@protobase/cli 0.73.0 → 0.73.1

package/dist/cli/package.js

@@ -1,4 +1,4 @@
 //#region package.json
-var version = "0.73.0";
+var version = "0.73.1";
 //#endregion
 export { version };

package/dist/mobile/build.js

@@ -1,5 +1,6 @@
 import { androidSigning } from "./android-signing.js";
 import { runChild } from "./child-process.js";
+import { buildIosAutomatic, iosApiKey } from "./ios-release.js";
 import { copyRelease, releaseFile } from "./release-output.js";
 import { prepareReleaseProject } from "./release-project.js";
 import { prepare, summary } from "./run.js";
@@ -11,25 +12,24 @@ const gradleArgs = [
 	"--no-configuration-cache",
 	"-Pkotlin.compiler.execution.strategy=in-process"
 ];
-const capBuildIos = ({ team, manual }) => [
+const capBuildManual = (team, { certificate, profile }) => [
 	"build",
 	"ios",
 	"--xcode-team-id",
 	team,
-	...manual ? [
-		"--xcode-signing-style",
-		"manual",
-		"--xcode-signing-certificate",
-		manual.certificate,
-		"--xcode-provisioning-profile",
-		manual.profile
-	] : []
+	"--xcode-signing-style",
+	"manual",
+	"--xcode-signing-certificate",
+	certificate,
+	"--xcode-provisioning-profile",
+	profile
 ];
 /** `protobase mobile build`: generates the native project as a release, builds it signed and copies the binary out. */
 const mobileBuild = async (input, out, deps = {}) => {
 	const { version, outDir, ios, ...mobile } = input;
 	if (mobile.platform === "ios" && !ios) throw new Error("An iOS release is signed by your Apple Developer team: pass --team");
 	const signing = mobile.platform === "android" ? androidSigning(process.env, mobile.projectDir) : void 0;
+	const apiKey = ios && !ios.manual ? iosApiKey(process.env, mobile.projectDir) : void 0;
 	const prepared = await prepare({
 		...mobile,
 		release: true
@@ -45,7 +45,16 @@ const mobileBuild = async (input, out, deps = {}) => {
 				...signing.env
 			}
 		});
-	} else await prepared.cap(capBuildIos(ios));
+	} else {
+		const { team, manual } = ios;
+		if (manual) await prepared.cap(capBuildManual(team, manual));
+		else await buildIosAutomatic({
+			ws: prepared.ws,
+			env: prepared.env,
+			team,
+			key: apiKey
+		}, deps.run ?? runChild);
+	}
 	const file = await copyRelease(releaseFile(prepared.ws, mobile.platform), outDir, `${prepared.appId}-${version.version}-${version.build}`);
 	out(`release ${path.relative(mobile.projectDir, file)}\n`);
 };

package/dist/mobile/capacitor-config.js

@@ -8,7 +8,8 @@ const liveUpdatePlugin = "@capawesome/capacitor-live-update";
 const readyTimeout = 3e4;
 /**
 * The app's `capacitor.config.json`, every key it sets named here. It never sets `server.url`, the hostname or the
-* schemes (the API's CORS list names Capacitor's default origins), or WebView debugging (on in debug builds only).
+* schemes (the API's CORS list names Capacitor's default origins). WebView debugging is off in an iOS release by name:
+* Capacitor's prebuilt simulator framework is a Debug build, so its default lists a Release app in Safari's Develop menu.
 * `plugins` configures ProtobaseAuth, the keyboard plugin and, with the live updater, what its guard needs: the key
 * releases are signed with, where they come from, the binary's fingerprint, shell version and the order of its own
 * files, background updates off, a rolled-back bundle blocked and `readyTimeout`, within which the shell must call
@@ -19,7 +20,7 @@ const readyTimeout = 3e4;
 * guards it. The file ships outside the app's web part, so the fingerprint in the user agent and ProtobaseAuth's
 * origins are beyond page script and a live update.
 */
-const capacitorConfig = ({ appId, appName, fingerprint, shellVersion, plugins, liveUpdate, allowances, apiOrigin, platform }) => ({
+const capacitorConfig = ({ appId, appName, fingerprint, shellVersion, plugins, liveUpdate, allowances, apiOrigin, platform, release }) => ({
 	appId,
 	appName,
 	webDir: "web",
@@ -50,7 +51,8 @@ const capacitorConfig = ({ appId, appName, fingerprint, shellVersion, plugins, l
 	android: {
 		resolveServiceWorkerRequests: false,
 		...allowances.mixedContent && { allowMixedContent: true }
-	}
+	},
+	...release && platform === "ios" && { ios: { webContentsDebuggingEnabled: false } }
 });
 /** Writes the config into the workspace `dir`, removing the `.ts` and `.js` configs Capacitor would read instead. */
 const writeCapacitorConfig = async (dir, config) => {

package/dist/mobile/ios-release.js

@@ -0,0 +1,99 @@
+import { statSync } from "node:fs";
+import path from "node:path";
+import { rm, writeFile } from "node:fs/promises";
+//#region src/mobile/ios-release.ts
+const apiKeyVariables = [
+	"PROTOBASE_IOS_API_KEY_PATH",
+	"PROTOBASE_IOS_API_KEY_ID",
+	"PROTOBASE_IOS_API_KEY_ISSUER"
+];
+/**
+* The API key in `env`, checked before anything is installed: none of its variables or all of them, the key a file,
+* made absolute against the project folder since xcodebuild runs in the native project. Without it Xcode signs with
+* the account in its settings.
+*/
+const iosApiKey = (env, projectDir) => {
+	const missing = apiKeyVariables.filter((key) => !env[key]);
+	if (missing.length === apiKeyVariables.length) return;
+	if (missing.length > 0) throw new Error(`Signing with an App Store Connect API key takes all of ${apiKeyVariables.join(", ")}: set ${missing.join(", ")}`);
+	const file = path.resolve(projectDir, env.PROTOBASE_IOS_API_KEY_PATH);
+	if (!statSync(file, { throwIfNoEntry: false })?.isFile()) throw new Error(`PROTOBASE_IOS_API_KEY_PATH names ${file}, which is not a file`);
+	return {
+		path: file,
+		id: env.PROTOBASE_IOS_API_KEY_ID,
+		issuer: env.PROTOBASE_IOS_API_KEY_ISSUER
+	};
+};
+const archive = "App.xcarchive";
+const exportOptions = "archive.plist";
+const provisioningArgs = (key) => ["-allowProvisioningUpdates", ...key ? [
+	"-authenticationKeyPath",
+	key.path,
+	"-authenticationKeyID",
+	key.id,
+	"-authenticationKeyIssuerID",
+	key.issuer
+] : []];
+/** xcodebuild's arguments to archive the release for `team`. */
+const iosArchiveArgs = (team, key) => [
+	"-project",
+	"App.xcodeproj",
+	"-scheme",
+	"App",
+	"-configuration",
+	"Release",
+	"-destination",
+	"generic/platform=iOS",
+	"-archivePath",
+	archive,
+	"archive",
+	`DEVELOPMENT_TEAM=${team}`,
+	...provisioningArgs(key)
+];
+/** xcodebuild's arguments to export the archive as an .ipa into `output`, where `releaseFile` finds it. */
+const iosExportArgs = (key) => [
+	"-exportArchive",
+	"-archivePath",
+	archive,
+	"-exportOptionsPlist",
+	exportOptions,
+	"-exportPath",
+	"output",
+	...provisioningArgs(key)
+];
+/** The export options of an App Store build `team` signs automatically; `team` is an id `--team` checked. */
+const iosExportOptions = (team) => `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+<key>method</key>
+<string>app-store-connect</string>
+<key>signingStyle</key>
+<string>automatic</string>
+<key>teamID</key>
+<string>${team}</string>
+</dict>
+</plist>
+`;
+/**
+* Archives and exports the iOS project in `ws` with automatic signing. xcodebuild runs here rather than through
+* `cap build ios`, which lets Xcode create nothing while archiving and cannot pass an API key to either step.
+*/
+const buildIosAutomatic = async ({ ws, env, team, key }, run) => {
+	const cwd = path.join(ws, "ios", "App");
+	await run("xcodebuild", iosArchiveArgs(team, key), {
+		cwd,
+		env
+	});
+	await writeFile(path.join(cwd, exportOptions), iosExportOptions(team));
+	await run("xcodebuild", iosExportArgs(key), {
+		cwd,
+		env
+	});
+	await rm(path.join(cwd, archive), {
+		recursive: true,
+		force: true
+	});
+};
+//#endregion
+export { buildIosAutomatic, iosApiKey, iosArchiveArgs, iosExportArgs, iosExportOptions };

package/dist/mobile/run.js

@@ -71,7 +71,8 @@ const prepare = async ({ projectDir, platform, api, extensions, live, release },
 		plugins,
 		allowances,
 		apiOrigin: url.origin,
-		platform
+		platform,
+		...release && { release }
 	};
 	await writeCapacitorConfig(ws, capacitorConfig({
 		...config,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@protobase/cli",
-  "version": "0.73.0",
+  "version": "0.73.1",
   "description": "The protobase command: scaffold, doctor, dev, build and serve a Protobase project.",
   "license": "Apache-2.0",
   "repository": {
@@ -43,13 +43,13 @@
   "dependencies": {
     "@better-auth/core": "^1.7.12",
     "@hono/node-server": "^2.1.3",
-    "@protobase/config": "0.73.0",
-    "@protobase/layout": "0.73.0",
-    "@protobase/query": "0.73.0",
-    "@protobase/schema": "0.73.0",
-    "@protobase/server": "0.73.0",
-    "@protobase/ui": "0.73.0",
-    "@protobase/workflows": "0.73.0",
+    "@protobase/config": "0.73.1",
+    "@protobase/layout": "0.73.1",
+    "@protobase/query": "0.73.1",
+    "@protobase/schema": "0.73.1",
+    "@protobase/server": "0.73.1",
+    "@protobase/ui": "0.73.1",
+    "@protobase/workflows": "0.73.1",
     "@react-email/render": "^2.1.0",
     "@scalar/hono-api-reference": "^0.12.10",
     "@sentry/vite-plugin": "^11.10.0",

package/skills/protobase/references/guides/mobile-app.md

@@ -118,7 +118,9 @@ Use it as the upload key with Play App Signing. Set these variables in your shel
 
 Only Gradle gets them, for the length of the build: npm, its install scripts and Capacitor never do. The build needs the Android SDK and JDK 21.
 
-**iOS**, on a Mac with Xcode: `--team` is your Apple Developer team id, shown in your account's membership details. Xcode signs with the certificates and profiles of the account you added in its settings. For manual signing, pass `--certificate <name>` and `--profile <name>` too. <gap>Manual signing cannot use a certificate or profile name that holds `<`, `>` or `&` because writing the escaped export options is not implemented.</gap> If automatic signing finds no profile for a new app, run `protobase mobile open ios`, pick the team in Signing & Capabilities and archive once from Xcode (Product, Archive), which creates the profile; then build again.
+**iOS**, on a Mac with Xcode: `--team` is your Apple Developer team id, shown in your account's membership details. Xcode signs with the certificates and profiles of the account you added in its settings. For manual signing, pass `--certificate <name>` and `--profile <name>` too. <gap>Manual signing cannot use a certificate or profile name that holds `<`, `>` or `&` because writing the escaped export options is not implemented.</gap> Xcode creates the certificates and profiles a new app lacks.
+
+To sign without an account in Xcode, as on a build machine, make an App Store Connect API key with the Admin role and set `PROTOBASE_IOS_API_KEY_PATH` to its `.p8` file, absolute or relative to the project folder, `PROTOBASE_IOS_API_KEY_ID` to its key id and `PROTOBASE_IOS_API_KEY_ISSUER` to its issuer id. Set all three or none; manual signing ignores them. The bundle id must exist on the team first.
 
 ## 7. Live updates
 

package/skills/protobase/references/reference/api.md

@@ -143,7 +143,7 @@ The queue is an `AuditQueue`, `{ publish(event): Promise<void> }`, the default e
 
 ## Filters
 
-`filter` and `order_by` are AIP-160 and AIP-132 text, checked against the model (filterable and sortable fields only). Functions: `in(field, v, ...)`, `search("text")` and bare words (every word, ignoring case, anywhere inside one of the resource's search fields, so `port` finds "Portfolio"; `%`, `_` and `\` are literal; a [`digitsEnd`](data-config.md#resource) field matches only the end of its digits), `similar(field, "text")`, `regex(field, "pattern")`, `isNull(field)`, `now()` with offsets such as `now() - 7d`. A filter is capped at 10,000 characters in a query string and 200,000 in a `:search` body.
+`filter` and `order_by` are AIP-160 and AIP-132 text, checked against the model (filterable and sortable fields only). Functions: `in(field, v, ...)`, `search("text")` and bare words (every word, ignoring case, anywhere inside one of the resource's search fields, so `port` finds "Portfolio"; `%`, `_` and `\` are literal; a [`digitsEnd`](data-config.md#resource) field matches only the end of its digits), `similar(field, "text")`, `regex(field, "pattern")`, `isNull(field)`, `now()` with offsets such as `now() - 7d`. A filter is capped at 10,000 characters in a query string and 200,000 in a `:search` body. A proxy in front of the API can refuse a long URL sooner with a `431`, counting the headers too: Protobase Cloud refused about 8,000 characters. So send a long filter to `:search`, as `client.list` does when its query string passes 4,000 characters.
 
 ## Writes
 

package/skills/protobase/references/reference/cli.md

@@ -650,7 +650,7 @@ Builds the project in the current directory as an iOS or Android app with Capaci
 - It installs `@protobase/mobile`, of the CLI's version, which pins Capacitor and its plugins, with the section's `plugins` into `.protobase/mobile/` with npm, when that changed, and on every run for a package from a local folder, given as `file:` or a path such as `../my-plugin`, which npm copies. When such a folder's dependencies are not the versions installed, it removes the workspace's `node_modules` and `package-lock.json` so npm resolves them again, and stops when a pin is still not met, as when two packages pin one dependency at different versions. It builds the app's files as [`build`](#build) does and keeps only `public/`, its `index.html` naming the API origin; writes `capacitor.config.json`, compiling in only the section's plugins; and generates the platform's native project again, replacing the last one.
 - `--api` is the server the app calls, the app's `url` by default: an http or https origin, plain http only to `localhost`, `127.0.0.1` and, on iOS, `[::1]`, or on Android `10.0.2.2`. An Android app calling `localhost` gets the port forwarded.
 - `run` runs the app on `--target`, or asks for one. On iOS, `--team` writes the Apple team id into the generated project and builds it once with xcodebuild allowed to create the development profile and register the device, `--target` or the one connected device, before Capacitor runs it there. With `--live` it opens `protobase dev` on `localhost:--port` instead of its own files. `open` opens the native project in Xcode or Android Studio.
-- `build` makes a signed release, an `.aab` (Android) or `.ipa` (iOS), and copies it to `--out`, which ignores itself in git when the command creates it, as `<appId>-<version>-<build number>`. Android signs through Gradle with the keystore, alias and passwords in `PROTOBASE_ANDROID_KEYSTORE`, `PROTOBASE_ANDROID_KEY_ALIAS`, `PROTOBASE_ANDROID_KEYSTORE_PASSWORD` and `PROTOBASE_ANDROID_KEY_PASSWORD`; iOS runs Capacitor's build with `--team`, and `--certificate` with `--profile` for manual signing.
+- `build` makes a signed release, an `.aab` (Android) or `.ipa` (iOS), and copies it to `--out`, which ignores itself in git when the command creates it, as `<appId>-<version>-<build number>`. Android signs through Gradle with the keystore, alias and passwords in `PROTOBASE_ANDROID_KEYSTORE`, `PROTOBASE_ANDROID_KEY_ALIAS`, `PROTOBASE_ANDROID_KEYSTORE_PASSWORD` and `PROTOBASE_ANDROID_KEY_PASSWORD`; iOS archives and exports with xcodebuild for `--team`, letting Xcode create certificates and profiles with the account in its settings, or with the App Store Connect API key in `PROTOBASE_IOS_API_KEY_PATH`, `PROTOBASE_IOS_API_KEY_ID` and `PROTOBASE_IOS_API_KEY_ISSUER`; `--certificate` with `--profile` signs manually through Capacitor's build.
 - A release calls an https server that is not this machine, and `--app-version` (one to three numbers) and `--build-number` (1 to 2100000000) are required.
 - npm and Capacitor get the CLI's environment without any variable named in the current directory's `.env*` files, nor the four `PROTOBASE_ANDROID_*` signing variables, which only Gradle gets, and with `CI=true`, which keeps Capacitor's telemetry off. The project's config, its extensions' configs and the web build run inside the CLI with no `PROTOBASE_ANDROID_*` variable left in its environment, even one the project's `.env` sets.
 - It prints the workspace, the API origin and the native fingerprint, which the app also sends in its user agent as `ProtobaseNative/<fingerprint>`: a hash of the native packages `@protobase/mobile` pins, at their versions, its own native contract, and the section's `plugins`, at the versions they give. A [mobile release](#mobile-releases) runs only on a binary of its own fingerprint. A Protobase release that pins the same native packages and keeps the same native contract keeps it; raise a plugin's version when the app's files start using a newer native feature of it, which changes it.

package/skills/protobase/references/reference/client.md

@@ -17,7 +17,7 @@ const { record, etag } = await api.get(orders, id)
 await api.update(orders, id, { status: 'shipped' }, etag) // 412 rejects with PreconditionFailedError
 ```
 
-Pass a resource builder to get its record type ([`InferRecord`](https://docs.protobase.net/api/schema/type-aliases/inferrecord/)), or a name for loose records. Filters are AIP-160 text or [`where`](https://docs.protobase.net/api/schema/variables/where/) results (printed with [`printFilter`](https://docs.protobase.net/api/schema/functions/printfilter/)). Errors are `ApiError` (`status`, `slug`, `errors`, `filterErrors` with spans, `blockedBy` for a delete other records point at), which `isApiError(error)` tells apart. Also: `search`, `create`, `remove`, `facets`, `series`, `histogram`, `map(resource, { latitude, longitude, zoom, filter?, orderBy?, fields? })` (the records in a map's view, or buckets of them, see [`:map`](api.md#maps)), `seek`, `reveal(resource, key, field)` (a [sensitive field](data-config.md#sensitive-fields)'s value), `generate(resource, key, action)` (runs an [AI action](ai.md#ai-actions) and resolves to the record as written), `meta(etag?, { signal? })`, `invoke(name, { body?, method?, path?, query? })` (one of the app's [API functions](../guides/api-functions.md#calling-a-function); its answer as parsed JSON, text, or a `Blob` for any other type), `history(resource, key, { pageSize?, pageToken? })` (a page of a record's [changes](history.md), newest first), `comments(resource, key, { pageSize?, pageToken? })`, `comment(resource, key, { body, mentions? })` and `mentionable(resource, key, query)` (a record's [comments](comments.md#the-endpoints), adding one, and the people it may mention), `form(name)`, `formChallenge(name)` and `submitForm(name, values, proof)` (a [public form](forms.md#routes)), `upload(resource, field, file, { onProgress?, signal? })` (a file for a [file field](files.md#uploading); its `value` goes in the next write, and `onProgress` uses XMLHttpRequest, since fetch reports no upload progress), `live({ onChanges, onResync, onRetry? })` (hears which records of the [live](live.md) resources change until the function it returns is called, connecting again by itself; every caller of one client shares one stream), `channel(resource, key)` (a record's [channel](channels.md#from-a-page), with its presence and broadcasts, every channel of the client on one socket).
+Pass a resource builder to get its record type ([`InferRecord`](https://docs.protobase.net/api/schema/type-aliases/inferrecord/)), or a name for loose records. Filters are AIP-160 text or [`where`](https://docs.protobase.net/api/schema/variables/where/) results (printed with [`printFilter`](https://docs.protobase.net/api/schema/functions/printfilter/)), and a list whose query string passes 4,000 characters goes by `:search`. Errors are `ApiError` (`status`, `slug`, `errors`, `filterErrors` with spans, `blockedBy` for a delete other records point at), which `isApiError(error)` tells apart. Also: `search`, `create`, `remove`, `facets`, `series`, `histogram`, `map(resource, { latitude, longitude, zoom, filter?, orderBy?, fields? })` (the records in a map's view, or buckets of them, see [`:map`](api.md#maps)), `seek`, `reveal(resource, key, field)` (a [sensitive field](data-config.md#sensitive-fields)'s value), `generate(resource, key, action)` (runs an [AI action](ai.md#ai-actions) and resolves to the record as written), `meta(etag?, { signal? })`, `invoke(name, { body?, method?, path?, query? })` (one of the app's [API functions](../guides/api-functions.md#calling-a-function); its answer as parsed JSON, text, or a `Blob` for any other type), `history(resource, key, { pageSize?, pageToken? })` (a page of a record's [changes](history.md), newest first), `comments(resource, key, { pageSize?, pageToken? })`, `comment(resource, key, { body, mentions? })` and `mentionable(resource, key, query)` (a record's [comments](comments.md#the-endpoints), adding one, and the people it may mention), `form(name)`, `formChallenge(name)` and `submitForm(name, values, proof)` (a [public form](forms.md#routes)), `upload(resource, field, file, { onProgress?, signal? })` (a file for a [file field](files.md#uploading); its `value` goes in the next write, and `onProgress` uses XMLHttpRequest, since fetch reports no upload progress), `live({ onChanges, onResync, onRetry? })` (hears which records of the [live](live.md) resources change until the function it returns is called, connecting again by itself; every caller of one client shares one stream), `channel(resource, key)` (a record's [channel](channels.md#from-a-page), with its presence and broadcasts, every channel of the client on one socket).
 
 With an absolute `baseUrl`, such as another app's `https://desk.example.com/api/v1`, the `url` of each [file](files.md) in a record the client answers is absolute too, on that API's origin, where the API answers a path on its own origin. `routedClient(own, sourceOf)` is one client over several APIs: each call about a resource goes to the client `sourceOf(resource)` gives, else to `own`, as the admin app does for [remote resources](remote-resources.md), and `sourceMeta(meta, source)` keeps the part of another API's `/meta` an app draws.