@craft-native/ios 0.0.92 → 0.0.95

package/templates/CraftApp.swift

@@ -34,7 +34,42 @@ import ActivityKit
 extension Notification.Name {
     static let craftPushToken = Notification.Name("craftPushToken")
     static let craftPushRegistrationError = Notification.Name("craftPushRegistrationError")
-    static let craftNotificationResponse = Notification.Name("craftNotificationResponse")
+}
+
+/// Which failed page loads mean the remote origin is out of reach (#252).
+///
+/// That is the only failure the bundled copy stands in for. Anything else
+/// either is not a failure at all or is one the bundle would hide: a TLS error
+/// or a bad response means the server *was* reached, and swapping in a local
+/// copy would bury a real fault under a page that half-works.
+///
+/// Written against NSError's domain and code rather than WebKit's types, so it
+/// compiles with Foundation alone — which is how `compile-templates` runs it on
+/// its own, on the CI host, rather than only reading its text.
+enum CraftLoadFailure {
+    static func isUnreachable(_ error: Error) -> Bool {
+        let error = error as NSError
+        // Everything outside NSURLErrorDomain is excluded, WebKit's own
+        // frame-load-interrupted (WebKitErrorDomain 102) among them: a load
+        // replaced by a newer one is not a load that failed.
+        guard error.domain == NSURLErrorDomain else { return false }
+        switch error.code {
+        case NSURLErrorNotConnectedToInternet,
+             NSURLErrorCannotFindHost,
+             NSURLErrorCannotConnectToHost,
+             NSURLErrorTimedOut,
+             NSURLErrorNetworkConnectionLost,
+             NSURLErrorDNSLookupFailed,
+             NSURLErrorDataNotAllowed,
+             NSURLErrorInternationalRoamingOff:
+            return true
+        default:
+            // NSURLErrorCancelled (-999) lands here. WebKit reports it for two
+            // quick taps, a redirect, or a `location.assign` while a load is in
+            // flight — and it used to end the session on the bundled copy.
+            return false
+        }
+    }
 }
 
 final class CraftAppDelegate: NSObject, UIApplicationDelegate, UNUserNotificationCenterDelegate {
@@ -68,11 +103,23 @@ final class CraftAppDelegate: NSObject, UIApplicationDelegate, UNUserNotificatio
     }
 
     func userNotificationCenter(_ center: UNUserNotificationCenter, didReceive response: UNNotificationResponse, withCompletionHandler completionHandler: @escaping () -> Void) {
-        NotificationCenter.default.post(name: .craftNotificationResponse, object: response.notification.request.content.userInfo)
+        // Through the manager, not NotificationCenter. A tap that launches a
+        // killed app arrives here before SwiftUI has built the Coordinator, and
+        // NotificationCenter keeps nothing for an observer that does not exist
+        // yet — so the tap was dropped, and the page opened wherever it opens
+        // rather than where the notification pointed. The manager exists from
+        // process start and holds the tap until the page is ready, the way it
+        // already does for a home-screen shortcut.
+        CraftEventManager.shared.handleNotificationResponse(response.notification.request.content.userInfo)
         completionHandler()
     }
 
     func userNotificationCenter(_ center: UNUserNotificationCenter, willPresent notification: UNNotification, withCompletionHandler completionHandler: @escaping (UNNotificationPresentationOptions) -> Void) {
+        // Told to the page as well as shown. A page that is open when a push
+        // lands used to hear about it only if someone tapped the banner, so it
+        // could not refresh what the push was about while it was on screen.
+        // The banner still shows: the page is told, not asked.
+        CraftEventManager.shared.handleNotificationReceived(notification.request.content.userInfo)
         completionHandler([.banner, .badge, .sound])
     }
 }
@@ -108,6 +155,30 @@ class CraftEventManager {
         sendToWeb("craftShortcut", data: ["type": shortcut.type])
     }
 
+    /// A tap on a notification, carrying the payload it was sent with.
+    ///
+    /// Keys that are not strings are dropped rather than failing the whole
+    /// event: an APNs payload's keys always are, and the page could not index
+    /// by anything else anyway.
+    func handleNotificationResponse(_ userInfo: [AnyHashable: Any]) {
+        sendToWeb("craftNotificationResponse", data: Self.pageData(userInfo))
+    }
+
+    /// A notification that arrived while the app was in front, in the same
+    /// shape as a tap so one handler can read both.
+    func handleNotificationReceived(_ userInfo: [AnyHashable: Any]) {
+        sendToWeb("craftNotificationReceived", data: Self.pageData(userInfo))
+    }
+
+    private static func pageData(_ userInfo: [AnyHashable: Any]) -> [String: Any] {
+        var data: [String: Any] = [:]
+        for (key, value) in userInfo {
+            guard let key = key as? String else { continue }
+            data[key] = value
+        }
+        return data
+    }
+
     func handleSiriActivity(_ activity: NSUserActivity) -> Bool {
         let prefix = "\(Bundle.main.bundleIdentifier ?? "{{BUNDLE_ID}}")."
         guard activity.activityType.hasPrefix(prefix) else { return false }
@@ -495,6 +566,21 @@ struct CraftWebView: UIViewRepresentable {
         private var pendingPushCallbackId: String?
         private var loadedBundledFallback = false
 
+        /// The highest `cb_<n>` this process has seen the page hand out.
+        ///
+        /// The page's own counter restarts at 0 on every injection, which is
+        /// every reload, navigation and web-content crash recovery, and
+        /// nothing native records which load a call came from. So an answer
+        /// to a call made before a reload was delivered to whichever call on
+        /// the new page drew the same number: `getDeviceInfo` settled with a
+        /// Siri result, or rejected with the earlier call's TIMEOUT (#226).
+        ///
+        /// Seeding each injection above everything already handed out makes
+        /// an id unique for the life of the process. A late answer then names
+        /// a callback no page has, and is dropped where it lands — on either
+        /// runtime, and without native having to track page loads at all.
+        private var highestCallbackId = 0
+
         // Location
         private var locationManager: CLLocationManager?
         private var singleLocationCallbackId: String?
@@ -584,7 +670,7 @@ struct CraftWebView: UIViewRepresentable {
             }
             NotificationCenter.default.addObserver(self, selector: #selector(receivePushToken(_:)), name: .craftPushToken, object: nil)
             NotificationCenter.default.addObserver(self, selector: #selector(receivePushRegistrationError(_:)), name: .craftPushRegistrationError, object: nil)
-            NotificationCenter.default.addObserver(self, selector: #selector(receiveNotificationResponse(_:)), name: .craftNotificationResponse, object: nil)
+            NotificationCenter.default.addObserver(self, selector: #selector(appWillEnterForeground(_:)), name: UIApplication.willEnterForegroundNotification, object: nil)
             setupNetworkMonitoring()
         }
 
@@ -607,6 +693,9 @@ struct CraftWebView: UIViewRepresentable {
         private func setupNetworkMonitoring() {
             networkMonitor = NWPathMonitor()
             networkMonitor?.pathUpdateHandler = { [weak self] path in
+                // Read before it is overwritten: the retry below wants the
+                // transition, not the state.
+                let wasConnected = self?.isConnected ?? true
                 self?.isConnected = path.status == .satisfied
                 if path.usesInterfaceType(.wifi) {
                     self?.connectionType = "wifi"
@@ -621,6 +710,16 @@ struct CraftWebView: UIViewRepresentable {
                     "isConnected": self?.isConnected ?? false,
                     "type": self?.connectionType ?? "unknown"
                 ])
+                // Only on false → true. Retrying whenever the path is merely
+                // satisfied would loop: a server that is down on a network
+                // that is up leaves the path satisfied throughout, so every
+                // update would retry, fail, fall back and retry again. That
+                // case recovers on the next foreground instead.
+                if !wasConnected, self?.isConnected == true {
+                    DispatchQueue.main.async {
+                        self?.returnFromBundledFallback(because: "the network came back")
+                    }
+                }
             }
             networkMonitor?.start(queue: DispatchQueue.global())
         }
@@ -635,6 +734,9 @@ struct CraftWebView: UIViewRepresentable {
                   let action = body["action"] as? String else { return }
 
             let callbackId = body["callbackId"] as? String
+            // Before Zig is offered the call, because the seed has to cover
+            // every id the page drew, not only the ones Swift went on to serve.
+            noteCallbackId(callbackId)
 
             // The Zig runtime first, when there is one.
             //
@@ -845,6 +947,8 @@ struct CraftWebView: UIViewRepresentable {
             case "setBadge":
                 if let count = body["count"] as? Int {
                     setBadgeCount(count, callbackId: callbackId)
+                } else {
+                    rejectCallback(callbackId, error: "setBadge needs a whole number of badges", code: "INVALID_ARGUMENT")
                 }
             case "clearBadge":
                 setBadgeCount(0, callbackId: callbackId)
@@ -859,6 +963,8 @@ struct CraftWebView: UIViewRepresentable {
             case "setFlashlight":
                 if let enabled = body["enabled"] as? Bool {
                     setFlashlight(enabled: enabled, callbackId: callbackId)
+                } else {
+                    rejectCallback(callbackId, error: "setFlashlight needs true or false", code: "INVALID_ARGUMENT")
                 }
             // Vibrate pattern
             case "vibrate":
@@ -873,6 +979,8 @@ struct CraftWebView: UIViewRepresentable {
                 if let urlString = body["url"] as? String, let url = URL(string: urlString) {
                     UIApplication.shared.open(url)
                     resolveCallback(callbackId, result: true)
+                } else {
+                    rejectCallback(callbackId, error: "openURL needs a URL it can parse", code: "INVALID_ARGUMENT")
                 }
             // App state
             case "getAppState":
@@ -1280,6 +1388,8 @@ struct CraftWebView: UIViewRepresentable {
             case "setShortcuts":
                 if let shortcuts = body["shortcuts"] as? [[String: Any]] {
                     setAppShortcuts(shortcuts: shortcuts, callbackId: callbackId)
+                } else {
+                    rejectCallback(callbackId, error: "setShortcuts needs a list of shortcuts", code: "INVALID_ARGUMENT")
                 }
             case "clearShortcuts":
                 clearAppShortcuts(callbackId: callbackId)
@@ -1290,16 +1400,22 @@ struct CraftWebView: UIViewRepresentable {
                    let value = body["value"] as? String {
                     let group = body["group"] as? String
                     setSharedKeychainItem(key: key, value: value, group: group, callbackId: callbackId)
+                } else {
+                    rejectCallback(callbackId, error: "setSharedItem needs both a key and a value", code: "INVALID_ARGUMENT")
                 }
             case "getSharedItem":
                 if let key = body["key"] as? String {
                     let group = body["group"] as? String
                     getSharedKeychainItem(key: key, group: group, callbackId: callbackId)
+                } else {
+                    rejectCallback(callbackId, error: "getSharedItem needs a key", code: "INVALID_ARGUMENT")
                 }
             case "removeSharedItem":
                 if let key = body["key"] as? String {
                     let group = body["group"] as? String
                     removeSharedKeychainItem(key: key, group: group, callbackId: callbackId)
+                } else {
+                    rejectCallback(callbackId, error: "removeSharedItem needs a key", code: "INVALID_ARGUMENT")
                 }
 
             // MARK: - Local Auth Persistence
@@ -1307,6 +1423,8 @@ struct CraftWebView: UIViewRepresentable {
                 if let enabled = body["enabled"] as? Bool {
                     let duration = body["duration"] as? Double ?? 300 // 5 min default
                     setBiometricPersistence(enabled: enabled, duration: duration, callbackId: callbackId)
+                } else {
+                    rejectCallback(callbackId, error: "setBiometricPersistence needs true or false", code: "INVALID_ARGUMENT")
                 }
             case "checkBiometricPersistence":
                 checkBiometricPersistence(callbackId: callbackId)
@@ -1390,6 +1508,8 @@ struct CraftWebView: UIViewRepresentable {
             case "updateWidget":
                 if let data = body["data"] as? [String: Any] {
                     updateWidget(data: data, callbackId: callbackId)
+                } else {
+                    rejectCallback(callbackId, error: "updateWidget needs a data object", code: "INVALID_ARGUMENT")
                 }
             case "reloadWidgets":
                 reloadAllWidgets(callbackId: callbackId)
@@ -1399,20 +1519,28 @@ struct CraftWebView: UIViewRepresentable {
                 if let phrase = body["phrase"] as? String,
                    let action = body["shortcutAction"] as? String {
                     registerSiriShortcut(phrase: phrase, action: action, callbackId: callbackId)
+                } else {
+                    rejectCallback(callbackId, error: "registerSiriShortcut needs both a phrase and a shortcutAction", code: "INVALID_ARGUMENT")
                 }
             case "removeSiriShortcut":
                 if let action = body["shortcutAction"] as? String {
                     removeSiriShortcut(action: action, callbackId: callbackId)
+                } else {
+                    rejectCallback(callbackId, error: "removeSiriShortcut needs a shortcutAction", code: "INVALID_ARGUMENT")
                 }
 
             // MARK: - Watch Connectivity
             case "sendToWatch":
                 if let message = body["message"] as? [String: Any] {
                     sendMessageToWatch(message: message, callbackId: callbackId)
+                } else {
+                    rejectCallback(callbackId, error: "sendToWatch needs a message object", code: "INVALID_ARGUMENT")
                 }
             case "updateWatchContext":
                 if let context = body["context"] as? [String: Any] {
                     updateWatchContext(context: context, callbackId: callbackId)
+                } else {
+                    rejectCallback(callbackId, error: "updateWatchContext needs a context object", code: "INVALID_ARGUMENT")
                 }
             case "isWatchReachable":
                 isWatchReachable(callbackId: callbackId)
@@ -1453,10 +1581,17 @@ struct CraftWebView: UIViewRepresentable {
         }
 
         func webView(_ webView: WKWebView, didFailProvisionalNavigation navigation: WKNavigation!, withError error: Error) {
-            loadBundledFallback(in: webView)
+            fallBackIfUnreachable(webView, after: error)
         }
 
         func webView(_ webView: WKWebView, didFail navigation: WKNavigation!, withError error: Error) {
+            fallBackIfUnreachable(webView, after: error)
+        }
+
+        /// Both used to fall back on *any* error, -999 included, so a second
+        /// tap before the first page committed ended the session on the bundle.
+        private func fallBackIfUnreachable(_ webView: WKWebView, after error: Error) {
+            guard CraftLoadFailure.isUnreachable(error) else { return }
             loadBundledFallback(in: webView)
         }
 
@@ -1465,9 +1600,35 @@ struct CraftWebView: UIViewRepresentable {
                   config.devServerURL != nil,
                   let bundledURL = URL(string: "craft://app/index.html") else { return }
             loadedBundledFallback = true
+            // Kept for the way back: `returnFromBundledFallback` has no view of
+            // its own to reload.
+            self.webView = webView
             webView.load(URLRequest(url: bundledURL))
         }
 
+        /// Leave the bundled copy for the remote origin again (#252).
+        ///
+        /// It used to be one-way for the life of the process, and the bundle
+        /// cannot reach a frontend's API by relative path — so one dropped
+        /// connection meant no API until the app was killed.
+        ///
+        /// Called when connectivity comes back and when the app returns to the
+        /// foreground, never on every path update. If the remote is still out
+        /// of reach, the load fails with a connectivity error and falls back
+        /// again: one round trip per trigger, not a loop.
+        private func returnFromBundledFallback(because reason: String) {
+            guard loadedBundledFallback,
+                  let webView,
+                  let remote = config.devServerURL.flatMap(URL.init(string:)) else { return }
+            loadedBundledFallback = false
+            print("Craft: \(reason); loading \(remote) again instead of the bundled copy")
+            webView.load(URLRequest(url: remote))
+        }
+
+        @objc private func appWillEnterForeground(_ notification: Notification) {
+            returnFromBundledFallback(because: "the app returned to the foreground")
+        }
+
         private func isTrustedURL(_ url: URL?) -> Bool {
             guard let url = url else { return false }
             return isTrustedOrigin(scheme: url.scheme ?? "", host: url.host ?? "", port: url.port ?? 0)
@@ -1509,6 +1670,16 @@ struct CraftWebView: UIViewRepresentable {
             return allowed.contains(origin)
         }
 
+        /// Raise the seed to cover an id the page has just used.
+        ///
+        /// Every call the page makes arrives here first, including the ones
+        /// Zig serves, so this sees the whole range a load hands out.
+        private func noteCallbackId(_ callbackId: String?) {
+            guard let callbackId, callbackId.hasPrefix("cb_"),
+                  let drawn = Int(callbackId.dropFirst(3)) else { return }
+            if drawn > highestCallbackId { highestCallbackId = drawn }
+        }
+
         private func injectNativeBridge() {
             let laContext = LAContext()
             var biometricAvailable = false
@@ -1548,7 +1719,9 @@ struct CraftWebView: UIViewRepresentable {
                 },
 
                 _callbacks: {},
-                _callbackId: 0,
+                // Not 0: an id must not repeat one an earlier load of this
+                // page is still waiting on an answer for (#226).
+                _callbackId: \(highestCallbackId),
 
                 _createCallback: function() {
                     var id = 'cb_' + (++this._callbackId);
@@ -1952,10 +2125,10 @@ struct CraftWebView: UIViewRepresentable {
                     return this.geolocation.getCurrentPosition({});
                 },
                 watchPosition: function(callback) {
-                    return this.geolocation.watchPosition(callback);
+                    return this.location.watchPosition(callback);
                 },
                 clearWatch: function(watchId) {
-                    return this.geolocation.clearWatch(watchId);
+                    return this.location.clearWatch(watchId);
                 },
                 getContacts: function() {
                     return this._invoke('getContacts');
@@ -2951,6 +3124,60 @@ struct CraftWebView: UIViewRepresentable {
                 };
             })(window.craft);
 
+            // A notification tap that arrived before anything subscribed.
+            //
+            // On a cold launch the tap is flushed the moment the bridge is
+            // ready, and a page that wires its listener once its router has
+            // hydrated — which is most single-page apps — was not listening
+            // yet, so "open the thing this notification is about" opened the
+            // home screen instead. Deep links hit the same wall (#198) and
+            // are held the same way: state on window, so a second injection
+            // into the same page does not start a fresh buffer, and the first
+            // subscriber is handed whatever it missed.
+            (function installNotificationTapReplay(craft) {
+                var replay = window.__craftNotificationTapReplay;
+                if (!replay) {
+                    replay = window.__craftNotificationTapReplay = {undelivered: [], subscribed: false};
+                    window.addEventListener('craftNotificationResponse', function(e) {
+                        if (!replay.subscribed) replay.undelivered.push(e.detail);
+                    });
+                }
+                craft._subscribeNotificationTaps = function(callback) {
+                    var active = true;
+                    var listener = function(e) { callback(e.detail); };
+                    window.addEventListener('craftNotificationResponse', listener);
+                    if (!replay.subscribed) {
+                        replay.subscribed = true;
+                        setTimeout(function() {
+                            var pending = replay.undelivered;
+                            replay.undelivered = [];
+                            if (!active) return;
+                            pending.forEach(function(detail) { callback(detail); });
+                        }, 0);
+                    }
+                    return function() {
+                        active = false;
+                        window.removeEventListener('craftNotificationResponse', listener);
+                    };
+                };
+                if (craft.notifications) {
+                    craft.notifications.onTap = function(callback) {
+                        return craft._subscribeNotificationTaps(callback);
+                    };
+                    // A notification that arrived while the page was open.
+                    // Live only, with nothing held: it matters to a page that
+                    // is running, and one that subscribes later has no use for
+                    // an arrival it was not there to see.
+                    craft.notifications.onReceive = function(callback) {
+                        var listener = function(e) { callback(e.detail); };
+                        window.addEventListener('craftNotificationReceived', listener);
+                        return function() {
+                            window.removeEventListener('craftNotificationReceived', listener);
+                        };
+                    };
+                }
+            })(window.craft);
+
             (function installCraftMobileContract(craft) {
                 var legacyShare = craft.share.bind(craft);
                 var legacyOpenCamera = craft.openCamera.bind(craft);
@@ -3026,21 +3253,80 @@ struct CraftWebView: UIViewRepresentable {
                 };
 
                 var locationWatchCallbacks = new Map();
+                var legacyLocationWatchCallbacks = [];
                 var nextLocationWatchId = 0;
+                var locationWatchStarted = false;
+                var locationWatchStart = null;
+                var locationWatchGeneration = 0;
+
+                function hasLocationWatchers() {
+                    return locationWatchCallbacks.size > 0 || legacyLocationWatchCallbacks.length > 0;
+                }
+
+                function startLocationWatch() {
+                    if (locationWatchStarted) return Promise.resolve(true);
+                    if (locationWatchStart) return locationWatchStart;
+
+                    var generation = locationWatchGeneration;
+                    var pending = craft._invoke('watchPosition');
+                    var managed = pending.then(function(result) {
+                        if (generation === locationWatchGeneration) {
+                            locationWatchStarted = hasLocationWatchers();
+                        }
+                        if (locationWatchStart === managed) locationWatchStart = null;
+                        return result;
+                    }, function(error) {
+                        if (generation === locationWatchGeneration) {
+                            locationWatchCallbacks.clear();
+                            legacyLocationWatchCallbacks.length = 0;
+                            locationWatchStarted = false;
+                        }
+                        if (locationWatchStart === managed) locationWatchStart = null;
+                        throw error;
+                    });
+                    locationWatchStart = managed;
+                    return managed;
+                }
+
+                function stopLocationWatchIfUnused() {
+                    if (hasLocationWatchers()) return Promise.resolve(true);
+                    if (!locationWatchStarted && !locationWatchStart) return Promise.resolve(true);
+
+                    locationWatchGeneration += 1;
+                    locationWatchStarted = false;
+                    locationWatchStart = null;
+                    return craft._invoke('clearWatch');
+                }
+
                 window.addEventListener('craftLocationUpdate', function(event) {
                     locationWatchCallbacks.forEach(function(callback) { callback(event.detail); });
+                    legacyLocationWatchCallbacks.slice().forEach(function(callback) { callback(event.detail); });
                 });
+                legacyGeolocation.watchPosition = function(callback) {
+                    legacyLocationWatchCallbacks.push(callback);
+                    return startLocationWatch();
+                };
+                legacyGeolocation.clearWatch = function() {
+                    legacyLocationWatchCallbacks.length = 0;
+                    return stopLocationWatchIfUnused();
+                };
                 craft.location = {
                     getCurrentPosition: function(options) { return legacyGeolocation.getCurrentPosition(options || {}); },
                     watchPosition: function(callback) {
                         var id = ++nextLocationWatchId;
                         locationWatchCallbacks.set(id, callback);
-                        if (locationWatchCallbacks.size === 1) void craft._invoke('watchPosition');
+                        void startLocationWatch().catch(function() {});
                         return id;
                     },
                     clearWatch: function(id) {
-                        locationWatchCallbacks.delete(id);
-                        if (locationWatchCallbacks.size === 0) void craft._invoke('clearWatch');
+                        if (typeof id === 'undefined') {
+                            locationWatchCallbacks.clear();
+                            legacyLocationWatchCallbacks.length = 0;
+                            void stopLocationWatchIfUnused().catch(function() {});
+                            return;
+                        }
+                        if (!locationWatchCallbacks.delete(id)) return;
+                        void stopLocationWatchIfUnused().catch(function() {});
                     },
                     startRecording: function() { return craft._invoke('startLocationRecording'); },
                     pauseRecording: function() { return craft._invoke('pauseLocationRecording'); },
@@ -3387,36 +3673,68 @@ struct CraftWebView: UIViewRepresentable {
         }
 
         // MARK: - Push Notifications
+
+        /// The deadline covering the APNs round trip, once authorization is in.
+        private var pendingPushDeadline: UUID?
+
         private func registerPushNotifications(callbackId: String?) {
+            // A second call used to overwrite the first's callbackId, and the
+            // first promise then never settled at all. Displacing a call is an
+            // answer the caller can act on, the way a replaced
+            // getCurrentPosition request is rejected rather than dropped.
+            if let displaced = pendingPushCallbackId {
+                if let token = pendingPushDeadline { _ = claimDeadline(token) }
+                pendingPushDeadline = nil
+                rejectCallback(displaced, error: "Replaced by another push registration", code: "CANCELLED")
+            }
             pendingPushCallbackId = callbackId
             UNUserNotificationCenter.current().requestAuthorization(options: [.alert, .badge, .sound]) { [weak self] granted, error in
                 if granted {
                     DispatchQueue.main.async {
+                        guard let self else { return }
+                        // Armed here rather than at dispatch: until the person
+                        // answers the prompt there is someone to wait for, and
+                        // only the APNs round trip afterwards is unattended.
+                        self.pendingPushDeadline = self.armDeadline(
+                            Coordinator.pushRegistrationDeadline,
+                            callbackId: callbackId,
+                            error: "APNs did not call back within \(Int(Coordinator.pushRegistrationDeadline))s"
+                        )
+                        self.pendingPushCallbackId = callbackId
                         UIApplication.shared.registerForRemoteNotifications()
                     }
                 } else {
-                    self?.rejectCallback(callbackId, error: error?.localizedDescription ?? "Permission denied")
-                    self?.pendingPushCallbackId = nil
+                    DispatchQueue.main.async { [weak self] in
+                        guard let self, self.pendingPushCallbackId == callbackId else { return }
+                        self.rejectCallback(callbackId, error: error?.localizedDescription ?? "Permission denied")
+                        self.pendingPushCallbackId = nil
+                    }
                 }
             }
         }
 
+        /// Whether this push callback is still the one waiting, claiming it if so.
+        private func claimPushRegistration() -> String?? {
+            guard let callbackId = pendingPushCallbackId else { return nil }
+            if let token = pendingPushDeadline, !claimDeadline(token) { return nil }
+            pendingPushDeadline = nil
+            pendingPushCallbackId = nil
+            return .some(callbackId)
+        }
+
         @objc private func receivePushToken(_ notification: Notification) {
             guard let token = notification.object as? String else { return }
-            resolveCallback(pendingPushCallbackId, result: token)
-            pendingPushCallbackId = nil
+            // The event goes out either way: a token that arrives after its
+            // deadline is still this app's token, and a page listening for
+            // craftPushToken is not the caller that timed out.
+            if let claimed = claimPushRegistration() { resolveCallback(claimed, result: token) }
             sendToWeb("craftPushToken", data: ["token": token])
         }
 
         @objc private func receivePushRegistrationError(_ notification: Notification) {
             let message = notification.object as? String ?? "Push registration failed"
-            rejectCallback(pendingPushCallbackId, error: message, code: "PUSH_REGISTRATION_ERROR")
-            pendingPushCallbackId = nil
-        }
-
-        @objc private func receiveNotificationResponse(_ notification: Notification) {
-            let data = notification.object as? [String: Any] ?? [:]
-            sendToWeb("craftNotificationResponse", data: data)
+            guard let claimed = claimPushRegistration() else { return }
+            rejectCallback(claimed, error: message, code: "PUSH_REGISTRATION_ERROR")
         }
 
         // MARK: - Secure Storage (Keychain)
@@ -3507,6 +3825,13 @@ struct CraftWebView: UIViewRepresentable {
                 let status = CBManager.authorization
                 resolveCallback(callbackId, result: permissionStatus(status == .allowedAlways, denied: status == .denied, restricted: status == .restricted))
             case "notifications":
+                // Zig answers UnknownAction for this permission, so Swift
+                // serves it on both runtimes and this is the only answer.
+                let token = armDeadline(
+                    Coordinator.notificationSettingsDeadline,
+                    callbackId: callbackId,
+                    error: "UNUserNotificationCenter.getNotificationSettings did not answer within \(Int(Coordinator.notificationSettingsDeadline))s"
+                )
                 UNUserNotificationCenter.current().getNotificationSettings { settings in
                     let status: String
                     switch settings.authorizationStatus {
@@ -3515,7 +3840,10 @@ struct CraftWebView: UIViewRepresentable {
                     case .notDetermined: status = "undetermined"
                     @unknown default: status = "undetermined"
                     }
-                    self.resolveCallback(callbackId, result: status)
+                    DispatchQueue.main.async { [weak self] in
+                        guard let self, self.claimDeadline(token) else { return }
+                        self.resolveCallback(callbackId, result: status)
+                    }
                 }
             default:
                 resolveCallback(callbackId, result: "undetermined")
@@ -3850,9 +4178,23 @@ struct CraftWebView: UIViewRepresentable {
         }
 
         func locationManager(_ manager: CLLocationManager, didFailWithError error: Error) {
+            let nativeError = error as NSError
+            // kCLErrorLocationUnknown is Core Location saying it has no fix
+            // *yet*, not that it failed. requestLocation gives up on it, so a
+            // one-shot asks again shortly instead of failing a caller whose
+            // fix was seconds off; its timeout still bounds the wait (#260).
+            // Nor is it an error event: a watch keeps running through it.
+            if nativeError.domain == kCLErrorDomain && nativeError.code == CLError.Code.locationUnknown.rawValue {
+                if let waiting = singleLocationCallbackId {
+                    DispatchQueue.main.asyncAfter(deadline: .now() + .seconds(1)) { [weak self] in
+                        guard let self, self.singleLocationCallbackId == waiting else { return }
+                        self.locationManager?.requestLocation()
+                    }
+                }
+                return
+            }
             let callbackId = singleLocationCallbackId
             finishSingleLocationRequest()
-            let nativeError = error as NSError
             let code = nativeError.domain == kCLErrorDomain && nativeError.code == CLError.Code.denied.rawValue
                 ? "PERMISSION_DENIED"
                 : "POSITION_UNAVAILABLE"
@@ -4164,6 +4506,10 @@ struct CraftWebView: UIViewRepresentable {
                 content.body = data["body"] as? String ?? ""
                 if let subtitle = data["subtitle"] as? String { content.subtitle = subtitle }
                 if let badge = data["badge"] as? Int { content.badge = NSNumber(value: badge) }
+                // The page's `data`, which is what a tap (#255) and an arrival
+                // (#256) hand back. It was dropped, so a tap on a scheduled
+                // notification reached the page as {} (#258).
+                if let info = data["data"] as? [String: Any] { content.userInfo = info }
                 content.sound = .default
 
                 let id = data["id"] as? String ?? UUID().uuidString
@@ -4214,6 +4560,13 @@ struct CraftWebView: UIViewRepresentable {
 
         // MARK: - In-App Purchase
         private func getProducts(_ productIds: [String], callbackId: String?) {
+            // Nobody is in front of a StoreKit fetch, and it reaches the
+            // network: a request that never returns leaves the page waiting.
+            let token = armDeadline(
+                Coordinator.storeKitDeadline,
+                callbackId: callbackId,
+                error: "StoreKit did not return products within \(Int(Coordinator.storeKitDeadline))s"
+            )
             Task {
                 do {
                     let products = try await Product.products(for: Set(productIds))
@@ -4226,9 +4579,15 @@ struct CraftWebView: UIViewRepresentable {
                             "displayPrice": product.displayPrice
                         ]
                     }
-                    resolveCallback(callbackId, result: productData)
+                    await MainActor.run { [weak self] in
+                        guard let self, self.claimDeadline(token) else { return }
+                        self.resolveCallback(callbackId, result: productData)
+                    }
                 } catch {
-                    rejectCallback(callbackId, error: error.localizedDescription)
+                    await MainActor.run { [weak self] in
+                        guard let self, self.claimDeadline(token) else { return }
+                        self.rejectCallback(callbackId, error: error.localizedDescription)
+                    }
                 }
             }
         }
@@ -4948,9 +5307,17 @@ struct CraftWebView: UIViewRepresentable {
                 durationSeconds: body["durationSeconds"] as? Double ?? current.durationSeconds,
                 progress: min(max(body["progress"] as? Double ?? current.progress, 0), 1)
             )
+            let token = armDeadline(
+                Coordinator.liveActivityDeadline,
+                callbackId: callbackId,
+                error: "Activity.update did not return within \(Int(Coordinator.liveActivityDeadline))s"
+            )
             Task {
                 await activity.update(ActivityContent(state: state, staleDate: nil))
-                resolveCallback(callbackId, result: ["updated": true])
+                await MainActor.run { [weak self] in
+                    guard let self, self.claimDeadline(token) else { return }
+                    self.resolveCallback(callbackId, result: ["updated": true])
+                }
             }
         }
 
@@ -4991,9 +5358,17 @@ struct CraftWebView: UIViewRepresentable {
             } else {
                 finalContent = nil
             }
+            let token = armDeadline(
+                Coordinator.liveActivityDeadline,
+                callbackId: callbackId,
+                error: "Activity.end did not return within \(Int(Coordinator.liveActivityDeadline))s"
+            )
             Task {
                 await activity.end(finalContent, dismissalPolicy: .default)
-                resolveCallback(callbackId, result: ["ended": true])
+                await MainActor.run { [weak self] in
+                    guard let self, self.claimDeadline(token) else { return }
+                    self.resolveCallback(callbackId, result: ["ended": true])
+                }
             }
         }
 
@@ -5622,6 +5997,54 @@ struct CraftWebView: UIViewRepresentable {
 
         // Removals waiting on their completion, each under a token of its own:
         // callbackId can be nil, and restarts when the page reloads.
+        /// One entry per call whose only answer is a framework callback.
+        ///
+        /// Each of these waits on something no person is in front of — a
+        /// notification-settings read, an APNs registration, a StoreKit fetch,
+        /// a Live Activity update — and nothing else settles the page's
+        /// promise if the callback never comes (#224). #211 found the same
+        /// shape in a Siri deletion, twice, on CI.
+        ///
+        /// Whoever claims the token first answers: the callback or the
+        /// deadline. Both run on the main queue, so the race is decided there
+        /// rather than by a lock, and the loser finds nothing and does
+        /// nothing. The deadline never claims the work happened — it may well
+        /// have — only that nothing reported back in time.
+        private var pendingDeadlines: [UUID: DispatchWorkItem] = [:]
+
+        /// How long each of them waits. Comfortably under the 30s the page's
+        /// own `_invoke` allows, so the caller hears the native answer rather
+        /// than its own timeout, and long enough that a slow device is not
+        /// cut off mid-answer.
+        private static let notificationSettingsDeadline: TimeInterval = 10
+        private static let pushRegistrationDeadline: TimeInterval = 20
+        private static let storeKitDeadline: TimeInterval = 20
+        private static let liveActivityDeadline: TimeInterval = 10
+
+        /// Arm a deadline for a call, and return the token that claims it.
+        private func armDeadline(_ seconds: TimeInterval, callbackId: String?, error: String) -> UUID {
+            let token = UUID()
+            let work = DispatchWorkItem { [weak self] in
+                guard let self, self.pendingDeadlines.removeValue(forKey: token) != nil else { return }
+                self.rejectCallback(callbackId, error: error, code: "TIMEOUT")
+            }
+            pendingDeadlines[token] = work
+            DispatchQueue.main.asyncAfter(deadline: .now() + seconds, execute: work)
+            return token
+        }
+
+        /// Claim the right to answer. False means the deadline already did.
+        ///
+        /// Call it on the main queue: the callbacks below hop there first,
+        /// because the queue a framework completion arrives on is its own
+        /// business and a `zig:` hand-off reply reaches `evaluateJavaScript`
+        /// with no hop of its own.
+        private func claimDeadline(_ token: UUID) -> Bool {
+            guard let work = pendingDeadlines.removeValue(forKey: token) else { return false }
+            work.cancel()
+            return true
+        }
+
         private var pendingSiriRemovals: [UUID: DispatchWorkItem] = [:]
         // The only thing that settles craft.siri.remove, which arms no timeout
         // of its own; the same as Zig's.