diff --git a/.github/dependabot.yml b/.github/dependabot.yml
deleted file mode 100644
index 3deee26f..00000000
--- a/.github/dependabot.yml
+++ /dev/null
@@ -1,10 +0,0 @@
-version: 2
-updates:
-  - package-ecosystem: "github-actions"
-    directory: "/"
-    schedule:
-      interval: "weekly"
-  - package-ecosystem: "npm"
-    directory: "/"
-    schedule:
-      interval: "weekly"
diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md
deleted file mode 100644
index a5dc7ed3..00000000
--- a/.github/pull_request_template.md
+++ /dev/null
@@ -1,30 +0,0 @@
-## Summary
-
-- What changed:
-- Why:
-
-## AI Intent
-
-- Prompt or task statement:
-- Scope of AI-assisted changes:
-
-## Risk Assessment
-
-- Risk level: low / medium / high
-- Primary risks:
-- Compatibility impact:
-
-## Rollback Plan
-
-- Revert path:
-- Forward-fix path (if revert is not possible):
-
-## Validation
-
-- Local checks run:
-- CI checks expected:
-
-## Internal/Public Boundary Check
-
-- [ ] No internal-only data, private URLs, secrets, or private runbooks were
-      added.
diff --git a/.github/workflows/agent-boundary-check.yml b/.github/workflows/agent-boundary-check.yml
deleted file mode 100644
index 9eb5c523..00000000
--- a/.github/workflows/agent-boundary-check.yml
+++ /dev/null
@@ -1,50 +0,0 @@
-name: "agent-boundary-check"
-
-on:
-  pull_request:
-
-permissions:
-  contents: read
-
-jobs:
-  boundary-check:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v7
-        with:
-          fetch-depth: 0
-
-      - name: "Validate changed files for internal-only markers"
-        shell: bash
-        run: |
-          set -euo pipefail
-
-          BASE_SHA="${{ github.event.pull_request.base.sha }}"
-          HEAD_SHA="${{ github.event.pull_request.head.sha }}"
-
-          mapfile -t CHANGED < <(git diff --name-only "$BASE_SHA" "$HEAD_SHA")
-          if [ "${#CHANGED[@]}" -eq 0 ]; then
-            echo "No changed files detected"
-            exit 0
-          fi
-
-          FORBIDDEN='(INTERNAL[- ]ONLY|internal[- ]only|control plane|private runbook|do not share|confidential|confluence|notion|vpn|internal\\.)'
-          STATUS=0
-
-          for f in "${CHANGED[@]}"; do
-            [ -f "$f" ] || continue
-            # Don't scan CI/workflow files
-            [[ "$f" == .github/* ]] && continue
-            [[ "$f" == AGENTS.md ]] && continue
-            case "$f" in
-              *.md|*.txt|*.yml|*.yaml|*.json|*.toml|*.ts|*.tsx|*.js|*.jsx|*.sh|*.py|*.rb|*.tf|*.hcl)
-                if grep -Einq "$FORBIDDEN" "$f"; then
-                  echo "::error file=$f::Potential internal-only marker detected in $f"
-                  grep -Ein "$FORBIDDEN" "$f" || true
-                  STATUS=1
-                fi
-                ;;
-            esac
-          done
-
-          exit "$STATUS"
diff --git a/.github/workflows/cd.deployment.yml b/.github/workflows/cd.deployment.yml
deleted file mode 100644
index 78b51bd2..00000000
--- a/.github/workflows/cd.deployment.yml
+++ /dev/null
@@ -1,13 +0,0 @@
-on:
-  push:
-    tags:
-      - latest
-  workflow_dispatch:
-
-jobs:
-  test-deployment:
-    runs-on: ubuntu-latest
-    steps:
-      - run: '! pkgx --version'
-      - uses: pkgxdev/setup@latest
-      - run: pkgx --version
diff --git a/.github/workflows/cd.installer.yml b/.github/workflows/cd.installer.yml
deleted file mode 100644
index 78ac2c0c..00000000
--- a/.github/workflows/cd.installer.yml
+++ /dev/null
@@ -1,59 +0,0 @@
-on:
-  push:
-    branches: main
-    paths:
-      - installer.sh
-      - installer.ps1
-      - .github/workflows/cd.installer.yml
-
-jobs:
-  qa:
-    uses: ./.github/workflows/ci.installer.yml
-
-  put:
-    permissions:
-      deployments: write
-    needs: qa
-    runs-on: ubuntu-latest
-    steps:
-      - name: Create Deployment
-        uses: bobheadxi/deployments@v1
-        id: deployment
-        with:
-          step: start
-          env: installer
-
-      - uses: actions/checkout@v7
-
-      - uses: aws-actions/configure-aws-credentials@v6
-        with:
-          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
-          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
-          aws-region: us-east-1
-
-      - run:
-          aws s3 cp
-            ./installer.sh
-            s3://www.pkgx.sh/installer.sh
-            --metadata-directive REPLACE
-            --cache-control no-cache,must-revalidate
-      - run:
-          aws s3 cp
-            ./installer.ps1
-            s3://www.pkgx.sh/installer.ps1
-            --metadata-directive REPLACE
-            --cache-control no-cache,must-revalidate
-
-      - run:
-          aws cloudfront create-invalidation
-            --distribution-id ${{ secrets.AWS_CF_DISTRIBUTION_ID }}
-            --paths / /installer.sh /installer.ps1
-
-      - name: Seal Deployment
-        uses: bobheadxi/deployments@v1
-        if: always()
-        with:
-          env: installer
-          step: finish
-          status: ${{ job.status }}
-          deployment_id: ${{ steps.deployment.outputs.deployment_id }}
diff --git a/.github/workflows/cd.qa.yml b/.github/workflows/cd.qa.yml
deleted file mode 100644
index 255c90cd..00000000
--- a/.github/workflows/cd.qa.yml
+++ /dev/null
@@ -1,11 +0,0 @@
-on:
-  workflow_dispatch:
-    inputs:
-      version:
-        required: true
-
-jobs:
-  qa-installer:
-    uses: ./.github/workflows/ci.installer.yml
-  qa-action:
-    uses: ./.github/workflows/ci.action.yml
diff --git a/.github/workflows/cd.vx.yml b/.github/workflows/cd.vx.yml
deleted file mode 100644
index 6ae5f665..00000000
--- a/.github/workflows/cd.vx.yml
+++ /dev/null
@@ -1,33 +0,0 @@
-name: cd·vx
-
-on:
-  release:
-    types:
-      - published
-
-concurrency:
-  group: cd/vx/${{ github.event.release.tag_name }}
-  cancel-in-progress: true
-
-permissions:
-  contents: write
-
-jobs:
-  vtagger:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v7
-      - uses: fischerscode/tagger@v0
-        with:
-          prefix: v
-      - run: |
-          latest_release=$(curl -s \
-            -H "Authorization: Bearer ${{ secrets.GITHUB_TOKEN }}" \
-            -H "Accept: application/vnd.github+json" \
-            https://api.github.com/repos/${{ github.repository }}/releases/latest \
-            | jq -r '.tag_name')
-
-          if [ "${latest_release}" = "${{ github.event.release.tag_name }}" ]; then
-            git tag -f latest
-            git push origin latest --force
-          fi
diff --git a/.github/workflows/ci.action.yml b/.github/workflows/ci.action.yml
deleted file mode 100644
index 98c62e20..00000000
--- a/.github/workflows/ci.action.yml
+++ /dev/null
@@ -1,133 +0,0 @@
-on:
-  push:
-    branches:
-      - main
-    paths:
-      - action.js
-  workflow_call:
-  pull_request:
-    paths:
-      - action.js
-      - action.yml
-      - package.json
-      - installer.sh
-      - .github/workflows/ci.action.yml
-
-concurrency:
-  group: ${{ github.ref || 'ci' }}/action.ts
-  cancel-in-progress: true
-
-jobs:
-  std:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v7
-      - run: npm i
-      - uses: ./
-        with:
-          version: null
-      - run: pkgx --version
-
-  plus-pkgs:
-    runs-on: ${{ matrix.os }}
-    strategy:
-      fail-fast: false
-      matrix:
-        os:
-          - macos-latest
-          - ubuntu-latest
-        prefix:
-          - null
-          - /tmp/pkgx
-        include:
-          - os: ubuntu-latest
-            container: debian:buster-slim
-          - os: windows-latest
-    container: ${{ matrix.container }}
-    steps:
-      - uses: actions/checkout@v7
-
-      - name: install libatomic (required by Node 25+ on older distros)
-        if: ${{ matrix.container == 'debian:buster-slim' }}
-        run: |
-          # Debian buster is EOL, so we need to change mirrors
-          sed -i 's/deb\.debian/archive\.debian/g' /etc/apt/sources.list
-          apt-get update -qq
-          apt-get install -y libatomic1
-
-      - uses: actions/setup-node@v6
-        with:
-          node-version: latest
-      - run: npm i
-
-      - uses: ./
-        with:
-          PKGX_DIR: ${{ matrix.prefix }}
-          +: node@18 curl.se
-        if: ${{ runner.os != 'Windows' }}
-
-      - uses: ./
-        with:
-          PKGX_DIR: ${{ matrix.prefix }}
-          +: cmake.org^3 curl.se
-        if: ${{ runner.os == 'Windows' }}
-
-      - run: test -f '${{ matrix.prefix }}/curl.se/v*/bin/curl'
-        if: ${{ matrix.prefix }}
-
-      - run: pkgx --version
-      - run: if [[ "$(node --version)" != v18.* ]]; then exit 1; fi
-        if: ${{ runner.os != 'Windows' }}
-      - run: curl --version
-
-  multiple-apply-is-ok:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v7
-      - run: npm i
-      - uses: ./
-      - run: pkgx --version
-      - uses: ./
-      - run: pkgx --version
-
-  dist:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v7
-      - run: npm i
-      - uses: ./
-      - run: npm run dist
-      - run: rm /usr/local/bin/pkgx
-      - run: "! pkgx --version"
-      - run: git clean -xfd
-      - uses: ./
-      - run: pkgx --version
-      - uses: actions/upload-artifact@v7
-        with:
-          path: |
-            ./action.js
-            ./action.yml
-          name: action
-
-  linuxen:
-    needs: dist
-    continue-on-error: true
-    runs-on: ubuntu-latest
-    strategy:
-      matrix:
-        container:
-          - debian:buster-slim
-          - debian:bullseye-slim
-          - debian:bookworm-slim
-          - archlinux:latest
-          - ubuntu:focal
-          - ubuntu:jammy
-          - ubuntu:noble
-          - fedora:latest
-    container: ${{ matrix.container }}
-    steps:
-      - uses: actions/download-artifact@v8
-        with:
-          name: action
-      - uses: ./
-      - run: pkgx node -e 'console.log(1)'
diff --git a/.github/workflows/ci.installer.yml b/.github/workflows/ci.installer.yml
deleted file mode 100644
index d6a927f0..00000000
--- a/.github/workflows/ci.installer.yml
+++ /dev/null
@@ -1,217 +0,0 @@
-on:
-  workflow_call:
-  pull_request:
-    paths:
-      - installer.sh
-      - .github/workflows/ci.installer.yml
-
-concurrency:
-  group: ${{ github.ref || 'ci' }}/installer.sh
-  cancel-in-progress: true
-
-permissions:
-  contents: read
-
-jobs:
-  install-pkgx:
-    runs-on: ${{ matrix.os }}
-    strategy:
-      matrix:
-        os:
-          - macos-latest
-          - ubuntu-latest
-    steps:
-      - uses: actions/checkout@v7
-      # using cat | sh to emulate the curl command we tell people to use
-      - run: cat ./installer.sh | sh
-      - run: pkgx --version
-
-  shellcheck:
-      runs-on: ubuntu-latest
-      steps:
-      - uses: actions/checkout@v7
-      - uses: reviewdog/action-shellcheck@v1
-
-  usage-as-proxy:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v7
-      - run: cat ./installer.sh | sh -s deno eval 'console.log(1)'
-      - run: ./installer.sh -- sh -c "which pkgx"
-      - run: sh <(cat ./installer.sh) duf
-      - run: if command -v pkgx; then exit 1; fi
-
-  sudo-not-required:
-    runs-on: ubuntu-latest
-    container: debian:buster-slim
-    steps:
-      - uses: actions/checkout@v7
-      - uses: actions/checkout@v7
-        with:
-          ref: curl
-          path: bin
-      - run: ./installer.sh
-        env:
-          PATH: ${{ github.workspace }}/bin:/usr/bin:/bin
-
-  eval-bash:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v7
-      - run: |
-          vMAJOR=$(curl https://pkgx.sh/VERSION | cut -d. -f1)
-
-          if [ "$vMAJOR" -lt 2 ]; then
-            eval "$(cat ./installer.sh)"
-            env +duf
-          else
-            eval "$(cat ./installer.sh)"
-            eval "$(pkgx +duf)"
-          fi
-
-          duf --version
-
-          test -n "$BASH_VERSION"
-          test -z "$ZSH_VERSION"
-        shell: bash -e {0}
-
-      # check pkgx was installed despite executing via `eval`
-      - run:
-          pkgx duf --version
-
-  eval-zsh:
-    runs-on: ubuntu-latest
-    steps:
-      - name: prep
-        run: sudo apt-get update && sudo apt-get install -y zsh
-
-      - uses: actions/checkout@v7
-      - run: |
-          vMAJOR=$(curl https://pkgx.sh/VERSION | cut -d. -f1)
-
-          if [ "$vMAJOR" -lt 2 ]; then
-            eval "$(cat ./installer.sh)"
-            env +duf
-          else
-            eval "$(cat ./installer.sh)"
-            eval "$(pkgx +duf)"
-          fi
-
-          duf --version
-
-          test -n "$ZSH_VERSION"
-          test -z "$BASH_VERSION"
-        shell: zsh -e {0}
-
-  eval-posix-sh:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v7
-      - run: |
-          vMAJOR=$(curl https://pkgx.sh/VERSION | cut -d. -f1)
-
-          if [ "$vMAJOR" -lt 2 ]; then
-            eval "$(cat ./installer.sh)"
-            env +duf
-          else
-            eval "$(cat ./installer.sh)"
-            eval "$(pkgx +duf)"
-          fi
-
-          duf --version
-
-          test -z "$ZSH_VERSION"
-          test -z "$BASH_VERSION"
-        shell: /bin/sh -e {0}
-
-  sudo-required:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v7
-      - run: sudo chmod go-w /usr/local/bin
-      # ^^ we run as `runner` but this dir has 999 perms
-      - name: check
-        run: if touch /usr/local/bin/foo; then exit 1; fi
-      - run: ./installer.sh
-      - run: test "$(which pkgx)" = /usr/local/bin/pkgx
-
-  no-dirs:
-    strategy:
-      matrix:
-        dir: [/usr/local, /usr/local/bin]
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v7
-      - run: sudo mv ${{ matrix.dir }} $(mktemp -d)
-      - run: ./installer.sh
-      - run: pkgx duf --version
-
-  multiple-apply-is-ok:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v7
-      - run: cat ./installer.sh | sh
-      - run: cat ./installer.sh | sh
-
-  linuxen:
-    continue-on-error: true
-    runs-on: ubuntu-latest
-    strategy:
-      matrix:
-        container:
-          - debian:buster-slim
-          - debian:bullseye-slim
-          - debian:bookworm-slim
-          - archlinux:latest
-          - ubuntu:focal
-          - ubuntu:jammy
-          - ubuntu:noble
-          - fedora:latest
-    container: ${{ matrix.container }}
-    steps:
-      - uses: actions/checkout@v7
-
-      - uses: actions/checkout@v7
-        with:
-          ref: curl
-          path: bin
-
-      - run: ./installer.sh
-        env:
-          PATH: ${{ github.workspace }}/bin:/usr/bin:/bin
-
-      - run: pkgx node -e 'console.log(1)'
-
-  windows:
-    runs-on: windows-latest
-    steps:
-      - uses: actions/checkout@v7
-      - run: .\\installer.ps1
-      - run: |
-          $env:Path += ";$env:LOCALAPPDATA\pkgx"
-          pkgx +zlib.net
-
-  upgrades:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v7
-      - run:
-          curl https://dist.pkgx.dev/pkgx.sh/linux/x86-64/v1.0.0.tar.gz |
-          tar xz --strip-components=3
-      - run: mv pkgx /usr/local/bin
-      - run: test "$(pkgx --version)" = 'pkgx 1.0.0'
-      - run: PKGX_UPDATE=no ./installer.sh
-      - run: test "$(pkgx --version)" = 'pkgx 1.0.0'
-      - run: ./installer.sh
-      - run: pkgx semverator gt $(pkgx --version | awk '{print $2}') 1.0.0
-
-  pkgm:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v7
-      - run: '! pkgm --version'
-      - run: '! deno --version'
-      - run: cat ./installer.sh | sh
-      - run: pkgm --version
-      - run: pkgm i deno
-      - run: deno --version
diff --git a/.github/workflows/quality-gate.yml b/.github/workflows/quality-gate.yml
deleted file mode 100644
index 362b1e82..00000000
--- a/.github/workflows/quality-gate.yml
+++ /dev/null
@@ -1,56 +0,0 @@
-name: quality-gate
-
-on:
-  pull_request:
-    types: [opened, synchronize, reopened, ready_for_review]
-
-permissions:
-  contents: read
-
-jobs:
-  changed-files:
-    runs-on: ubuntu-latest
-    outputs:
-      source_changed: ${{ steps.source.outputs.diff != '' }}
-      tests_changed: ${{ steps.tests.outputs.diff != '' }}
-    steps:
-      - uses: actions/checkout@v7
-        with:
-          fetch-depth: 0
-      - uses: technote-space/get-diff-action@v6
-        id: source
-        with:
-          PATTERNS: |
-            **/*.ts
-            **/*.tsx
-            **/*.js
-            **/*.jsx
-            **/*.mjs
-            **/*.go
-            **/*.rs
-            **/*.py
-            **/*.sh
-          EXCLUDE_PATTERNS: |
-            **/*.test.*
-            **/*.spec.*
-            .github/**
-      - uses: technote-space/get-diff-action@v6
-        id: tests
-        with:
-          PATTERNS: |
-            **/*.test.*
-            **/*.spec.*
-            **/test/**
-            **/tests/**
-          EXCLUDE_PATTERNS: |
-            .github/**
-
-  enforce-test-delta:
-    needs: changed-files
-    if: needs.changed-files.outputs.source_changed == 'true' && needs.changed-files.outputs.tests_changed != 'true'
-    runs-on: ubuntu-latest
-    steps:
-      - name: Require test updates when source changes
-        run: |
-          echo "::error::Source files changed without accompanying test changes."
-          exit 1
\ No newline at end of file
diff --git a/.gitignore b/.gitignore
deleted file mode 100644
index 5cce23c0..00000000
--- a/.gitignore
+++ /dev/null
@@ -1,3 +0,0 @@
-/out.gif
-.DS_Store
-/node_modules
diff --git a/AGENTS.md b/AGENTS.md
deleted file mode 100644
index f9a6538b..00000000
--- a/AGENTS.md
+++ /dev/null
@@ -1,24 +0,0 @@
-# AGENTS: setup
-
-Public repository for installer scripts and GitHub Action setup.
-
-## Core Commands
-
-- `npm install`
-- `npm run dist`
-- `sh ./installer.sh --help`
-
-## Always Do
-
-- Keep installer behavior explicit across macOS, Linux, and Windows.
-- Preserve action input/output contract stability.
-
-## Ask First
-
-- Any change to default install paths or update behavior.
-- Any action permission or deployment behavior change.
-
-## Never Do
-
-- Never remove installer safety checks.
-- Never introduce hidden network side effects without documentation.
diff --git a/LICENSE.txt b/LICENSE.txt
deleted file mode 100644
index c1009552..00000000
--- a/LICENSE.txt
+++ /dev/null
@@ -1,201 +0,0 @@
-                                 Apache License
-                           Version 2.0, January 2004
-                        http://www.apache.org/licenses/
-
-   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
-
-   1. Definitions.
-
-      "License" shall mean the terms and conditions for use, reproduction,
-      and distribution as defined by Sections 1 through 9 of this document.
-
-      "Licensor" shall mean the copyright owner or entity authorized by
-      the copyright owner that is granting the License.
-
-      "Legal Entity" shall mean the union of the acting entity and all
-      other entities that control, are controlled by, or are under common
-      control with that entity. For the purposes of this definition,
-      "control" means (i) the power, direct or indirect, to cause the
-      direction or management of such entity, whether by contract or
-      otherwise, or (ii) ownership of fifty percent (50%) or more of the
-      outstanding shares, or (iii) beneficial ownership of such entity.
-
-      "You" (or "Your") shall mean an individual or Legal Entity
-      exercising permissions granted by this License.
-
-      "Source" form shall mean the preferred form for making modifications,
-      including but not limited to software source code, documentation
-      source, and configuration files.
-
-      "Object" form shall mean any form resulting from mechanical
-      transformation or translation of a Source form, including but
-      not limited to compiled object code, generated documentation,
-      and conversions to other media types.
-
-      "Work" shall mean the work of authorship, whether in Source or
-      Object form, made available under the License, as indicated by a
-      copyright notice that is included in or attached to the work
-      (an example is provided in the Appendix below).
-
-      "Derivative Works" shall mean any work, whether in Source or Object
-      form, that is based on (or derived from) the Work and for which the
-      editorial revisions, annotations, elaborations, or other modifications
-      represent, as a whole, an original work of authorship. For the purposes
-      of this License, Derivative Works shall not include works that remain
-      separable from, or merely link (or bind by name) to the interfaces of,
-      the Work and Derivative Works thereof.
-
-      "Contribution" shall mean any work of authorship, including
-      the original version of the Work and any modifications or additions
-      to that Work or Derivative Works thereof, that is intentionally
-      submitted to Licensor for inclusion in the Work by the copyright owner
-      or by an individual or Legal Entity authorized to submit on behalf of
-      the copyright owner. For the purposes of this definition, "submitted"
-      means any form of electronic, verbal, or written communication sent
-      to the Licensor or its representatives, including but not limited to
-      communication on electronic mailing lists, source code control systems,
-      and issue tracking systems that are managed by, or on behalf of, the
-      Licensor for the purpose of discussing and improving the Work, but
-      excluding communication that is conspicuously marked or otherwise
-      designated in writing by the copyright owner as "Not a Contribution."
-
-      "Contributor" shall mean Licensor and any individual or Legal Entity
-      on behalf of whom a Contribution has been received by Licensor and
-      subsequently incorporated within the Work.
-
-   2. Grant of Copyright License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      copyright license to reproduce, prepare Derivative Works of,
-      publicly display, publicly perform, sublicense, and distribute the
-      Work and such Derivative Works in Source or Object form.
-
-   3. Grant of Patent License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      (except as stated in this section) patent license to make, have made,
-      use, offer to sell, sell, import, and otherwise transfer the Work,
-      where such license applies only to those patent claims licensable
-      by such Contributor that are necessarily infringed by their
-      Contribution(s) alone or by combination of their Contribution(s)
-      with the Work to which such Contribution(s) was submitted. If You
-      institute patent litigation against any entity (including a
-      cross-claim or counterclaim in a lawsuit) alleging that the Work
-      or a Contribution incorporated within the Work constitutes direct
-      or contributory patent infringement, then any patent licenses
-      granted to You under this License for that Work shall terminate
-      as of the date such litigation is filed.
-
-   4. Redistribution. You may reproduce and distribute copies of the
-      Work or Derivative Works thereof in any medium, with or without
-      modifications, and in Source or Object form, provided that You
-      meet the following conditions:
-
-      (a) You must give any other recipients of the Work or
-          Derivative Works a copy of this License; and
-
-      (b) You must cause any modified files to carry prominent notices
-          stating that You changed the files; and
-
-      (c) You must retain, in the Source form of any Derivative Works
-          that You distribute, all copyright, patent, trademark, and
-          attribution notices from the Source form of the Work,
-          excluding those notices that do not pertain to any part of
-          the Derivative Works; and
-
-      (d) If the Work includes a "NOTICE" text file as part of its
-          distribution, then any Derivative Works that You distribute must
-          include a readable copy of the attribution notices contained
-          within such NOTICE file, excluding those notices that do not
-          pertain to any part of the Derivative Works, in at least one
-          of the following places: within a NOTICE text file distributed
-          as part of the Derivative Works; within the Source form or
-          documentation, if provided along with the Derivative Works; or,
-          within a display generated by the Derivative Works, if and
-          wherever such third-party notices normally appear. The contents
-          of the NOTICE file are for informational purposes only and
-          do not modify the License. You may add Your own attribution
-          notices within Derivative Works that You distribute, alongside
-          or as an addendum to the NOTICE text from the Work, provided
-          that such additional attribution notices cannot be construed
-          as modifying the License.
-
-      You may add Your own copyright statement to Your modifications and
-      may provide additional or different license terms and conditions
-      for use, reproduction, or distribution of Your modifications, or
-      for any such Derivative Works as a whole, provided Your use,
-      reproduction, and distribution of the Work otherwise complies with
-      the conditions stated in this License.
-
-   5. Submission of Contributions. Unless You explicitly state otherwise,
-      any Contribution intentionally submitted for inclusion in the Work
-      by You to the Licensor shall be under the terms and conditions of
-      this License, without any additional terms or conditions.
-      Notwithstanding the above, nothing herein shall supersede or modify
-      the terms of any separate license agreement you may have executed
-      with Licensor regarding such Contributions.
-
-   6. Trademarks. This License does not grant permission to use the trade
-      names, trademarks, service marks, or product names of the Licensor,
-      except as required for reasonable and customary use in describing the
-      origin of the Work and reproducing the content of the NOTICE file.
-
-   7. Disclaimer of Warranty. Unless required by applicable law or
-      agreed to in writing, Licensor provides the Work (and each
-      Contributor provides its Contributions) on an "AS IS" BASIS,
-      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
-      implied, including, without limitation, any warranties or conditions
-      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
-      PARTICULAR PURPOSE. You are solely responsible for determining the
-      appropriateness of using or redistributing the Work and assume any
-      risks associated with Your exercise of permissions under this License.
-
-   8. Limitation of Liability. In no event and under no legal theory,
-      whether in tort (including negligence), contract, or otherwise,
-      unless required by applicable law (such as deliberate and grossly
-      negligent acts) or agreed to in writing, shall any Contributor be
-      liable to You for damages, including any direct, indirect, special,
-      incidental, or consequential damages of any character arising as a
-      result of this License or out of the use or inability to use the
-      Work (including but not limited to damages for loss of goodwill,
-      work stoppage, computer failure or malfunction, or any and all
-      other commercial damages or losses), even if such Contributor
-      has been advised of the possibility of such damages.
-
-   9. Accepting Warranty or Additional Liability. While redistributing
-      the Work or Derivative Works thereof, You may choose to offer,
-      and charge a fee for, acceptance of support, warranty, indemnity,
-      or other liability obligations and/or rights consistent with this
-      License. However, in accepting such obligations, You may act only
-      on Your own behalf and on Your sole responsibility, not on behalf
-      of any other Contributor, and only if You agree to indemnify,
-      defend, and hold each Contributor harmless for any liability
-      incurred by, or claims asserted against, such Contributor by reason
-      of your accepting any such warranty or additional liability.
-
-   END OF TERMS AND CONDITIONS
-
-   APPENDIX: How to apply the Apache License to your work.
-
-      To apply the Apache License to your work, attach the following
-      boilerplate notice, with the fields enclosed by brackets "[]"
-      replaced with your own identifying information. (Don't include
-      the brackets!)  The text should be enclosed in the appropriate
-      comment syntax for the file format. We also recommend that a
-      file or class name and description of purpose be included on the
-      same "printed page" as the copyright notice for easier
-      identification within third-party archives.
-
-   Copyright 2022–23 pkgx.inc.
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.
diff --git a/README.md b/README.md
deleted file mode 100644
index bbae0ee4..00000000
--- a/README.md
+++ /dev/null
@@ -1,111 +0,0 @@
-![pkgx](https://pkgx.dev/banner.png)
-
-* This repository provides the `pkgx` GitHub Action.
-* It also hosts [`installer.sh`](./installer.sh); the result of `curl pkgx.sh`.
-
-
-# GitHub Action
-
-```yaml
-- uses: pkgxdev/setup@v4
-```
-
-Installs the latest version of `pkgx`.
-
-> [!NOTE]
->
-> * `v3` & `v4` default to pkgx^2
-> * `v2` defaults to pkgx^1
-
-
-See [`action.yml`] for all inputs and outputs, but here’s the usual ones:
-
-```yaml
-- uses: pkgxdev/setup@v4
-  with:
-    +: deno@1.30
-       rust@1.60   # we understand colloquial names, generally just type what you know
-       clang       # versions aren’t necessary if you don’t care
-```
-
-The easiest way to know if it will work in the action is to try it locally on your computer:
-
-```
-$ pkgx +rust
-# if there’s output, we got it
-```
-
-> See [`@pkgxdev/dev`] to run the `dev` command in a GitHub Actions compatible manner
-
-
-## Should you Cache `~/.pkgx`?
-
-No. pkgx packages are just tarballs. Caching is just a tarball. You’ll likely
-just slow things down.
-
-## Version History
-
-* `v5` defaults to `pkgx`^2, uses node^24 and doesn’t install any pre-reqs on Linux†
-* `v4` defaults to `pkgx`^2, uses node^20 and doesn’t install any pre-reqs on Linux†
-* `v3` defaults to `pkgx`^2 and uses node^20
-* `v2` defaults to `pkgx`^1 and uses node^20
-* `v1` defaults to `pkgx`@latest and uses node^16
-* `v0` should not be used
-
-> † `pkgx` requires glibc>=2.28, libgcc, libstdc++ and libatomic. Generally
-> images come installed with these. If you are building binaries you may need
-> the `-dev` versions of these packages also.
-
-&nbsp;
-
-
-# The `pkgx` Installer
-
-To install `pkgx`:
-
-```sh
-$ curl https://pkgx.sh | sh
-
-# - installs `pkgx` & `pkgm` to `/usr/local/bin`
-# - if both are already installed, does an update check
-```
-
-Or on Windows:
-
-```ps1
-$ irm https://pkgx.sh | iex
-# - installs `pkgx.exe` to `$env:ProgramFiles/pkgx`
-# - adds it to your system PATH
-```
-
-## Temporary Sandboxes
-
-To use `pkgx` to run a command in a temporary sandbox:
-
-```sh
-$ curl -Ssf https://pkgx.sh | sh -s -- gum spin -- sleep 5
-
-# - if pkgx is installed, uses that installation to run gum
-# - if pkgx *isn’t* installed, downloads pkgx to a temporary location
-# - if pkgx *isn’t* installed, packages are also cached to a temporary location
-```
-
-> This usage of our installer can be useful for demonstrative purposes in
-> READMEs and gists.
-
-This syntax is easier to remember:
-
-```sh
-sh <(curl -L pkgx.sh) gum spin -- sleep 5
-```
-
-> There is the **notable caveat** that the above easier syntax will not work with bash <4
-> which is the bash that comes with macOS. Even though macOS has defaulted to
-> zsh for years it is still relatively easy for users to end up in a situation
-> where bash is the shell interpreting your commands. **Your call**.
->
-> Additionally, use of `-L` is subject to man-in-the-middle attacks.
-> Again **your call**.
-
-[`action.yml`]: ./action.yml
-[`@pkgxdev/dev`]: https://github.com/pkgxdev/dev
diff --git a/action.js b/action.js
deleted file mode 100644
index 89002468..00000000
--- a/action.js
+++ /dev/null
@@ -1,172 +0,0 @@
-const { execSync } = require('child_process');
-const unzipper = require('unzipper');
-const semver = require('semver');
-const https = require('https');
-const path = require('path');
-const tar = require('tar');
-const fs = require('fs');
-const os = require('os');
-
-const dstdir = (() => {
-  try {
-    fs.accessSync('/usr/local/bin', fs.constants.W_OK);
-    return '/usr/local/bin';
-  } catch (err) {
-    return path.join(process.env.INPUT_PKGX_DIR || path.join(os.homedir(), '.pkgx'), 'bin');
-  }
-})();
-
-fs.writeFileSync(process.env["GITHUB_PATH"], `${dstdir}\n`);
-
-function platform_key() {
-  let platform = os.platform(); // 'darwin', 'linux', 'win32', etc.
-  if (platform == 'win32') platform = 'windows';
-  let arch = os.arch(); // 'x64', 'arm64', etc.
-  if (arch == 'x64') arch = 'x86-64';
-  if (arch == 'arm64') arch = 'aarch64';
-  return `${platform}/${arch}`;
-}
-
-function downloadAndExtract(url, destination, strip) {
-
-  return new Promise((resolve, reject) => {
-    https.get(url, (response) => {
-      if (response.statusCode !== 200) {
-        reject(new Error(`Failed to get '${url}' (${response.statusCode})`));
-        return;
-      }
-
-      console.log(`extracting pkgx archive…`);
-
-      if (platform_key().startsWith('windows')) {
-        const unzip_stream = unzipper.Extract({ path: destination });
-        response
-          .pipe(unzip_stream)
-          .promise()
-          .then(resolve, reject);
-        unzip_stream.on('error', reject);
-      } else {
-        const tar_stream = tar.x({ cwd: destination, strip });
-        response
-          .pipe(tar_stream)
-          .on('finish', resolve)
-          .on('error', reject);
-        tar_stream.on('error', reject);
-      }
-
-    }).on('error', reject);
-  });
-}
-
-function parse_pkgx_output(output) {
-
-  const stripQuotes = (str) =>
-    str.startsWith('"') || str.startsWith("'") ? str.slice(1, -1) : str;
-
-  const replaceEnvVars = (str) => {
-    const value = str
-      .replaceAll(
-        /\$\{([a-zA-Z0-9_]+):\+:\$[a-zA-Z0-9_]+\}/g,
-        (_, key) => ((v) => v ? `:${v}` : "")(process.env[key]),
-      )
-      .replaceAll(/\$\{([a-zA-Z0-9_]+)\}/g, (_, key) => process.env[key] ?? "")
-      .replaceAll(/\$([a-zA-Z0-9_]+)/g, (_, key) => process.env[key] ?? "");
-    return value;
-  };
-
-  for (const line of output.split("\n")) {
-    const match = line.match(/^([^=]+)=(.*)$/);
-    if (match) {
-      const [_, key, value_] = match;
-      const value = stripQuotes(value_);
-      if (key === "PATH") {
-        value
-          .replaceAll("${PATH:+:$PATH}", "")
-          .replaceAll("$PATH", "")
-          .replaceAll("${PATH}", "")
-          .split(":").forEach((path) => {
-            fs.appendFileSync(process.env["GITHUB_PATH"], `${path}\n`);
-          });
-      } else {
-        let v = replaceEnvVars(value);
-        fs.appendFileSync(process.env["GITHUB_ENV"], `${key}=${v}\n`);
-      }
-    }
-  }
-}
-
-async function install_pkgx() {
-  let strip = 3;
-
-  async function get_url() {
-    if (platform_key().startsWith('windows')) {
-      // not yet versioned
-      strip = 0;
-      return 'https://pkgx.sh/Windows/x86_64.zip';
-    }
-
-    let url = `https://dist.pkgx.dev/pkgx.sh/${platform_key()}/versions.txt`;
-
-    console.log(`fetching ${url}`);
-
-    const rsp = await fetch(url);
-    const txt = await rsp.text();
-
-    const versions = txt.split('\n');
-    const version = process.env.INPUT_VERSION
-      ? semver.maxSatisfying(versions, process.env.INPUT_VERSION)
-      : versions.slice(-1)[0];
-
-    if (!version) {
-      throw new Error(`no version found for ${process.env.INPUT_VERSION}`);
-    }
-
-    console.log(`selected pkgx v${version}`);
-
-    return `https://dist.pkgx.dev/pkgx.sh/${platform_key()}/v${version}.tar.gz`;
-  }
-
-  console.log(`::group::installing ${path.join(dstdir, 'pkgx')}`);
-
-  const url = await get_url();
-
-  console.log(`fetching ${url}`);
-
-  if (!fs.existsSync(dstdir)) {
-    fs.mkdirSync(dstdir, {recursive: true});
-  }
-
-  await downloadAndExtract(url, dstdir, strip);
-
-  console.log(`::endgroup::`);
-}
-
-(async () => {
-  await install_pkgx();
-
-  if (process.env.INPUT_PKGX_DIR) {
-    fs.appendFileSync(process.env["GITHUB_ENV"], `PKGX_DIR=${process.env.INPUT_PKGX_DIR}\n`);
-  }
-
-  if (process.env['INPUT_+']) {
-    console.log(`::group::installing pkgx input packages`);
-    let args = process.env['INPUT_+'].split(' ');
-    if (os.platform() == 'win32') {
-      // cmd.exe uses ^ as an escape character
-      args = args.map(x => x.replace('^', '^^'));
-    }
-    const cmd = `${path.join(dstdir, 'pkgx')} ${args.map(x => `+${x}`).join(' ')}`;
-    console.log(`running: \`${cmd}\``);
-    let env = undefined;
-    if (process.env.INPUT_PKGX_DIR) {
-      env = process.env
-      env['PKGX_DIR'] = process.env.INPUT_PKGX_DIR;
-    }
-    const output = execSync(cmd, {env});
-    parse_pkgx_output(output.toString());
-    console.log(`::endgroup::`);
-  }
-})().catch(err => {
-  console.error(`::error::${err.message}`)
-  process.exit(1);
-});
diff --git a/action.yml b/action.yml
deleted file mode 100644
index b4490386..00000000
--- a/action.yml
+++ /dev/null
@@ -1,26 +0,0 @@
-name: pkgx/setup
-description: >
-  Installs `pkgx` to your GitHub Actions runner.
-inputs:
-  +:
-    description: |
-      Whitespace separated, pkgs to supplement the environment. eg.
-
-      ```yaml
-      +: deno@1.36 rust@1.60
-      ```
-    required: false
-  PKGX_DIR:
-    description: >
-      Where pkgs are cached.
-      Defaults to `$HOME/.pkgx`.
-    required: false
-  version:
-    description: >
-      The version of `pkgx` to install.
-      Defaults to ^2
-    required: false
-    default: ^2
-runs:
-  using: node24
-  main: ./action.js
diff --git a/curl b/curl
new file mode 100755
index 00000000..eab65b50
--- /dev/null
+++ b/curl
@@ -0,0 +1,3 @@
+#!/bin/sh
+# because we test on dozens of containers and most have no ca-certs installed by default
+exec $(cd $(dirname $0) && pwd)/curl.bin --insecure "$@"
diff --git a/curl.bin b/curl.bin
new file mode 100755
index 00000000..7ed55eef
Binary files /dev/null and b/curl.bin differ
diff --git a/installer.ps1 b/installer.ps1
deleted file mode 100644
index c25b3f40..00000000
--- a/installer.ps1
+++ /dev/null
@@ -1,26 +0,0 @@
-# irm https://pkgx.sh | iex
-
-$ErrorActionPreference = "Stop"
-
-# Determine install location for the current user
-$installDir = "$env:LOCALAPPDATA\pkgx"
-
-# Create directory if it doesn't exist
-if (!(Test-Path $installDir)) {
-    New-Item -ItemType Directory -Path $installDir -Force | Out-Null
-}
-
-# Download and extract
-$zipUrl = "https://pkgx.sh/Windows/x86_64.zip"
-$zipFile = "$env:TEMP\pkgx.zip"
-Invoke-WebRequest -Uri $zipUrl -OutFile $zipFile
-Expand-Archive -Path $zipFile -DestinationPath $installDir -Force
-Remove-Item $zipFile
-
-# Ensure user's PATH is updated
-$envPath = [System.Environment]::GetEnvironmentVariable("Path", [System.EnvironmentVariableTarget]::User)
-if ($envPath -notlike "*$installDir*") {
-    [System.Environment]::SetEnvironmentVariable("Path", "$envPath;$installDir", [System.EnvironmentVariableTarget]::User)
-}
-
-Write-Host "pkgx installed successfully! Restart your terminal to use it."
diff --git a/installer.sh b/installer.sh
deleted file mode 100755
index 01940dc0..00000000
--- a/installer.sh
+++ /dev/null
@@ -1,144 +0,0 @@
-#!/bin/sh
-
-set -e
-
-_main() {
-  if _should_install_pkgx; then
-    _install_pkgx "$@"
-  elif [ $# -eq 0 ]; then
-    echo /usr/local/bin/"$(pkgx --version) already installed" >&2
-    echo /usr/local/bin/"$(pkgm --version) already installed" >&2
-    exit
-  fi
-
-  if [ $# -gt 0 ]; then
-    pkgx "$@"
-  else
-    if type eval >/dev/null 2>&1; then
-      if ! [ "$major_version" ]; then
-        major_version=$(pkgx --version | cut -d' ' -f2 | cut -d. -f1)
-      fi
-      if [ $major_version -lt 2 ]; then
-        eval "$(pkgx --shellcode)" 2>/dev/null
-      fi
-    fi
-    if ! _is_ci; then
-      echo "now type: pkgx --help" >&2
-    fi
-  fi
-}
-
-_prep() {
-  if test -n "$VERBOSE" -o -n "$GITHUB_ACTIONS" -a -n "$RUNNER_DEBUG"; then
-    set -x
-  fi
-
-  if test -d /usr/local/bin -a ! -w /usr/local/bin; then
-    SUDO="sudo"
-  elif test -d /usr/local -a ! -w /usr/local; then
-    SUDO="sudo"
-  elif test -d /usr -a ! -w /usr; then
-    SUDO="sudo"
-  fi
-}
-
-_is_ci() {
-  [ -n "$CI" ] && [ $CI != 0 ]
-}
-
-_install_pkgx() {
-  if _is_ci; then
-    progress="--no-progress-meter"
-  else
-    progress="--progress-bar"
-  fi
-
-  tmpdir="$(mktemp -d)"
-
-  if [ $# -eq 0 ]; then
-    if [ -f /usr/local/bin/pkgx ]; then
-      echo "upgrading: /usr/local/bin/pkgx" >&2
-    else
-      echo "installing: /usr/local/bin/pkgx" >&2
-    fi
-
-    # using a named pipe to prevent curl progress output trumping the sudo password prompt
-    pipe="$tmpdir/pipe"
-    mkfifo "$pipe"
-
-    curl $progress --fail --proto '=https' "https://pkgx.sh/$(uname)/$(uname -m)".tgz > "$pipe" &
-    $SUDO sh -c "
-      mkdir -p /usr/local/bin
-      tar xz --directory /usr/local/bin < '$pipe'
-      if [ ! -f /usr/local/bin/pkgm ]; then
-        echo '#!/usr/bin/env -S pkgx -q! pkgm' > /usr/local/bin/pkgm
-        chmod +x /usr/local/bin/pkgm
-      fi
-      if [ ! -f /usr/local/bin/mash ]; then
-        echo '#!/usr/bin/env -S pkgx -q! mash' > /usr/local/bin/mash
-        chmod +x /usr/local/bin/mash
-      fi
-    " &
-    wait
-
-    rm -r "$tmpdir"
-
-    if [ "$(command -v pkgx 2>&1)" != /usr/local/bin/pkgx ]; then
-      echo "warning: active pkgx is not /usr/local/bin/pkgx" >&2
-      export PATH="/usr/local/bin:$PATH"  # so we can exec if required
-    fi
-
-    # tell the user what version we just installed
-    pkgx --version
-    pkgx pkgm@latest --version
-    pkgx mash@latest --version
-
-  else
-    curl $progress --fail --proto '=https' \
-        "https://pkgx.sh/$(uname)/$(uname -m)".tgz \
-      | tar xz --directory "$tmpdir"
-
-    export PATH="$tmpdir:$PATH"
-    export PKGX_DIR="$tmpdir"
-  fi
-
-  unset tmpdir pipe
-}
-
-_pkgx_is_old() {
-  if [ "$PKGX_UPDATE" = no ]; then
-    return 1
-  else
-    new_version=$(curl -Ssf https://pkgx.sh/VERSION)
-    old_version=$(/usr/local/bin/pkgx --version || echo pkgx 0)
-    old_version=$(echo $old_version | cut -d' ' -f2)
-    major_version=$(echo $new_version | cut -d. -f1)
-
-    /usr/local/bin/pkgx --silent semverator gt $new_version $old_version
-  fi
-}
-
-_pkgm_is_old() {
-  if [ "$PKGX_UPDATE" = no ]; then
-    return 1
-  else
-    new_version=$(curl -Ssf https://pkgxdev.github.io/pkgm/version.txt)
-    old_version=$(pkgm --version || echo pkgm 0)
-    old_version=$(echo $old_version | cut -d' ' -f2)
-
-    /usr/local/bin/pkgx --silent semverator gt $new_version $old_version
-  fi
-}
-
-_should_install_pkgx() {
-  if [ ! -f /usr/local/bin/pkgx ]; then
-    return 0
-  elif _pkgx_is_old >/dev/null 2>&1 || _pkgm_is_old >/dev/null 2>&1; then
-    return 0
-  else
-    return 1
-  fi
-}
-
-_prep
-_main "$@"
diff --git a/package-lock.json b/package-lock.json
deleted file mode 100644
index 12f3fb76..00000000
--- a/package-lock.json
+++ /dev/null
@@ -1,228 +0,0 @@
-{
-  "name": "setup",
-  "lockfileVersion": 3,
-  "requires": true,
-  "packages": {
-    "": {
-      "dependencies": {
-        "semver": "^7.8.5",
-        "tar": "^7.5.19",
-        "unzipper": "^0.12.5"
-      }
-    },
-    "node_modules/@isaacs/fs-minipass": {
-      "version": "4.0.1",
-      "resolved": "https://registry.npmjs.org/@isaacs/fs-minipass/-/fs-minipass-4.0.1.tgz",
-      "integrity": "sha512-wgm9Ehl2jpeqP3zw/7mo3kRHFp5MEDhqAdwy1fTGkHAwnkGOVsgpvQhL8B5n1qlb01jV3n/bI0ZfZp5lWA1k4w==",
-      "license": "ISC",
-      "dependencies": {
-        "minipass": "^7.0.4"
-      },
-      "engines": {
-        "node": ">=18.0.0"
-      }
-    },
-    "node_modules/bluebird": {
-      "version": "3.7.2",
-      "resolved": "https://registry.npmjs.org/bluebird/-/bluebird-3.7.2.tgz",
-      "integrity": "sha512-XpNj6GDQzdfW+r2Wnn7xiSAd7TM3jzkxGXBGTtWKuSXv1xUV+azxAm8jdWZN06QTQk+2N2XB9jRDkvbmQmcRtg==",
-      "license": "MIT"
-    },
-    "node_modules/chownr": {
-      "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/chownr/-/chownr-3.0.0.tgz",
-      "integrity": "sha512-+IxzY9BZOQd/XuYPRmrvEVjF/nqj5kgT4kEq7VofrDoM1MxoRjEWkrCC3EtLi59TVawxTAn+orJwFQcrqEN1+g==",
-      "license": "BlueOak-1.0.0",
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/core-util-is": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/core-util-is/-/core-util-is-1.0.3.tgz",
-      "integrity": "sha512-ZQBvi1DcpJ4GDqanjucZ2Hj3wEO5pZDS89BWbkcrvdxksJorwUDDZamX9ldFkp9aw2lmBDLgkObEA4DWNJ9FYQ==",
-      "license": "MIT"
-    },
-    "node_modules/duplexer2": {
-      "version": "0.1.4",
-      "resolved": "https://registry.npmjs.org/duplexer2/-/duplexer2-0.1.4.tgz",
-      "integrity": "sha512-asLFVfWWtJ90ZyOUHMqk7/S2w2guQKxUI2itj3d92ADHhxUSbCMGi1f1cBcJ7xM1To+pE/Khbwo1yuNbMEPKeA==",
-      "license": "BSD-3-Clause",
-      "dependencies": {
-        "readable-stream": "^2.0.2"
-      }
-    },
-    "node_modules/fs-extra": {
-      "version": "11.3.1",
-      "resolved": "https://registry.npmjs.org/fs-extra/-/fs-extra-11.3.1.tgz",
-      "integrity": "sha512-eXvGGwZ5CL17ZSwHWd3bbgk7UUpF6IFHtP57NYYakPvHOs8GDgDe5KJI36jIJzDkJ6eJjuzRA8eBQb6SkKue0g==",
-      "license": "MIT",
-      "dependencies": {
-        "graceful-fs": "^4.2.0",
-        "jsonfile": "^6.0.1",
-        "universalify": "^2.0.0"
-      },
-      "engines": {
-        "node": ">=14.14"
-      }
-    },
-    "node_modules/graceful-fs": {
-      "version": "4.2.11",
-      "resolved": "https://registry.npmjs.org/graceful-fs/-/graceful-fs-4.2.11.tgz",
-      "integrity": "sha512-RbJ5/jmFcNNCcDV5o9eTnBLJ/HszWV0P73bc+Ff4nS/rJj+YaS6IGyiOL0VoBYX+l1Wrl3k63h/KrH+nhJ0XvQ==",
-      "license": "ISC"
-    },
-    "node_modules/inherits": {
-      "version": "2.0.4",
-      "resolved": "https://registry.npmjs.org/inherits/-/inherits-2.0.4.tgz",
-      "integrity": "sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ==",
-      "license": "ISC"
-    },
-    "node_modules/isarray": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/isarray/-/isarray-1.0.0.tgz",
-      "integrity": "sha512-VLghIWNM6ELQzo7zwmcg0NmTVyWKYjvIeM83yjp0wRDTmUnrM678fQbcKBo6n2CJEF0szoG//ytg+TKla89ALQ==",
-      "license": "MIT"
-    },
-    "node_modules/jsonfile": {
-      "version": "6.2.1",
-      "resolved": "https://registry.npmjs.org/jsonfile/-/jsonfile-6.2.1.tgz",
-      "integrity": "sha512-zwOTdL3rFQ/lRdBnntKVOX6k5cKJwEc1HdilT71BWEu7J41gXIB2MRp+vxduPSwZJPWBxEzv4yH1wYLJGUHX4Q==",
-      "license": "MIT",
-      "dependencies": {
-        "universalify": "^2.0.0"
-      },
-      "optionalDependencies": {
-        "graceful-fs": "^4.1.6"
-      }
-    },
-    "node_modules/minipass": {
-      "version": "7.1.2",
-      "resolved": "https://registry.npmjs.org/minipass/-/minipass-7.1.2.tgz",
-      "integrity": "sha512-qOOzS1cBTWYF4BH8fVePDBOO9iptMnGUEZwNc/cMWnTV2nVLZ7VoNWEPHkYczZA0pdoA7dl6e7FL659nX9S2aw==",
-      "license": "ISC",
-      "engines": {
-        "node": ">=16 || 14 >=14.17"
-      }
-    },
-    "node_modules/minizlib": {
-      "version": "3.1.0",
-      "resolved": "https://registry.npmjs.org/minizlib/-/minizlib-3.1.0.tgz",
-      "integrity": "sha512-KZxYo1BUkWD2TVFLr0MQoM8vUUigWD3LlD83a/75BqC+4qE0Hb1Vo5v1FgcfaNXvfXzr+5EhQ6ing/CaBijTlw==",
-      "license": "MIT",
-      "dependencies": {
-        "minipass": "^7.1.2"
-      },
-      "engines": {
-        "node": ">= 18"
-      }
-    },
-    "node_modules/node-int64": {
-      "version": "0.4.0",
-      "resolved": "https://registry.npmjs.org/node-int64/-/node-int64-0.4.0.tgz",
-      "integrity": "sha512-O5lz91xSOeoXP6DulyHfllpq+Eg00MWitZIbtPfoSEvqIHdl5gfcY6hYzDWnj0qD5tz52PI08u9qUvSVeUBeHw==",
-      "license": "MIT"
-    },
-    "node_modules/process-nextick-args": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/process-nextick-args/-/process-nextick-args-2.0.1.tgz",
-      "integrity": "sha512-3ouUOpQhtgrbOa17J7+uxOTpITYWaGP7/AhoR3+A+/1e9skrzelGi/dXzEYyvbxubEF6Wn2ypscTKiKJFFn1ag==",
-      "license": "MIT"
-    },
-    "node_modules/readable-stream": {
-      "version": "2.3.8",
-      "resolved": "https://registry.npmjs.org/readable-stream/-/readable-stream-2.3.8.tgz",
-      "integrity": "sha512-8p0AUk4XODgIewSi0l8Epjs+EVnWiK7NoDIEGU0HhE7+ZyY8D1IMY7odu5lRrFXGg71L15KG8QrPmum45RTtdA==",
-      "license": "MIT",
-      "dependencies": {
-        "core-util-is": "~1.0.0",
-        "inherits": "~2.0.3",
-        "isarray": "~1.0.0",
-        "process-nextick-args": "~2.0.0",
-        "safe-buffer": "~5.1.1",
-        "string_decoder": "~1.1.1",
-        "util-deprecate": "~1.0.1"
-      }
-    },
-    "node_modules/safe-buffer": {
-      "version": "5.1.2",
-      "resolved": "https://registry.npmjs.org/safe-buffer/-/safe-buffer-5.1.2.tgz",
-      "integrity": "sha512-Gd2UZBJDkXlY7GbJxfsE8/nvKkUEU1G38c1siN6QP6a9PT9MmHB8GnpscSmMJSoF8LOIrt8ud/wPtojys4G6+g==",
-      "license": "MIT"
-    },
-    "node_modules/semver": {
-      "version": "7.8.5",
-      "resolved": "https://registry.npmjs.org/semver/-/semver-7.8.5.tgz",
-      "integrity": "sha512-Y7/KDsb8LjooZpwaqGyulO6DQlksgCncchHGk+sZIY4SBvUocMBEFH5Ur1fI4dV+Jvl0w6cjvucaIi40puRioA==",
-      "license": "ISC",
-      "bin": {
-        "semver": "bin/semver.js"
-      },
-      "engines": {
-        "node": ">=10"
-      }
-    },
-    "node_modules/string_decoder": {
-      "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/string_decoder/-/string_decoder-1.1.1.tgz",
-      "integrity": "sha512-n/ShnvDi6FHbbVfviro+WojiFzv+s8MPMHBczVePfUpDJLwoLT0ht1l4YwBCbi8pJAveEEdnkHyPyTP/mzRfwg==",
-      "license": "MIT",
-      "dependencies": {
-        "safe-buffer": "~5.1.0"
-      }
-    },
-    "node_modules/tar": {
-      "version": "7.5.19",
-      "resolved": "https://registry.npmjs.org/tar/-/tar-7.5.19.tgz",
-      "integrity": "sha512-4LeEWl96twnS2Q7Bz4MGqgazLqO+hJN63GZxXoIqh1T3VweYD997gbU1ItNsQafqqXTXd5WFyFdReLtwvRBNiw==",
-      "license": "BlueOak-1.0.0",
-      "dependencies": {
-        "@isaacs/fs-minipass": "^4.0.0",
-        "chownr": "^3.0.0",
-        "minipass": "^7.1.2",
-        "minizlib": "^3.1.0",
-        "yallist": "^5.0.0"
-      },
-      "engines": {
-        "node": ">=18"
-      }
-    },
-    "node_modules/universalify": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/universalify/-/universalify-2.0.1.tgz",
-      "integrity": "sha512-gptHNQghINnc/vTGIk0SOFGFNXw7JVrlRUtConJRlvaw6DuX0wO5Jeko9sWrMBhh+PsYAZ7oXAiOnf/UKogyiw==",
-      "license": "MIT",
-      "engines": {
-        "node": ">= 10.0.0"
-      }
-    },
-    "node_modules/unzipper": {
-      "version": "0.12.5",
-      "resolved": "https://registry.npmjs.org/unzipper/-/unzipper-0.12.5.tgz",
-      "integrity": "sha512-tXYOi9R57Uj/2Z25SOs5RRSzq886MBQj2gY8dPL+xl/kv6s6SvByoKfAtvfVeEuhntWDgjd2o9p2lb4TVPAz0A==",
-      "license": "MIT",
-      "dependencies": {
-        "bluebird": "~3.7.2",
-        "duplexer2": "~0.1.4",
-        "fs-extra": "11.3.1",
-        "graceful-fs": "^4.2.2",
-        "node-int64": "^0.4.0"
-      }
-    },
-    "node_modules/util-deprecate": {
-      "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/util-deprecate/-/util-deprecate-1.0.2.tgz",
-      "integrity": "sha512-EPD5q1uXyFxJpCrLnCc1nHnq3gOa6DZBocAIiI2TaSCA7VCJ1UJDMagCzIkXNsUYfD1daK//LTEQ8xiIbrHtcw==",
-      "license": "MIT"
-    },
-    "node_modules/yallist": {
-      "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/yallist/-/yallist-5.0.0.tgz",
-      "integrity": "sha512-YgvUTfwqyc7UXVMrB+SImsVYSmTS8X/tSrtdNZMImM+n7+QTriRXyXim0mBrTXNeqzVF0KWGgHPeiyViFFrNDw==",
-      "license": "BlueOak-1.0.0",
-      "engines": {
-        "node": ">=18"
-      }
-    }
-  }
-}
diff --git a/package.json b/package.json
deleted file mode 100644
index 83561eaa..00000000
--- a/package.json
+++ /dev/null
@@ -1,10 +0,0 @@
-{
-  "dependencies": {
-    "semver": "^7.8.5",
-    "tar": "^7.5.19",
-    "unzipper": "^0.12.5"
-  },
-  "scripts": {
-    "dist": "npx esbuild ./action.js --bundle --platform=node --target=node24 --outfile=./action.js --allow-overwrite --minify --external:@aws-sdk/client-s3"
-  }
-}
diff --git a/scripts/publish-release.sh b/scripts/publish-release.sh
deleted file mode 100755
index 3539d1a9..00000000
--- a/scripts/publish-release.sh
+++ /dev/null
@@ -1,97 +0,0 @@
-#!/usr/bin/env -S pkgx +bun +npm +gum bash -eo pipefail
-
-cd "$(dirname "$0")"/..
-
-if ! git diff-index --quiet HEAD --; then
-  echo "error: dirty working tree" >&2
-  exit 1
-fi
-
-if [ "$(git rev-parse --abbrev-ref HEAD)" != main ]; then
-  echo "error: requires main branch" >&2
-  exit 1
-fi
-
-if test "$VERBOSE"; then
-  set -x
-fi
-
-# ensure we have the latest version tags
-git fetch origin -pft
-
-# ensure github tags the right release
-git push origin main
-
-versions="$(git tag | grep '^v[0-9]\+\.[0-9]\+\.[0-9]\+')"
-v_latest="$(bunx -- semver --include-prerelease $versions | tail -n1)"
-
-case $1 in
-major|minor|patch|prerelease)
-  v_new=$(bunx -- semver bump $v_latest --increment $1)
-  ;;
-"")
-  echo "usage $0 <major|minor|patch|prerelease|VERSION>" >&2
-  exit 1;;
-*)
-  if test "$(bunx -- semver """$1""")" != "$1"; then
-    echo "$1 doesn't look like valid semver."
-    exit 1
-  fi
-  v_new=$1
-  ;;
-esac
-
-if [ $v_new = $v_latest ]; then
-  echo v"$v_new already exists!" >&2
-  exit 1
-fi
-
-if ! gh release view v$v_new >/dev/null 2>&1; then
-  gum confirm "prepare draft release for v$v_new?" || exit 1
-
-  gh release create \
-    v$v_new \
-    --draft=true \
-    --generate-notes \
-    --notes-start-tag=v$v_latest \
-    --title=v$v_new
-else
-  gum format "> existing $v_new release found, using that"
-  echo  #spacer
-fi
-
-
-gh workflow run cd.qa.yml --raw-field version="$v_new"
-# ^^ infuriatingly does not tell us the ID of the run
-
-gum spin --title 'sleeping 5s because GitHub API is slow' -- sleep 5
-
-run_id=$(gh run list --json databaseId --workflow=cd.qa.yml | jq '.[0].databaseId')
-
-if ! gh run watch --exit-status $run_id; then
-  foo=$?
-  gum format -- "> gh run view --web $run_id"
-  exit $foo
-fi
-
-git checkout -b v$v_new-branch
-npm run dist
-git add ./action.js
-git commit --message v$v_new
-git tag v$v_new
-git push origin v$v_new
-
-gh release upload --clobber v$v_new ./installer.sh ./action.js
-
-gh release view v$v_new
-
-gum confirm "draft prepared, release v$v_new?" || exit 1
-
-gh release edit \
-  v$v_new \
-  --verify-tag \
-  --latest \
-  --draft=false
-
-git checkout main
-git branch -D v$v_new-branch