@craft-native/ios 0.0.487 → 0.0.490

package/dist/cli.js

@@ -546,6 +546,21 @@ function hybridConfigProblems(config) {
     if (!matchNativePath(config.nativeScreens, start, config.nativeScreenConstraints))
       problems.push(`The start path "${start}" (from devServerURL) is not a nativeScreens path; with renderer: "native" the app must start on a native screen.`);
   }
+  const gate = config.nativeGate;
+  if (gate !== undefined) {
+    if (typeof gate.redirect !== "string" || normalizeNativePath(gate.redirect) !== gate.redirect)
+      problems.push(`nativeGate.redirect "${String(gate.redirect)}" must be an absolute path with no query, hash or trailing slash.`);
+    else if (hasNativeRoutes(config) && !matchNativePath(config.nativeScreens, gate.redirect, config.nativeScreenConstraints))
+      problems.push(`nativeGate.redirect "${gate.redirect}" is not a nativeScreens path; a signed-out launch would have nothing to show.`);
+    for (const path of gate.publicPaths ?? []) {
+      if (typeof path !== "string" || normalizeNativePath(path) !== path)
+        problems.push(`nativeGate.publicPaths "${String(path)}" must be an absolute path with no query, hash or trailing slash.`);
+    }
+    if (typeof gate.redirect === "string" && !(gate.publicPaths ?? []).some((path) => gate.redirect === path || gate.redirect.startsWith(`${path}/`)))
+      problems.push(`nativeGate.redirect "${gate.redirect}" must also be listed in nativeGate.publicPaths.`);
+    if (gate.token !== undefined && (typeof gate.token !== "string" || !gate.token))
+      problems.push("nativeGate.token must be the secure-storage key the sign-in lives under.");
+  }
   if (config.nativeApp !== undefined) {
     if (typeof config.nativeApp !== "string" || !/^[A-Za-z_$][\w$-]*$/.test(config.nativeApp))
       problems.push(`nativeApp "${String(config.nativeApp)}" must be a route name from the native bundle.`);

package/dist/index.js

@@ -740,6 +740,21 @@ function hybridConfigProblems(config) {
     if (!matchNativePath(config.nativeScreens, start, config.nativeScreenConstraints))
       problems.push(`The start path "${start}" (from devServerURL) is not a nativeScreens path; with renderer: "native" the app must start on a native screen.`);
   }
+  const gate = config.nativeGate;
+  if (gate !== undefined) {
+    if (typeof gate.redirect !== "string" || normalizeNativePath(gate.redirect) !== gate.redirect)
+      problems.push(`nativeGate.redirect "${String(gate.redirect)}" must be an absolute path with no query, hash or trailing slash.`);
+    else if (hasNativeRoutes(config) && !matchNativePath(config.nativeScreens, gate.redirect, config.nativeScreenConstraints))
+      problems.push(`nativeGate.redirect "${gate.redirect}" is not a nativeScreens path; a signed-out launch would have nothing to show.`);
+    for (const path of gate.publicPaths ?? []) {
+      if (typeof path !== "string" || normalizeNativePath(path) !== path)
+        problems.push(`nativeGate.publicPaths "${String(path)}" must be an absolute path with no query, hash or trailing slash.`);
+    }
+    if (typeof gate.redirect === "string" && !(gate.publicPaths ?? []).some((path) => gate.redirect === path || gate.redirect.startsWith(`${path}/`)))
+      problems.push(`nativeGate.redirect "${gate.redirect}" must also be listed in nativeGate.publicPaths.`);
+    if (gate.token !== undefined && (typeof gate.token !== "string" || !gate.token))
+      problems.push("nativeGate.token must be the secure-storage key the sign-in lives under.");
+  }
   if (config.nativeApp !== undefined) {
     if (typeof config.nativeApp !== "string" || !/^[A-Za-z_$][\w$-]*$/.test(config.nativeApp))
       problems.push(`nativeApp "${String(config.nativeApp)}" must be a route name from the native bundle.`);

package/dist/internal/ios/src/index.d.ts

@@ -317,6 +317,28 @@ export interface CraftConfig {
      * `craftsession` event on the page.
      */
     sessionTokenKey?: string;
+    /**
+     * Which screens a signed-out launch may start on.
+     *
+     * The shell resolves this while it is deciding the start path, before any
+     * screen is built. An app script cannot do the same job: it is started from
+     * the first frame's completion block, so by the time it can read a token the
+     * signed-in screen it would have prevented has already been painted — with
+     * the previous session's kept snapshot in it when the launch follows an
+     * expired token rather than a sign-out.
+     *
+     * ```ts
+     * nativeGate: {
+     *   publicPaths: ['/m/login', '/m/signup', '/m/store'],
+     *   redirect: '/m/login',
+     * }
+     * ```
+     *
+     * `publicPaths` admits a listed path and anything under it, so `/m/store`
+     * covers `/m/store/42` and not `/m/storefront`. `token` defaults to
+     * `sessionTokenKey`, the item `craft.session` already follows.
+     */
+    nativeGate?: NativeGate;
     /**
      * Crash and error reporting to bughq (CraftCrashReporter.swift): crashes
      * and hangs (signal handlers, NSException, MetricKit), uncaught JavaScript
@@ -325,6 +347,25 @@ export interface CraftConfig {
      */
     crashReporting?: CraftCrashReporting;
 }
+/**
+ * An auth gate the shell applies while resolving the start path.
+ *
+ * See `CraftConfig.nativeGate`. The allowlist is static data in the apps that
+ * need this, so emitting it into the config costs nothing at runtime.
+ */
+export interface NativeGate {
+    /**
+     * Paths a signed-out launch may start on, each admitting what sits under it.
+     *
+     * Not `public`: that is a Swift keyword, and remapping it would make the
+     * stored key differ from the property the host decodes it into.
+     */
+    publicPaths?: string[];
+    /** Where a signed-out launch starts instead. Must itself be public. */
+    redirect: string;
+    /** The secure-storage key holding the sign-in. Defaults to `sessionTokenKey`. */
+    token?: string;
+}
 export interface CraftCrashReporting {
     /** The bughq project's public ingest key. Ships in the app; it is not a secret. */
     key: string;
@@ -362,7 +403,7 @@ export declare function usesNativeBundle(config: Pick<CraftConfig, 'renderer' |
  */
 export declare function nativeStartPath(config: Pick<CraftConfig, 'devServerURL'>): string;
 /** What is wrong with a config's hybrid and tab settings, one sentence each. */
-export declare function hybridConfigProblems(config: Pick<CraftConfig, 'renderer' | 'nativeScreens' | 'nativeScreenConstraints' | 'tabs' | 'shareStorage' | 'devServerURL' | 'nativeApp' | 'nativeScriptThread' | 'notificationCategories'>): string[];
+export declare function hybridConfigProblems(config: Pick<CraftConfig, 'renderer' | 'nativeScreens' | 'nativeScreenConstraints' | 'tabs' | 'shareStorage' | 'devServerURL' | 'nativeApp' | 'nativeScriptThread' | 'notificationCategories' | 'nativeGate'>): string[];
 /**
  * The builder installs a directory of route bundles (stx's `routesDir`) as
  * well as the one-file bundle, and the app runs each screen from its own

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@craft-native/ios",
-  "version": "0.0.487",
+  "version": "0.0.490",
   "homepage": "https://github.com/craft-native/craft/tree/main/packages/ios#readme",
   "repository": {
     "type": "git",

package/templates/CraftApp.swift

@@ -2046,6 +2046,9 @@ struct CraftConfig: Codable {
     /// (`auth.token` unless set): `craft.session` follows it, and a change of
     /// it is `SESSION_CHANGED` on every screen (CraftSession).
     var sessionTokenKey: String? = nil
+    /// Which screens a signed-out launch may start on, resolved before the
+    /// first frame is built (CraftHybrid.configure).
+    var nativeGate: NativeGate? = nil
     /// The bundle route of the app script: a screen-less script that runs for
     /// the app's whole life and hears the app's events (CraftHybrid.swift).
     var nativeApp: String? = nil
@@ -2057,6 +2060,33 @@ struct CraftConfig: Codable {
     /// unless the config names a project key.
     var crashReporting: CrashReporting? = nil
 
+    /// An auth gate the shell applies while resolving the start path.
+    ///
+    /// An app script cannot do this. It is started from the first frame's
+    /// `CATransaction` completion block, so by the time it can read a token
+    /// the signed-in screen it would have prevented is already on screen —
+    /// with the previous session's kept snapshot in it when the launch
+    /// follows an expired token rather than a sign-out (#499). The check has
+    /// to belong to whoever decides the start path, and that is the shell.
+    struct NativeGate: Codable {
+        /// Paths that may be shown without a sign-in. A path is public when
+        /// it is listed, or when it sits under a listed one: `/m/store`
+        /// admits `/m/store/42` and not `/m/storefront`.
+        ///
+        /// Spelled `publicPaths` rather than `public` in the stored config
+        /// too. `public` is a Swift keyword, and remapping it through
+        /// `CodingKeys` would make the property name and the stored key
+        /// differ — which is exactly what the Zig conformance mirror checks,
+        /// and a divergence worth not having for the sake of one word.
+        var publicPaths: [String]? = nil
+        /// Where a signed-out launch starts instead.
+        var redirect: String? = nil
+        /// The secure-storage key holding the sign-in. Defaults to
+        /// `sessionTokenKey`, which is the same item `craft.session` follows,
+        /// so an app that already declares one need not repeat it.
+        var token: String? = nil
+    }
+
     struct Tab: Codable {
         var id: String
         var title: String

package/templates/CraftHybrid.swift

@@ -425,6 +425,7 @@ final class CraftHybrid: NSObject {
                 : "[craft hybrid] nativeScreens are set but dist/native-screen.js is missing; the app has no screens to show")
         }
         isEnabled = wanted && Self.hasBundle
+        applyGate(config)
         if isEnabled, !hasWeb, routes.match(startPath) == nil {
             // No web view to show it in: the first tab a screen draws.
             let fallback = (config.tabs ?? []).map(\.id).first { routes.match($0) != nil }
@@ -458,6 +459,54 @@ final class CraftHybrid: NSObject {
         DispatchQueue.main.asyncAfter(deadline: .now() + 1.5) { self.startAppScript() }
     }
 
+    /// Whether `path` may be shown to someone who is not signed in.
+    ///
+    /// Listed, or under something listed: `/m/store` admits `/m/store/42` and
+    /// not `/m/storefront`. Prefixes are compared with the separator attached
+    /// so a listed path cannot admit a sibling that merely starts with its
+    /// letters.
+    static func gateAdmits(_ path: String, public allowed: [String]) -> Bool {
+        allowed.contains { entry in
+            var listed = entry
+            while listed.count > 1, listed.hasSuffix("/") { listed.removeLast() }
+            guard !listed.isEmpty else { return false }
+            if path == listed { return true }
+            // "/" is the root path, not a prefix of everything. Reading it as
+            // one would admit every path, which is a gate that is not a gate.
+            guard listed != "/" else { return false }
+            return path.hasPrefix(listed + "/")
+        }
+    }
+
+    /// Send a signed-out launch to the gate's redirect before anything is built.
+    ///
+    /// This runs while `startPath` is still being resolved, which is the
+    /// whole point: the app script that would otherwise do it does not start
+    /// until the first frame has been committed, so it can only push sign-in
+    /// on top of a screen that has already been drawn with the previous
+    /// session's data in it (#499).
+    ///
+    /// The Keychain read is synchronous and can cost 100-900ms cold. It is
+    /// not an extra read: every signed-in screen reads this same item when it
+    /// opens, and `CraftKeychain` caches it, so the gate moves the app's first
+    /// read earlier rather than adding one. Only apps that declare a gate pay
+    /// it at all.
+    private func applyGate(_ config: CraftConfig) {
+        guard let gate = config.nativeGate, let redirect = gate.redirect, !redirect.isEmpty else { return }
+        guard !Self.gateAdmits(startPath, public: gate.publicPaths ?? []) else { return }
+        let key = gate.token ?? config.sessionTokenKey ?? "auth.token"
+        guard (CraftNativeActions.webSecureValue(forKey: key) ?? "").isEmpty else { return }
+        // A redirect nothing can draw would trade a private screen for a
+        // blank one. Say so and leave the start path alone; the fallback
+        // below then treats it as any other unroutable start.
+        if isEnabled, !hasWeb, routes.match(redirect) == nil {
+            NSLog("[craft hybrid] nativeGate redirect %@ has no native screen; the gate did not run", redirect)
+            return
+        }
+        NSLog("[craft hybrid] no sign-in under %@: starting on %@ instead of %@", key, redirect, startPath)
+        startPath = redirect
+    }
+
     /// A silent push or a background refresh is waiting for the app script,
     /// with iOS's clock running: it starts now rather than after a frame,
     /// which a launch in the background never draws.

package/templates/CraftNativeActions.swift

@@ -2001,7 +2001,15 @@ enum CraftSnapshots {
             }
             lock.unlock()
             DispatchQueue.main.async {
-                if ok { NotificationCenter.default.post(name: changed, object: nil, userInfo: ["name": name]) }
+                // Posted whether or not the write landed. A screen displays its
+                // checkpoint optimistically, and this notification carries only
+                // the name, so a reader answers it by calling `read` — which
+                // after a failure finds the previous value, because `pending`
+                // was cleared above and the cache was only refilled on success.
+                // Posting only on success left a failed checkpoint on screen as
+                // though it had been kept; Android already restores it
+                // (`changed("snapshots", name, if (ok) json else previous, null)`).
+                NotificationCenter.default.post(name: changed, object: nil, userInfo: ["name": name])
                 completion?(ok)
             }
         }

package/templates/CraftNativeScreen.swift

@@ -12,6 +12,7 @@ import OSLog
 import Security
 import SwiftUI
 import UIKit
+import UIKit.UIGestureRecognizerSubclass
 
 /// A menu belongs to its native view, not to coordinates in a web page.
 final class CraftNativeContextMenu: NSObject, UIContextMenuInteractionDelegate {
@@ -5195,6 +5196,23 @@ private final class CraftNativeScrollView: UIScrollView, UIGestureRecognizerDele
 /// Native inspection of an SVG plot. Coordinates are fractions of the plot's
 /// bounds; labels and values are already localized by the application. No JS
 /// callback or bridge round trip is needed while a finger moves.
+/// Reports where each touch starts and then fails, so it observes a window
+/// without ever taking a touch from the view underneath.
+final class CraftTouchBeganRecognizer: UIGestureRecognizer {
+    private let began: (CGPoint) -> Void
+    init(began: @escaping (CGPoint) -> Void) {
+        self.began = began
+        super.init(target: nil, action: nil)
+        cancelsTouchesInView = false
+        delaysTouchesBegan = false
+        delaysTouchesEnded = false
+    }
+    override func touchesBegan(_ touches: Set<UITouch>, with event: UIEvent) {
+        state = .failed
+        if let touch = touches.first { began(touch.location(in: view)) }
+    }
+}
+
 final class CraftChartInspection: NSObject, UIGestureRecognizerDelegate {
     struct Reading {
         let key: String
@@ -5214,6 +5232,7 @@ final class CraftChartInspection: NSObject, UIGestureRecognizerDelegate {
     private lazy var tap = UITapGestureRecognizer(target: self, action: #selector(tapped(_:)))
     private lazy var pan = UIPanGestureRecognizer(target: self, action: #selector(panned(_:)))
     private lazy var hold = UILongPressGestureRecognizer(target: self, action: #selector(held(_:)))
+    private var outside: CraftTouchBeganRecognizer?
 
     init(view: UIView) {
         self.view = view
@@ -5241,6 +5260,7 @@ final class CraftChartInspection: NSObject, UIGestureRecognizerDelegate {
                            color: (point["color"] as? String).flatMap { UIColor(css: $0) } ?? .systemBlue, label: label, rows: rows)
         }
         selectedIndex = -1
+        unwatchOutside()
         view?.isUserInteractionEnabled = !readings.isEmpty
         if readings.isEmpty { view?.accessibilityTraits.remove(.adjustable); view?.accessibilityValue = nil }
         [tap, pan, hold].forEach { $0.isEnabled = !readings.isEmpty }
@@ -5270,6 +5290,7 @@ final class CraftChartInspection: NSObject, UIGestureRecognizerDelegate {
     }
 
     @discardableResult func dismiss() -> Bool {
+        unwatchOutside()
         guard selectedIndex >= 0 else { return false }
         selectedIndex = -1
         configureAccessibility()
@@ -5277,20 +5298,47 @@ final class CraftChartInspection: NSObject, UIGestureRecognizerDelegate {
         return true
     }
 
-    private func select(at point: CGPoint) {
-        guard let view, view.bounds.width > 0 else { return }
+    private func nearest(at point: CGPoint) -> Int? {
+        guard let view, view.bounds.width > 0 else { return nil }
         let fraction = max(0, min(1, point.x / view.bounds.width))
-        if let nearest = readings.indices.min(by: { abs(readings[$0].x - fraction) < abs(readings[$1].x - fraction) }) { select(nearest) }
+        return readings.indices.min(by: { abs(readings[$0].x - fraction) < abs(readings[$1].x - fraction) })
+    }
+    private func select(at point: CGPoint) {
+        if let index = nearest(at: point) { select(index); watchOutside() }
+    }
+    /// A tap pins the reading under it. Tapping the pinned reading again puts
+    /// it away, so a reading can always be closed where it was opened.
+    func tap(at point: CGPoint) {
+        guard let index = nearest(at: point) else { return }
+        if index == selectedIndex { dismiss() } else { select(at: point) }
+    }
+    /// A drag or a hold reads the chart only while the finger is down.
+    func scrub(_ state: UIGestureRecognizer.State, at point: CGPoint) {
+        switch state {
+        case .began, .changed: select(at: point)
+        case .ended, .cancelled, .failed: dismiss()
+        default: break
+        }
     }
-    @objc private func tapped(_ gesture: UITapGestureRecognizer) { select(at: gesture.location(in: view)) }
-    @objc private func panned(_ gesture: UIPanGestureRecognizer) {
-        if gesture.state == .began || gesture.state == .changed { select(at: gesture.location(in: view)) }
-        if gesture.state == .cancelled { dismiss() }
+    /// A touch that starts anywhere off the chart closes a pinned reading. The
+    /// watcher never recognises, so the touch still reaches what it landed on.
+    func touchBegan(inWindow point: CGPoint) {
+        guard let view, let window = view.window else { return }
+        if !view.bounds.contains(view.convert(point, from: window)) { dismiss() }
     }
-    @objc private func held(_ gesture: UILongPressGestureRecognizer) {
-        if gesture.state == .began || gesture.state == .changed { select(at: gesture.location(in: view)) }
-        if gesture.state == .cancelled { dismiss() }
+    private func watchOutside() {
+        guard outside == nil, let window = view?.window else { return }
+        let watcher = CraftTouchBeganRecognizer { [weak self] point in self?.touchBegan(inWindow: point) }
+        window.addGestureRecognizer(watcher)
+        outside = watcher
     }
+    private func unwatchOutside() {
+        if let outside { outside.view?.removeGestureRecognizer(outside) }
+        outside = nil
+    }
+    @objc private func tapped(_ gesture: UITapGestureRecognizer) { tap(at: gesture.location(in: view)) }
+    @objc private func panned(_ gesture: UIPanGestureRecognizer) { scrub(gesture.state, at: gesture.location(in: view)) }
+    @objc private func held(_ gesture: UILongPressGestureRecognizer) { scrub(gesture.state, at: gesture.location(in: view)) }
     func gestureRecognizerShouldBegin(_ gesture: UIGestureRecognizer) -> Bool {
         guard gesture === pan else { return true }
         let velocity = pan.velocity(in: view)
@@ -6002,9 +6050,23 @@ final class CraftNativeSolidSwitch: UIControl {
         return CGRect(x: min(max(x, track.minX), track.maxX - rect.width - stretch),
                       y: rect.minY, width: rect.width + stretch, height: rect.height)
     }
+    /// How much wider than tall the thumb is drawn.
+    ///
+    /// iOS 26 draws a wide pill where every system before it drew a circle,
+    /// so a square thumb reads as a control from an older OS sitting among
+    /// native ones. Measured on iOS 26.5 (iPhone 17 Pro simulator) by walking
+    /// a real `UISwitch`: the control is 63x28 and its thumb 37x24, inset 2 on
+    /// every side, travelling from x=2 to x=24.
+    ///
+    /// Expressed against the thumb's own height rather than as a fixed size,
+    /// so it keeps following whatever the real `UISwitch` reports — which is
+    /// where `naturalSize` already comes from. At the system's own 24-point
+    /// thumb height this is exactly 37.
+    private static let thumbAspect: CGFloat = 37.0 / 24.0
     private func thumbRect(at position: CGFloat) -> CGRect {
         let track = trackRect.insetBy(dx: 2, dy: 2)
-        return CGRect(x: track.minX + (track.width - track.height) * position, y: track.minY, width: track.height, height: track.height)
+        let width = min(track.width, track.height * Self.thumbAspect)
+        return CGRect(x: track.minX + (track.width - width) * position, y: track.minY, width: width, height: track.height)
     }
     override func draw(_ rect: CGRect) {
         let track = trackRect
@@ -6341,12 +6403,37 @@ private final class CraftNativeTextView: UITextView {
         if !isScrollEnabled, contentOffset != .zero { contentOffset = .zero }
         let inset = textContainerInset
         let padding = textContainer.lineFragmentPadding
-        placeholderLabel.frame = CGRect(
-            x: inset.left + padding,
-            y: inset.top,
-            width: max(0, bounds.width - inset.left - inset.right - padding * 2),
-            height: max(0, bounds.height - inset.top - inset.bottom)
-        )
+        let measured = placeholderLabel
+            .sizeThatFits(CGSize(width: Self.placeholderWidth(bounds: bounds, inset: inset, padding: padding),
+                                 height: .greatestFiniteMagnitude))
+        placeholderLabel.frame = Self.placeholderFrame(bounds: bounds, inset: inset, padding: padding,
+                                                       fittedHeight: measured.height)
+    }
+
+    static func placeholderWidth(bounds: CGRect, inset: UIEdgeInsets, padding: CGFloat) -> CGFloat {
+        max(0, bounds.width - inset.left - inset.right - padding * 2)
+    }
+
+    /// Where the placeholder sits inside the box.
+    ///
+    /// Anchored at the top, and no taller than the text it holds. `UILabel`
+    /// centres its text block vertically within its frame, while
+    /// `UITextView` lays its glyphs out from the top, so a label handed the
+    /// box's whole remaining height drew the placeholder of a four-row notes
+    /// field halfway down it — nowhere near the caret that replaced it the
+    /// moment the field was tapped (#501). The two rules only agreed when
+    /// the box was exactly one line tall, which is why single-line fields
+    /// looked right and every `textarea` did not. Given only the height its
+    /// text needs, the label has no spare height to centre within.
+    ///
+    /// Clamped to what is left of the box so that a placeholder longer than
+    /// the field stays inside it rather than drawing past the bottom.
+    static func placeholderFrame(bounds: CGRect, inset: UIEdgeInsets, padding: CGFloat, fittedHeight: CGFloat) -> CGRect {
+        let available = max(0, bounds.height - inset.top - inset.bottom)
+        return CGRect(x: inset.left + padding,
+                      y: inset.top,
+                      width: placeholderWidth(bounds: bounds, inset: inset, padding: padding),
+                      height: min(max(0, fittedHeight), available))
     }
 
     func refreshPlaceholder() {
@@ -7037,6 +7124,17 @@ final class CraftNativeScreenController: UIViewController, UIScrollViewDelegate,
 
     override func viewWillDisappear(_ animated: Bool) {
         super.viewWillDisappear(animated)
+        // A screen does not take the keyboard with it. Its field is still
+        // first responder at this point, and once the view leaves the window
+        // the next screen's `window?.endEditing` no longer reaches it — the
+        // keyboard then stays up with nothing able to dismiss it until the
+        // app is backgrounded (#497). This is the one moment both facts hold:
+        // the screen is going, and its view still owns the responder.
+        //
+        // `lastFocusedInput` is deliberately left alone. A screen merely
+        // covered by a push comes back, and restoreFocus putting the person
+        // back where they were is the behaviour that was already there.
+        view.endEditing(true)
         screenVisibilityChanged(false)
         stopCelebrations(in: view)
         // Release only this screen's accessory. A retained or prepared screen
@@ -7045,7 +7143,7 @@ final class CraftNativeScreenController: UIViewController, UIScrollViewDelegate,
         CraftChrome.shared.releaseTabAccessory(ownedBy: self)
         // Popped (or its stack dismissed) while the bar was away: it comes
         // back for whatever shows next, a web page included.
-        if tabBarHidden, isMovingFromParent || isBeingDismissed || navigationController?.isBeingDismissed == true {
+        if tabBarHiddenApplied, isMovingFromParent || isBeingDismissed || navigationController?.isBeingDismissed == true {
             CraftChrome.shared.setHiddenByScreen(false)
         }
     }
@@ -7087,7 +7185,7 @@ final class CraftNativeScreenController: UIViewController, UIScrollViewDelegate,
 
     private func restoreShellChrome() {
         guard !isAppScript else { return }
-        CraftChrome.shared.setHiddenByScreen(tabBarHidden)
+        applyTabBarHidden()
         // A screen not yet asked about the accessory (one shown for the first
         // time, before its script has run) leaves the bar as it is; one that
         // has drawn without asking for it takes off what nobody claims.
@@ -7183,6 +7281,18 @@ final class CraftNativeScreenController: UIViewController, UIScrollViewDelegate,
     private func disposeRuntime() {
         guard !runtimeDisposed else { return }
         runtimeDisposed = true
+        // Again here, and forgetting the input this time: a screen can be torn
+        // down without ever appearing (one prepared and then replaced), so
+        // viewWillDisappear is not guaranteed to have run. Nothing comes back
+        // from here, so there is no focus worth restoring.
+        //
+        // `viewIfLoaded`, never `view`: this also runs from `deinit`, where
+        // `view` is a `UIView!` that UIKit has already cleared — reading it
+        // traps on the implicit unwrap, and a screen that never appeared
+        // would instead have `loadView` resurrect `self` while it is being
+        // deallocated. A screen with no loaded view has nothing focused.
+        forgetFocusedInput()
+        viewIfLoaded?.endEditing(true)
         frameDelivery.close()
         storageLifetime.close()
         pendingCapabilityDeadlines.values.forEach { $0.cancel() }
@@ -7658,7 +7768,8 @@ final class CraftNativeScreenController: UIViewController, UIScrollViewDelegate,
     /// - `craft.secureStorage.getSync(key)`: the Keychain item the web page's
     ///   `craft.secureStorage.set` wrote.
     /// - `craft.navigation.setOptions({ title, titleColor, largeTitle, hidden,
-    ///   backTitle, tabBarHidden, tabItem, swipeBack, contentSwipeBack,
+    ///   backTitle, tabBarHidden, tabBarHiddenWhenPushed, tabItem, swipeBack,
+    ///   contentSwipeBack,
     ///   tabSwipeEnabled, backgroundColor, navigationBarSolid, leftButtons,
     ///   rightButtons, tabAccessory })`; a button's tap is the event
     ///   `navButton`. `craft.d.ts` types no navigation surface, so this list
@@ -8125,6 +8236,32 @@ final class CraftNativeScreenController: UIViewController, UIScrollViewDelegate,
     private var statusBarHiddenOverride: Bool?
     /// The app's tab bar away while this screen shows (`tabBarHidden`).
     private var tabBarHidden = false
+    /// The bar away only once this screen is pushed onto something
+    /// (`tabBarHiddenWhenPushed`): UIKit's `hidesBottomBarWhenPushed` idiom,
+    /// for a screen that keeps the bar as its stack's root and drops it when
+    /// it is a detail. Craft's tab bar is drawn by CraftChrome rather than a
+    /// UITabBarController, so the depth is read here and the bar is asked
+    /// directly; the Android shell has honoured the same key all along.
+    private var tabBarHiddenWhenPushed = false
+    /// What this screen last told the chrome. Teardown has to put back a bar
+    /// this screen took away, and recomputing the answer there is no good:
+    /// UIKit has already taken a popped screen out of `viewControllers` by
+    /// `viewWillDisappear`, so a bar hidden for depth would read as never
+    /// hidden at all and stay off for whatever shows next.
+    private var tabBarHiddenApplied = false
+
+    /// Whether the bar should be away for this screen as it stands now.
+    private var wantsTabBarHidden: Bool {
+        if tabBarHidden { return true }
+        guard tabBarHiddenWhenPushed, let stack = navigationController?.viewControllers else { return false }
+        guard let depth = stack.firstIndex(where: { $0 === self }) else { return false }
+        return depth > 0
+    }
+
+    private func applyTabBarHidden() {
+        tabBarHiddenApplied = wantsTabBarHidden
+        CraftChrome.shared.setHiddenByScreen(tabBarHiddenApplied)
+    }
     private var tabAccessory: [String: Any]?
     /// Whether the screen has said anything about the accessory yet
     /// (`tabAccessory`, null included): until it has, the bar keeps showing
@@ -8210,8 +8347,16 @@ final class CraftNativeScreenController: UIViewController, UIScrollViewDelegate,
         }
         if let hidden = options["tabBarHidden"] as? Bool {
             tabBarHidden = hidden
+        }
+        if let hiddenWhenPushed = options["tabBarHiddenWhenPushed"] as? Bool {
+            tabBarHiddenWhenPushed = hiddenWhenPushed
+        }
+        if options.keys.contains("tabBarHidden") || options.keys.contains("tabBarHiddenWhenPushed") {
+            // Prepared tabs and screens under a push keep the answer and apply
+            // it when they are shown (restoreShellChrome); only the screen on
+            // display may move the shared bar.
             if navigationController?.topViewController === self, isShownOnScreen {
-                CraftChrome.shared.setHiddenByScreen(hidden)
+                applyTabBarHidden()
             }
         }
         if let swipeBack = options["swipeBack"] as? Bool {
@@ -8324,6 +8469,22 @@ final class CraftNativeScreenController: UIViewController, UIScrollViewDelegate,
 
     /// A bar button from `{ id, symbol | title }`. Its tap is the event
     /// `navButton` with `{ id }`.
+    /// A bar button's choices, or nil when it has none worth a menu.
+    static func navigationMenu(_ raw: Any?, chosen: @escaping (String) -> Void) -> UIMenu? {
+        let actions: [UIAction] = ((raw as? [[String: Any]]) ?? []).prefix(12).compactMap { choice in
+            guard let id = choice["id"] as? String, !id.isEmpty,
+                  let title = choice["title"] as? String, !title.isEmpty else { return nil }
+            var attributes: UIMenuElement.Attributes = []
+            if choice["disabled"] as? Bool == true { attributes.insert(.disabled) }
+            if choice["destructive"] as? Bool == true { attributes.insert(.destructive) }
+            let action = UIAction(title: title, image: (choice["symbol"] as? String).flatMap { UIImage(systemName: $0) },
+                                  attributes: attributes) { _ in chosen(id) }
+            action.accessibilityIdentifier = "nav-menu-\(id)"
+            return action
+        }
+        return actions.isEmpty ? nil : UIMenu(children: actions)
+    }
+
     private func navigationButton(_ spec: [String: Any]) -> UIBarButtonItem? {
         guard let id = spec["id"] as? String, !id.isEmpty else { return nil }
         let action = UIAction { [weak self] _ in
@@ -8332,11 +8493,16 @@ final class CraftNativeScreenController: UIViewController, UIScrollViewDelegate,
         if spec["variant"] as? String == "accent" || spec["variant"] as? String == "account" {
             return accountNavigationButton(spec, action: action)
         }
+        // `menu`: the button opens a native menu instead of sending its own
+        // id, and each choice is reported as a press of that choice's id.
+        let menu = Self.navigationMenu(spec["menu"]) { [weak self] choice in
+            self?.send(type: "EVENT", payload: ["handlerName": "navButton", "nativeEvent": ["id": choice]])
+        }
         let item: UIBarButtonItem
         if let symbol = spec["symbol"] as? String, let image = UIImage(systemName: symbol) {
-            item = UIBarButtonItem(image: image, primaryAction: action)
+            item = menu.map { UIBarButtonItem(image: image, menu: $0) } ?? UIBarButtonItem(image: image, primaryAction: action)
         } else if let title = spec["title"] as? String {
-            item = UIBarButtonItem(title: title, primaryAction: action)
+            item = menu.map { UIBarButtonItem(title: title, menu: $0) } ?? UIBarButtonItem(title: title, primaryAction: action)
         } else {
             return nil
         }
@@ -8927,14 +9093,22 @@ final class CraftNativeScreenController: UIViewController, UIScrollViewDelegate,
                 ])
             }
         case "NAVIGATE", "NAVIGATE_REPLACE":
-            // A screen's own stack; the app script has none (it opens paths).
-            guard !isAppScript, navigationController?.topViewController === self,
-                  let screen = payload["screen"] as? String, !screen.isEmpty,
-                  let navigation = navigationController else { return }
+            guard let screen = payload["screen"] as? String, !screen.isEmpty else { return }
+            // Replacing a path needs no stack of its own: it asks the shell to
+            // show that path, which is why it delegates rather than pushing.
+            // The app script has no stack, so this was refused to it along
+            // with everything else, and its only way to redirect was to push
+            // sign-in on top of the screen it meant to prevent (#499). The
+            // gate in CraftHybrid.configure is the fix for launch; this is
+            // what lets a session that ends mid-run replace rather than stack.
             if type == "NAVIGATE_REPLACE", screen.hasPrefix("/") {
+                guard isAppScript || navigationController?.topViewController === self else { return }
                 hybridEvents?.nativeScreen(self, replace: screen)
                 return
             }
+            // A screen's own stack; the app script has none (it opens paths).
+            guard !isAppScript, navigationController?.topViewController === self,
+                  let navigation = navigationController else { return }
             let params = payload["params"] as? [String: Any] ?? [:]
             let next = CraftNativeScreenController(config: config, routeName: screen, routeParams: params)
             next.hybridEvents = hybridEvents
@@ -9376,7 +9550,18 @@ final class CraftNativeScreenController: UIViewController, UIScrollViewDelegate,
         previousNodesByProtocolID.removeAll(keepingCapacity: true)
         adoptedPreviousProtocolIDs.removeAll(keepingCapacity: true)
         indexPreviousNodes(previous)
-        let next = reconcile(document, identity: "root", path: "root", previous: previous)
+        // The app's configured body face seeds the inheritance chain, so a
+        // screen's text is branded for the same reason its chrome is. Without
+        // this the chain starts empty and `fontFamily` reached the navigation
+        // bar, the tab labels and the bar buttons — all UIAppearance proxies —
+        // while every label, button and field inside a screen stayed in the
+        // system face (#500).
+        //
+        // A node that sets its own family still wins: the fill below only
+        // applies where a node set none or `inherit`. Nil unless the app
+        // configured one, which the same guard makes free.
+        let next = reconcile(document, identity: "root", path: "root", previous: previous,
+                             inheritedFontFamily: CraftChromeFonts.body)
         previousNodesByProtocolID.removeAll(keepingCapacity: true)
         adoptedPreviousProtocolIDs.removeAll(keepingCapacity: true)
         if previous?.view !== next.view {