docs: stale staging URLs in JS-side examples (yivi.app aliases serve fake K8s cert)

[dobby-coder]

The JavaScript SDK code examples across the docs site point users at pkg.staging.yivi.app and fileshare.staging.yivi.app. Both hostnames resolve to the same staging ingress as the .staging.postguard.eu aliases, but the TLS cert served on the yivi.app names is the placeholder K8s cert (O=Acme Co; CN=Kubernetes Ingress Controller Fake Certificate). Any real client doing TLS validation rejects the connection. Anyone following the quickstart fails before reaching the PKG.

Ruben flagged this exact follow-up in commit c7e8413 (PR #93, 2026-05-16): "the docs still reference fileshare.staging.yivi.app in JS-side snippets and fileshare.postguard.eu as a production host — leaving those for a separate review since neither was part of this rename." This issue picks up that thread.

Canonical URLs (verified)

Source of truth: postguard-js/scripts/smoke.mjs and postguard-examples/pg-sveltekit/.env.example both use:

Environment	PKG	Cryptify
Staging	https://pkg.staging.postguard.eu	https://storage.staging.postguard.eu
Production	https://pkg.postguard.eu	https://storage.postguard.eu

Verified live (2026-05-26): pkg.staging.postguard.eu/v2/parameters returns HTTP 405 (real server), storage.staging.postguard.eu/health returns 200. The yivi.app aliases return the K8s placeholder cert and 404 on the API path. fileshare.postguard.eu does not serve /health; storage.postguard.eu/health returns 200.

Files to update

JS-side snippets (replace pkg.staging.yivi.app with pkg.staging.postguard.eu, fileshare.staging.yivi.app with storage.staging.postguard.eu):

• docs/index.md lines 47-48
• docs/repos/postguard-js.md lines 29-30 and 86-87
• docs/repos/pg-sveltekit.md lines 42-43 and 64-65
• docs/sdk/getting-started.md lines 33-34
• docs/sdk/js-encryption.md lines 98-99

Production Cryptify (one line, replace fileshare.postguard.eu with storage.postguard.eu):

• docs/repos/pg-dotnet.md line 47

Source-link side effect

docs/repos/pg-sveltekit.md lines 42-43 and 64-65 carry source links to the pinned commit 3d06342fad2c749ca4d043070d1ad9c831c7bfc1 in postguard-examples. The pinned file at that hash already uses pkg.staging.postguard.eu and fileshare.staging.postguard.eu (verified via raw.githubusercontent.com), so the rendered snippet currently does not match the source it links to. Updating the snippets to the canonical URLs also fixes this snippet-vs-source drift, though it leaves a small mismatch on the Cryptify host (pinned file has fileshare., canonical is storage.). The cleanest fix is to repin the source link to a newer commit on main that uses the canonical hosts, or to repin to the storage.staging.postguard.eu rename commit in postguard-examples, and update the snippet text to match exactly what is at that hash.

Verification

After the edit, run npm run docs:build (no warnings expected, build ~7s) and grep -rEn 'yivi\.app|fileshare\.postguard\.eu' docs/ should return nothing under non-dist/ paths.

[dobby-coder]

/dobby

[dobby-coder]

Dobby has received the request! Routing to the right specialist now...

[dobby-coder]

Plan

Scope: replace the staging *.yivi.app URLs (which serve the K8s placeholder cert and break TLS validation) with the canonical *.staging.postguard.eu hosts, plus the one production fileshare.postguard.eu → storage.postguard.eu swap. Exact files/lines as enumerated in the issue.

Replacements

From	To
pkg.staging.yivi.app	pkg.staging.postguard.eu
fileshare.staging.yivi.app	storage.staging.postguard.eu
fileshare.postguard.eu (prod, pg-dotnet only)	storage.postguard.eu

Files

• docs/index.md (lines 47-48)
• docs/repos/postguard-js.md (lines 29-30, 86-87)
• docs/repos/pg-sveltekit.md (lines 42-43, 64-65)
• docs/sdk/getting-started.md (lines 33-34)
• docs/sdk/js-encryption.md (lines 98-99)
• docs/repos/pg-dotnet.md (line 47)

Final sweep: grep -rEn 'pkg\.staging\.yivi\.app|fileshare\.staging\.yivi\.app|fileshare\.postguard\.eu' docs/ must return empty. Other yivi.app mentions (the Yivi brand, is.yivi.app, schemes.yivi.app, docs.yivi.app) are legitimate and stay.

Source-link side effect (pg-sveltekit.md)

The two pg-sveltekit snippets are pinned to 3d06342fad... in postguard-examples. I verified the file at that hash via raw.githubusercontent.com:

• .env.example and config.ts at the pin use pkg.staging.postguard.eu and fileshare.staging.postguard.eu.

After the URL fix:

• PKG line now matches the pinned source (improvement — was previously a yivi.app drift).
• Cryptify line still drifts: snippet will read storage. while pinned source reads fileshare..

I considered repinning to a newer hash in postguard-examples (e.g. main at 8f312b9d11f4, where both URLs are canonical), but that hash drops PG_API_KEY from .env.example and removes config.server.ts entirely. Repinning would force a larger rewrite of the surrounding snippet text and break the third source link on the page. Out of scope here; better as its own follow-up after we decide whether to track the post-API-key-drop structure or stay on the older form.

Verification

• npm run docs:build (expect ~7s, no warnings).
• grep -rEn 'pkg\.staging\.yivi\.app|fileshare\.staging\.yivi\.app|fileshare\.postguard\.eu' docs/ returns nothing.

PR

Draft PR on a new branch, Fixes #108.