v0.1.3

One export, and a README that stops explaining itself.

subscriptionKey and KEY_PREFIX are part of the API. A host that wants the row
for one endpoint had to list the namespace and compare .endpoint on every row it
holds. Listing cannot answer that question: KV's list is eventually consistent, so a
device that enrolled a second ago comes back as not enrolled, and a page acting on
that tells somebody their enrollment failed while the row sits in KV. The key
derivation is now exported, so the lookup is a point read. It was never free to change
anyway, since an altered hash orphans every existing row, so exporting it costs nothing
that was not already owed. Without it, hosts copy the six lines and diverge quietly.

The README says less. It had grown to explain itself to the reader: what each
section was about to do, what the API section would report, a mounted-Worker walkthrough
that duplicated the docs it linked to. Roughly half of it is gone. The install path, the
five topologies, and the API are still there, now shown with curl instead of described.

The site has a share card. Links to the page now unfurl with an image and the tags
that point at it, and site/og.source.html keeps the source the card was cut from, so
the next edit is not a redraw from scratch. The second button demonstrates the thing
instead of claiming it, and the prerequisites end with the device that proves them.

Upgrading is npm install kukuroo@0.1.3. Nothing re-enrolls, no key changes, and no
route behaves differently.

v0.1.2

Three fixes, all of them for failures that said nothing while they happened.

A device whose deployment was re-keyed can enroll again. subscribe() does not
replace a subscription created under a different VAPID key; it throws
InvalidStateError. So a phone that had enrolled against an older keypair could
never enroll again from the page, however many times its owner tapped the button,
and the only remaining fix was deleting the installed web app. The enrollment page
now reads the key the browser is holding, drops the subscription when it does not
match, and falls back to unsubscribing on the throw where the browser will not
expose it. It deliberately does not unsubscribe whenever it is unsure:
re-subscribing mints a fresh endpoint, so guessing would re-enroll healthy devices
and orphan their rows.

kukuroo init --no-deploy no longer creates a Worker. wrangler secret bulk
against a Worker that does not exist creates it, and the secret upload ran before
the deploy check. A run told to stop before going live therefore put a script on
your Cloudflare account, holding real secrets, with its workers.dev hostname
claimed. The upload now waits for the deploy, and the keys are written to disk
only. Finish such a setup with npx wrangler deploy followed by npx kukuroo init --resume. The read that refuses to generate a second VAPID key for a Worker
already holding one still runs.

GET <prefix>/public-key names the variable it is missing. An unset
KUKUROO_VAPID_PRIVATE was reported as "the VAPID key on this Worker is not
usable", which is also what a corrupt key says, so an operator could not tell a
skipped setup step from a broken one. It now names the variable, the same as
/push/send already did. This is the worse of the two routes to be vague on: the
enrollment page fetches it, so the mistake surfaces on somebody's phone first.

Upgrading is npm install kukuroo@0.1.2 and a deploy. Nothing re-enrolls, and no
keys change.

v0.1.0

First published release: npm install kukuroo now works.

Kukuroo sends Web Push notifications to your own devices from anything that can
make an HTTP request. A Cloudflare Worker plus KV holds the subscriptions and
signs the pushes itself, so there is no third-party notification service in the
path and no app to install.

• npx kukuroo init scaffolds a standalone Worker, or mounts the routes into a
  Worker you already have. It asks what it needs and generates every secret up
  front.
• Works with an existing website on any host: a subscription binds to the
  enrolling page's origin and the VAPID keypair, never the Worker's address.
  Five topologies are documented in the README.
• Cross-origin enrolment via KUKUROO_ALLOWED_ORIGINS (exact origins, no
  wildcard). send is never CORS-enabled, by design.
• Declarative Web Push, so iOS 16.4+ Home Screen web apps get notifications
  with no service worker.

Early software: tested end to end against a real iPhone, but installed by
exactly one person so far. Please report rough edges.