@swiftbrowser/native 0.19.0 → 0.23.0

package/swift/Sources/SwiftBrowserNative/Host/FilesBridge.swift

@@ -49,6 +49,14 @@ struct FilesBridge: Sendable {
         return roots
     }
 
+    /// Whether `url` is in one of the app's directories, or a file the viewer picked or dropped (PickedFiles),
+    /// which the app may read and copy in (`readRange`, `importItem`, `attributes`) but not write.
+    private func readable(_ url: URL) -> Bool {
+        let path = url.path
+        if roots.contains(where: { path == $0.path || path.hasPrefix($0.path + "/") }) { return true }
+        return PickedFiles.shared.contains(url)
+    }
+
     /// Runs `body` on `url` under file coordination when the URL is in the iCloud container, else as it is.
     private func coordinated<T>(_ url: URL, writing: NSFileCoordinator.WritingOptions?, _ body: (URL) throws -> T) throws -> T {
         guard ICloudContainer.shared.contains(url) else { return try body(url) }
@@ -84,20 +92,43 @@ struct FilesBridge: Sendable {
         throw HostRequestFailure("unavailable: \(url.absoluteString) did not download from iCloud Drive")
     }
 
-    /// The file URL `params[key]` names, under today's container, inside the app's directories.
-    private func url(_ params: JSONObject, _ key: String) throws -> URL {
+    /// The file URL `params[key]` names, under today's container, inside the app's directories (or, `reading`, a picked file's).
+    private func url(_ params: JSONObject, _ key: String, reading: Bool = false) throws -> URL {
         guard let string = params[key]?.string, let parsed = URL(string: string) else {
             throw HostRequestFailure("unsupported: files: \(key) is not a URL")
         }
         guard parsed.isFileURL else { throw HostRequestFailure("unsupported: \(string) is not a file URL") }
         let url = AppFiles.current(parsed).standardizedFileURL
         let path = url.path
-        guard roots.contains(where: { path == $0.path || path.hasPrefix($0.path + "/") }) else {
+        let inApp = roots.contains(where: { path == $0.path || path.hasPrefix($0.path + "/") })
+        guard inApp || (reading && readable(url)) else {
             throw HostRequestFailure("unsupported: \(string) is not in the app's directories")
         }
         return url
     }
 
+    /// The file URL `string` names when the app may read it (in its directories, or picked or dropped); nil otherwise. For a body streamed from disk (BodyStream.swift).
+    static func readableURL(_ string: String) -> URL? {
+        let bridge = FilesBridge()
+        guard let parsed = URL(string: string), parsed.isFileURL else { return nil }
+        let url = AppFiles.current(parsed).standardizedFileURL
+        return bridge.readable(url) ? url : nil
+    }
+
+    /// The file's bytes from `start` up to `end` (clamped), through a `FileHandle`, so a large file is read a piece at a time.
+    private func readRange(_ url: URL, start: Int, end: Int?) throws -> Data {
+        try coordinated(url, writing: nil) { target in
+            let handle = try FileHandle(forReadingFrom: target)
+            defer { try? handle.close() }
+            let size = try handle.seekToEnd()
+            let from = min(UInt64(max(0, start)), size)
+            let to = min(end.map { UInt64(max(0, $0)) } ?? size, size)
+            guard from < to else { return Data() }
+            try handle.seek(toOffset: from)
+            return try handle.read(upToCount: Int(to - from)) ?? Data()
+        }
+    }
+
     private func isDirectory(_ url: URL) -> Bool? {
         var directory: ObjCBool = false
         if manager.fileExists(atPath: url.path, isDirectory: &directory) { return directory.boolValue }
@@ -128,15 +159,47 @@ struct FilesBridge: Sendable {
             try await ensureDownloaded(url)
             return .object(["url": .string(url.absoluteString)])
         case "read":
-            let url = try url(params, "url")
+            let url = try url(params, "url", reading: true)
             switch isDirectory(url) {
             case nil: throw HostRequestFailure("notFound: no file at \(url.absoluteString)")
             case true?: throw HostRequestFailure("isDirectory: \(url.absoluteString) is a directory")
             case false?: break
             }
             try await ensureDownloaded(url)
-            let data = try coordinated(url, writing: nil) { try Data(contentsOf: $0) }
+            let data = try PickedFiles.shared.accessing(url) { try coordinated(url, writing: nil) { try Data(contentsOf: $0) } }
             return .object(["data": RequestBytes.value(data)])
+        case "readRange":
+            // `fileManager.contents(url, { start, end })`: a piece of the file, `FileHandle`'s seek and read.
+            let url = try url(params, "url", reading: true)
+            switch isDirectory(url) {
+            case nil: throw HostRequestFailure("notFound: no file at \(url.absoluteString)")
+            case true?: throw HostRequestFailure("isDirectory: \(url.absoluteString) is a directory")
+            case false?: break
+            }
+            try await ensureDownloaded(url)
+            let start = params["start"]?.int ?? Int(params["start"]?.double ?? 0)
+            let end = params["end"]?.int ?? params["end"]?.double.map { Int($0) }
+            let data = try PickedFiles.shared.accessing(url) { try readRange(url, start: start, end: end) }
+            return .object(["data": RequestBytes.value(data)])
+        case "importItem":
+            // `fileManager.write(url, pickedFile)`: the picked file copied on disk into the app's directories, no bytes across the bridge.
+            let from = try url(params, "from", reading: true)
+            let to = try url(params, "to")
+            guard isDirectory(from) == false else { throw HostRequestFailure("notFound: no file at \(from.absoluteString)") }
+            if isDirectory(to) == true { throw HostRequestFailure("isDirectory: \(to.absoluteString) is a directory") }
+            try requireDirectory(to.deletingLastPathComponent(), for: to)
+            try await ensureDownloaded(from)
+            try PickedFiles.shared.accessing(from) {
+                try coordinated(to, writing: .forReplacing) { target in
+                    if manager.fileExists(atPath: target.path) { try manager.removeItem(at: target) }
+                    try manager.copyItem(at: from, to: target)
+                }
+            }
+            return .object([:])
+        case "release":
+            // The app is done with what it picked: the folder's security scope ends and the copies in tmp go.
+            PickedFiles.shared.release(params["urls"]?.array?.compactMap { $0.string.flatMap(URL.init(string:)) })
+            return .object([:])
         case "write":
             let url = try url(params, "url")
             guard let data = RequestBytes.data(params["data"]) else {
@@ -169,9 +232,9 @@ struct FilesBridge: Sendable {
             }).sorted { $0.localizedStandardCompare($1) == .orderedAscending }
             return .object(["urls": .array(names.map { .string(url.appendingPathComponent($0).absoluteString) })])
         case "attributes":
-            let url = try url(params, "url")
+            let url = try url(params, "url", reading: true)
             guard let directory = isDirectory(url) else { return .null }
-            let attributes = try manager.attributesOfItem(atPath: url.path)
+            let attributes = try PickedFiles.shared.accessing(url) { try manager.attributesOfItem(atPath: url.path) }
             let size = directory ? 0 : ((attributes[.size] as? NSNumber)?.doubleValue ?? 0)
             let modified = (attributes[.modificationDate] as? Date).map { JSONValue.number(($0.timeIntervalSince1970 * 1000).rounded()) } ?? .null
             let created = (attributes[.creationDate] as? Date).map { JSONValue.number(($0.timeIntervalSince1970 * 1000).rounded()) } ?? .null
@@ -203,6 +266,77 @@ struct FilesBridge: Sendable {
 
 #endif
 
+#if !canImport(FoundationBridge)
+/// The files and folders the viewer picked (`pickFiles`) or dropped: the page
+/// gets their URLs and sizes, not their bytes, and reads them through the
+/// files bridge (`readRange`, `importItem`) while they are registered here.
+/// A folder opened in place keeps its security scope until the app releases
+/// it (`files` `release`) or picks again; copies the pickers made in tmp are
+/// deleted then too.
+final class PickedFiles: @unchecked Sendable {
+    static let shared = PickedFiles()
+
+    private let lock = NSLock()
+    /// Files the app may read, by standardized path; the scoped folders they came from, if any.
+    private var files: [String: URL] = [:]
+    private var scopedFolders: [URL] = []
+    /// Folders in tmp the pickers copied into, removed on release.
+    private var temporaryFolders: [URL] = []
+
+    /// Registers files the app may read: `scoped` is a folder whose security scope is open (stopped on release).
+    func register(_ urls: [URL], scoped folder: URL? = nil, temporary: URL? = nil) {
+        lock.lock()
+        defer { lock.unlock() }
+        for url in urls { files[url.standardizedFileURL.path] = url }
+        if let folder { scopedFolders.append(folder) }
+        if let temporary { temporaryFolders.append(temporary) }
+    }
+
+    func contains(_ url: URL) -> Bool {
+        lock.lock()
+        defer { lock.unlock() }
+        let path = url.standardizedFileURL.path
+        if files[path] != nil { return true }
+        return scopedFolders.contains { path.hasPrefix($0.standardizedFileURL.path + "/") }
+    }
+
+    /// Runs `body` with the folder's security scope open where `url` is in a scoped folder.
+    func accessing<T>(_ url: URL, _ body: () throws -> T) rethrows -> T {
+        let stop = beginAccessing(url)
+        defer { stop?() }
+        return try body()
+    }
+
+    /// Opens the security scope of the folder `url` is in, if any, until the closure answered is called (a stream reading over time).
+    func beginAccessing(_ url: URL) -> (() -> Void)? {
+        lock.lock()
+        let path = url.standardizedFileURL.path
+        let folder = scopedFolders.first { path.hasPrefix($0.standardizedFileURL.path + "/") }
+        lock.unlock()
+        guard let folder, folder.startAccessingSecurityScopedResource() else { return nil }
+        return { folder.stopAccessingSecurityScopedResource() }
+    }
+
+    /// Forgets the given files (all of them when nil), ending scopes and deleting the pickers' copies no file still names.
+    func release(_ urls: [URL]?) {
+        lock.lock()
+        if let urls {
+            for url in urls { files[url.standardizedFileURL.path] = nil }
+        } else {
+            files.removeAll()
+        }
+        let stillNamed = Set(files.values.map { $0.standardizedFileURL.path })
+        let doneFolders = scopedFolders.filter { folder in !stillNamed.contains { $0.hasPrefix(folder.standardizedFileURL.path + "/") } }
+        scopedFolders.removeAll { doneFolders.contains($0) }
+        let doneTemporary = temporaryFolders.filter { folder in !stillNamed.contains { $0.hasPrefix(folder.standardizedFileURL.path + "/") } }
+        temporaryFolders.removeAll { doneTemporary.contains($0) }
+        lock.unlock()
+        for folder in doneFolders { folder.stopAccessingSecurityScopedResource() }
+        for folder in doneTemporary { try? FileManager.default.removeItem(at: folder) }
+    }
+}
+#endif
+
 /// Files the app keeps (a recording's, `fileManager`'s) are named by their
 /// URL, and iOS moves an app's container when it is installed again: a file
 /// URL into an old `Documents` that is not there anymore is the same path

package/swift/Sources/SwiftBrowserNative/Host/HostBridge.swift

@@ -29,6 +29,8 @@ import IOKit.pwr_mgt
 /// | `setTimer(id, delayMs, repeats)`, `clearTimer(id)` | timers on the main run loop; fire `__sbTimerFired(id)` |
 /// | `hostRequestBytes(id, kind, json, ...views)` | `hostRequest` with typed arrays beside the JSON, which names each as `{ "$bytes": n }` (docs/notes/bytes.md); only where the engine carries bytes (JavaScriptCore), and an answer's bytes follow `__sbHostResponse`'s JSON the same way |
 /// | `fetch(id, requestJSON, ...views)` | `URLSession`; answers `__sbFetchResult(id, resultJSON, ...bytes)`: a body as a typed array beside the JSON where the engine carries bytes and the request says `bytes: true`, else base64 |
+/// | `fetchCancel(id)` | cancels the request's task (an `AbortController`'s abort); it answers nothing |
+/// | `fetchStreams()` | true: `fetch` takes `bodyParts`, typed arrays beside the request and ranges of files on disk, streamed in order (BodyStream.swift) |
 /// | `probeImage(id, url)` | the image's pixel size through the image loader (ImageLoader.swift), which keeps the bytes for the `image` that follows; answers `__sbImageProbed(id, {width, height} or {error})`. The runtime's `Image` (a page's `new Image()`). Apple platforms only |
 /// | `storageGet/Set/Remove/Keys/Clear` | `localStorage` over `UserDefaults` |
 /// | `randomBytes(count)` | base64 of random bytes (`crypto.getRandomValues`) |
@@ -65,7 +67,15 @@ final class HostBridge {
     private var workers: [Int: any WorkerEngine] = [:]
     #endif
     private let logger = Logger(subsystem: "swiftbrowser", category: "js")
+    #if canImport(FoundationBridge)
     private let session = URLSession(configuration: .default)
+    #else
+    /// Streamed bodies are rebuilt from their parts when a redirect or a challenge asks for the body again (`needNewBodyStream`).
+    private let bodyStreams = BodyStreams()
+    private lazy var session = URLSession(configuration: .default, delegate: bodyStreams, delegateQueue: nil)
+    #endif
+    /// The requests under way, by id, for `fetchCancel`.
+    private var fetchTasks: [Int: URLSessionDataTask] = [:]
     #if canImport(MediaPlayer)
     private var nowPlaying: NowPlayingBridge?
     #endif
@@ -204,6 +214,18 @@ final class HostBridge {
             return nil
         }
 
+        // An `AbortController`'s abort: the task is cancelled and answers nothing.
+        host.install("fetchCancel") { [weak self] arguments in
+            guard let self, let id = arguments[safe: 0]?.int else { return nil }
+            self.fetchTasks.removeValue(forKey: id)?.cancel()
+            return nil
+        }
+
+        #if !canImport(FoundationBridge)
+        // A body as parts (`bodyParts`): typed arrays beside the request and ranges of files on disk, streamed in order.
+        host.install("fetchStreams") { _ in .bool(true) }
+        #endif
+
         #if !canImport(FoundationBridge)
         host.install("probeImage") { [weak self] arguments in
             guard let self, let id = arguments[safe: 0]?.int, let string = arguments[safe: 1]?.string else { return nil }
@@ -680,7 +702,9 @@ final class HostBridge {
     // MARK: fetch
 
     /// `{ url, method, headers: {name: value}, body, bytes }` in, the body
-    /// base64 or `{ "$bytes": 0 }` naming a view in `bytes`;
+    /// base64 or `{ "$bytes": 0 }` naming a view in `bytes`, or `bodyParts`
+    /// (`fetchStreams`): views and ranges of files on disk, streamed in
+    /// order without reading the files into memory;
     /// `{ status, statusText, headers, url, body }` or `{ error }` out, the
     /// body base64, or a `Uint8Array` after the JSON where the request said
     /// `bytes: true` (docs/notes/bytes.md).
@@ -697,8 +721,25 @@ final class HostBridge {
         if let data = request["body"].bytes(from: bytes) {
             urlRequest.httpBody = data
         }
+        #if !canImport(FoundationBridge)
+        var streamedParts: [BodyPart]?
+        if let parts = request["bodyParts"].array {
+            do {
+                streamedParts = try parts.map { try BodyPart(part: $0, bytes: bytes) }
+            } catch {
+                callIn("__sbFetchResult", [.number(Double(id)), .object(["error": .string(error.localizedDescription)])])
+                return
+            }
+            urlRequest.httpBodyStream = PartsInputStream(parts: streamedParts!)
+            if urlRequest.value(forHTTPHeaderField: "Content-Length") == nil {
+                urlRequest.setValue(String(streamedParts!.reduce(0) { $0 + $1.length }), forHTTPHeaderField: "Content-Length")
+            }
+        }
+        #endif
         let answersBytes = host.carriesBytes && request["bytes"].bool == true
         let task = session.dataTask(with: urlRequest) { [weak self] data, response, error in
+            // Cancelled (`fetchCancel`): the app rejected its promise already and hears nothing more.
+            if let error, (error as NSError).code == NSURLErrorCancelled, (error as NSError).domain == NSURLErrorDomain { return }
             let result: JSONValue
             if let error {
                 result = .object(["error": .string(error.localizedDescription)])
@@ -719,10 +760,15 @@ final class HostBridge {
             let body = error == nil && answersBytes ? [HostValue.bytes(HostBytes(data ?? Data(), kind: .uint8))] : []
             DispatchQueue.main.async { [weak self] in
                 MainActor.assumeIsolated {
+                    self?.fetchTasks.removeValue(forKey: id)
                     self?.callIn("__sbFetchResult", values: [.json(.number(Double(id))), .json(result)] + body)
                 }
             }
         }
+        fetchTasks[id] = task
+        #if !canImport(FoundationBridge)
+        if let streamedParts { bodyStreams.register(task, parts: streamedParts) }
+        #endif
         task.resume()
     }
 }

package/swift/Sources/SwiftBrowserNative/Host/HostRequestBridge.swift

@@ -28,7 +28,8 @@ import UniformTypeIdentifiers
 /// are the web renderer's (docs/ops-protocol.md): `share` (`title`, `text`,
 /// `url`, `files`: a share sheet; `{ outcome }`), `pickFiles` (`accept`,
 /// `multiple`: the photo picker for pictures and videos, else the document
-/// picker; `{ files: [{ name, type, data }] }`), `clipboard` (`write` with
+/// picker, or with `public.folder` a folder's files, named by their paths in
+/// it; `{ files: [{ name, type, data }] }`), `clipboard` (`write` with
 /// `text` or `files`, `readText`; `{ text }`), `pickColor` (`color`: the
 /// color picker; `{ color }`), `webAuth` (`url`, `callbackScheme`,
 /// `ephemeral`: `ASWebAuthenticationSession`; `{ url }`) and, on iOS,
@@ -128,6 +129,13 @@ final class HostRequestBridge {
             let value = try await files.handle(params)
             // The container resolved: from now on its changes reach the app.
             if params["action"]?.string == "iCloud", value != .null, iCloud == nil { iCloud = ICloudWatcher(send: filesChanged) }
+            // What the app itself wrote, made, moved or removed: `fileManager.watch` hears it, as the page's host tells its watchers.
+            switch params["action"]?.string {
+            case "write", "remove", "createDirectory": if let url = params["url"]?.string { filesChanged([url]) }
+            case "move", "copy": filesChanged([params["from"]?.string, params["to"]?.string].compactMap { $0 })
+            case "importItem": if let url = params["to"]?.string { filesChanged([url]) }
+            default: break
+            }
             return value
         #endif
         #if canImport(AuthenticationServices) && !canImport(FoundationBridge)
@@ -202,9 +210,14 @@ final class HostRequestBridge {
         let folder = FileManager.default.temporaryDirectory.appendingPathComponent("swiftbrowser-share-\(UUID().uuidString)", isDirectory: true)
         try FileManager.default.createDirectory(at: folder, withIntermediateDirectories: true)
         return try files.compactMap { file -> URL? in
-            guard let data = RequestBytes.data(file["data"]) else { return nil }
             let name = file["name"].string.flatMap { $0.isEmpty ? nil : $0 } ?? "file"
             let url = folder.appendingPathComponent(name.components(separatedBy: "/").last ?? name)
+            // A picked file still on disk (its `url`) is copied; bytes are written.
+            if let source = file["url"].string.flatMap(URL.init(string:)), source.isFileURL, PickedFiles.shared.contains(source) {
+                try PickedFiles.shared.accessing(source) { try FileManager.default.copyItem(at: source, to: url) }
+                return url
+            }
+            guard let data = RequestBytes.data(file["data"]) else { return nil }
             try data.write(to: url)
             return url
         }
@@ -214,8 +227,43 @@ final class HostRequestBridge {
         UTType(filenameExtension: url.pathExtension)?.preferredMIMEType ?? "application/octet-stream"
     }
 
-    private static func fileValue(name: String, type: String, data: Data) -> JSONValue {
-        .object(["name": .string(name), "type": .string(type), "data": RequestBytes.value(data)])
+    /// A file still on disk, as the page's `LazyFile` reads it: its URL and size, no bytes (docs/notes/bytes.md).
+    static func fileReference(name: String, url: URL) -> JSONValue {
+        let values = try? url.resourceValues(forKeys: [.fileSizeKey, .contentModificationDateKey])
+        var value: JSONObject = [
+            "name": .string(name),
+            "type": .string(mimeType(of: url)),
+            "url": .string(url.standardizedFileURL.absoluteString),
+            "size": .number(Double(values?.fileSize ?? 0)),
+        ]
+        if let modified = values?.contentModificationDate { value["lastModified"] = .number((modified.timeIntervalSince1970 * 1000).rounded()) }
+        return .object(value)
+    }
+
+    /// A chosen folder's files, at any depth, that `types` allow (any when none), each named by its path from the
+    /// folder, the folder's own name first (`Bank/Leads/Saw.fxp`), as the page's folder chooser names them. The
+    /// files stay on disk: the folder's security scope is kept open (PickedFiles) and the page reads what it needs.
+    static func folderFiles(_ folder: URL, types: [UTType]) -> [JSONValue] {
+        let scoped = folder.startAccessingSecurityScopedResource()
+        defer { if scoped { folder.stopAccessingSecurityScopedResource() } }
+        let root = folder.resolvingSymlinksInPath().standardizedFileURL.pathComponents
+        guard let walker = FileManager.default.enumerator(at: folder, includingPropertiesForKeys: [.isRegularFileKey, .fileSizeKey], options: [.skipsHiddenFiles, .skipsPackageDescendants]) else { return [] }
+        var files: [JSONValue] = []
+        var urls: [URL] = []
+        for case let url as URL in walker {
+            guard (try? url.resourceValues(forKeys: [.isRegularFileKey]))?.isRegularFile == true else { continue }
+            if !types.isEmpty {
+                guard let type = UTType(filenameExtension: url.pathExtension), types.contains(where: { type.conforms(to: $0) }) else { continue }
+            }
+            let components = url.resolvingSymlinksInPath().standardizedFileURL.pathComponents
+            guard components.count > root.count, Array(components.prefix(root.count)) == root else { continue }
+            let path = ([folder.lastPathComponent] + components.dropFirst(root.count)).joined(separator: "/")
+            files.append(fileReference(name: path, url: url))
+            urls.append(url)
+        }
+        // Scoped again for as long as the app reads the files: `accessing` opens it per read, `release` ends it.
+        PickedFiles.shared.register(urls, scoped: scoped ? folder : nil)
+        return files
     }
 
     #if canImport(UIKit)
@@ -285,16 +333,18 @@ final class HostRequestBridge {
                 continuation.resume(returning: urls)
             }
             keep(delegate)
-            let picker = UIDocumentPickerViewController(forOpeningContentTypes: accept.types.isEmpty ? [.item] : accept.types, asCopy: true)
-            picker.allowsMultipleSelection = multiple
+            // A folder is opened in place (a folder cannot be copied in), its files read while its scope is open.
+            let picker = accept.folder
+                ? UIDocumentPickerViewController(forOpeningContentTypes: [.folder], asCopy: false)
+                : UIDocumentPickerViewController(forOpeningContentTypes: accept.types.isEmpty ? [.item] : accept.types, asCopy: true)
+            picker.allowsMultipleSelection = multiple && !accept.folder
             picker.delegate = delegate
             presenter.present(picker, animated: true)
         }
-        let files = urls.compactMap { url -> JSONValue? in
-            guard let data = try? Data(contentsOf: url) else { return nil }
-            return Self.fileValue(name: url.lastPathComponent, type: Self.mimeType(of: url), data: data)
-        }
-        return .object(["files": .array(files)])
+        if accept.folder { return .object(["files": .array(urls.first.map { Self.folderFiles($0, types: accept.types) } ?? [])]) }
+        // Copied into the app's tmp by the picker (`asCopy: true`): the page gets their URLs and reads them a piece at a time.
+        PickedFiles.shared.register(urls)
+        return .object(["files": .array(urls.map { Self.fileReference(name: $0.lastPathComponent, url: $0) })])
     }
 
     /// `fileExporter`: the files are written to the temporary directory and the
@@ -366,16 +416,15 @@ final class HostRequestBridge {
     private func pickFiles(_ params: JSONObject) async throws -> JSONValue {
         let accept = Self.parseAccept(params["accept"]?.string ?? "")
         let panel = NSOpenPanel()
-        panel.allowsMultipleSelection = params["multiple"]?.bool ?? false
-        panel.canChooseDirectories = false
-        if !accept.types.isEmpty { panel.allowedContentTypes = accept.types }
+        panel.allowsMultipleSelection = !accept.folder && (params["multiple"]?.bool ?? false)
+        panel.canChooseDirectories = accept.folder
+        panel.canChooseFiles = !accept.folder
+        if !accept.folder, !accept.types.isEmpty { panel.allowedContentTypes = accept.types }
         let response = await panel.begin()
         guard response == .OK else { return .object(["files": .array([])]) }
-        let files = panel.urls.compactMap { url -> JSONValue? in
-            guard let data = try? Data(contentsOf: url) else { return nil }
-            return Self.fileValue(name: url.lastPathComponent, type: Self.mimeType(of: url), data: data)
-        }
-        return .object(["files": .array(files)])
+        if accept.folder { return .object(["files": .array(panel.urls.first.map { Self.folderFiles($0, types: accept.types) } ?? [])]) }
+        PickedFiles.shared.register(panel.urls)
+        return .object(["files": .array(panel.urls.map { Self.fileReference(name: $0.lastPathComponent, url: $0) })])
     }
 
     /// `fileExporter`: a save panel per file; answers `{ outcome: "saved", urls }`, or `cancelled` at the first panel dismissed.
@@ -421,12 +470,15 @@ final class HostRequestBridge {
     }
     #endif
 
-    /// What a chooser's `accept` asks for: the content types, and whether they are all pictures or videos (the photo library's).
-    static func parseAccept(_ accept: String) -> (types: [UTType], photos: Bool, images: Bool, videos: Bool) {
-        let entries = accept.split(separator: ",").map { $0.trimmingCharacters(in: .whitespaces) }.filter { !$0.isEmpty }
+    /// What a chooser's `accept` asks for: the content types, and whether they are all pictures or videos (the
+    /// photo library's), or a folder (`public.folder`, `UTType.folder`), its files then those the other types allow.
+    static func parseAccept(_ accept: String) -> (types: [UTType], photos: Bool, images: Bool, videos: Bool, folder: Bool) {
+        var entries = accept.split(separator: ",").map { $0.trimmingCharacters(in: .whitespaces) }.filter { !$0.isEmpty }
+        let folder = entries.contains(UTType.folder.identifier)
+        entries.removeAll { $0 == UTType.folder.identifier }
         let images = entries.contains { $0.hasPrefix("image/") }
         let videos = entries.contains { $0.hasPrefix("video/") }
-        let photos = !entries.isEmpty && entries.allSatisfy { $0.hasPrefix("image/") || $0.hasPrefix("video/") }
+        let photos = !folder && !entries.isEmpty && entries.allSatisfy { $0.hasPrefix("image/") || $0.hasPrefix("video/") }
         let types = entries.compactMap { entry -> UTType? in
             if entry.hasPrefix(".") { return UTType(filenameExtension: String(entry.dropFirst())) }
             switch entry {
@@ -436,7 +488,7 @@ final class HostRequestBridge {
             default: return UTType(mimeType: entry)
             }
         }
-        return (types, photos, images, videos)
+        return (types, photos, images, videos, folder)
     }
 
     /// A picked photo or video as a file: its first picture (or movie) representation, named after the item.
@@ -446,14 +498,31 @@ final class HostRequestBridge {
             ?? identifiers.first(where: { UTType($0)?.conforms(to: .movie) == true })
             ?? identifiers.first else { return nil }
         let type = UTType(identifier)
-        let data: Data? = await withCheckedContinuation { continuation in
-            _ = provider.loadDataRepresentation(forTypeIdentifier: identifier) { data, _ in continuation.resume(returning: data) }
-        }
-        guard let data else { return nil }
         let ext = type?.preferredFilenameExtension ?? "bin"
         let suggested = provider.suggestedName ?? "photo"
         let name = suggested.contains(".") ? suggested : "\(suggested).\(ext)"
-        return fileValue(name: name, type: type?.preferredMIMEType ?? "application/octet-stream", data: data)
+        // The file the library hands over lives only while the completion runs: copied into a tmp folder of
+        // its own, registered (PickedFiles) and answered as a reference, so the page reads it a piece at a time.
+        let folder = FileManager.default.temporaryDirectory.appendingPathComponent("swiftbrowser-picks-\(UUID().uuidString)", isDirectory: true)
+        let copied: URL? = await withCheckedContinuation { continuation in
+            _ = provider.loadFileRepresentation(forTypeIdentifier: identifier) { url, _ in
+                guard let url else {
+                    continuation.resume(returning: nil)
+                    return
+                }
+                do {
+                    try FileManager.default.createDirectory(at: folder, withIntermediateDirectories: true)
+                    let target = folder.appendingPathComponent(name)
+                    try FileManager.default.copyItem(at: url, to: target)
+                    continuation.resume(returning: target)
+                } catch {
+                    continuation.resume(returning: nil)
+                }
+            }
+        }
+        guard let copied else { return nil }
+        PickedFiles.shared.register([copied], temporary: folder)
+        return fileReference(name: name, url: copied)
     }
     #endif
 }

package/swift/Sources/SwiftBrowserNative/Runtime/NativeFunctions.swift

@@ -35,7 +35,7 @@ public struct NativeFunctionError: Error, CustomStringConvertible {
 }
 
 /// Swift the app's JavaScript can call: the function half of the escape hatch
-/// (docs/native.md; `NativeRegistry` is the view half). The Swift app
+/// (docs/native.md; `ViewRegistry` is the view half). The Swift app
 /// registers functions once, before the app loads, and `@swiftbrowser/native`
 /// calls them: `callNative(name, params)` resolves with what an async function
 /// returns, through the host request `app:<name>` (HostRequestBridge.swift);

package/swift/Sources/SwiftBrowserNative/Runtime/ViewRegistry.swift

@@ -0,0 +1,57 @@
+#if canImport(SwiftUI)
+import Foundation
+import SwiftBrowserProtocol
+import SwiftBrowserTree
+import SwiftUI
+
+/// A view a package or the app draws itself, by name: the `registered`
+/// element kind (docs/native.md), which `RegisteredView` in
+/// @swiftbrowser/react emits. A page registers its own element under the
+/// same name (@swiftbrowser/web's `ViewRegistry`), so one component is a
+/// SwiftUI view here and the package's DOM there, drawing what never crosses
+/// the bridge (an audio node's frames, a map's tiles).
+///
+/// ```swift
+/// ViewRegistry.register("MapView") { context in
+///     MapView(region: context.props["region"]) { context.send(["tapped": true]) }
+/// }
+/// ```
+///
+/// ```tsx
+/// <RegisteredView name="MapView" props={{ region }} onEvent={(value) => …} />
+/// ```
+@MainActor
+public enum ViewRegistry {
+    /// What a registered view gets: the element's `props` as the app wrote
+    /// them, its children (SwiftUI views the app put inside it) and a way to
+    /// send a value back, which reaches the element's `onEvent` in JavaScript.
+    public struct Context {
+        public let id: Int
+        public let props: JSONValue
+        public let children: [ElementNode]
+        public let send: (JSONValue) -> Void
+
+        /// The children as a view (built on the main actor, as views are).
+        @MainActor public var content: some View {
+            ForEach(children) { ElementView(node: $0) }
+        }
+    }
+
+    public typealias Builder = (Context) -> AnyView
+    private static var builders: [String: Builder] = [:]
+
+    public static func register<V: View>(_ name: String, @ViewBuilder _ builder: @escaping (Context) -> V) {
+        builders[name] = { AnyView(builder($0)) }
+    }
+
+    public static func unregister(_ name: String) {
+        builders[name] = nil
+    }
+
+    public static func isRegistered(_ name: String) -> Bool { builders[name] != nil }
+
+    static func view(name: String, context: Context) -> AnyView? {
+        builders[name]?(context)
+    }
+}
+#endif

package/swift/Sources/SwiftBrowserNative/Views/ElementView.swift

@@ -89,8 +89,12 @@ struct ElementView: View {
         // Shapes and colors
         case "color": return AnyView(ColorElement(node: node))
         case "shape": return ShapeElement(node: node).reportingSize(of: node)
+        case "canvas": return AnyView(CanvasElement(node: node))
+        case "layout": return AnyView(LayoutElement(node: node))
+        case "draggable": return AnyView(DraggableElement(node: node))
+        case "dropdestination": return AnyView(DropDestinationElement(node: node))
         // The escape hatch
-        case "native": return AnyView(NativeElement(node: node))
+        case "registered": return AnyView(RegisteredElement(node: node))
         default: return AnyView(UnsupportedElement(node: node))
         }
     }
@@ -131,18 +135,18 @@ struct UnsupportedElement: View {
     }
 }
 
-/// The `native` kind: a view the Swift app registered under `name`.
-struct NativeElement: View {
+/// The `registered` kind: a view registered under `name` (`ViewRegistry`).
+struct RegisteredElement: View {
     let node: ElementNode
     @Environment(\.nativeApp) private var app
 
     var body: some View {
-        let props = NativeProps(props: node.props)
+        let props = RegisteredProps(props: node.props)
         let app = app
-        let context = NativeViewContext(id: node.id, props: props.props, children: node.children) { value in
-            app?.dispatch(.native(node.id, name: props.name, value: value))
+        let context = ViewRegistry.Context(id: node.id, props: props.props, children: node.children) { value in
+            app?.dispatch(.registered(node.id, name: props.name, value: value))
         }
-        if let view = NativeRegistry.view(name: props.name, context: context) {
+        if let view = ViewRegistry.view(name: props.name, context: context) {
             view
         } else {
             UnsupportedElement(node: node)