@straitlink/cli 0.3.5 → 0.3.7

package/README.md

@@ -51,7 +51,7 @@ From a checkout of this repo: `node bin/strait.mjs init ../my-app`, or `npm link
 
 | Option | |
 |---|---|
-| `--key` | Publishable key (Dashboard → Get started). Env: `STRAIT_PUBLISHABLE_KEY` |
+| `--key` | Publishable key (Dashboard → Setup → Your keys). Env: `STRAIT_PUBLISHABLE_KEY` |
 | `--host` | Link domain, e.g. `acme.strait.link`. A pasted link works too. Env: `STRAIT_LINK_HOST` |
 | `--scheme` | Custom scheme: the one you typed in Dashboard → Apps & stores. Taken from `app.json`, or guessed from the package name (`com.acme.shop` → `acmeshop`); a guess is marked "(guessed from …)" in the output |
 | `--framework` | `react-native`, `expo`, `flutter` or `android`, to skip detection |
@@ -83,14 +83,14 @@ Android (assetlinks.json)
 | `--key` | Also check the publishable key. Env: `STRAIT_PUBLISHABLE_KEY`. Left out, the key check is skipped |
 | `--json` | The reports as JSON, for CI and agents |
 
-With a secret key (`STRAIT_SECRET_KEY` or `--secret-key`), `doctor` also runs [`strait app verify`](#whats-wrong-with-my-setup-strait-app-verify) and prints its checks under "Account"; `--host` is then optional. If those checks can't run (a refused or malformed key, no connection, the 6-a-minute limit) it says "Could not check" and exits `1`, never a silent pass. `--json` adds them as `verify`. If your CI sets `STRAIT_SECRET_KEY` and should check only the host, unset it for the doctor step (`env -u STRAIT_SECRET_KEY npx @straitlink/cli doctor --host …`).
+With a secret key (`STRAIT_SECRET_KEY` or `--secret-key`), `doctor` also runs [`strait app verify`](#whats-wrong-with-my-setup-strait-app-verify) and prints its checks under "Account"; `--host` is then optional. If those checks can't run (a refused or malformed key, no connection, the 6-a-minute limit) it says "Could not check". They are shown but don't change the exit code, so a CI job that already sets `STRAIT_SECRET_KEY` keeps passing as before; add `--strict` to exit `1` when one fails or can't run. `--json` adds them as `verify` (its own `ok` inside); the top-level `ok` matches the exit code.
 
 Exit codes: `0` no errors (warnings allowed), `1` a check failed, `2` usage problem. What a terminal can't see (intent filters, the Associated Domains entitlement) is checked by `doctor()` inside a debug build and by the [free tools](https://straitlink.in/tools/).
 
 ## Manage links: `strait links`
 
 ```bash
-export STRAIT_SECRET_KEY=st_live_…        # Dashboard → Settings → Secret keys
+export STRAIT_SECRET_KEY=st_live_…        # Dashboard → Settings → Keys
 npx @straitlink/cli links create summer https://acme.com/summer --campaign sale --tag email
 npx @straitlink/cli links list --status active --limit 20
 npx @straitlink/cli links qr summer --size 512          # writes summer.png
@@ -104,7 +104,7 @@ Exit codes: `0` done, `1` the API said no or can't be reached (its message on st
 ## Am I set up right? `strait test`
 
 ```bash
-export STRAIT_SECRET_KEY=st_live_…        # Dashboard → Settings → Secret keys
+export STRAIT_SECRET_KEY=st_live_…        # Dashboard → Settings → Keys
 npx @straitlink/cli test
 ```
 
@@ -126,7 +126,7 @@ One read-only pass: the engine answers (`GET /healthz`), the secret key is valid
 ## What's wrong with my setup? `strait app verify`
 
 ```bash
-export STRAIT_SECRET_KEY=st_live_…        # Dashboard → Settings → Secret keys (read or full access)
+export STRAIT_SECRET_KEY=st_live_…        # Dashboard → Settings → Keys (read or full access)
 npx @straitlink/cli app            # the setup Strait has: apps, link domains and their files, SDKs seen
 npx @straitlink/cli app verify     # every check, with the fix for each problem
 ```

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@straitlink/cli",
-  "version": "0.3.5",
+  "version": "0.3.7",
   "description": "Strait deep links from the terminal: init sets them up in a React Native, Expo, Flutter or Android app, doctor checks your link host, app verify checks your whole setup with a fix for each problem, links creates and lists links and saves QR codes.",
   "keywords": [
     "strait",

package/src/app.mjs

@@ -99,8 +99,9 @@ function formatVerify(answer) {
 }
 
 /** `strait doctor`'s account block: the verify answer, or why it could not run (never a silent pass). */
-export function formatAccount(answer) {
+export function formatAccount(answer, strict = false) {
   const head = 'Account (strait app verify)';
-  if (answer?.error) return lines([head, `  Could not check: ${answer.error}`]);
-  return lines([head, ...verifyLines(answer), '', verifyVerdict(answer)]);
+  const soft = !strict && answer?.ok !== true ? ['These checks don\'t change doctor\'s exit code: add --strict to make doctor fail on them.'] : [];
+  if (answer?.error) return lines([head, `  Could not check: ${answer.error}`, ...soft]);
+  return lines([head, ...verifyLines(answer), '', verifyVerdict(answer), ...soft]);
 }

package/src/cli.mjs

@@ -31,6 +31,7 @@ const OPTIONS = {
     cert: { type: 'string', multiple: true },
     'secret-key': { type: 'string' },
     'api-url': { type: 'string' },
+    strict: { type: 'boolean', default: false },
     json: { type: 'boolean', default: false },
   },
   links: {
@@ -77,7 +78,7 @@ Usage
   strait events add <name> [dir] [options]    Print ready-to-paste code that tracks an event
 
 init options
-  --key <st_pub_live_…>   Publishable key (Dashboard → Get started)
+  --key <st_pub_live_…>   Publishable key (Dashboard → Setup → Your keys)
   --host <host>           Your link domain, e.g. acme.strait.link
   --scheme <scheme>       Your app's custom scheme, the one in Dashboard → Apps & stores,
                           e.g. acmeshop (guessed from the package name if left out)
@@ -93,14 +94,15 @@ doctor options (the same checks and messages as doctor() in the SDKs)
   --cert <sha256>         Android signing certificate fingerprint (repeatable)
   --key <st_pub_live_…>   Also check the publishable key (env STRAIT_PUBLISHABLE_KEY)
   --secret-key <st_live_…>  Also run strait app verify (env STRAIT_SECRET_KEY); --host is then optional.
-                          If it can't run (refused key, no connection), doctor says so and exits 1
+                          If it can't run (refused key, no connection), doctor says so
+  --strict                Exit 1 when an account check fails or can't run (default: shown, exit unchanged)
   --api-url <url>         Engine for those checks (env STRAIT_API_URL, default https://strait.link)
   --json                  Print the reports as JSON
   With neither --android nor --ios, both files are checked and the apps they list are shown.
   Exit 1 when a check fails.
 
 links options
-  --secret-key <st_live_…>  Secret key (Dashboard → Settings → Secret keys). Prefer the
+  --secret-key <st_live_…>  Secret key (Dashboard → Settings → Keys). Prefer the
                             env STRAIT_SECRET_KEY: flags stay in your shell history
   --api-url <url>         API base (env STRAIT_API_URL, default https://strait.link)
   --title, --campaign, --tag <tag> (repeatable)   create: link details
@@ -194,7 +196,7 @@ export async function main(argv, io = {}) {
     if (canAsk && (!key || !host || !scheme)) {
       const ask = io.ask ?? (await terminalAsker(io.stdin ?? process.stdin, out));
       try {
-        key = key ?? (await askValid(ask, 'Publishable key (Dashboard → Get started, st_pub_live_…): ', normalizeKey, err));
+        key = key ?? (await askValid(ask, 'Publishable key (Dashboard → Setup → Your keys, st_pub_live_…): ', normalizeKey, err));
         host = host ?? (await askValid(ask, 'Link host (e.g. acme.strait.link): ', normalizeHost, err));
         if (!scheme) {
           const guess = suggestScheme(detectProject(dir) ?? {});
@@ -246,7 +248,7 @@ async function terminalAsker(input, output) {
 async function doctor({ values: v }, { out, env, io }) {
   const hostIn = v.host ?? env.STRAIT_LINK_HOST;
   const secretIn = v['secret-key'] ?? env.STRAIT_SECRET_KEY;
-  if (!hostIn && !secretIn) throw new UsageError('Missing --host: your link domain from Dashboard → Get started, e.g. --host acme.strait.link. Or set STRAIT_SECRET_KEY to check your whole setup.');
+  if (!hostIn && !secretIn) throw new UsageError('Missing --host: your link domain from Dashboard → Setup → Your keys, e.g. --host acme.strait.link. Or set STRAIT_SECRET_KEY to check your whole setup.');
   const fetchImpl = io.fetch ?? fetch;
   let result = { ok: true };
   if (hostIn) {
@@ -255,7 +257,8 @@ async function doctor({ values: v }, { out, env, io }) {
     result = await runDoctor({ host: normalizeHost(hostIn), key, android: v.android?.trim(), ios: v.ios?.trim(), certs: v.cert ?? [], fetch: fetchImpl });
   }
   if (secretIn) {
-    // A secret key adds the engine's checks (docs/adr/0003). If they can't run, say so and fail: never a silent pass.
+    // A secret key adds the engine's checks (docs/adr/0003), always shown; if they can't run, that is shown too.
+    // They change the exit code only with --strict, so a CI job that already sets the key keeps passing as before.
     try {
       const call = apiClient({ apiUrl: v['api-url'] ?? env.STRAIT_API_URL ?? DEFAULT_API_URL, key: secretKey(secretIn), fetch: fetchImpl, userAgent: `strait-cli/${CLI_VERSION}` });
       result.verify = await getVerify(call);
@@ -263,9 +266,9 @@ async function doctor({ values: v }, { out, env, io }) {
       if (!(e instanceof ApiError || e instanceof UsageError)) throw e;
       result.verify = { error: e.message };
     }
-    if (result.verify?.ok !== true) result.ok = false;
+    if (v.strict && result.verify?.ok !== true) result.ok = false;
   }
-  const text = v.json ? toJson(result) : [hostIn && formatDoctor(result), secretIn && formatAccount(result.verify)].filter(Boolean).join('\n\n');
+  const text = v.json ? toJson(result) : [hostIn && formatDoctor(result), secretIn && formatAccount(result.verify, v.strict)].filter(Boolean).join('\n\n');
   out.write(text + '\n');
   return result.ok ? 0 : 1;
 }

package/src/doctor.mjs

@@ -51,12 +51,12 @@ export function doctorFindings(input) {
   const key = input.publishableKey ?? '';
   if (key.startsWith('st_pub_')) findings.push(ok('key.ok', 'Publishable key is set'));
   else if (key.startsWith('st_live_') || key.startsWith('st_test_'))
-    findings.push(err('key.secret', 'This is a secret key, not the publishable key', 'Use the publishable key (st_pub_…) from Dashboard → Get started, and revoke this secret key in Dashboard → Settings → Secret keys: it has been inside your app.'));
-  else findings.push(err('key.invalid', 'Not a publishable key', 'Copy the publishable key (st_pub_…) from Dashboard → Get started.'));
+    findings.push(err('key.secret', 'This is a secret key, not the publishable key', 'Use the publishable key (st_pub_…) from Dashboard → Setup → Your keys, and revoke this secret key in Dashboard → Settings → Keys: it has been inside your app.'));
+  else findings.push(err('key.invalid', 'Not a publishable key', 'Copy the publishable key (st_pub_…) from Dashboard → Setup → Your keys.'));
 
   const host = doctorHost(input.endpoint ?? '');
   if (!host) {
-    findings.push(err('endpoint.invalid', "The endpoint isn't an https link domain", 'Set endpoint to your link domain from Dashboard → Get started, e.g. https://<handle>.strait.link.'));
+    findings.push(err('endpoint.invalid', "The endpoint isn't an https link domain", 'Set endpoint to your link domain from Dashboard → Setup → Your keys, e.g. https://<handle>.strait.link.'));
   } else if (input.file) findings.push(...hostFindings(input, host, input.file));
   return { ok: !findings.some((f) => f.severity === 'error'), findings };
 }
@@ -71,12 +71,12 @@ const notConfigured = (file) => file.status === 404 && file.body === NOT_CONFIGU
 function hostFindings(input, host, file) {
   const android = input.platform === 'android';
   if (file.status === undefined)
-    return [err('host.unreachable', `Can't reach ${host}`, 'Check that endpoint is your link domain (Dashboard → Get started) and that this device is online.')];
+    return [err('host.unreachable', `Can't reach ${host}`, 'Check that endpoint is your link domain (Dashboard → Setup → Your keys) and that this device is online.')];
   const apps = file.status === 200 ? listedApps(input.platform, file.body ?? '') : null;
   if (!apps && !notConfigured(file))
-    return [err('host.file_missing', `${host} doesn't serve ${android ? 'assetlinks.json' : 'apple-app-site-association'}`, 'Use your Strait link domain as endpoint (Dashboard → Get started); Strait serves this file there.')];
+    return [err('host.file_missing', `${host} doesn't serve ${android ? 'assetlinks.json' : 'apple-app-site-association'}`, 'Use your Strait link domain as endpoint (Dashboard → Setup → Your keys); Strait serves this file there.')];
   if (!apps?.size)
-    return [err('app.none', `No ${android ? 'Android' : 'iOS'} app is set up for ${host}`, `Fill in Dashboard → Apps & stores (${android ? 'package name and SHA-256 fingerprint' : 'Team ID and bundle ID'}), wait a minute, then check again. Already done? Make sure ${host} is your link domain from Dashboard → Get started.`)];
+    return [err('app.none', `No ${android ? 'Android' : 'iOS'} app is set up for ${host}`, `Fill in Dashboard → Apps & stores (${android ? 'package name and SHA-256 fingerprint' : 'Team ID and bundle ID'}), wait a minute, then check again. Already done? Make sure ${host} is your link domain from Dashboard → Setup → Your keys.`)];
 
   const listed = [...apps.keys()].join(', ');
   const app = input.appId?.trim();

package/src/install.mjs

@@ -23,10 +23,10 @@ export const sourceFor = (src, registry) => (typeof src.source === 'string' ? sr
  * `strait events add` reads them too: its iOS/Android eventId needs these SDKs.
  */
 export const VERSIONS = {
-  version: '0.11.4', // Swift (Unity is not written by this CLI)
-  rnVersion: '0.11.3',
-  flutterVersion: '0.10.6',
-  androidVersion: '0.10.4',
+  version: '0.11.6', // Swift (Unity is not written by this CLI)
+  rnVersion: '0.11.5',
+  flutterVersion: '0.10.8',
+  androidVersion: '0.10.6',
 };
 
 export const PACKAGES = {

package/src/links.mjs

@@ -14,7 +14,7 @@ export class ApiError extends Error {}
 /** The secret key for the link API, or a UsageError that says where to get one. Never echoes the value. */
 export function secretKey(value) {
   const k = String(value ?? '').trim().replace(/^['"]+|['"]+$/g, '').replace(/^Bearer\s+/i, '');
-  const where = 'Create one in Dashboard → Settings → Secret keys and set STRAIT_SECRET_KEY (or pass --secret-key).';
+  const where = 'Create one in Dashboard → Settings → Keys (https://app.straitlink.in/settings#keys) and set STRAIT_SECRET_KEY (or pass --secret-key).';
   if (!k) throw new UsageError(`The link API needs a secret key (st_live_…). ${where}`);
   if (k.startsWith('st_pub_')) throw new UsageError(`That is the publishable key (st_pub_…), which only works inside apps. The link API needs a secret key (st_live_…). ${where}`);
   if (!SECRET.test(k)) throw new UsageError(`That is not a secret key (st_live_… or st_test_…). ${where}`);

package/src/selftest.mjs

@@ -48,7 +48,7 @@ export async function runSelfTest({ call, apiUrl, key, fetch: fetchImpl }) {
     checks.push(pass('key', 'Key', `valid ${mode} key${prefix ? ` ${prefix}…` : ''} for workspace "${workspace.name ?? '?'}"${access}`));
   } catch (e) {
     if (!(e instanceof ApiError)) throw e;
-    checks.push(fail('key', 'Key', e.message, 'Create a secret key in Dashboard → Settings → Secret keys and set STRAIT_SECRET_KEY.'));
+    checks.push(fail('key', 'Key', e.message, 'Create a secret key in Dashboard → Settings → Keys (https://app.straitlink.in/settings#keys) and set STRAIT_SECRET_KEY.'));
     checks.push(...DOMAIN_CHECKS.map(([id, l]) => skip(id, l, 'needs a valid key')));
     return done();
   }

package/src/validate.mjs

@@ -15,15 +15,15 @@ const EXAMPLE_BODIES = new Set(['8fK2mQx7Lp4RtZ']);
  */
 export function normalizeKey(value) {
   let k = String(value ?? '').trim().replace(/^['"]+|['"]+$/g, '');
-  if (!k) throw new UsageError('A publishable key is required (--key st_pub_live_…). Find it in Dashboard → Get started.');
+  if (!k) throw new UsageError('A publishable key is required (--key st_pub_live_…). Find it in Dashboard → Setup → Your keys (https://app.straitlink.in/setup#keys).');
   if (SECRET_KEY.test(k)) {
     throw new UsageError(
-      'That is a secret key (st_live_…). Apps must use the publishable key (st_pub_live_…) from Dashboard → Get started. ' +
-        'If the secret key was pasted somewhere public, rotate it in Dashboard → Settings → Secret keys.',
+      'That is a secret key (st_live_…). Apps must use the publishable key (st_pub_live_…) from Dashboard → Setup → Your keys. ' +
+        'If the secret key was pasted somewhere public, rotate it in Dashboard → Settings → Keys.',
     );
   }
   const m = /^st_pub_(live|test)_(.*)$/.exec(k);
-  const where = (mode = 'live') => `Copy your real one from Dashboard → Get started (the Publishable key box): st_pub_${mode}_ followed by 32 letters and numbers.`;
+  const where = (mode = 'live') => `Copy your real one from Dashboard → Setup → Your keys (the Publishable key box): st_pub_${mode}_ followed by 32 letters and numbers.`;
   if (!m) throw new UsageError(`That is not a publishable key. ${where()}`);
   const [, mode] = m;
   let rest = m[2].replace(/\.$/, ''); // a full stop copied from a sentence
@@ -42,7 +42,7 @@ export function normalizeKey(value) {
 /** "https://Acme.strait.link/summer" → "acme.strait.link". */
 export function normalizeHost(value) {
   let h = String(value ?? '').trim().toLowerCase();
-  if (!h) throw new UsageError('A link host is required (--host acme.strait.link). It is your workspace link domain in Dashboard → Get started.');
+  if (!h) throw new UsageError('A link host is required (--host acme.strait.link). It is your workspace link domain in Dashboard → Setup → Your keys.');
   h = h.replace(/^[a-z][a-z0-9+.-]*:\/\//, '').replace(/[/?#].*$/, '').replace(/\.$/, '');
   const labels = h.split('.');
   if (h.length > 253 || labels.length < 2 || !labels.every((l) => LABEL.test(l)) || !/^[a-z]{2,}$/.test(labels.at(-1))) {

package/src/version.mjs

@@ -1,2 +1,2 @@
 // Kept equal to package.json version (test/links.test.mjs checks it). Sent as the API User-Agent.
-export const CLI_VERSION = '0.3.5';
+export const CLI_VERSION = '0.3.7';