craft-native 0.0.486 → 0.0.490

package/dist/android/src/index.d.ts

@@ -183,6 +183,20 @@ export interface CraftAndroidConfig {
      * screen, and a change of it is `SESSION_CHANGED { key, token, previous }`.
      */
     sessionTokenKey?: string;
+    /**
+     * Which screens a signed-out launch may start on.
+     *
+     * The shell resolves this while choosing the start path, before any screen
+     * is built. The `nativeApp` script cannot do the same job: `openScreen`
+     * returns as soon as it has an isolate and evaluates the script later, so
+     * the gate and the first screen race — and on a launch that follows an
+     * expired token rather than a sign-out, losing paints the previous
+     * session's kept snapshot.
+     *
+     * The same shape as the iOS field, deliberately: one `nativeGate` block
+     * must gate both hosts or an app is protected on one and not the other.
+     */
+    nativeGate?: AndroidNativeGate;
     /** Wake the app script every so often (`craftBackgroundRefresh`), through WorkManager. */
     backgroundRefresh?: {
         enabled?: boolean;
@@ -208,6 +222,20 @@ export interface CraftAndroidConfig {
         sessions?: boolean;
     };
 }
+/**
+ * An auth gate the shell applies while choosing the start path.
+ *
+ * See `CraftAndroidConfig.nativeGate`. Mirrors the iOS `NativeGate`, field for
+ * field, because one config block has to gate both hosts.
+ */
+export interface AndroidNativeGate {
+    /** Paths a signed-out launch may start on, each admitting what sits under it. */
+    publicPaths?: string[];
+    /** Where a signed-out launch starts instead. */
+    redirect: string;
+    /** The secure-storage key holding the sign-in. Defaults to `sessionTokenKey`. */
+    token?: string;
+}
 export interface CraftTabBarConfig {
     selection?: {
         /** The selected tab indicator's corner radius in dp; omitted keeps the default. */

package/dist/android/src/index.js

@@ -1247,6 +1247,21 @@ function validateNativeRouteConfig(config) {
     if (!matchesNativeRoute(config.nativeScreens, start, config.nativeScreenConstraints))
       throw new Error(`The start path "${start}" (from devServerURL) is not a nativeScreens path; with renderer: "native" the app must start on a native screen.`);
   }
+  const gate = config.nativeGate;
+  if (gate !== undefined) {
+    if (typeof gate.redirect !== "string" || normalizeNativeRoutePath(gate.redirect) !== gate.redirect)
+      throw new Error(`nativeGate.redirect "${String(gate.redirect)}" must be an absolute path with no query, hash or trailing slash.`);
+    if (config.renderer === "native" && screens.length > 0 && !matchesNativeRoute(config.nativeScreens, gate.redirect, config.nativeScreenConstraints))
+      throw new Error(`nativeGate.redirect "${gate.redirect}" is not a nativeScreens path; a signed-out launch would have nothing to show.`);
+    for (const path of gate.publicPaths ?? []) {
+      if (typeof path !== "string" || normalizeNativeRoutePath(path) !== path)
+        throw new Error(`nativeGate.publicPaths "${String(path)}" must be an absolute path with no query, hash or trailing slash.`);
+    }
+    if (!(gate.publicPaths ?? []).some((path) => gate.redirect === path || gate.redirect.startsWith(`${path}/`)))
+      throw new Error(`nativeGate.redirect "${gate.redirect}" must also be listed in nativeGate.publicPaths.`);
+    if (gate.token !== undefined && (typeof gate.token !== "string" || !gate.token))
+      throw new Error("nativeGate.token must be the secure-storage key the sign-in lives under.");
+  }
   if (config.nativeApp !== undefined) {
     if (typeof config.nativeApp !== "string" || !/^[A-Za-z_$][\w$-]*$/.test(config.nativeApp))
       throw new Error(`nativeApp "${String(config.nativeApp)}" must be a route name from the native bundle.`);

package/dist/android/templates/CraftNativeServices.kt.template

@@ -685,7 +685,16 @@ internal class CraftNativeServices(
                 voiceRecorder = null
                 val metadata = MediaMetadataRetriever()
                 val duration = try { metadata.setDataSource(file.absolutePath); (metadata.extractMetadata(MediaMetadataRetriever.METADATA_KEY_DURATION)?.toDoubleOrNull() ?: 0.0) / 1000 } finally { metadata.release() }
-                if (!file.exists() || file.length() == 0L || duration <= 0) throw IllegalStateException("Empty recording")
+                // Nothing recorded is its own answer, not a read failure.
+                // Thrown into the blanket catch below, it reached callers as
+                // RECORDING_FAILED and became indistinguishable from a damaged
+                // file, so an app could offer "nothing was recorded — try
+                // again" on iOS and not here (#496).
+                if (!file.exists() || file.length() == 0L || duration <= 0) {
+                    cancelVoice()
+                    done(failure("EMPTY_RECORDING", "The recording was empty"))
+                    return
+                }
                 done(success(JSONObject().put("path", file.absolutePath).put("name", file.name).put("type", "audio/mp4").put("size", file.length()).put("durationSeconds", duration)))
             } catch (_: Exception) { cancelVoice(); done(failure("RECORDING_FAILED", "The recording could not be read")) }
             return

package/dist/android/templates/CraftNativeShell.kt.template

@@ -398,6 +398,15 @@ internal class CraftNativeStores private constructor(
 
     fun snapshot(name: String): String? = snapshotCache[name]
 
+    /**
+     * One secure value, read directly rather than through the preload.
+     *
+     * For code that runs before any isolate exists. The auth gate resolves the
+     * start path before the first screen is built, so it cannot wait for the
+     * preload every isolate is handed (#499).
+     */
+    fun secureValue(key: String): String? = secure?.getString(key, null)
+
     /** `craft.storage.setSync`: null removes the key. Tells every isolate. */
     fun setStorage(key: String, json: String?, from: String?) {
         synchronized(CraftNativeStorage.lock) {
@@ -465,7 +474,19 @@ internal class CraftNativeStores private constructor(
         CraftNativeHub.broadcast("SYNC_UPDATE", payload, except = from)
     }
 
-    private fun isSnapshotName(name: String): Boolean = name.matches(Regex("[A-Za-z0-9_-][A-Za-z0-9_.-]{0,127}"))
+    /**
+     * The same names UIKit accepts, so one checkpoint key is not valid on one
+     * host and refused on the other.
+     *
+     * `CraftSnapshots.isValidName` allows ASCII alphanumerics and `-_.:`, up
+     * to 128 characters, and rejects only a leading dot. The `:` is deliberate
+     * there — its own comment calls it the account namespace — so a key like
+     * `account:slot` wrote on iOS and came back `false` on Android.
+     *
+     * A colon never reaches the filesystem: `snapshotFile` percent-encodes the
+     * name, and `snapshotName` decodes it back.
+     */
+    private fun isSnapshotName(name: String): Boolean = name.matches(Regex("[A-Za-z0-9_:-][A-Za-z0-9_.:-]{0,127}"))
 
     private fun snapshotFile(name: String): File = File(snapshotsDir, URLEncoder.encode(name, "UTF-8") + ".json")
 
@@ -495,6 +516,32 @@ internal object CraftNativePrelude {
      */
     fun sessionTokenKey(config: JSONObject): String = config.optString("sessionTokenKey").ifBlank { "auth.token" }
 
+    /**
+     * Whether `path` may be shown to someone who is not signed in.
+     *
+     * Listed, or under something listed: `/m/store` admits `/m/store/42` and
+     * not `/m/storefront`. The separator is attached before comparing so a
+     * listed path cannot admit a sibling that merely starts with its letters.
+     *
+     * A literal mirror of `CraftHybrid.gateAdmits` in
+     * `packages/ios/templates/CraftHybrid.swift`, down to the trailing-slash
+     * trimming, because the two hosts must admit exactly the same paths from
+     * the same `publicPaths` list. `native-gate.test.ts` runs both against one
+     * table of cases.
+     */
+    fun gateAdmits(path: String, allowed: List<String>): Boolean = allowed.any { entry ->
+        var listed = entry
+        while (listed.length > 1 && listed.endsWith("/")) listed = listed.dropLast(1)
+        when {
+            listed.isEmpty() -> false
+            path == listed -> true
+            // "/" is the root path, not a prefix of everything. Reading it as
+            // one would admit every path, which is a gate that is not a gate.
+            listed == "/" -> false
+            else -> path.startsWith("$listed/")
+        }
+    }
+
     fun script(
         bridgeFields: String,
         post: String,
@@ -632,7 +679,12 @@ internal object CraftNativePrelude {
             if (message && message.type === 'FRAME_FIRE') {
               var due = frames;
               frames = [];
-              var time = message.payload && message.payload.time || Date.now();
+              // A real first frame is 0, which `||` would replace with a Unix
+              // epoch value twelve orders of magnitude away. Only a missing or
+              // non-finite time falls back, and it falls back to the same
+              // origin-relative scale rather than to wall-clock.
+              var reported = message.payload && message.payload.time;
+              var time = typeof reported === 'number' && isFinite(reported) ? reported : 0;
               due.forEach(function(entry) {
                 if (cancelledFrames[entry.id]) { delete cancelledFrames[entry.id]; return; }
                 try { entry.fn(time); } catch (error) { console.error('[frame] ' + (error && error.stack || error)); }
@@ -704,8 +756,11 @@ internal object CraftNativePrelude {
             if (json === null || json === undefined) return null;
             try { return JSON.parse(json); } catch (error) { return null; }
           }
+          // The same names the host accepts, including the `:` UIKit calls the
+          // account namespace. This gate runs inside the isolate, so a stricter
+          // rule here refuses a key the host would have kept.
           function validSnapshotName(name) {
-            return /^[A-Za-z0-9_-][A-Za-z0-9_.-]{0,127}$/.test(name);
+            return /^[A-Za-z0-9_:-][A-Za-z0-9_.:-]{0,127}$/.test(name);
           }
           var craft = globalThis.craft = globalThis.craft || {};
           function keep(name, extras) {
@@ -735,7 +790,7 @@ internal object CraftNativePrelude {
             },
             set: function(name, value) {
               name = String(name);
-              if (!validSnapshotName(name)) return Promise.reject(new TypeError('Snapshot names are letters, digits, ".", "_" and "-"'));
+              if (!validSnapshotName(name)) return Promise.reject(new TypeError('Snapshot names are letters, digits, ".", "_", "-" and ":"'));
               var json = value === null ? null : JSON.stringify(value);
               if (json === undefined) return Promise.reject(new TypeError('Snapshot ' + name + ' is not JSON'));
               if (json === null) delete sync.snapshots[name];
@@ -824,9 +879,24 @@ internal object CraftNativePrelude {
 
 /**
  * The bar above a screen (back, title, the screen's buttons) and the tab bar
- * below it, in plain Android views. A screen sets its bar with
- * `craft.navigation.setOptions` (title, largeTitle, hidden, rightButtons,
- * tabAccessory, tabBarHidden); the tabs come from the app's `tabs`.
+ * below it, in plain Android views. The tabs come from the app's `tabs`; a
+ * screen sets its own chrome with
+ *
+ * `craft.navigation.setOptions({ title, largeTitle, titleColor, hidden,
+ *   backgroundColor, leftButtons, rightButtons, tabItem, tabAccessory,
+ *   tabBarHidden, tabBarHiddenWhenPushed, tabSwipeEnabled })`
+ *
+ * which `apply` below reads. That list is checked against `apply` itself
+ * rather than kept by hand, and only the list is: the iOS comment named
+ * twelve keys while fifteen shipped (#489), and a first attempt at the same
+ * ratchet there passed with keys deleted because the prose underneath
+ * happened to mention them. Six of these twelve had never been written down.
+ *
+ * `tabBarHiddenWhenPushed` was honoured here and nowhere else in Craft until
+ * #493: hiding the tab bar on push is the ordinary iOS idiom, so a caller who
+ * set it got the behaviour on one host and silence on the other. UIKit reads
+ * the same key now, at the same depth, through CraftNativeScreen's
+ * `wantsTabBarHidden`.
  */
 internal class CraftNativeChrome(
     context: Context,
@@ -1316,7 +1386,25 @@ internal class CraftNativeChrome(
         if (badge > 0) {
             view.text = "${view.text}${if (button.optString("badgeStyle") == "dot") " •" else " $badge"}"
         }
-        view.setOnClickListener { onButton?.invoke(id) }
+        // `menu`: the button opens a popup instead of reporting its own id, and
+        // each choice is reported as a press of that choice's id.
+        val choices = button.optJSONArray("menu")
+        val menu = (0 until minOf(choices?.length() ?: 0, 12)).mapNotNull { index ->
+            choices?.optJSONObject(index)?.takeIf { it.optString("id").isNotBlank() && it.optString("title").isNotBlank() }
+        }
+        view.setOnClickListener {
+            if (menu.isEmpty()) onButton?.invoke(id)
+            else android.widget.PopupMenu(context, view).apply {
+                menu.forEachIndexed { index, choice ->
+                    this.menu.add(0, index, index, choice.optString("title")).isEnabled = !choice.optBoolean("disabled")
+                }
+                setOnMenuItemClickListener { selected ->
+                    menu.getOrNull(selected.itemId)?.let { onButton?.invoke(it.optString("id")) }
+                    true
+                }
+                show()
+            }
+        }
         view.layoutParams = LayoutParams(ViewGroup.LayoutParams.WRAP_CONTENT, ViewGroup.LayoutParams.MATCH_PARENT)
         return view
     }

package/dist/android/templates/MainActivityNative.kt.template

@@ -149,9 +149,37 @@ private fun craftNativeBoolean(value: Any?, fallback: Boolean = false): Boolean
 
 private fun craftNativeInt(value: Any?, fallback: Int): Int = (value as? Number)?.toInt() ?: fallback
 
+/**
+ * A scroll event's geometry in density-independent units.
+ *
+ * UIKit reports `contentOffset`, `contentSize` and `layoutMeasurement` in
+ * points, and this host's own `emitLayoutEvent` already divides a View's
+ * pixels by the display density. These three were the exception: they shipped
+ * raw pixels, so the same scroll handler saw values three times larger on a
+ * 3x Android screen than on iOS — and larger than the `onLayout` bounds the
+ * same screen reports, which is the comparison infinite-scroll code makes.
+ */
+private fun craftNativeScrollMetrics(
+    offsetX: Int,
+    offsetY: Int,
+    contentWidth: Int,
+    contentHeight: Int,
+    viewportWidth: Int,
+    viewportHeight: Int,
+    density: Double,
+): JSONObject {
+    // A density of zero would be a broken DisplayMetrics; report pixels rather
+    // than NaN, which JSON cannot carry and a handler cannot compare.
+    val scale = if (density.isFinite() && density > 0.0) density else 1.0
+    return JSONObject()
+        .put("contentOffset", JSONObject().put("x", offsetX / scale).put("y", offsetY / scale))
+        .put("contentSize", JSONObject().put("width", contentWidth / scale).put("height", contentHeight / scale))
+        .put("layoutMeasurement", JSONObject().put("width", viewportWidth / scale).put("height", viewportHeight / scale))
+}
+
 private fun craftNativePickerValue(value: Any?): String? = when (value) {
-    is String -> value.takeIf { it.isNotEmpty() }
-    is Number -> value.toDouble().takeIf { it.isFinite() }?.toString()
+    is String -> value
+    is Number -> value.toDouble().takeIf { it.isFinite() }?.let { value.toString() }
     else -> null
 }
 
@@ -391,6 +419,16 @@ private object CraftNativeSkewTransforms {
 /** A DOM-free SVG surface for the geometry emitted by the shared STX native protocol. */
 /** Local native chart selection: no JS events are needed while scrubbing. */
 private class CraftNativeChartInspection(private val view: View) {
+    companion object {
+        /** The one chart with a reading pinned open, if any. */
+        private var pinned: java.lang.ref.WeakReference<CraftNativeChartInspection>? = null
+        /** A touch that starts off the pinned chart closes its reading; the touch still lands where it was aimed. */
+        fun touchBegan(event: MotionEvent) {
+            if (event.actionMasked != MotionEvent.ACTION_DOWN) return
+            val open = pinned?.get() ?: return
+            if (!open.contains(event.rawX, event.rawY)) open.dismiss()
+        }
+    }
     private var fingerprint = ""
     private var title = ""
     private var points = emptyList<JSONObject>()
@@ -399,8 +437,9 @@ private class CraftNativeChartInspection(private val view: View) {
     private var startY = 0f
     private var dragging = false
     private var abandoned = false
+    private var holding = false
     private val slop = android.view.ViewConfiguration.get(view.context).scaledTouchSlop
-    private val hold = Runnable { if (!abandoned) selectAt(startX) }
+    private val hold = Runnable { if (!abandoned) { holding = true; selectAt(startX) } }
     val enabled: Boolean get() = points.isNotEmpty()
     private val density get() = view.resources.displayMetrics.density
     private fun dp(value: Float) = value * density
@@ -414,7 +453,7 @@ private class CraftNativeChartInspection(private val view: View) {
             val x = it.optDouble("x", Double.NaN)
             x.isFinite() && x in 0.0..1.0 && it.opt("label") is String
         }
-        selected = -1
+        dismiss()
         view.isFocusable = enabled
         view.invalidate()
     }
@@ -431,16 +470,31 @@ private class CraftNativeChartInspection(private val view: View) {
         view.sendAccessibilityEvent(android.view.accessibility.AccessibilityEvent.TYPE_VIEW_SELECTED)
         view.invalidate()
     }
-    private fun selectAt(x: Float) {
-        if (view.width <= 0) return
+    private fun nearest(x: Float): Int? {
+        if (view.width <= 0) return null
         val fraction = (x / view.width).coerceIn(0f, 1f)
-        points.indices.minByOrNull { kotlin.math.abs(points[it].optDouble("x") - fraction) }?.let { select(it) }
+        return points.indices.minByOrNull { kotlin.math.abs(points[it].optDouble("x") - fraction) }
+    }
+    private fun selectAt(x: Float) { nearest(x)?.let { select(it); pinned = java.lang.ref.WeakReference(this) } }
+    /** Puts the reading away. Returns whether one was showing. */
+    fun dismiss(): Boolean {
+        if (pinned?.get() === this) pinned = null
+        if (selected < 0) return false
+        selected = -1
+        view.invalidate()
+        return true
+    }
+    /** A tap pins the reading under it; tapping the pinned reading again puts it away. */
+    private fun tapAt(x: Float) { if (nearest(x) == selected) dismiss() else selectAt(x) }
+    private fun contains(rawX: Float, rawY: Float): Boolean {
+        val origin = IntArray(2).also { view.getLocationOnScreen(it) }
+        return rawX >= origin[0] && rawX < origin[0] + view.width && rawY >= origin[1] && rawY < origin[1] + view.height
     }
     fun touch(event: MotionEvent): Boolean {
         if (!enabled) return false
         when (event.actionMasked) {
             MotionEvent.ACTION_DOWN -> {
-                startX = event.x; startY = event.y; dragging = false; abandoned = false
+                startX = event.x; startY = event.y; dragging = false; abandoned = false; holding = false
                 view.postDelayed(hold, 250)
             }
             MotionEvent.ACTION_MOVE -> {
@@ -455,17 +509,19 @@ private class CraftNativeChartInspection(private val view: View) {
             }
             MotionEvent.ACTION_UP -> {
                 view.removeCallbacks(hold)
-                if (!abandoned) { view.performClick(); selectAt(event.x) }
+                // A drag or a hold reads the chart only while the finger is down.
+                if (dragging || holding) dismiss()
+                else if (!abandoned) { view.performClick(); tapAt(event.x) }
                 view.parent?.requestDisallowInterceptTouchEvent(false)
             }
             MotionEvent.ACTION_CANCEL -> {
-                view.removeCallbacks(hold); abandoned = true; selected = -1
-                view.parent?.requestDisallowInterceptTouchEvent(false); view.invalidate()
+                view.removeCallbacks(hold); abandoned = true; dismiss()
+                view.parent?.requestDisallowInterceptTouchEvent(false)
             }
         }
         return !abandoned
     }
-    fun detach() { view.removeCallbacks(hold); selected = -1 }
+    fun detach() { view.removeCallbacks(hold); dismiss() }
     fun accessibility(info: android.view.accessibility.AccessibilityNodeInfo) {
         if (!enabled) return
         info.className = "android.widget.SeekBar"
@@ -480,7 +536,7 @@ private class CraftNativeChartInspection(private val view: View) {
         when (action) {
             android.view.accessibility.AccessibilityNodeInfo.ACTION_SCROLL_FORWARD -> select(if (selected < 0) 0 else selected + 1)
             android.view.accessibility.AccessibilityNodeInfo.ACTION_SCROLL_BACKWARD -> select(if (selected < 0) points.lastIndex else selected - 1)
-            android.view.accessibility.AccessibilityNodeInfo.ACTION_DISMISS -> { selected = -1; view.invalidate() }
+            android.view.accessibility.AccessibilityNodeInfo.ACTION_DISMISS -> dismiss()
             else -> return false
         }
         return true
@@ -1186,6 +1242,7 @@ internal object CraftNativePointers {
     fun ownsTouch(view: View): Boolean = route(view).firstOrNull() !in setOf("none", "box-none")
 
     fun dispatch(view: View, event: MotionEvent, native: (MotionEvent) -> Boolean): Boolean {
+        CraftNativeChartInspection.touchBegan(event)
         val state = states.getOrPut(view) { State() }
         val route = route(view)
         if (event.actionMasked == MotionEvent.ACTION_CANCEL) {
@@ -4827,6 +4884,17 @@ class MainActivity : AppCompatActivity() {
         val chunks = CraftNativeChunks()
         /** A `requestAnimationFrame` is waiting for the next frame. */
         var frameRequested = false
+        /**
+         * Choreographer's frame time at this screen's first delivered frame.
+         *
+         * `requestAnimationFrame` hands its callback a `DOMHighResTimeStamp`:
+         * milliseconds measured from the context's own origin, so the first one
+         * is near zero. `frameTimeNanos` counts from boot, which on a device up
+         * for a month is nine digits of offset, and UIKit already subtracts its
+         * own origin (`frameTimeOrigin` in `CraftNativeScreen.swift`). Without
+         * this the same shared animation code sees two different epochs.
+         */
+        var frameTimeOrigin: Long? = null
         /** The screen's timers (`setTimeout`), kept by the host. */
         val timers = mutableMapOf<Int, Runnable>()
         val drafts = mutableMapOf<String, String>()
@@ -5182,9 +5250,51 @@ class MainActivity : AppCompatActivity() {
         }
         val launch = initialDeepLink?.let { routes.appPath(it.toString(), urlSchemes) }
         if (launch != null) deliveredInitialDeepLink = true
-        selectTab(routes.tabFor(launch ?: routes.initialPath)?.let { routes.tabs.indexOf(it) } ?: 0)
+        // A launch link is deliberately not gated. Suppressing one would have
+        // to decide whether it is dropped or replayed after signing in, and
+        // UIKit does not gate them either — its gate resolves the start path
+        // while links are still queued for replay. Same gap, both hosts, and
+        // better as its own change than as a silent asymmetry here.
+        val start = if (launch != null) launch else gatedStartPath(routes.initialPath)
+        selectTab(routes.tabFor(start)?.let { routes.tabs.indexOf(it) } ?: 0)
         if (launch != null && routes.tabFor(launch) == null) navigateOpen(launch, fromLink = true)
-        else if (routes.tabs.isEmpty() && screens.isEmpty()) navigateOpen(routes.initialPath)
+        else if (routes.tabs.isEmpty() && screens.isEmpty()) navigateOpen(start)
+    }
+
+    /**
+     * Send a signed-out launch to the gate's redirect before any screen is
+     * built (#499).
+     *
+     * The app script cannot do this. `openScreen` returns as soon as it has an
+     * isolate and evaluates the script later on an executor, so opening the
+     * app script before the first screen only creates its isolate first — the
+     * two then evaluate with nothing ordering them, and whether the gate runs
+     * before the first screen paints is a race. On a launch that follows an
+     * expired session rather than a sign-out, losing that race paints the
+     * previous session's kept snapshot.
+     *
+     * UIKit loses the same race by construction rather than by chance, which
+     * is where this was reported; the fix is the same on both and so is the
+     * config.
+     */
+    private fun gatedStartPath(start: String): String {
+        val gate = config.optJSONObject("nativeGate") ?: return start
+        val redirect = gate.optString("redirect").takeIf { it.isNotBlank() } ?: return start
+        val listed = gate.optJSONArray("publicPaths")
+        val allowed = (0 until (listed?.length() ?: 0)).mapNotNull { index ->
+            listed?.optString(index)?.takeIf { it.isNotBlank() }
+        }
+        if (CraftNativePrelude.gateAdmits(start, allowed)) return start
+        val key = gate.optString("token").ifBlank { CraftNativePrelude.sessionTokenKey(config) }
+        if (!stores.secureValue(key).isNullOrEmpty()) return start
+        // A redirect nothing can draw would trade a private screen for a blank
+        // one. Say so and leave the start path alone.
+        if (routes.match(redirect) == null) {
+            Log.w(TAG, "nativeGate redirect $redirect has no native screen; the gate did not run")
+            return start
+        }
+        Log.i(TAG, "no sign-in under $key: starting on $redirect instead of $start")
+        return redirect
     }
 
     private fun installChrome() {
@@ -5814,7 +5924,11 @@ class MainActivity : AppCompatActivity() {
             if (!screen.active || !screen.frameRequested) return@postFrameCallback
             if (visibleScreen !== screen && !screen.headless) return@postFrameCallback
             screen.frameRequested = false
-            send(screen, "FRAME_FIRE", JSONObject().put("time", frameTime / 1_000_000.0))
+            // Milliseconds from this screen's first frame, not from boot: see
+            // Screen.frameTimeOrigin. Nanoseconds are subtracted before the
+            // division so the difference keeps full resolution.
+            val origin = screen.frameTimeOrigin ?: frameTime.also { screen.frameTimeOrigin = it }
+            send(screen, "FRAME_FIRE", JSONObject().put("time", (frameTime - origin) / 1_000_000.0))
         }
     }
 
@@ -7136,10 +7250,15 @@ class MainActivity : AppCompatActivity() {
                     onScroll = { scrollX, scrollY ->
                         screen.scrollHandlers[nativeScroll]?.let { current ->
                             val contentView = nativeScroll.content
-                            send(screen, "EVENT", JSONObject().put("handlerName", current).put("nativeEvent", JSONObject()
-                                .put("contentOffset", JSONObject().put("x", scrollX).put("y", scrollY))
-                                .put("contentSize", JSONObject().put("width", contentView.width).put("height", contentView.height))
-                                .put("layoutMeasurement", JSONObject().put("width", nativeScroll.width).put("height", nativeScroll.height))))
+                            // Density-independent, like `emitLayoutEvent` and
+                            // like UIKit's points: see craftNativeScrollMetrics.
+                            val scale = resources.displayMetrics.density.toDouble()
+                            send(screen, "EVENT", JSONObject().put("handlerName", current).put("nativeEvent", craftNativeScrollMetrics(
+                                offsetX = scrollX, offsetY = scrollY,
+                                contentWidth = contentView.width, contentHeight = contentView.height,
+                                viewportWidth = nativeScroll.width, viewportHeight = nativeScroll.height,
+                                density = scale,
+                            )))
                         }
                     },
                     onBeginDrag = {
@@ -7476,16 +7595,12 @@ class MainActivity : AppCompatActivity() {
             ?: craftNativeOptionalString(props.opt("resizeMode")).orEmpty()
     }
 
-    private fun flatListScrollEvent(list: CraftNativeFlatList): JSONObject = JSONObject()
-        .put("contentOffset", JSONObject()
-            .put("x", list.computeHorizontalScrollOffset())
-            .put("y", list.computeVerticalScrollOffset()))
-        .put("contentSize", JSONObject()
-            .put("width", list.computeHorizontalScrollRange())
-            .put("height", list.computeVerticalScrollRange()))
-        .put("layoutMeasurement", JSONObject()
-            .put("width", list.width)
-            .put("height", list.height))
+    private fun flatListScrollEvent(list: CraftNativeFlatList): JSONObject = craftNativeScrollMetrics(
+        offsetX = list.computeHorizontalScrollOffset(), offsetY = list.computeVerticalScrollOffset(),
+        contentWidth = list.computeHorizontalScrollRange(), contentHeight = list.computeVerticalScrollRange(),
+        viewportWidth = list.width, viewportHeight = list.height,
+        density = resources.displayMetrics.density.toDouble(),
+    )
 
     private fun reconcileChildren(
         screen: Screen,

package/dist/cli.js

@@ -3243,7 +3243,7 @@ function pinCraftNativeDependency(packagePath, craftVersion) {
 `);
 }
 // package.json
-var version = "0.0.486";
+var version = "0.0.490";
 
 // bin/cli.ts
 var spawnedFrom = process6.env[CRAFT_CLI_SPAWN_MARKER];

package/dist/index.cjs

@@ -376,7 +376,7 @@ function craftBinaryNotFoundMessage(triedPath) {
 `);
 }
 // package.json
-var version = "0.0.486";
+var version = "0.0.490";
 
 // src/sdk-version.ts
 var SDK_VERSION = version;

package/dist/index.js

@@ -117,7 +117,7 @@ function craftBinaryNotFoundMessage(triedPath) {
 `);
 }
 // package.json
-var version = "0.0.486";
+var version = "0.0.490";
 
 // src/sdk-version.ts
 var SDK_VERSION = version;

package/dist/ios/src/index.d.ts

@@ -317,6 +317,28 @@ export interface CraftConfig {
      * `craftsession` event on the page.
      */
     sessionTokenKey?: string;
+    /**
+     * Which screens a signed-out launch may start on.
+     *
+     * The shell resolves this while it is deciding the start path, before any
+     * screen is built. An app script cannot do the same job: it is started from
+     * the first frame's completion block, so by the time it can read a token the
+     * signed-in screen it would have prevented has already been painted — with
+     * the previous session's kept snapshot in it when the launch follows an
+     * expired token rather than a sign-out.
+     *
+     * ```ts
+     * nativeGate: {
+     *   publicPaths: ['/m/login', '/m/signup', '/m/store'],
+     *   redirect: '/m/login',
+     * }
+     * ```
+     *
+     * `publicPaths` admits a listed path and anything under it, so `/m/store`
+     * covers `/m/store/42` and not `/m/storefront`. `token` defaults to
+     * `sessionTokenKey`, the item `craft.session` already follows.
+     */
+    nativeGate?: NativeGate;
     /**
      * Crash and error reporting to bughq (CraftCrashReporter.swift): crashes
      * and hangs (signal handlers, NSException, MetricKit), uncaught JavaScript
@@ -325,6 +347,25 @@ export interface CraftConfig {
      */
     crashReporting?: CraftCrashReporting;
 }
+/**
+ * An auth gate the shell applies while resolving the start path.
+ *
+ * See `CraftConfig.nativeGate`. The allowlist is static data in the apps that
+ * need this, so emitting it into the config costs nothing at runtime.
+ */
+export interface NativeGate {
+    /**
+     * Paths a signed-out launch may start on, each admitting what sits under it.
+     *
+     * Not `public`: that is a Swift keyword, and remapping it would make the
+     * stored key differ from the property the host decodes it into.
+     */
+    publicPaths?: string[];
+    /** Where a signed-out launch starts instead. Must itself be public. */
+    redirect: string;
+    /** The secure-storage key holding the sign-in. Defaults to `sessionTokenKey`. */
+    token?: string;
+}
 export interface CraftCrashReporting {
     /** The bughq project's public ingest key. Ships in the app; it is not a secret. */
     key: string;
@@ -362,7 +403,7 @@ export declare function usesNativeBundle(config: Pick<CraftConfig, 'renderer' |
  */
 export declare function nativeStartPath(config: Pick<CraftConfig, 'devServerURL'>): string;
 /** What is wrong with a config's hybrid and tab settings, one sentence each. */
-export declare function hybridConfigProblems(config: Pick<CraftConfig, 'renderer' | 'nativeScreens' | 'nativeScreenConstraints' | 'tabs' | 'shareStorage' | 'devServerURL' | 'nativeApp' | 'nativeScriptThread' | 'notificationCategories'>): string[];
+export declare function hybridConfigProblems(config: Pick<CraftConfig, 'renderer' | 'nativeScreens' | 'nativeScreenConstraints' | 'tabs' | 'shareStorage' | 'devServerURL' | 'nativeApp' | 'nativeScriptThread' | 'notificationCategories' | 'nativeGate'>): string[];
 /**
  * The builder installs a directory of route bundles (stx's `routesDir`) as
  * well as the one-file bundle, and the app runs each screen from its own

package/dist/ios/src/index.js

@@ -740,6 +740,21 @@ function hybridConfigProblems(config) {
     if (!matchNativePath(config.nativeScreens, start, config.nativeScreenConstraints))
       problems.push(`The start path "${start}" (from devServerURL) is not a nativeScreens path; with renderer: "native" the app must start on a native screen.`);
   }
+  const gate = config.nativeGate;
+  if (gate !== undefined) {
+    if (typeof gate.redirect !== "string" || normalizeNativePath(gate.redirect) !== gate.redirect)
+      problems.push(`nativeGate.redirect "${String(gate.redirect)}" must be an absolute path with no query, hash or trailing slash.`);
+    else if (hasNativeRoutes(config) && !matchNativePath(config.nativeScreens, gate.redirect, config.nativeScreenConstraints))
+      problems.push(`nativeGate.redirect "${gate.redirect}" is not a nativeScreens path; a signed-out launch would have nothing to show.`);
+    for (const path of gate.publicPaths ?? []) {
+      if (typeof path !== "string" || normalizeNativePath(path) !== path)
+        problems.push(`nativeGate.publicPaths "${String(path)}" must be an absolute path with no query, hash or trailing slash.`);
+    }
+    if (typeof gate.redirect === "string" && !(gate.publicPaths ?? []).some((path) => gate.redirect === path || gate.redirect.startsWith(`${path}/`)))
+      problems.push(`nativeGate.redirect "${gate.redirect}" must also be listed in nativeGate.publicPaths.`);
+    if (gate.token !== undefined && (typeof gate.token !== "string" || !gate.token))
+      problems.push("nativeGate.token must be the secure-storage key the sign-in lives under.");
+  }
   if (config.nativeApp !== undefined) {
     if (typeof config.nativeApp !== "string" || !/^[A-Za-z_$][\w$-]*$/.test(config.nativeApp))
       problems.push(`nativeApp "${String(config.nativeApp)}" must be a route name from the native bundle.`);