@crossbind/core-app-host 0.0.0-bootstrap.0 → 2.0.0-beta.65

package/cpp/src/host_core.cpp

@@ -0,0 +1,335 @@
+#include "host_core.h"
+
+#include <emscripten/bind.h>
+
+#include <array>
+#include <cstdio>
+#include <filesystem>
+#include <fstream>
+#include <future>
+#include <random>
+#include <sstream>
+
+namespace crossbind::app {
+
+namespace {
+
+class VectorBuffer : public jsi::MutableBuffer {
+public:
+    explicit VectorBuffer(std::vector<uint8_t> bytes) : bytes_(std::move(bytes)) {}
+    size_t size() const override { return bytes_.size(); }
+    uint8_t *data() override { return bytes_.data(); }
+
+private:
+    std::vector<uint8_t> bytes_;
+};
+
+constexpr char B64[] = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
+
+std::string toBase64(const uint8_t *bytes, size_t length) {
+    std::string out;
+    out.reserve((length + 2) / 3 * 4);
+    size_t i = 0;
+    for (; i + 2 < length; i += 3) {
+        const uint32_t n = (bytes[i] << 16) | (bytes[i + 1] << 8) | bytes[i + 2];
+        out += B64[n >> 18];
+        out += B64[(n >> 12) & 63];
+        out += B64[(n >> 6) & 63];
+        out += B64[n & 63];
+    }
+    if (i < length) {
+        const uint32_t n = (bytes[i] << 16) | ((i + 1 < length ? bytes[i + 1] : 0) << 8);
+        out += B64[n >> 18];
+        out += B64[(n >> 12) & 63];
+        out += i + 1 < length ? B64[(n >> 6) & 63] : '=';
+        out += '=';
+    }
+    return out;
+}
+
+std::vector<uint8_t> fromBase64(const std::string &text) {
+    static const auto index = [] {
+        std::array<uint8_t, 256> table{};
+        for (uint8_t i = 0; i < 64; i += 1) table[static_cast<uint8_t>(B64[i])] = i;
+        return table;
+    }();
+    const size_t padding = text.size() >= 2 && text[text.size() - 1] == '=' ? (text[text.size() - 2] == '=' ? 2 : 1) : 0;
+    std::vector<uint8_t> bytes(text.size() / 4 * 3 - padding);
+    size_t o = 0;
+    for (size_t i = 0; i + 3 < text.size(); i += 4) {
+        const uint32_t n = (index[static_cast<uint8_t>(text[i])] << 18) | (index[static_cast<uint8_t>(text[i + 1])] << 12)
+            | (index[static_cast<uint8_t>(text[i + 2])] << 6) | index[static_cast<uint8_t>(text[i + 3])];
+        if (o < bytes.size()) bytes[o++] = n >> 16;
+        if (o < bytes.size()) bytes[o++] = (n >> 8) & 255;
+        if (o < bytes.size()) bytes[o++] = n & 255;
+    }
+    return bytes;
+}
+
+std::vector<uint8_t> bytesOf(const std::string &text) { return std::vector<uint8_t>(text.begin(), text.end()); }
+
+// 128 random bits, as hex.
+std::string randomToken() {
+    std::random_device random;
+    char token[33];
+    std::snprintf(token, sizeof token, "%08x%08x%08x%08x", random(), random(), random(), random());
+    return token;
+}
+
+// A reply the page decodes as a failed call.
+std::string errorReply(const std::string &message) {
+    std::string escaped;
+    for (const char c : message) {
+        if (static_cast<unsigned char>(c) < 0x20) {
+            escaped += ' ';
+            continue;
+        }
+        if (c == '"' || c == '\\') escaped += '\\';
+        escaped += c;
+    }
+    return "[1,{\"name\":\"Error\",\"message\":\"" + escaped + "\"}]";
+}
+
+void setFunction(jsi::Runtime &rt, const char *name, unsigned params, jsi::HostFunctionType fn) {
+    rt.global().setProperty(rt, name, jsi::Function::createFromHostFunction(rt, jsi::PropNameID::forAscii(rt, name), params, std::move(fn)));
+}
+
+// The page's requests for bytes, each answered by a function of the host bundle: a message with its attachments in the
+// request body, and a large result read after its reply.
+const std::map<std::string, std::string> ROUTES{
+    {"/b/frame", "__crossbind_frame"},
+    {"/b/result", "__crossbind_result"},
+};
+
+const std::map<std::string, std::string> MIME_TYPES{
+    {"html", "text/html; charset=utf-8"},
+    {"js", "text/javascript; charset=utf-8"},
+    {"mjs", "text/javascript; charset=utf-8"},
+    {"css", "text/css; charset=utf-8"},
+    {"json", "application/json"},
+    {"map", "application/json"},
+    {"txt", "text/plain; charset=utf-8"},
+    {"svg", "image/svg+xml"},
+    {"png", "image/png"},
+    {"jpg", "image/jpeg"},
+    {"jpeg", "image/jpeg"},
+    {"gif", "image/gif"},
+    {"webp", "image/webp"},
+    {"ico", "image/x-icon"},
+    {"wasm", "application/wasm"},
+    {"woff", "font/woff"},
+    {"woff2", "font/woff2"},
+};
+
+SchemeResponse binaryCall(jsi::Runtime &rt, const std::string &function, SchemeRequest &request) {
+    jsi::ArrayBuffer body(rt, std::make_shared<VectorBuffer>(std::move(request.body)));
+    auto reply = rt.global().getPropertyAsFunction(rt, function.c_str()).call(rt, jsi::String::createFromUtf8(rt, request.query), std::move(body));
+    if (reply.isString()) return SchemeResponse{200, "application/json", bytesOf(reply.asString(rt).utf8(rt))};
+    auto view = reply.asObject(rt);
+    auto buffer = view.getProperty(rt, "buffer").asObject(rt).getArrayBuffer(rt);
+    const auto offset = static_cast<size_t>(view.getProperty(rt, "byteOffset").asNumber());
+    const auto length = static_cast<size_t>(view.getProperty(rt, "byteLength").asNumber());
+    const uint8_t *data = buffer.data(rt) + offset;
+    return SchemeResponse{200, "application/octet-stream", std::vector<uint8_t>(data, data + length)};
+}
+
+// A file of the page: a directory names its index.html, and no path leaves the page's directory.
+SchemeResponse pageFile(const std::string &pageDir, const std::string &path) {
+    if (path.find("..") != std::string::npos) return SchemeResponse{404, "text/plain", {}};
+    std::filesystem::path file = pageDir + path;
+    std::error_code error;
+    if (std::filesystem::is_directory(file, error)) file /= "index.html";
+    // A device, such as Windows' CON, or a pipe would hold the read up.
+    if (!std::filesystem::is_regular_file(file, error)) return SchemeResponse{404, "text/plain", {}};
+    std::ifstream stream(file, std::ios::binary);
+    if (!stream) return SchemeResponse{404, "text/plain", {}};
+    std::ostringstream content;
+    content << stream.rdbuf();
+    const std::string extension = file.extension().string();
+    const auto mime = extension.empty() ? MIME_TYPES.end() : MIME_TYPES.find(extension.substr(1));
+    return SchemeResponse{200, mime == MIME_TYPES.end() ? "application/octet-stream" : mime->second, bytesOf(content.str())};
+}
+
+}  // namespace
+
+std::string readFile(const std::string &path) {
+    std::ifstream file(path, std::ios::binary);
+    if (!file) throw std::runtime_error("cannot read " + path);
+    std::ostringstream text;
+    text << file.rdbuf();
+    return text.str();
+}
+
+void JsThread::start(Task boot) {
+    thread_ = std::thread([this, boot = std::move(boot)] { loop(boot); });
+}
+
+void JsThread::post(Task task) {
+    {
+        std::lock_guard<std::mutex> lock(mutex_);
+        tasks_.push_back(std::move(task));
+    }
+    wake_.notify_one();
+}
+
+void JsThread::postAfter(double ms, Task task) {
+    {
+        std::lock_guard<std::mutex> lock(mutex_);
+        timers_.emplace(Clock::now() + std::chrono::microseconds(static_cast<long long>(ms * 1000)), std::move(task));
+    }
+    wake_.notify_one();
+}
+
+void JsThread::stop() {
+    {
+        std::lock_guard<std::mutex> lock(mutex_);
+        stopping_ = true;
+    }
+    wake_.notify_one();
+    if (thread_.joinable()) thread_.join();
+}
+
+JsThread::Task JsThread::next() {
+    std::unique_lock<std::mutex> lock(mutex_);
+    for (;;) {
+        if (!tasks_.empty()) {
+            Task task = std::move(tasks_.front());
+            tasks_.pop_front();
+            return task;
+        }
+        if (!timers_.empty() && timers_.begin()->first <= Clock::now()) {
+            Task task = std::move(timers_.begin()->second);
+            timers_.erase(timers_.begin());
+            return task;
+        }
+        if (stopping_) return nullptr;
+        if (timers_.empty()) {
+            wake_.wait(lock);
+        } else {
+            wake_.wait_until(lock, timers_.begin()->first);
+        }
+    }
+}
+
+void JsThread::loop(const Task &boot) {
+    auto config = ::hermes::vm::RuntimeConfig::Builder().withMicrotaskQueue(true).withES6BlockScoping(true).build();
+    runtime_ = facebook::hermes::makeHermesRuntime(config);
+    run(boot);
+    while (Task task = next()) run(task);
+}
+
+void JsThread::run(const Task &task) {
+    try {
+        task(*runtime_);
+        while (!runtime_->drainMicrotasks()) {
+        }
+    } catch (const jsi::JSError &error) {
+        std::fprintf(stderr, "crossbind: %s\n%s\n", error.getMessage().c_str(), error.getStack().c_str());
+    } catch (const std::exception &error) {
+        std::fprintf(stderr, "crossbind: %s\n", error.what());
+    }
+}
+
+void Core::installHostFunctions(jsi::Runtime &rt) {
+    setFunction(rt, "__host_log", 2, [](jsi::Runtime &rt, const jsi::Value &, const jsi::Value *args, size_t) {
+        const std::string level = args[0].asString(rt).utf8(rt);
+        std::FILE *out = level == "warn" || level == "error" ? stderr : stdout;
+        std::fprintf(out, "%s\n", args[1].asString(rt).utf8(rt).c_str());
+        std::fflush(out);
+        return jsi::Value::undefined();
+    });
+    setFunction(rt, "__host_timer", 2, [this](jsi::Runtime &rt, const jsi::Value &, const jsi::Value *args, size_t) {
+        const double id = args[0].asNumber();
+        js_.postAfter(args[1].asNumber(), [id](jsi::Runtime &rt) {
+            rt.global().getPropertyAsFunction(rt, "__host_timer_fire").call(rt, id);
+        });
+        return jsi::Value::undefined();
+    });
+    setFunction(rt, "__host_b64encode", 3, [](jsi::Runtime &rt, const jsi::Value &, const jsi::Value *args, size_t) {
+        const auto buffer = args[0].asObject(rt).getArrayBuffer(rt);
+        const auto offset = static_cast<size_t>(args[1].asNumber());
+        const auto length = static_cast<size_t>(args[2].asNumber());
+        return jsi::Value(rt, jsi::String::createFromAscii(rt, toBase64(buffer.data(rt) + offset, length)));
+    });
+    setFunction(rt, "__host_b64decode", 1, [](jsi::Runtime &rt, const jsi::Value &, const jsi::Value *args, size_t) {
+        auto bytes = fromBase64(args[0].asString(rt).utf8(rt));
+        return jsi::Value(rt, jsi::ArrayBuffer(rt, std::make_shared<VectorBuffer>(std::move(bytes))));
+    });
+    setFunction(rt, "__host_reply", 2, [this](jsi::Runtime &rt, const jsi::Value &, const jsi::Value *args, size_t) {
+        const auto pending = replies_.find(args[0].asString(rt).utf8(rt));
+        if (pending != replies_.end()) {
+            const ReplyFn reply = std::move(pending->second);
+            replies_.erase(pending);
+            reply(args[1].asString(rt).utf8(rt));
+        }
+        return jsi::Value::undefined();
+    });
+}
+
+std::string Core::boot(std::string bundle, const std::string &sourceUrl, const std::string &dataPath) {
+    token_ = randomToken();
+    std::promise<std::string> booted;
+    js_.start([&](jsi::Runtime &rt) {
+        try {
+            installHostFunctions(rt);
+            rt.evaluateJavaScript(std::make_shared<jsi::StringBuffer>(std::move(bundle)), sourceUrl);
+            emscripten::internal::_embind_initialize_bindings(rt, dataPath);
+            rt.global().getPropertyAsFunction(rt, "__crossbind_start").call(rt);
+            booted.set_value("");
+        } catch (const jsi::JSError &error) {
+            booted.set_value(error.getMessage() + "\n" + error.getStack());
+        } catch (const std::exception &error) {
+            booted.set_value(error.what());
+        }
+    });
+    return booted.get_future().get();
+}
+
+void Core::receive(std::string message, ReplyFn reply) {
+    if (message.compare(0, token_.size(), token_) != 0) {
+        reply(errorReply("crossbind: this message does not carry the page's token"));
+        return;
+    }
+    message.erase(0, token_.size());
+    js_.post([this, message = std::move(message), reply = std::move(reply)](jsi::Runtime &rt) {
+        const std::string call = std::to_string(nextReply_++);
+        replies_.emplace(call, reply);
+        try {
+            rt.global().getPropertyAsFunction(rt, "__crossbind_receive")
+                .call(rt, jsi::String::createFromUtf8(rt, call), jsi::String::createFromUtf8(rt, message));
+        } catch (const std::exception &error) {
+            replies_.erase(call);
+            reply(errorReply(error.what()));
+        }
+    });
+}
+
+void Core::serve(SchemeRequest request, SchemeRespond answer) {
+    SchemeRespond respond = cors ? SchemeRespond([answer = std::move(answer)](SchemeResponse response) {
+        response.headers.emplace_back("Access-Control-Allow-Origin", "*");
+        answer(std::move(response));
+    })
+                                 : std::move(answer);
+    const auto route = ROUTES.find(request.path);
+    if (route == ROUTES.end()) {
+        respond(pageFile(pageDir_, request.path));
+        return;
+    }
+    if (("&" + request.query + "&").find("&t=" + token_ + "&") == std::string::npos) {
+        respond(SchemeResponse{403, "text/plain", bytesOf("crossbind: this request does not carry the page's token")});
+        return;
+    }
+    js_.post([function = route->second, request = std::move(request), respond = std::move(respond)](jsi::Runtime &rt) mutable {
+        try {
+            respond(binaryCall(rt, function, request));
+        } catch (const std::exception &error) {
+            respond(SchemeResponse{500, "text/plain", bytesOf(error.what())});
+        }
+    });
+}
+
+void Core::reset() {
+    js_.post([](jsi::Runtime &rt) { rt.global().getPropertyAsFunction(rt, "__crossbind_reset").call(rt); });
+}
+
+}  // namespace crossbind::app

package/cpp/src/host_core.h

@@ -0,0 +1,84 @@
+#pragma once
+
+// What every app host shares: the module in Hermes on a thread of its own, the page's messages and its crossbind://
+// requests. A platform adds the window, the webview and their channels (platform.h).
+#include <hermes/hermes.h>
+#include <jsi/jsi.h>
+
+#include "platform.h"
+
+#include <chrono>
+#include <condition_variable>
+#include <deque>
+#include <functional>
+#include <map>
+#include <memory>
+#include <mutex>
+#include <string>
+#include <thread>
+#include <unordered_map>
+
+namespace crossbind::app {
+
+namespace jsi = facebook::jsi;
+using Clock = std::chrono::steady_clock;
+
+std::string readFile(const std::string &path);
+
+// Runs every JS task on one thread, as JSI requires, and drains Hermes' microtasks after each, so a reply that waits
+// on a promise goes out before the next message.
+class JsThread {
+public:
+    using Task = std::function<void(jsi::Runtime &)>;
+
+    void start(Task boot);
+    void post(Task task);
+    void postAfter(double ms, Task task);
+    // The runtime stays alive: bindings keep JSI values in globals that would outlive its teardown.
+    void stop();
+
+private:
+    Task next();
+    void loop(const Task &boot);
+    void run(const Task &task);
+
+    std::unique_ptr<facebook::hermes::HermesRuntime> runtime_;
+    std::mutex mutex_;
+    std::condition_variable wake_;
+    std::deque<Task> tasks_;
+    std::multimap<Clock::time_point, Task> timers_;
+    bool stopping_ = false;
+    std::thread thread_;
+};
+
+class Core {
+public:
+    explicit Core(std::string pageDir) : pageDir_(std::move(pageDir)) {}
+
+    // Loads the host bundle, Hermes bytecode or source, and starts the module. Returns an error, or nothing.
+    std::string boot(std::string bundle, const std::string &sourceUrl, const std::string &dataPath);
+    // A page message, which the host bundle answers through __host_reply.
+    void receive(std::string message, ReplyFn reply);
+    // The page's files, and the calls whose bytes are the request or response body.
+    void serve(SchemeRequest request, SchemeRespond respond);
+    // A new page replaced the one that held the module's objects.
+    void reset();
+    void stop() { js_.stop(); }
+    const std::string &token() const { return token_; }
+
+    // Every response lets any origin read it, as a page from a dev server needs.
+    bool cors = false;
+
+private:
+    void installHostFunctions(jsi::Runtime &rt);
+
+    JsThread js_;
+    std::string pageDir_;
+    // Made at boot for the page's top frame. Every message and every call made as a crossbind:// request carries it, so
+    // markup and frames that cannot read the top frame's globals cannot make one.
+    std::string token_;
+    std::unordered_map<std::string, ReplyFn> replies_;
+    long long nextReply_ = 0;
+};
+
+}  // namespace crossbind::app

package/cpp/src/ios/bundle.mm

@@ -0,0 +1,15 @@
+#import <UIKit/UIKit.h>
+
+#include "platform.h"
+
+// The app's Xcode project copies the app's files into the bundle's app folder.
+std::string resourceDir() { return std::string(NSBundle.mainBundle.resourcePath.UTF8String) + "/app"; }
+
+void onQuit(std::function<void()> quit) {
+    [NSNotificationCenter.defaultCenter addObserverForName:UIApplicationWillTerminateNotification
+                                                    object:nil
+                                                     queue:nil
+                                                usingBlock:^(NSNotification *) {
+                                                  quit();
+                                                }];
+}

package/cpp/src/ios/main.mm

@@ -0,0 +1,71 @@
+// An iOS app: one scene whose WKWebView page reaches a crossbind module running in Hermes, as on macOS. The page comes
+// from crossbind://app/, or in a debug app the dev server opens, from the URL CROSSBIND_APP_URL names.
+#import <UIKit/UIKit.h>
+#import <WebKit/WebKit.h>
+
+#include "app.h"
+
+namespace {
+
+namespace app = crossbind::app;
+
+app::Core *core;
+const char *devUrl;
+
+}  // namespace
+
+@interface CBSceneDelegate : UIResponder <UIWindowSceneDelegate>
+@property(nonatomic, strong) UIWindow *window;
+@end
+
+@implementation CBSceneDelegate
+
+- (void)scene:(UIScene *)scene willConnectToSession:(UISceneSession *)session options:(UISceneConnectionOptions *)options {
+    WKWebViewConfiguration *configuration = [WKWebViewConfiguration new];
+    registerSchemeHandler((__bridge void *)configuration, "crossbind", [](SchemeRequest request, SchemeRespond respond) {
+        core->serve(std::move(request), std::move(respond));
+    });
+    WKWebView *webView = [[WKWebView alloc] initWithFrame:CGRectZero configuration:configuration];
+#ifdef CROSSBIND_APP_DEV
+    if (@available(iOS 16.4, *)) webView.inspectable = YES;
+#endif
+    const std::string url = app::attach(*core, (__bridge void *)webView, devUrl);
+
+    UIViewController *controller = [UIViewController new];
+    controller.view = webView;
+    self.window = [[UIWindow alloc] initWithWindowScene:(UIWindowScene *)scene];
+    self.window.rootViewController = controller;
+    [self.window makeKeyAndVisible];
+    [webView loadRequest:[NSURLRequest requestWithURL:[NSURL URLWithString:@(url.c_str())]]];
+}
+
+@end
+
+@interface CBAppDelegate : UIResponder <UIApplicationDelegate>
+@end
+
+@implementation CBAppDelegate
+
+- (BOOL)application:(UIApplication *)application didFinishLaunchingWithOptions:(NSDictionary *)options {
+    devUrl = app::devUrl();
+    core = &app::start(devUrl);
+    onQuit([] { app::quit(*core, 0); });
+    return YES;
+}
+
+- (UISceneConfiguration *)application:(UIApplication *)application
+    configurationForConnectingSceneSession:(UISceneSession *)session
+                                   options:(UISceneConnectionOptions *)options {
+    UISceneConfiguration *configuration = [[UISceneConfiguration alloc] initWithName:@"Default" sessionRole:session.role];
+    configuration.delegateClass = CBSceneDelegate.class;
+    return configuration;
+}
+
+@end
+
+// The app's Xcode project only calls this from its main(): the whole app comes prebuilt.
+extern "C" int crossbind_app_main(int argc, char *argv[]) {
+    @autoreleasepool {
+        return UIApplicationMain(argc, argv, nil, NSStringFromClass(CBAppDelegate.class));
+    }
+}

package/cpp/src/linux/app.cpp

@@ -0,0 +1,29 @@
+#include "platform.h"
+
+#include <unistd.h>
+
+#include <climits>
+
+namespace {
+
+std::string executablePath() {
+    char path[PATH_MAX];
+    const ssize_t length = readlink("/proc/self/exe", path, sizeof path);
+    return length > 0 ? std::string(path, static_cast<size_t>(length)) : std::string();
+}
+
+}  // namespace
+
+// A Linux app is a directory: the executable, and the app's files in resources/ beside it.
+std::string resourceDir() {
+    const std::string executable = executablePath();
+    return executable.substr(0, executable.find_last_of('/')) + "/resources";
+}
+
+std::string appName() {
+    const std::string executable = executablePath();
+    return executable.substr(executable.find_last_of('/') + 1);
+}
+
+// The app ends with its window; anything else ends the process as it ends any other.
+void onQuit(std::function<void()>) {}

package/cpp/src/linux/channels.cpp

@@ -0,0 +1,143 @@
+#include "main_thread.h"
+#include "platform.h"
+
+#include <webkit2/webkit2.h>
+
+#include <cstdio>
+#include <cstring>
+
+namespace {
+
+// Wraps the page's console and reports uncaught errors, in the top frame alone.
+constexpr const char *CONSOLE_SCRIPT = "(() => {"
+    "const text = (args) => args.map((arg) => {"
+    "  if (arg instanceof Error) return `${arg.message}\\n${arg.stack}`;"
+    "  if (typeof arg === 'string') return arg;"
+    "  try { return JSON.stringify(arg); } catch { return String(arg); }"
+    "}).join(' ');"
+    "const post = (level, args) => window.webkit.messageHandlers.crossbind_console.postMessage([level, text(args)]);"
+    "for (const level of ['log', 'info', 'warn', 'error', 'debug']) {"
+    "  const original = console[level].bind(console);"
+    "  console[level] = (...args) => { post(level, args); original(...args); };"
+    "}"
+    "addEventListener('error', (event) => post('error', [event.error ?? event.message]));"
+    "addEventListener('unhandledrejection', (event) => post('error', [event.reason]));"
+    "})();";
+
+std::string stringOf(JSCValue *value) {
+    gchar *text = jsc_value_to_string(value);
+    std::string result(text ? text : "");
+    g_free(text);
+    return result;
+}
+
+// WebKitGTK does not say which frame sent a message; the host checks the token the message carries instead.
+gboolean onMessage(WebKitUserContentManager *, JSCValue *value, WebKitScriptMessageReply *reply, gpointer data) {
+    const std::string message = jsc_value_is_string(value) ? stringOf(value) : "";
+    JSCContext *context = JSC_CONTEXT(g_object_ref(jsc_value_get_context(value)));
+    webkit_script_message_reply_ref(reply);
+    (*static_cast<MessageHandler *>(data))("", message, [reply, context](const std::string &text) {
+        onMainThread([reply, context, text] {
+            JSCValue *answer = jsc_value_new_string(context, text.c_str());
+            webkit_script_message_reply_return_value(reply, answer);
+            g_object_unref(answer);
+            webkit_script_message_reply_unref(reply);
+            g_object_unref(context);
+        });
+    });
+    return TRUE;
+}
+
+void onConsole(WebKitUserContentManager *, WebKitJavascriptResult *result, gpointer) {
+    JSCValue *entry = webkit_javascript_result_get_js_value(result);
+    JSCValue *level = jsc_value_object_get_property_at_index(entry, 0);
+    JSCValue *text = jsc_value_object_get_property_at_index(entry, 1);
+    const std::string name = stringOf(level);
+    std::FILE *out = name == "warn" || name == "error" ? stderr : stdout;
+    std::fprintf(out, "%s\n", stringOf(text).c_str());
+    std::fflush(out);
+    g_object_unref(level);
+    g_object_unref(text);
+}
+
+std::vector<uint8_t> readBody(WebKitURISchemeRequest *request) {
+    std::vector<uint8_t> body;
+    GInputStream *stream = webkit_uri_scheme_request_get_http_body(request);
+    if (!stream) return body;
+    uint8_t chunk[65536];
+    for (gssize read; (read = g_input_stream_read(stream, chunk, sizeof chunk, nullptr, nullptr)) > 0;) {
+        body.insert(body.end(), chunk, chunk + read);
+    }
+    g_object_unref(stream);
+    return body;
+}
+
+void respond(WebKitURISchemeRequest *request, SchemeResponse response) {
+    auto *bytes = new std::vector<uint8_t>(std::move(response.body));
+    GBytes *data = g_bytes_new_with_free_func(bytes->data(), bytes->size(),
+        [](gpointer owned) { delete static_cast<std::vector<uint8_t> *>(owned); }, bytes);
+    GInputStream *stream = g_memory_input_stream_new_from_bytes(data);
+    WebKitURISchemeResponse *answer = webkit_uri_scheme_response_new(stream, static_cast<gint64>(g_bytes_get_size(data)));
+    webkit_uri_scheme_response_set_status(answer, static_cast<guint>(response.status), nullptr);
+    webkit_uri_scheme_response_set_content_type(answer, response.mime.c_str());
+    if (!response.headers.empty()) {
+        SoupMessageHeaders *headers = soup_message_headers_new(SOUP_MESSAGE_HEADERS_RESPONSE);
+        for (const auto &[name, value] : response.headers) soup_message_headers_append(headers, name.c_str(), value.c_str());
+        webkit_uri_scheme_response_set_http_headers(answer, headers);
+    }
+    webkit_uri_scheme_request_finish_with_response(request, answer);
+    g_object_unref(answer);
+    g_object_unref(stream);
+    g_bytes_unref(data);
+    g_object_unref(request);
+}
+
+void onSchemeRequest(WebKitURISchemeRequest *request, gpointer data) {
+    SchemeRequest incoming;
+    const char *method = webkit_uri_scheme_request_get_http_method(request);
+    incoming.method = method ? method : "GET";
+    const char *path = webkit_uri_scheme_request_get_path(request);
+    incoming.path = path ? path : "";
+    const char *uri = webkit_uri_scheme_request_get_uri(request);
+    const char *query = uri ? std::strchr(uri, '?') : nullptr;
+    incoming.query = query ? query + 1 : "";
+    incoming.body = readBody(request);
+    g_object_ref(request);
+    (*static_cast<SchemeHandler *>(data))(std::move(incoming), [request](SchemeResponse response) {
+        onMainThread([request, response = std::move(response)]() mutable { respond(request, std::move(response)); });
+    });
+}
+
+}  // namespace
+
+void installReplyChannel(void *webView, const char *name, MessageHandler handler) {
+    WebKitUserContentManager *manager = webkit_web_view_get_user_content_manager(WEBKIT_WEB_VIEW(webView));
+    const std::string signal = std::string("script-message-with-reply-received::") + name;
+    g_signal_connect(manager, signal.c_str(), G_CALLBACK(onMessage), new MessageHandler(std::move(handler)));
+    webkit_user_content_manager_register_script_message_handler_with_reply(manager, name, nullptr);
+}
+
+void forwardConsole(void *webView) {
+    WebKitUserContentManager *manager = webkit_web_view_get_user_content_manager(WEBKIT_WEB_VIEW(webView));
+    g_signal_connect(manager, "script-message-received::crossbind_console", G_CALLBACK(onConsole), nullptr);
+    webkit_user_content_manager_register_script_message_handler(manager, "crossbind_console");
+    addTopFrameScript(webView, CONSOLE_SCRIPT);
+}
+
+void addTopFrameScript(void *webView, const std::string &source) {
+    WebKitUserContentManager *manager = webkit_web_view_get_user_content_manager(WEBKIT_WEB_VIEW(webView));
+    WebKitUserScript *script = webkit_user_script_new(source.c_str(), WEBKIT_USER_CONTENT_INJECT_TOP_FRAME,
+        WEBKIT_USER_SCRIPT_INJECT_AT_DOCUMENT_START, nullptr, nullptr);
+    webkit_user_content_manager_add_script(manager, script);
+    webkit_user_script_unref(script);
+}
+
+// The page's requests are secure-context requests, and CORS applies to them as it does to https.
+void registerSchemeHandler(void *target, const char *scheme, SchemeHandler handler) {
+    WebKitWebContext *context = webkit_web_view_get_context(WEBKIT_WEB_VIEW(target));
+    webkit_web_context_register_uri_scheme(context, scheme, onSchemeRequest, new SchemeHandler(std::move(handler)),
+        [](gpointer owned) { delete static_cast<SchemeHandler *>(owned); });
+    WebKitSecurityManager *security = webkit_web_context_get_security_manager(context);
+    webkit_security_manager_register_uri_scheme_as_secure(security, scheme);
+    webkit_security_manager_register_uri_scheme_as_cors_enabled(security, scheme);
+}