@driftengine/package 3.61.0 → 3.61.1

package/android/build.gradle.kts

@@ -0,0 +1,3 @@
+plugins {
+  id("com.android.application") version "8.7.3" apply false
+}

package/android/gradle.properties

@@ -0,0 +1,4 @@
+# The defaults Android Studio writes, minus the ones that are only about its own UI.
+android.useAndroidX=true
+android.nonTransitiveRClass=true
+org.gradle.jvmargs=-Xmx2048m -Dfile.encoding=UTF-8

package/android/settings.gradle.kts

@@ -0,0 +1,24 @@
+/*
+ * The Android host, as a one-module Gradle project.
+ *
+ * It is a *template*: the packager copies this whole directory into a staging area, drops the
+ * game's build into `app/src/main/assets/www`, and builds there. Nothing a consumer owns is ever
+ * written into this directory, which is what keeps a 70 MB game out of the engine's repository.
+ */
+pluginManagement {
+  repositories {
+    google()
+    mavenCentral()
+    gradlePluginPortal()
+  }
+}
+
+dependencyResolutionManagement {
+  repositories {
+    google()
+    mavenCentral()
+  }
+}
+
+rootProject.name = "drift-android-host"
+include(":app")

package/assets/lockup.svg

@@ -0,0 +1,45 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 233.30 207.08" color="#ececf0">
+  <!--
+    The vertical lockup: the mark over the word.
+
+    The word is outlines rather than text, so this file renders identically on a machine with no
+    fonts installed and inside a shell that has no access to any. Drawn from Fira Sans (SIL Open
+    Font License 1.1) at Light for "Drift" and SemiBold for "Engine": the weight break is what
+    carries the compound word without a space or a capital doing the work, and the colour break
+    puts the engine's own accent on the half that names it.
+
+    Nothing here is a font dependency: no font is embedded, distributed or required. These are
+    curves.
+
+    "Drift" is `currentColor` so the half that is not the accent follows whatever surface this is
+    placed on; the root carries the dark-surface default, which is what a standalone view or an
+    `<img>` gets. The mark is centred on the *cube* rather than on the composition's bounding box:
+    the streaks drag that box left, and centring on it puts the cube visibly off the word's axis.  -->
+  <style>
+    /* The half that is not the accent follows its surface. A file referenced as an image gets
+       these defaults; an inline copy can be overridden by setting `color` on any ancestor.
+       No angle brackets in here: this is XML, and a tag name inside a CSS comment is a tag. */
+    :root { color: #ececf0; }
+    @media (prefers-color-scheme: light) { :root { color: #14141a; } }
+  </style>
+  <g transform="translate(27.96,0)">
+    <polygon points="38.04,54.65 4.00,71.67 4.00,82.07 38.04,65.05" fill="#2ac79c" />
+    <polygon points="38.04,83.02 4.00,100.04 4.00,110.44 38.04,93.42" fill="#116352" />
+    <polygon points="49.39,43.31 88.69,66.00 88.69,111.39 49.39,88.69" fill="#0f5b49" />
+    <polygon points="88.69,66.00 128.00,43.31 128.00,88.69 88.69,111.39" fill="#1c9b7c" />
+    <polygon points="88.69,20.61 128.00,43.31 88.69,66.00 49.39,43.31" fill="#35e0b0" />
+  </g>
+  <g transform="translate(0.00,196.96)">
+    <path transform="translate(0.00,0.00) scale(0.04600,-0.04600)" d="M247 685H111V0H258C399 0 566 64 566 348C566 630 406 685 247 685ZM255 635C375 635 503 599 503 348C503 102 380 50 262 50H171V635Z" fill="currentColor" />
+    <path transform="translate(29.37,0.00) scale(0.04600,-0.04600)" d="M309 534C236 534 189 492 161 406L156 523H106V0H164V320C192 427 231 479 304 479C322 479 335 477 350 473L361 528C347 532 329 534 309 534Z" fill="currentColor" />
+    <path transform="translate(46.83,0.00) scale(0.04600,-0.04600)" d="M134 753C108 753 91 734 91 711C91 688 108 669 134 669C161 669 178 688 178 711C178 734 161 753 134 753ZM164 523H106V0H164Z" fill="currentColor" />
+    <path transform="translate(59.55,0.00) scale(0.04600,-0.04600)" d="M260 695C293 695 325 687 359 672L379 715C340 733 302 743 257 743C166 743 112 691 112 609V523H21V476H112V0H170V476H300L308 523H170V607C170 669 201 695 260 695Z" fill="currentColor" />
+    <path transform="translate(74.62,0.00) scale(0.04600,-0.04600)" d="M321 62C295 47 270 39 241 39C188 39 164 69 164 130V476H292L299 523H164V655L106 648V523H18V476H106V127C106 36 155 -11 234 -11C276 -11 312 1 344 22Z" fill="currentColor" />
+    <path transform="translate(90.60,0.00) scale(0.04600,-0.04600)" d="M486 692H73V0H488V108H220V299H438V405H220V585H470Z" fill="#35e0b0" />
+    <path transform="translate(115.19,0.00) scale(0.04600,-0.04600)" d="M366 546C298 546 247 516 204 463L193 530H70V0H212V366C241 413 273 440 314 440C350 440 372 423 372 362V0H514V386C514 486 459 546 366 546Z" fill="#35e0b0" />
+    <path transform="translate(142.12,0.00) scale(0.04600,-0.04600)" d="M509 610C445 574 383 543 261 546C128 546 35 471 35 354C35 286 63 239 129 203C91 179 67 142 67 104C67 48 113 0 224 0H302C358 0 385 -22 385 -58C385 -96 359 -123 261 -123C160 -123 138 -101 138 -51H11C11 -157 64 -220 258 -220C435 -220 528 -155 528 -48C528 40 451 104 331 104H250C198 104 189 121 189 139C189 153 197 166 209 174C228 169 248 167 271 167C406 167 489 242 489 345C489 412 456 452 391 481C455 481 505 486 544 501ZM264 451C323 451 352 421 352 358C352 293 322 259 265 259C211 259 177 295 177 356C177 414 210 451 264 451Z" fill="#35e0b0" />
+    <path transform="translate(167.45,0.00) scale(0.04600,-0.04600)" d="M140 803C89 803 54 767 54 720C54 673 89 637 140 637C191 637 227 673 227 720C227 767 191 803 140 803ZM212 530H70V0H212Z" fill="#35e0b0" />
+    <path transform="translate(180.72,0.00) scale(0.04600,-0.04600)" d="M366 546C298 546 247 516 204 463L193 530H70V0H212V366C241 413 273 440 314 440C350 440 372 423 372 362V0H514V386C514 486 459 546 366 546Z" fill="#35e0b0" />
+    <path transform="translate(207.65,0.00) scale(0.04600,-0.04600)" d="M518 277C518 446 429 546 279 546C124 546 38 422 38 262C38 96 127 -16 297 -16C380 -16 446 14 498 56L439 136C393 104 355 90 310 90C242 90 194 120 184 222H515C516 237 518 259 518 277ZM377 311H184C191 411 226 449 282 449C350 449 377 397 377 317Z" fill="#35e0b0" />
+  </g>
+</svg>

package/assets/mark-plain.svg

@@ -0,0 +1,23 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64">
+  <!--
+    DriftEngine: a cube in isometric, with the streaks of its own motion behind it.
+
+    A cube because that is what a 3D engine draws before it draws anything else, and three flat
+    facets because that is what this one's renderer does to it — one tone a face, no gradient, no
+    smooth Bezier anywhere in the file.
+
+    The isometric is exact rather than eyeballed: half-diagonals of side*cos30 and side*sin30 with
+    a vertical edge of side, so it reads as a cube instead of as a box. The streaks carry the name.
+    They were arrived at by elimination, and what was tried first is worth recording, because it is
+    the obvious thing: echoes of the cube itself, offset along its axis. Stacked triangles read as
+    a pine tree at every size that was tried. Two parallel streaks, near one bright and far one
+    dim, read as motion at 128 pixels and as motion at 32.
+
+    Below about 24 pixels the streaks merge into the cube. `mark-small.svg` is the same mark with
+    them removed, which is what a favicon should use.  -->
+  <polygon points="19.82,27.06 5.00,34.47 5.00,39.00 19.82,31.59" fill="#2ac79c" />
+  <polygon points="19.82,39.41 5.00,46.82 5.00,51.35 19.82,43.94" fill="#116352" />
+  <polygon points="24.77,22.12 41.88,32.00 41.88,51.77 24.77,41.88" fill="#0f5b49" />
+  <polygon points="41.88,32.00 59.00,22.12 59.00,41.88 41.88,51.77" fill="#1c9b7c" />
+  <polygon points="41.88,12.23 59.00,22.12 41.88,32.00 24.77,22.12" fill="#35e0b0" />
+</svg>

package/assets/mark-small.svg

@@ -0,0 +1,22 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64">
+  <!--
+    DriftEngine: a cube in isometric, with the streaks of its own motion behind it.
+
+    A cube because that is what a 3D engine draws before it draws anything else, and three flat
+    facets because that is what this one's renderer does to it — one tone a face, no gradient, no
+    smooth Bezier anywhere in the file.
+
+    The isometric is exact rather than eyeballed: half-diagonals of side*cos30 and side*sin30 with
+    a vertical edge of side, so it reads as a cube instead of as a box. The streaks carry the name.
+    They were arrived at by elimination, and what was tried first is worth recording, because it is
+    the obvious thing: echoes of the cube itself, offset along its axis. Stacked triangles read as
+    a pine tree at every size that was tried. Two parallel streaks, near one bright and far one
+    dim, read as motion at 128 pixels and as motion at 32.
+
+    Below about 24 pixels the streaks merge into the cube. `mark-small.svg` is the same mark with
+    them removed, which is what a favicon should use.  -->
+  <rect width="64" height="64" rx="12" fill="#0b0b0d" />
+  <polygon points="9.48,19.00 32.00,32.00 32.00,58.00 9.48,45.00" fill="#0f5b49" />
+  <polygon points="32.00,32.00 54.52,19.00 54.52,45.00 32.00,58.00" fill="#1c9b7c" />
+  <polygon points="32.00,6.00 54.52,19.00 32.00,32.00 9.48,19.00" fill="#35e0b0" />
+</svg>

package/assets/mark.svg

@@ -0,0 +1,24 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64">
+  <!--
+    DriftEngine: a cube in isometric, with the streaks of its own motion behind it.
+
+    A cube because that is what a 3D engine draws before it draws anything else, and three flat
+    facets because that is what this one's renderer does to it — one tone a face, no gradient, no
+    smooth Bezier anywhere in the file.
+
+    The isometric is exact rather than eyeballed: half-diagonals of side*cos30 and side*sin30 with
+    a vertical edge of side, so it reads as a cube instead of as a box. The streaks carry the name.
+    They were arrived at by elimination, and what was tried first is worth recording, because it is
+    the obvious thing: echoes of the cube itself, offset along its axis. Stacked triangles read as
+    a pine tree at every size that was tried. Two parallel streaks, near one bright and far one
+    dim, read as motion at 128 pixels and as motion at 32.
+
+    Below about 24 pixels the streaks merge into the cube. `mark-small.svg` is the same mark with
+    them removed, which is what a favicon should use.  -->
+  <rect width="64" height="64" rx="12" fill="#0b0b0d" />
+  <polygon points="19.82,27.06 5.00,34.47 5.00,39.00 19.82,31.59" fill="#2ac79c" />
+  <polygon points="19.82,39.41 5.00,46.82 5.00,51.35 19.82,43.94" fill="#116352" />
+  <polygon points="24.77,22.12 41.88,32.00 41.88,51.77 24.77,41.88" fill="#0f5b49" />
+  <polygon points="41.88,32.00 59.00,22.12 59.00,41.88 41.88,51.77" fill="#1c9b7c" />
+  <polygon points="41.88,12.23 59.00,22.12 41.88,32.00 24.77,22.12" fill="#35e0b0" />
+</svg>

package/assets/originProbe.html

@@ -0,0 +1,117 @@
+<!doctype html>
+<meta charset="utf-8" />
+<title>Origin probe</title>
+<!--
+  The one measurement a mobile host cannot be written without.
+
+  **Whether a WebView calls its origin a secure context decides the design.** `crossOriginIsolated`,
+  `SharedArrayBuffer` and anything threaded depend on it, and the answer is not the same on the two
+  platforms: Android serves from an `https://` origin through `WebViewAssetLoader`, which is a
+  secure context by definition, while iOS serves from a custom scheme through `WKURLSchemeHandler`,
+  where it is genuinely unclear. If iOS says no, the answer is a loopback server on 127.0.0.1 and
+  `SchemeHandler.swift` is the only file that changes.
+
+  Load this in the host — `drift://localhost/__drift/originProbe.html` on iOS,
+  `/originProbe.html` on Android — and read the table. A simulator is evidence for the origin
+  rows and not for the GPU ones.
+
+  The iOS host is `localhost` and the prefix is `__drift/`, and both are load-bearing:
+  `SchemeHandler.swift` serves shell assets from under that prefix alone, and `localhost` is the
+  whole reason the origin is trustworthy. `drift://shell/` is the desktop shell's spelling and
+  resolves here against the game's bundle root, where this file is not.
+-->
+<style>
+  body {
+    font:
+      15px/1.5 system-ui,
+      sans-serif;
+    margin: 0;
+    padding: 16px;
+    background: #0b0b0d;
+    color: #ececf0;
+  }
+  h1 {
+    font-size: 1rem;
+    color: #9a9aa8;
+    margin: 0 0 12px;
+  }
+  table {
+    border-collapse: collapse;
+    width: 100%;
+  }
+  td {
+    padding: 6px 8px;
+    border-bottom: 1px solid #26262d;
+    vertical-align: top;
+  }
+  td:first-child {
+    color: #9a9aa8;
+    white-space: nowrap;
+  }
+  .yes {
+    color: #35e0b0;
+  }
+  .no {
+    color: #ff9b9b;
+  }
+</style>
+<h1>Origin probe</h1>
+<table id="t">
+  <tbody>
+    <tr>
+      <td>running…</td>
+      <td></td>
+    </tr>
+  </tbody>
+</table>
+<script type="module">
+  /* That this script runs at all is the first result: a module script fails from `file://`. */
+  const rows = {
+    origin: location.origin,
+    isSecureContext: String(globalThis.isSecureContext),
+    crossOriginIsolated: String(globalThis.crossOriginIsolated),
+    sharedArrayBuffer: String(typeof SharedArrayBuffer !== 'undefined'),
+    moduleScript: 'yes — this script is one',
+    host: String(globalThis.__driftHost !== undefined),
+    webgpu: String(navigator.gpu !== undefined),
+    webgl2: String(document.createElement('canvas').getContext('webgl2') !== null),
+    videoEncoder: String(typeof VideoEncoder !== 'undefined'),
+    devicePixelRatio: String(devicePixelRatio),
+    screen: `${screen.width}x${screen.height}`,
+    userAgent: navigator.userAgent,
+  };
+
+  try {
+    const worker = new Worker(
+      URL.createObjectURL(new Blob(['self.postMessage(1)'], { type: 'text/javascript' })),
+    );
+    rows.blobWorker = await new Promise((done) => {
+      worker.onmessage = () => done('yes');
+      setTimeout(() => done('no'), 500);
+    });
+  } catch (cause) {
+    rows.blobWorker = `no — ${cause}`;
+  }
+
+  if (navigator.gpu !== undefined) {
+    try {
+      const adapter = await navigator.gpu.requestAdapter();
+      rows.adapter = adapter === null ? 'none offered' : (adapter.info?.description ?? 'unnamed');
+    } catch (cause) {
+      rows.adapter = `threw — ${cause}`;
+    }
+  }
+
+  globalThis.__originReport = rows;
+  document.querySelector('#t tbody').innerHTML = Object.entries(rows)
+    .map(([key, value]) => {
+      const cls =
+        value === 'true' || value === 'yes'
+          ? 'yes'
+          : value === 'false' || value === 'no'
+            ? 'no'
+            : '';
+      return `<tr><td>${key}</td><td class="${cls}">${String(value)}</td></tr>`;
+    })
+    .join('');
+</script>

package/assets/splash.html

@@ -0,0 +1,119 @@
+<!doctype html>
+<meta charset="utf-8" />
+<title>DriftEngine</title>
+<!--
+  The badge the shell shows while the game builds its first frame.
+
+  **It covers a real wait rather than manufacturing one.** A packaged game has to start Chromium,
+  read a world off disk and compile shaders before it can paint, and the alternative to this is a
+  black window for that whole time — which reads as a crash. The minimum duration in the manifest
+  is what stops it flickering on a machine that boots fast, and the cap in `splashTiming.ts` is
+  what stops it outliving a boot that never finishes.
+
+  No script, and nothing loaded from anywhere but the shell's own assets: this page has no reason
+  to run code, and a splash that can fail to render is worse than none.
+-->
+<style>
+  :root {
+    color-scheme: dark;
+  }
+  html,
+  body {
+    height: 100%;
+  }
+  body {
+    margin: 0;
+    display: grid;
+    place-items: center;
+    background: #0b0b0d;
+    /* The plate is flat except for one very soft lift behind the mark, which is what stops a
+       420x300 rectangle of near-black reading as a window that failed to paint. */
+    background-image: radial-gradient(60% 55% at 50% 42%, #12161a 0%, #0b0b0d 70%);
+    overflow: hidden;
+  }
+
+  .stack {
+    display: grid;
+    justify-items: center;
+    gap: 26px;
+  }
+
+  /*
+   * The entrance is the mark's own idea, applied to the whole lockup: it arrives from the left
+   * and settles. Eased hard out, so it is quick at the start and lands rather than stops.
+   */
+  img {
+    width: 208px;
+    height: auto;
+    animation: arrive 640ms cubic-bezier(0.16, 0.84, 0.44, 1) both;
+  }
+
+  @keyframes arrive {
+    from {
+      opacity: 0;
+      transform: translateX(-16px);
+    }
+    to {
+      opacity: 1;
+      transform: translateX(0);
+    }
+  }
+
+  /* A hairline that says something is happening, without claiming to know how much is left.
+     A progress bar that cannot measure progress is a lie told in pixels. */
+  .line {
+    width: 168px;
+    height: 2px;
+    border-radius: 2px;
+    background: #1a2320;
+    overflow: hidden;
+    animation: fade 700ms 260ms both;
+  }
+
+  .line::after {
+    content: '';
+    display: block;
+    width: 42%;
+    height: 100%;
+    border-radius: 2px;
+    background: linear-gradient(90deg, rgba(53, 224, 176, 0), #35e0b0, rgba(53, 224, 176, 0));
+    animation: sweep 1500ms cubic-bezier(0.45, 0, 0.55, 1) infinite;
+  }
+
+  @keyframes fade {
+    from {
+      opacity: 0;
+    }
+    to {
+      opacity: 1;
+    }
+  }
+  @keyframes sweep {
+    from {
+      transform: translateX(-100%);
+    }
+    to {
+      transform: translateX(340%);
+    }
+  }
+
+  /*
+   * Movement is the first thing to go for somebody who asked for less of it. The badge still
+   * appears and still says the same thing; it simply does not travel, and the hairline holds
+   * still rather than sweeping.
+   */
+  @media (prefers-reduced-motion: reduce) {
+    img {
+      animation: fade 300ms both;
+    }
+    .line::after {
+      animation: none;
+      width: 100%;
+      opacity: 0.5;
+    }
+  }
+</style>
+<div class="stack">
+  <img src="./lockup.svg" alt="DriftEngine" />
+  <div class="line"></div>
+</div>

package/ios/DriftHost/AppDelegate.swift

@@ -0,0 +1,23 @@
+import UIKit
+
+/// The application, which is one window holding one view controller.
+///
+/// No storyboard: a game has one screen and a storyboard for it is a file nobody reads and a merge
+/// conflict nobody wants. The launch screen is declared in the generated Info.plist as an empty
+/// `UILaunchScreen`, which gives a black screen for the moment before the first frame — the same
+/// thing the desktop shell's splash covers, and the most iOS offers without a bundled image.
+@main
+final class AppDelegate: UIResponder, UIApplicationDelegate {
+    var window: UIWindow?
+
+    func application(
+        _ application: UIApplication,
+        didFinishLaunchingWithOptions options: [UIApplication.LaunchOptionsKey: Any]? = nil
+    ) -> Bool {
+        let window = UIWindow(frame: UIScreen.main.bounds)
+        window.rootViewController = ViewController()
+        window.makeKeyAndVisible()
+        self.window = window
+        return true
+    }
+}

package/ios/DriftHost/HostBridge.swift

@@ -0,0 +1,159 @@
+import UIKit
+import WebKit
+
+/// The half of the bridge that iOS can expose, which is less than Android's.
+///
+/// **There is no synchronous return from native code to JavaScript on this platform.** A
+/// `WKScriptMessageHandler` is one-way; `WKScriptMessageHandlerWithReply` — iOS 14 and up, which
+/// is why the deployment target is 15 — gives a promise back, and that is the most this can do. So
+/// everything a game must read *synchronously* is injected before its first line of script runs,
+/// as a literal object, and only the mutations arrive here.
+///
+/// `bridgeShim.ts`'s iOS half assembles both into the same `DriftHostBridge` the desktop shell
+/// exposes, so the engine sees one seam with three shells behind it.
+final class HostBridge: NSObject, WKScriptMessageHandlerWithReply {
+    static let name = "driftHost"
+    private static let storePrefix = "drift.store."
+
+    private weak var controller: ViewController?
+    private let defaults = UserDefaults.standard
+
+    init(controller: ViewController) {
+        self.controller = controller
+    }
+
+    /// Everything the page can read the instant it starts, as JSON for the injected literal.
+    ///
+    /// Rebuilt whenever the host has something new to say — a rotation, a display change — and
+    /// pushed into the page by assigning over the same object, so a bridge that read it at boot is
+    /// not left reporting the previous orientation for the rest of the session.
+    func stateJson() -> String {
+        var store: [String: String] = [:]
+        for (key, value) in defaults.dictionaryRepresentation() {
+            guard key.hasPrefix(Self.storePrefix), let text = value as? String else { continue }
+            store[String(key.dropFirst(Self.storePrefix.count))] = text
+        }
+
+        let screen = controller?.view.window?.windowScene?.screen ?? UIScreen.main
+        let bounds = screen.bounds
+        // A real number, which is the whole point of a shell: 60 on most devices and 120 on a
+        // ProMotion one, and a game pacing itself against a guess would be wrong on both.
+        let hz = screen.maximumFramesPerSecond
+
+        let state: [String: Any] = [
+            "snapshot": store,
+            "refreshHz": hz > 0 ? hz : NSNull(),
+            "mode": "fullscreen",
+            "size": ["width": Int(bounds.width), "height": Int(bounds.height)],
+            "displays": [[
+                "id": "0",
+                "label": "built-in",
+                "width": Int(bounds.width),
+                "height": Int(bounds.height),
+                "scale": screen.scale,
+                "refreshHz": hz > 0 ? hz : NSNull(),
+                "primary": true,
+            ]],
+            "fullscreen": true,
+            // An iOS application does not exit itself and Apple asks that it not try, so a game
+            // reads this and draws no exit button rather than one that does nothing.
+            "canQuit": false,
+        ]
+        guard let data = try? JSONSerialization.data(withJSONObject: state),
+              let json = String(data: data, encoding: .utf8) else {
+            return "{}"
+        }
+        return json
+    }
+
+    func userContentController(
+        _ controller: WKUserContentController,
+        didReceive message: WKScriptMessage,
+        replyHandler: @escaping (Any?, String?) -> Void
+    ) {
+        guard let body = message.body as? [String: Any],
+              let name = body["name"] as? String else {
+            replyHandler(false, nil)
+            return
+        }
+        let payload = body["payload"] as? [String: Any] ?? [:]
+
+        switch name {
+        case "write":
+            if let key = payload["key"] as? String, let value = payload["value"] as? String {
+                defaults.set(value, forKey: Self.storePrefix + key)
+            }
+            replyHandler(true, nil)
+
+        case "remove":
+            if let key = payload["key"] as? String {
+                defaults.removeObject(forKey: Self.storePrefix + key)
+            }
+            replyHandler(true, nil)
+
+        case "fullscreen", "mode":
+            // The status bar is the only thing there is to hide here, and the view controller
+            // hides it for the whole life of the application. Answered rather than acted on.
+            replyHandler(true, nil)
+
+        case "save":
+            save(payload: payload, reply: replyHandler)
+
+        case "openExternal":
+            if let raw = payload["url"] as? String, let url = URL(string: raw),
+               ["http", "https", "mailto"].contains(url.scheme ?? "") {
+                UIApplication.shared.open(url)
+            }
+            replyHandler(true, nil)
+
+        default:
+            replyHandler(false, "unknown message: \(name)")
+        }
+    }
+
+    /// Write a file and offer it to the share sheet, which is where a file goes on this platform.
+    ///
+    /// **There is no Downloads folder to save into.** A clip that a player cannot send anywhere is
+    /// a clip that does not exist, so the file is written to the app's temporary directory and
+    /// handed straight to `UIActivityViewController` — Photos, Files, Messages, whatever they
+    /// choose. The temporary copy is the system's to reclaim.
+    private func save(payload: [String: Any], reply: @escaping (Any?, String?) -> Void) {
+        guard let name = payload["name"] as? String,
+              let pieces = payload["data"] as? [String] else {
+            reply(false, nil)
+            return
+        }
+        var bytes = Data()
+        for piece in pieces {
+            guard let part = Data(base64Encoded: piece) else {
+                reply(false, nil)
+                return
+            }
+            bytes.append(part)
+        }
+
+        let safe = name.replacingOccurrences(of: "/", with: "_")
+        let url = FileManager.default.temporaryDirectory.appendingPathComponent(safe)
+        do {
+            try bytes.write(to: url, options: .atomic)
+        } catch {
+            reply(false, nil)
+            return
+        }
+
+        DispatchQueue.main.async { [weak self] in
+            guard let host = self?.controller else {
+                reply(false, nil)
+                return
+            }
+            let sheet = UIActivityViewController(activityItems: [url], applicationActivities: nil)
+            // An iPad presents this from a point rather than from the bottom, and one with no
+            // anchor throws rather than appearing.
+            sheet.popoverPresentationController?.sourceView = host.view
+            sheet.popoverPresentationController?.sourceRect = CGRect(
+                x: host.view.bounds.midX, y: host.view.bounds.midY, width: 0, height: 0)
+            host.present(sheet, animated: true)
+            reply(true, nil)
+        }
+    }
+}