release: bridge legacy installations to ForgeFlow-Public

tests/config-store.test.mjs

@@ -48,6 +48,20 @@ test("load creates missing config and recovers malformed JSON", async (t) => {
   assert.ok((await readdir(directory)).some((name) => name.includes(".corrupt-")));
 });
 
+test("legacy ForgeFlow update endpoint migrates to the signed public releases", async (t) => {
+  const { directory, store } = await storeFixture(t);
+  assert.equal(store.data.updates.repo, "ForgeFlow-Public");
+  await writeFile(store.filePath, JSON.stringify({
+    updates: { owner: "Jens", repo: "ForgeFlow", branch: "main", autoCheck: true },
+  }), "utf8");
+  await store.load();
+  assert.equal(store.data.updates.repo, "ForgeFlow-Public");
+  assert.equal(JSON.parse(await readFile(store.filePath, "utf8")).updates.repo, "ForgeFlow-Public");
+  assert.equal(store.migrate({ updates: { owner: "Team", repo: "ForgeFlow" } }).updates.repo, "ForgeFlow");
+  assert.equal(store.migrate({ updates: { owner: "Jens", repo: "CustomUpdates" } }).updates.repo, "CustomUpdates");
+  assert.equal(store.migrate({ updates: { owner: "Jens", repo: "ForgeFlow", branch: "custom" } }).updates.repo, "ForgeFlow");
+});
+
 test("server normalization rejects unsafe targets and preserves bounded scan configuration", async (t) => {
   const { store } = await storeFixture(t);
   assert.throws(() => store.normalizeServer({ host: "bad host", username: "root" }), /hostname/);