@craft-native/ios 0.0.254 → 0.0.272

package/README.md

@@ -77,11 +77,19 @@ decoration. Resuming does not replay it. Available on both native renderers.
 The iOS support is built into the main `craft` CLI:
 
 `Pressable`, `TouchableOpacity`, and `TouchableHighlight` render as native
-pressable flow containers. `Modal` renders a parent-scoped blocking layer in native mode, with `visible`,
-`transparent`, `animationType`, `onShow`, `onDismiss`, and `onRequestClose`
-support. `FlatList` item roots receive the same `onLayout` callback as ordinary native
+pressable flow containers. `Modal` renders a parent-scoped native layer in native mode, with `visible`,
+`transparent`, `nonModal`, `dismissOnOutsideTap`, `animationType`, `onShow`,
+`onDismiss`, and `onRequestClose` support. Non-modal popups remain pass-through
+unless outside-tap dismissal is explicitly enabled. `FlatList` item roots receive the same `onLayout` callback as ordinary native
 views when rows are materialized or recycled.
 
+`View.measure` and non-modal `left`/`top` placement use the same `screenViewport`
+coordinate space. Safe-area and navigation-bar offsets are not added implicitly;
+anchored callers must clamp against the measured viewport when needed. Re-run
+measurement after the anchor or screen root emits `onLayout`, and after every
+`onScroll` from an ancestor; those are the host-neutral invalidation signals for
+repositioning an anchored popup.
+
 ```bash
 bun add craft-native
 ```
@@ -151,6 +159,9 @@ bounds and corners through layout changes.
 
 The opt-in `native` renderer hosts compiled `.stx` screens in JavaScriptCore and renders their `View`, `SafeAreaView`, `KeyboardAvoidingView`, `StatusBar`, `RefreshControl`, `Text`, `Button`, `Link`, `Checkbox`, `TextInput`, `Picker`, `DatePicker`, `Switch`, `Slider`, `ActivityIndicator`, `Icon`, `Image`, `ImageBackground`, `Video`, `Map`, `Svg`, `G`, `SvgText`, `ScrollView`, `SectionList`, and recycling `FlatList` nodes as UIKit controls. `StatusBar` and `RefreshControl` are screen/scroll utility nodes rather than visible children. `Map` uses MapKit for trail polylines and marker taps; its overlays carry flat latitude/longitude `geometry` arrays, `strokeWidth` is expressed in logical points, and the camera supports controlled `region`, one-time `initialRegion`, and `fitToBounds`. `Svg` is a DOM-free drawing surface; grouped `G` and `SvgText` nodes are painted inside it. `Icon` uses SF Symbols with the shared symbol/name contract and accessibility metadata. `SectionList` uses the same native scroll host for ordinary `.stx` slot children; grouped section data should use `FlatList` until the section-data protocol is available. `FlatList` uses `UICollectionView` with stable keyed rows, incremental diffs, grids, horizontal and inverted layouts, list chrome, and end-reached pagination. Native views support `onLayout` callbacks with point-based frame measurements that refresh after safe-area or orientation changes. Flex items support `flex`, `flexGrow`, `flexShrink`, and numeric `flexBasis` for main-axis space distribution. Native screens also expose the versioned capability bridge: JSON storage and SQLite survive relaunch, lifecycle and deep-link events are scoped to the top route, and local notifications use `UNUserNotificationCenter`. Enable each capability in `craft.config.json`; disabled calls preserve Craft's `CAPABILITY_DISABLED` rejection code and every request has deterministic timeout/cancellation behavior. The default remains `web`; existing iOS apps are unchanged. `Checkbox` supports controlled `checked`/`value`, indeterminate state, and boolean `onValueChange`; `Picker` renders `<select>`/`<option>` values with `onValueChange` or `onChange`; `DatePicker` emits local date/time values plus ISO and millisecond `timestamp` fields; `Switch` supports state-aware `trackColor`, `thumbColor`, and iOS `ios_backgroundColor`; `Slider` supports track/thumb tint props and `step` snapping; `Image` reports load lifecycle events and structured failures; `Video` uses an `AVPlayerViewController` attached to the native screen for URI playback, native controls, and route-safe teardown. `craft.navigation.setOptions` also accepts a `tabAccessory` destination beside the tab pill; it uses an app-local `path`, `title`, `symbol`, optional `badge`, and `accessibilityLabel`, and `null` clears it. The portable component, capability, list, style, image-source, event, accessibility, and reconciliation behavior is specified in the [Native STX guide](../../docs/guides/native-stx.md).
 
+`FlatList` rows are authored as keyed `:for` child rows in native STX; the
+maintained protocol does not serialize `data`/`renderItem` callbacks.
+
 JavaScriptCore has no DOM `window`; Craft aliases `globalThis.window` to
 `globalThis` before installing the native bridge so browser-safe SDK calls such
 as `window.craft.dialog.actionSheet()` reach the native capability host. This
@@ -220,9 +231,9 @@ Follow it with `selected` and content checks, then a full `swipe` to verify the
 next gesture still works. Synchronized XCTest gestures do not replace separate
 direct-input rapid-tap checks.
 
-The iOS host uses the shared tree-layout ABI for eligible definite-size,
-non-grid, non-wrapped containers and retains a local fallback for older
-runtimes or unsupported styles. Both paths implement wrapped-line and grid
+The iOS host uses the shared tree-layout ABI for eligible definite-size
+containers, including reverse and wrap-reverse direct flows, and retains a
+local fallback for older runtimes or unsupported styles. Both paths implement wrapped-line and grid
 `alignContent`, including `space-evenly`, so a missing optional shared symbol
 does not change placement semantics.
 Reverse flex directions also retain wrapped line order on the cross axis while

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@craft-native/ios",
-  "version": "0.0.254",
+  "version": "0.0.272",
   "homepage": "https://github.com/craft-native/craft/tree/main/packages/ios#readme",
   "repository": {
     "type": "git",

package/templates/CraftApp.swift

@@ -686,6 +686,9 @@ final class CraftChrome: ObservableObject {
     /// Whether a hybrid page lets the shell claim horizontal swipes for tabs.
     /// Native screens use their own per-screen `tabSwipeEnabled` option.
     private(set) var tabSwipeEnabled = true
+    /// The selected tab highlight's corner radius. Nil preserves the default
+    /// capsule, while a finite non-negative value opts into a rounded rect.
+    private(set) var tabSelectionCornerRadius: CGFloat?
 
     weak var webView: WKWebView?
     /// What the tab bar covers at the bottom of the screen, in points.
@@ -794,10 +797,21 @@ final class CraftChrome: ObservableObject {
         tabAccessory = next
     }
 
-    /// A retained or prepared screen cannot clear another screen's chrome.
-    func clearTabAccessory(ownedBy owner: AnyObject) {
+    /// A screen going away gives its accessory up without taking it off the
+    /// bar (a retained or prepared screen cannot clear another's): the screen coming in shows it until it says what it wants. Taken
+    /// off at once, the pill stretched across the bar and back while the
+    /// next screen (Messages, opened from the accessory; a tab opened for the
+    /// first time) started up and set the same accessory again.
+    func releaseTabAccessory(ownedBy owner: AnyObject) {
         guard tabAccessoryOwner === owner else { return }
-        updateTabAccessory(nil)
+        tabAccessoryOwner = nil
+    }
+
+    /// Takes off an accessory nobody claims any more: the screen now showing
+    /// drew without asking for one, or is a page that never does.
+    func clearUnclaimedTabAccessory() {
+        guard tabAccessoryOwner == nil, tabAccessory != nil else { return }
+        tabAccessory = nil
     }
 
     func setHiddenByScreen(_ hidden: Bool) {
@@ -823,6 +837,7 @@ final class CraftChrome: ObservableObject {
         switch body["type"] as? String {
         case "tabBar":
             pendingHide?.cancel()
+            tabSelectionCornerRadius = Self.selectionCornerRadius(body["selection"])
             tabs = (body["tabs"] as? [[String: Any]] ?? []).compactMap { item in
                 guard let id = item["id"] as? String, let title = item["title"] as? String else { return nil }
                 let badge = (item["badge"] as? String).flatMap { $0.isEmpty ? nil : $0 }
@@ -872,6 +887,15 @@ final class CraftChrome: ObservableObject {
         }
     }
 
+    private static func selectionCornerRadius(_ value: Any?) -> CGFloat? {
+        guard let selection = value as? [String: Any],
+              let raw = selection["cornerRadius"] as? NSNumber,
+              raw.doubleValue.isFinite,
+              raw.doubleValue >= 0,
+              raw.doubleValue <= Double(CGFloat.greatestFiniteMagnitude) else { return nil }
+        return CGFloat(raw.doubleValue)
+    }
+
     /// A tap on a tab: the page navigates, and says which tab is current.
     ///
     /// No haptic. UITabBar plays none, and a tab bar that ticks on every tap is
@@ -1175,7 +1199,7 @@ struct CraftTabBarView: View {
                     }
                     .foregroundStyle(isSelected ? selectedColor : Color.primary)
                     .frame(maxWidth: .infinity, minHeight: 54)
-                    .contentShape(Capsule())
+                    .contentShape(CraftTabSelectionShape(cornerRadius: chrome.tabSelectionCornerRadius))
                 }
                 .buttonStyle(.plain)
                 .accessibilityShowsLargeContentViewer {
@@ -1188,7 +1212,11 @@ struct CraftTabBarView: View {
             }
         }
         .background {
-            CraftTabSelectionIndicator(selected: chrome.tabs.firstIndex(where: { $0.id == chrome.selected }), count: chrome.tabs.count)
+            CraftTabSelectionIndicator(
+                selected: chrome.tabs.firstIndex(where: { $0.id == chrome.selected }),
+                count: chrome.tabs.count,
+                cornerRadius: chrome.tabSelectionCornerRadius
+            )
         }
     }
 
@@ -1230,18 +1258,33 @@ struct CraftTabBarView: View {
     }
 }
 
+private struct CraftTabSelectionShape: Shape {
+    let cornerRadius: CGFloat?
+
+    func path(in rect: CGRect) -> Path {
+        if let cornerRadius {
+            return RoundedRectangle(
+                cornerRadius: min(cornerRadius, min(rect.width, rect.height) / 2),
+                style: .continuous
+            ).path(in: rect)
+        }
+        return Capsule().path(in: rect)
+    }
+}
+
 private struct CraftTabSelectionIndicator: View {
     @ObservedObject private var progress = CraftChrome.shared.tabSwipeProgress
     let selected: Int?
     let count: Int
+    let cornerRadius: CGFloat?
 
     var body: some View {
         GeometryReader { geometry in
             if let position = progress.position ?? selected.map({ CGFloat($0) }) {
                 let width = geometry.size.width / CGFloat(max(1, count))
-                Capsule()
-                    .fill(Color.primary.opacity(0.09))
+                CraftTabSelectionShape(cornerRadius: cornerRadius)
                     .frame(width: width, height: geometry.size.height)
+                    .foregroundStyle(Color.primary.opacity(0.09))
                     .offset(x: position * width)
             }
         }
@@ -6315,6 +6358,7 @@ struct CraftWebView: UIViewRepresentable {
 
             SecItemDelete(query as CFDictionary)
             let status = SecItemAdd(query as CFDictionary, nil)
+            CraftKeychain.forget(account: key)
             return status == errSecSuccess
         }
 
@@ -6341,12 +6385,14 @@ struct CraftWebView: UIViewRepresentable {
                 kSecAttrAccount as String: key
             ]
             let status = SecItemDelete(query as CFDictionary)
+            CraftKeychain.forget(account: key)
             return status == errSecSuccess || status == errSecItemNotFound
         }
 
         private func secureClear() -> Bool {
             let query: [String: Any] = [kSecClass as String: kSecClassGenericPassword]
             let status = SecItemDelete(query as CFDictionary)
+            CraftKeychain.forget(account: nil)
             return status == errSecSuccess || status == errSecItemNotFound
         }
 
@@ -8227,6 +8273,7 @@ struct CraftWebView: UIViewRepresentable {
             SecItemDelete(query as CFDictionary)
 
             let status = SecItemAdd(query as CFDictionary, nil)
+            CraftKeychain.forget(account: key)
             if status == errSecSuccess {
                 resolveCallback(callbackId, result: ["success": true, "key": key])
             } else {
@@ -8269,6 +8316,7 @@ struct CraftWebView: UIViewRepresentable {
             }
 
             let status = SecItemDelete(query as CFDictionary)
+            CraftKeychain.forget(account: key)
             if status == errSecSuccess || status == errSecItemNotFound {
                 resolveCallback(callbackId, result: ["success": true, "key": key])
             } else {

package/templates/CraftHealth.swift

@@ -43,6 +43,19 @@ private final class CraftHealthWorkoutDelegate: NSObject, HKWorkoutSessionDelega
     }
 }
 
+@available(iOS 26.0, *)
+private final class CraftHealthWorkoutBuilderDelegate: NSObject, HKLiveWorkoutBuilderDelegate {
+    weak var owner: CraftHealth?
+
+    init(owner: CraftHealth) { self.owner = owner }
+
+    func workoutBuilder(_ workoutBuilder: HKLiveWorkoutBuilder, didCollectDataOf collectedTypes: Set<HKSampleType>) {
+        owner?.emitLiveWorkoutMetrics(workoutBuilder)
+    }
+
+    func workoutBuilderDidCollectEvent(_ workoutBuilder: HKLiveWorkoutBuilder) {}
+}
+
 /// Apple Health for the whole app: the web page's bridge (`craft.health` in
 /// the hybrid's web view, CraftApp.swift) and native screens alike
 /// (`Health` through CraftNativeActions), so a screen drawn natively reads
@@ -837,12 +850,15 @@ final class CraftHealth {
             let session = try HKWorkoutSession(healthStore: healthStore, configuration: configuration)
             let builder = session.associatedWorkoutBuilder()
             let delegate = CraftHealthWorkoutDelegate(id: { [weak self] in self?.liveWorkoutID ?? "" }) { [weak self] detail in self?.sendWorkout(detail) }
+            let metricsDelegate = CraftHealthWorkoutBuilderDelegate(owner: self)
             session.delegate = delegate
+            builder.delegate = metricsDelegate
             builder.shouldCollectWorkoutEvents = true
             builder.dataSource = HKLiveWorkoutDataSource(healthStore: healthStore, workoutConfiguration: configuration)
             liveWorkoutSession = session
             liveWorkoutBuilder = builder
             liveWorkoutDelegate = delegate
+            liveWorkoutBuilderDelegate = metricsDelegate
             liveWorkoutID = UUID().uuidString.lowercased()
             liveWorkoutType = type
             liveWorkoutStart = Date()
@@ -923,11 +939,32 @@ final class CraftHealth {
         liveWorkoutSession = nil
         liveWorkoutBuilder = nil
         liveWorkoutDelegate = nil
+        liveWorkoutBuilderDelegate = nil
         liveWorkoutID = nil
         liveWorkoutType = nil
         liveWorkoutStart = nil
     }
 
+    @available(iOS 26.0, *)
+    fileprivate func emitLiveWorkoutMetrics(_ builder: HKLiveWorkoutBuilder) {
+        guard let id = liveWorkoutID else { return }
+        var detail: [String: Any] = ["id": id, "event": "metrics", "date": Date().timeIntervalSince1970 * 1000]
+        let bpm = HKUnit.count().unitDivided(by: .minute())
+        if let type = HKQuantityType.quantityType(forIdentifier: .heartRate),
+           let value = builder.statistics(for: type)?.mostRecentQuantity()?.doubleValue(for: bpm), value.isFinite {
+            detail["heartRateBpm"] = value
+        }
+        if let type = HKQuantityType.quantityType(forIdentifier: .activeEnergyBurned),
+           let value = builder.statistics(for: type)?.sumQuantity()?.doubleValue(for: .kilocalorie()), value.isFinite {
+            detail["activeEnergyCalories"] = value
+        }
+        if let type = HKQuantityType.quantityType(forIdentifier: .distanceWalkingRunning),
+           let value = builder.statistics(for: type)?.sumQuantity()?.doubleValue(for: .meter()), value.isFinite {
+            detail["distanceMeters"] = value
+        }
+        onMain { [weak self] in self?.sendWorkout(detail) }
+    }
+
     private static func workoutActivity(_ type: String) -> HKWorkoutActivityType? {
         switch type {
         case "running": return .running
@@ -965,6 +1002,7 @@ final class CraftHealth {
     private var liveWorkoutSession: AnyObject?
     private var liveWorkoutBuilder: AnyObject?
     private var liveWorkoutDelegate: AnyObject?
+    private var liveWorkoutBuilderDelegate: AnyObject?
     private var liveWorkoutID: String?
     private var liveWorkoutType: String?
     private var liveWorkoutStart: Date?

package/templates/CraftHybrid.swift

@@ -240,8 +240,10 @@ enum CraftHybridKeychain {
     static let nativeService = "dev.craft.native.secure"
 
     static func set(_ key: String, value: String?) {
+        defer { CraftKeychain.forget(account: key) }
         // Every item for the account, whatever its service.
         SecItemDelete([kSecClass as String: kSecClassGenericPassword, kSecAttrAccount as String: key] as CFDictionary)
+        CraftKeychain.forget(account: key)
         guard let value else { return }
         for service in [nil, nativeService] {
             var add: [String: Any] = [
@@ -1076,6 +1078,18 @@ final class CraftHybridWebSlot: UIViewController {
     }
 }
 
+/// A native stack lets the top screen consume Back for its presented modal
+/// before UIKit removes the screen from the navigation stack.
+final class CraftNativeNavigationController: UINavigationController {
+    override func popViewController(animated: Bool) -> UIViewController? {
+        if let screen = topViewController as? CraftNativeScreenController,
+           screen.handleBackForModal() {
+            return nil
+        }
+        return super.popViewController(animated: animated)
+    }
+}
+
 final class CraftHybridController: UIViewController, UINavigationControllerDelegate, UIGestureRecognizerDelegate, CraftHybridScreenEvents {
     private let config: CraftConfig
     private let hybrid = CraftHybrid.shared
@@ -1175,6 +1189,10 @@ final class CraftHybridController: UIViewController, UINavigationControllerDeleg
         tabSwipeRecognizers.append(recognizer)
     }
 
+    private func shouldCompleteTabSwipe(progress: CGFloat, speed: CGFloat) -> Bool {
+        speed > -700 && (progress >= max(32, view.bounds.width * 0.28) || speed > 700)
+    }
+
     @objc private func tabSwipeRecognized(_ recognizer: UIPanGestureRecognizer) {
         // A finger that lands while the last swipe settles takes the screens
         // from where they are, as a paging scroll view does. This swipe used
@@ -1186,7 +1204,10 @@ final class CraftHybridController: UIViewController, UINavigationControllerDeleg
         let translation = recognizer.translation(in: view).x
         let velocity = recognizer.velocity(in: view).x
         switch recognizer.state {
-        case .changed:
+        case .began, .changed:
+            // Catching a settle can begin at zero translation. Keep its
+            // committed selection until the new finger actually moves.
+            if recognizer.state == .began, caughtSettle != nil, abs(translation) <= 1 { return }
             if activeTabSwipeTarget == nil {
                 let direction = abs(translation) > 1 ? translation : velocity
                 guard abs(direction) > 1 else { return }
@@ -1201,9 +1222,14 @@ final class CraftHybridController: UIViewController, UINavigationControllerDeleg
                 // the caught screens finish where they were going.
                 if caughtSettle != nil { settleCaughtScreens(); return }
                 guard recognizer.state == .ended else { return }
-                let delta = abs(translation) >= 32 ? translation : velocity
-                guard abs(delta) >= 32 else { return }
-                let next = delta < 0 ? index + 1 : index - 1
+                // UIKit can coalesce a short gesture without a changed
+                // callback. Keep the same completion rule as the animated
+                // path instead of treating any 32-point drag as a full page.
+                let direction = abs(translation) > 1 ? translation : velocity
+                guard abs(direction) > 1 else { return }
+                let sign: CGFloat = direction < 0 ? -1 : 1
+                guard shouldCompleteTabSwipe(progress: translation * sign, speed: velocity * sign) else { return }
+                let next = direction < 0 ? index + 1 : index - 1
                 guard tabs.indices.contains(next) else { return }
                 CraftChrome.shared.swipe(to: tabs[next])
                 return
@@ -1216,8 +1242,7 @@ final class CraftHybridController: UIViewController, UINavigationControllerDeleg
             let direction: CGFloat = tabSwipeFrom > 0 ? -1 : 1
             let progress = (translation + tabSwipeBase) * direction
             let speed = velocity * direction
-            let complete = recognizer.state == .ended && speed > -700
-                && (progress >= max(32, view.bounds.width * 0.28) || speed > 700)
+            let complete = recognizer.state == .ended && shouldCompleteTabSwipe(progress: progress, speed: speed)
             finishInteractiveTabSwipe(completed: complete, velocity: velocity) { [weak self] in
                 CraftFramePacing.shared.end("tab swipe")
                 self?.activeTabSwipeTarget = nil
@@ -1566,7 +1591,7 @@ final class CraftHybridController: UIViewController, UINavigationControllerDeleg
         // Constructing the navigation controller can load the root's view and
         // mount its script immediately. Set its initial focus before that.
         if hidden { (root as? CraftNativeScreenController)?.screenVisibilityChanged(false) }
-        let nav = UINavigationController(rootViewController: root)
+        let nav = CraftNativeNavigationController(rootViewController: root)
         nav.delegate = self
         nav.view.backgroundColor = config.resolvedBackgroundColor
         nav.additionalSafeAreaInsets.bottom = safeAreaForTabBar()
@@ -2011,6 +2036,8 @@ final class CraftHybridController: UIViewController, UINavigationControllerDeleg
     func navigationController(_ navigationController: UINavigationController, didShow viewController: UIViewController, animated: Bool) {
         lastNavigation = CACurrentMediaTime()
         CraftFramePacing.shared.end("navigation")
+        // A page shows no native accessory; one a screen gave up is taken off.
+        if viewController is CraftHybridWebSlot { CraftChrome.shared.clearUnclaimedTabAccessory() }
         let key = ObjectIdentifier(navigationController)
         let before = shownStacks[key] ?? []
         let now = navigationController.viewControllers
@@ -2278,6 +2305,22 @@ final class CraftFramePacing: NSObject {
         return result
     }
 
+    /// One piece of the screens' JavaScript (CraftNativeScriptThread): how
+    /// long it waited behind other screens' work, and how long it ran. The
+    /// screens share one serial script thread, so a screen in front can sit
+    /// behind hidden tabs reloading; `waited` is where that shows.
+    func scriptWork(_ name: String, waited: CFTimeInterval, ran: CFTimeInterval) {
+        guard enabled else { return }
+        write(String(format: "script %@ waited=%.1fms ran=%.1fms", name, waited * 1000, ran * 1000))
+    }
+
+    /// A capability a screen asked for (a request, the keychain), from the
+    /// ask to the answer. Logged from 4ms, as script work is.
+    func capability(_ name: String, took: CFTimeInterval) {
+        guard enabled, took >= 0.004 else { return }
+        write(String(format: "capability %@ took=%.1fms", name, took * 1000))
+    }
+
     /// Each line to the log and to `Library/Caches/craft-frame-pacing.log`
     /// in the app's container, which a test run reads back whole (a
     /// simulator's unified log can drop an app's lines under load). Written

package/templates/CraftNativeActions.swift

@@ -42,7 +42,7 @@ enum CraftNativeActions {
     static func capabilities(config: CraftConfig) -> [String] {
         // `speech`, `audio` (background sound) and `eventStream` (a fetch read
         // as it arrives) need nothing the app has to declare.
-        var values = ["device", "clipboard", "haptics", "storage", "lifecycle", "fetch", "dialog", "speech", "audio", "eventStream", "linking", "badge", "animation", "viewFocus", "viewMeasure", "viewReparent"]
+        var values = ["device", "clipboard", "haptics", "storage", "lifecycle", "fetch", "dialog", "speech", "audio", "eventStream", "linking", "badge", "animation", "viewFocus", "viewMeasure", "viewReparent", "viewNonModalPresentation"]
         values.append("storageCompareAndSet")
         values.append("storageSetIfAbsent")
         values.append("viewScroll")
@@ -219,11 +219,13 @@ enum CraftNativeActions {
             }
             // A write that moves the sign-in token is the account's change:
             // every screen hears it (CraftSession). Reads skip the check.
-            if ["set", "remove", "delete", "clear"].contains(method) {
-                sync = CraftSession.observe(key: method == "clear" ? nil : args.first as? String, config: config, write)
-            } else {
-                sync = write()
+            // Off the main thread, in order (CraftKeychain.queue).
+            let isWrite = ["set", "remove", "delete", "clear"].contains(method)
+            CraftKeychain.queue.async {
+                let result = isWrite ? CraftSession.observe(key: method == "clear" ? nil : args.first as? String, config: config, write) : write()
+                complete(requestToken, result, completion)
             }
+            return
         case ("Biometrics", "isAvailable"):
             sync = config.enableBiometric ? .success(biometricContext().canEvaluatePolicy(.deviceOwnerAuthenticationWithBiometrics, error: nil)) : failure("CAPABILITY_DISABLED", "Biometric authentication is disabled")
         case ("Biometrics", "getBiometricType"):
@@ -957,6 +959,7 @@ enum CraftNativeActions {
         if method == "clear" {
             let query: [String: Any] = [kSecClass as String: kSecClassGenericPassword, kSecAttrService as String: service]
             let status = SecItemDelete(query as CFDictionary)
+            CraftKeychain.forget(account: nil)
             guard status == errSecSuccess || status == errSecItemNotFound else {
                 return failure("SECURE_STORAGE_ERROR", "Secure storage could not be cleared")
             }
@@ -977,24 +980,38 @@ enum CraftNativeActions {
             query[kSecValueData as String] = Data(value.utf8)
             query[kSecAttrAccessible as String] = kSecAttrAccessibleWhenUnlockedThisDeviceOnly
             let removed = SecItemDelete(base as CFDictionary)
+            CraftKeychain.forget(account: key)
             guard removed == errSecSuccess || removed == errSecItemNotFound else {
                 return failure("SECURE_STORAGE_ERROR", "Secure storage could not be replaced (\(removed))")
             }
             let status = SecItemAdd(query as CFDictionary, nil)
+            CraftKeychain.forget(account: key)
             return status == errSecSuccess ? .success(true) : failure("SECURE_STORAGE_ERROR", "Secure storage could not be written (\(status))")
         case "get":
-            var query = base
-            query[kSecReturnData as String] = true
-            query[kSecMatchLimit as String] = kSecMatchLimitOne
-            var result: AnyObject?
-            let status = SecItemCopyMatching(query as CFDictionary, &result)
-            if status == errSecItemNotFound { return .success(NSNull()) }
-            guard status == errSecSuccess, let data = result as? Data else {
+            // A failed read is not remembered: it is answered as a failure,
+            // and the next read asks the Keychain again.
+            var failed = false
+            let value = CraftKeychain.value(account: key, service: service) { () -> String? in
+                var query = base
+                query[kSecReturnData as String] = true
+                query[kSecMatchLimit as String] = kSecMatchLimitOne
+                var result: AnyObject?
+                let status = SecItemCopyMatching(query as CFDictionary, &result)
+                if status == errSecItemNotFound { return nil }
+                guard status == errSecSuccess, let data = result as? Data else {
+                    failed = true
+                    return nil
+                }
+                return String(decoding: data, as: UTF8.self)
+            }
+            if failed {
+                CraftKeychain.forget(account: key)
                 return failure("SECURE_STORAGE_ERROR", "Secure storage could not be read")
             }
-            return .success(String(decoding: data, as: UTF8.self))
+            return .success(value.map { $0 as Any } ?? NSNull())
         case "remove":
             let status = SecItemDelete(base as CFDictionary)
+            CraftKeychain.forget(account: key)
             return status == errSecSuccess || status == errSecItemNotFound ? .success(true) : failure("SECURE_STORAGE_ERROR", "Secure storage could not be removed")
         default:
             return failure("UNKNOWN_ACTION", "Unsupported SecureStorage method")
@@ -1500,15 +1517,85 @@ extension CraftNativeActions {
     /// `secureStore` writes it. Nil when there is none.
     static func webSecureValue(forKey key: String) -> String? {
         guard let key = validKey(key) else { return nil }
-        let query: [String: Any] = [
-            kSecClass as String: kSecClassGenericPassword,
-            kSecAttrAccount as String: key,
-            kSecReturnData as String: true,
-            kSecMatchLimit as String: kSecMatchLimitOne,
-        ]
-        var result: AnyObject?
-        guard SecItemCopyMatching(query as CFDictionary, &result) == errSecSuccess, let data = result as? Data else { return nil }
-        return String(data: data, encoding: .utf8)
+        return CraftKeychain.value(account: key, service: nil) {
+            let query: [String: Any] = [
+                kSecClass as String: kSecClassGenericPassword,
+                kSecAttrAccount as String: key,
+                kSecReturnData as String: true,
+                kSecMatchLimit as String: kSecMatchLimitOne,
+            ]
+            var result: AnyObject?
+            guard SecItemCopyMatching(query as CFDictionary, &result) == errSecSuccess, let data = result as? Data else { return nil }
+            return String(data: data, encoding: .utf8)
+        }
+    }
+}
+
+/// The app's own Keychain items, read once and then remembered.
+///
+/// A Keychain read is `SecItemCopyMatching`, which took 100-900ms a read on a
+/// simulator and is not free on a phone, and every screen reads the sign-in
+/// token and the account beside it when it opens. They ran on the main
+/// thread, one after another, so a sign-in that made each open screen check
+/// the account again held the interface for seconds.
+///
+/// This process is the only writer of these items, through `secureStorage`,
+/// `CraftHybridKeychain` and the web bridge's secure storage, and each of
+/// them forgets what it changed. An item another process could write (a
+/// shared access group, an extension) is not remembered, and coming back to
+/// the foreground forgets everything, so a value written while the app was
+/// away is read fresh.
+enum CraftKeychain {
+    /// Where native screens' secure storage runs: off the main thread, one
+    /// call at a time, so a write is always seen by the read after it.
+    static let queue = DispatchQueue(label: "craft.keychain", qos: .userInitiated)
+    private static let lock = NSLock()
+    private static var values: [String: String?] = [:]
+    /// Moves on every forget, so a read that raced a write is not kept.
+    private static var generation = 0
+    private static var observing: NSObjectProtocol?
+
+    private static func cacheKey(_ account: String, _ service: String?) -> String {
+        "\(service ?? "*")\u{1F}\(account)"
+    }
+
+    /// `account`'s value under `service` (nil: whichever service holds it),
+    /// from memory when it was read before, else from `read`.
+    static func value(account: String, service: String?, read: () -> String?) -> String? {
+        let key = cacheKey(account, service)
+        lock.lock()
+        if observing == nil { observeForeground() }
+        if let known = values[key] {
+            lock.unlock()
+            return known
+        }
+        let started = generation
+        lock.unlock()
+        let value = read()
+        lock.lock()
+        if generation == started { values[key] = .some(value) }
+        lock.unlock()
+        return value
+    }
+
+    /// Drop what is remembered for `account`, under every service; nil drops all.
+    static func forget(account: String?) {
+        lock.lock()
+        generation += 1
+        if let account {
+            let suffix = "\u{1F}\(account)"
+            values = values.filter { !$0.key.hasSuffix(suffix) }
+        } else {
+            values.removeAll()
+        }
+        lock.unlock()
+    }
+
+    /// Called with `lock` held.
+    private static func observeForeground() {
+        observing = NotificationCenter.default.addObserver(forName: UIApplication.willEnterForegroundNotification, object: nil, queue: nil) { _ in
+            forget(account: nil)
+        }
     }
 }