@swiftbrowser/native 0.17.8 → 0.18.0

package/swift/Sources/SwiftBrowserNative/Host/FilesBridge.swift

@@ -0,0 +1,154 @@
+#if canImport(SwiftUI)
+import Foundation
+
+#if !canImport(FoundationBridge)
+
+/// The app's files for the page's `fileManager` (@swiftbrowser/react): the
+/// `files` host requests (packages/native/src/hostRequests.ts), answered with
+/// Foundation's `FileManager` in the app's sandbox. A URL must be in one of
+/// the app's directories (`Documents`, `Library`, `tmp`); bytes cross the
+/// bridge as base64; the standard directories go to the page through the
+/// bridge's `appDirectories()`. Failures are `kind: detail`, as the page's own
+/// host fails: `unsupported`, `notFound`, `exists`, `isDirectory`,
+/// `notDirectory`.
+struct FilesBridge: Sendable {
+    /// Not stored: a struct without stored properties is `Sendable`, and `handle` runs off the main actor.
+    private var manager: FileManager { .default }
+
+    /// The standard directories, made where they are not yet (`Application Support` is not, on iOS).
+    static func directories() -> JSONValue {
+        let manager = FileManager.default
+        let documents = manager.urls(for: .documentDirectory, in: .userDomainMask).first!
+        let support = manager.urls(for: .applicationSupportDirectory, in: .userDomainMask).first!
+        let caches = manager.urls(for: .cachesDirectory, in: .userDomainMask).first!
+        for directory in [documents, support, caches] {
+            try? manager.createDirectory(at: directory, withIntermediateDirectories: true)
+        }
+        return .object([
+            "documents": .string(documents.standardizedFileURL.absoluteString),
+            "applicationSupport": .string(support.standardizedFileURL.absoluteString),
+            "caches": .string(caches.standardizedFileURL.absoluteString),
+            "temporary": .string(manager.temporaryDirectory.standardizedFileURL.absoluteString),
+        ])
+    }
+
+    /// Where the app may read and write: its documents, its library (Application Support, Caches) and its temporary directory.
+    private var roots: [URL] {
+        var roots = [URL]()
+        for directory in [FileManager.SearchPathDirectory.documentDirectory, .libraryDirectory] {
+            if let url = manager.urls(for: directory, in: .userDomainMask).first { roots.append(url.standardizedFileURL) }
+        }
+        roots.append(manager.temporaryDirectory.standardizedFileURL)
+        return roots
+    }
+
+    /// The file URL `params[key]` names, under today's container, inside the app's directories.
+    private func url(_ params: JSONObject, _ key: String) throws -> URL {
+        guard let string = params[key]?.string, let parsed = URL(string: string) else {
+            throw HostRequestFailure("unsupported: files: \(key) is not a URL")
+        }
+        guard parsed.isFileURL else { throw HostRequestFailure("unsupported: \(string) is not a file URL") }
+        let url = AppFiles.current(parsed).standardizedFileURL
+        let path = url.path
+        guard roots.contains(where: { path == $0.path || path.hasPrefix($0.path + "/") }) else {
+            throw HostRequestFailure("unsupported: \(string) is not in the app's directories")
+        }
+        return url
+    }
+
+    private func isDirectory(_ url: URL) -> Bool? {
+        var directory: ObjCBool = false
+        guard manager.fileExists(atPath: url.path, isDirectory: &directory) else { return nil }
+        return directory.boolValue
+    }
+
+    private func requireDirectory(_ directory: URL, for url: URL) throws {
+        switch isDirectory(directory) {
+        case nil: throw HostRequestFailure("notFound: no directory at \(directory.absoluteString) (for \(url.absoluteString))")
+        case false?: throw HostRequestFailure("notDirectory: \(directory.absoluteString) is a file")
+        case true?: break
+        }
+    }
+
+    func handle(_ params: JSONObject) async throws -> JSONValue {
+        switch params["action"]?.string {
+        case "read":
+            let url = try url(params, "url")
+            switch isDirectory(url) {
+            case nil: throw HostRequestFailure("notFound: no file at \(url.absoluteString)")
+            case true?: throw HostRequestFailure("isDirectory: \(url.absoluteString) is a directory")
+            case false?: break
+            }
+            let data = try Data(contentsOf: url)
+            return .object(["data": .string(data.base64EncodedString())])
+        case "write":
+            let url = try url(params, "url")
+            guard let data = Data(base64Encoded: params["data"]?.string ?? "") else {
+                throw HostRequestFailure("unsupported: files: data is not base64")
+            }
+            if isDirectory(url) == true { throw HostRequestFailure("isDirectory: \(url.absoluteString) is a directory") }
+            try requireDirectory(url.deletingLastPathComponent(), for: url)
+            try data.write(to: url, options: .atomic)
+            return .object([:])
+        case "remove":
+            let url = try url(params, "url")
+            guard isDirectory(url) != nil else { throw HostRequestFailure("notFound: nothing at \(url.absoluteString)") }
+            guard !roots.contains(where: { $0.path == url.path }) else {
+                throw HostRequestFailure("unsupported: \(url.absoluteString) is one of the app's directories")
+            }
+            try manager.removeItem(at: url)
+            return .object([:])
+        case "createDirectory":
+            let url = try url(params, "url")
+            if isDirectory(url) == false { throw HostRequestFailure("exists: \(url.absoluteString) is a file") }
+            try manager.createDirectory(at: url, withIntermediateDirectories: true)
+            return .object([:])
+        case "list":
+            let url = try url(params, "url")
+            try requireDirectory(url, for: url)
+            let names = try manager.contentsOfDirectory(atPath: url.path).sorted { $0.localizedStandardCompare($1) == .orderedAscending }
+            return .object(["urls": .array(names.map { .string(url.appendingPathComponent($0).absoluteString) })])
+        case "attributes":
+            let url = try url(params, "url")
+            guard let directory = isDirectory(url) else { return .null }
+            let attributes = try manager.attributesOfItem(atPath: url.path)
+            let size = directory ? 0 : ((attributes[.size] as? NSNumber)?.doubleValue ?? 0)
+            let modified = (attributes[.modificationDate] as? Date).map { JSONValue.number(($0.timeIntervalSince1970 * 1000).rounded()) } ?? .null
+            return .object(["size": .number(size), "modified": modified, "directory": .bool(directory)])
+        case "move", "copy":
+            let from = try url(params, "from")
+            let to = try url(params, "to")
+            guard isDirectory(from) != nil else { throw HostRequestFailure("notFound: nothing at \(from.absoluteString)") }
+            guard isDirectory(to) == nil else { throw HostRequestFailure("exists: something is at \(to.absoluteString) already") }
+            try requireDirectory(to.deletingLastPathComponent(), for: to)
+            if to.path.hasPrefix(from.path + "/") { throw HostRequestFailure("unsupported: \(to.absoluteString) is inside \(from.absoluteString)") }
+            if params["action"]?.string == "move" { try manager.moveItem(at: from, to: to) } else { try manager.copyItem(at: from, to: to) }
+            return .object([:])
+        default:
+            throw HostRequestFailure("unsupported: files: unknown action \(params["action"]?.string ?? "")")
+        }
+    }
+}
+
+#endif
+
+/// Files the app keeps (a recording's, `fileManager`'s) are named by their
+/// URL, and iOS moves an app's container when it is installed again: a file
+/// URL into an old `Documents` that is not there anymore is the same path
+/// under today's. (Against the shim nothing moves.)
+enum AppFiles {
+    static func current(_ url: URL) -> URL {
+        #if canImport(FoundationBridge)
+        return url
+        #else
+        let manager = FileManager.default
+        guard url.isFileURL, !manager.fileExists(atPath: url.path) else { return url }
+        guard let range = url.path.range(of: "/Documents/"),
+              let documents = manager.urls(for: .documentDirectory, in: .userDomainMask).first
+        else { return url }
+        let moved = documents.appendingPathComponent(String(url.path[range.upperBound...]))
+        return manager.fileExists(atPath: moved.path) ? moved : url
+        #endif
+    }
+}
+#endif

package/swift/Sources/SwiftBrowserNative/Host/HostBridge.swift

@@ -30,7 +30,9 @@ import CryptoKit
 /// | `randomBytes(count)` | base64 of random bytes (`crypto.getRandomValues`) |
 /// | `openURL(url)` | the system opener |
 /// | `locale()` | the viewer's locale identifier |
+/// | `measureText(text, fontJSON, width)` | @swiftbrowser/react's `measureText`: `{ width, height, lines }` of the text in the font wrapped to the width (one line when null), from `NSAttributedString`'s bounding rect, synchronously (TextMeasureBridge.swift); nothing where there is no text system |
 /// | `launchArguments()` | the process's arguments (`-screen list` from a scheme or `simctl launch`) |
+/// | `appDirectories()` | the app's standard directories as `file:` URLs, a JSON object `{ documents, applicationSupport, caches, temporary }`, for `fileManager` (FilesBridge.swift); its `files` requests go through `hostRequest`. Apple platforms only |
 /// | `mediaSession(update)` | `navigator.mediaSession`: the lock screen's now-playing info and the remote commands the app handles, on MediaPlayer (NowPlayingBridge.swift); a command the viewer gives comes to `__sbMediaSessionCommand(json)` |
 /// | `notificationsReady()`, `notificationPermission(id, request)`, `notificationShow(json)`, `notificationClose(json)`, `setBadge(count)`, `pushRegister(id, key?)` | notifications on UserNotifications (NotificationBridge.swift): the permission answers `__sbNotificationPermission(id, state)`, a registration `__sbPushRegistered(id, result)`, and what the viewer opens or what arrives comes to `__sbNotification(json)` |
 /// | `wsOpen(id, url, protocols)`, `wsSend(id, json)`, `wsClose(id, code, reason)` | `WebSocket` on `URLSessionWebSocketTask` (WebSocketBridge.swift); what a socket receives comes to `__sbWebSocketEvent(id, json)` |
@@ -38,6 +40,7 @@ import CryptoKit
 /// | `haptic(kind)` | `navigator.vibrate`: a feedback generator's `impact`, `selection`, `success`, `warning` or `error` |
 /// | `hostRequest(id, kind, json)` | the web renderer's `share`, `pickFiles`, `clipboard`, `pickColor` and `webAuth` requests, answered with the system's share sheet, pickers, pasteboard and sign-in session (HostRequestBridge.swift); the answer comes to `__sbHostResponse(id, result)` |
 /// | `secureGet(key)`, `secureSet(key, value)`, `secureRemove(key)` | `secureStorage` over the Keychain (SecureStorage.swift) |
+/// | `undoState(json)` | the app's undo manager's `canUndo`, `canRedo`, `undoActionName` and `redoActionName`, mirrored on the window's `UndoManager` (UndoBridge.swift) so the shake, the three-finger swipe, ⌘Z and the Edit menu reach the app; what the system asks comes to `__sbUndoCommand("undo" \| "redo")` |
 /// | `workerStart(id, name, engine)`, `workerPost(id, text)`, `workerTerminate(id)` | workers (JavaScriptCore only): a `JSContext` on a thread (`"context"`, WorkerHost.swift) or a hidden web view with WebKit's JIT (`"webview"`, WebViewWorkerHost.swift); their messages come to `__sbWorkerMessage(id, text)`, their errors to `__sbWorkerError(id, message)` |
 ///
 /// Everything JavaScript-facing runs on the main thread; work that is not
@@ -60,6 +63,11 @@ final class HostBridge {
     #endif
     private var webSockets: WebSocketBridge?
     private var hostRequests: HostRequestBridge?
+    #if !canImport(FoundationBridge)
+    private var undo: UndoBridge?
+    /// The window's undo manager, for the undo bridge when the app first sends a state.
+    private weak var undoManager: UndoManager?
+    #endif
     /// Keys of `localStorage` live under this prefix in `UserDefaults`.
     static let storagePrefix = "swiftbrowser.storage."
 
@@ -74,6 +82,9 @@ final class HostBridge {
         for timer in timers.values { timer.invalidate() }
         timers.removeAll()
         webSockets?.invalidate()
+        #if !canImport(FoundationBridge)
+        undo?.manager = nil
+        #endif
         #if canImport(JavaScriptCore)
         for worker in workers.values { worker.terminate() }
         workers.removeAll()
@@ -209,8 +220,18 @@ final class HostBridge {
 
         host.install("locale") { _ in .string(Locale.current.identifier) }
 
+        host.install("measureText") { arguments in
+            guard let text = arguments[safe: 0]?.string else { return nil }
+            let font = (try? JSONValue.parse(arguments[safe: 1]?.string ?? "{}")) ?? .object([:])
+            return TextMeasureBridge.measure(text: text, font: font, width: arguments[safe: 2]?.double)
+        }
+
         host.install("launchArguments") { _ in .array(ProcessInfo.processInfo.arguments.map(JSONValue.string)) }
 
+        #if !canImport(FoundationBridge)
+        host.install("appDirectories") { _ in .string(FilesBridge.directories().json) }
+        #endif
+
         #if canImport(MediaPlayer)
         host.install("mediaSession") { [weak self] arguments in
             guard let self, let update = arguments.first?.string else { return .string("mediaSession: expected a JSON string") }
@@ -293,6 +314,13 @@ final class HostBridge {
             return nil
         }
 
+        #if !canImport(FoundationBridge)
+        host.install("undoState") { [weak self] arguments in
+            guard let self, let json = arguments.first?.string else { return .string("undoState: expected a JSON string") }
+            return undoBridge.update(json).map(JSONValue.string)
+        }
+        #endif
+
         host.install("secureGet") { arguments in
             guard let key = arguments.first?.string else { return nil }
             return SecureStorage.get(key).map(JSONValue.string) ?? .null
@@ -367,6 +395,23 @@ final class HostBridge {
     }
     #endif
 
+    #if !canImport(FoundationBridge)
+    /// The undo bridge, made when the app first sends its undo manager's state.
+    private var undoBridge: UndoBridge {
+        if let undo { return undo }
+        let bridge = UndoBridge { [weak self] command in self?.callIn("__sbUndoCommand", [.string(command)]) }
+        bridge.manager = undoManager
+        undo = bridge
+        return bridge
+    }
+
+    /// The window's `UndoManager` (the root view's environment), which mirrors the app's.
+    func setUndoManager(_ manager: UndoManager?) {
+        undoManager = manager
+        undo?.manager = manager
+    }
+    #endif
+
     /// The WebSocket bridge, made when the app opens its first socket.
     private var webSocketBridge: WebSocketBridge {
         if let webSockets { return webSockets }

package/swift/Sources/SwiftBrowserNative/Host/HostRequestBridge.swift

@@ -30,8 +30,10 @@ import UniformTypeIdentifiers
 /// `multiple`: the photo picker for pictures and videos, else the document
 /// picker; `{ files: [{ name, type, data }] }`), `clipboard` (`write` with
 /// `text` or `files`, `readText`; `{ text }`), `pickColor` (`color`: the
-/// color picker; `{ color }`) and `webAuth` (`url`, `callbackScheme`,
-/// `ephemeral`: `ASWebAuthenticationSession`; `{ url }`). Against the shim
+/// color picker; `{ color }`), `webAuth` (`url`, `callbackScheme`,
+/// `ephemeral`: `ASWebAuthenticationSession`; `{ url }`) and, on iOS,
+/// `audioRecord` (`action`: the microphone with `AVAudioRecorder`,
+/// AudioRecorderBridge.swift). Against the shim
 /// (the round trip) the page answers the first four itself, and the sign-in
 /// runs on the shim's session; the rest answers `unsupported`.
 @MainActor
@@ -39,6 +41,14 @@ final class HostRequestBridge {
     private let answer: (Int, JSONValue) -> Void
     /// Delegates and sessions kept alive until they answer.
     private var active: [ObjectIdentifier: AnyObject] = [:]
+    #if os(iOS) && !canImport(FoundationBridge)
+    /// The microphone (`audioRecord`), one recording at a time.
+    private lazy var recorder = AudioRecorderBridge()
+    #endif
+    #if !canImport(FoundationBridge)
+    /// The app's files (`files`) for `fileManager`.
+    private let files = FilesBridge()
+    #endif
 
     /// `answer` hands a request's result to the app.
     init(answer: @escaping (Int, JSONValue) -> Void) {
@@ -64,6 +74,10 @@ final class HostRequestBridge {
         case "pickFiles": try await pickFiles(params)
         case "clipboard": try clipboard(params)
         case "pickColor": try await pickColor(params)
+        case "files": try await files.handle(params)
+        #endif
+        #if os(iOS) && !canImport(FoundationBridge)
+        case "audioRecord": try await recorder.handle(params)
         #endif
         default: throw HostRequestFailure("unsupported: the native app cannot answer a \(kind) request")
         }

package/swift/Sources/SwiftBrowserNative/Host/TextMeasureBridge.swift

@@ -0,0 +1,139 @@
+#if canImport(SwiftUI)
+import Foundation
+import SwiftBrowserProtocol
+import SwiftUI
+#if canImport(UIKit)
+import UIKit
+#elseif canImport(AppKit)
+import AppKit
+#endif
+
+/// `measureText(text, fontJSON, width)` for @swiftbrowser/react's
+/// `measureText`: the size `text` takes in the font (a Font JSON object:
+/// `textStyle` or `size`, `weight`, `design`; the body font when empty)
+/// wrapped to `width` points (one line when null), from
+/// `NSAttributedString`'s bounding rect with the platform font, so an app
+/// paginating from text sizes gets what UIKit draws. Answers
+/// `{ width, height, lines }` (`lines` is the height in the font's line
+/// heights), or nil where there is no text system (the shim's round trip).
+enum TextMeasureBridge {
+    static func measure(text: String, font fontJSON: JSONValue, width: Double?) -> JSONValue? {
+        #if (canImport(UIKit) || canImport(AppKit)) && !canImport(FoundationBridge) // the shim's stand-ins have no text system
+        let font = platformFont(FontSpec(json: fontJSON))
+        let bounds = CGSize(width: width.map { CGFloat(max(1, $0)) } ?? .greatestFiniteMagnitude, height: .greatestFiniteMagnitude)
+        // An empty text is one line tall, as a `Text("")` is.
+        let measured = NSAttributedString(string: text.isEmpty ? " " : text, attributes: [.font: font])
+        let rect = measured.boundingRect(with: bounds, options: [.usesLineFragmentOrigin, .usesFontLeading], context: nil)
+        // The font's line height from the metrics UIFont and NSFont share (NSFont has no `lineHeight`).
+        let lineHeight = max(1, font.ascender - font.descender + font.leading)
+        let lines = max(1, Int((rect.height / lineHeight).rounded()))
+        return .object([
+            "width": .number(Double(text.isEmpty ? 0 : ceil(rect.width))),
+            "height": .number(Double(ceil(rect.height))),
+            "lines": .number(Double(lines)),
+        ])
+        #else
+        return nil
+        #endif
+    }
+
+    #if canImport(UIKit)
+    typealias PlatformFont = UIFont
+    #elseif canImport(AppKit)
+    typealias PlatformFont = NSFont
+    #endif
+
+    #if (canImport(UIKit) || canImport(AppKit)) && !canImport(FoundationBridge) // the shim's stand-ins have no text system
+    /// The platform font a Font JSON object names: a text style's preferred font (Dynamic Type) or a point size, with its weight and design.
+    static func platformFont(_ spec: FontSpec?) -> PlatformFont {
+        let weight = spec?.weight.map(platformWeight) ?? .regular
+        var font: PlatformFont
+        if let size = spec?.size {
+            font = PlatformFont.systemFont(ofSize: CGFloat(size), weight: weight)
+        } else {
+            #if canImport(UIKit)
+            let base = UIFont.preferredFont(forTextStyle: textStyle(spec?.textStyle ?? "body"))
+            font = spec?.weight == nil ? base : UIFont.systemFont(ofSize: base.pointSize, weight: weight)
+            #else
+            let base = NSFont.preferredFont(forTextStyle: textStyle(spec?.textStyle ?? "body"))
+            font = spec?.weight == nil ? base : NSFont.systemFont(ofSize: base.pointSize, weight: weight)
+            #endif
+        }
+        if let design = spec?.design.flatMap(platformDesign), let descriptor = font.fontDescriptor.withDesign(design) {
+            #if canImport(UIKit)
+            font = UIFont(descriptor: descriptor, size: font.pointSize)
+            #else
+            font = NSFont(descriptor: descriptor, size: font.pointSize) ?? font
+            #endif
+        }
+        return font
+    }
+
+    private static func platformWeight(_ name: String) -> PlatformFont.Weight {
+        switch name {
+        case "ultraLight": return .ultraLight
+        case "thin": return .thin
+        case "light": return .light
+        case "medium": return .medium
+        case "semibold": return .semibold
+        case "bold": return .bold
+        case "heavy": return .heavy
+        case "black": return .black
+        default: return .regular
+        }
+    }
+
+    #if canImport(UIKit)
+    private static func platformDesign(_ name: String) -> UIFontDescriptor.SystemDesign? {
+        switch name {
+        case "serif": return .serif
+        case "rounded": return .rounded
+        case "monospaced": return .monospaced
+        default: return nil
+        }
+    }
+
+    private static func textStyle(_ name: String) -> UIFont.TextStyle {
+        switch name {
+        case "largeTitle": return .largeTitle
+        case "title": return .title1
+        case "title2": return .title2
+        case "title3": return .title3
+        case "headline": return .headline
+        case "subheadline": return .subheadline
+        case "callout": return .callout
+        case "footnote": return .footnote
+        case "caption": return .caption1
+        case "caption2": return .caption2
+        default: return .body
+        }
+    }
+    #else
+    private static func platformDesign(_ name: String) -> NSFontDescriptor.SystemDesign? {
+        switch name {
+        case "serif": return .serif
+        case "rounded": return .rounded
+        case "monospaced": return .monospaced
+        default: return nil
+        }
+    }
+
+    private static func textStyle(_ name: String) -> NSFont.TextStyle {
+        switch name {
+        case "largeTitle": return .largeTitle
+        case "title": return .title1
+        case "title2": return .title2
+        case "title3": return .title3
+        case "headline": return .headline
+        case "subheadline": return .subheadline
+        case "callout": return .callout
+        case "footnote": return .footnote
+        case "caption": return .caption1
+        case "caption2": return .caption2
+        default: return .body
+        }
+    }
+    #endif
+    #endif
+}
+#endif

package/swift/Sources/SwiftBrowserNative/Host/UndoBridge.swift

@@ -0,0 +1,170 @@
+#if canImport(SwiftUI) && !canImport(FoundationBridge)
+import Foundation
+import SwiftBrowserProtocol
+
+/// The app's undo manager (`useUndoManager` in @swiftbrowser/react,
+/// packages/native/src/undo.ts) on the window's `UndoManager`, so the
+/// system's undo reaches it: the shake and the three-finger swipe on iOS,
+/// ⌘Z and ⇧⌘Z from a keyboard, the Edit menu on macOS. The JavaScript stack
+/// is the truth (its closures are JavaScript, and `canUndo` must change in
+/// the pass that registered them); the window's manager mirrors it. Each
+/// `undoState(json)` (`canUndo`, `canRedo`, `undoActionName`,
+/// `redoActionName`) rebuilds the mirror: one proxy action on the undo
+/// stack when the app can undo and one on the redo stack when it can redo,
+/// named as the app names them, each sending `__sbUndoCommand("undo" |
+/// "redo")` when the system runs it. The redo stack is reached the only
+/// way `UndoManager` allows, from inside an undo: on the turn after the
+/// undo proxy's (whose event group the run loop has closed by then), a
+/// no-op is registered and undone at once, and the proxy it registers
+/// while undoing lands on the redo stack. A proxy the system runs calls
+/// into the app, whose new state arrives while the manager is still
+/// undoing, so the mirror is rebuilt on the next turn of the run loop.
+///
+/// Against the shim (the round trip) the page's keyboard is the host and
+/// this file is empty.
+@MainActor
+final class UndoBridge {
+    struct State: Equatable {
+        var canUndo = false
+        var canRedo = false
+        var undoActionName = ""
+        var redoActionName = ""
+    }
+
+    private let send: (String) -> Void
+    private(set) var state = State()
+    /// What the mirror does, for the tests (nil: nothing is traced).
+    nonisolated(unsafe) static var trace: (@MainActor (String) -> Void)?
+    /// Whether a proxy is running the app's undo or redo: the state it sends back is mirrored afterwards.
+    private var applying = false
+    /// The window's manager, from the root view's environment.
+    weak var manager: UndoManager? {
+        didSet {
+            if manager !== oldValue {
+                if let oldValue {
+                    oldValue.removeAllActions(withTarget: self)
+                    // A proxy registered this turn sits in an event group still
+                    // open, out of `removeAllActions`'s reach until the turn ends.
+                    DispatchQueue.main.async { [weak self] in
+                        MainActor.assumeIsolated { if let self { oldValue.removeAllActions(withTarget: self) } }
+                    }
+                }
+                mirror()
+            }
+        }
+    }
+
+    /// `send` hands the system's `undo` or `redo` to the app.
+    init(send: @escaping (String) -> Void) {
+        self.send = send
+    }
+
+    /// Applies one state; the message of what was wrong with it, or nil.
+    func update(_ json: String) -> String? {
+        let parsed: JSONValue
+        do {
+            parsed = try JSONValue.parse(json)
+        } catch {
+            return "undoState: \(error)"
+        }
+        guard let fields = parsed.object else { return "undoState: expected an object" }
+        state = State(
+            canUndo: fields.bool("canUndo") ?? false,
+            canRedo: fields.bool("canRedo") ?? false,
+            undoActionName: fields.string("undoActionName") ?? "",
+            redoActionName: fields.string("redoActionName") ?? ""
+        )
+        if !applying { mirror() }
+        return nil
+    }
+
+    /// Rebuilds the window's manager from `state`; while another group is open on it, on the next turn of the run loop.
+    private func mirror() {
+        guard let manager else { return }
+        guard manager.groupingLevel == 0 else {
+            afterTurn { $0.mirror() }
+            return
+        }
+        Self.trace?("mirror level=\(manager.groupingLevel) before: \(describe(manager)) state: \(state)")
+        manager.removeAllActions(withTarget: self)
+        Self.trace?("mirror after removeAllActions: \(describe(manager))")
+        // The undo proxy first: a registration made while not undoing clears
+        // the redo stack, so the redo proxy must be the last thing planted,
+        // and on the next turn: this turn's event group stays open around
+        // the undo proxy until the run loop ends it, and the no-op's
+        // `undo()` would close and undo it whole.
+        if state.canUndo {
+            manager.beginUndoGrouping()
+            registerProxy("undo", named: state.undoActionName)
+            manager.endUndoGrouping()
+        }
+        if state.canRedo { later { $0.plantRedo(attempts: 3) } }
+    }
+
+    /// The redo proxy, from inside the undo of a no-op: on a turn with no
+    /// group open (a later one while this one's event group is still open:
+    /// a block run in the same drain of the main queue as the registration
+    /// that opened it comes before the run loop's end of the turn).
+    private func plantRedo(attempts: Int) {
+        guard let manager else { return }
+        Self.trace?("plantRedo attempts=\(attempts) level=\(manager.groupingLevel) \(describe(manager)) state.canRedo=\(state.canRedo)")
+        guard state.canRedo, !manager.canRedo else { return }
+        guard manager.groupingLevel == 0 else {
+            if attempts > 0 { afterTurn { $0.plantRedo(attempts: attempts - 1) } }
+            return
+        }
+        manager.beginUndoGrouping()
+        manager.registerUndo(withTarget: self) { target in
+            MainActor.assumeIsolated { target.registerProxy("redo", named: target.state.redoActionName) }
+        }
+        manager.endUndoGrouping()
+        Self.trace?("plantRedo before undo(): \(describe(manager))")
+        manager.undo()
+        Self.trace?("plantRedo after undo(): \(describe(manager))")
+    }
+
+    private func describe(_ manager: UndoManager) -> String {
+        "undo=\(manager.canUndo)/\(manager.undoActionName) redo=\(manager.canRedo)/\(manager.redoActionName) undoing=\(manager.isUndoing) redoing=\(manager.isRedoing) level=\(manager.groupingLevel)"
+    }
+
+    /// Registers the proxy that sends `command`, on whichever stack the manager is filling.
+    private func registerProxy(_ command: String, named name: String) {
+        guard let manager else { return }
+        manager.registerUndo(withTarget: self) { target in
+            MainActor.assumeIsolated { target.perform(command) }
+        }
+        manager.setActionName(name)
+    }
+
+    /// The system ran a proxy: the app undoes or redoes, and the mirror follows once the manager is done.
+    private func perform(_ command: String) {
+        guard let manager else { return } // taken away: a proxy left in a group that was open then
+        Self.trace?("perform \(command): \(describe(manager))")
+        applying = true
+        send(command)
+        applying = false
+        // What the app can now do the other way, so the manager is right at once; the rebuild confirms it.
+        if command == "undo", state.canRedo { registerProxy("redo", named: state.redoActionName) }
+        if command == "redo", state.canUndo { registerProxy("undo", named: state.undoActionName) }
+        mirrorLater()
+    }
+
+    private func mirrorLater() {
+        later { $0.mirror() }
+    }
+
+    /// `body` on the next drain of the main queue, with this bridge.
+    private func later(_ body: @escaping @MainActor (UndoBridge) -> Void) {
+        DispatchQueue.main.async { [weak self] in
+            MainActor.assumeIsolated { if let self { body(self) } }
+        }
+    }
+
+    /// `body` a moment later, on a turn of the run loop after this one has ended (and closed its event group).
+    private func afterTurn(_ body: @escaping @MainActor (UndoBridge) -> Void) {
+        DispatchQueue.main.asyncAfter(deadline: .now() + .milliseconds(1)) { [weak self] in
+            MainActor.assumeIsolated { if let self { body(self) } }
+        }
+    }
+}
+#endif

package/swift/Sources/SwiftBrowserNative/Runtime/NativeApp.swift

@@ -40,6 +40,10 @@ public final class NativeApp {
     /// URLs the app was opened with before its script could take them (a
     /// universal link that launched it): delivered once it loads.
     private var pendingURLs: [URL] = []
+    #if !canImport(FoundationBridge)
+    /// The window's undo manager, kept across reloads.
+    private weak var undoManager: UndoManager?
+    #endif
 
     #if canImport(JavaScriptCore)
     public convenience init() {
@@ -57,6 +61,19 @@ public final class NativeApp {
                 body()
             }
         }
+        // `withAnimation(_:completionCriteria:_:completion:)`: SwiftUI calls the
+        // completion when the pass's animation ends; with no animation, right
+        // after the pass (the tree sends the event a turn later, off the
+        // pass's stack, as the app answers with a pass of its own).
+        tree.animateWithCompletion = { spec, completion, body, done in
+            guard let animation = spec.map(Animation.init(spec:)) else {
+                body()
+                done()
+                return
+            }
+            let criteria: AnimationCompletionCriteria = completion.criteria == "removed" ? .removed : .logicallyComplete
+            withAnimation(animation, completionCriteria: criteria, body, completion: done)
+        }
         tree.onEvent = { [weak self] event in self?.dispatch(event) }
         #if canImport(JavaScriptCore)
         (host as? JavaScriptCoreHost)?.onError = { [weak self] error in self?.error = error.description }
@@ -137,8 +154,21 @@ public final class NativeApp {
         try? tree.apply(tree.root.children.map { Op.remove(id: $0.id) } + [.commit(animation: nil)])
         host.reset()
         bridge = HostBridge(host: host, tree: tree)
+        #if !canImport(FoundationBridge)
+        bridge?.setUndoManager(undoManager)
+        #endif
     }
 
+    #if !canImport(FoundationBridge)
+    /// The window's `UndoManager` (`NativeRootView` reads it from the
+    /// environment): it mirrors the app's undo manager (UndoBridge.swift),
+    /// so the system's undo gestures, keys and menu reach the app.
+    public func setUndoManager(_ manager: UndoManager?) {
+        undoManager = manager
+        bridge?.setUndoManager(manager)
+    }
+    #endif
+
     /// Loads a bundled resource, `app.js` by default.
     public func load(resource: String = "app", extension ext: String = "js", bundle: Bundle = .main) {
         guard let url = bundle.url(forResource: resource, withExtension: ext) else {