@protobase/cli 0.73.0 → 0.73.2

package/dist/build/service-worker-push-code.js

@@ -8,9 +8,13 @@ import { pushRecord } from "@protobase/schema/internal";
 *   names the subscription's endpoint and the push names the record's user. A push without a title shows the app's
 *   name alone. A push with no record, or for another endpoint or user, shows nothing: the worker closes what it showed,
 *   clears the badge, drops the record and unsubscribes.
-* - `notificationclick` opens the notification's url only when it is an absolute `http` or `https` URL, parsed without
-*   a base: on the worker's own origin in a window of the app, focused and navigated there, or in a new window when none
-*   is open; on any other origin always in a new window. Anything else opens nothing, whoever showed the notification.
+* - A push's tap opens its `notification.navigate`, or its `url` when it has none, and each of its `notification.actions`
+*   shows as a button that opens the action's own `navigate`, or the tap's url when it has none. Nothing else in the
+*   push, such as its `data`, is kept for a tap.
+* - `notificationclick` opens the tapped action's url, or the notification's for a tap on no action it knows, only when
+*   it is an absolute `http` or `https` URL, parsed without a base: on the worker's own origin in a window of the app,
+*   focused and navigated there, or in a new window when none is open; on any other origin always in a new window.
+*   Anything else opens nothing, whoever showed the notification, and a failing action never falls back to another url.
 * - `pushsubscriptionchange` marks an existing record for renewal, which the helper registers once its user is signed
 *   in; the worker has no token to do so itself.
 */
@@ -59,6 +63,22 @@ const pushData = (data) => {
 }
 
 const text = (value) => (typeof value === 'string' ? value : undefined)
+const plainObject = (value) => value !== null && typeof value === 'object' && !Array.isArray(value)
+
+// The checked urls a tap may open: the notification's, and per action [action, url], with null for a navigate that
+// fails, so its button opens nothing. Pairs rather than an object keyed by the push's action names.
+const tapTargets = (push) => {
+  const notification = plainObject(push.notification) ? push.notification : {}
+  const url = notification.navigate !== undefined ? tapUrl(notification.navigate) : tapUrl(push.url)
+  const actions = (Array.isArray(notification.actions) ? notification.actions : []).filter(
+    (action) => plainObject(action) && text(action.action) !== undefined && text(action.title) !== undefined,
+  )
+  return {
+    url,
+    buttons: actions.map((action) => ({ action: action.action, title: action.title })),
+    actions: actions.map((action) => [action.action, action.navigate === undefined ? url ?? null : tapUrl(action.navigate) ?? null]),
+  }
+}
 
 // This browser is no longer registered for anyone: nothing it showed stays, and it gets no more pushes.
 const forgetPush = async () => {
@@ -75,11 +95,12 @@ const showPush = async (data) => {
   const push = pushData(data)
   if (!push || text(push.title) === undefined) return self.registration.showNotification(text(record.appName) || self.location.host, {})
   if (push.user !== record.userId) return forgetPush()
-  const url = tapUrl(push.url)
+  const { url, buttons, actions } = tapTargets(push)
   const options = {}
   if (text(push.body) !== undefined) options.body = push.body
   if (text(push.tag) !== undefined) options.tag = push.tag
-  if (url !== undefined) options.data = { url }
+  if (buttons.length > 0) options.actions = buttons
+  if (url !== undefined || actions.length > 0) options.data = { ...(url !== undefined && { url }), ...(actions.length > 0 && { actions }) }
   if (typeof push.badge === 'number' && self.navigator.setAppBadge) await self.navigator.setAppBadge(push.badge)
   return self.registration.showNotification(push.title, options)
 }
@@ -98,15 +119,22 @@ const openInApp = async (url) => {
   }
 }
 
-const openTap = (notification) => {
+// The url a tap opens, checked again: page code may show a notification with any data.
+const tappedUrl = (data, action) => {
+  if (!plainObject(data)) return undefined
+  const pair = action && Array.isArray(data.actions) ? data.actions.find((entry) => Array.isArray(entry) && entry[0] === action) : undefined
+  return tapUrl(pair ? pair[1] : data.url)
+}
+
+const openTap = (notification, action) => {
   notification.close()
-  const url = tapUrl(notification.data && notification.data.url)
+  const url = tappedUrl(notification.data, action)
   if (url === undefined) return Promise.resolve()
   return new URL(url).origin === self.location.origin ? openInApp(url) : self.clients.openWindow(url)
 }
 
 self.addEventListener('push', (event) => event.waitUntil(showPush(event.data)))
-self.addEventListener('notificationclick', (event) => event.waitUntil(openTap(event.notification)))
+self.addEventListener('notificationclick', (event) => event.waitUntil(openTap(event.notification, event.action)))
 self.addEventListener('pushsubscriptionchange', (event) => {
   event.waitUntil(readPushRecord().then((record) => record && writePushRecord({ ...record, renew: true })))
 })

package/dist/cli/package.js

@@ -1,4 +1,4 @@
 //#region package.json
-var version = "0.73.0";
+var version = "0.73.2";
 //#endregion
 export { version };

package/dist/mobile/build.js

@@ -1,5 +1,6 @@
 import { androidSigning } from "./android-signing.js";
 import { runChild } from "./child-process.js";
+import { buildIosAutomatic, iosApiKey } from "./ios-release.js";
 import { copyRelease, releaseFile } from "./release-output.js";
 import { prepareReleaseProject } from "./release-project.js";
 import { prepare, summary } from "./run.js";
@@ -11,25 +12,24 @@ const gradleArgs = [
 	"--no-configuration-cache",
 	"-Pkotlin.compiler.execution.strategy=in-process"
 ];
-const capBuildIos = ({ team, manual }) => [
+const capBuildManual = (team, { certificate, profile }) => [
 	"build",
 	"ios",
 	"--xcode-team-id",
 	team,
-	...manual ? [
-		"--xcode-signing-style",
-		"manual",
-		"--xcode-signing-certificate",
-		manual.certificate,
-		"--xcode-provisioning-profile",
-		manual.profile
-	] : []
+	"--xcode-signing-style",
+	"manual",
+	"--xcode-signing-certificate",
+	certificate,
+	"--xcode-provisioning-profile",
+	profile
 ];
 /** `protobase mobile build`: generates the native project as a release, builds it signed and copies the binary out. */
 const mobileBuild = async (input, out, deps = {}) => {
 	const { version, outDir, ios, ...mobile } = input;
 	if (mobile.platform === "ios" && !ios) throw new Error("An iOS release is signed by your Apple Developer team: pass --team");
 	const signing = mobile.platform === "android" ? androidSigning(process.env, mobile.projectDir) : void 0;
+	const apiKey = ios && !ios.manual ? iosApiKey(process.env, mobile.projectDir) : void 0;
 	const prepared = await prepare({
 		...mobile,
 		release: true
@@ -45,7 +45,16 @@ const mobileBuild = async (input, out, deps = {}) => {
 				...signing.env
 			}
 		});
-	} else await prepared.cap(capBuildIos(ios));
+	} else {
+		const { team, manual } = ios;
+		if (manual) await prepared.cap(capBuildManual(team, manual));
+		else await buildIosAutomatic({
+			ws: prepared.ws,
+			env: prepared.env,
+			team,
+			key: apiKey
+		}, deps.run ?? runChild);
+	}
 	const file = await copyRelease(releaseFile(prepared.ws, mobile.platform), outDir, `${prepared.appId}-${version.version}-${version.build}`);
 	out(`release ${path.relative(mobile.projectDir, file)}\n`);
 };

package/dist/mobile/capacitor-config.js

@@ -8,7 +8,8 @@ const liveUpdatePlugin = "@capawesome/capacitor-live-update";
 const readyTimeout = 3e4;
 /**
 * The app's `capacitor.config.json`, every key it sets named here. It never sets `server.url`, the hostname or the
-* schemes (the API's CORS list names Capacitor's default origins), or WebView debugging (on in debug builds only).
+* schemes (the API's CORS list names Capacitor's default origins). WebView debugging is off in an iOS release by name:
+* Capacitor's prebuilt simulator framework is a Debug build, so its default lists a Release app in Safari's Develop menu.
 * `plugins` configures ProtobaseAuth, the keyboard plugin and, with the live updater, what its guard needs: the key
 * releases are signed with, where they come from, the binary's fingerprint, shell version and the order of its own
 * files, background updates off, a rolled-back bundle blocked and `readyTimeout`, within which the shell must call
@@ -19,7 +20,7 @@ const readyTimeout = 3e4;
 * guards it. The file ships outside the app's web part, so the fingerprint in the user agent and ProtobaseAuth's
 * origins are beyond page script and a live update.
 */
-const capacitorConfig = ({ appId, appName, fingerprint, shellVersion, plugins, liveUpdate, allowances, apiOrigin, platform }) => ({
+const capacitorConfig = ({ appId, appName, fingerprint, shellVersion, plugins, liveUpdate, allowances, apiOrigin, platform, release }) => ({
 	appId,
 	appName,
 	webDir: "web",
@@ -50,7 +51,8 @@ const capacitorConfig = ({ appId, appName, fingerprint, shellVersion, plugins, l
 	android: {
 		resolveServiceWorkerRequests: false,
 		...allowances.mixedContent && { allowMixedContent: true }
-	}
+	},
+	...release && platform === "ios" && { ios: { webContentsDebuggingEnabled: false } }
 });
 /** Writes the config into the workspace `dir`, removing the `.ts` and `.js` configs Capacitor would read instead. */
 const writeCapacitorConfig = async (dir, config) => {

package/dist/mobile/ios-release.js

@@ -0,0 +1,99 @@
+import { statSync } from "node:fs";
+import path from "node:path";
+import { rm, writeFile } from "node:fs/promises";
+//#region src/mobile/ios-release.ts
+const apiKeyVariables = [
+	"PROTOBASE_IOS_API_KEY_PATH",
+	"PROTOBASE_IOS_API_KEY_ID",
+	"PROTOBASE_IOS_API_KEY_ISSUER"
+];
+/**
+* The API key in `env`, checked before anything is installed: none of its variables or all of them, the key a file,
+* made absolute against the project folder since xcodebuild runs in the native project. Without it Xcode signs with
+* the account in its settings.
+*/
+const iosApiKey = (env, projectDir) => {
+	const missing = apiKeyVariables.filter((key) => !env[key]);
+	if (missing.length === apiKeyVariables.length) return;
+	if (missing.length > 0) throw new Error(`Signing with an App Store Connect API key takes all of ${apiKeyVariables.join(", ")}: set ${missing.join(", ")}`);
+	const file = path.resolve(projectDir, env.PROTOBASE_IOS_API_KEY_PATH);
+	if (!statSync(file, { throwIfNoEntry: false })?.isFile()) throw new Error(`PROTOBASE_IOS_API_KEY_PATH names ${file}, which is not a file`);
+	return {
+		path: file,
+		id: env.PROTOBASE_IOS_API_KEY_ID,
+		issuer: env.PROTOBASE_IOS_API_KEY_ISSUER
+	};
+};
+const archive = "App.xcarchive";
+const exportOptions = "archive.plist";
+const provisioningArgs = (key) => ["-allowProvisioningUpdates", ...key ? [
+	"-authenticationKeyPath",
+	key.path,
+	"-authenticationKeyID",
+	key.id,
+	"-authenticationKeyIssuerID",
+	key.issuer
+] : []];
+/** xcodebuild's arguments to archive the release for `team`. */
+const iosArchiveArgs = (team, key) => [
+	"-project",
+	"App.xcodeproj",
+	"-scheme",
+	"App",
+	"-configuration",
+	"Release",
+	"-destination",
+	"generic/platform=iOS",
+	"-archivePath",
+	archive,
+	"archive",
+	`DEVELOPMENT_TEAM=${team}`,
+	...provisioningArgs(key)
+];
+/** xcodebuild's arguments to export the archive as an .ipa into `output`, where `releaseFile` finds it. */
+const iosExportArgs = (key) => [
+	"-exportArchive",
+	"-archivePath",
+	archive,
+	"-exportOptionsPlist",
+	exportOptions,
+	"-exportPath",
+	"output",
+	...provisioningArgs(key)
+];
+/** The export options of an App Store build `team` signs automatically; `team` is an id `--team` checked. */
+const iosExportOptions = (team) => `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+<key>method</key>
+<string>app-store-connect</string>
+<key>signingStyle</key>
+<string>automatic</string>
+<key>teamID</key>
+<string>${team}</string>
+</dict>
+</plist>
+`;
+/**
+* Archives and exports the iOS project in `ws` with automatic signing. xcodebuild runs here rather than through
+* `cap build ios`, which lets Xcode create nothing while archiving and cannot pass an API key to either step.
+*/
+const buildIosAutomatic = async ({ ws, env, team, key }, run) => {
+	const cwd = path.join(ws, "ios", "App");
+	await run("xcodebuild", iosArchiveArgs(team, key), {
+		cwd,
+		env
+	});
+	await writeFile(path.join(cwd, exportOptions), iosExportOptions(team));
+	await run("xcodebuild", iosExportArgs(key), {
+		cwd,
+		env
+	});
+	await rm(path.join(cwd, archive), {
+		recursive: true,
+		force: true
+	});
+};
+//#endregion
+export { buildIosAutomatic, iosApiKey, iosArchiveArgs, iosExportArgs, iosExportOptions };

package/dist/mobile/run.js

@@ -71,7 +71,8 @@ const prepare = async ({ projectDir, platform, api, extensions, live, release },
 		plugins,
 		allowances,
 		apiOrigin: url.origin,
-		platform
+		platform,
+		...release && { release }
 	};
 	await writeCapacitorConfig(ws, capacitorConfig({
 		...config,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@protobase/cli",
-  "version": "0.73.0",
+  "version": "0.73.2",
   "description": "The protobase command: scaffold, doctor, dev, build and serve a Protobase project.",
   "license": "Apache-2.0",
   "repository": {
@@ -43,13 +43,13 @@
   "dependencies": {
     "@better-auth/core": "^1.7.12",
     "@hono/node-server": "^2.1.3",
-    "@protobase/config": "0.73.0",
-    "@protobase/layout": "0.73.0",
-    "@protobase/query": "0.73.0",
-    "@protobase/schema": "0.73.0",
-    "@protobase/server": "0.73.0",
-    "@protobase/ui": "0.73.0",
-    "@protobase/workflows": "0.73.0",
+    "@protobase/config": "0.73.2",
+    "@protobase/layout": "0.73.2",
+    "@protobase/query": "0.73.2",
+    "@protobase/schema": "0.73.2",
+    "@protobase/server": "0.73.2",
+    "@protobase/ui": "0.73.2",
+    "@protobase/workflows": "0.73.2",
     "@react-email/render": "^2.1.0",
     "@scalar/hono-api-reference": "^0.12.10",
     "@sentry/vite-plugin": "^11.10.0",

package/skills/protobase/references/guides/mobile-app.md

@@ -118,7 +118,9 @@ Use it as the upload key with Play App Signing. Set these variables in your shel
 
 Only Gradle gets them, for the length of the build: npm, its install scripts and Capacitor never do. The build needs the Android SDK and JDK 21.
 
-**iOS**, on a Mac with Xcode: `--team` is your Apple Developer team id, shown in your account's membership details. Xcode signs with the certificates and profiles of the account you added in its settings. For manual signing, pass `--certificate <name>` and `--profile <name>` too. <gap>Manual signing cannot use a certificate or profile name that holds `<`, `>` or `&` because writing the escaped export options is not implemented.</gap> If automatic signing finds no profile for a new app, run `protobase mobile open ios`, pick the team in Signing & Capabilities and archive once from Xcode (Product, Archive), which creates the profile; then build again.
+**iOS**, on a Mac with Xcode: `--team` is your Apple Developer team id, shown in your account's membership details. Xcode signs with the certificates and profiles of the account you added in its settings. For manual signing, pass `--certificate <name>` and `--profile <name>` too. <gap>Manual signing cannot use a certificate or profile name that holds `<`, `>` or `&` because writing the escaped export options is not implemented.</gap> Xcode creates the certificates and profiles a new app lacks.
+
+To sign without an account in Xcode, as on a build machine, make an App Store Connect API key with the Admin role and set `PROTOBASE_IOS_API_KEY_PATH` to its `.p8` file, absolute or relative to the project folder, `PROTOBASE_IOS_API_KEY_ID` to its key id and `PROTOBASE_IOS_API_KEY_ISSUER` to its issuer id. Set all three or none; manual signing ignores them. The bundle id must exist on the team first.
 
 ## 7. Live updates
 

package/skills/protobase/references/reference/api.md

@@ -143,7 +143,7 @@ The queue is an `AuditQueue`, `{ publish(event): Promise<void> }`, the default e
 
 ## Filters
 
-`filter` and `order_by` are AIP-160 and AIP-132 text, checked against the model (filterable and sortable fields only). Functions: `in(field, v, ...)`, `search("text")` and bare words (every word, ignoring case, anywhere inside one of the resource's search fields, so `port` finds "Portfolio"; `%`, `_` and `\` are literal; a [`digitsEnd`](data-config.md#resource) field matches only the end of its digits), `similar(field, "text")`, `regex(field, "pattern")`, `isNull(field)`, `now()` with offsets such as `now() - 7d`. A filter is capped at 10,000 characters in a query string and 200,000 in a `:search` body.
+`filter` and `order_by` are AIP-160 and AIP-132 text, checked against the model (filterable and sortable fields only). Functions: `in(field, v, ...)`, `search("text")` and bare words (every word, ignoring case, anywhere inside one of the resource's search fields, so `port` finds "Portfolio"; `%`, `_` and `\` are literal; a [`digitsEnd`](data-config.md#resource) field matches only the end of its digits), `similar(field, "text")`, `regex(field, "pattern")`, `isNull(field)`, `now()` with offsets such as `now() - 7d`. A filter is capped at 10,000 characters in a query string and 200,000 in a `:search` body. A proxy in front of the API can refuse a long URL sooner with a `431`, counting the headers too: Protobase Cloud refused about 8,000 characters. So send a long filter to `:search`, as `client.list` does when its query string passes 4,000 characters.
 
 ## Writes
 

package/skills/protobase/references/reference/cli.md

@@ -650,7 +650,7 @@ Builds the project in the current directory as an iOS or Android app with Capaci
 - It installs `@protobase/mobile`, of the CLI's version, which pins Capacitor and its plugins, with the section's `plugins` into `.protobase/mobile/` with npm, when that changed, and on every run for a package from a local folder, given as `file:` or a path such as `../my-plugin`, which npm copies. When such a folder's dependencies are not the versions installed, it removes the workspace's `node_modules` and `package-lock.json` so npm resolves them again, and stops when a pin is still not met, as when two packages pin one dependency at different versions. It builds the app's files as [`build`](#build) does and keeps only `public/`, its `index.html` naming the API origin; writes `capacitor.config.json`, compiling in only the section's plugins; and generates the platform's native project again, replacing the last one.
 - `--api` is the server the app calls, the app's `url` by default: an http or https origin, plain http only to `localhost`, `127.0.0.1` and, on iOS, `[::1]`, or on Android `10.0.2.2`. An Android app calling `localhost` gets the port forwarded.
 - `run` runs the app on `--target`, or asks for one. On iOS, `--team` writes the Apple team id into the generated project and builds it once with xcodebuild allowed to create the development profile and register the device, `--target` or the one connected device, before Capacitor runs it there. With `--live` it opens `protobase dev` on `localhost:--port` instead of its own files. `open` opens the native project in Xcode or Android Studio.
-- `build` makes a signed release, an `.aab` (Android) or `.ipa` (iOS), and copies it to `--out`, which ignores itself in git when the command creates it, as `<appId>-<version>-<build number>`. Android signs through Gradle with the keystore, alias and passwords in `PROTOBASE_ANDROID_KEYSTORE`, `PROTOBASE_ANDROID_KEY_ALIAS`, `PROTOBASE_ANDROID_KEYSTORE_PASSWORD` and `PROTOBASE_ANDROID_KEY_PASSWORD`; iOS runs Capacitor's build with `--team`, and `--certificate` with `--profile` for manual signing.
+- `build` makes a signed release, an `.aab` (Android) or `.ipa` (iOS), and copies it to `--out`, which ignores itself in git when the command creates it, as `<appId>-<version>-<build number>`. Android signs through Gradle with the keystore, alias and passwords in `PROTOBASE_ANDROID_KEYSTORE`, `PROTOBASE_ANDROID_KEY_ALIAS`, `PROTOBASE_ANDROID_KEYSTORE_PASSWORD` and `PROTOBASE_ANDROID_KEY_PASSWORD`; iOS archives and exports with xcodebuild for `--team`, letting Xcode create certificates and profiles with the account in its settings, or with the App Store Connect API key in `PROTOBASE_IOS_API_KEY_PATH`, `PROTOBASE_IOS_API_KEY_ID` and `PROTOBASE_IOS_API_KEY_ISSUER`; `--certificate` with `--profile` signs manually through Capacitor's build.
 - A release calls an https server that is not this machine, and `--app-version` (one to three numbers) and `--build-number` (1 to 2100000000) are required.
 - npm and Capacitor get the CLI's environment without any variable named in the current directory's `.env*` files, nor the four `PROTOBASE_ANDROID_*` signing variables, which only Gradle gets, and with `CI=true`, which keeps Capacitor's telemetry off. The project's config, its extensions' configs and the web build run inside the CLI with no `PROTOBASE_ANDROID_*` variable left in its environment, even one the project's `.env` sets.
 - It prints the workspace, the API origin and the native fingerprint, which the app also sends in its user agent as `ProtobaseNative/<fingerprint>`: a hash of the native packages `@protobase/mobile` pins, at their versions, its own native contract, and the section's `plugins`, at the versions they give. A [mobile release](#mobile-releases) runs only on a binary of its own fingerprint. A Protobase release that pins the same native packages and keeps the same native contract keeps it; raise a plugin's version when the app's files start using a newer native feature of it, which changes it.

package/skills/protobase/references/reference/client.md

@@ -17,7 +17,7 @@ const { record, etag } = await api.get(orders, id)
 await api.update(orders, id, { status: 'shipped' }, etag) // 412 rejects with PreconditionFailedError
 ```
 
-Pass a resource builder to get its record type ([`InferRecord`](https://docs.protobase.net/api/schema/type-aliases/inferrecord/)), or a name for loose records. Filters are AIP-160 text or [`where`](https://docs.protobase.net/api/schema/variables/where/) results (printed with [`printFilter`](https://docs.protobase.net/api/schema/functions/printfilter/)). Errors are `ApiError` (`status`, `slug`, `errors`, `filterErrors` with spans, `blockedBy` for a delete other records point at), which `isApiError(error)` tells apart. Also: `search`, `create`, `remove`, `facets`, `series`, `histogram`, `map(resource, { latitude, longitude, zoom, filter?, orderBy?, fields? })` (the records in a map's view, or buckets of them, see [`:map`](api.md#maps)), `seek`, `reveal(resource, key, field)` (a [sensitive field](data-config.md#sensitive-fields)'s value), `generate(resource, key, action)` (runs an [AI action](ai.md#ai-actions) and resolves to the record as written), `meta(etag?, { signal? })`, `invoke(name, { body?, method?, path?, query? })` (one of the app's [API functions](../guides/api-functions.md#calling-a-function); its answer as parsed JSON, text, or a `Blob` for any other type), `history(resource, key, { pageSize?, pageToken? })` (a page of a record's [changes](history.md), newest first), `comments(resource, key, { pageSize?, pageToken? })`, `comment(resource, key, { body, mentions? })` and `mentionable(resource, key, query)` (a record's [comments](comments.md#the-endpoints), adding one, and the people it may mention), `form(name)`, `formChallenge(name)` and `submitForm(name, values, proof)` (a [public form](forms.md#routes)), `upload(resource, field, file, { onProgress?, signal? })` (a file for a [file field](files.md#uploading); its `value` goes in the next write, and `onProgress` uses XMLHttpRequest, since fetch reports no upload progress), `live({ onChanges, onResync, onRetry? })` (hears which records of the [live](live.md) resources change until the function it returns is called, connecting again by itself; every caller of one client shares one stream), `channel(resource, key)` (a record's [channel](channels.md#from-a-page), with its presence and broadcasts, every channel of the client on one socket).
+Pass a resource builder to get its record type ([`InferRecord`](https://docs.protobase.net/api/schema/type-aliases/inferrecord/)), or a name for loose records. Filters are AIP-160 text or [`where`](https://docs.protobase.net/api/schema/variables/where/) results (printed with [`printFilter`](https://docs.protobase.net/api/schema/functions/printfilter/)), and a list whose query string passes 4,000 characters goes by `:search`. Errors are `ApiError` (`status`, `slug`, `errors`, `filterErrors` with spans, `blockedBy` for a delete other records point at), which `isApiError(error)` tells apart. Also: `search`, `create`, `remove`, `facets`, `series`, `histogram`, `map(resource, { latitude, longitude, zoom, filter?, orderBy?, fields? })` (the records in a map's view, or buckets of them, see [`:map`](api.md#maps)), `seek`, `reveal(resource, key, field)` (a [sensitive field](data-config.md#sensitive-fields)'s value), `generate(resource, key, action)` (runs an [AI action](ai.md#ai-actions) and resolves to the record as written), `meta(etag?, { signal? })`, `invoke(name, { body?, method?, path?, query? })` (one of the app's [API functions](../guides/api-functions.md#calling-a-function); its answer as parsed JSON, text, or a `Blob` for any other type), `history(resource, key, { pageSize?, pageToken? })` (a page of a record's [changes](history.md), newest first), `comments(resource, key, { pageSize?, pageToken? })`, `comment(resource, key, { body, mentions? })` and `mentionable(resource, key, query)` (a record's [comments](comments.md#the-endpoints), adding one, and the people it may mention), `form(name)`, `formChallenge(name)` and `submitForm(name, values, proof)` (a [public form](forms.md#routes)), `upload(resource, field, file, { onProgress?, signal? })` (a file for a [file field](files.md#uploading); its `value` goes in the next write, and `onProgress` uses XMLHttpRequest, since fetch reports no upload progress), `live({ onChanges, onResync, onRetry? })` (hears which records of the [live](live.md) resources change until the function it returns is called, connecting again by itself; every caller of one client shares one stream), `channel(resource, key)` (a record's [channel](channels.md#from-a-page), with its presence and broadcasts, every channel of the client on one socket).
 
 With an absolute `baseUrl`, such as another app's `https://desk.example.com/api/v1`, the `url` of each [file](files.md) in a record the client answers is absolute too, on that API's origin, where the API answers a path on its own origin. `routedClient(own, sourceOf)` is one client over several APIs: each call about a resource goes to the client `sourceOf(resource)` gives, else to `own`, as the admin app does for [remote resources](remote-resources.md), and `sourceMeta(meta, source)` keeps the part of another API's `/meta` an app draws.
 

package/skills/protobase/references/reference/notifications.md

@@ -207,7 +207,7 @@ export const PushButton = () => {
 - Only someone signed in as themselves can turn push on: a visitor's click and staff signed in as the user do nothing.
 - On iPhone and iPad, push works in the app added to the Home Screen; a browser tab answers `unsupported`.
 - Signing out turns push off in this browser, and so does someone else signing in on it: what the browser showed is closed, the app's badge cleared, and the device removed. Signing in again as the same user keeps it on. Each push names the user its device is registered for, and the browser shows nothing of a push for another user than the one it holds push for.
-- A tap on a notification whose url is on your app's origin opens that page in the app, in an open window of it or a new one; any other url opens in a new tab.
+- A tap on a notification opens its `platform.web.payload` `notification.navigate`, or its `url` when it has none, and each of the payload's `notification.actions` shows as a button that opens its own `navigate`, or the notification's url when it has none. The browser checks each url again as the server does and opens nothing for one that fails; no other field, such as `data`, is ever opened. A url on your app's origin opens that page in the app, in an open window of it or a new one; any other url opens in a new tab.
 
 `protobase serve` and `protobase dev` both serve the service worker that shows notifications, `protobase dev` only when the app has `notifications`.