docs: app-palette badges, brew blocks and doc cleanups

README.en.md

@@ -1,16 +1,20 @@
-[![Русский](https://img.shields.io/badge/%D0%A0%D1%83%D1%81%D1%81%D0%BA%D0%B8%D0%B9-00a693?style=flat)](README.md)
-[![English](https://img.shields.io/badge/English-808080?style=flat)](README.en.md)
+[![Русский](assets/badges/lang-ru-muted.svg)](README.md)
+[![English](assets/badges/lang-en.svg)](README.en.md)
 
 <p align="center">
   <img src="assets/icon/icon-preview.png" width="128" alt="xrayvpn">
 </p>
 
 # Xray Reality VPN Server — deployment
 
-[![Release](https://img.shields.io/github/v/release/lifestreamy/xrayvpn?style=flat&label=release&color=00a693)](https://github.com/lifestreamy/xrayvpn/releases/latest)
-[![PyPI](https://img.shields.io/pypi/v/xrayvpn?style=flat&label=pypi&color=00a693)](https://pypi.org/project/xrayvpn/)
-[![Python](https://img.shields.io/badge/python-3.12%2B-00a693?style=flat&logo=python&logoColor=white)](python-client/README.en.md)
-[![License](https://img.shields.io/badge/license-AGPL--3.0%20%2B%20commercial-00a693?style=flat)](LICENSE)
+[![release v0.4.1](assets/badges/release.svg?v=0.4.1)](https://github.com/lifestreamy/xrayvpn/releases/latest)
+[![brew v0.4.1](assets/badges/brew.svg?v=0.4.1)](https://github.com/lifestreamy/homebrew-tap)
+[![winget soon](assets/badges/winget-en.svg)](https://github.com/microsoft/winget-pkgs/pull/440001)
+[![apt v0.4.1](assets/badges/apt.svg?v=0.4.1)](https://lifestreamy.github.io/xrayvpn/apt/)
+[![pip v0.4.1](assets/badges/pip.svg?v=0.4.1)](https://pypi.org/project/xrayvpn/)
+[![uv tool v0.4.1](assets/badges/uv.svg?v=0.4.1)](https://pypi.org/project/xrayvpn/)
+[![python 3.12+](assets/badges/python.svg)](python-client/README.en.md)
+[![license AGPL-3.0](assets/badges/license.svg)](LICENSE)
 
 > VLESS Xray Reality with an optional Cloudflare WARP outbound. A personal VPN on your own VPS
 > running Ubuntu/Debian — no domain to buy, just an IP and the root password.
@@ -87,7 +91,7 @@ VPN stopped — start with [`docs/user/RUNBOOK.en.md`](docs/user/RUNBOOK.en.md).
 | Path | What you need | How | Comment |
 |---|---|---|---|
 | Portable app | one downloaded file, nothing to install | download from [Releases](https://github.com/lifestreamy/xrayvpn/releases/latest) and run it (double-click on Windows), type `deploy` | console app |
-| Package managers | a package manager | `pip install xrayvpn` (Python 3.12+), apt (Ubuntu 24.04 / Debian 12) | one-command install |
+| Package managers | a package manager | `pip install xrayvpn` (Python 3.12+), brew (macOS Apple Silicon), apt (Ubuntu 24.04 / Debian 12) | one-command install |
 | From the repository | `uv` (installs Python 3.12+) | `uv run --project python-client xrayvpn deploy` | running from source |
 | Shell wrappers | Linux/WSL (bash) or Windows+WSL (PowerShell) | `provision-vpn.sh` / `Provision-VPN.ps1` | maintained, not developed |
 | Ansible directly | ansible-core 2.14+ and `community.general` | `ansible-playbook -i inventory.yml deploy.yml` | for techies |
@@ -101,7 +105,13 @@ access to it — a password or a key. Install guide — [`docs/user/SETUP.en.md`
 **Windows:** download `xrayvpn-<version>-windows-x64-portable.exe` from
 [Releases](https://github.com/lifestreamy/xrayvpn/releases/latest) and double-click it.
 
-**macOS (Apple Silicon):** download `xrayvpn-<version>-macos-arm64-portable`:
+**macOS (Apple Silicon)** — Homebrew:
+
+```bash
+brew install lifestreamy/tap/xrayvpn
+```
+
+Or download `xrayvpn-<version>-macos-arm64-portable`:
 
 ```bash
 chmod +x xrayvpn-*-macos-arm64-portable

README.md

@@ -1,16 +1,20 @@
-[![English](https://img.shields.io/badge/English-808080?style=flat)](README.en.md)
-[![Русский](https://img.shields.io/badge/%D0%A0%D1%83%D1%81%D1%81%D0%BA%D0%B8%D0%B9-00a693?style=flat)](README.md)
+[![English](assets/badges/lang-en-muted.svg)](README.en.md)
+[![Русский](assets/badges/lang-ru.svg)](README.md)
 
 <p align="center">
   <img src="assets/icon/icon-preview.png" width="128" alt="xrayvpn">
 </p>
 
 # Xray Reality VPN Server — развёртывание
 
-[![Release](https://img.shields.io/github/v/release/lifestreamy/xrayvpn?style=flat&label=release&color=00a693)](https://github.com/lifestreamy/xrayvpn/releases/latest)
-[![PyPI](https://img.shields.io/pypi/v/xrayvpn?style=flat&label=pypi&color=00a693)](https://pypi.org/project/xrayvpn/)
-[![Python](https://img.shields.io/badge/python-3.12%2B-00a693?style=flat&logo=python&logoColor=white)](python-client/README.md)
-[![License](https://img.shields.io/badge/license-AGPL--3.0%20%2B%20commercial-00a693?style=flat)](LICENSE)
+[![release v0.4.1](assets/badges/release.svg?v=0.4.1)](https://github.com/lifestreamy/xrayvpn/releases/latest)
+[![brew v0.4.1](assets/badges/brew.svg?v=0.4.1)](https://github.com/lifestreamy/homebrew-tap)
+[![winget скоро](assets/badges/winget-ru.svg)](https://github.com/microsoft/winget-pkgs/pull/440001)
+[![apt v0.4.1](assets/badges/apt.svg?v=0.4.1)](https://lifestreamy.github.io/xrayvpn/apt/)
+[![pip v0.4.1](assets/badges/pip.svg?v=0.4.1)](https://pypi.org/project/xrayvpn/)
+[![uv tool v0.4.1](assets/badges/uv.svg?v=0.4.1)](https://pypi.org/project/xrayvpn/)
+[![python 3.12+](assets/badges/python.svg)](python-client/README.md)
+[![license AGPL-3.0](assets/badges/license.svg)](LICENSE)
 
 > VLESS Xray Reality + опциональный исходящий Cloudflare WARP. Личный VPN-сервер на своём VPS
 > Ubuntu/Debian без покупки домена: достаточно IP и пароля root.
@@ -85,7 +89,7 @@
 | Путь | Что нужно | Как | Комментарий |
 |---|---|---|---|
 | Портативное приложение | один скачанный файл, ставить ничего не надо | скачать из [Releases](https://github.com/lifestreamy/xrayvpn/releases/latest) и запустить (Windows — двойной клик), набрать `deploy` | консольное приложение |
-| Пакетные менеджеры | менеджер пакетов | `pip install xrayvpn` (Python 3.12+), apt (Ubuntu 24.04 / Debian 12) | установка одной командой |
+| Пакетные менеджеры | менеджер пакетов | `pip install xrayvpn` (Python 3.12+), brew (macOS Apple Silicon), apt (Ubuntu 24.04 / Debian 12) | установка одной командой |
 | Из репозитория | `uv` (поставит Python 3.12+) | `uv run --project python-client xrayvpn deploy` | запуск из исходников |
 | Shell-обёртки | Linux/WSL (bash) или Windows+WSL (PowerShell) | `provision-vpn.sh` / `Provision-VPN.ps1` | поддержка без развития |
 | Ansible напрямую | ansible-core 2.14+ и `community.general` | `ansible-playbook -i inventory.yml deploy.yml` | для технарей |
@@ -99,7 +103,13 @@ SSH-доступ к нему — пароль или ключ. Инструкц
 **Windows:** скачайте `xrayvpn-<версия>-windows-x64-portable.exe` из
 [Releases](https://github.com/lifestreamy/xrayvpn/releases/latest) и запустите двойным кликом.
 
-**macOS (Apple Silicon):** скачайте `xrayvpn-<версия>-macos-arm64-portable`:
+**macOS (Apple Silicon)** — Homebrew:
+
+```bash
+brew install lifestreamy/tap/xrayvpn
+```
+
+Или скачайте `xrayvpn-<версия>-macos-arm64-portable`:
 
 ```bash
 chmod +x xrayvpn-*-macos-arm64-portable

docs/dev/RELEASE.en.md

@@ -38,6 +38,12 @@ echo "deb [signed-by=/usr/share/keyrings/xrayvpn-archive-keyring.gpg] https://li
 sudo apt update && sudo apt install xrayvpn
 ```
 
+Homebrew (macOS, Apple Silicon):
+
+```bash
+brew install lifestreamy/tap/xrayvpn
+```
+
 ## CHANGELOG
 - Kept per shipped version; entries are added by the release commit; format — Added / Changed /
   Fixed / Removed.

docs/dev/RELEASE.md

@@ -39,6 +39,12 @@ echo "deb [signed-by=/usr/share/keyrings/xrayvpn-archive-keyring.gpg] https://li
 sudo apt update && sudo apt install xrayvpn
 ```
 
+Homebrew (macOS, Apple Silicon):
+
+```bash
+brew install lifestreamy/tap/xrayvpn
+```
+
 ## CHANGELOG
 - Ведётся по выпущенным версиям; записи вносит релизный коммит; формат — Added / Changed / Fixed /
   Removed.

docs/dev/publishing/brew.md

@@ -25,6 +25,21 @@ The `xrayvpn` formula in the tap `lifestreamy/homebrew-tap`, so users install wi
 
 Secret: `BREW_DEPLOY_KEY` (write deploy key of the tap repository).
 
+## Tap trust
+
+Since Homebrew 6.0 a third-party tap is not loaded until it is trusted. The fully qualified
+command trusts exactly one formula, so it needs no extra step:
+
+```
+brew install lifestreamy/tap/xrayvpn
+```
+
+The short form works only after an explicit trust: `brew tap lifestreamy/tap`, then
+`brew trust --formula lifestreamy/tap/xrayvpn` (or `brew trust lifestreamy/tap` for the whole tap),
+and only then `brew install xrayvpn`.
+
+The formula covers macOS arm64 only (`depends_on arch: :arm64`); Homebrew on Linux is not covered.
+
 ## Repair
 
 Re-run the pipeline with the released tag and approve it. The formula can also be pushed by hand:

docs/dev/publishing/winget.md

@@ -61,6 +61,21 @@ If `wingetcreate submit` fails in the pipeline, the same command can be run loca
 wingetcreate.exe submit <manifest directory>
 ```
 
+## URL validation
+
+The validation pipeline checks the URLs in the manifest set — metadata URLs (`PublisherUrl`,
+`PublisherSupportUrl`, `PackageUrl`, `LicenseUrl`, `ReleaseNotesUrl`) and the installer URL — and
+fails the URL step with a `URL-Validation-Error` when one of them answers with an HTTP error; the
+comment names the URL and the status code, and the domain step that follows is skipped. A publisher
+site that is down or answers through a broken origin fails this way. The check runs from Azure IP
+ranges, so a server that blocks them fails it too.
+
+Fix the URL and re-run the validation; no manifest change is needed when the fix is on the site
+side. `@wingetbot run` is a moderator command — it re-runs the validation and strips the transient
+labels — so the re-run is requested from a moderator. The validation service also retries failed
+steps on its own schedule: a failed run is picked up again within a few hours, the transient labels
+are dropped, and the retry re-checks every URL.
+
 ## Verify and remove
 
 ```