wip: enable verified Koh 2 release feed compatibility (3.0.219); deployment pending

@@ -1,6 +1,6 @@11 {22 	"name": "kepr",3-	"version": "3.0.218",3+	"version": "3.0.219",44 	"private": true,55 	"type": "module",66 	"scripts": {

@@ -53,15 +53,6 @@5353 	return `${head(release)},"platforms":{${platforms.join(",")}}}`;5454 }5555 56-/** Kepr 2's legacy per-platform shape, which only the frozen Koh 2 route serves (§22.4). */57-export function legacyReleaseJson(domain: string, repo: string, release: Release): string {58-	const platforms = release.files.map(59-		(file) =>60-			`${str(file.platform)}:{"url":"https://${jsonEscape(domain)}/api/${repo}/releases/${release.version}/${file.platform}","checksum":${str(`blake3:${file.blake3}`)},"provenance":${provenance(release.version, file)},"signature":""}`,61-	);62-	return `${head(release)},"platforms":{${platforms.join(",")}}}`;63-}64-6556 /** `[{"version","notes"}]`, newest first; unlike the release shape, Kepr 2 always sent notes here. */6657 export function historyJson(releases: Release[]): string {6758 	const rows = releases.map((r) => `{"version":${str(r.version)},"notes":${str(r.notes)}}`);

@@ -9,13 +9,6 @@99 import { checksumsTxt, historyJson, metaJson, releaseJson, updateInfoJson } from "./feeds.ts";1010 import { countDownload, type Release, releaseContentType, visibleReleases } from "./releases.ts";1111 12-/**13- * §22.4: Koh 2's `koh update` reads `/api/koh/releases/latest`, built into every Koh 2 binary. The14- * route stays on Koh 2's last release forever, never the repo's newest, so a Koh 2 install is never15- * offered Koh 3.16- */17-const FROZEN_KOH2 = { repo: "koh", version: "2.1.16" } as const;18-1912 // §22.5: one generic script; each repo gets its own name and address filled in.2013 const INSTALL_SH = readFileSync(join(import.meta.dir, "install.sh"), "utf8");2114 @@ -62,11 +55,8 @@6255 		return f.releases[0] ?? send(c, 404, NO_RELEASES);6356 	};6457 65-	app.get("/api/koh/releases/latest", (c) =>66-		send(c, 404, '{"error":"no_releases","message":"no releases available"}'),67-	);6858 	app.get("/api/koh/releases/:version/:platform", (c) =>69-		downloadAt(c, FROZEN_KOH2.repo, c.req.param("version"), c.req.param("platform")),59+		downloadAt(c, "koh", c.req.param("version"), c.req.param("platform")),7060 	);7161 	for (const [path, cors] of [7262 		["/api/:repo/releases/latest", true],

@@ -131,7 +131,7 @@131131 		});132132 	});133133 134-	// koh's /api route is the frozen Koh 2 feed, tested on its own below.134+	// Koh 2 uses this same shape through its built-in update URL, tested below.135135 	// §30 2026-10-03: `url` alone departs from Kepr 2, ending in the file's stored name.136136 	test.each(RELEASED.filter((r) => r !== "koh"))(137137 		"/api/%s/releases/latest is byte for byte Kepr 2's but for urls naming the file, with CORS",@@ -270,7 +270,7 @@270270 	});271271 });272272 273-describe("the frozen Koh 2 route", () => {273+describe("Koh 2 upgrades to Koh 3", () => {274274 	let app: Hono;275275 	let bucketDir: string;276276 	const get = (path: string) => app.request(path);@@ -300,16 +300,14 @@300300 		app = await serve(bucketDir, (kepr) => kepr.run("UPDATE repos SET public = 1"));301301 	});302302 303-	// Kepr 2 listed platforms by build time; Kepr 3 lists them by name, as the generic shape always304-	// did. Koh 2 reads them by key, so the object is compared as parsed, and every field order exactly.305-	test("always returns the frozen Koh 2 no-releases body", async () => {303+	test("offers the newest Koh 3 release through the built-in Koh 2 URL", async () => {306304 		const res = await get("/api/koh/releases/latest");307-		expect(res.status).toBe(404);308-		expect(await res.text()).toBe('{"error":"no_releases","message":"no releases available"}');309-		expect(await (await get("/koh/releases/latest/version.txt")).text()).toBe("3.0.0");305+		expect(res.status).toBe(200);306+		expect(res.headers.get("Access-Control-Allow-Origin")).toBe("*");307+		expect(await res.text()).toBe(await (await get("/koh/releases/latest.json")).text());310308 	});311309 312-	test("returns the frozen Koh 2 no-releases body when 2.1.16 is unavailable", async () => {310+	test("also upgrades when there is no Koh 2 release", async () => {313311 		app = await serve(bucketDir, (kepr) => {314312 			kepr.run("UPDATE repos SET public = 1");315313 			kepr.run(@@ -317,9 +315,9 @@317315 			);318316 		});319317 		const res = await get("/api/koh/releases/latest");320-		expect(res.status).toBe(404);321-		// Required compatibility body: Koh 2's updater parses this exact JSON response.322-		expect(await res.text()).toBe('{"error":"no_releases","message":"no releases available"}');318+		expect(res.status).toBe(200);319+		const release = (await res.json()) as { version: string };320+		expect(release.version).toBe("3.0.0");323321 	});324322 325323 	test("its download URLs redirect to the file", async () => {