craft-native 0.0.487 → 0.0.490

package/dist/android/src/index.d.ts

@@ -183,6 +183,20 @@ export interface CraftAndroidConfig {
      * screen, and a change of it is `SESSION_CHANGED { key, token, previous }`.
      */
     sessionTokenKey?: string;
+    /**
+     * Which screens a signed-out launch may start on.
+     *
+     * The shell resolves this while choosing the start path, before any screen
+     * is built. The `nativeApp` script cannot do the same job: `openScreen`
+     * returns as soon as it has an isolate and evaluates the script later, so
+     * the gate and the first screen race — and on a launch that follows an
+     * expired token rather than a sign-out, losing paints the previous
+     * session's kept snapshot.
+     *
+     * The same shape as the iOS field, deliberately: one `nativeGate` block
+     * must gate both hosts or an app is protected on one and not the other.
+     */
+    nativeGate?: AndroidNativeGate;
     /** Wake the app script every so often (`craftBackgroundRefresh`), through WorkManager. */
     backgroundRefresh?: {
         enabled?: boolean;
@@ -208,6 +222,20 @@ export interface CraftAndroidConfig {
         sessions?: boolean;
     };
 }
+/**
+ * An auth gate the shell applies while choosing the start path.
+ *
+ * See `CraftAndroidConfig.nativeGate`. Mirrors the iOS `NativeGate`, field for
+ * field, because one config block has to gate both hosts.
+ */
+export interface AndroidNativeGate {
+    /** Paths a signed-out launch may start on, each admitting what sits under it. */
+    publicPaths?: string[];
+    /** Where a signed-out launch starts instead. */
+    redirect: string;
+    /** The secure-storage key holding the sign-in. Defaults to `sessionTokenKey`. */
+    token?: string;
+}
 export interface CraftTabBarConfig {
     selection?: {
         /** The selected tab indicator's corner radius in dp; omitted keeps the default. */

package/dist/android/src/index.js

@@ -1247,6 +1247,21 @@ function validateNativeRouteConfig(config) {
     if (!matchesNativeRoute(config.nativeScreens, start, config.nativeScreenConstraints))
       throw new Error(`The start path "${start}" (from devServerURL) is not a nativeScreens path; with renderer: "native" the app must start on a native screen.`);
   }
+  const gate = config.nativeGate;
+  if (gate !== undefined) {
+    if (typeof gate.redirect !== "string" || normalizeNativeRoutePath(gate.redirect) !== gate.redirect)
+      throw new Error(`nativeGate.redirect "${String(gate.redirect)}" must be an absolute path with no query, hash or trailing slash.`);
+    if (config.renderer === "native" && screens.length > 0 && !matchesNativeRoute(config.nativeScreens, gate.redirect, config.nativeScreenConstraints))
+      throw new Error(`nativeGate.redirect "${gate.redirect}" is not a nativeScreens path; a signed-out launch would have nothing to show.`);
+    for (const path of gate.publicPaths ?? []) {
+      if (typeof path !== "string" || normalizeNativeRoutePath(path) !== path)
+        throw new Error(`nativeGate.publicPaths "${String(path)}" must be an absolute path with no query, hash or trailing slash.`);
+    }
+    if (!(gate.publicPaths ?? []).some((path) => gate.redirect === path || gate.redirect.startsWith(`${path}/`)))
+      throw new Error(`nativeGate.redirect "${gate.redirect}" must also be listed in nativeGate.publicPaths.`);
+    if (gate.token !== undefined && (typeof gate.token !== "string" || !gate.token))
+      throw new Error("nativeGate.token must be the secure-storage key the sign-in lives under.");
+  }
   if (config.nativeApp !== undefined) {
     if (typeof config.nativeApp !== "string" || !/^[A-Za-z_$][\w$-]*$/.test(config.nativeApp))
       throw new Error(`nativeApp "${String(config.nativeApp)}" must be a route name from the native bundle.`);

package/dist/android/templates/CraftNativeServices.kt.template

@@ -685,7 +685,16 @@ internal class CraftNativeServices(
                 voiceRecorder = null
                 val metadata = MediaMetadataRetriever()
                 val duration = try { metadata.setDataSource(file.absolutePath); (metadata.extractMetadata(MediaMetadataRetriever.METADATA_KEY_DURATION)?.toDoubleOrNull() ?: 0.0) / 1000 } finally { metadata.release() }
-                if (!file.exists() || file.length() == 0L || duration <= 0) throw IllegalStateException("Empty recording")
+                // Nothing recorded is its own answer, not a read failure.
+                // Thrown into the blanket catch below, it reached callers as
+                // RECORDING_FAILED and became indistinguishable from a damaged
+                // file, so an app could offer "nothing was recorded — try
+                // again" on iOS and not here (#496).
+                if (!file.exists() || file.length() == 0L || duration <= 0) {
+                    cancelVoice()
+                    done(failure("EMPTY_RECORDING", "The recording was empty"))
+                    return
+                }
                 done(success(JSONObject().put("path", file.absolutePath).put("name", file.name).put("type", "audio/mp4").put("size", file.length()).put("durationSeconds", duration)))
             } catch (_: Exception) { cancelVoice(); done(failure("RECORDING_FAILED", "The recording could not be read")) }
             return

package/dist/android/templates/CraftNativeShell.kt.template

@@ -398,6 +398,15 @@ internal class CraftNativeStores private constructor(
 
     fun snapshot(name: String): String? = snapshotCache[name]
 
+    /**
+     * One secure value, read directly rather than through the preload.
+     *
+     * For code that runs before any isolate exists. The auth gate resolves the
+     * start path before the first screen is built, so it cannot wait for the
+     * preload every isolate is handed (#499).
+     */
+    fun secureValue(key: String): String? = secure?.getString(key, null)
+
     /** `craft.storage.setSync`: null removes the key. Tells every isolate. */
     fun setStorage(key: String, json: String?, from: String?) {
         synchronized(CraftNativeStorage.lock) {
@@ -465,7 +474,19 @@ internal class CraftNativeStores private constructor(
         CraftNativeHub.broadcast("SYNC_UPDATE", payload, except = from)
     }
 
-    private fun isSnapshotName(name: String): Boolean = name.matches(Regex("[A-Za-z0-9_-][A-Za-z0-9_.-]{0,127}"))
+    /**
+     * The same names UIKit accepts, so one checkpoint key is not valid on one
+     * host and refused on the other.
+     *
+     * `CraftSnapshots.isValidName` allows ASCII alphanumerics and `-_.:`, up
+     * to 128 characters, and rejects only a leading dot. The `:` is deliberate
+     * there — its own comment calls it the account namespace — so a key like
+     * `account:slot` wrote on iOS and came back `false` on Android.
+     *
+     * A colon never reaches the filesystem: `snapshotFile` percent-encodes the
+     * name, and `snapshotName` decodes it back.
+     */
+    private fun isSnapshotName(name: String): Boolean = name.matches(Regex("[A-Za-z0-9_:-][A-Za-z0-9_.:-]{0,127}"))
 
     private fun snapshotFile(name: String): File = File(snapshotsDir, URLEncoder.encode(name, "UTF-8") + ".json")
 
@@ -495,6 +516,32 @@ internal object CraftNativePrelude {
      */
     fun sessionTokenKey(config: JSONObject): String = config.optString("sessionTokenKey").ifBlank { "auth.token" }
 
+    /**
+     * Whether `path` may be shown to someone who is not signed in.
+     *
+     * Listed, or under something listed: `/m/store` admits `/m/store/42` and
+     * not `/m/storefront`. The separator is attached before comparing so a
+     * listed path cannot admit a sibling that merely starts with its letters.
+     *
+     * A literal mirror of `CraftHybrid.gateAdmits` in
+     * `packages/ios/templates/CraftHybrid.swift`, down to the trailing-slash
+     * trimming, because the two hosts must admit exactly the same paths from
+     * the same `publicPaths` list. `native-gate.test.ts` runs both against one
+     * table of cases.
+     */
+    fun gateAdmits(path: String, allowed: List<String>): Boolean = allowed.any { entry ->
+        var listed = entry
+        while (listed.length > 1 && listed.endsWith("/")) listed = listed.dropLast(1)
+        when {
+            listed.isEmpty() -> false
+            path == listed -> true
+            // "/" is the root path, not a prefix of everything. Reading it as
+            // one would admit every path, which is a gate that is not a gate.
+            listed == "/" -> false
+            else -> path.startsWith("$listed/")
+        }
+    }
+
     fun script(
         bridgeFields: String,
         post: String,
@@ -632,7 +679,12 @@ internal object CraftNativePrelude {
             if (message && message.type === 'FRAME_FIRE') {
               var due = frames;
               frames = [];
-              var time = message.payload && message.payload.time || Date.now();
+              // A real first frame is 0, which `||` would replace with a Unix
+              // epoch value twelve orders of magnitude away. Only a missing or
+              // non-finite time falls back, and it falls back to the same
+              // origin-relative scale rather than to wall-clock.
+              var reported = message.payload && message.payload.time;
+              var time = typeof reported === 'number' && isFinite(reported) ? reported : 0;
               due.forEach(function(entry) {
                 if (cancelledFrames[entry.id]) { delete cancelledFrames[entry.id]; return; }
                 try { entry.fn(time); } catch (error) { console.error('[frame] ' + (error && error.stack || error)); }
@@ -704,8 +756,11 @@ internal object CraftNativePrelude {
             if (json === null || json === undefined) return null;
             try { return JSON.parse(json); } catch (error) { return null; }
           }
+          // The same names the host accepts, including the `:` UIKit calls the
+          // account namespace. This gate runs inside the isolate, so a stricter
+          // rule here refuses a key the host would have kept.
           function validSnapshotName(name) {
-            return /^[A-Za-z0-9_-][A-Za-z0-9_.-]{0,127}$/.test(name);
+            return /^[A-Za-z0-9_:-][A-Za-z0-9_.:-]{0,127}$/.test(name);
           }
           var craft = globalThis.craft = globalThis.craft || {};
           function keep(name, extras) {
@@ -735,7 +790,7 @@ internal object CraftNativePrelude {
             },
             set: function(name, value) {
               name = String(name);
-              if (!validSnapshotName(name)) return Promise.reject(new TypeError('Snapshot names are letters, digits, ".", "_" and "-"'));
+              if (!validSnapshotName(name)) return Promise.reject(new TypeError('Snapshot names are letters, digits, ".", "_", "-" and ":"'));
               var json = value === null ? null : JSON.stringify(value);
               if (json === undefined) return Promise.reject(new TypeError('Snapshot ' + name + ' is not JSON'));
               if (json === null) delete sync.snapshots[name];
@@ -824,9 +879,24 @@ internal object CraftNativePrelude {
 
 /**
  * The bar above a screen (back, title, the screen's buttons) and the tab bar
- * below it, in plain Android views. A screen sets its bar with
- * `craft.navigation.setOptions` (title, largeTitle, hidden, rightButtons,
- * tabAccessory, tabBarHidden); the tabs come from the app's `tabs`.
+ * below it, in plain Android views. The tabs come from the app's `tabs`; a
+ * screen sets its own chrome with
+ *
+ * `craft.navigation.setOptions({ title, largeTitle, titleColor, hidden,
+ *   backgroundColor, leftButtons, rightButtons, tabItem, tabAccessory,
+ *   tabBarHidden, tabBarHiddenWhenPushed, tabSwipeEnabled })`
+ *
+ * which `apply` below reads. That list is checked against `apply` itself
+ * rather than kept by hand, and only the list is: the iOS comment named
+ * twelve keys while fifteen shipped (#489), and a first attempt at the same
+ * ratchet there passed with keys deleted because the prose underneath
+ * happened to mention them. Six of these twelve had never been written down.
+ *
+ * `tabBarHiddenWhenPushed` was honoured here and nowhere else in Craft until
+ * #493: hiding the tab bar on push is the ordinary iOS idiom, so a caller who
+ * set it got the behaviour on one host and silence on the other. UIKit reads
+ * the same key now, at the same depth, through CraftNativeScreen's
+ * `wantsTabBarHidden`.
  */
 internal class CraftNativeChrome(
     context: Context,
@@ -1316,7 +1386,25 @@ internal class CraftNativeChrome(
         if (badge > 0) {
             view.text = "${view.text}${if (button.optString("badgeStyle") == "dot") " •" else " $badge"}"
         }
-        view.setOnClickListener { onButton?.invoke(id) }
+        // `menu`: the button opens a popup instead of reporting its own id, and
+        // each choice is reported as a press of that choice's id.
+        val choices = button.optJSONArray("menu")
+        val menu = (0 until minOf(choices?.length() ?: 0, 12)).mapNotNull { index ->
+            choices?.optJSONObject(index)?.takeIf { it.optString("id").isNotBlank() && it.optString("title").isNotBlank() }
+        }
+        view.setOnClickListener {
+            if (menu.isEmpty()) onButton?.invoke(id)
+            else android.widget.PopupMenu(context, view).apply {
+                menu.forEachIndexed { index, choice ->
+                    this.menu.add(0, index, index, choice.optString("title")).isEnabled = !choice.optBoolean("disabled")
+                }
+                setOnMenuItemClickListener { selected ->
+                    menu.getOrNull(selected.itemId)?.let { onButton?.invoke(it.optString("id")) }
+                    true
+                }
+                show()
+            }
+        }
         view.layoutParams = LayoutParams(ViewGroup.LayoutParams.WRAP_CONTENT, ViewGroup.LayoutParams.MATCH_PARENT)
         return view
     }

package/dist/android/templates/MainActivityNative.kt.template

@@ -149,6 +149,34 @@ private fun craftNativeBoolean(value: Any?, fallback: Boolean = false): Boolean
 
 private fun craftNativeInt(value: Any?, fallback: Int): Int = (value as? Number)?.toInt() ?: fallback
 
+/**
+ * A scroll event's geometry in density-independent units.
+ *
+ * UIKit reports `contentOffset`, `contentSize` and `layoutMeasurement` in
+ * points, and this host's own `emitLayoutEvent` already divides a View's
+ * pixels by the display density. These three were the exception: they shipped
+ * raw pixels, so the same scroll handler saw values three times larger on a
+ * 3x Android screen than on iOS — and larger than the `onLayout` bounds the
+ * same screen reports, which is the comparison infinite-scroll code makes.
+ */
+private fun craftNativeScrollMetrics(
+    offsetX: Int,
+    offsetY: Int,
+    contentWidth: Int,
+    contentHeight: Int,
+    viewportWidth: Int,
+    viewportHeight: Int,
+    density: Double,
+): JSONObject {
+    // A density of zero would be a broken DisplayMetrics; report pixels rather
+    // than NaN, which JSON cannot carry and a handler cannot compare.
+    val scale = if (density.isFinite() && density > 0.0) density else 1.0
+    return JSONObject()
+        .put("contentOffset", JSONObject().put("x", offsetX / scale).put("y", offsetY / scale))
+        .put("contentSize", JSONObject().put("width", contentWidth / scale).put("height", contentHeight / scale))
+        .put("layoutMeasurement", JSONObject().put("width", viewportWidth / scale).put("height", viewportHeight / scale))
+}
+
 private fun craftNativePickerValue(value: Any?): String? = when (value) {
     is String -> value
     is Number -> value.toDouble().takeIf { it.isFinite() }?.let { value.toString() }
@@ -391,6 +419,16 @@ private object CraftNativeSkewTransforms {
 /** A DOM-free SVG surface for the geometry emitted by the shared STX native protocol. */
 /** Local native chart selection: no JS events are needed while scrubbing. */
 private class CraftNativeChartInspection(private val view: View) {
+    companion object {
+        /** The one chart with a reading pinned open, if any. */
+        private var pinned: java.lang.ref.WeakReference<CraftNativeChartInspection>? = null
+        /** A touch that starts off the pinned chart closes its reading; the touch still lands where it was aimed. */
+        fun touchBegan(event: MotionEvent) {
+            if (event.actionMasked != MotionEvent.ACTION_DOWN) return
+            val open = pinned?.get() ?: return
+            if (!open.contains(event.rawX, event.rawY)) open.dismiss()
+        }
+    }
     private var fingerprint = ""
     private var title = ""
     private var points = emptyList<JSONObject>()
@@ -399,8 +437,9 @@ private class CraftNativeChartInspection(private val view: View) {
     private var startY = 0f
     private var dragging = false
     private var abandoned = false
+    private var holding = false
     private val slop = android.view.ViewConfiguration.get(view.context).scaledTouchSlop
-    private val hold = Runnable { if (!abandoned) selectAt(startX) }
+    private val hold = Runnable { if (!abandoned) { holding = true; selectAt(startX) } }
     val enabled: Boolean get() = points.isNotEmpty()
     private val density get() = view.resources.displayMetrics.density
     private fun dp(value: Float) = value * density
@@ -414,7 +453,7 @@ private class CraftNativeChartInspection(private val view: View) {
             val x = it.optDouble("x", Double.NaN)
             x.isFinite() && x in 0.0..1.0 && it.opt("label") is String
         }
-        selected = -1
+        dismiss()
         view.isFocusable = enabled
         view.invalidate()
     }
@@ -431,16 +470,31 @@ private class CraftNativeChartInspection(private val view: View) {
         view.sendAccessibilityEvent(android.view.accessibility.AccessibilityEvent.TYPE_VIEW_SELECTED)
         view.invalidate()
     }
-    private fun selectAt(x: Float) {
-        if (view.width <= 0) return
+    private fun nearest(x: Float): Int? {
+        if (view.width <= 0) return null
         val fraction = (x / view.width).coerceIn(0f, 1f)
-        points.indices.minByOrNull { kotlin.math.abs(points[it].optDouble("x") - fraction) }?.let { select(it) }
+        return points.indices.minByOrNull { kotlin.math.abs(points[it].optDouble("x") - fraction) }
+    }
+    private fun selectAt(x: Float) { nearest(x)?.let { select(it); pinned = java.lang.ref.WeakReference(this) } }
+    /** Puts the reading away. Returns whether one was showing. */
+    fun dismiss(): Boolean {
+        if (pinned?.get() === this) pinned = null
+        if (selected < 0) return false
+        selected = -1
+        view.invalidate()
+        return true
+    }
+    /** A tap pins the reading under it; tapping the pinned reading again puts it away. */
+    private fun tapAt(x: Float) { if (nearest(x) == selected) dismiss() else selectAt(x) }
+    private fun contains(rawX: Float, rawY: Float): Boolean {
+        val origin = IntArray(2).also { view.getLocationOnScreen(it) }
+        return rawX >= origin[0] && rawX < origin[0] + view.width && rawY >= origin[1] && rawY < origin[1] + view.height
     }
     fun touch(event: MotionEvent): Boolean {
         if (!enabled) return false
         when (event.actionMasked) {
             MotionEvent.ACTION_DOWN -> {
-                startX = event.x; startY = event.y; dragging = false; abandoned = false
+                startX = event.x; startY = event.y; dragging = false; abandoned = false; holding = false
                 view.postDelayed(hold, 250)
             }
             MotionEvent.ACTION_MOVE -> {
@@ -455,17 +509,19 @@ private class CraftNativeChartInspection(private val view: View) {
             }
             MotionEvent.ACTION_UP -> {
                 view.removeCallbacks(hold)
-                if (!abandoned) { view.performClick(); selectAt(event.x) }
+                // A drag or a hold reads the chart only while the finger is down.
+                if (dragging || holding) dismiss()
+                else if (!abandoned) { view.performClick(); tapAt(event.x) }
                 view.parent?.requestDisallowInterceptTouchEvent(false)
             }
             MotionEvent.ACTION_CANCEL -> {
-                view.removeCallbacks(hold); abandoned = true; selected = -1
-                view.parent?.requestDisallowInterceptTouchEvent(false); view.invalidate()
+                view.removeCallbacks(hold); abandoned = true; dismiss()
+                view.parent?.requestDisallowInterceptTouchEvent(false)
             }
         }
         return !abandoned
     }
-    fun detach() { view.removeCallbacks(hold); selected = -1 }
+    fun detach() { view.removeCallbacks(hold); dismiss() }
     fun accessibility(info: android.view.accessibility.AccessibilityNodeInfo) {
         if (!enabled) return
         info.className = "android.widget.SeekBar"
@@ -480,7 +536,7 @@ private class CraftNativeChartInspection(private val view: View) {
         when (action) {
             android.view.accessibility.AccessibilityNodeInfo.ACTION_SCROLL_FORWARD -> select(if (selected < 0) 0 else selected + 1)
             android.view.accessibility.AccessibilityNodeInfo.ACTION_SCROLL_BACKWARD -> select(if (selected < 0) points.lastIndex else selected - 1)
-            android.view.accessibility.AccessibilityNodeInfo.ACTION_DISMISS -> { selected = -1; view.invalidate() }
+            android.view.accessibility.AccessibilityNodeInfo.ACTION_DISMISS -> dismiss()
             else -> return false
         }
         return true
@@ -1186,6 +1242,7 @@ internal object CraftNativePointers {
     fun ownsTouch(view: View): Boolean = route(view).firstOrNull() !in setOf("none", "box-none")
 
     fun dispatch(view: View, event: MotionEvent, native: (MotionEvent) -> Boolean): Boolean {
+        CraftNativeChartInspection.touchBegan(event)
         val state = states.getOrPut(view) { State() }
         val route = route(view)
         if (event.actionMasked == MotionEvent.ACTION_CANCEL) {
@@ -4827,6 +4884,17 @@ class MainActivity : AppCompatActivity() {
         val chunks = CraftNativeChunks()
         /** A `requestAnimationFrame` is waiting for the next frame. */
         var frameRequested = false
+        /**
+         * Choreographer's frame time at this screen's first delivered frame.
+         *
+         * `requestAnimationFrame` hands its callback a `DOMHighResTimeStamp`:
+         * milliseconds measured from the context's own origin, so the first one
+         * is near zero. `frameTimeNanos` counts from boot, which on a device up
+         * for a month is nine digits of offset, and UIKit already subtracts its
+         * own origin (`frameTimeOrigin` in `CraftNativeScreen.swift`). Without
+         * this the same shared animation code sees two different epochs.
+         */
+        var frameTimeOrigin: Long? = null
         /** The screen's timers (`setTimeout`), kept by the host. */
         val timers = mutableMapOf<Int, Runnable>()
         val drafts = mutableMapOf<String, String>()
@@ -5182,9 +5250,51 @@ class MainActivity : AppCompatActivity() {
         }
         val launch = initialDeepLink?.let { routes.appPath(it.toString(), urlSchemes) }
         if (launch != null) deliveredInitialDeepLink = true
-        selectTab(routes.tabFor(launch ?: routes.initialPath)?.let { routes.tabs.indexOf(it) } ?: 0)
+        // A launch link is deliberately not gated. Suppressing one would have
+        // to decide whether it is dropped or replayed after signing in, and
+        // UIKit does not gate them either — its gate resolves the start path
+        // while links are still queued for replay. Same gap, both hosts, and
+        // better as its own change than as a silent asymmetry here.
+        val start = if (launch != null) launch else gatedStartPath(routes.initialPath)
+        selectTab(routes.tabFor(start)?.let { routes.tabs.indexOf(it) } ?: 0)
         if (launch != null && routes.tabFor(launch) == null) navigateOpen(launch, fromLink = true)
-        else if (routes.tabs.isEmpty() && screens.isEmpty()) navigateOpen(routes.initialPath)
+        else if (routes.tabs.isEmpty() && screens.isEmpty()) navigateOpen(start)
+    }
+
+    /**
+     * Send a signed-out launch to the gate's redirect before any screen is
+     * built (#499).
+     *
+     * The app script cannot do this. `openScreen` returns as soon as it has an
+     * isolate and evaluates the script later on an executor, so opening the
+     * app script before the first screen only creates its isolate first — the
+     * two then evaluate with nothing ordering them, and whether the gate runs
+     * before the first screen paints is a race. On a launch that follows an
+     * expired session rather than a sign-out, losing that race paints the
+     * previous session's kept snapshot.
+     *
+     * UIKit loses the same race by construction rather than by chance, which
+     * is where this was reported; the fix is the same on both and so is the
+     * config.
+     */
+    private fun gatedStartPath(start: String): String {
+        val gate = config.optJSONObject("nativeGate") ?: return start
+        val redirect = gate.optString("redirect").takeIf { it.isNotBlank() } ?: return start
+        val listed = gate.optJSONArray("publicPaths")
+        val allowed = (0 until (listed?.length() ?: 0)).mapNotNull { index ->
+            listed?.optString(index)?.takeIf { it.isNotBlank() }
+        }
+        if (CraftNativePrelude.gateAdmits(start, allowed)) return start
+        val key = gate.optString("token").ifBlank { CraftNativePrelude.sessionTokenKey(config) }
+        if (!stores.secureValue(key).isNullOrEmpty()) return start
+        // A redirect nothing can draw would trade a private screen for a blank
+        // one. Say so and leave the start path alone.
+        if (routes.match(redirect) == null) {
+            Log.w(TAG, "nativeGate redirect $redirect has no native screen; the gate did not run")
+            return start
+        }
+        Log.i(TAG, "no sign-in under $key: starting on $redirect instead of $start")
+        return redirect
     }
 
     private fun installChrome() {
@@ -5814,7 +5924,11 @@ class MainActivity : AppCompatActivity() {
             if (!screen.active || !screen.frameRequested) return@postFrameCallback
             if (visibleScreen !== screen && !screen.headless) return@postFrameCallback
             screen.frameRequested = false
-            send(screen, "FRAME_FIRE", JSONObject().put("time", frameTime / 1_000_000.0))
+            // Milliseconds from this screen's first frame, not from boot: see
+            // Screen.frameTimeOrigin. Nanoseconds are subtracted before the
+            // division so the difference keeps full resolution.
+            val origin = screen.frameTimeOrigin ?: frameTime.also { screen.frameTimeOrigin = it }
+            send(screen, "FRAME_FIRE", JSONObject().put("time", (frameTime - origin) / 1_000_000.0))
         }
     }
 
@@ -7136,10 +7250,15 @@ class MainActivity : AppCompatActivity() {
                     onScroll = { scrollX, scrollY ->
                         screen.scrollHandlers[nativeScroll]?.let { current ->
                             val contentView = nativeScroll.content
-                            send(screen, "EVENT", JSONObject().put("handlerName", current).put("nativeEvent", JSONObject()
-                                .put("contentOffset", JSONObject().put("x", scrollX).put("y", scrollY))
-                                .put("contentSize", JSONObject().put("width", contentView.width).put("height", contentView.height))
-                                .put("layoutMeasurement", JSONObject().put("width", nativeScroll.width).put("height", nativeScroll.height))))
+                            // Density-independent, like `emitLayoutEvent` and
+                            // like UIKit's points: see craftNativeScrollMetrics.
+                            val scale = resources.displayMetrics.density.toDouble()
+                            send(screen, "EVENT", JSONObject().put("handlerName", current).put("nativeEvent", craftNativeScrollMetrics(
+                                offsetX = scrollX, offsetY = scrollY,
+                                contentWidth = contentView.width, contentHeight = contentView.height,
+                                viewportWidth = nativeScroll.width, viewportHeight = nativeScroll.height,
+                                density = scale,
+                            )))
                         }
                     },
                     onBeginDrag = {
@@ -7476,16 +7595,12 @@ class MainActivity : AppCompatActivity() {
             ?: craftNativeOptionalString(props.opt("resizeMode")).orEmpty()
     }
 
-    private fun flatListScrollEvent(list: CraftNativeFlatList): JSONObject = JSONObject()
-        .put("contentOffset", JSONObject()
-            .put("x", list.computeHorizontalScrollOffset())
-            .put("y", list.computeVerticalScrollOffset()))
-        .put("contentSize", JSONObject()
-            .put("width", list.computeHorizontalScrollRange())
-            .put("height", list.computeVerticalScrollRange()))
-        .put("layoutMeasurement", JSONObject()
-            .put("width", list.width)
-            .put("height", list.height))
+    private fun flatListScrollEvent(list: CraftNativeFlatList): JSONObject = craftNativeScrollMetrics(
+        offsetX = list.computeHorizontalScrollOffset(), offsetY = list.computeVerticalScrollOffset(),
+        contentWidth = list.computeHorizontalScrollRange(), contentHeight = list.computeVerticalScrollRange(),
+        viewportWidth = list.width, viewportHeight = list.height,
+        density = resources.displayMetrics.density.toDouble(),
+    )
 
     private fun reconcileChildren(
         screen: Screen,

package/dist/cli.js

@@ -3243,7 +3243,7 @@ function pinCraftNativeDependency(packagePath, craftVersion) {
 `);
 }
 // package.json
-var version = "0.0.487";
+var version = "0.0.490";
 
 // bin/cli.ts
 var spawnedFrom = process6.env[CRAFT_CLI_SPAWN_MARKER];

package/dist/index.cjs

@@ -376,7 +376,7 @@ function craftBinaryNotFoundMessage(triedPath) {
 `);
 }
 // package.json
-var version = "0.0.487";
+var version = "0.0.490";
 
 // src/sdk-version.ts
 var SDK_VERSION = version;

package/dist/index.js

@@ -117,7 +117,7 @@ function craftBinaryNotFoundMessage(triedPath) {
 `);
 }
 // package.json
-var version = "0.0.487";
+var version = "0.0.490";
 
 // src/sdk-version.ts
 var SDK_VERSION = version;

package/dist/ios/src/index.d.ts

@@ -317,6 +317,28 @@ export interface CraftConfig {
      * `craftsession` event on the page.
      */
     sessionTokenKey?: string;
+    /**
+     * Which screens a signed-out launch may start on.
+     *
+     * The shell resolves this while it is deciding the start path, before any
+     * screen is built. An app script cannot do the same job: it is started from
+     * the first frame's completion block, so by the time it can read a token the
+     * signed-in screen it would have prevented has already been painted — with
+     * the previous session's kept snapshot in it when the launch follows an
+     * expired token rather than a sign-out.
+     *
+     * ```ts
+     * nativeGate: {
+     *   publicPaths: ['/m/login', '/m/signup', '/m/store'],
+     *   redirect: '/m/login',
+     * }
+     * ```
+     *
+     * `publicPaths` admits a listed path and anything under it, so `/m/store`
+     * covers `/m/store/42` and not `/m/storefront`. `token` defaults to
+     * `sessionTokenKey`, the item `craft.session` already follows.
+     */
+    nativeGate?: NativeGate;
     /**
      * Crash and error reporting to bughq (CraftCrashReporter.swift): crashes
      * and hangs (signal handlers, NSException, MetricKit), uncaught JavaScript
@@ -325,6 +347,25 @@ export interface CraftConfig {
      */
     crashReporting?: CraftCrashReporting;
 }
+/**
+ * An auth gate the shell applies while resolving the start path.
+ *
+ * See `CraftConfig.nativeGate`. The allowlist is static data in the apps that
+ * need this, so emitting it into the config costs nothing at runtime.
+ */
+export interface NativeGate {
+    /**
+     * Paths a signed-out launch may start on, each admitting what sits under it.
+     *
+     * Not `public`: that is a Swift keyword, and remapping it would make the
+     * stored key differ from the property the host decodes it into.
+     */
+    publicPaths?: string[];
+    /** Where a signed-out launch starts instead. Must itself be public. */
+    redirect: string;
+    /** The secure-storage key holding the sign-in. Defaults to `sessionTokenKey`. */
+    token?: string;
+}
 export interface CraftCrashReporting {
     /** The bughq project's public ingest key. Ships in the app; it is not a secret. */
     key: string;
@@ -362,7 +403,7 @@ export declare function usesNativeBundle(config: Pick<CraftConfig, 'renderer' |
  */
 export declare function nativeStartPath(config: Pick<CraftConfig, 'devServerURL'>): string;
 /** What is wrong with a config's hybrid and tab settings, one sentence each. */
-export declare function hybridConfigProblems(config: Pick<CraftConfig, 'renderer' | 'nativeScreens' | 'nativeScreenConstraints' | 'tabs' | 'shareStorage' | 'devServerURL' | 'nativeApp' | 'nativeScriptThread' | 'notificationCategories'>): string[];
+export declare function hybridConfigProblems(config: Pick<CraftConfig, 'renderer' | 'nativeScreens' | 'nativeScreenConstraints' | 'tabs' | 'shareStorage' | 'devServerURL' | 'nativeApp' | 'nativeScriptThread' | 'notificationCategories' | 'nativeGate'>): string[];
 /**
  * The builder installs a directory of route bundles (stx's `routesDir`) as
  * well as the one-file bundle, and the app runs each screen from its own

package/dist/ios/src/index.js

@@ -740,6 +740,21 @@ function hybridConfigProblems(config) {
     if (!matchNativePath(config.nativeScreens, start, config.nativeScreenConstraints))
       problems.push(`The start path "${start}" (from devServerURL) is not a nativeScreens path; with renderer: "native" the app must start on a native screen.`);
   }
+  const gate = config.nativeGate;
+  if (gate !== undefined) {
+    if (typeof gate.redirect !== "string" || normalizeNativePath(gate.redirect) !== gate.redirect)
+      problems.push(`nativeGate.redirect "${String(gate.redirect)}" must be an absolute path with no query, hash or trailing slash.`);
+    else if (hasNativeRoutes(config) && !matchNativePath(config.nativeScreens, gate.redirect, config.nativeScreenConstraints))
+      problems.push(`nativeGate.redirect "${gate.redirect}" is not a nativeScreens path; a signed-out launch would have nothing to show.`);
+    for (const path of gate.publicPaths ?? []) {
+      if (typeof path !== "string" || normalizeNativePath(path) !== path)
+        problems.push(`nativeGate.publicPaths "${String(path)}" must be an absolute path with no query, hash or trailing slash.`);
+    }
+    if (typeof gate.redirect === "string" && !(gate.publicPaths ?? []).some((path) => gate.redirect === path || gate.redirect.startsWith(`${path}/`)))
+      problems.push(`nativeGate.redirect "${gate.redirect}" must also be listed in nativeGate.publicPaths.`);
+    if (gate.token !== undefined && (typeof gate.token !== "string" || !gate.token))
+      problems.push("nativeGate.token must be the secure-storage key the sign-in lives under.");
+  }
   if (config.nativeApp !== undefined) {
     if (typeof config.nativeApp !== "string" || !/^[A-Za-z_$][\w$-]*$/.test(config.nativeApp))
       problems.push(`nativeApp "${String(config.nativeApp)}" must be a route name from the native bundle.`);

package/dist/ios/templates/CraftApp.swift

@@ -2046,6 +2046,9 @@ struct CraftConfig: Codable {
     /// (`auth.token` unless set): `craft.session` follows it, and a change of
     /// it is `SESSION_CHANGED` on every screen (CraftSession).
     var sessionTokenKey: String? = nil
+    /// Which screens a signed-out launch may start on, resolved before the
+    /// first frame is built (CraftHybrid.configure).
+    var nativeGate: NativeGate? = nil
     /// The bundle route of the app script: a screen-less script that runs for
     /// the app's whole life and hears the app's events (CraftHybrid.swift).
     var nativeApp: String? = nil
@@ -2057,6 +2060,33 @@ struct CraftConfig: Codable {
     /// unless the config names a project key.
     var crashReporting: CrashReporting? = nil
 
+    /// An auth gate the shell applies while resolving the start path.
+    ///
+    /// An app script cannot do this. It is started from the first frame's
+    /// `CATransaction` completion block, so by the time it can read a token
+    /// the signed-in screen it would have prevented is already on screen —
+    /// with the previous session's kept snapshot in it when the launch
+    /// follows an expired token rather than a sign-out (#499). The check has
+    /// to belong to whoever decides the start path, and that is the shell.
+    struct NativeGate: Codable {
+        /// Paths that may be shown without a sign-in. A path is public when
+        /// it is listed, or when it sits under a listed one: `/m/store`
+        /// admits `/m/store/42` and not `/m/storefront`.
+        ///
+        /// Spelled `publicPaths` rather than `public` in the stored config
+        /// too. `public` is a Swift keyword, and remapping it through
+        /// `CodingKeys` would make the property name and the stored key
+        /// differ — which is exactly what the Zig conformance mirror checks,
+        /// and a divergence worth not having for the sake of one word.
+        var publicPaths: [String]? = nil
+        /// Where a signed-out launch starts instead.
+        var redirect: String? = nil
+        /// The secure-storage key holding the sign-in. Defaults to
+        /// `sessionTokenKey`, which is the same item `craft.session` follows,
+        /// so an app that already declares one need not repeat it.
+        var token: String? = nil
+    }
+
     struct Tab: Codable {
         var id: String
         var title: String

package/dist/ios/templates/CraftHybrid.swift

@@ -425,6 +425,7 @@ final class CraftHybrid: NSObject {
                 : "[craft hybrid] nativeScreens are set but dist/native-screen.js is missing; the app has no screens to show")
         }
         isEnabled = wanted && Self.hasBundle
+        applyGate(config)
         if isEnabled, !hasWeb, routes.match(startPath) == nil {
             // No web view to show it in: the first tab a screen draws.
             let fallback = (config.tabs ?? []).map(\.id).first { routes.match($0) != nil }
@@ -458,6 +459,54 @@ final class CraftHybrid: NSObject {
         DispatchQueue.main.asyncAfter(deadline: .now() + 1.5) { self.startAppScript() }
     }
 
+    /// Whether `path` may be shown to someone who is not signed in.
+    ///
+    /// Listed, or under something listed: `/m/store` admits `/m/store/42` and
+    /// not `/m/storefront`. Prefixes are compared with the separator attached
+    /// so a listed path cannot admit a sibling that merely starts with its
+    /// letters.
+    static func gateAdmits(_ path: String, public allowed: [String]) -> Bool {
+        allowed.contains { entry in
+            var listed = entry
+            while listed.count > 1, listed.hasSuffix("/") { listed.removeLast() }
+            guard !listed.isEmpty else { return false }
+            if path == listed { return true }
+            // "/" is the root path, not a prefix of everything. Reading it as
+            // one would admit every path, which is a gate that is not a gate.
+            guard listed != "/" else { return false }
+            return path.hasPrefix(listed + "/")
+        }
+    }
+
+    /// Send a signed-out launch to the gate's redirect before anything is built.
+    ///
+    /// This runs while `startPath` is still being resolved, which is the
+    /// whole point: the app script that would otherwise do it does not start
+    /// until the first frame has been committed, so it can only push sign-in
+    /// on top of a screen that has already been drawn with the previous
+    /// session's data in it (#499).
+    ///
+    /// The Keychain read is synchronous and can cost 100-900ms cold. It is
+    /// not an extra read: every signed-in screen reads this same item when it
+    /// opens, and `CraftKeychain` caches it, so the gate moves the app's first
+    /// read earlier rather than adding one. Only apps that declare a gate pay
+    /// it at all.
+    private func applyGate(_ config: CraftConfig) {
+        guard let gate = config.nativeGate, let redirect = gate.redirect, !redirect.isEmpty else { return }
+        guard !Self.gateAdmits(startPath, public: gate.publicPaths ?? []) else { return }
+        let key = gate.token ?? config.sessionTokenKey ?? "auth.token"
+        guard (CraftNativeActions.webSecureValue(forKey: key) ?? "").isEmpty else { return }
+        // A redirect nothing can draw would trade a private screen for a
+        // blank one. Say so and leave the start path alone; the fallback
+        // below then treats it as any other unroutable start.
+        if isEnabled, !hasWeb, routes.match(redirect) == nil {
+            NSLog("[craft hybrid] nativeGate redirect %@ has no native screen; the gate did not run", redirect)
+            return
+        }
+        NSLog("[craft hybrid] no sign-in under %@: starting on %@ instead of %@", key, redirect, startPath)
+        startPath = redirect
+    }
+
     /// A silent push or a background refresh is waiting for the app script,
     /// with iOS's clock running: it starts now rather than after a frame,
     /// which a launch in the background never draws.

package/dist/ios/templates/CraftNativeActions.swift

@@ -2001,7 +2001,15 @@ enum CraftSnapshots {
             }
             lock.unlock()
             DispatchQueue.main.async {
-                if ok { NotificationCenter.default.post(name: changed, object: nil, userInfo: ["name": name]) }
+                // Posted whether or not the write landed. A screen displays its
+                // checkpoint optimistically, and this notification carries only
+                // the name, so a reader answers it by calling `read` — which
+                // after a failure finds the previous value, because `pending`
+                // was cleared above and the cache was only refilled on success.
+                // Posting only on success left a failed checkpoint on screen as
+                // though it had been kept; Android already restores it
+                // (`changed("snapshots", name, if (ok) json else previous, null)`).
+                NotificationCenter.default.post(name: changed, object: nil, userInfo: ["name": name])
                 completion?(ok)
             }
         }

package/dist/ios/templates/CraftNativeScreen.swift

@@ -12,6 +12,7 @@ import OSLog
 import Security
 import SwiftUI
 import UIKit
+import UIKit.UIGestureRecognizerSubclass
 
 /// A menu belongs to its native view, not to coordinates in a web page.
 final class CraftNativeContextMenu: NSObject, UIContextMenuInteractionDelegate {
@@ -5195,6 +5196,23 @@ private final class CraftNativeScrollView: UIScrollView, UIGestureRecognizerDele
 /// Native inspection of an SVG plot. Coordinates are fractions of the plot's
 /// bounds; labels and values are already localized by the application. No JS
 /// callback or bridge round trip is needed while a finger moves.
+/// Reports where each touch starts and then fails, so it observes a window
+/// without ever taking a touch from the view underneath.
+final class CraftTouchBeganRecognizer: UIGestureRecognizer {
+    private let began: (CGPoint) -> Void
+    init(began: @escaping (CGPoint) -> Void) {
+        self.began = began
+        super.init(target: nil, action: nil)
+        cancelsTouchesInView = false
+        delaysTouchesBegan = false
+        delaysTouchesEnded = false
+    }
+    override func touchesBegan(_ touches: Set<UITouch>, with event: UIEvent) {
+        state = .failed
+        if let touch = touches.first { began(touch.location(in: view)) }
+    }
+}
+
 final class CraftChartInspection: NSObject, UIGestureRecognizerDelegate {
     struct Reading {
         let key: String
@@ -5214,6 +5232,7 @@ final class CraftChartInspection: NSObject, UIGestureRecognizerDelegate {
     private lazy var tap = UITapGestureRecognizer(target: self, action: #selector(tapped(_:)))
     private lazy var pan = UIPanGestureRecognizer(target: self, action: #selector(panned(_:)))
     private lazy var hold = UILongPressGestureRecognizer(target: self, action: #selector(held(_:)))
+    private var outside: CraftTouchBeganRecognizer?
 
     init(view: UIView) {
         self.view = view
@@ -5241,6 +5260,7 @@ final class CraftChartInspection: NSObject, UIGestureRecognizerDelegate {
                            color: (point["color"] as? String).flatMap { UIColor(css: $0) } ?? .systemBlue, label: label, rows: rows)
         }
         selectedIndex = -1
+        unwatchOutside()
         view?.isUserInteractionEnabled = !readings.isEmpty
         if readings.isEmpty { view?.accessibilityTraits.remove(.adjustable); view?.accessibilityValue = nil }
         [tap, pan, hold].forEach { $0.isEnabled = !readings.isEmpty }
@@ -5270,6 +5290,7 @@ final class CraftChartInspection: NSObject, UIGestureRecognizerDelegate {
     }
 
     @discardableResult func dismiss() -> Bool {
+        unwatchOutside()
         guard selectedIndex >= 0 else { return false }
         selectedIndex = -1
         configureAccessibility()
@@ -5277,20 +5298,47 @@ final class CraftChartInspection: NSObject, UIGestureRecognizerDelegate {
         return true
     }
 
-    private func select(at point: CGPoint) {
-        guard let view, view.bounds.width > 0 else { return }
+    private func nearest(at point: CGPoint) -> Int? {
+        guard let view, view.bounds.width > 0 else { return nil }
         let fraction = max(0, min(1, point.x / view.bounds.width))
-        if let nearest = readings.indices.min(by: { abs(readings[$0].x - fraction) < abs(readings[$1].x - fraction) }) { select(nearest) }
+        return readings.indices.min(by: { abs(readings[$0].x - fraction) < abs(readings[$1].x - fraction) })
+    }
+    private func select(at point: CGPoint) {
+        if let index = nearest(at: point) { select(index); watchOutside() }
+    }
+    /// A tap pins the reading under it. Tapping the pinned reading again puts
+    /// it away, so a reading can always be closed where it was opened.
+    func tap(at point: CGPoint) {
+        guard let index = nearest(at: point) else { return }
+        if index == selectedIndex { dismiss() } else { select(at: point) }
+    }
+    /// A drag or a hold reads the chart only while the finger is down.
+    func scrub(_ state: UIGestureRecognizer.State, at point: CGPoint) {
+        switch state {
+        case .began, .changed: select(at: point)
+        case .ended, .cancelled, .failed: dismiss()
+        default: break
+        }
     }
-    @objc private func tapped(_ gesture: UITapGestureRecognizer) { select(at: gesture.location(in: view)) }
-    @objc private func panned(_ gesture: UIPanGestureRecognizer) {
-        if gesture.state == .began || gesture.state == .changed { select(at: gesture.location(in: view)) }
-        if gesture.state == .cancelled { dismiss() }
+    /// A touch that starts anywhere off the chart closes a pinned reading. The
+    /// watcher never recognises, so the touch still reaches what it landed on.
+    func touchBegan(inWindow point: CGPoint) {
+        guard let view, let window = view.window else { return }
+        if !view.bounds.contains(view.convert(point, from: window)) { dismiss() }
     }
-    @objc private func held(_ gesture: UILongPressGestureRecognizer) {
-        if gesture.state == .began || gesture.state == .changed { select(at: gesture.location(in: view)) }
-        if gesture.state == .cancelled { dismiss() }
+    private func watchOutside() {
+        guard outside == nil, let window = view?.window else { return }
+        let watcher = CraftTouchBeganRecognizer { [weak self] point in self?.touchBegan(inWindow: point) }
+        window.addGestureRecognizer(watcher)
+        outside = watcher
     }
+    private func unwatchOutside() {
+        if let outside { outside.view?.removeGestureRecognizer(outside) }
+        outside = nil
+    }
+    @objc private func tapped(_ gesture: UITapGestureRecognizer) { tap(at: gesture.location(in: view)) }
+    @objc private func panned(_ gesture: UIPanGestureRecognizer) { scrub(gesture.state, at: gesture.location(in: view)) }
+    @objc private func held(_ gesture: UILongPressGestureRecognizer) { scrub(gesture.state, at: gesture.location(in: view)) }
     func gestureRecognizerShouldBegin(_ gesture: UIGestureRecognizer) -> Bool {
         guard gesture === pan else { return true }
         let velocity = pan.velocity(in: view)
@@ -6002,9 +6050,23 @@ final class CraftNativeSolidSwitch: UIControl {
         return CGRect(x: min(max(x, track.minX), track.maxX - rect.width - stretch),
                       y: rect.minY, width: rect.width + stretch, height: rect.height)
     }
+    /// How much wider than tall the thumb is drawn.
+    ///
+    /// iOS 26 draws a wide pill where every system before it drew a circle,
+    /// so a square thumb reads as a control from an older OS sitting among
+    /// native ones. Measured on iOS 26.5 (iPhone 17 Pro simulator) by walking
+    /// a real `UISwitch`: the control is 63x28 and its thumb 37x24, inset 2 on
+    /// every side, travelling from x=2 to x=24.
+    ///
+    /// Expressed against the thumb's own height rather than as a fixed size,
+    /// so it keeps following whatever the real `UISwitch` reports — which is
+    /// where `naturalSize` already comes from. At the system's own 24-point
+    /// thumb height this is exactly 37.
+    private static let thumbAspect: CGFloat = 37.0 / 24.0
     private func thumbRect(at position: CGFloat) -> CGRect {
         let track = trackRect.insetBy(dx: 2, dy: 2)
-        return CGRect(x: track.minX + (track.width - track.height) * position, y: track.minY, width: track.height, height: track.height)
+        let width = min(track.width, track.height * Self.thumbAspect)
+        return CGRect(x: track.minX + (track.width - width) * position, y: track.minY, width: width, height: track.height)
     }
     override func draw(_ rect: CGRect) {
         let track = trackRect
@@ -6341,12 +6403,37 @@ private final class CraftNativeTextView: UITextView {
         if !isScrollEnabled, contentOffset != .zero { contentOffset = .zero }
         let inset = textContainerInset
         let padding = textContainer.lineFragmentPadding
-        placeholderLabel.frame = CGRect(
-            x: inset.left + padding,
-            y: inset.top,
-            width: max(0, bounds.width - inset.left - inset.right - padding * 2),
-            height: max(0, bounds.height - inset.top - inset.bottom)
-        )
+        let measured = placeholderLabel
+            .sizeThatFits(CGSize(width: Self.placeholderWidth(bounds: bounds, inset: inset, padding: padding),
+                                 height: .greatestFiniteMagnitude))
+        placeholderLabel.frame = Self.placeholderFrame(bounds: bounds, inset: inset, padding: padding,
+                                                       fittedHeight: measured.height)
+    }
+
+    static func placeholderWidth(bounds: CGRect, inset: UIEdgeInsets, padding: CGFloat) -> CGFloat {
+        max(0, bounds.width - inset.left - inset.right - padding * 2)
+    }
+
+    /// Where the placeholder sits inside the box.
+    ///
+    /// Anchored at the top, and no taller than the text it holds. `UILabel`
+    /// centres its text block vertically within its frame, while
+    /// `UITextView` lays its glyphs out from the top, so a label handed the
+    /// box's whole remaining height drew the placeholder of a four-row notes
+    /// field halfway down it — nowhere near the caret that replaced it the
+    /// moment the field was tapped (#501). The two rules only agreed when
+    /// the box was exactly one line tall, which is why single-line fields
+    /// looked right and every `textarea` did not. Given only the height its
+    /// text needs, the label has no spare height to centre within.
+    ///
+    /// Clamped to what is left of the box so that a placeholder longer than
+    /// the field stays inside it rather than drawing past the bottom.
+    static func placeholderFrame(bounds: CGRect, inset: UIEdgeInsets, padding: CGFloat, fittedHeight: CGFloat) -> CGRect {
+        let available = max(0, bounds.height - inset.top - inset.bottom)
+        return CGRect(x: inset.left + padding,
+                      y: inset.top,
+                      width: placeholderWidth(bounds: bounds, inset: inset, padding: padding),
+                      height: min(max(0, fittedHeight), available))
     }
 
     func refreshPlaceholder() {
@@ -7037,6 +7124,17 @@ final class CraftNativeScreenController: UIViewController, UIScrollViewDelegate,
 
     override func viewWillDisappear(_ animated: Bool) {
         super.viewWillDisappear(animated)
+        // A screen does not take the keyboard with it. Its field is still
+        // first responder at this point, and once the view leaves the window
+        // the next screen's `window?.endEditing` no longer reaches it — the
+        // keyboard then stays up with nothing able to dismiss it until the
+        // app is backgrounded (#497). This is the one moment both facts hold:
+        // the screen is going, and its view still owns the responder.
+        //
+        // `lastFocusedInput` is deliberately left alone. A screen merely
+        // covered by a push comes back, and restoreFocus putting the person
+        // back where they were is the behaviour that was already there.
+        view.endEditing(true)
         screenVisibilityChanged(false)
         stopCelebrations(in: view)
         // Release only this screen's accessory. A retained or prepared screen
@@ -7045,7 +7143,7 @@ final class CraftNativeScreenController: UIViewController, UIScrollViewDelegate,
         CraftChrome.shared.releaseTabAccessory(ownedBy: self)
         // Popped (or its stack dismissed) while the bar was away: it comes
         // back for whatever shows next, a web page included.
-        if tabBarHidden, isMovingFromParent || isBeingDismissed || navigationController?.isBeingDismissed == true {
+        if tabBarHiddenApplied, isMovingFromParent || isBeingDismissed || navigationController?.isBeingDismissed == true {
             CraftChrome.shared.setHiddenByScreen(false)
         }
     }
@@ -7087,7 +7185,7 @@ final class CraftNativeScreenController: UIViewController, UIScrollViewDelegate,
 
     private func restoreShellChrome() {
         guard !isAppScript else { return }
-        CraftChrome.shared.setHiddenByScreen(tabBarHidden)
+        applyTabBarHidden()
         // A screen not yet asked about the accessory (one shown for the first
         // time, before its script has run) leaves the bar as it is; one that
         // has drawn without asking for it takes off what nobody claims.
@@ -7183,6 +7281,18 @@ final class CraftNativeScreenController: UIViewController, UIScrollViewDelegate,
     private func disposeRuntime() {
         guard !runtimeDisposed else { return }
         runtimeDisposed = true
+        // Again here, and forgetting the input this time: a screen can be torn
+        // down without ever appearing (one prepared and then replaced), so
+        // viewWillDisappear is not guaranteed to have run. Nothing comes back
+        // from here, so there is no focus worth restoring.
+        //
+        // `viewIfLoaded`, never `view`: this also runs from `deinit`, where
+        // `view` is a `UIView!` that UIKit has already cleared — reading it
+        // traps on the implicit unwrap, and a screen that never appeared
+        // would instead have `loadView` resurrect `self` while it is being
+        // deallocated. A screen with no loaded view has nothing focused.
+        forgetFocusedInput()
+        viewIfLoaded?.endEditing(true)
         frameDelivery.close()
         storageLifetime.close()
         pendingCapabilityDeadlines.values.forEach { $0.cancel() }
@@ -7658,7 +7768,8 @@ final class CraftNativeScreenController: UIViewController, UIScrollViewDelegate,
     /// - `craft.secureStorage.getSync(key)`: the Keychain item the web page's
     ///   `craft.secureStorage.set` wrote.
     /// - `craft.navigation.setOptions({ title, titleColor, largeTitle, hidden,
-    ///   backTitle, tabBarHidden, tabItem, swipeBack, contentSwipeBack,
+    ///   backTitle, tabBarHidden, tabBarHiddenWhenPushed, tabItem, swipeBack,
+    ///   contentSwipeBack,
     ///   tabSwipeEnabled, backgroundColor, navigationBarSolid, leftButtons,
     ///   rightButtons, tabAccessory })`; a button's tap is the event
     ///   `navButton`. `craft.d.ts` types no navigation surface, so this list
@@ -8125,6 +8236,32 @@ final class CraftNativeScreenController: UIViewController, UIScrollViewDelegate,
     private var statusBarHiddenOverride: Bool?
     /// The app's tab bar away while this screen shows (`tabBarHidden`).
     private var tabBarHidden = false
+    /// The bar away only once this screen is pushed onto something
+    /// (`tabBarHiddenWhenPushed`): UIKit's `hidesBottomBarWhenPushed` idiom,
+    /// for a screen that keeps the bar as its stack's root and drops it when
+    /// it is a detail. Craft's tab bar is drawn by CraftChrome rather than a
+    /// UITabBarController, so the depth is read here and the bar is asked
+    /// directly; the Android shell has honoured the same key all along.
+    private var tabBarHiddenWhenPushed = false
+    /// What this screen last told the chrome. Teardown has to put back a bar
+    /// this screen took away, and recomputing the answer there is no good:
+    /// UIKit has already taken a popped screen out of `viewControllers` by
+    /// `viewWillDisappear`, so a bar hidden for depth would read as never
+    /// hidden at all and stay off for whatever shows next.
+    private var tabBarHiddenApplied = false
+
+    /// Whether the bar should be away for this screen as it stands now.
+    private var wantsTabBarHidden: Bool {
+        if tabBarHidden { return true }
+        guard tabBarHiddenWhenPushed, let stack = navigationController?.viewControllers else { return false }
+        guard let depth = stack.firstIndex(where: { $0 === self }) else { return false }
+        return depth > 0
+    }
+
+    private func applyTabBarHidden() {
+        tabBarHiddenApplied = wantsTabBarHidden
+        CraftChrome.shared.setHiddenByScreen(tabBarHiddenApplied)
+    }
     private var tabAccessory: [String: Any]?
     /// Whether the screen has said anything about the accessory yet
     /// (`tabAccessory`, null included): until it has, the bar keeps showing
@@ -8210,8 +8347,16 @@ final class CraftNativeScreenController: UIViewController, UIScrollViewDelegate,
         }
         if let hidden = options["tabBarHidden"] as? Bool {
             tabBarHidden = hidden
+        }
+        if let hiddenWhenPushed = options["tabBarHiddenWhenPushed"] as? Bool {
+            tabBarHiddenWhenPushed = hiddenWhenPushed
+        }
+        if options.keys.contains("tabBarHidden") || options.keys.contains("tabBarHiddenWhenPushed") {
+            // Prepared tabs and screens under a push keep the answer and apply
+            // it when they are shown (restoreShellChrome); only the screen on
+            // display may move the shared bar.
             if navigationController?.topViewController === self, isShownOnScreen {
-                CraftChrome.shared.setHiddenByScreen(hidden)
+                applyTabBarHidden()
             }
         }
         if let swipeBack = options["swipeBack"] as? Bool {
@@ -8324,6 +8469,22 @@ final class CraftNativeScreenController: UIViewController, UIScrollViewDelegate,
 
     /// A bar button from `{ id, symbol | title }`. Its tap is the event
     /// `navButton` with `{ id }`.
+    /// A bar button's choices, or nil when it has none worth a menu.
+    static func navigationMenu(_ raw: Any?, chosen: @escaping (String) -> Void) -> UIMenu? {
+        let actions: [UIAction] = ((raw as? [[String: Any]]) ?? []).prefix(12).compactMap { choice in
+            guard let id = choice["id"] as? String, !id.isEmpty,
+                  let title = choice["title"] as? String, !title.isEmpty else { return nil }
+            var attributes: UIMenuElement.Attributes = []
+            if choice["disabled"] as? Bool == true { attributes.insert(.disabled) }
+            if choice["destructive"] as? Bool == true { attributes.insert(.destructive) }
+            let action = UIAction(title: title, image: (choice["symbol"] as? String).flatMap { UIImage(systemName: $0) },
+                                  attributes: attributes) { _ in chosen(id) }
+            action.accessibilityIdentifier = "nav-menu-\(id)"
+            return action
+        }
+        return actions.isEmpty ? nil : UIMenu(children: actions)
+    }
+
     private func navigationButton(_ spec: [String: Any]) -> UIBarButtonItem? {
         guard let id = spec["id"] as? String, !id.isEmpty else { return nil }
         let action = UIAction { [weak self] _ in
@@ -8332,11 +8493,16 @@ final class CraftNativeScreenController: UIViewController, UIScrollViewDelegate,
         if spec["variant"] as? String == "accent" || spec["variant"] as? String == "account" {
             return accountNavigationButton(spec, action: action)
         }
+        // `menu`: the button opens a native menu instead of sending its own
+        // id, and each choice is reported as a press of that choice's id.
+        let menu = Self.navigationMenu(spec["menu"]) { [weak self] choice in
+            self?.send(type: "EVENT", payload: ["handlerName": "navButton", "nativeEvent": ["id": choice]])
+        }
         let item: UIBarButtonItem
         if let symbol = spec["symbol"] as? String, let image = UIImage(systemName: symbol) {
-            item = UIBarButtonItem(image: image, primaryAction: action)
+            item = menu.map { UIBarButtonItem(image: image, menu: $0) } ?? UIBarButtonItem(image: image, primaryAction: action)
         } else if let title = spec["title"] as? String {
-            item = UIBarButtonItem(title: title, primaryAction: action)
+            item = menu.map { UIBarButtonItem(title: title, menu: $0) } ?? UIBarButtonItem(title: title, primaryAction: action)
         } else {
             return nil
         }
@@ -8927,14 +9093,22 @@ final class CraftNativeScreenController: UIViewController, UIScrollViewDelegate,
                 ])
             }
         case "NAVIGATE", "NAVIGATE_REPLACE":
-            // A screen's own stack; the app script has none (it opens paths).
-            guard !isAppScript, navigationController?.topViewController === self,
-                  let screen = payload["screen"] as? String, !screen.isEmpty,
-                  let navigation = navigationController else { return }
+            guard let screen = payload["screen"] as? String, !screen.isEmpty else { return }
+            // Replacing a path needs no stack of its own: it asks the shell to
+            // show that path, which is why it delegates rather than pushing.
+            // The app script has no stack, so this was refused to it along
+            // with everything else, and its only way to redirect was to push
+            // sign-in on top of the screen it meant to prevent (#499). The
+            // gate in CraftHybrid.configure is the fix for launch; this is
+            // what lets a session that ends mid-run replace rather than stack.
             if type == "NAVIGATE_REPLACE", screen.hasPrefix("/") {
+                guard isAppScript || navigationController?.topViewController === self else { return }
                 hybridEvents?.nativeScreen(self, replace: screen)
                 return
             }
+            // A screen's own stack; the app script has none (it opens paths).
+            guard !isAppScript, navigationController?.topViewController === self,
+                  let navigation = navigationController else { return }
             let params = payload["params"] as? [String: Any] ?? [:]
             let next = CraftNativeScreenController(config: config, routeName: screen, routeParams: params)
             next.hybridEvents = hybridEvents
@@ -9376,7 +9550,18 @@ final class CraftNativeScreenController: UIViewController, UIScrollViewDelegate,
         previousNodesByProtocolID.removeAll(keepingCapacity: true)
         adoptedPreviousProtocolIDs.removeAll(keepingCapacity: true)
         indexPreviousNodes(previous)
-        let next = reconcile(document, identity: "root", path: "root", previous: previous)
+        // The app's configured body face seeds the inheritance chain, so a
+        // screen's text is branded for the same reason its chrome is. Without
+        // this the chain starts empty and `fontFamily` reached the navigation
+        // bar, the tab labels and the bar buttons — all UIAppearance proxies —
+        // while every label, button and field inside a screen stayed in the
+        // system face (#500).
+        //
+        // A node that sets its own family still wins: the fill below only
+        // applies where a node set none or `inherit`. Nil unless the app
+        // configured one, which the same guard makes free.
+        let next = reconcile(document, identity: "root", path: "root", previous: previous,
+                             inheritedFontFamily: CraftChromeFonts.body)
         previousNodesByProtocolID.removeAll(keepingCapacity: true)
         adoptedPreviousProtocolIDs.removeAll(keepingCapacity: true)
         if previous?.view !== next.view {

package/dist/mobile.js

@@ -1510,7 +1510,7 @@ function postHybrid(message) {
   }
 }
 function isSnapshotName(name) {
-  return typeof name === "string" && /^[A-Za-z0-9_-][\w.-]{0,127}$/.test(name);
+  return typeof name === "string" && /^[A-Za-z0-9_:-][\w.:-]{0,127}$/.test(name);
 }
 var snapshots = {
   isAvailable() {
@@ -1518,7 +1518,7 @@ var snapshots = {
   },
   set(name, value) {
     if (!isSnapshotName(name))
-      throw new TypeError(`Snapshot names are letters, digits, ".", "_" and "-": ${String(name)}`);
+      throw new TypeError(`Snapshot names are letters, digits, ".", "_", "-" and ":": ${String(name)}`);
     const json = JSON.stringify(value);
     if (json === undefined)
       throw new TypeError(`Snapshot ${name} is not JSON`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "craft-native",
-  "version": "0.0.487",
+  "version": "0.0.490",
   "type": "module",
   "description": "Build desktop apps with web languages - TypeScript SDK for Craft",
   "author": "Chris Breuer <chris@stacksjs.org>",