Reference · Store-safe container

Web container behavior

Drel opens an exact HTTPS destination in a focused native web container. It gives a page environment information, not device authority.

Navigation and presentation

Input	Behavior	Boundary
HTTPS `url`	Opened after the user taps a notification or a message.	Use a publicly trusted HTTPS certificate. The Store container does not promise support for HTTP or self-signed TLS.
`mode=normal`	Standard Drel web view.	Normal is the safe default for unknown or absent mode.
`mode=immersive`	Fullscreen-oriented Drel container with an expandable return control.	The return/refresh control remains available; a webpage cannot suppress it.
`mode=modal`	Compact modal presentation.	Presentation is not a permission grant.

Drel preserves the destination URL and its query string. It does not append login credentials, device tokens or a trusted “push source” marker. Do not use URL parameters, referrer values or user-agent text as authorization proof.

Runtime environment

At document start, Drel exposes a read-only window.DrelRuntime. Pages must feature-detect it and work as ordinary web pages when it is missing.

window.DrelRuntime = {
  runtime: "web" | "offline-package",
  isOfflinePackage: true | false,
  presentation: "normal" | "immersive" | "modal",
  screen: { width, height, dpr },
  viewport: { width, height, scale },
  containerVersion: 1,
  offlinePackageVersion: 1,
  bridgeVersion: 0
}

The user agent also includes a versioned Drel product token with app/build, screen baseline, pixel ratio and container/offline/bridge versions. screen is a hardware baseline, while viewport, CSS safe-area variables and window.visualViewport reflect the current layout. They can change with rotation or presentation; do not infer a notch, entitlement, identity or permission from them.

Web compatibility and storage

Bridge is not available in the Store container. bridgeVersion: 0 means remote pages receive no native command surface. Standard browser APIs remain subject to iOS, WKWebView and the user’s permission settings, so feature-detect before depending on an API.

Origin storage such as cookies, IndexedDB and localStorage may be available as normal web storage, but it is not a durable account or authorization guarantee. Users, iOS or an app uninstall can clear it.
Do not rely on popups, downloads, camera, photo library, external-app handoff or background execution without testing the exact iOS release and providing a normal web fallback.
Resetting a Drel push address protects the notification capability. It must not be treated as a way to erase a website session or any web-origin data.

Push context and lifecycle

A notification can select a destination and presentation; it cannot silently approve a request, install an app, modify an offline package, or execute a sensitive native action. The page receives its own URL and normal browser lifecycle events. Build integrations so refresh, relaunch, unavailable network and a plain mobile browser all have a safe path.