', pkg);
-          cache[pkg].updatedAt = Date.now();
-          cache[pkg].all = all;
-          complete = true;
-        }),
-      sleep(15000).then(function () {
-        if (complete) {
-          return;
-        }
-        console.error(`request timeout waiting for '${pkg}' release info`);
-      }),
-    ]);
-
-    return cache[pkg].all;
+  if (!json) {
+    let empty = { download: '', releases: [] };
+    cache[pkg] = empty;
+    return empty;
   }
 
-  if (!cache[pkg]) {
-    cache[pkg] = {
-      updatedAt: 0,
-      all: { download: '', releases: [] },
-      promise: Promise.resolve(),
-    };
+  let all;
+  try {
+    all = JSON.parse(json);
+  } catch (e) {
+    console.error(`error: ${dataFile}:\n\t${e.message}`);
+    let empty = { download: '', releases: [] };
+    cache[pkg] = empty;
+    return empty;
   }
 
-  var bgRenewal;
-  var age = Date.now() - cache[pkg].updatedAt;
-  var fresh = age < staleAge;
-  if (!fresh) {
-    bgRenewal = chainCachePromise(putCache);
-  }
-
-  var tooStale = age > expiredAge;
-  if (!tooStale) {
-    return await cache[pkg].all;
-  }
-
-  return await Promise.race([
-    bgRenewal,
-    sleep(5000).then(function () {
-      return cache[pkg].all;
-    }),
-  ]);
+  cache[pkg] = all;
+  return all;
 }
 
 async function filterReleases(
@@ -190,15 +85,22 @@ async function filterReleases(
   // sort the most compatible format first
   // (i.e. so that we don't do .pkg on linux except on purpose)
   var rformats = formats.slice(0).reverse();
-  var sortByVerExt = createFormatsSorter(rformats);
+  var sortByExtLibc = createFormatsSorter(rformats);
   var reVer = new RegExp('^' + ver + '\\b');
 
   function selectMatches(rel) {
+    /* jshint maxcomplexity: 25 */
     if (os) {
-      if (rel.os !== '*') {
-        if (rel.os !== os) {
-          return false;
-        }
+      // '*' = any OS (matches anything, including windows).
+      // 'posix' / 'posix_20xx' = any POSIX OS (matches linux, macos,
+      // freebsd, etc., but NOT windows).
+      let isPosix = rel.os === 'posix' || rel.os.startsWith('posix_20');
+      let osMatches =
+        rel.os === '*' ||
+        rel.os === os ||
+        (isPosix && os !== 'windows');
+      if (!osMatches) {
+        return false;
       }
     }
 
@@ -210,7 +112,10 @@ async function filterReleases(
       }
     }
 
-    if (rel.libc !== 'none') {
+    // libc='libc' is serve-releases.js's default when the caller
+    // didn't pin one — treat it as 'no preference', not a filter.
+    let isMeaningfulLibc = libc && libc !== 'libc' && rel.libc !== 'none';
+    if (isMeaningfulLibc) {
       let releaseRequiresMusl = rel.libc === 'musl';
       // goal: handle non-glibc (Alpine / Docker / musl)
       let osHasMusl = libc === 'musl';
@@ -257,7 +162,7 @@ async function filterReleases(
     return true;
   }
 
-  var sortedRels = all.releases.filter(selectMatches).sort(sortByVerExt);
+  var sortedRels = all.releases.filter(selectMatches).sort(sortByExtLibc);
   //console.log(sortedRels.slice(0, 4));
 
   return sortedRels.slice(0, limit || 1000);
@@ -416,8 +321,8 @@ Releases.getReleases = function ({
 };
 
 if (require.main === module) {
-  return module
-    .exports({
+  return Releases
+    .getReleases({
       pkg: 'node',
       ver: '',
       os: 'macos',

_webi/ua-detect.js

@@ -38,9 +38,8 @@ function getOs(ua) {
     // It's the year of the Linux Desktop!
     // See also http://www.mslinux.org/
     // 'linux' must be tested before 'Microsoft' because WSL
-    // (TODO: does this affect cygwin / msysgit?)
     return 'linux';
-  } else if (/^ms$|Microsoft|Windows|win32|win|PowerShell/i.test(ua)) {
+  } else if (/^ms$|Microsoft|Windows|win32|win|PowerShell|CYGWIN|MINGW/i.test(ua)) {
     // 'win' must be tested after 'darwin'
     return 'windows';
   } else if (/Linux|curl|wget/i.test(ua)) {

aliasman/README.md

@@ -72,8 +72,8 @@ gc "feat: new feature"
 
 ### Common aliases
 
-Use *alias*es to make other tools you find around webi even _more_ convenient
-⚡️ (and powerful 💪).
+Use *alias*es to make other tools you find around webi even _more_ convenient ⚡️
+(and powerful 💪).
 
 ```sh
 aliasman curl 'curlie'

aliasman/releases.conf

@@ -0,0 +1,2 @@
+github_sources = BeyondCodeBootcamp/aliasman
+git_url = https://github.com/BeyondCodeBootcamp/aliasman.git

aliasman/releases.js

@@ -1,22 +0,0 @@
-'use strict';
-
-let Releases = module.exports;
-
-let GitHubSource = require('../_common/github-source.js');
-let owner = 'BeyondCodeBootcamp';
-let repo = 'aliasman';
-
-Releases.latest = async function () {
-  let all = await GitHubSource.getDistributables({ owner, repo });
-  for (let pkg of all.releases) {
-    pkg.os = 'posix_2017';
-  }
-  return all;
-};
-
-if (module === require.main) {
-  Releases.latest().then(function (all) {
-    all = require('../_webi/normalize.js')(all);
-    console.info(JSON.stringify(all, null, 2));
-  });
-}

arc/install.ps1

@@ -19,13 +19,13 @@ New-Item "$Env:USERPROFILE\Downloads\webi" -ItemType Directory -Force | Out-Null
 $pkg_download = "$Env:USERPROFILE\Downloads\webi\$Env:WEBI_PKG_FILE"
 
 # Fetch archive
-IF (!(Test-Path -Path "$Env:USERPROFILE\Downloads\webi\$Env:WEBI_PKG_FILE")) {
+if (!(Test-Path -Path "$Env:USERPROFILE\Downloads\webi\$Env:WEBI_PKG_FILE")) {
     Write-Output "Downloading archiver from $Env:WEBI_PKG_URL to $pkg_download"
     & curl.exe -A "$Env:WEBI_UA" -fsSL "$Env:WEBI_PKG_URL" -o "$pkg_download.part"
     & Move-Item "$pkg_download.part" "$pkg_download"
 }
 
-IF (!(Test-Path -Path "$pkg_src_cmd")) {
+if (!(Test-Path -Path "$pkg_src_cmd")) {
     Write-Output "Installing archiver"
 
     # TODO: create package-specific temp directory

arc/releases.conf

@@ -0,0 +1 @@
+github_releases = mholt/archiver

arc/releases.js

@@ -1,21 +0,0 @@
-'use strict';
-
-var github = require('../_common/github.js');
-var owner = 'mholt';
-var repo = 'archiver';
-
-module.exports = function () {
-  return github(null, owner, repo).then(function (all) {
-    all._names = ['archiver', 'arc'];
-    return all;
-  });
-};
-
-if (module === require.main) {
-  module.exports().then(function (all) {
-    all = require('../_webi/normalize.js')(all);
-    // just select the first 5 for demonstration
-    all.releases = all.releases.slice(0, 5);
-    console.info(JSON.stringify(all, null, 2));
-  });
-}

archiver/install.ps1

@@ -1,5 +1,5 @@
 #!/bin/pwsh
 
 Write-Output "'archiver@$Env:WEBI_TAG' is an alias for 'arc@$Env:WEBI_VERSION'"
-IF ($null -eq $Env:WEBI_HOST -or $Env:WEBI_HOST -eq "") { $Env:WEBI_HOST = "https://webinstall.dev" }
+if ($null -eq $Env:WEBI_HOST -or $Env:WEBI_HOST -eq "") { $Env:WEBI_HOST = "https://webinstall.dev" }
 curl.exe -A MS -fsSL "$Env:WEBI_HOST/arc@$Env:WEBI_VERSION" | powershell

atomicparsley/install.ps1

@@ -20,7 +20,7 @@ New-Item "$Env:USERPROFILE\Downloads\webi" -ItemType Directory -Force | Out-Null
 $pkg_download = "$Env:USERPROFILE\Downloads\webi\$Env:WEBI_PKG_FILE"
 
 # Fetch archive
-IF (!(Test-Path -Path "$Env:USERPROFILE\Downloads\webi\$Env:WEBI_PKG_FILE")) {
+if (!(Test-Path -Path "$Env:USERPROFILE\Downloads\webi\$Env:WEBI_PKG_FILE")) {
     Write-Output "Checking for (or Installing) MSVC Runtime..."
     & "$Env:USERPROFILE\.local\bin\webi-pwsh.ps1" vcruntime
 
@@ -29,7 +29,7 @@ IF (!(Test-Path -Path "$Env:USERPROFILE\Downloads\webi\$Env:WEBI_PKG_FILE")) {
     & Move-Item "$pkg_download.part" "$pkg_download"
 }
 
-IF (!(Test-Path -Path "$pkg_src_cmd")) {
+if (!(Test-Path -Path "$pkg_src_cmd")) {
     Write-Output "Installing AtomicParsley"
 
     # TODO: create package-specific temp directory

atomicparsley/releases.conf

@@ -0,0 +1 @@
+github_releases = wez/atomicparsley

atomicparsley/releases.js

@@ -1,79 +0,0 @@
-'use strict';
-
-var github = require('../_common/github.js');
-var owner = 'wez';
-var repo = 'atomicparsley';
-
-let targets = {
-  x86win: {
-    os: 'windows',
-    arch: 'x86',
-    libc: 'msvc',
-  },
-  x64win: {
-    os: 'windows',
-    arch: 'amd64',
-    // https://github.com/wez/atomicparsley/issues/6#issuecomment-1364523028
-    libc: 'msvc',
-  },
-  x64mac: {
-    os: 'macos',
-    arch: 'amd64',
-  },
-  x64lin: {
-    os: 'linux',
-    arch: 'amd64',
-    libc: 'gnu',
-  },
-  x64musl: {
-    os: 'linux',
-    arch: 'amd64',
-    libc: 'musl',
-  },
-};
-
-module.exports = function () {
-  return github(null, owner, repo).then(function (all) {
-    for (let rel of all.releases) {
-      let windows32 = rel.name.includes('WindowsX86.');
-      if (windows32) {
-        Object.assign(rel, targets.x86win);
-        continue;
-      }
-
-      let windows64 = rel.name.includes('Windows.');
-      if (windows64) {
-        Object.assign(rel, targets.x64win);
-        continue;
-      }
-
-      let macos64 = rel.name.includes('MacOS');
-      if (macos64) {
-        Object.assign(rel, targets.x64mac);
-        continue;
-      }
-
-      let musl64 = rel.name.includes('Alpine');
-      if (musl64) {
-        Object.assign(rel, targets.x64musl);
-        continue;
-      }
-
-      let lin64 = rel.name.includes('Linux.');
-      if (lin64) {
-        Object.assign(rel, targets.x64lin);
-        continue;
-      }
-    }
-    all._names = ['AtomicParsley', 'atomicparsley'];
-    return all;
-  });
-};
-
-if (module === require.main) {
-  module.exports().then(function (all) {
-    all = require('../_webi/normalize.js')(all);
-    console.info(JSON.stringify(all));
-    //console.info(JSON.stringify(all, null, 2));
-  });
-}

awless/install.ps1

@@ -20,13 +20,13 @@ New-Item "$Env:USERPROFILE\Downloads\webi" -ItemType Directory -Force | Out-Null
 $pkg_download = "$Env:USERPROFILE\Downloads\webi\$Env:WEBI_PKG_FILE"
 
 # Fetch archive
-IF (!(Test-Path -Path "$Env:USERPROFILE\Downloads\webi\$Env:WEBI_PKG_FILE")) {
+if (!(Test-Path -Path "$Env:USERPROFILE\Downloads\webi\$Env:WEBI_PKG_FILE")) {
     Write-Output "Downloading awless from $Env:WEBI_PKG_URL to $pkg_download"
     & curl.exe -A "$Env:WEBI_UA" -fsSL "$Env:WEBI_PKG_URL" -o "$pkg_download.part"
     & Move-Item "$pkg_download.part" "$pkg_download"
 }
 
-IF (!(Test-Path -Path "$pkg_src_cmd")) {
+if (!(Test-Path -Path "$pkg_src_cmd")) {
     Write-Output "Installing awless"
 
     # TODO: create package-specific temp directory

awless/releases.conf

@@ -0,0 +1 @@
+github_releases = wallix/awless

awless/releases.js

@@ -1,22 +0,0 @@
-'use strict';
-
-var github = require('../_common/github.js');
-var owner = 'wallix';
-var repo = 'awless';
-
-module.exports = function () {
-  return github(null, owner, repo).then(function (all) {
-    // remove checksums and .deb
-    all.releases = all.releases.filter(function (rel) {
-      return !/(\.txt)|(\.deb)$/i.test(rel.name);
-    });
-    return all;
-  });
-};
-
-if (module === require.main) {
-  module.exports().then(function (all) {
-    all = require('../_webi/normalize.js')(all);
-    console.info(JSON.stringify(all));
-  });
-}

bat/install.ps1

@@ -3,7 +3,7 @@
 $VERNAME = "$Env:PKG_NAME-v$Env:WEBI_VERSION.exe"
 $EXENAME = "$Env:PKG_NAME.exe"
 # Fetch archive
-IF (!(Test-Path -Path "$Env:USERPROFILE\Downloads\webi\$Env:WEBI_PKG_FILE")) {
+if (!(Test-Path -Path "$Env:USERPROFILE\Downloads\webi\$Env:WEBI_PKG_FILE")) {
     Write-Output "Downloading $Env:PKG_NAME from $Env:WEBI_PKG_URL to $Env:USERPROFILE\Downloads\webi\$Env:WEBI_PKG_FILE"
     & curl.exe -A "$Env:WEBI_UA" -fsSL "$Env:WEBI_PKG_URL" -o "$Env:USERPROFILE\Downloads\webi\$Env:WEBI_PKG_FILE.part"
     & Move-Item "$Env:USERPROFILE\Downloads\webi\$Env:WEBI_PKG_FILE.part" "$Env:USERPROFILE\Downloads\webi\$Env:WEBI_PKG_FILE"
@@ -11,11 +11,11 @@ IF (!(Test-Path -Path "$Env:USERPROFILE\Downloads\webi\$Env:WEBI_PKG_FILE")) {
 
 # Fetch MSVC Runtime
 Write-Output "Checking for MSVC Runtime..."
-IF (-not (Test-Path "\Windows\System32\vcruntime140.dll")) {
+if (-not (Test-Path "\Windows\System32\vcruntime140.dll")) {
     & "$Env:USERPROFILE\.local\bin\webi-pwsh.ps1" vcruntime
 }
 
-IF (!(Test-Path -Path "$Env:USERPROFILE\.local\bin\$VERNAME")) {
+if (!(Test-Path -Path "$Env:USERPROFILE\.local\bin\$VERNAME")) {
     Write-Output "Installing $Env:PKG_NAME"
     # TODO: temp directory
 

bat/releases.conf

@@ -0,0 +1 @@
+github_releases = sharkdp/bat

bat/releases.js

@@ -1,20 +0,0 @@
-'use strict';
-
-var github = require('../_common/github.js');
-var owner = 'sharkdp';
-var repo = 'bat';
-
-module.exports = function () {
-  return github(null, owner, repo).then(function (all) {
-    return all;
-  });
-};
-
-if (module === require.main) {
-  module.exports().then(function (all) {
-    all = require('../_webi/normalize.js')(all);
-    all.releases = all.releases.slice(0, 10);
-    //console.info(JSON.stringify(all));
-    console.info(JSON.stringify(all, null, 2));
-  });
-}

bun/releases.conf

@@ -0,0 +1,5 @@
+github_releases = oven-sh/bun
+tag_prefix = bun-
+default_x86_64 = x86_64_v3
+x86_64_v2 = baseline
+variants = profile

bun/releases.js

@@ -1,47 +0,0 @@
-'use strict';
-
-var github = require('../_common/github.js');
-var owner = 'oven-sh';
-var repo = 'bun';
-
-module.exports = function () {
-  return github(null, owner, repo).then(function (all) {
-    all.releases = all.releases
-      .filter(function (r) {
-        let isDebug = r.name.includes('-profile');
-        if (isDebug) {
-          return false;
-        }
-
-        let isAncient = r.name.includes('-baseline');
-        if (isAncient) {
-          return false;
-        }
-
-        let isMusl = r.name.includes('-musl');
-        if (isMusl) {
-          r._musl = true;
-          r.libc = 'musl';
-        } else if (r.os === 'linux') {
-          r.libc = 'gnu';
-        }
-
-        return true;
-      })
-      .map(function (r) {
-        // bun-v0.5.1 => v0.5.1
-        r.version = r.version.replace(/bun-/g, '');
-        return r;
-      });
-    return all;
-  });
-};
-
-if (module === require.main) {
-  module.exports().then(function (all) {
-    all = require('../_webi/normalize.js')(all);
-    // just select the first 5 for demonstration
-    all.releases = all.releases.slice(0, 5);
-    console.info(JSON.stringify(all, null, 2));
-  });
-}

caddy/README.md

@@ -1181,7 +1181,8 @@ To prevent search engine and browser confusion
 - _DO NOT_ prevent crawling via `robots.txt` \
   (counter-intuitive, but pages _must_ be crawled for links to _NOT_ be indexed)
 - _all_ domains using public TLS certs _will_ be indexed by default \
-  (they are all linked to and crawled from various Certificate Transparency reports)
+  (they are all linked to and crawled from various Certificate Transparency
+  reports)
 - follow these guidelines even if the dev sites use HTTP Basic Auth
 
 ```Caddyfile

caddy/install.ps1

@@ -20,13 +20,13 @@ New-Item "$Env:USERPROFILE\Downloads\webi" -ItemType Directory -Force | Out-Null
 $pkg_download = "$Env:USERPROFILE\Downloads\webi\$Env:WEBI_PKG_FILE"
 
 # Fetch archive
-IF (!(Test-Path -Path "$Env:USERPROFILE\Downloads\webi\$Env:WEBI_PKG_FILE")) {
+if (!(Test-Path -Path "$Env:USERPROFILE\Downloads\webi\$Env:WEBI_PKG_FILE")) {
     Write-Output "Downloading caddy from $Env:WEBI_PKG_URL to $pkg_download"
     & curl.exe -A "$Env:WEBI_UA" -fsSL "$Env:WEBI_PKG_URL" -o "$pkg_download.part"
     & Move-Item "$pkg_download.part" "$pkg_download"
 }
 
-IF (!(Test-Path -Path "$pkg_src_cmd")) {
+if (!(Test-Path -Path "$pkg_src_cmd")) {
     Write-Output "Installing caddy"
 
     # TODO: create package-specific temp directory

caddy/releases.conf

@@ -0,0 +1 @@
+github_releases = caddyserver/caddy

caddy/releases.js

@@ -1,27 +0,0 @@
-'use strict';
-
-var github = require('../_common/github.js');
-var owner = 'caddyserver';
-var repo = 'caddy';
-
-module.exports = function () {
-  return github(null, owner, repo).then(function (all) {
-    // remove checksums and .deb
-    all.releases = all.releases.filter(function (rel) {
-      let isOneOffAsset = rel.download.includes('buildable-artifact');
-      if (isOneOffAsset) {
-        return false;
-      }
-
-      return true;
-    });
-    return all;
-  });
-};
-
-if (module === require.main) {
-  module.exports().then(function (all) {
-    all = require('../_webi/normalize.js')(all);
-    console.info(JSON.stringify(all));
-  });
-}

chromedriver/install.ps1

@@ -19,13 +19,13 @@ New-Item "$Env:USERPROFILE\Downloads\webi" -ItemType Directory -Force | Out-Null
 $pkg_download = "$Env:USERPROFILE\Downloads\webi\$Env:WEBI_PKG_FILE"
 
 # Fetch archive
-IF (!(Test-Path -Path "$Env:USERPROFILE\Downloads\webi\$Env:WEBI_PKG_FILE")) {
+if (!(Test-Path -Path "$Env:USERPROFILE\Downloads\webi\$Env:WEBI_PKG_FILE")) {
     Write-Output "Downloading chromedriver from $Env:WEBI_PKG_URL to $pkg_download"
     & curl.exe -A "$Env:WEBI_UA" -fsSL "$Env:WEBI_PKG_URL" -o "$pkg_download.part"
     & Move-Item "$pkg_download.part" "$pkg_download"
 }
 
-IF (!(Test-Path -Path "$pkg_src_cmd")) {
+if (!(Test-Path -Path "$pkg_src_cmd")) {
     Write-Output "Installing chromedriver"
 
     # TODO: create package-specific temp directory

chromedriver/releases.conf

@@ -0,0 +1 @@
+source = chromedist

chromedriver/releases.js

@@ -1,101 +0,0 @@
-'use strict';
-
-let Fetcher = require('../_common/fetcher.js');
-
-// See <https://googlechromelabs.github.io/chrome-for-testing/>
-const releaseApiUrl =
-  'https://googlechromelabs.github.io/chrome-for-testing/known-good-versions-with-downloads.json';
-
-// {
-//   "timestamp": "2023-11-15T21:08:56.730Z",
-//   "versions": [
-//     {
-//       "version": "121.0.6120.0",
-//       "revision": "1222902",
-//       "downloads": {
-//         "chrome": [],
-//         "chromedriver": [
-//           {
-//             "platform": "linux64",
-//             "url": "https://edgedl.me.gvt1.com/edgedl/chrome/chrome-for-testing/121.0.6120.0/linux64/chromedriver-linux64.zip"
-//           },
-//           {
-//             "platform": "mac-arm64",
-//             "url": "https://edgedl.me.gvt1.com/edgedl/chrome/chrome-for-testing/121.0.6120.0/mac-arm64/chromedriver-mac-arm64.zip"
-//           },
-//           {
-//             "platform": "mac-x64",
-//             "url": "https://edgedl.me.gvt1.com/edgedl/chrome/chrome-for-testing/121.0.6120.0/mac-x64/chromedriver-mac-x64.zip"
-//           },
-//           {
-//             "platform": "win32",
-//             "url": "https://edgedl.me.gvt1.com/edgedl/chrome/chrome-for-testing/121.0.6120.0/win32/chromedriver-win32.zip"
-//           },
-//           {
-//             "platform": "win64",
-//             "url": "https://edgedl.me.gvt1.com/edgedl/chrome/chrome-for-testing/121.0.6120.0/win64/chromedriver-win64.zip"
-//           }
-//         ],
-//         "chrome-headless-shell": []
-//       }
-//     }
-//   ]
-// }
-
-module.exports = async function () {
-  let resp;
-  try {
-    resp = await Fetcher.fetch(releaseApiUrl, {
-      headers: { Accept: 'application/json' },
-    });
-  } catch (e) {
-    /** @type {Error & { code: string, response: { status: number, body: string } }} */ //@ts-expect-error
-    let err = e;
-    if (err.code === 'E_FETCH_RELEASES') {
-      err.message = `failed to fetch 'chromedriver' release data: ${err.response.status} ${err.response.body}`;
-    }
-    throw e;
-  }
-  let data = JSON.parse(resp.body);
-
-  let builds = [];
-  for (let release of data.versions) {
-    if (!release.downloads.chromedriver) {
-      continue;
-    }
-
-    let version = release.version;
-    for (let asset of release.downloads.chromedriver) {
-      let build = {
-        version: version,
-        download: asset.url,
-        // I' not sure that this is actually statically built but it
-        // seems to be and at worst we'll just get bug reports for Alpine
-        libc: 'none',
-      };
-
-      builds.push(build);
-    }
-  }
-
-  let all = {
-    download: '',
-    releases: builds,
-  };
-
-  return all;
-};
-
-if (module === require.main) {
-  module
-    .exports()
-    .then(function (all) {
-      all = require('../_webi/normalize.js')(all);
-      // just select the latest 20 for demonstration
-      all.releases = all.releases.slice(-20);
-      console.info(JSON.stringify(all, null, 2));
-    })
-    .catch(function (err) {
-      console.error('Error:', err);
-    });
-}

cilium/install.ps1

@@ -17,13 +17,13 @@ $pkg_src = "$pkg_src_cmd"
 New-Item "$Env:USERPROFILE\Downloads\webi" -ItemType Directory -Force | Out-Null
 $pkg_download = "$Env:USERPROFILE\Downloads\webi\$Env:WEBI_PKG_FILE"
 
-IF (!(Test-Path -Path "$Env:USERPROFILE\Downloads\webi\$Env:WEBI_PKG_FILE")) {
+if (!(Test-Path -Path "$Env:USERPROFILE\Downloads\webi\$Env:WEBI_PKG_FILE")) {
     Write-Output "Downloading cilium from $Env:WEBI_PKG_URL to $pkg_download"
     & curl.exe -A "$Env:WEBI_UA" -fsSL "$Env:WEBI_PKG_URL" -o "$pkg_download.part"
     & Move-Item "$pkg_download.part" "$pkg_download"
 }
 
-IF (!(Test-Path -Path "$pkg_src_cmd")) {
+if (!(Test-Path -Path "$pkg_src_cmd")) {
     Write-Output "Installing cilium"
     Push-Location .local\tmp
 

cilium/releases.conf

@@ -0,0 +1 @@
+github_releases = cilium/cilium-cli

cilium/releases.js

@@ -1,21 +0,0 @@
-'use strict';
-
-var github = require('../_common/github.js');
-var owner = 'cilium';
-var repo = 'cilium-cli';
-
-module.exports = async function () {
-  let all = await github(null, owner, repo);
-  return all;
-};
-
-if (module === require.main) {
-  (async function () {
-    let normalize = require('../_webi/normalize.js');
-    let all = await module.exports();
-    all = normalize(all);
-    // just select the first 5 for demonstration
-    all.releases = all.releases.slice(0, 5);
-    console.info(JSON.stringify(all, null, 2));
-  })();
-}

cmake/install.ps1

@@ -20,13 +20,13 @@ New-Item "$Env:USERPROFILE\Downloads\webi" -ItemType Directory -Force | Out-Null
 $pkg_download = "$Env:USERPROFILE\Downloads\webi\$Env:WEBI_PKG_FILE"
 
 # Fetch archive
-IF (!(Test-Path -Path "$pkg_download")) {
+if (!(Test-Path -Path "$pkg_download")) {
     Write-Output "Downloading cmake from $Env:WEBI_PKG_URL to $pkg_download"
     & curl.exe -A "$Env:WEBI_UA" -fsSL "$Env:WEBI_PKG_URL" -o "$pkg_download.part"
     & Move-Item "$pkg_download.part" "$pkg_download"
 }
 
-IF (!(Test-Path -Path "$pkg_src_dir")) {
+if (!(Test-Path -Path "$pkg_src_dir")) {
     Write-Output "Installing cmake"
 
     # TODO: create package-specific temp directory

cmake/releases.conf

@@ -0,0 +1 @@
+github_releases = Kitware/CMake

cmake/releases.js

@@ -1,53 +0,0 @@
-'use strict';
-
-var github = require('../_common/github.js');
-var owner = 'Kitware';
-var repo = 'CMake';
-
-module.exports = function () {
-  return github(null, owner, repo).then(function (all) {
-    for (let rel of all.releases) {
-      if (rel.version.startsWith('v')) {
-        rel._version = rel.version.slice(1);
-      }
-
-      {
-        let linuxRe = /(\b|_)(linux|gnu)(\b|_)/i;
-        let isLinux = linuxRe.test(rel.download) || linuxRe.test(rel.name);
-
-        if (isLinux) {
-          let muslRe = /(\b|_)(musl|alpine)(\b|_)/i;
-          let isMusl = muslRe.test(rel.download) || muslRe.test(rel.name);
-          if (isMusl) {
-            rel.libc = 'musl';
-          } else {
-            rel.libc = 'gnu';
-          }
-          continue;
-        }
-      }
-
-      {
-        let windowsRe = /(\b|_)(win\d*|windows\d*)(\b|_)/i;
-        let isWindows =
-          windowsRe.test(rel.download) || windowsRe.test(rel.name);
-
-        if (isWindows) {
-          rel.libc = 'msvc';
-          continue;
-        }
-      }
-    }
-
-    return all;
-  });
-};
-
-if (module === require.main) {
-  module.exports().then(function (all) {
-    all = require('../_webi/normalize.js')(all);
-    // just select the first 5 for demonstration
-    all.releases = all.releases.slice(0, 5);
-    console.info(JSON.stringify(all, null, 2));
-  });
-}

cmd/webicached/main.go

@@ -0,0 +1,924 @@
+// Command webicached is the release cache daemon. It fetches releases
+// from upstream sources, classifies build assets, and writes them to
+// the _cache/ directory in the format the Node.js server expects.
+//
+// This is the Go replacement for the Node.js release-fetching pipeline.
+// It reads releases.conf files to discover packages, fetches from the
+// configured source, classifies assets, and writes to fsstore.
+//
+// Default mode: classify all from existing rawcache on startup, then
+// fetch+refresh one package per tick (round-robin, 15m default).
+//
+// Usage:
+//
+//	go run ./cmd/webicached                # default: round-robin, one per tick
+//	go run ./cmd/webicached -eager         # fetch all packages on startup
+//	go run ./cmd/webicached -once -no-fetch # classify from rawcache and exit
+//	go run ./cmd/webicached bat goreleaser # only these packages
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"flag"
+	"fmt"
+	"io"
+	"log"
+	"math/rand/v2"
+	"net/http"
+	"os"
+	"path/filepath"
+	"sort"
+	"strings"
+	"time"
+
+	"github.com/joho/godotenv"
+	"github.com/webinstall/webi-installers/internal/classifypkg"
+	"github.com/webinstall/webi-installers/internal/httpclient"
+	"github.com/webinstall/webi-installers/internal/installerconf"
+	"github.com/webinstall/webi-installers/internal/rawcache"
+	"github.com/webinstall/webi-installers/internal/releases/chromedist"
+	"github.com/webinstall/webi-installers/internal/releases/flutterdist"
+	"github.com/webinstall/webi-installers/internal/releases/gitea"
+	"github.com/webinstall/webi-installers/internal/releases/github"
+	"github.com/webinstall/webi-installers/internal/releases/githubish"
+	"github.com/webinstall/webi-installers/internal/releases/gittag"
+	"github.com/webinstall/webi-installers/internal/releases/golang"
+	"github.com/webinstall/webi-installers/internal/releases/gpgdist"
+	"github.com/webinstall/webi-installers/internal/releases/hashicorp"
+	"github.com/webinstall/webi-installers/internal/releases/iterm2dist"
+	"github.com/webinstall/webi-installers/internal/releases/juliadist"
+	"github.com/webinstall/webi-installers/internal/releases/mariadbdist"
+	"github.com/webinstall/webi-installers/internal/releases/nodedist"
+	"github.com/webinstall/webi-installers/internal/releases/servicemandist"
+	"github.com/webinstall/webi-installers/internal/releases/zigdist"
+	"github.com/webinstall/webi-installers/internal/storage"
+	"github.com/webinstall/webi-installers/internal/storage/fsstore"
+)
+
+var (
+	name         = "webicached"
+	version      = "0.0.0-dev"
+	commit       = "0000000"
+	date         = "0001-01-01"
+	licenseYear  = "2024"
+	licenseOwner = "AJ ONeal"
+	licenseType  = "MPL-2.0"
+)
+
+func printVersion(w io.Writer) {
+	b_ver := strings.TrimPrefix(version, "v")
+	_, _ = fmt.Fprintf(w, "%s v%s %s (%s)\n", name, b_ver, commit[:7], date)
+	_, _ = fmt.Fprintf(w, "Copyright (C) %s %s\n", licenseYear, licenseOwner)
+	_, _ = fmt.Fprintf(w, "Licensed under %s\n", licenseType)
+}
+
+type MainConfig struct {
+	envFile   string
+	confDir   string
+	cacheDir  string
+	rawDir    string
+	token     string
+	once      bool
+	noFetch   bool
+	shallow   bool
+	eager     bool
+	interval  time.Duration
+	pageDelay time.Duration
+}
+
+// WebiCache holds the configuration for the cache daemon.
+type WebiCache struct {
+	ConfDir   string          // root directory with {pkg}/releases.conf files
+	Store     storage.Store   // classified asset storage (fsstore)
+	RawDir    string          // raw upstream response cache
+	Client    *http.Client    // HTTP client for upstream calls
+	Auth      *githubish.Auth // GitHub API auth (optional)
+	Shallow   bool            // fetch only the first page of releases
+	NoFetch   bool            // skip fetching, classify from existing raw data only
+	PageDelay time.Duration   // delay between paginated API requests
+}
+
+// delayTransport wraps an http.RoundTripper to add a delay between requests.
+type delayTransport struct {
+	base  http.RoundTripper
+	delay time.Duration
+	last  time.Time
+}
+
+func (t *delayTransport) RoundTrip(req *http.Request) (*http.Response, error) {
+	if !t.last.IsZero() && t.delay > 0 {
+		if wait := t.delay - time.Since(t.last); wait > 0 {
+			time.Sleep(wait)
+		}
+	}
+	t.last = time.Now()
+	return t.base.RoundTrip(req)
+}
+
+func main() {
+	if len(os.Args) > 1 {
+		switch os.Args[1] {
+		case "-V", "-version", "--version", "version":
+			printVersion(os.Stdout)
+			os.Exit(0)
+		case "help", "-help", "--help":
+			printVersion(os.Stdout)
+			fmt.Fprintln(os.Stdout, "")
+			fs := flag.NewFlagSet(os.Args[0], flag.ContinueOnError)
+			fs.SetOutput(os.Stdout)
+			registerFlags(fs, &MainConfig{})
+			fs.Usage()
+			os.Exit(0)
+		}
+	}
+
+	cfg := MainConfig{}
+	fs := flag.NewFlagSet(os.Args[0], flag.ContinueOnError)
+	registerFlags(fs, &cfg)
+	if err := fs.Parse(os.Args[1:]); err != nil {
+		if errors.Is(err, flag.ErrHelp) {
+			os.Exit(0)
+		}
+		os.Exit(1)
+	}
+
+	cfg.cacheDir = expandHome(cfg.cacheDir)
+	cfg.rawDir = expandHome(cfg.rawDir)
+
+	if cfg.envFile != "" {
+		if err := godotenv.Load(cfg.envFile); err != nil {
+			log.Fatalf("envfile: %v", err)
+		}
+	}
+	if cfg.token == "" {
+		cfg.token = os.Getenv("GITHUB_TOKEN")
+	}
+
+	fss, err := fsstore.New(cfg.cacheDir)
+	if err != nil {
+		log.Fatalf("fsstore: %v", err)
+	}
+	var store storage.Store = fss
+
+	var auth *githubish.Auth
+	if cfg.token != "" {
+		auth = &githubish.Auth{Token: cfg.token}
+	}
+
+	client := httpclient.New()
+	if cfg.pageDelay > 0 {
+		client.Transport = &delayTransport{
+			base:  client.Transport,
+			delay: cfg.pageDelay,
+		}
+	}
+
+	wc := &WebiCache{
+		ConfDir:   cfg.confDir,
+		Store:     store,
+		RawDir:    cfg.rawDir,
+		Client:    client,
+		Auth:      auth,
+		Shallow:   cfg.shallow,
+		NoFetch:   cfg.noFetch,
+		PageDelay: cfg.pageDelay,
+	}
+
+	filterPkgs := fs.Args()
+
+	if cfg.eager {
+		wc.Run(filterPkgs)
+		if cfg.once {
+			return
+		}
+	} else if cfg.once {
+		wc.Run(filterPkgs)
+		return
+	} else {
+		saved := wc.NoFetch
+		wc.NoFetch = true
+		wc.Run(filterPkgs)
+		wc.NoFetch = saved
+	}
+
+	packages, err := discover(wc.ConfDir)
+	if err != nil {
+		log.Fatalf("discover: %v", err)
+	}
+	nameSet := make(map[string]bool, len(filterPkgs))
+	for _, a := range filterPkgs {
+		nameSet[a] = true
+	}
+	if len(filterPkgs) > 0 {
+		var filtered []pkgConf
+		for _, p := range packages {
+			if nameSet[p.name] {
+				filtered = append(filtered, p)
+			}
+		}
+		packages = filtered
+	}
+
+	var real []pkgConf
+	for _, pkg := range packages {
+		if pkg.conf.AliasOf == "" {
+			real = append(real, pkg)
+		}
+	}
+
+	// rescanNew appends any conf files added since the last scan.
+	// Returns true when at least one new package was added so the caller
+	// can restart the batch loop and process new packages immediately.
+	rescanNew := func() bool {
+		discovered, err := discover(wc.ConfDir)
+		if err != nil {
+			log.Printf("rescan: %v", err)
+			return false
+		}
+		known := make(map[string]bool, len(real))
+		for _, p := range real {
+			known[p.name] = true
+		}
+		added := false
+		for _, p := range discovered {
+			if p.conf.AliasOf != "" || known[p.name] {
+				continue
+			}
+			if len(filterPkgs) > 0 && !nameSet[p.name] {
+				continue
+			}
+			log.Printf("discovered new package: %s (source=%s)", p.name, p.conf.Source)
+			real = append(real, p)
+			added = true
+		}
+		return added
+	}
+
+	log.Printf("refreshing %d packages, interval %s, batch size 20 (ctrl-c to stop)", len(real), cfg.interval)
+	for {
+		// Rescan before computing staleness so newly added conf files are
+		// included immediately. New packages have a zero timestamp and sort
+		// to the front of the stale list, so they are processed next.
+		rescanNew()
+
+		stale := wc.stalest(real)
+		if len(stale) == 0 {
+			log.Printf("all packages fresh, sleeping %s", cfg.interval)
+			time.Sleep(cfg.interval)
+			continue
+		}
+
+		batch := stale
+		if len(batch) > 20 {
+			batch = batch[:20]
+		}
+		rand.Shuffle(len(batch), func(i, j int) {
+			batch[i], batch[j] = batch[j], batch[i]
+		})
+
+		log.Printf("batch: %d stale, refreshing %d (most stale first)", len(stale), len(batch))
+		for _, pkg := range batch {
+			ctx, cancel := context.WithTimeout(context.Background(), 5*time.Minute)
+			if err := wc.refreshPackage(ctx, pkg); err != nil {
+				log.Printf("  ERROR %s: %v", pkg.name, err)
+			}
+			cancel()
+			time.Sleep(cfg.interval)
+			// Rescan mid-batch so new packages preempt remaining batch items.
+			if rescanNew() {
+				break
+			}
+		}
+	}
+}
+
+func registerFlags(fs *flag.FlagSet, cfg *MainConfig) {
+	fs.StringVar(&cfg.envFile, "envfile", "", "path to .env file to load before running")
+	fs.StringVar(&cfg.confDir, "conf", ".", "root directory containing {pkg}/releases.conf files")
+	fs.StringVar(&cfg.cacheDir, "legacy", "~/.cache/webi/legacy", "legacy cache directory (fsstore root)")
+	fs.StringVar(&cfg.rawDir, "raw", "~/.cache/webi/raw", "raw cache directory for upstream responses")
+	fs.StringVar(&cfg.token, "token", "", "GitHub API token (or set $GITHUB_TOKEN)")
+	fs.BoolVar(&cfg.once, "once", false, "run once then exit (no periodic refresh)")
+	fs.BoolVar(&cfg.noFetch, "no-fetch", false, "skip fetching, classify from existing raw data only")
+	fs.BoolVar(&cfg.shallow, "shallow", false, "fetch only the first page of releases (latest)")
+	fs.BoolVar(&cfg.eager, "eager", false, "fetch all packages on startup (default: one per tick)")
+	fs.DurationVar(&cfg.interval, "interval", 9*time.Second, "delay between individual package fetches")
+	fs.DurationVar(&cfg.pageDelay, "page-delay", 2*time.Second, "delay between paginated API requests")
+}
+
+func expandHome(path string) string {
+	if !strings.HasPrefix(path, "~/") {
+		return path
+	}
+	home, err := os.UserHomeDir()
+	if err != nil {
+		return path
+	}
+	return filepath.Join(home, path[2:])
+}
+
+// stalest returns packages sorted by most stale first (oldest UpdatedAt).
+// Packages with no cache entry or empty assets are considered most stale.
+func (wc *WebiCache) stalest(packages []pkgConf) []pkgConf {
+	type stamped struct {
+		pkg       pkgConf
+		updatedAt time.Time
+	}
+
+	var stale []stamped
+	ctx := context.Background()
+	for _, pkg := range packages {
+		data, err := wc.Store.Load(ctx, pkg.name)
+		var t time.Time
+		if err == nil && data != nil {
+			t = data.UpdatedAt
+		}
+		// Never fetched, or older than 10 minutes.
+		// 0-asset results are not treated as perpetually stale — packages that
+		// produce no classifiable assets (e.g. galera) respect the timestamp.
+		if t.IsZero() || time.Since(t) > 10*time.Minute {
+			stale = append(stale, stamped{pkg: pkg, updatedAt: t})
+		}
+	}
+
+	sort.SliceStable(stale, func(i, j int) bool {
+		ti, tj := stale[i].updatedAt, stale[j].updatedAt
+		if ti.Equal(tj) {
+			return stale[i].pkg.name < stale[j].pkg.name
+		}
+		return ti.Before(tj)
+	})
+
+	result := make([]pkgConf, len(stale))
+	for i, s := range stale {
+		result[i] = s.pkg
+	}
+	return result
+}
+
+// Run discovers packages and refreshes each one.
+func (wc *WebiCache) Run(filterPkgs []string) {
+	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Minute)
+	defer cancel()
+
+	packages, err := discover(wc.ConfDir)
+	if err != nil {
+		log.Printf("discover: %v", err)
+		return
+	}
+
+	if len(filterPkgs) > 0 {
+		nameSet := make(map[string]bool, len(filterPkgs))
+		for _, a := range filterPkgs {
+			nameSet[a] = true
+		}
+		var filtered []pkgConf
+		for _, p := range packages {
+			if nameSet[p.name] {
+				filtered = append(filtered, p)
+			}
+		}
+		packages = filtered
+	}
+
+	var real []pkgConf
+	for _, pkg := range packages {
+		if pkg.conf.AliasOf != "" {
+			continue
+		}
+		real = append(real, pkg)
+	}
+
+	log.Printf("refreshing %d packages", len(real))
+	runStart := time.Now()
+
+	for _, pkg := range real {
+		if err := wc.refreshPackage(ctx, pkg); err != nil {
+			log.Printf("  ERROR %s: %v", pkg.name, err)
+		}
+	}
+
+	log.Printf("refreshed %d packages in %s", len(real), time.Since(runStart))
+}
+
+type pkgConf struct {
+	name string
+	conf *installerconf.Conf
+}
+
+func discover(dir string) ([]pkgConf, error) {
+	pattern := filepath.Join(dir, "*", "releases.conf")
+	matches, err := filepath.Glob(pattern)
+	if err != nil {
+		return nil, err
+	}
+
+	var packages []pkgConf
+	for _, path := range matches {
+		pkgDir := filepath.Dir(path)
+		name := filepath.Base(pkgDir)
+		if strings.HasPrefix(name, "_") {
+			continue
+		}
+
+		// If the package directory is a symlink, treat it as an alias
+		// of the symlink target (e.g. rust.vim → vim-rust).
+		fi, err := os.Lstat(filepath.Join(dir, name))
+		if err != nil {
+			log.Printf("warning: %s: %v", name, err)
+			continue
+		}
+		if fi.Mode()&os.ModeSymlink != 0 {
+			target, err := os.Readlink(filepath.Join(dir, name))
+			if err != nil {
+				log.Printf("warning: readlink %s: %v", name, err)
+				continue
+			}
+			packages = append(packages, pkgConf{
+				name: name,
+				conf: &installerconf.Conf{AliasOf: target},
+			})
+			continue
+		}
+
+		conf, err := installerconf.Read(path)
+		if err != nil {
+			log.Printf("warning: %s: %v", path, err)
+			continue
+		}
+		packages = append(packages, pkgConf{name: name, conf: conf})
+	}
+
+	sort.Slice(packages, func(i, j int) bool {
+		return packages[i].name < packages[j].name
+	})
+	return packages, nil
+}
+
+// refreshPackage does the full pipeline for one package:
+// fetch raw → classify → write to fsstore.
+func (wc *WebiCache) refreshPackage(ctx context.Context, pkg pkgConf) error {
+	pkgStart := time.Now()
+	name := pkg.name
+	conf := pkg.conf
+
+	// Step 1: Fetch raw upstream data to rawcache (unless -no-fetch).
+	if !wc.NoFetch {
+		shallow := wc.Shallow
+		if !shallow {
+			d, err := rawcache.Open(filepath.Join(wc.RawDir, name))
+			if err == nil && d.Populated() {
+				shallow = true
+			}
+		}
+		fetchStart := time.Now()
+		if err := wc.fetchRaw(ctx, pkg, shallow); err != nil {
+			return fmt.Errorf("fetch: %w", err)
+		}
+		log.Printf("  %s: fetch %s", name, time.Since(fetchStart))
+	}
+
+	// Step 2: Classify raw data into assets, tag variants, apply config.
+	classifyStart := time.Now()
+	d, err := rawcache.Open(filepath.Join(wc.RawDir, name))
+	if err != nil {
+		return fmt.Errorf("rawcache open: %w", err)
+	}
+
+	// Open supplementary gittag raw cache if available (for packages with
+	// git_url that use a non-gittag source type like servicemandist).
+	var gitTagDir *rawcache.Dir
+	if conf.GitURL != "" && conf.Source != "gittag" {
+		gd, gdErr := rawcache.Open(filepath.Join(wc.RawDir, "_gittag", name))
+		if gdErr == nil && gd.Populated() {
+			gitTagDir = gd
+		}
+	}
+
+	assets, err := classifypkg.Package(name, conf, d, gitTagDir)
+	if err != nil {
+		return fmt.Errorf("classify: %w", err)
+	}
+	classifyDur := time.Since(classifyStart)
+
+	// Step 3: Write to fsstore.
+	writeStart := time.Now()
+	tx, err := wc.Store.BeginRefresh(ctx, name)
+	if err != nil {
+		return fmt.Errorf("begin refresh: %w", err)
+	}
+	if err := tx.Put(assets); err != nil {
+		tx.Rollback()
+		return fmt.Errorf("put: %w", err)
+	}
+	if err := tx.Commit(ctx); err != nil {
+		return fmt.Errorf("commit: %w", err)
+	}
+	writeDur := time.Since(writeStart)
+
+	log.Printf("  %s: %d assets (classify %s, write %s, total %s)",
+		name, len(assets), classifyDur, writeDur, time.Since(pkgStart))
+	return nil
+}
+
+// --- Fetch raw ---
+
+func (wc *WebiCache) fetchRaw(ctx context.Context, pkg pkgConf, shallow bool) error {
+	switch pkg.conf.Source {
+	case "github", "githubsource":
+		if err := wc.fetchGitHub(ctx, pkg.name, pkg.conf, shallow); err != nil {
+			return err
+		}
+	case "nodedist":
+		return wc.fetchNodeDist(ctx, pkg.name, pkg.conf)
+	case "gittag":
+		return wc.fetchGitTag(ctx, pkg.name, pkg.conf, shallow)
+	case "gitea":
+		return wc.fetchGitea(ctx, pkg.name, pkg.conf, shallow)
+	case "chromedist":
+		return fetchChromeDist(ctx, wc.Client, wc.RawDir, pkg.name)
+	case "flutterdist":
+		return fetchFlutterDist(ctx, wc.Client, wc.RawDir, pkg.name)
+	case "golang":
+		return fetchGolang(ctx, wc.Client, wc.RawDir, pkg.name)
+	case "gpgdist":
+		return fetchGPGDist(ctx, wc.Client, wc.RawDir, pkg.name)
+	case "hashicorp":
+		return fetchHashiCorp(ctx, wc.Client, wc.RawDir, pkg.name, pkg.conf)
+	case "iterm2dist":
+		return fetchITerm2Dist(ctx, wc.Client, wc.RawDir, pkg.name)
+	case "juliadist":
+		return fetchJuliaDist(ctx, wc.Client, wc.RawDir, pkg.name)
+	case "mariadbdist":
+		return fetchMariaDBDist(ctx, wc.Client, wc.RawDir, pkg.name)
+	case "servicemandist":
+		if err := servicemandist.Fetch(ctx, wc.Client, wc.RawDir, pkg.name, wc.Auth, shallow); err != nil {
+			return err
+		}
+	case "zigdist":
+		return fetchZigDist(ctx, wc.Client, wc.RawDir, pkg.name)
+	default:
+		log.Printf("  %s: source %q not yet supported, skipping", pkg.name, pkg.conf.Source)
+		return nil
+	}
+
+	// For non-gittag sources with a git_url, also clone the repo to get
+	// commit hashes. Git entries are classified from this data in
+	// refreshPackage, not from the main raw cache.
+	if pkg.conf.GitURL != "" && pkg.conf.Source != "gittag" {
+		gitShallow := shallow
+		if !wc.Shallow {
+			gd, gdErr := rawcache.Open(filepath.Join(wc.RawDir, "_gittag", pkg.name))
+			if gdErr == nil && !gd.Populated() {
+				gitShallow = false
+			}
+		}
+		if err := wc.fetchGitTagSupplementary(ctx, pkg.name, pkg.conf.GitURL, gitShallow); err != nil {
+			log.Printf("  %s: supplementary gittag fetch: %v", pkg.name, err)
+		}
+	}
+	return nil
+}
+
+// fetchGitTagSupplementary clones a git repo to get commit hashes for
+// packages that use a non-gittag source type (servicemandist, githubsource)
+// but also have a git_url for source installs.
+func (wc *WebiCache) fetchGitTagSupplementary(ctx context.Context, pkgName, gitURL string, shallow bool) error {
+	d, err := rawcache.Open(filepath.Join(wc.RawDir, "_gittag", pkgName))
+	if err != nil {
+		return err
+	}
+
+	repoDir := filepath.Join(wc.RawDir, "_repos")
+	os.MkdirAll(repoDir, 0o755)
+
+	for batch, err := range gittag.Fetch(ctx, gitURL, repoDir) {
+		if err != nil {
+			return err
+		}
+		for _, entry := range batch {
+			tag := entry.Version
+			if tag == "" {
+				tag = "HEAD-" + entry.CommitHash
+			}
+			data, _ := json.Marshal(entry)
+			d.Merge(tag, data)
+		}
+		if shallow {
+			break
+		}
+	}
+	return nil
+}
+
+func (wc *WebiCache) fetchGitHub(ctx context.Context, pkgName string, conf *installerconf.Conf, shallow bool) error {
+	owner, repo := conf.Owner, conf.Repo
+	if owner == "" || repo == "" {
+		return fmt.Errorf("missing owner or repo")
+	}
+
+	d, err := rawcache.Open(filepath.Join(wc.RawDir, pkgName))
+	if err != nil {
+		return err
+	}
+
+	tagPrefix := conf.TagPrefix
+	for batch, err := range github.Fetch(ctx, wc.Client, owner, repo, wc.Auth) {
+		if err != nil {
+			return fmt.Errorf("github %s/%s: %w", owner, repo, err)
+		}
+		for _, rel := range batch {
+			if rel.Draft {
+				continue
+			}
+			tag := rel.TagName
+			if tagPrefix != "" && !strings.HasPrefix(tag, tagPrefix) {
+				continue
+			}
+			data, _ := json.Marshal(rel)
+			d.Merge(tag, data)
+		}
+		if shallow {
+			break
+		}
+	}
+	return nil
+}
+
+func (wc *WebiCache) fetchNodeDist(ctx context.Context, pkgName string, conf *installerconf.Conf) error {
+	baseURL := conf.BaseURL
+	if baseURL == "" {
+		return fmt.Errorf("missing url")
+	}
+
+	d, err := rawcache.Open(filepath.Join(wc.RawDir, pkgName))
+	if err != nil {
+		return err
+	}
+
+	// Fetch from primary URL. Tag with "official/" prefix so unofficial
+	// entries for the same version don't overwrite.
+	for batch, err := range nodedist.Fetch(ctx, wc.Client, baseURL) {
+		if err != nil {
+			return err
+		}
+		for _, entry := range batch {
+			data, _ := json.Marshal(entry)
+			d.Merge("official/"+entry.Version, data)
+		}
+	}
+
+	// Fetch from unofficial URL if configured (e.g. Node.js unofficial builds
+	// which add musl, riscv64, loong64 targets).
+	if unofficialURL := conf.Extra["unofficial_url"]; unofficialURL != "" {
+		for batch, err := range nodedist.Fetch(ctx, wc.Client, unofficialURL) {
+			if err != nil {
+				log.Printf("warning: %s unofficial fetch: %v", pkgName, err)
+				break
+			}
+			for _, entry := range batch {
+				data, _ := json.Marshal(entry)
+				d.Merge("unofficial/"+entry.Version, data)
+			}
+		}
+	}
+
+	return nil
+}
+
+func (wc *WebiCache) fetchGitTag(ctx context.Context, pkgName string, conf *installerconf.Conf, shallow bool) error {
+	gitURL := conf.BaseURL
+	if gitURL == "" {
+		return fmt.Errorf("missing url")
+	}
+
+	d, err := rawcache.Open(filepath.Join(wc.RawDir, pkgName))
+	if err != nil {
+		return err
+	}
+
+	repoDir := filepath.Join(wc.RawDir, "_repos")
+	os.MkdirAll(repoDir, 0o755)
+
+	for batch, err := range gittag.Fetch(ctx, gitURL, repoDir) {
+		if err != nil {
+			return err
+		}
+		for _, entry := range batch {
+			tag := entry.Version
+			if tag == "" {
+				tag = "HEAD-" + entry.CommitHash
+			}
+			data, _ := json.Marshal(entry)
+			d.Merge(tag, data)
+		}
+		if shallow {
+			break
+		}
+	}
+	return nil
+}
+
+func (wc *WebiCache) fetchGitea(ctx context.Context, pkgName string, conf *installerconf.Conf, shallow bool) error {
+	baseURL, owner, repo := conf.BaseURL, conf.Owner, conf.Repo
+	if baseURL == "" || owner == "" || repo == "" {
+		return fmt.Errorf("missing base_url, owner, or repo")
+	}
+
+	d, err := rawcache.Open(filepath.Join(wc.RawDir, pkgName))
+	if err != nil {
+		return err
+	}
+
+	for batch, err := range gitea.Fetch(ctx, wc.Client, baseURL, owner, repo, nil) {
+		if err != nil {
+			return err
+		}
+		for _, rel := range batch {
+			if rel.Draft {
+				continue
+			}
+			data, _ := json.Marshal(rel)
+			d.Merge(rel.TagName, data)
+		}
+		if shallow {
+			break
+		}
+	}
+	return nil
+}
+
+func fetchChromeDist(ctx context.Context, client *http.Client, rawDir, pkgName string) error {
+	d, err := rawcache.Open(filepath.Join(rawDir, pkgName))
+	if err != nil {
+		return err
+	}
+
+	for batch, err := range chromedist.Fetch(ctx, client) {
+		if err != nil {
+			return fmt.Errorf("chromedist: %w", err)
+		}
+		for _, ver := range batch {
+			data, _ := json.Marshal(ver)
+			d.Merge(ver.Version, data)
+		}
+	}
+	return nil
+}
+
+func fetchFlutterDist(ctx context.Context, client *http.Client, rawDir, pkgName string) error {
+	d, err := rawcache.Open(filepath.Join(rawDir, pkgName))
+	if err != nil {
+		return err
+	}
+
+	for batch, err := range flutterdist.Fetch(ctx, client) {
+		if err != nil {
+			return fmt.Errorf("flutterdist: %w", err)
+		}
+		for _, rel := range batch {
+			// Key by version+channel+os for uniqueness.
+			key := rel.Version + "-" + rel.Channel + "-" + rel.OS
+			data, _ := json.Marshal(rel)
+			d.Merge(key, data)
+		}
+	}
+	return nil
+}
+
+func fetchGolang(ctx context.Context, client *http.Client, rawDir, pkgName string) error {
+	d, err := rawcache.Open(filepath.Join(rawDir, pkgName))
+	if err != nil {
+		return err
+	}
+
+	for batch, err := range golang.Fetch(ctx, client) {
+		if err != nil {
+			return fmt.Errorf("golang: %w", err)
+		}
+		for _, rel := range batch {
+			data, _ := json.Marshal(rel)
+			d.Merge(rel.Version, data)
+		}
+	}
+	return nil
+}
+
+func fetchGPGDist(ctx context.Context, client *http.Client, rawDir, pkgName string) error {
+	d, err := rawcache.Open(filepath.Join(rawDir, pkgName))
+	if err != nil {
+		return err
+	}
+
+	for batch, err := range gpgdist.Fetch(ctx, client) {
+		if err != nil {
+			return fmt.Errorf("gpgdist: %w", err)
+		}
+		for _, entry := range batch {
+			data, _ := json.Marshal(entry)
+			d.Merge(entry.Version, data)
+		}
+	}
+	return nil
+}
+
+func fetchHashiCorp(ctx context.Context, client *http.Client, rawDir, pkgName string, conf *installerconf.Conf) error {
+	product := conf.Repo
+	if product == "" {
+		product = pkgName
+	}
+
+	d, err := rawcache.Open(filepath.Join(rawDir, pkgName))
+	if err != nil {
+		return err
+	}
+
+	for idx, err := range hashicorp.Fetch(ctx, client, product) {
+		if err != nil {
+			return fmt.Errorf("hashicorp %s: %w", product, err)
+		}
+		for ver, vdata := range idx.Versions {
+			data, _ := json.Marshal(vdata)
+			d.Merge(ver, data)
+		}
+	}
+	return nil
+}
+
+func fetchITerm2Dist(ctx context.Context, client *http.Client, rawDir, pkgName string) error {
+	d, err := rawcache.Open(filepath.Join(rawDir, pkgName))
+	if err != nil {
+		return err
+	}
+
+	for batch, err := range iterm2dist.Fetch(ctx, client) {
+		if err != nil {
+			return fmt.Errorf("iterm2dist: %w", err)
+		}
+		for _, entry := range batch {
+			key := entry.Version
+			if entry.Channel == "beta" {
+				key += "-beta"
+			}
+			data, _ := json.Marshal(entry)
+			d.Merge(key, data)
+		}
+	}
+	return nil
+}
+
+func fetchJuliaDist(ctx context.Context, client *http.Client, rawDir, pkgName string) error {
+	d, err := rawcache.Open(filepath.Join(rawDir, pkgName))
+	if err != nil {
+		return err
+	}
+
+	for batch, err := range juliadist.Fetch(ctx, client) {
+		if err != nil {
+			return fmt.Errorf("juliadist: %w", err)
+		}
+		for _, rel := range batch {
+			data, _ := json.Marshal(rel)
+			d.Merge(rel.Version, data)
+		}
+	}
+	return nil
+}
+
+func fetchMariaDBDist(ctx context.Context, client *http.Client, rawDir, pkgName string) error {
+	d, err := rawcache.Open(filepath.Join(rawDir, pkgName))
+	if err != nil {
+		return err
+	}
+
+	for batch, err := range mariadbdist.Fetch(ctx, client) {
+		if err != nil {
+			return fmt.Errorf("mariadbdist: %w", err)
+		}
+		for _, rel := range batch {
+			data, _ := json.Marshal(rel)
+			d.Merge(rel.ReleaseID, data)
+		}
+	}
+	return nil
+}
+
+func fetchZigDist(ctx context.Context, client *http.Client, rawDir, pkgName string) error {
+	d, err := rawcache.Open(filepath.Join(rawDir, pkgName))
+	if err != nil {
+		return err
+	}
+
+	for batch, err := range zigdist.Fetch(ctx, client) {
+		if err != nil {
+			return fmt.Errorf("zigdist: %w", err)
+		}
+		for _, rel := range batch {
+			data, _ := json.Marshal(rel)
+			d.Merge(rel.Version, data)
+		}
+	}
+	return nil
+}

cmd/webid/bootstrap_test.go

@@ -0,0 +1,146 @@
+package main
+
+import (
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+)
+
+// TestBootstrapCurlPipe verifies the /{pkg} route returns the curl-pipe bootstrap.
+func TestBootstrapCurlPipe(t *testing.T) {
+	srv, ts := newTestServer(t)
+
+	pkg := "bat"
+	if srv.getPackage(pkg) == nil {
+		t.Skipf("package %s not in cache", pkg)
+	}
+
+	code, body := get(t, ts, "/bat@stable")
+	if code != 200 {
+		t.Fatalf("status %d: %s", code, body[:min(len(body), 200)])
+	}
+
+	// Should contain the bootstrap env vars.
+	if !strings.Contains(body, "WEBI_PKG=") {
+		t.Error("missing WEBI_PKG= in bootstrap")
+	}
+	if !strings.Contains(body, "WEBI_HOST=") {
+		t.Error("missing WEBI_HOST= in bootstrap")
+	}
+	if !strings.Contains(body, "WEBI_CHECKSUM=") {
+		t.Error("missing WEBI_CHECKSUM= in bootstrap")
+	}
+	// Should NOT contain the full installer (install.sh content).
+	// The bootstrap just downloads and runs webi.
+	if strings.Contains(body, "pkg_install()") {
+		t.Error("bootstrap should not contain pkg_install — that's the full installer")
+	}
+
+	t.Logf("bootstrap size: %d bytes", len(body))
+}
+
+// TestInstallerFull verifies /api/installers/{pkg}.sh returns the full installer.
+func TestInstallerFull(t *testing.T) {
+	srv, ts := newTestServer(t)
+
+	pkg := "bat"
+	if srv.getPackage(pkg) == nil {
+		t.Skipf("package %s not in cache", pkg)
+	}
+
+	// Use a webi-style User-Agent so the server can detect platform.
+	code, body := getWithUA(t, ts, "/api/installers/bat@stable.sh", "aarch64/unknown Darwin/24.2.0 libc")
+	if code != 200 {
+		t.Fatalf("status %d: %s", code, body[:min(len(body), 500)])
+	}
+
+	// Should contain resolved release info.
+	if !strings.Contains(body, "WEBI_VERSION=") {
+		t.Error("missing WEBI_VERSION= in installer")
+	}
+	if !strings.Contains(body, "WEBI_PKG_URL=") {
+		t.Error("missing WEBI_PKG_URL= in installer")
+	}
+	if !strings.Contains(body, "PKG_NAME=") {
+		t.Error("missing PKG_NAME= in installer")
+	}
+
+	// Should contain the package's install.sh content (embedded).
+	if !strings.Contains(body, "pkg_") {
+		t.Error("installer should contain pkg_ functions from install.sh")
+	}
+
+	t.Logf("installer size: %d bytes", len(body))
+}
+
+// TestInstallerPowerShell verifies /api/installers/{pkg}.ps1 returns a PowerShell installer.
+func TestInstallerPowerShell(t *testing.T) {
+	srv, ts := newTestServer(t)
+
+	pkg := "node"
+	if srv.getPackage(pkg) == nil {
+		t.Skipf("package %s not in cache", pkg)
+	}
+
+	code, body := getWithUA(t, ts, "/api/installers/node@stable.ps1", "AMD64/unknown Windows/10.0.19045 msvc")
+	if code != 200 {
+		t.Fatalf("status %d: %s", code, body[:min(len(body), 500)])
+	}
+
+	if !strings.Contains(body, "$Env:WEBI_VERSION") {
+		t.Error("missing $Env:WEBI_VERSION in PS1 installer")
+	}
+	if !strings.Contains(body, "$Env:WEBI_PKG_URL") {
+		t.Error("missing $Env:WEBI_PKG_URL in PS1 installer")
+	}
+	if !strings.Contains(body, "$Env:PKG_NAME") {
+		t.Error("missing $Env:PKG_NAME in PS1 installer")
+	}
+
+	t.Logf("PS1 installer size: %d bytes", len(body))
+}
+
+// TestInstallerSelfHosted verifies selfhosted packages get a script without resolution.
+func TestInstallerSelfHosted(t *testing.T) {
+	_, ts := newTestServer(t)
+
+	// ssh-utils is selfhosted — has install.sh but no releases.conf.
+	code, body := getWithUA(t, ts, "/api/installers/ssh-utils.sh", "aarch64/unknown Darwin/24.2.0 libc")
+	if code == 404 {
+		t.Skip("ssh-utils not available as installer")
+	}
+	if code != 200 {
+		t.Skipf("status %d (selfhosted may not render without cache): %s", code, body[:min(len(body), 200)])
+	}
+
+	t.Logf("selfhosted installer size: %d bytes", len(body))
+}
+
+// TestBootstrapUnknownPackage verifies 404 for unknown packages.
+func TestBootstrapUnknownPackage(t *testing.T) {
+	_, ts := newTestServer(t)
+
+	code, _ := get(t, ts, "/nonexistent-package-xyz")
+	if code != 404 {
+		t.Errorf("expected 404, got %d", code)
+	}
+}
+
+// getWithUA fetches a URL with a custom User-Agent header.
+func getWithUA(t *testing.T, ts *httptest.Server, path, ua string) (int, string) {
+	t.Helper()
+	req, err := http.NewRequest("GET", ts.URL+path, nil)
+	if err != nil {
+		t.Fatalf("new request: %v", err)
+	}
+	req.Header.Set("User-Agent", ua)
+	resp, err := http.DefaultClient.Do(req)
+	if err != nil {
+		t.Fatalf("GET %s: %v", path, err)
+	}
+	defer resp.Body.Close()
+	body, _ := io.ReadAll(resp.Body)
+	return resp.StatusCode, string(body)
+}

cmd/webid/main.go

@@ -0,0 +1,989 @@
+// Command webid is the webi HTTP API server. It reads cached release
+// data from the filesystem and serves release metadata, installer
+// scripts, and bootstrap dispatches.
+//
+// It never fetches from upstream APIs — that's webicached's job.
+// This server is stateless and fast: load from cache, resolve, render.
+//
+// Usage:
+//
+//	go run ./cmd/webid
+//	go run ./cmd/webid -addr :3001 -cache ~/.cache/webi/legacy
+package main
+
+import (
+	"context"
+	"crypto/sha1"
+	"encoding/json"
+	"flag"
+	"fmt"
+	"io"
+	"log"
+	"net/http"
+	"os"
+	"os/signal"
+	"path/filepath"
+	"slices"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/webinstall/webi-installers/internal/buildmeta"
+	"github.com/webinstall/webi-installers/internal/lexver"
+	"github.com/webinstall/webi-installers/internal/render"
+	"github.com/webinstall/webi-installers/internal/resolve"
+	"github.com/webinstall/webi-installers/internal/resolver"
+	middleware "github.com/therootcompany/golib/http/middleware/v2"
+
+	"github.com/webinstall/webi-installers/internal/storage"
+	"github.com/webinstall/webi-installers/internal/storage/fsstore"
+	"github.com/webinstall/webi-installers/internal/uadetect"
+)
+
+var (
+	name         = "webid"
+	version      = "0.0.0-dev"
+	commit       = "0000000"
+	date         = "0001-01-01"
+	licenseYear  = "2024"
+	licenseOwner = "AJ ONeal"
+	licenseType  = "MPL-2.0"
+)
+
+func printVersion(w io.Writer) {
+	v := strings.TrimPrefix(version, "v")
+	_, _ = fmt.Fprintf(w, "%s v%s %s (%s)\n", name, v, commit[:7], date)
+	_, _ = fmt.Fprintf(w, "Copyright (C) %s %s\n", licenseYear, licenseOwner)
+	_, _ = fmt.Fprintf(w, "Licensed under %s\n", licenseType)
+}
+
+func main() {
+	addr := flag.String("addr", ":3001", "listen address")
+	cacheDir := flag.String("legacy", "~/.cache/webi/legacy", "legacy cache directory")
+	installersDir := flag.String("installers", ".", "installers repo root (for install.sh/ps1)")
+
+	if len(os.Args) > 1 {
+		switch os.Args[1] {
+		case "-V", "-version", "--version", "version":
+			printVersion(os.Stdout)
+			os.Exit(0)
+		case "help", "-help", "--help":
+			printVersion(os.Stdout)
+			fmt.Fprintln(os.Stdout, "")
+			flag.CommandLine.SetOutput(os.Stdout)
+			flag.Usage()
+			os.Exit(0)
+		}
+	}
+
+	flag.Parse()
+
+	cachePath := expandHome(*cacheDir)
+
+	fss, err := fsstore.New(cachePath)
+	if err != nil {
+		log.Fatalf("fsstore: %v", err)
+	}
+	var store storage.Store = fss
+
+	srv := &server{
+		store:         store,
+		installersDir: *installersDir,
+		packages:      make(map[string]*packageCache),
+	}
+
+	// Pre-load all cached packages.
+	srv.loadAll()
+
+	mux := http.NewServeMux()
+	mmux := middleware.WithMux(mux, requestLogger)
+
+	// Legacy API routes (Node.js compat).
+	mmux.HandleFunc("GET /api/releases/{rest...}", srv.handleReleasesAPI)
+
+	// New API routes (v1).
+	mmux.HandleFunc("GET /v1/releases/{rest...}", srv.handleV1Releases)
+	mmux.HandleFunc("GET /v1/resolve/{rest...}", srv.handleV1Resolve)
+
+	// Full installer script (package-install.tpl.sh + install.sh).
+	mmux.HandleFunc("GET /api/installers/{rest...}", srv.handleInstaller)
+
+	// Debug endpoint.
+	mmux.HandleFunc("GET /api/debug", srv.handleDebug)
+
+	// Health check (no logging — too noisy).
+	mux.HandleFunc("GET /api/health", func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusOK)
+		fmt.Fprintln(w, "ok")
+	})
+
+	// Bootstrap route: /{package} and /{package}@{version}
+	// Detects UA and returns rendered installer script.
+	mmux.HandleFunc("GET /{pkgSpec}", srv.handleBootstrap)
+
+	httpSrv := &http.Server{
+		Addr:         *addr,
+		Handler:      mux,
+		ReadTimeout:  5 * time.Second,
+		WriteTimeout: 30 * time.Second,
+		IdleTimeout:  120 * time.Second,
+	}
+
+	// Graceful shutdown.
+	ctx, stop := signal.NotifyContext(context.Background(), os.Interrupt)
+	defer stop()
+
+	go func() {
+		log.Printf("webid listening on %s", *addr)
+		if err := httpSrv.ListenAndServe(); err != nil && err != http.ErrServerClosed {
+			log.Fatalf("listen: %v", err)
+		}
+	}()
+
+	<-ctx.Done()
+	log.Println("shutting down...")
+
+	shutCtx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+	httpSrv.Shutdown(shutCtx)
+}
+
+// requestLogger is a middleware that logs each request with status and duration.
+func requestLogger(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		start := time.Now()
+		rw := &statusWriter{ResponseWriter: w, code: http.StatusOK}
+		next.ServeHTTP(rw, r)
+		log.Printf("%s %s %d %s", r.Method, r.URL.Path, rw.code, time.Since(start))
+	})
+}
+
+// statusWriter wraps ResponseWriter to capture the HTTP status code.
+type statusWriter struct {
+	http.ResponseWriter
+	code int
+}
+
+func (sw *statusWriter) WriteHeader(code int) {
+	sw.code = code
+	sw.ResponseWriter.WriteHeader(code)
+}
+
+// server holds the shared state for all HTTP handlers.
+type server struct {
+	store         storage.Store
+	installersDir string
+
+	mu        sync.RWMutex
+	packages  map[string]*packageCache
+	webiCksum string // cached sha1[:8] of webi.sh
+}
+
+// packageCache holds a loaded package's assets and catalog.
+type packageCache struct {
+	assets  []storage.Asset
+	dists   []resolve.Dist
+	catalog resolve.Catalog
+}
+
+// loadAll pre-loads all packages from the store.
+func (s *server) loadAll() {
+	ctx := context.Background()
+
+	pkgs, err := s.store.ListPackages(ctx)
+	if err != nil {
+		log.Printf("warn: list packages: %v", err)
+		return
+	}
+
+	count := 0
+	for _, pkg := range pkgs {
+		pd, err := s.store.Load(ctx, pkg)
+		if err != nil {
+			log.Printf("warn: load %s: %v", pkg, err)
+			continue
+		}
+		if pd == nil || len(pd.Assets) == 0 {
+			continue
+		}
+
+		pc := &packageCache{
+			assets: pd.Assets,
+			dists:  assetsToDists(pd.Assets),
+		}
+		pc.catalog = resolve.Survey(pc.dists)
+
+		s.mu.Lock()
+		s.packages[pkg] = pc
+		s.mu.Unlock()
+		count++
+	}
+	log.Printf("loaded %d packages from store", count)
+}
+
+// getPackage returns the cached package data, or nil if not found.
+func (s *server) getPackage(pkg string) *packageCache {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+	return s.packages[pkg]
+}
+
+// assetsToDists converts storage.Asset slice to resolve.Dist slice.
+func assetsToDists(assets []storage.Asset) []resolve.Dist {
+	dists := make([]resolve.Dist, len(assets))
+	for i, a := range assets {
+		dists[i] = resolve.Dist{
+			Filename: a.Filename,
+			Version:  a.Version,
+			LTS:      a.LTS,
+			Channel:  a.Channel,
+			Date:     a.Date,
+			OS:       a.OS,
+			Arch:     a.Arch,
+			Libc:     a.Libc,
+			Format:   a.Format,
+			Download: a.Download,
+			Extra:         a.Extra,
+			GitTag:        a.GitTag,
+			GitCommitHash: a.GitCommitHash,
+			Variants:      a.Variants,
+		}
+	}
+	return dists
+}
+
+// handleReleasesAPI serves /api/releases/{package}@{version}.{format}
+func (s *server) handleReleasesAPI(w http.ResponseWriter, r *http.Request) {
+	rest := r.PathValue("rest")
+
+	// Parse: {package}@{version}.{json|tab} or {package}.{json|tab}
+	pkg, version, format, err := parseReleasePath(rest)
+	if err != nil {
+		http.Error(w, err.Error(), http.StatusBadRequest)
+		return
+	}
+
+	pc := s.getPackage(pkg)
+	if pc == nil {
+		// Check if it's a selfhosted package.
+		if s.isSelfHosted(pkg) {
+			s.serveEmptyReleases(w, format)
+			return
+		}
+		http.Error(w, fmt.Sprintf("package %q not found", pkg), http.StatusNotFound)
+		return
+	}
+
+	// Parse query parameters.
+	q := r.URL.Query()
+	osStr := q.Get("os")
+	archStr := q.Get("arch")
+	libcStr := q.Get("libc")
+	ltsStr := q.Get("lts")
+	channelStr := q.Get("channel")
+	formatsStr := q.Get("formats")
+	limitStr := q.Get("limit")
+
+	// Normalize wildcard "-" to empty (means "any").
+	if osStr == "-" {
+		osStr = ""
+	}
+	if archStr == "-" {
+		archStr = ""
+	}
+	if libcStr == "-" {
+		libcStr = ""
+	}
+
+	// Map Node.js OS/arch names to our canonical names.
+	osStr = normalizeQueryOS(osStr)
+	archStr = normalizeQueryArch(archStr)
+
+	// Parse LTS.
+	lts := ltsStr == "true" || ltsStr == "1"
+
+	// Handle channel selectors in the version field: @stable, @lts, @beta, etc.
+	switch strings.ToLower(version) {
+	case "stable", "latest":
+		version = ""
+		if channelStr == "" {
+			channelStr = "stable"
+		}
+	case "lts":
+		version = ""
+		lts = true
+	case "beta", "pre", "preview":
+		version = ""
+		if channelStr == "" {
+			channelStr = "beta"
+		}
+	case "rc":
+		version = ""
+		if channelStr == "" {
+			channelStr = "rc"
+		}
+	case "alpha", "dev":
+		version = ""
+		if channelStr == "" {
+			channelStr = "alpha"
+		}
+	}
+
+	// Parse formats list.
+	var formats []string
+	if formatsStr != "" {
+		formats = strings.Split(formatsStr, ",")
+	}
+
+	// Parse limit.
+	limit := 100
+	if limitStr != "" {
+		fmt.Sscanf(limitStr, "%d", &limit)
+	}
+
+	// Filter matching releases, sort by specificity, then apply limit.
+	filtered := filterDists(pc.dists, osStr, archStr, libcStr, channelStr, version, formats, lts)
+	sortDistsDescending(filtered, osStr, archStr)
+	if len(filtered) > limit {
+		filtered = filtered[:limit]
+	}
+
+	switch format {
+	case "json":
+		s.serveJSON(w, r, pc, filtered)
+	case "tab":
+		s.serveTab(w, r, filtered)
+	default:
+		http.Error(w, "unsupported format: "+format, http.StatusBadRequest)
+	}
+}
+
+// normalizeQueryOS maps Node.js OS names to our canonical names.
+func normalizeQueryOS(s string) string {
+	switch strings.ToLower(s) {
+	case "macos", "mac":
+		return "darwin"
+	case "win":
+		return "windows"
+	default:
+		return s
+	}
+}
+
+// normalizeQueryArch maps Node.js arch names to our canonical names.
+func normalizeQueryArch(s string) string {
+	switch strings.ToLower(s) {
+	case "amd64":
+		return string(buildmeta.ArchAMD64) // "x86_64"
+	case "arm64":
+		return string(buildmeta.ArchARM64) // "aarch64"
+	case "armv7l":
+		return string(buildmeta.ArchARMv7)
+	case "armv6l":
+		return string(buildmeta.ArchARMv6)
+	case "x86", "i386", "i686":
+		return string(buildmeta.ArchX86)
+	default:
+		return s
+	}
+}
+
+// parseReleasePath parses "{pkg}@{version}.{format}" or "{pkg}.{format}".
+func parseReleasePath(rest string) (pkg, version, format string, err error) {
+	if strings.HasSuffix(rest, ".json") {
+		format = "json"
+		rest = strings.TrimSuffix(rest, ".json")
+	} else if strings.HasSuffix(rest, ".tab") {
+		format = "tab"
+		rest = strings.TrimSuffix(rest, ".tab")
+	} else {
+		return "", "", "", fmt.Errorf("unsupported format (use .json or .tab)")
+	}
+
+	if idx := strings.IndexByte(rest, '@'); idx >= 0 {
+		pkg = rest[:idx]
+		version = rest[idx+1:]
+	} else {
+		pkg = rest
+	}
+
+	if pkg == "" {
+		return "", "", "", fmt.Errorf("package name required")
+	}
+
+	return pkg, version, format, nil
+}
+
+// filterDists filters dists by query parameters, returning all matches
+// up to limit. This is for the API listing, not single-best resolution.
+func filterDists(dists []resolve.Dist, osStr, archStr, libcStr, channel, version string, formats []string, lts bool) []resolve.Dist {
+	var result []resolve.Dist
+
+	archSet := make(map[string]bool)
+	if archStr != "" {
+		for _, a := range buildmeta.CompatArches(buildmeta.OS(osStr), buildmeta.Arch(archStr)) {
+			archSet[string(a)] = true
+		}
+		if len(archSet) == 0 {
+			archSet[archStr] = true
+		}
+	}
+
+	for _, d := range dists {
+		if osStr != "" && d.OS != osStr && d.OS != "*" && d.OS != "ANYOS" && d.OS != "" &&
+			!(d.OS == "posix_2017" && osStr != "windows") {
+			continue
+		}
+
+		if archStr != "" && !archSet[d.Arch] && d.Arch != "*" && d.Arch != "ANYARCH" && d.Arch != "" {
+			continue
+		}
+
+		if libcStr != "" && d.Libc != "none" && d.Libc != "" && d.Libc != libcStr {
+			continue
+		}
+
+		if lts && !d.LTS {
+			continue
+		}
+
+		if channel != "" && d.Channel != channel {
+			continue
+		}
+
+		if version != "" {
+			// Match with or without "v" prefix:
+			// query "0.25" should match version "v0.25.0".
+			v := strings.TrimPrefix(d.Version, "v")
+			vq := strings.TrimPrefix(version, "v")
+			if !strings.HasPrefix(v, vq) {
+				continue
+			}
+		}
+
+		if len(formats) > 0 {
+			matched := false
+			for _, f := range formats {
+				if strings.Contains(d.Format, f) {
+					matched = true
+					break
+				}
+			}
+			if !matched {
+				continue
+			}
+		}
+
+		result = append(result, d)
+	}
+
+	return result
+}
+
+// legacyRelease matches the Node.js JSON response format.
+// Production returns a bare JSON array of these objects.
+type legacyRelease struct {
+	Name          string `json:"name"`
+	Version       string `json:"version"`
+	GitTag        string `json:"git_tag,omitempty"`
+	GitCommitHash string `json:"git_commit_hash,omitempty"`
+	LTS           bool   `json:"lts"`
+	Channel       string `json:"channel"`
+	Date          string `json:"date"`
+	OS            string `json:"os"`
+	Arch          string `json:"arch"`
+	Ext           string `json:"ext"`
+	Download      string `json:"download"`
+	Libc          string `json:"libc"`
+}
+
+// legacyOS maps Go canonical OS names to Node.js legacy names.
+func legacyOS(s string) string {
+	switch s {
+	case "darwin":
+		return "macos"
+	case "":
+		return "*"
+	default:
+		return s
+	}
+}
+
+// legacyArch maps Go canonical arch names to Node.js legacy names.
+func legacyArch(s string) string {
+	switch s {
+	case "x86_64":
+		return "amd64"
+	case "aarch64":
+		return "arm64"
+	case "armv7":
+		return "armv7l"
+	case "armv6":
+		return "armv6l"
+	case "armv5":
+		return "arm"
+	case "":
+		return "*"
+	default:
+		return s
+	}
+}
+
+// legacyExt strips the leading "." from format strings.
+func legacyExt(s string) string {
+	s = strings.TrimPrefix(s, ".")
+	if s == "" {
+		return "exe"
+	}
+	return s
+}
+
+// legacyVersion strips the leading "v" from version strings.
+func legacyVersion(s string) string {
+	return strings.TrimPrefix(s, "v")
+}
+
+// legacyLibc returns "none" for empty libc values.
+func legacyLibc(s string) string {
+	if s == "" {
+		return "none"
+	}
+	return s
+}
+
+func distsToLegacy(dists []resolve.Dist) []legacyRelease {
+	releases := make([]legacyRelease, len(dists))
+	for i, d := range dists {
+		releases[i] = legacyRelease{
+			Name:          d.Filename,
+			Version:       legacyVersion(d.Version),
+			GitTag:        d.GitTag,
+			GitCommitHash: d.GitCommitHash,
+			LTS:           d.LTS,
+			Channel:       d.Channel,
+			Date:          d.Date,
+			OS:            legacyOS(d.OS),
+			Arch:          legacyArch(d.Arch),
+			Ext:           legacyExt(d.Format),
+			Download:      d.Download,
+			Libc:          legacyLibc(d.Libc),
+		}
+	}
+	return releases
+}
+
+func (s *server) serveJSON(w http.ResponseWriter, r *http.Request, pc *packageCache, filtered []resolve.Dist) {
+	// Production returns a bare JSON array, not wrapped in an object.
+	releases := distsToLegacy(filtered)
+
+	w.Header().Set("Content-Type", "application/json")
+
+	pretty := r.URL.Query().Get("pretty")
+	if pretty == "true" || pretty == "1" {
+		enc := json.NewEncoder(w)
+		enc.SetIndent("", "  ")
+		enc.Encode(releases)
+	} else {
+		json.NewEncoder(w).Encode(releases)
+	}
+}
+
+func (s *server) serveTab(w http.ResponseWriter, r *http.Request, filtered []resolve.Dist) {
+	w.Header().Set("Content-Type", "text/plain; charset=utf-8")
+
+	// Production only shows header row with ?pretty=true.
+	pretty := r.URL.Query().Get("pretty")
+	if pretty != "" && pretty != "false" {
+		fmt.Fprintln(w, "VERSION\tLTS\tCHANNEL\tRELEASE_DATE\tOS\tARCH\tEXT\tHASH\tURL\t_\tLIBC")
+	}
+
+	// Tab format matches Node.js production:
+	// version \t lts \t channel \t date \t os \t arch \t ext \t hash \t download \t comment \t libc
+	for _, d := range filtered {
+		lts := "-"
+		if d.LTS {
+			lts = "lts"
+		}
+		channel := d.Channel
+		if channel == "" {
+			channel = "-"
+		}
+		date := d.Date
+		if date == "" {
+			date = "-"
+		}
+		fmt.Fprintf(w, "%s\t%s\t%s\t%s\t%s\t%s\t%s\t-\t%s\t\t%s\n",
+			legacyVersion(d.Version),
+			lts,
+			channel,
+			date,
+			legacyOS(d.OS),
+			legacyArch(d.Arch),
+			legacyExt(d.Format),
+			d.Download,
+			legacyLibc(d.Libc),
+		)
+	}
+}
+
+// sortDistsDescending sorts dists newest-first by version.
+func sortDistsDescending(dists []resolve.Dist, queryOS, queryArch string) {
+	slices.SortStableFunc(dists, func(a, b resolve.Dist) int {
+		va := lexver.Parse(strings.TrimPrefix(a.Version, "v"))
+		vb := lexver.Parse(strings.TrimPrefix(b.Version, "v"))
+		if cmp := lexver.Compare(vb, va); cmp != 0 {
+			return cmp
+		}
+		if cmp := osSpecificity(a.OS, queryOS) - osSpecificity(b.OS, queryOS); cmp != 0 {
+			return cmp
+		}
+		if cmp := archSpecificity(a.Arch, queryArch) - archSpecificity(b.Arch, queryArch); cmp != 0 {
+			return cmp
+		}
+		return libcRank(a.Libc) - libcRank(b.Libc)
+	})
+}
+
+func osSpecificity(distOS, queryOS string) int {
+	switch {
+	case distOS == queryOS:
+		return 0
+	case distOS == "posix_2017":
+		return 1
+	default:
+		return 2
+	}
+}
+
+func archSpecificity(distArch, queryArch string) int {
+	switch {
+	case distArch == queryArch:
+		return 0
+	case distArch == "" || distArch == "*":
+		return 2
+	default:
+		return 1
+	}
+}
+
+func libcRank(libc string) int {
+	switch libc {
+	case "none", "":
+		return 0
+	default:
+		return 1
+	}
+}
+
+// serveEmptyReleases returns an empty release list for selfhosted packages.
+func (s *server) serveEmptyReleases(w http.ResponseWriter, format string) {
+	switch format {
+	case "json":
+		w.Header().Set("Content-Type", "application/json")
+		// Production returns an empty array.
+		json.NewEncoder(w).Encode([]legacyRelease{})
+	case "tab":
+		w.Header().Set("Content-Type", "text/plain; charset=utf-8")
+	}
+}
+
+// isSelfHosted checks if a package has install.sh but no releases.conf.
+func (s *server) isSelfHosted(pkg string) bool {
+	installPath := filepath.Join(s.installersDir, pkg, "install.sh")
+	if _, err := os.Stat(installPath); err != nil {
+		return false
+	}
+	confPath := filepath.Join(s.installersDir, pkg, "releases.conf")
+	if _, err := os.Stat(confPath); err == nil {
+		return false
+	}
+	return true
+}
+
+// handleDebug returns UA detection info for the requesting client.
+func (s *server) handleDebug(w http.ResponseWriter, r *http.Request) {
+	result := uadetect.FromRequest(r)
+
+	w.Header().Set("Content-Type", "application/json")
+	json.NewEncoder(w).Encode(map[string]string{
+		"user_agent": r.Header.Get("User-Agent"),
+		"os":         string(result.OS),
+		"arch":       string(result.Arch),
+		"libc":       string(result.Libc),
+	})
+}
+
+// handleBootstrap serves /{package} and /{package}@{version}.
+// This is the curl-pipe bootstrap: a minimal script that sets
+// WEBI_PKG/WEBI_HOST/WEBI_CHECKSUM and downloads+runs webi.
+func (s *server) handleBootstrap(w http.ResponseWriter, r *http.Request) {
+	pkgSpec := r.PathValue("pkgSpec")
+
+	// Parse package@version.
+	pkg, tag := pkgSpec, ""
+	if idx := strings.IndexByte(pkgSpec, '@'); idx >= 0 {
+		pkg = pkgSpec[:idx]
+		tag = pkgSpec[idx+1:]
+	}
+
+	if pkg == "" {
+		http.Error(w, "package name required", http.StatusBadRequest)
+		return
+	}
+
+	// Verify package exists.
+	if s.getPackage(pkg) == nil && !s.isSelfHosted(pkg) {
+		http.Error(w, fmt.Sprintf("package %q not found", pkg), http.StatusNotFound)
+		return
+	}
+
+	baseURL := baseURLFromRequest(r)
+	webiPkg := pkg
+	if tag != "" {
+		webiPkg = pkg + "@" + tag
+	}
+
+	// Read and inject the curl-pipe bootstrap template.
+	tplPath := filepath.Join(s.installersDir, "_webi", "curl-pipe-bootstrap.tpl.sh")
+	tpl, err := os.ReadFile(tplPath)
+	if err != nil {
+		log.Printf("bootstrap: read template: %v", err)
+		http.Error(w, "bootstrap template not found", http.StatusInternalServerError)
+		return
+	}
+
+	script := string(tpl)
+	script = render.InjectVar(script, "WEBI_PKG", webiPkg)
+	script = render.InjectVar(script, "WEBI_HOST", baseURL)
+	script = render.InjectVar(script, "WEBI_CHECKSUM", s.webiChecksum())
+
+	// text/html so browsers see the meta redirect to cheat sheet.
+	w.Header().Set("Content-Type", "text/html; charset=utf-8")
+	fmt.Fprint(w, script)
+}
+
+// handleInstaller serves /api/installers/{pkg}@{version}.sh
+// This is the full installer script with release resolution and
+// embedded install.sh.
+func (s *server) handleInstaller(w http.ResponseWriter, r *http.Request) {
+	rest := r.PathValue("rest")
+
+	// Parse: {pkg}@{version}.sh or {pkg}.sh
+	ext := ""
+	if strings.HasSuffix(rest, ".sh") {
+		ext = "sh"
+		rest = strings.TrimSuffix(rest, ".sh")
+	} else if strings.HasSuffix(rest, ".ps1") {
+		ext = "ps1"
+		rest = strings.TrimSuffix(rest, ".ps1")
+	} else {
+		http.Error(w, "unsupported format (use .sh or .ps1)", http.StatusBadRequest)
+		return
+	}
+
+	pkg, tag := rest, ""
+	if idx := strings.IndexByte(rest, '@'); idx >= 0 {
+		pkg = rest[:idx]
+		tag = rest[idx+1:]
+	}
+
+	if pkg == "" {
+		http.Error(w, "package name required", http.StatusBadRequest)
+		return
+	}
+	// Detect platform from User-Agent.
+	ua := uadetect.FromRequest(r)
+	if ua.OS == "" {
+		http.Error(w, "could not detect OS from User-Agent", http.StatusBadRequest)
+		return
+	}
+
+	isSelfHosted := s.isSelfHosted(pkg)
+	pc := s.getPackage(pkg)
+
+	if pc == nil && !isSelfHosted {
+		http.Error(w, fmt.Sprintf("package %q not found", pkg), http.StatusNotFound)
+		return
+	}
+
+	baseURL := baseURLFromRequest(r)
+
+	p := render.Params{
+		Host:    baseURL,
+		PkgName: pkg,
+		Tag:     tag,
+		OS:      string(ua.OS),
+		Arch:    string(ua.Arch),
+		Libc:    string(ua.Libc),
+	}
+
+	// Resolve the best release (if not selfhosted).
+	if pc != nil {
+		req := resolver.Request{
+			OS:   string(ua.OS),
+			Arch: string(ua.Arch),
+			Libc: string(ua.Libc),
+		}
+
+		switch strings.ToLower(tag) {
+		case "stable", "latest", "":
+			// Default.
+		case "lts":
+			req.LTS = true
+		case "beta", "pre", "preview":
+			req.Channel = "beta"
+		case "rc":
+			req.Channel = "rc"
+		case "alpha", "dev":
+			req.Channel = "alpha"
+		default:
+			req.Version = tag
+		}
+
+		res, err := resolver.Resolve(pc.assets, req)
+		if err != nil {
+			p.Version = "0.0.0"
+			p.Channel = "error"
+			p.Ext = "err"
+			p.PkgURL = "https://example.com/doesntexist.ext"
+			p.PkgFile = "doesntexist.ext"
+			p.CSV = buildCSV(p)
+		} else {
+			v := strings.TrimPrefix(res.Version, "v")
+			parts := splitVersion(v)
+			p.Version = v
+			p.Major = parts[0]
+			p.Minor = parts[1]
+			p.Patch = parts[2]
+			p.Build = parts[3]
+			if res.Asset.GitTag != "" {
+				p.GitTag = res.Asset.GitTag
+			} else {
+				p.GitTag = "v" + v
+			}
+			p.GitBranch = p.GitTag
+			p.GitCommitHash = res.Asset.GitCommitHash
+			p.LTS = fmt.Sprintf("%v", res.Asset.LTS)
+			p.Channel = res.Asset.Channel
+			if p.Channel == "" {
+				p.Channel = "stable"
+			}
+			p.Ext = strings.TrimPrefix(res.Asset.Format, ".")
+			if p.Ext == "" {
+				p.Ext = "exe"
+			}
+			p.PkgURL = res.Asset.Download
+			p.PkgFile = res.Asset.Filename
+			p.CSV = buildCSV(p)
+		}
+
+		p.PkgStable = pc.catalog.Stable
+		p.PkgLatest = pc.catalog.Latest
+		p.PkgOSes = strings.Join(pc.catalog.OSes, " ")
+		p.PkgArches = strings.Join(pc.catalog.Arches, " ")
+		p.PkgLibcs = strings.Join(pc.catalog.Libcs, " ")
+		p.PkgFormats = strings.Join(pc.catalog.Formats, " ")
+	}
+
+	p.ReleasesURL = fmt.Sprintf("%s/api/releases/%s@%s.tab?os=%s&arch=%s&libc=%s&formats=tar&pretty=true",
+		baseURL, pkg, tag, p.OS, p.Arch, p.Libc)
+
+	var script string
+	var renderErr error
+	if ext == "ps1" {
+		tplPath := filepath.Join(s.installersDir, "_webi", "package-install.tpl.ps1")
+		script, renderErr = render.PowerShell(tplPath, s.installersDir, pkg, p)
+	} else {
+		tplPath := filepath.Join(s.installersDir, "_webi", "package-install.tpl.sh")
+		script, renderErr = render.Bash(tplPath, s.installersDir, pkg, p)
+	}
+	if renderErr != nil {
+		log.Printf("render %s: %v", pkg, renderErr)
+		http.Error(w, fmt.Sprintf("failed to render installer for %q: %v", pkg, renderErr), http.StatusInternalServerError)
+		return
+	}
+
+	w.Header().Set("Content-Type", "text/plain; charset=utf-8")
+	fmt.Fprint(w, script)
+}
+
+// baseURLFromRequest builds the base URL from the request.
+func baseURLFromRequest(r *http.Request) string {
+	if r.TLS != nil || strings.Contains(r.Host, "webinstall") || strings.Contains(r.Host, "webi.") {
+		return "https://" + r.Host
+	}
+	return "http://" + r.Host
+}
+
+// webiChecksum returns the checksum of the webi.sh bootstrap script.
+func (s *server) webiChecksum() string {
+	s.mu.RLock()
+	cksum := s.webiCksum
+	s.mu.RUnlock()
+	if cksum != "" {
+		return cksum
+	}
+
+	// Calculate checksum from webi.sh file.
+	webiPath := filepath.Join(s.installersDir, "webi", "webi.sh")
+	data, err := os.ReadFile(webiPath)
+	if err != nil {
+		return "00000000"
+	}
+
+	h := sha1.New()
+	h.Write(data)
+	cksum = fmt.Sprintf("%x", h.Sum(nil))[:8]
+
+	s.mu.Lock()
+	s.webiCksum = cksum
+	s.mu.Unlock()
+	return cksum
+}
+
+// buildCSV creates the WEBI_CSV line in the Node.js format.
+func buildCSV(p render.Params) string {
+	return strings.Join([]string{
+		p.Version,
+		p.LTS,
+		p.Channel,
+		"", // date
+		p.OS,
+		p.Arch,
+		p.Ext,
+		"-",
+		p.PkgURL,
+		p.PkgFile,
+		"",
+	}, ",")
+}
+
+// splitVersion splits a version string into [major, minor, patch, build].
+func splitVersion(v string) [4]string {
+	// Strip pre-release suffix for splitting.
+	base := v
+	build := ""
+	if idx := strings.IndexByte(v, '-'); idx >= 0 {
+		base = v[:idx]
+		build = v[idx+1:]
+	}
+
+	parts := strings.SplitN(base, ".", 4)
+	var result [4]string
+	for i := 0; i < len(parts) && i < 3; i++ {
+		result[i] = parts[i]
+	}
+	result[3] = build
+	return result
+}
+
+func expandHome(path string) string {
+	if !strings.HasPrefix(path, "~/") {
+		return path
+	}
+	home, err := os.UserHomeDir()
+	if err != nil {
+		return path
+	}
+	return filepath.Join(home, path[2:])
+}

cmd/webid/main_test.go

@@ -0,0 +1,298 @@
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/webinstall/webi-installers/internal/resolve"
+	"github.com/webinstall/webi-installers/internal/storage"
+	"github.com/webinstall/webi-installers/internal/storage/fsstore"
+)
+
+// newTestServer creates a server backed by the real _cache directory
+// and returns an httptest.Server with proper routing (so PathValue works).
+func newTestServer(t *testing.T) (*server, *httptest.Server) {
+	t.Helper()
+
+	cacheDir := filepath.Join("..", "..", "_cache")
+	if _, err := os.Stat(cacheDir); err != nil {
+		t.Skipf("no cache dir at %s", cacheDir)
+	}
+
+	store, err := fsstore.New(cacheDir)
+	if err != nil {
+		t.Fatalf("fsstore: %v", err)
+	}
+
+	srv := &server{
+		store:         store,
+		installersDir: filepath.Join("..", ".."),
+		packages:      make(map[string]*packageCache),
+	}
+
+	// Load packages.
+	monthDir := time.Now().Format("2006-01")
+	dir := filepath.Join(store.Root(), monthDir)
+	entries, err := os.ReadDir(dir)
+	if err != nil {
+		t.Fatalf("readdir: %v", err)
+	}
+	for _, e := range entries {
+		if !strings.HasSuffix(e.Name(), ".json") {
+			continue
+		}
+		pkg := strings.TrimSuffix(e.Name(), ".json")
+		pd, err := store.Load(context.Background(), pkg)
+		if err != nil || pd == nil || len(pd.Assets) == 0 {
+			continue
+		}
+		pc := &packageCache{
+			assets: pd.Assets,
+			dists:  assetsToDists(pd.Assets),
+		}
+		pc.catalog = resolve.Survey(pc.dists)
+		srv.packages[pkg] = pc
+	}
+
+	mux := http.NewServeMux()
+	mux.HandleFunc("GET /api/releases/{rest...}", srv.handleReleasesAPI)
+	mux.HandleFunc("GET /v1/releases/{rest...}", srv.handleV1Releases)
+	mux.HandleFunc("GET /v1/resolve/{rest...}", srv.handleV1Resolve)
+	mux.HandleFunc("GET /api/installers/{rest...}", srv.handleInstaller)
+	mux.HandleFunc("GET /api/debug", srv.handleDebug)
+	mux.HandleFunc("GET /{pkgSpec}", srv.handleBootstrap)
+
+	ts := httptest.NewServer(mux)
+	t.Cleanup(ts.Close)
+
+	return srv, ts
+}
+
+// get fetches a URL from the test server and returns the body.
+func get(t *testing.T, ts *httptest.Server, path string) (int, string) {
+	t.Helper()
+	resp, err := http.Get(ts.URL + path)
+	if err != nil {
+		t.Fatalf("GET %s: %v", path, err)
+	}
+	defer resp.Body.Close()
+	body, _ := io.ReadAll(resp.Body)
+	return resp.StatusCode, string(body)
+}
+
+// TestLegacyJSONFormat verifies our JSON output matches the production format.
+func TestLegacyJSONFormat(t *testing.T) {
+	srv, ts := newTestServer(t)
+
+	packages := []string{"bat", "node", "go", "jq"}
+	for _, pkg := range packages {
+		t.Run(pkg, func(t *testing.T) {
+			if srv.getPackage(pkg) == nil {
+				t.Skipf("package %s not in cache", pkg)
+			}
+
+			code, body := get(t, ts, "/api/releases/"+pkg+".json?limit=5")
+			if code != http.StatusOK {
+				t.Fatalf("status %d: %s", code, body)
+			}
+
+			body = strings.TrimSpace(body)
+
+			// Must be a JSON array, not an object.
+			if !strings.HasPrefix(body, "[") {
+				t.Fatalf("expected JSON array, got: %.100s", body)
+			}
+
+			var releases []legacyRelease
+			if err := json.Unmarshal([]byte(body), &releases); err != nil {
+				t.Fatalf("decode: %v", err)
+			}
+			if len(releases) == 0 {
+				t.Fatal("no releases returned")
+			}
+
+			// Check field format conventions.
+			for i, r := range releases {
+				if strings.HasPrefix(r.Version, "v") {
+					t.Errorf("release[%d]: version %q should not have v prefix", i, r.Version)
+				}
+				if strings.HasPrefix(r.Ext, ".") {
+					t.Errorf("release[%d]: ext %q should not have . prefix", i, r.Ext)
+				}
+				if r.OS == "darwin" {
+					t.Errorf("release[%d]: os should be 'macos' not 'darwin'", i)
+				}
+				if r.Arch == "x86_64" {
+					t.Errorf("release[%d]: arch should be 'amd64' not 'x86_64'", i)
+				}
+				if r.Arch == "aarch64" {
+					t.Errorf("release[%d]: arch should be 'arm64' not 'aarch64'", i)
+				}
+				if r.Libc == "" {
+					t.Errorf("release[%d]: libc should be 'none' not empty", i)
+				}
+				if r.Download == "" {
+					t.Errorf("release[%d]: download URL is empty", i)
+				}
+			}
+		})
+	}
+}
+
+// TestLegacyTabFormat verifies our .tab output uses real TSV.
+func TestLegacyTabFormat(t *testing.T) {
+	srv, ts := newTestServer(t)
+
+	packages := []string{"bat", "node", "go"}
+	for _, pkg := range packages {
+		t.Run(pkg, func(t *testing.T) {
+			if srv.getPackage(pkg) == nil {
+				t.Skipf("package %s not in cache", pkg)
+			}
+
+			code, body := get(t, ts, "/api/releases/"+pkg+".tab?limit=3")
+			if code != http.StatusOK {
+				t.Fatalf("status %d: %s", code, body)
+			}
+
+			lines := strings.Split(strings.TrimSpace(body), "\n")
+			if len(lines) == 0 {
+				t.Fatal("no lines returned")
+			}
+
+			for i, line := range lines {
+				fields := strings.Split(line, "\t")
+				// Expect 11 tab-separated fields:
+				// version, lts, channel, date, os, arch, ext, hash, download, (empty), libc
+				if len(fields) != 11 {
+					t.Errorf("line[%d]: expected 11 tab fields, got %d: %q", i, len(fields), line)
+					continue
+				}
+
+				version := fields[0]
+				lts := fields[1]
+				ext := fields[6]
+
+				if strings.HasPrefix(version, "v") {
+					t.Errorf("line[%d]: version %q should not have v prefix", i, version)
+				}
+				if lts != "-" && lts != "lts" {
+					t.Errorf("line[%d]: lts should be '-' or 'lts', got %q", i, lts)
+				}
+				if strings.HasPrefix(ext, ".") {
+					t.Errorf("line[%d]: ext %q should not have . prefix", i, ext)
+				}
+			}
+		})
+	}
+}
+
+// TestLegacyJSONAgainstProduction compares our output against live production.
+// Run with: WEBI_TEST_PROD=1 go test -run TestLegacyJSONAgainstProduction
+func TestLegacyJSONAgainstProduction(t *testing.T) {
+	if os.Getenv("WEBI_TEST_PROD") == "" {
+		t.Skip("set WEBI_TEST_PROD=1 to compare against production")
+	}
+
+	srv, ts := newTestServer(t)
+
+	packages := []string{"bat", "node", "go", "jq", "rg"}
+	for _, pkg := range packages {
+		t.Run(pkg, func(t *testing.T) {
+			if srv.getPackage(pkg) == nil {
+				t.Skipf("package %s not in cache", pkg)
+			}
+
+			// Fetch from production.
+			prodURL := fmt.Sprintf("https://webinstall.dev/api/releases/%s.json?limit=3", pkg)
+			prodResp, err := http.Get(prodURL)
+			if err != nil {
+				t.Fatalf("fetch production: %v", err)
+			}
+			defer prodResp.Body.Close()
+			prodBody, _ := io.ReadAll(prodResp.Body)
+
+			var prodReleases []legacyRelease
+			if err := json.Unmarshal(prodBody, &prodReleases); err != nil {
+				t.Fatalf("decode production: %v\nbody: %.500s", err, string(prodBody))
+			}
+
+			// Fetch from local.
+			_, localBody := get(t, ts, "/api/releases/"+pkg+".json?limit=3")
+
+			var localReleases []legacyRelease
+			if err := json.Unmarshal([]byte(localBody), &localReleases); err != nil {
+				t.Fatalf("decode local: %v", err)
+			}
+
+			if len(prodReleases) == 0 || len(localReleases) == 0 {
+				t.Skip("empty releases")
+			}
+
+			// Compare the first release's format.
+			prod := prodReleases[0]
+			local := localReleases[0]
+
+			if strings.HasPrefix(local.Version, "v") != strings.HasPrefix(prod.Version, "v") {
+				t.Errorf("version prefix mismatch: prod=%q local=%q", prod.Version, local.Version)
+			}
+			if strings.HasPrefix(local.Ext, ".") != strings.HasPrefix(prod.Ext, ".") {
+				t.Errorf("ext prefix mismatch: prod=%q local=%q", prod.Ext, local.Ext)
+			}
+			if prod.OS == "macos" && local.OS == "darwin" {
+				t.Error("OS: prod uses 'macos', local uses 'darwin'")
+			}
+			if prod.Arch == "amd64" && local.Arch == "x86_64" {
+				t.Error("Arch: prod uses 'amd64', local uses 'x86_64'")
+			}
+			if prod.Arch == "arm64" && local.Arch == "aarch64" {
+				t.Error("Arch: prod uses 'arm64', local uses 'aarch64'")
+			}
+
+			t.Logf("prod[0]:  version=%q os=%q arch=%q ext=%q libc=%q",
+				prod.Version, prod.OS, prod.Arch, prod.Ext, prod.Libc)
+			t.Logf("local[0]: version=%q os=%q arch=%q ext=%q libc=%q",
+				local.Version, local.OS, local.Arch, local.Ext, local.Libc)
+		})
+	}
+}
+
+// TestSortOrder verifies releases come back newest-first.
+func TestSortOrder(t *testing.T) {
+	srv, ts := newTestServer(t)
+
+	pkg := "bat"
+	if srv.getPackage(pkg) == nil {
+		t.Skipf("package %s not in cache", pkg)
+	}
+
+	_, body := get(t, ts, "/api/releases/"+pkg+".json?limit=20")
+
+	var releases []legacyRelease
+	if err := json.Unmarshal([]byte(body), &releases); err != nil {
+		t.Fatalf("decode: %v", err)
+	}
+
+	if len(releases) < 2 {
+		t.Skip("need at least 2 releases")
+	}
+
+	// First release should be newest (or equal) version.
+	first := releases[0].Date
+	last := releases[len(releases)-1].Date
+	if first < last {
+		t.Errorf("not newest-first: first=%q last=%q", first, last)
+	}
+}
+
+// Ensure imports are used.
+var _ = storage.Asset{}

cmd/webid/v1api.go

@@ -0,0 +1,459 @@
+package main
+
+import (
+	"bytes"
+	"encoding/csv"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"slices"
+	"strings"
+
+	"github.com/jszwec/csvutil"
+
+	"github.com/webinstall/webi-installers/internal/buildmeta"
+	"github.com/webinstall/webi-installers/internal/lexver"
+	"github.com/webinstall/webi-installers/internal/resolver"
+	"github.com/webinstall/webi-installers/internal/storage"
+)
+
+// v1Release is a single release in the new API TSV format.
+// Field order matters for csvutil — it determines column order.
+// Fields are designed to be easy to consume with cut/grep/sort.
+type v1Release struct {
+	Version  string `csv:"version"`
+	Channel  string `csv:"channel"`
+	LTS      string `csv:"lts"`
+	Date     string `csv:"date"`
+	OS       string `csv:"os"`
+	Arch     string `csv:"arch"`
+	Libc     string `csv:"libc"`
+	Format   string `csv:"format"`
+	Variants string `csv:"variants"` // space-separated
+	Download string `csv:"download"`
+	Filename string `csv:"filename"`
+}
+
+// v1ResolveResult is the response for /v1/resolve/{pkg}.
+type v1ResolveResult struct {
+	Version  string `csv:"version"  json:"version"`
+	Channel  string `csv:"channel"  json:"channel"`
+	LTS      string `csv:"lts"      json:"lts"`
+	Date     string `csv:"date"     json:"date"`
+	OS       string `csv:"os"       json:"os"`
+	Arch     string `csv:"arch"     json:"arch"`
+	Libc     string `csv:"libc"     json:"libc"`
+	Format   string `csv:"format"   json:"format"`
+	Variants string `csv:"variants" json:"variants"`
+	Download string `csv:"download" json:"download"`
+	Filename string `csv:"filename" json:"filename"`
+	Triplet  string `csv:"triplet"  json:"triplet"`
+}
+
+// handleV1Releases serves /v1/releases/{pkg}.tsv (or .json)
+// with Go-native naming and TSV-first format.
+//
+// Query params:
+//
+//	os      — filter by OS (darwin, linux, windows)
+//	arch    — filter by arch (aarch64, x86_64, armv7l)
+//	libc    — filter by libc (gnu, musl, msvc)
+//	channel — release channel (stable, beta, rc, alpha)
+//	version — version prefix filter (e.g. "1.20")
+//	lts     — if "true", only LTS releases
+//	format  — filter by format (e.g. "tar.gz")
+//	variant — filter by variant (e.g. "rocm")
+//	limit   — max results (default 1000)
+func (s *server) handleV1Releases(w http.ResponseWriter, r *http.Request) {
+	rest := r.PathValue("rest")
+
+	pkg, version, format, err := parseReleasePath(rest)
+	if err != nil {
+		http.Error(w, err.Error(), http.StatusBadRequest)
+		return
+	}
+
+	pc := s.getPackage(pkg)
+	if pc == nil {
+		if s.isSelfHosted(pkg) {
+			s.v1ServeEmpty(w, format)
+			return
+		}
+		http.Error(w, fmt.Sprintf("package %q not found", pkg), http.StatusNotFound)
+		return
+	}
+
+	q := r.URL.Query()
+	osStr := q.Get("os")
+	archStr := q.Get("arch")
+	libcStr := q.Get("libc")
+	channelStr := q.Get("channel")
+	ltsStr := q.Get("lts")
+	formatFilter := q.Get("format")
+	variantStr := q.Get("variant")
+	limitStr := q.Get("limit")
+
+	// Use version from URL path or query.
+	if version == "" {
+		version = q.Get("version")
+	}
+
+	// Handle channel selectors in version field.
+	switch strings.ToLower(version) {
+	case "stable", "latest":
+		version = ""
+		if channelStr == "" {
+			channelStr = "stable"
+		}
+	case "lts":
+		version = ""
+		ltsStr = "true"
+	case "beta", "pre", "preview":
+		version = ""
+		if channelStr == "" {
+			channelStr = "beta"
+		}
+	case "rc":
+		version = ""
+		if channelStr == "" {
+			channelStr = "rc"
+		}
+	case "alpha", "dev":
+		version = ""
+		if channelStr == "" {
+			channelStr = "alpha"
+		}
+	}
+
+	lts := ltsStr == "true" || ltsStr == "1"
+
+	limit := 1000
+	if limitStr != "" {
+		fmt.Sscanf(limitStr, "%d", &limit)
+	}
+
+	// Filter assets directly (not via resolve.Dist).
+	filtered := filterAssets(pc.assets, osStr, archStr, libcStr, channelStr, version, formatFilter, variantStr, lts, limit)
+
+	// Sort newest-first.
+	sortAssetsDescending(filtered)
+
+	switch format {
+	case "json":
+		s.v1ServeJSON(w, filtered)
+	case "tab":
+		s.v1ServeTSV(w, filtered)
+	default:
+		http.Error(w, "unsupported format: "+format+" (use .json or .tab)", http.StatusBadRequest)
+	}
+}
+
+// handleV1Resolve serves /v1/resolve/{pkg}.tsv (or .json)
+// It resolves the single best asset for a given platform.
+//
+// Query params:
+//
+//	os      — target OS (required)
+//	arch    — target arch (required)
+//	libc    — target libc
+//	version — version prefix
+//	channel — release channel
+//	lts     — if "true", only LTS
+//	format  — preferred formats (comma-separated, in preference order)
+//	variant — preferred variant
+func (s *server) handleV1Resolve(w http.ResponseWriter, r *http.Request) {
+	rest := r.PathValue("rest")
+
+	pkg, version, format, err := parseReleasePath(rest)
+	if err != nil {
+		http.Error(w, err.Error(), http.StatusBadRequest)
+		return
+	}
+
+	pc := s.getPackage(pkg)
+	if pc == nil {
+		http.Error(w, fmt.Sprintf("package %q not found", pkg), http.StatusNotFound)
+		return
+	}
+
+	q := r.URL.Query()
+	osStr := q.Get("os")
+	archStr := q.Get("arch")
+	libcStr := q.Get("libc")
+	channelStr := q.Get("channel")
+	ltsStr := q.Get("lts")
+	formatsStr := q.Get("format")
+	variantStr := q.Get("variant")
+
+	if version == "" {
+		version = q.Get("version")
+	}
+
+	// Handle channel selectors in version field.
+	switch strings.ToLower(version) {
+	case "stable", "latest":
+		version = ""
+		if channelStr == "" {
+			channelStr = "stable"
+		}
+	case "lts":
+		version = ""
+		ltsStr = "true"
+	case "beta", "pre", "preview":
+		version = ""
+		if channelStr == "" {
+			channelStr = "beta"
+		}
+	case "rc":
+		version = ""
+		if channelStr == "" {
+			channelStr = "rc"
+		}
+	case "alpha", "dev":
+		version = ""
+		if channelStr == "" {
+			channelStr = "alpha"
+		}
+	}
+
+	lts := ltsStr == "true" || ltsStr == "1"
+
+	var formats []string
+	if formatsStr != "" {
+		formats = strings.Split(formatsStr, ",")
+	}
+
+	req := resolver.Request{
+		OS:      osStr,
+		Arch:    archStr,
+		Libc:    libcStr,
+		Version: version,
+		Channel: channelStr,
+		LTS:     lts,
+		Formats: formats,
+		Variant: variantStr,
+	}
+
+	res, err := resolver.Resolve(pc.assets, req)
+	if err != nil {
+		http.Error(w, fmt.Sprintf("no match for %s: %v", pkg, err), http.StatusNotFound)
+		return
+	}
+
+	result := assetToV1Resolve(res)
+
+	switch format {
+	case "json":
+		w.Header().Set("Content-Type", "application/json")
+		enc := json.NewEncoder(w)
+		enc.SetIndent("", "  ")
+		enc.Encode(result)
+	case "tab":
+		w.Header().Set("Content-Type", "text/plain; charset=utf-8")
+		data, err := marshalTSV([]v1ResolveResult{result})
+		if err != nil {
+			http.Error(w, "encode error: "+err.Error(), http.StatusInternalServerError)
+			return
+		}
+		w.Write(data)
+	default:
+		http.Error(w, "unsupported format: "+format, http.StatusBadRequest)
+	}
+}
+
+func assetToV1Release(a storage.Asset) v1Release {
+	lts := "-"
+	if a.LTS {
+		lts = "lts"
+	}
+	channel := a.Channel
+	if channel == "" {
+		channel = "stable"
+	}
+	libc := a.Libc
+	if libc == "" {
+		libc = "-"
+	}
+	return v1Release{
+		Version:  a.Version,
+		Channel:  channel,
+		LTS:      lts,
+		Date:     a.Date,
+		OS:       a.OS,
+		Arch:     a.Arch,
+		Libc:     libc,
+		Format:   a.Format,
+		Variants: strings.Join(a.Variants, " "),
+		Download: a.Download,
+		Filename: a.Filename,
+	}
+}
+
+func assetToV1Resolve(res resolver.Result) v1ResolveResult {
+	a := res.Asset
+	lts := "-"
+	if a.LTS {
+		lts = "lts"
+	}
+	channel := a.Channel
+	if channel == "" {
+		channel = "stable"
+	}
+	libc := a.Libc
+	if libc == "" {
+		libc = "-"
+	}
+	return v1ResolveResult{
+		Version:  a.Version,
+		Channel:  channel,
+		LTS:      lts,
+		Date:     a.Date,
+		OS:       a.OS,
+		Arch:     a.Arch,
+		Libc:     libc,
+		Format:   a.Format,
+		Variants: strings.Join(a.Variants, " "),
+		Download: a.Download,
+		Filename: a.Filename,
+		Triplet:  res.Triplet,
+	}
+}
+
+func (s *server) v1ServeTSV(w http.ResponseWriter, assets []storage.Asset) {
+	w.Header().Set("Content-Type", "text/plain; charset=utf-8")
+
+	releases := make([]v1Release, len(assets))
+	for i, a := range assets {
+		releases[i] = assetToV1Release(a)
+	}
+
+	data, err := marshalTSV(releases)
+	if err != nil {
+		http.Error(w, "encode error: "+err.Error(), http.StatusInternalServerError)
+		return
+	}
+	w.Write(data)
+}
+
+func (s *server) v1ServeJSON(w http.ResponseWriter, assets []storage.Asset) {
+	w.Header().Set("Content-Type", "application/json")
+
+	releases := make([]v1Release, len(assets))
+	for i, a := range assets {
+		releases[i] = assetToV1Release(a)
+	}
+
+	enc := json.NewEncoder(w)
+	enc.SetIndent("", "  ")
+	enc.Encode(releases)
+}
+
+func (s *server) v1ServeEmpty(w http.ResponseWriter, format string) {
+	switch format {
+	case "json":
+		w.Header().Set("Content-Type", "application/json")
+		w.Write([]byte("[]\n"))
+	case "tab":
+		w.Header().Set("Content-Type", "text/plain; charset=utf-8")
+		// Just the header.
+		data, _ := marshalTSV([]v1Release{})
+		w.Write(data)
+	}
+}
+
+// filterAssets filters storage.Asset slices directly.
+func filterAssets(assets []storage.Asset, osStr, archStr, libcStr, channel, version, formatFilter, variant string, lts bool, limit int) []storage.Asset {
+	var result []storage.Asset
+
+	for _, a := range assets {
+		if osStr != "" && a.OS != osStr && a.OS != "ANYOS" && a.OS != "" {
+			continue
+		}
+		if archStr != "" && a.Arch != archStr && a.Arch != "ANYARCH" && a.Arch != "" {
+			continue
+		}
+		if libcStr != "" && a.Libc != "" && a.Libc != "none" && a.Libc != libcStr {
+			continue
+		}
+		if lts && !a.LTS {
+			continue
+		}
+		if channel != "" && a.Channel != channel {
+			continue
+		}
+		if version != "" {
+			v := strings.TrimPrefix(a.Version, "v")
+			vq := strings.TrimPrefix(version, "v")
+			if !strings.HasPrefix(v, vq) {
+				continue
+			}
+		}
+		if formatFilter != "" && !strings.Contains(a.Format, formatFilter) {
+			continue
+		}
+		if variant != "" {
+			if !hasVariant(a.Variants, variant) {
+				continue
+			}
+		}
+
+		result = append(result, a)
+		if len(result) >= limit {
+			break
+		}
+	}
+
+	return result
+}
+
+// sortAssetsDescending sorts assets newest-first by version.
+func sortAssetsDescending(assets []storage.Asset) {
+	slices.SortStableFunc(assets, func(a, b storage.Asset) int {
+		va := lexver.Parse(strings.TrimPrefix(a.Version, "v"))
+		vb := lexver.Parse(strings.TrimPrefix(b.Version, "v"))
+		return lexver.Compare(vb, va) // descending
+	})
+}
+
+// hasVariant checks if the variant list contains the wanted variant.
+// This is a copy of resolver.hasVariant since it's unexported.
+func hasVariant(variants []string, want string) bool {
+	for _, v := range variants {
+		if v == want {
+			return true
+		}
+	}
+	return false
+}
+
+// marshalTSV encodes a slice of structs as tab-separated values with a header.
+// Uses csvutil for struct-to-CSV mapping, with csv.Writer set to tab delimiter.
+func marshalTSV[T any](records []T) ([]byte, error) {
+	var buf bytes.Buffer
+	w := csv.NewWriter(&buf)
+	w.Comma = '\t'
+
+	enc := csvutil.NewEncoder(w)
+	for _, r := range records {
+		if err := enc.Encode(r); err != nil {
+			return nil, err
+		}
+	}
+	w.Flush()
+	if err := w.Error(); err != nil {
+		return nil, err
+	}
+	return buf.Bytes(), nil
+}
+
+// normalizeV1Arch maps query arch names to canonical Go names.
+func normalizeV1Arch(s string) string {
+	switch strings.ToLower(s) {
+	case "amd64":
+		return string(buildmeta.ArchAMD64) // "x86_64"
+	case "arm64":
+		return string(buildmeta.ArchARM64) // "aarch64"
+	default:
+		return s
+	}
+}

cmd/webid/v1api_test.go

@@ -0,0 +1,273 @@
+package main
+
+import (
+	"encoding/json"
+	"strings"
+	"testing"
+)
+
+// TestV1ReleasesTSV verifies the v1 releases endpoint returns proper TSV.
+func TestV1ReleasesTSV(t *testing.T) {
+	srv, ts := newTestServer(t)
+
+	packages := []string{"bat", "node", "go"}
+	for _, pkg := range packages {
+		t.Run(pkg, func(t *testing.T) {
+			if srv.getPackage(pkg) == nil {
+				t.Skipf("package %s not in cache", pkg)
+			}
+
+			code, body := get(t, ts, "/v1/releases/"+pkg+".tab?limit=5")
+			if code != 200 {
+				t.Fatalf("status %d: %s", code, body)
+			}
+
+			lines := strings.Split(strings.TrimSpace(body), "\n")
+			if len(lines) < 2 {
+				t.Fatal("expected header + data rows")
+			}
+
+			// First line should be header.
+			header := lines[0]
+			fields := strings.Split(header, "\t")
+			expectedHeaders := []string{
+				"version",
+				"channel",
+				"lts",
+				"date",
+				"os",
+				"arch",
+				"libc",
+				"format",
+				"variants",
+				"download",
+				"filename",
+			}
+			if len(fields) != len(expectedHeaders) {
+				t.Fatalf("expected %d columns, got %d: %q", len(expectedHeaders), len(fields), header)
+			}
+			for i, want := range expectedHeaders {
+				if fields[i] != want {
+					t.Errorf("column[%d]: want %q, got %q", i, want, fields[i])
+				}
+			}
+
+			// Data rows should have same number of fields.
+			for i, line := range lines[1:] {
+				dataFields := strings.Split(line, "\t")
+				if len(dataFields) != len(expectedHeaders) {
+					t.Errorf("row[%d]: expected %d fields, got %d: %q", i, len(expectedHeaders), len(dataFields), line)
+				}
+			}
+		})
+	}
+}
+
+// TestV1ReleasesJSON verifies the v1 releases JSON format.
+func TestV1ReleasesJSON(t *testing.T) {
+	srv, ts := newTestServer(t)
+
+	pkg := "bat"
+	if srv.getPackage(pkg) == nil {
+		t.Skipf("package %s not in cache", pkg)
+	}
+
+	code, body := get(t, ts, "/v1/releases/"+pkg+".json?limit=3")
+	if code != 200 {
+		t.Fatalf("status %d: %s", code, body)
+	}
+
+	var releases []v1Release
+	if err := json.Unmarshal([]byte(body), &releases); err != nil {
+		t.Fatalf("decode: %v", err)
+	}
+
+	if len(releases) == 0 {
+		t.Fatal("no releases")
+	}
+
+	// v1 API uses Go-native naming — no mapping.
+	for i, r := range releases {
+		if r.Version == "" {
+			t.Errorf("release[%d]: empty version", i)
+		}
+		if r.Download == "" {
+			t.Errorf("release[%d]: empty download", i)
+		}
+		if r.Channel == "" {
+			t.Errorf("release[%d]: empty channel (should be 'stable' or similar)", i)
+		}
+	}
+}
+
+// TestV1Resolve verifies the v1 resolve endpoint.
+func TestV1Resolve(t *testing.T) {
+	srv, ts := newTestServer(t)
+
+	pkg := "bat"
+	if srv.getPackage(pkg) == nil {
+		t.Skipf("package %s not in cache", pkg)
+	}
+
+	tests := []struct {
+		name   string
+		query  string
+		wantOS string
+	}{
+		{
+			name:   "linux amd64",
+			query:  "?os=linux&arch=x86_64",
+			wantOS: "linux",
+		},
+		{
+			name:   "darwin arm64",
+			query:  "?os=darwin&arch=aarch64",
+			wantOS: "darwin",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			code, body := get(t, ts, "/v1/resolve/"+pkg+".json"+tt.query)
+			if code != 200 {
+				t.Fatalf("status %d: %s", code, body)
+			}
+
+			var result v1ResolveResult
+			if err := json.Unmarshal([]byte(body), &result); err != nil {
+				t.Fatalf("decode: %v", err)
+			}
+
+			if result.Version == "" {
+				t.Error("empty version")
+			}
+			if result.Download == "" {
+				t.Error("empty download")
+			}
+			if result.OS != tt.wantOS {
+				t.Errorf("os: want %q, got %q", tt.wantOS, result.OS)
+			}
+			if result.Triplet == "" {
+				t.Error("empty triplet")
+			}
+
+			t.Logf("resolved: %s %s %s %s → %s", result.Version, result.OS, result.Arch, result.Format, result.Download)
+		})
+	}
+}
+
+// TestV1ResolveTSV verifies the TSV format for resolve.
+func TestV1ResolveTSV(t *testing.T) {
+	srv, ts := newTestServer(t)
+
+	pkg := "bat"
+	if srv.getPackage(pkg) == nil {
+		t.Skipf("package %s not in cache", pkg)
+	}
+
+	code, body := get(t, ts, "/v1/resolve/"+pkg+".tab?os=linux&arch=x86_64")
+	if code != 200 {
+		t.Fatalf("status %d: %s", code, body)
+	}
+
+	lines := strings.Split(strings.TrimSpace(body), "\n")
+	if len(lines) != 2 {
+		t.Fatalf("expected 2 lines (header + result), got %d", len(lines))
+	}
+
+	header := strings.Split(lines[0], "\t")
+	data := strings.Split(lines[1], "\t")
+
+	if len(header) != len(data) {
+		t.Fatalf("header has %d fields, data has %d", len(header), len(data))
+	}
+
+	// Should have a "triplet" column.
+	hasTriplet := false
+	for _, h := range header {
+		if h == "triplet" {
+			hasTriplet = true
+		}
+	}
+	if !hasTriplet {
+		t.Error("missing triplet column in header")
+	}
+}
+
+// TestV1ResolveJQ verifies jq resolves to binaries, not git.
+func TestV1ResolveJQ(t *testing.T) {
+	srv, ts := newTestServer(t)
+
+	pkg := "jq"
+	if srv.getPackage(pkg) == nil {
+		t.Skipf("package %s not in cache", pkg)
+	}
+
+	code, body := get(t, ts, "/v1/resolve/"+pkg+".json?os=darwin&arch=aarch64")
+	if code != 200 {
+		t.Fatalf("status %d: %s", code, body)
+	}
+
+	var result v1ResolveResult
+	if err := json.Unmarshal([]byte(body), &result); err != nil {
+		t.Fatalf("decode: %v", err)
+	}
+
+	if result.Format == "git" {
+		t.Errorf("resolved to git instead of binary: %+v", result)
+	}
+	if result.OS == "" {
+		t.Errorf("resolved to empty OS (git asset): %+v", result)
+	}
+
+	t.Logf("jq resolved: version=%s os=%s arch=%s format=%s → %s",
+		result.Version, result.OS, result.Arch, result.Format, result.Download)
+}
+
+// TestV1ReleasesFilterOS verifies OS filtering works.
+func TestV1ReleasesFilterOS(t *testing.T) {
+	srv, ts := newTestServer(t)
+
+	pkg := "bat"
+	if srv.getPackage(pkg) == nil {
+		t.Skipf("package %s not in cache", pkg)
+	}
+
+	code, body := get(t, ts, "/v1/releases/"+pkg+".json?os=darwin&limit=10")
+	if code != 200 {
+		t.Fatalf("status %d: %s", code, body)
+	}
+
+	var releases []v1Release
+	if err := json.Unmarshal([]byte(body), &releases); err != nil {
+		t.Fatalf("decode: %v", err)
+	}
+
+	for i, r := range releases {
+		if r.OS != "darwin" && r.OS != "ANYOS" && r.OS != "" {
+			t.Errorf("release[%d]: os=%q, expected darwin", i, r.OS)
+		}
+	}
+}
+
+// TestV1NoQuotedFields verifies TSV output has no quoted fields.
+func TestV1NoQuotedFields(t *testing.T) {
+	srv, ts := newTestServer(t)
+
+	pkg := "bat"
+	if srv.getPackage(pkg) == nil {
+		t.Skipf("package %s not in cache", pkg)
+	}
+
+	code, body := get(t, ts, "/v1/releases/"+pkg+".tab?limit=20")
+	if code != 200 {
+		t.Fatalf("status %d: %s", code, body)
+	}
+
+	lines := strings.Split(strings.TrimSpace(body), "\n")
+	for i, line := range lines {
+		if strings.Contains(line, "\"") {
+			t.Errorf("line[%d] contains quotes: %s", i, line)
+		}
+	}
+}

comrak/install.ps1

@@ -3,13 +3,13 @@
 $VERNAME = "$Env:PKG_NAME-v$Env:WEBI_VERSION.exe"
 $EXENAME = "$Env:PKG_NAME.exe"
 # Fetch archive
-IF (!(Test-Path -Path "$Env:USERPROFILE\Downloads\webi\$Env:WEBI_PKG_FILE")) {
+if (!(Test-Path -Path "$Env:USERPROFILE\Downloads\webi\$Env:WEBI_PKG_FILE")) {
     Write-Output "Downloading $Env:PKG_NAME from $Env:WEBI_PKG_URL to $Env:USERPROFILE\Downloads\webi\$Env:WEBI_PKG_FILE"
     & curl.exe -A "$Env:WEBI_UA" -fsSL "$Env:WEBI_PKG_URL" -o "$Env:USERPROFILE\Downloads\webi\$Env:WEBI_PKG_FILE.part"
     & Move-Item "$Env:USERPROFILE\Downloads\webi\$Env:WEBI_PKG_FILE.part" "$Env:USERPROFILE\Downloads\webi\$Env:WEBI_PKG_FILE"
 }
 
-IF (!(Test-Path -Path "$Env:USERPROFILE\.local\opt\$Env:PKG_NAME-v$Env:WEBI_VERSION\bin\$VERNAME")) {
+if (!(Test-Path -Path "$Env:USERPROFILE\.local\opt\$Env:PKG_NAME-v$Env:WEBI_VERSION\bin\$VERNAME")) {
     Write-Output "Installing $Env:PKG_NAME"
     # TODO: temp directory
 

comrak/releases.conf

@@ -0,0 +1 @@
+github_releases = kivikakk/comrak

comrak/releases.js

@@ -1,40 +0,0 @@
-'use strict';
-
-var github = require('../_common/github.js');
-var owner = 'kivikakk';
-var repo = 'comrak';
-
-var ODDITIES = ['-musleabihf.1-'];
-
-module.exports = function () {
-  return github(null, owner, repo).then(function (all) {
-    let builds = [];
-
-    loopBuilds: for (let build of all.releases) {
-      let isOddity;
-      for (let oddity of ODDITIES) {
-        isOddity = build.name.includes(oddity);
-        if (isOddity) {
-          break;
-        }
-      }
-      if (isOddity) {
-        continue;
-      }
-
-      builds.push(build);
-    }
-
-    all.releases = builds;
-    return all;
-  });
-};
-
-if (module === require.main) {
-  module.exports().then(function (all) {
-    all = require('../_webi/normalize.js')(all);
-    all.releases = all.releases.slice(0, 10);
-    //console.info(JSON.stringify(all));
-    console.info(JSON.stringify(all, null, 2));
-  });
-}

crabz/install.ps1

@@ -20,13 +20,13 @@ New-Item "$Env:USERPROFILE\Downloads\webi" -ItemType Directory -Force | Out-Null
 $pkg_download = "$Env:USERPROFILE\Downloads\webi\$Env:WEBI_PKG_FILE"
 
 # Fetch archive
-IF (!(Test-Path -Path "$pkg_download")) {
+if (!(Test-Path -Path "$pkg_download")) {
     Write-Output "Downloading crabz from $Env:WEBI_PKG_URL to $pkg_download"
     & curl.exe -A "$Env:WEBI_UA" -fsSL "$Env:WEBI_PKG_URL" -o "$pkg_download.part"
     & Move-Item "$pkg_download.part" "$pkg_download"
 }
 
-IF (!(Test-Path -Path "$pkg_src_cmd")) {
+if (!(Test-Path -Path "$pkg_src_cmd")) {
     Write-Output "Installing crabz"
 
     # TODO: create package-specific temp directory

crabz/releases.conf

@@ -0,0 +1 @@
+github_releases = sstadick/crabz

crabz/releases.js

@@ -1,31 +0,0 @@
-'use strict';
-
-var github = require('../_common/github.js');
-var owner = 'sstadick';
-var repo = 'crabz';
-
-module.exports = async function () {
-  let all = await github(null, owner, repo);
-
-  let releases = [];
-  for (let rel of all.releases) {
-    let isSrc = rel.download.includes('-src.');
-    if (isSrc) {
-      continue;
-    }
-
-    releases.push(rel);
-  }
-  all.releases = releases;
-
-  return all;
-};
-
-if (module === require.main) {
-  module.exports().then(function (all) {
-    all = require('../_webi/normalize.js')(all);
-    // just select the first 5 for demonstration
-    all.releases = all.releases.slice(0, 5);
-    console.info(JSON.stringify(all, null, 2));
-  });
-}

curlie/install.ps1

@@ -3,13 +3,13 @@
 $VERNAME = "$Env:PKG_NAME-v$Env:WEBI_VERSION.exe"
 $EXENAME = "$Env:PKG_NAME.exe"
 # Fetch archive
-IF (!(Test-Path -Path "$Env:USERPROFILE\Downloads\webi\$Env:WEBI_PKG_FILE")) {
+if (!(Test-Path -Path "$Env:USERPROFILE\Downloads\webi\$Env:WEBI_PKG_FILE")) {
     Write-Output "Downloading $Env:PKG_NAME from $Env:WEBI_PKG_URL to $Env:USERPROFILE\Downloads\webi\$Env:WEBI_PKG_FILE"
     & curl.exe -A "$Env:WEBI_UA" -fsSL "$Env:WEBI_PKG_URL" -o "$Env:USERPROFILE\Downloads\webi\$Env:WEBI_PKG_FILE.part"
     & Move-Item "$Env:USERPROFILE\Downloads\webi\$Env:WEBI_PKG_FILE.part" "$Env:USERPROFILE\Downloads\webi\$Env:WEBI_PKG_FILE"
 }
 
-IF (!(Test-Path -Path "$Env:USERPROFILE\.local\bin\$VERNAME")) {
+if (!(Test-Path -Path "$Env:USERPROFILE\.local\bin\$VERNAME")) {
     Write-Output "Installing $Env:PKG_NAME"
     # TODO: temp directory
 

curlie/releases.conf

@@ -0,0 +1 @@
+github_releases = rs/curlie

curlie/releases.js

@@ -1,21 +0,0 @@
-'use strict';
-
-var github = require('../_common/github.js');
-var owner = 'rs';
-var repo = 'curlie';
-
-module.exports = function () {
-  return github(null, owner, repo).then(function (all) {
-    all._names = ['curlie', 'curl-httpie'];
-    return all;
-  });
-};
-
-if (module === require.main) {
-  module.exports().then(function (all) {
-    all = require('../_webi/normalize.js')(all);
-    all.releases = all.releases.slice(0, 10);
-    //console.info(JSON.stringify(all));
-    console.info(JSON.stringify(all, null, 2));
-  });
-}

dashcore/README.md

@@ -147,8 +147,8 @@ dash-qt \
 CoinJoin aids in preventing some bad actors and malicious observers being able
 to easily reconstruct details about your transactions from the publicly
 available data by creating many excess transactions. \
-(be aware, however, that dedicated bad actors can use sophisticated software that
-will reveal much of the same information over time)
+(be aware, however, that dedicated bad actors can use sophisticated software
+that will reveal much of the same information over time)
 
 `dash-qt` does not enable CoinJoin mixing by default.
 

dashcore/install.ps1

@@ -20,13 +20,13 @@ New-Item "$Env:USERPROFILE\Downloads\webi" -ItemType Directory -Force | Out-Null
 $pkg_download = "$Env:USERPROFILE\Downloads\webi\$Env:WEBI_PKG_FILE"
 
 # Fetch archive
-IF (!(Test-Path -Path "$Env:USERPROFILE\Downloads\webi\$Env:WEBI_PKG_FILE")) {
+if (!(Test-Path -Path "$Env:USERPROFILE\Downloads\webi\$Env:WEBI_PKG_FILE")) {
     Write-Output "Downloading dashcore from $Env:WEBI_PKG_URL to $pkg_download"
     & curl.exe -A "$Env:WEBI_UA" -fsSL "$Env:WEBI_PKG_URL" -o "$pkg_download.part"
     & Move-Item "$pkg_download.part" "$pkg_download"
 }
 
-IF (!(Test-Path -Path "$pkg_src_dir")) {
+if (!(Test-Path -Path "$pkg_src_dir")) {
     Write-Output "Installing dashcore"
 
     # TODO: create package-specific temp directory

dashcore/releases.conf

@@ -0,0 +1 @@
+github_releases = dashpay/dash

dashcore/releases.js

@@ -1,31 +0,0 @@
-'use strict';
-
-var github = require('../_common/github.js');
-var owner = 'dashpay';
-var repo = 'dash';
-
-module.exports = function () {
-  return github(null, owner, repo).then(function (all) {
-    all.releases.forEach(function (rel) {
-      if (rel.name.includes('osx64')) {
-        rel.os = 'macos';
-      }
-
-      if (rel.version.startsWith('v')) {
-        rel._version = rel.version.slice(1);
-      }
-    });
-
-    all._names = ['dashd', 'dashcore'];
-    return all;
-  });
-};
-
-if (module === require.main) {
-  module.exports().then(function (all) {
-    all = require('../_webi/normalize.js')(all);
-    // just select the first 5 for demonstration
-    all.releases = all.releases.slice(0, 5);
-    console.info(JSON.stringify(all, null, 2));
-  });
-}

dashd/install.ps1

@@ -20,13 +20,13 @@ New-Item "$Env:USERPROFILE\Downloads\webi" -ItemType Directory -Force | Out-Null
 $pkg_download = "$Env:USERPROFILE\Downloads\webi\$Env:WEBI_PKG_FILE"
 
 # Fetch archive
-IF (!(Test-Path -Path "$Env:USERPROFILE\Downloads\webi\$Env:WEBI_PKG_FILE")) {
+if (!(Test-Path -Path "$Env:USERPROFILE\Downloads\webi\$Env:WEBI_PKG_FILE")) {
     Write-Output "Downloading dashd from $Env:WEBI_PKG_URL to $pkg_download"
     & curl.exe -A "$Env:WEBI_UA" -fsSL "$Env:WEBI_PKG_URL" -o "$pkg_download.part"
     & Move-Item "$pkg_download.part" "$pkg_download"
 }
 
-IF (!(Test-Path -Path "$pkg_src_dir")) {
+if (!(Test-Path -Path "$pkg_src_dir")) {
     Write-Output "Installing dashd"
 
     # TODO: create package-specific temp directory

dashd/releases.conf

@@ -0,0 +1 @@
+alias_of = dashcore

dashd/releases.js

@@ -1,3 +0,0 @@
-'use strict';
-
-module.exports = require('../dashcore/releases.js');

dashmsg/install.ps1

@@ -19,13 +19,13 @@ New-Item "$Env:USERPROFILE\Downloads\webi" -ItemType Directory -Force | Out-Null
 $pkg_download = "$Env:USERPROFILE\Downloads\webi\$Env:WEBI_PKG_FILE"
 
 # Fetch archive
-IF (!(Test-Path -Path "$Env:USERPROFILE\Downloads\webi\$Env:WEBI_PKG_FILE")) {
+if (!(Test-Path -Path "$Env:USERPROFILE\Downloads\webi\$Env:WEBI_PKG_FILE")) {
     Write-Output "Downloading dashmsg from $Env:WEBI_PKG_URL to $pkg_download"
     & curl.exe -A "$Env:WEBI_UA" -fsSL "$Env:WEBI_PKG_URL" -o "$pkg_download.part"
     & Move-Item "$pkg_download.part" "$pkg_download"
 }
 
-IF (!(Test-Path -Path "$pkg_src_cmd")) {
+if (!(Test-Path -Path "$pkg_src_cmd")) {
     Write-Output "Installing dashmsg"
 
     # TODO: create package-specific temp directory

dashmsg/releases.conf

@@ -0,0 +1 @@
+github_releases = dashhive/dashmsg

dashmsg/releases.js

@@ -1,18 +0,0 @@
-'use strict';
-
-var github = require('../_common/github.js');
-var owner = 'dashhive';
-var repo = 'dashmsg';
-
-module.exports = function () {
-  return github(null, owner, repo).then(function (all) {
-    return all;
-  });
-};
-
-if (module === require.main) {
-  module.exports().then(function (all) {
-    all = require('../_webi/normalize.js')(all);
-    console.info(JSON.stringify(all, null, 2));
-  });
-}

delta/install.ps1

@@ -19,13 +19,13 @@ New-Item "$Env:USERPROFILE\Downloads\webi" -ItemType Directory -Force | Out-Null
 $pkg_download = "$Env:USERPROFILE\Downloads\webi\$Env:WEBI_PKG_FILE"
 
 # Fetch archive
-IF (!(Test-Path -Path "$Env:USERPROFILE\Downloads\webi\$Env:WEBI_PKG_FILE")) {
+if (!(Test-Path -Path "$Env:USERPROFILE\Downloads\webi\$Env:WEBI_PKG_FILE")) {
     Write-Output "Downloading delta from $Env:WEBI_PKG_URL to $pkg_download"
     & curl.exe -A "$Env:WEBI_UA" -fsSL "$Env:WEBI_PKG_URL" -o "$pkg_download.part"
     & Move-Item "$pkg_download.part" "$pkg_download"
 }
 
-IF (!(Test-Path -Path "$pkg_src_cmd")) {
+if (!(Test-Path -Path "$pkg_src_cmd")) {
     Write-Output "Installing delta"
 
     # TODO: create package-specific temp directory

delta/releases.conf

@@ -0,0 +1 @@
+github_releases = dandavison/delta

delta/releases.js

@@ -1,20 +0,0 @@
-'use strict';
-
-var github = require('../_common/github.js');
-var owner = 'dandavison';
-var repo = 'delta';
-
-module.exports = function () {
-  return github(null, owner, repo).then(function (all) {
-    return all;
-  });
-};
-
-if (module === require.main) {
-  module.exports().then(function (all) {
-    all = require('../_webi/normalize.js')(all);
-    // just select the first 15 for demonstration
-    all.releases = all.releases.slice(0, 15);
-    console.info(JSON.stringify(all, null, 2));
-  });
-}

deno/install.ps1

@@ -1,14 +1,14 @@
 #!/usr/bin/env pwsh
 
 # Fetch archive
-IF (!(Test-Path -Path "$Env:USERPROFILE\Downloads\webi\$Env:WEBI_PKG_FILE")) {
+if (!(Test-Path -Path "$Env:USERPROFILE\Downloads\webi\$Env:WEBI_PKG_FILE")) {
     Write-Output "Downloading $Env:PKG_NAME from $Env:WEBI_PKG_URL to $Env:USERPROFILE\Downloads\webi\$Env:WEBI_PKG_FILE"
     #Invoke-WebRequest https://nodejs.org/dist/v12.16.2/node-v12.16.2-win-x64.zip -OutFile node-v12.16.2-win-x64.zip
     & curl.exe -A "$Env:WEBI_UA" -fsSL "$Env:WEBI_PKG_URL" -o "$Env:USERPROFILE\Downloads\webi\$Env:WEBI_PKG_FILE.part"
     & Move-Item "$Env:USERPROFILE\Downloads\webi\$Env:WEBI_PKG_FILE.part" "$Env:USERPROFILE\Downloads\webi\$Env:WEBI_PKG_FILE"
 }
 
-IF (!(Test-Path -Path "$Env:USERPROFILE\.local\opt\$Env:PKG_NAME-v$Env:WEBI_VERSION")) {
+if (!(Test-Path -Path "$Env:USERPROFILE\.local\opt\$Env:PKG_NAME-v$Env:WEBI_VERSION")) {
     Write-Output "Installing $Env:PKG_NAME"
     # TODO: temp directory
 

deno/releases.conf

@@ -0,0 +1 @@
+github_releases = denoland/deno

deno/releases.js

@@ -1,42 +0,0 @@
-'use strict';
-
-var path = require('path');
-
-var github = require('../_common/github.js');
-var owner = 'denoland';
-var repo = 'deno';
-
-module.exports = function () {
-  return github(null, owner, repo).then(function (all) {
-    // remove checksums and .deb
-    all.releases = all.releases
-      .filter(function (rel) {
-        let isMeta = rel.name.endsWith('.d.ts');
-        if (isMeta) {
-          return false;
-        }
-
-        return true;
-      })
-      .map(function (rel) {
-        var ext;
-        if (!rel.name.match(rel.version)) {
-          ext = path.extname(rel.name);
-          rel.filename =
-            rel.name.slice(0, rel.name.length - ext.length) +
-            '-' +
-            rel.version +
-            ext;
-        }
-        return rel;
-      });
-    return all;
-  });
-};
-
-if (module === require.main) {
-  module.exports().then(function (all) {
-    all = require('../_webi/normalize.js')(all);
-    console.info(JSON.stringify(all, null, 2));
-  });
-}

docs/installer-patterns.md

@@ -0,0 +1,121 @@
+# Installer Archive Patterns
+
+Every package falls into one of these archive structure patterns. When writing
+or modifying an `install.sh`, identify the pattern first — it determines the
+extraction and installation strategy.
+
+## Pattern A: Bare Binary in Archive
+
+Archive contains the binary (and maybe LICENSE/README) at the top level.
+
+Examples: awless, caddy, cilium, curlie, dashmsg, deno, dotenv, dotenv-linter,
+ffuf, fzf, gitdeploy, gprox, grype, hugo, hugo-extended, k9s, keypairs, koji,
+lf, monorel, ots, runzip, sclient, sqlc, sqlpkg, sttr, terraform, uuidv7, xcaddy
+
+Install: extract, move binary to `~/.local/opt/{pkg}-{ver}/bin/{binary}`, symlink.
+
+## Pattern B: Subdirectory with Binary Only
+
+Archive contains a version-named directory wrapping the binary and docs.
+
+Examples: delta, hexyl, kubectx, kubens, shellcheck, trip, xsv
+
+Typical directory naming: `{tool}-{ver}-{triplet}/`
+
+Install: extract, find binary in subdirectory, move to opt, symlink.
+
+Special cases:
+- `pathman`: bare binary named with full release tag (needs rename)
+- `yq`: binary named with platform suffix `yq_linux_amd64` (needs rename)
+
+## Pattern C: Binary + Completions + Man Pages
+
+Archive includes shell completions and/or man pages alongside the binary.
+
+| Package | Completions Dir | Man Page |
+|---------|----------------|----------|
+| bat | `autocomplete/` | `bat.1` |
+| fd | `autocomplete/{fd.bash,.fish,_fd}` | `fd.1` |
+| goreleaser | `completions/{.bash,.fish,.zsh}` | `manpages/*.1.gz` |
+| lsd | `autocomplete/{lsd.bash-completion,.fish,_lsd}` | `lsd.1` |
+| rg | `complete/{rg.bash,.fish,_rg}` | `doc/rg.1` |
+| sd | `completions/{sd.bash,.fish,_sd}` | `sd.1` |
+| watchexec | `completions/{bash,fish,zsh}` | `watchexec.1` |
+| zoxide | `completions/{zoxide.bash,.fish,_zoxide}` | `man/man1/zoxide*.1` |
+
+Install: extract, install binary, install completions to standard dirs, install
+man pages. Completion naming varies: `autocomplete/`, `completions/`, `complete/`.
+
+## Pattern D: Binary + Libraries
+
+Complex packages that bundle shared libraries.
+
+| Package | Layout |
+|---------|--------|
+| ollama (Linux) | `bin/ollama` + `lib/ollama/{cuda_v12,cuda_v13,vulkan}/` |
+| pg/postgres/psql | `bin/psql` + `lib/{libpq,libz,...}.so` + `include/` |
+| sass | `dart-sass/sass` (wrapper) + `dart-sass/src/{dart,sass.snapshot}` |
+| syncthing | `syncthing-{triplet}-{ver}/syncthing` + `etc/{systemd,...}/` |
+| xz | `xz-{ver}-{triplet}/xz` + `xz-{ver}-{triplet}/unxz` |
+
+Install: extract entire directory tree into opt, symlink binary.
+
+## Pattern E: FHS-like Layout (bin/ + share/)
+
+Archive already follows standard layout.
+
+| Package | Layout |
+|---------|--------|
+| gh | `gh_{ver}_{os}_{arch}/bin/gh` + `share/man/man1/*.1` |
+| pandoc | `pandoc-{ver}/bin/{pandoc,...}` + `share/man/man1/*.1.gz` |
+
+Install: extract directly into opt (already correct layout).
+
+## Pattern G: Full SDK/Toolchain
+
+Self-contained toolchain with compiler, runtime, standard library.
+
+| Package | Layout |
+|---------|--------|
+| cmake | `cmake-{ver}-{os}-{arch}/bin/{cmake,ctest,...}` + `share/` + `man/` |
+| tinygo | `tinygo/bin/tinygo` + `tinygo/src/` + `tinygo/targets/` |
+| go | `go/bin/{go,gofmt}` + `go/src/` + `go/pkg/` |
+| zig | `zig-{os}-{arch}-{ver}/zig` + `lib/` |
+| flutter | `flutter/bin/flutter` + full SDK |
+| julia | `julia-{ver}/bin/julia` + full SDK |
+| node | `node-{ver}-{os}-{arch}/bin/{node,npm,npx}` + `lib/` |
+
+Install: extract entire tree into `~/.local/opt/{pkg}-{ver}/`, symlink `bin/*`.
+
+## Pattern H: .NET Runtime Bundle
+
+Flat archive with hundreds of DLLs.
+
+Example: pwsh — `pwsh` binary + `*.dll` + locale dirs
+
+Install: extract entire directory into opt, symlink primary binary.
+
+## Pattern I: Multi-Binary Distribution
+
+Archive contains multiple related binaries + libs.
+
+| Package | Layout |
+|---------|--------|
+| dashcore | `dashcore-{ver}/bin/{dashd,dash-cli,...}` + `lib/` + `share/man/` |
+| mutagen | `mutagen` + `mutagen-agents.tar.gz` (embedded agent archive) |
+
+Install: extract into opt, symlink primary binary.
+
+## Format Changes Over Time
+
+Most packages have stable formats. Notable structural changes:
+
+| Package | When | Change |
+|---------|------|--------|
+| sd | 2023 | zip → tar.gz, added completions + man page |
+| ollama | 2025-2026 | bare binary → no GitHub release → tar.zst with lib/ |
+| deno | 2020-2021 | .gz (gzipped binary) → .zip |
+| hugo | 2017-2018 | zip → tar.gz; 2024: macOS → .pkg only |
+| gh | 2024 | darwin: tar.gz → .pkg |
+| sclient | 2023 | tar.gz → tar.xz |
+| watchexec | 2019-2020 | tar.gz → tar.xz |

docs/version-oddities.md

@@ -0,0 +1,74 @@
+# Version & Release Oddities
+
+Non-standard version formats and tag prefixes that affect parsing, sorting,
+and classification. The Go classifier and `internal/lexver` must handle all
+of these.
+
+## Non-Numeric Tag Prefixes
+
+| Package | Raw Tag | Cleaned | Transform |
+|---------|---------|---------|-----------|
+| lf | `r21` | `0.21.0` | `r` prefix → prepend `0.` |
+| bun | `bun-v1.0.0` | `1.0.0` | Strip `bun-` prefix |
+| jq | `jq-1.7` | `1.7` | Strip `jq-` prefix |
+| watchexec | `cli-v1.2.3` | `1.2.3` | Strip `cli-` prefix |
+| ffmpeg | `b6.0` | `6.0` | Strip `b` prefix |
+
+## Underscore-Delimited Tags
+
+| Package | Raw Tag | Cleaned | Transform |
+|---------|---------|---------|-----------|
+| postgres | `REL_17_0` | `17.0` | Strip `REL_`, replace `_` with `.` |
+| psql | `REL_17_0` | `17.0` | Same as postgres |
+
+## Platform Suffix in Version
+
+| Package | Raw Tag | Cleaned | Transform |
+|---------|---------|---------|-----------|
+| git (Windows) | `2.41.0.windows.1` | `2.41.0` | Strip `.windows.N` suffix |
+
+## 4-Part Versions
+
+| Package | Example | Notes |
+|---------|---------|-------|
+| chromedriver | `121.0.6120.0` | Google Chrome's versioning |
+| gpg | `2.2.19.0` | 4th segment is build metadata |
+
+## Date-Based Versions
+
+| Package | Notes |
+|---------|-------|
+| atomicparsley | Date-based version strings |
+
+## Complex Pre-Release Formats
+
+| Package | Example | Notes |
+|---------|---------|-------|
+| flutter | `2.3.0-16.0.pre` | Extra dots and numeric segments |
+| iterm2 | `iTerm2_3_5_0beta17` | Underscores, beta attached → `3.5.0-beta17` |
+
+## Channel Detection
+
+- Node.js: odd major = "current" not LTS (v15, v17, v19, v21, v23)
+- Go: `go` prefix stripped (`go1.23.6` → `1.23.6`)
+- Terraform: `-alpha`, `-beta`, `-rc` suffixes → beta channel
+
+## Directory Symlinks (Aliases)
+
+These are directory-level symlinks. They share all files (including
+releases.conf) with their target automatically.
+
+```
+msvc-runtime    → vcruntime
+msvcruntime     → vcruntime
+rust.vim        → vim-rust
+vc-redist       → vcruntime
+vc-runtime      → vcruntime
+vc_redist       → vcruntime
+vcredist        → vcruntime
+vcruntime140    → vcruntime
+vim-essential   → vim-essentials
+vim-mouse       → vim-gui
+vps-myip        → myip
+xcode-cli       → commandlinetools
+```

dotenv-linter/install.ps1

@@ -20,18 +20,18 @@ $pkg_download = "$Env:USERPROFILE\Downloads\webi\$Env:WEBI_PKG_FILE"
 
 # Fetch MSVC Runtime
 Write-Output "Checking for MSVC Runtime..."
-IF (-not (Test-Path "\Windows\System32\vcruntime140.dll")) {
+if (-not (Test-Path "\Windows\System32\vcruntime140.dll")) {
     & "$Env:USERPROFILE\.local\bin\webi-pwsh.ps1" vcruntime
 }
 
 # Fetch archive
-IF (!(Test-Path -Path "$pkg_download")) {
+if (!(Test-Path -Path "$pkg_download")) {
     Write-Output "Downloading dotenv-linter from $Env:WEBI_PKG_URL to $pkg_download"
     & curl.exe -A "$Env:WEBI_UA" -fsSL "$Env:WEBI_PKG_URL" -o "$pkg_download.part"
     & Move-Item "$pkg_download.part" "$pkg_download"
 }
 
-IF (!(Test-Path -Path "$pkg_src_cmd")) {
+if (!(Test-Path -Path "$pkg_src_cmd")) {
     Write-Output "Installing dotenv-linter"
 
     # TODO: create package-specific temp directory

dotenv-linter/releases.conf

@@ -0,0 +1 @@
+github_releases = dotenv-linter/dotenv-linter

dotenv-linter/releases.js

@@ -1,20 +0,0 @@
-'use strict';
-
-var github = require('../_common/github.js');
-var owner = 'dotenv-linter';
-var repo = 'dotenv-linter';
-
-module.exports = function () {
-  return github(null, owner, repo).then(function (all) {
-    return all;
-  });
-};
-
-if (module === require.main) {
-  module.exports().then(function (all) {
-    all = require('../_webi/normalize.js')(all);
-    // just select the first 5 for demonstration
-    all.releases = all.releases.slice(0, 5);
-    console.info(JSON.stringify(all, null, 2));
-  });
-}

dotenv/install.ps1

@@ -19,13 +19,13 @@ New-Item "$Env:USERPROFILE\Downloads\webi" -ItemType Directory -Force | Out-Null
 $pkg_download = "$Env:USERPROFILE\Downloads\webi\$Env:WEBI_PKG_FILE"
 
 # Fetch archive
-IF (!(Test-Path -Path "$Env:USERPROFILE\Downloads\webi\$Env:WEBI_PKG_FILE")) {
+if (!(Test-Path -Path "$Env:USERPROFILE\Downloads\webi\$Env:WEBI_PKG_FILE")) {
     Write-Output "Downloading dotenv from $Env:WEBI_PKG_URL to $pkg_download"
     & curl.exe -A "$Env:WEBI_UA" -fsSL "$Env:WEBI_PKG_URL" -o "$pkg_download.part"
     & Move-Item "$pkg_download.part" "$pkg_download"
 }
 
-IF (!(Test-Path -Path "$pkg_src_cmd")) {
+if (!(Test-Path -Path "$pkg_src_cmd")) {
     Write-Output "Installing dotenv"
 
     # TODO: create package-specific temp directory

dotenv/releases.conf

@@ -0,0 +1 @@
+github_releases = therootcompany/dotenv