typeferry 0.10.0 → 0.12.0

package/dist/native/templates/http-session.js

@@ -0,0 +1,117 @@
+/**
+ * Same-origin native transport, with a private cookie jar persisted in Keychain.
+ */
+export const HTTP_SESSION_SWIFT = String.raw `import Foundation
+
+final class TypeFerryHTTPSession: NSObject, URLSessionTaskDelegate {
+    let backendURL: URL
+    private let cookieAccount: String
+    private var session: URLSession!
+    private let cookieLock = NSLock()
+    private var generation = 0
+
+    init(backendURL: URL) throws {
+        self.backendURL = backendURL
+        cookieAccount = "cookies:" + backendURL.absoluteString
+        super.init()
+
+        let configuration = Self.makeConfiguration()
+        if let data = try TypeFerryKeychain.read(cookieAccount),
+           let rows = try PropertyListSerialization.propertyList(from: data, format: nil) as? [[String: Any]] {
+            for row in rows {
+                let properties = Dictionary(uniqueKeysWithValues: row.map { (HTTPCookiePropertyKey($0.key), $0.value) })
+                if let cookie = HTTPCookie(properties: properties),
+                   cookie.expiresDate.map({ $0 > Date() }) ?? true {
+                    configuration.httpCookieStorage?.setCookie(cookie)
+                }
+            }
+        }
+        session = URLSession(configuration: configuration, delegate: self, delegateQueue: nil)
+    }
+
+    func accepts(_ url: URL) -> Bool {
+        TypeFerryMediaPolicy.isTrusted(localURL: backendURL, requestURL: url, isMainFrame: true)
+    }
+
+    func request(_ request: URLRequest, completion: @escaping (Result<(Data, HTTPURLResponse), Error>) -> Void) {
+        guard let url = request.url, accepts(url) else { completion(.failure(Self.failure("Untrusted backend URL."))); return }
+        let (requestSession, requestGeneration) = snapshot()
+        requestSession.dataTask(with: request) { [weak self] data, response, error in
+            if let error = error { completion(.failure(error)); return }
+            guard let self = self, let response = response as? HTTPURLResponse, let data = data else {
+                completion(.failure(Self.failure("The backend returned no response."))); return
+            }
+            do {
+                try self.persistCookies(session: requestSession, generation: requestGeneration)
+                completion(.success((data, response)))
+            } catch { completion(.failure(error)) }
+        }.resume()
+    }
+
+    func download(_ request: URLRequest, completion: @escaping (Result<URL, Error>) -> Void) {
+        guard let url = request.url, accepts(url) else { completion(.failure(Self.failure("Untrusted download URL."))); return }
+        let (requestSession, requestGeneration) = snapshot()
+        requestSession.downloadTask(with: request) { [weak self] location, response, error in
+            if let error = error { completion(.failure(error)); return }
+            guard let self = self, let location = location, let response = response as? HTTPURLResponse,
+                  (200..<300).contains(response.statusCode) else {
+                completion(.failure(Self.failure("The download failed."))); return
+            }
+            do {
+                try self.persistCookies(session: requestSession, generation: requestGeneration)
+                let retained = FileManager.default.temporaryDirectory.appendingPathComponent(UUID().uuidString)
+                try FileManager.default.moveItem(at: location, to: retained)
+                completion(.success(retained))
+            } catch { completion(.failure(error)) }
+        }.resume()
+    }
+
+    func clearCookies() throws {
+        cookieLock.lock()
+        defer { cookieLock.unlock() }
+        let previous = session
+        generation += 1
+        // A fresh cookie jar prevents in-flight Set-Cookie from resurrecting logout.
+        session = URLSession(configuration: Self.makeConfiguration(), delegate: self, delegateQueue: nil)
+        previous?.invalidateAndCancel()
+        try TypeFerryKeychain.delete(cookieAccount)
+    }
+
+    func urlSession(_ session: URLSession, task: URLSessionTask, willPerformHTTPRedirection response: HTTPURLResponse,
+                    newRequest request: URLRequest, completionHandler: @escaping (URLRequest?) -> Void) {
+        guard let url = request.url, accepts(url) else { completionHandler(nil); return }
+        completionHandler(request)
+    }
+
+    private func snapshot() -> (URLSession, Int) {
+        cookieLock.lock()
+        defer { cookieLock.unlock() }
+        return (session, generation)
+    }
+
+    private static func makeConfiguration() -> URLSessionConfiguration {
+        let configuration = URLSessionConfiguration.ephemeral
+        configuration.httpShouldSetCookies = true
+        configuration.timeoutIntervalForRequest = 60
+        configuration.timeoutIntervalForResource = 300
+        return configuration
+    }
+
+    private func persistCookies(session: URLSession, generation: Int) throws {
+        cookieLock.lock()
+        defer { cookieLock.unlock() }
+        guard generation == self.generation else { throw Self.failure("The native session was cleared.") }
+        let rows = (session.configuration.httpCookieStorage?.cookies ?? []).compactMap { cookie -> [String: Any]? in
+            guard let properties = cookie.properties else { return nil }
+            return Dictionary(uniqueKeysWithValues: properties.map { ($0.key.rawValue, $0.value) })
+        }
+        let data = try PropertyListSerialization.data(fromPropertyList: rows, format: .binary, options: 0)
+        try TypeFerryKeychain.write(cookieAccount, data: data)
+    }
+
+    static func failure(_ message: String) -> NSError {
+        NSError(domain: "TypeFerryNative", code: 1, userInfo: [NSLocalizedDescriptionKey: message])
+    }
+}
+`;
+//# sourceMappingURL=http-session.js.map

package/dist/native/templates/http-session.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-session.js","sourceRoot":"","sources":["../../../src/native/templates/http-session.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,MAAM,CAAC,GAAG,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAgH3C,CAAA"}

package/dist/native/templates/index.d.ts

@@ -0,0 +1,4 @@
+/**
+ * Framework-owned Swift source files installed explicitly by the iOS scaffold.
+ */
+export declare const IOS_NATIVE_TEMPLATES: Readonly<Record<string, string>>;

package/dist/native/templates/index.js

@@ -0,0 +1,20 @@
+import { BRIDGE_VIEW_CONTROLLER_SWIFT } from './bridge-view-controller.js';
+import { FILE_STAGING_SWIFT } from './file-staging.js';
+import { HTTP_SESSION_SWIFT } from './http-session.js';
+import { KEYCHAIN_SWIFT } from './keychain.js';
+import { MEDIA_PERMISSION_POLICY_SWIFT } from './media-permission-policy.js';
+import { NATIVE_PLUGIN_SWIFT } from './plugin.js';
+import { WAKE_LOCKS_SWIFT } from './wake-locks.js';
+/**
+ * Framework-owned Swift source files installed explicitly by the iOS scaffold.
+ */
+export const IOS_NATIVE_TEMPLATES = {
+    'TypeFerryBridgeViewController.swift': BRIDGE_VIEW_CONTROLLER_SWIFT,
+    'TypeFerryMediaPolicy.swift': MEDIA_PERMISSION_POLICY_SWIFT,
+    'TypeFerryWakeLocks.swift': WAKE_LOCKS_SWIFT,
+    'TypeFerryFileStaging.swift': FILE_STAGING_SWIFT,
+    'TypeFerryKeychain.swift': KEYCHAIN_SWIFT,
+    'TypeFerryHTTPSession.swift': HTTP_SESSION_SWIFT,
+    'TypeFerryNativePlugin.swift': NATIVE_PLUGIN_SWIFT,
+};
+//# sourceMappingURL=index.js.map

package/dist/native/templates/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/native/templates/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,4BAA4B,EAAE,MAAM,0BAA0B,CAAA;AACvE,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAA;AACnD,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAA;AACnD,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAC3C,OAAO,EAAE,6BAA6B,EAAE,MAAM,2BAA2B,CAAA;AACzE,OAAO,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAA;AAC9C,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAA;AAE/C;;GAEG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAqC;IACpE,qCAAqC,EAAE,4BAA4B;IACnE,4BAA4B,EAAE,6BAA6B;IAC3D,0BAA0B,EAAE,gBAAgB;IAC5C,4BAA4B,EAAE,kBAAkB;IAChD,yBAAyB,EAAE,cAAc;IACzC,4BAA4B,EAAE,kBAAkB;IAChD,6BAA6B,EAAE,mBAAmB;CACnD,CAAA"}

package/dist/native/templates/keychain.d.ts

@@ -0,0 +1,4 @@
+/**
+ * Native-only secrets survive application upgrades without entering web storage.
+ */
+export declare const KEYCHAIN_SWIFT: string;

package/dist/native/templates/keychain.js

@@ -0,0 +1,48 @@
+/**
+ * Native-only secrets survive application upgrades without entering web storage.
+ */
+export const KEYCHAIN_SWIFT = String.raw `import Foundation
+import Security
+
+struct TypeFerryKeychain {
+    static func read(_ account: String) throws -> Data? {
+        var query = baseQuery(account)
+        query[kSecReturnData] = true
+        query[kSecMatchLimit] = kSecMatchLimitOne
+        var result: CFTypeRef?
+        let status = SecItemCopyMatching(query as CFDictionary, &result)
+        if status == errSecItemNotFound { return nil }
+        guard status == errSecSuccess else { throw failure(status) }
+        return result as? Data
+    }
+
+    static func write(_ account: String, data: Data) throws {
+        let query = baseQuery(account)
+        let updates: [CFString: Any] = [kSecValueData: data]
+        let status = SecItemUpdate(query as CFDictionary, updates as CFDictionary)
+        if status == errSecItemNotFound {
+            var insertion = query
+            insertion[kSecValueData] = data
+            insertion[kSecAttrAccessible] = kSecAttrAccessibleWhenUnlockedThisDeviceOnly
+            let insertStatus = SecItemAdd(insertion as CFDictionary, nil)
+            guard insertStatus == errSecSuccess else { throw failure(insertStatus) }
+        } else if status != errSecSuccess { throw failure(status) }
+    }
+
+    static func delete(_ account: String) throws {
+        let status = SecItemDelete(baseQuery(account) as CFDictionary)
+        guard status == errSecSuccess || status == errSecItemNotFound else { throw failure(status) }
+    }
+
+    private static func baseQuery(_ account: String) -> [CFString: Any] {
+        [kSecClass: kSecClassGenericPassword,
+         kSecAttrService: (Bundle.main.bundleIdentifier ?? "typeferry") + ".typeferry",
+         kSecAttrAccount: account]
+    }
+
+    private static func failure(_ status: OSStatus) -> NSError {
+        NSError(domain: NSOSStatusErrorDomain, code: Int(status), userInfo: [NSLocalizedDescriptionKey: "Secure session storage is unavailable."])
+    }
+}
+`;
+//# sourceMappingURL=keychain.js.map

package/dist/native/templates/keychain.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keychain.js","sourceRoot":"","sources":["../../../src/native/templates/keychain.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,MAAM,CAAC,GAAG,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA2CvC,CAAA"}

package/dist/native/templates/media-permission-policy.d.ts

@@ -0,0 +1,4 @@
+/**
+ * Foundation-only origin policy, also executed by the native security tests.
+ */
+export declare const MEDIA_PERMISSION_POLICY_SWIFT: string;

package/dist/native/templates/media-permission-policy.js

@@ -0,0 +1,24 @@
+/**
+ * Foundation-only origin policy, also executed by the native security tests.
+ */
+export const MEDIA_PERMISSION_POLICY_SWIFT = String.raw `import Foundation
+
+struct TypeFerryMediaPolicy {
+    static func isTrusted(localURL: URL, requestURL: URL, isMainFrame: Bool) -> Bool {
+        guard isMainFrame, requestURL.user == nil, requestURL.password == nil else { return false }
+        return localURL.scheme?.lowercased() == requestURL.scheme?.lowercased()
+            && localURL.host?.lowercased() == requestURL.host?.lowercased()
+            && effectivePort(localURL) == effectivePort(requestURL)
+    }
+
+    private static func effectivePort(_ url: URL) -> Int? {
+        if let port = url.port { return port }
+        switch url.scheme?.lowercased() {
+        case "https": return 443
+        case "http": return 80
+        default: return nil
+        }
+    }
+}
+`;
+//# sourceMappingURL=media-permission-policy.js.map

package/dist/native/templates/media-permission-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"media-permission-policy.js","sourceRoot":"","sources":["../../../src/native/templates/media-permission-policy.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,MAAM,CAAC,GAAG,CAAA;;;;;;;;;;;;;;;;;;;CAmBtD,CAAA"}

package/dist/native/templates/plugin.d.ts

@@ -0,0 +1,4 @@
+/**
+ * Narrow Capacitor bridge: pinned backend requests, Keychain, system auth and sharing.
+ */
+export declare const NATIVE_PLUGIN_SWIFT: string;

package/dist/native/templates/plugin.js

@@ -0,0 +1,314 @@
+/**
+ * Narrow Capacitor bridge: pinned backend requests, Keychain, system auth and sharing.
+ */
+export const NATIVE_PLUGIN_SWIFT = String.raw `import AuthenticationServices
+import Capacitor
+import UIKit
+import WebKit
+
+@objc(TypeFerryNativePlugin)
+public class TypeFerryNativePlugin: CAPPlugin, CAPBridgedPlugin, ASWebAuthenticationPresentationContextProviding {
+    public let identifier = "TypeFerryNativePlugin"
+    public let jsName = "TypeFerryNative"
+    public let pluginMethods: [CAPPluginMethod] = [
+        CAPPluginMethod(name: "request", returnType: CAPPluginReturnPromise),
+        CAPPluginMethod(name: "getSession", returnType: CAPPluginReturnPromise),
+        CAPPluginMethod(name: "setSession", returnType: CAPPluginReturnPromise),
+        CAPPluginMethod(name: "clearSession", returnType: CAPPluginReturnPromise),
+        CAPPluginMethod(name: "authenticate", returnType: CAPPluginReturnPromise),
+        CAPPluginMethod(name: "acquireWakeLock", returnType: CAPPluginReturnPromise),
+        CAPPluginMethod(name: "releaseWakeLock", returnType: CAPPluginReturnPromise),
+        CAPPluginMethod(name: "getState", returnType: CAPPluginReturnPromise),
+        CAPPluginMethod(name: "beginFile", returnType: CAPPluginReturnPromise),
+        CAPPluginMethod(name: "appendFile", returnType: CAPPluginReturnPromise),
+        CAPPluginMethod(name: "finishFile", returnType: CAPPluginReturnPromise),
+        CAPPluginMethod(name: "cancelFile", returnType: CAPPluginReturnPromise),
+        CAPPluginMethod(name: "shareFile", returnType: CAPPluginReturnPromise)
+    ]
+    private var http: TypeFerryHTTPSession?
+    private var initializationError: Error?
+    private var authentication: ASWebAuthenticationSession?
+    private var sharing = false
+    private let fileStaging = TypeFerryFileStaging()
+    private var stagingExpiry: DispatchWorkItem?
+    private static let stagingTimeout: TimeInterval = 600
+    private static let wakeLocks = TypeFerryWakeLocks { enabled in UIApplication.shared.isIdleTimerDisabled = enabled }
+    private let wakeLockOwner = UUID().uuidString
+    private var observers: [NSObjectProtocol] = []
+
+    public override func load() {
+        do {
+            guard let origin = getConfig().getString("backendOrigin"), let url = URL(string: origin),
+                  url.host != nil, url.user == nil, url.password == nil, url.query == nil, url.fragment == nil,
+                  url.path.isEmpty || url.path == "/" else {
+                throw TypeFerryHTTPSession.failure("A valid backend origin is required.")
+            }
+            var permitted = url.scheme == "https"
+            #if DEBUG
+            permitted = permitted || (url.scheme == "http" && ["localhost", "127.0.0.1", "::1"].contains(url.host ?? ""))
+            #endif
+            guard permitted else { throw TypeFerryHTTPSession.failure("The backend requires HTTPS.") }
+            http = try TypeFerryHTTPSession(backendURL: url)
+        } catch { initializationError = error }
+
+        observers.append(NotificationCenter.default.addObserver(forName: .capacitorDecidePolicyForNavigationAction, object: nil, queue: .main) { [weak self] notification in
+            guard let self = self, let webView = self.bridge?.webView,
+                  let navigation = notification.object as? WKNavigationAction,
+                  navigation.sourceFrame.webView === webView,
+                  navigation.targetFrame?.isMainFrame == true else { return }
+            Self.wakeLocks.removeOwner(self.wakeLockOwner)
+        })
+
+        for name in [UIApplication.didBecomeActiveNotification, UIApplication.didEnterBackgroundNotification] {
+            observers.append(NotificationCenter.default.addObserver(forName: name, object: nil, queue: .main) { [weak self] _ in
+                guard let self = self else { return }
+                let active = UIApplication.shared.applicationState == .active
+                Self.wakeLocks.setActive(owner: self.wakeLockOwner, active: active)
+                self.notifyListeners("appStateChange", data: ["isActive": active])
+            })
+        }
+    }
+
+    deinit {
+        let owner = wakeLockOwner
+        DispatchQueue.main.async { TypeFerryNativePlugin.wakeLocks.removeOwner(owner) }
+        for observer in observers { NotificationCenter.default.removeObserver(observer) }
+        authentication?.cancel()
+        stagingExpiry?.cancel()
+    }
+
+    @objc func request(_ call: CAPPluginCall) {
+        do {
+            let request = try makeRequest(call)
+            guard let http = http else { throw initializationError ?? TypeFerryHTTPSession.failure("Native transport is unavailable.") }
+            http.request(request) { result in
+                switch result {
+                case .success(let (data, response)):
+                    guard let body = String(data: data, encoding: .utf8) else { call.reject("Native RPC responses must be UTF-8."); return }
+                    var headers: [String: String] = [:]
+                    for (key, value) in response.allHeaderFields {
+                        guard let name = key as? String, name.lowercased() != "set-cookie" else { continue }
+                        headers[name] = String(describing: value)
+                    }
+                    call.resolve(["status": response.statusCode, "statusText": HTTPURLResponse.localizedString(forStatusCode: response.statusCode), "headers": headers, "body": body])
+                case .failure(let error): call.reject("The backend request failed.", nil, error)
+                }
+            }
+        } catch { call.reject("The backend request was rejected.", nil, error) }
+    }
+
+    @objc func getSession(_ call: CAPPluginCall) {
+        do {
+            let data = try TypeFerryKeychain.read("session")
+            call.resolve(["value": data.flatMap { String(data: $0, encoding: .utf8) } as Any? ?? NSNull()])
+        } catch { call.reject("Unable to read the secure session.", nil, error) }
+    }
+
+    @objc func setSession(_ call: CAPPluginCall) {
+        guard let value = call.getString("value"), let data = value.data(using: .utf8), data.count <= 65_536 else {
+            call.reject("A session value of at most 64 KiB is required."); return
+        }
+        do { try TypeFerryKeychain.write("session", data: data); call.resolve() }
+        catch { call.reject("Unable to store the secure session.", nil, error) }
+    }
+
+    @objc func clearSession(_ call: CAPPluginCall) {
+        do {
+            try http?.clearCookies()
+            try TypeFerryKeychain.delete("session")
+            call.resolve()
+        } catch { call.reject("Unable to clear the secure session.", nil, error) }
+    }
+
+    @objc func acquireWakeLock(_ call: CAPPluginCall) {
+        DispatchQueue.main.async {
+            guard UIApplication.shared.applicationState == .active else {
+                call.reject("The application must be active to keep the screen awake."); return
+            }
+            Self.wakeLocks.setActive(owner: self.wakeLockOwner, active: true)
+            call.resolve(["id": Self.wakeLocks.acquire(owner: self.wakeLockOwner)])
+        }
+    }
+
+    @objc func releaseWakeLock(_ call: CAPPluginCall) {
+        guard let id = call.getString("id") else { call.reject("A wake lock identifier is required."); return }
+        DispatchQueue.main.async {
+            Self.wakeLocks.release(id: id, owner: self.wakeLockOwner)
+            call.resolve()
+        }
+    }
+
+    @objc func getState(_ call: CAPPluginCall) {
+        DispatchQueue.main.async { call.resolve(["isActive": UIApplication.shared.applicationState == .active]) }
+    }
+
+    @objc func authenticate(_ call: CAPPluginCall) {
+        guard let urlValue = call.getString("url"), let url = URL(string: urlValue), http?.accepts(url) == true,
+              let scheme = call.getString("callbackScheme"), scheme == getConfig().getString("callbackScheme"),
+              !scheme.isEmpty, !["http", "https", "capacitor", "file", "javascript"].contains(scheme.lowercased()) else {
+            call.reject("Untrusted authentication URL or callback scheme."); return
+        }
+        DispatchQueue.main.async {
+            guard self.authentication == nil else { call.reject("Authentication is already running."); return }
+            let session = ASWebAuthenticationSession(url: url, callbackURLScheme: scheme) { [weak self] callback, error in
+                DispatchQueue.main.async {
+                    self?.authentication = nil
+                    guard let callback = callback, callback.scheme == scheme else {
+                        call.reject("Authentication did not complete.", nil, error); return
+                    }
+                    call.resolve(["url": callback.absoluteString])
+                }
+            }
+            session.presentationContextProvider = self
+            self.authentication = session
+            if !session.start() { self.authentication = nil; call.reject("Authentication could not start.") }
+        }
+    }
+
+    public func presentationAnchor(for session: ASWebAuthenticationSession) -> ASPresentationAnchor {
+        bridge?.viewController?.view.window ?? ASPresentationAnchor()
+    }
+
+    @objc func beginFile(_ call: CAPPluginCall) {
+        guard let name = call.getString("fileName"), let size = call.getInt("size") else {
+            call.reject("A file name and size are required."); return
+        }
+        DispatchQueue.main.async {
+            guard !self.sharing else { call.reject("File sharing is already running."); return }
+            do {
+                let id = try self.fileStaging.begin(fileName: name, size: size)
+                self.sharing = true
+                self.extendStagingDeadline(id: id)
+                call.resolve(["id": id])
+            } catch { call.reject("The file could not be prepared.", nil, error) }
+        }
+    }
+
+    @objc func appendFile(_ call: CAPPluginCall) {
+        guard let id = call.getString("id"), let offset = call.getInt("offset"), let base64 = call.getString("base64") else {
+            call.reject("A file identifier, offset and chunk are required."); return
+        }
+        DispatchQueue.main.async {
+            do {
+                try self.fileStaging.append(id: id, offset: offset, base64: base64)
+                self.extendStagingDeadline(id: id)
+                call.resolve()
+            } catch {
+                self.cancelStaging(id: id)
+                call.reject("The file chunk could not be written.", nil, error)
+            }
+        }
+    }
+
+    @objc func finishFile(_ call: CAPPluginCall) {
+        guard let id = call.getString("id") else { call.reject("A file identifier is required."); return }
+        DispatchQueue.main.async {
+            do {
+                let file = try self.fileStaging.finish(id: id)
+                self.stagingExpiry?.cancel()
+                self.stagingExpiry = nil
+                self.presentShare(file.url, fileName: file.fileName, call: call)
+            } catch {
+                self.cancelStaging(id: id)
+                call.reject("The file could not be completed.", nil, error)
+            }
+        }
+    }
+
+    @objc func cancelFile(_ call: CAPPluginCall) {
+        guard let id = call.getString("id") else { call.reject("A file identifier is required."); return }
+        DispatchQueue.main.async {
+            self.cancelStaging(id: id)
+            call.resolve()
+        }
+    }
+
+    private func cancelStaging(id: String) {
+        guard fileStaging.contains(id: id) else { return }
+        fileStaging.cancel(id: id)
+        stagingExpiry?.cancel()
+        stagingExpiry = nil
+        sharing = false
+    }
+
+    private func extendStagingDeadline(id: String) {
+        stagingExpiry?.cancel()
+        let expiry = DispatchWorkItem { [weak self] in self?.cancelStaging(id: id) }
+        stagingExpiry = expiry
+        DispatchQueue.main.asyncAfter(deadline: .now() + Self.stagingTimeout, execute: expiry)
+    }
+
+    @objc func shareFile(_ call: CAPPluginCall) {
+        do {
+            var request = try makeRequest(call)
+            request.httpMethod = "GET"
+            request.httpBody = nil
+            guard let fileName = call.getString("fileName"), !fileName.isEmpty,
+                  fileName == URL(fileURLWithPath: fileName).lastPathComponent,
+                  ![".", ".."].contains(fileName), !fileName.contains("\\"),
+                  let http = http else { throw TypeFerryHTTPSession.failure("A safe file name is required.") }
+            DispatchQueue.main.async {
+                guard !self.sharing else { call.reject("File sharing is already running."); return }
+                self.sharing = true
+                http.download(request) { result in
+                    DispatchQueue.main.async {
+                        switch result {
+                        case .failure(let error): self.sharing = false; call.reject("The file could not be downloaded.", nil, error)
+                        case .success(let temporary): self.presentShare(temporary, fileName: fileName, call: call)
+                        }
+                    }
+                }
+            }
+        } catch { call.reject("The download was rejected.", nil, error) }
+    }
+
+    private func presentShare(_ temporary: URL, fileName: String, call: CAPPluginCall) {
+        let directory = FileManager.default.temporaryDirectory.appendingPathComponent(UUID().uuidString, isDirectory: true)
+        do {
+            try FileManager.default.createDirectory(at: directory, withIntermediateDirectories: true)
+            let destination = directory.appendingPathComponent(fileName)
+            try FileManager.default.moveItem(at: temporary, to: destination)
+            guard let controller = bridge?.viewController, controller.presentedViewController == nil else {
+                throw TypeFerryHTTPSession.failure("Close the active native dialog before sharing.")
+            }
+            let sheet = UIActivityViewController(activityItems: [destination], applicationActivities: nil)
+            sheet.popoverPresentationController?.sourceView = controller.view
+            sheet.popoverPresentationController?.sourceRect = CGRect(x: controller.view.bounds.midX, y: controller.view.bounds.midY, width: 1, height: 1)
+            sheet.completionWithItemsHandler = { [weak self] _, completed, _, error in
+                try? FileManager.default.removeItem(at: directory)
+                self?.sharing = false
+                if let error = error { call.reject("File sharing failed.", nil, error) }
+                else { call.resolve(["completed": completed]) }
+            }
+            controller.present(sheet, animated: true)
+        } catch {
+            try? FileManager.default.removeItem(at: temporary)
+            try? FileManager.default.removeItem(at: directory)
+            sharing = false
+            call.reject("The file could not be shared.", nil, error)
+        }
+    }
+
+    private func makeRequest(_ call: CAPPluginCall) throws -> URLRequest {
+        guard let value = call.getString("url"), let url = URL(string: value), http?.accepts(url) == true else {
+            throw initializationError ?? TypeFerryHTTPSession.failure("Untrusted backend URL.")
+        }
+        var request = URLRequest(url: url)
+        let method = call.getString("method") ?? "GET"
+        guard ["GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", "OPTIONS"].contains(method) else {
+            throw TypeFerryHTTPSession.failure("Unsupported HTTP method.")
+        }
+        request.httpMethod = method
+        request.httpBody = call.getString("body")?.data(using: .utf8)
+        for (name, value) in call.getObject("headers") ?? [:] {
+            guard let value = value as? String, !["cookie", "host", "origin", "content-length"].contains(name.lowercased()),
+                  !name.contains("\r"), !name.contains("\n"), !value.contains("\r"), !value.contains("\n") else {
+                throw TypeFerryHTTPSession.failure("Unsupported request header.")
+            }
+            request.setValue(value, forHTTPHeaderField: name)
+        }
+        return request
+    }
+}
+`;
+//# sourceMappingURL=plugin.js.map

package/dist/native/templates/plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../../../src/native/templates/plugin.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,MAAM,CAAC,GAAG,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAqT5C,CAAA"}

package/dist/native/templates/wake-locks.d.ts

@@ -0,0 +1,4 @@
+/**
+ * Process-wide ownership keeps independent scene/presentation leases isolated.
+ */
+export declare const WAKE_LOCKS_SWIFT: string;

package/dist/native/templates/wake-locks.js

@@ -0,0 +1,47 @@
+/**
+ * Process-wide ownership keeps independent scene/presentation leases isolated.
+ */
+export const WAKE_LOCKS_SWIFT = String.raw `import Foundation
+
+final class TypeFerryWakeLocks {
+    private var leases: [String: String] = [:]
+    private var activeOwners: Set<String> = []
+    private var enabled = false
+    private let apply: (Bool) -> Void
+
+    init(apply: @escaping (Bool) -> Void) { self.apply = apply }
+
+    func setActive(owner: String, active: Bool) {
+        if active { activeOwners.insert(owner) }
+        else { activeOwners.remove(owner) }
+        update()
+    }
+
+    func acquire(owner: String) -> String {
+        let id = UUID().uuidString
+        leases[id] = owner
+        update()
+        return id
+    }
+
+    func release(id: String, owner: String) {
+        guard leases[id] == owner else { return }
+        leases.removeValue(forKey: id)
+        update()
+    }
+
+    func removeOwner(_ owner: String) {
+        leases = leases.filter { $0.value != owner }
+        activeOwners.remove(owner)
+        update()
+    }
+
+    private func update() {
+        let next = leases.values.contains { activeOwners.contains($0) }
+        guard next != enabled else { return }
+        enabled = next
+        apply(next)
+    }
+}
+`;
+//# sourceMappingURL=wake-locks.js.map

package/dist/native/templates/wake-locks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"wake-locks.js","sourceRoot":"","sources":["../../../src/native/templates/wake-locks.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,MAAM,CAAC,GAAG,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA0CzC,CAAA"}

package/dist/native/wake-lock.d.ts

@@ -0,0 +1,9 @@
+export interface NativeWakeLock {
+    release(): Promise<void>;
+}
+/**
+ * Keeps the screen awake while the owning native application is foregrounded.
+ * Release on presentation exit/unmount. A late acquisition must also be released
+ * if its component was disposed while the native promise was pending.
+ */
+export declare function acquireNativeWakeLock(): Promise<NativeWakeLock>;

package/dist/native/wake-lock.js

@@ -0,0 +1,17 @@
+import { TypeFerryNative } from './index.js';
+/**
+ * Keeps the screen awake while the owning native application is foregrounded.
+ * Release on presentation exit/unmount. A late acquisition must also be released
+ * if its component was disposed while the native promise was pending.
+ */
+export async function acquireNativeWakeLock() {
+    const { id } = await TypeFerryNative.acquireWakeLock();
+    let release;
+    return {
+        release() {
+            release ??= TypeFerryNative.releaseWakeLock({ id });
+            return release;
+        },
+    };
+}
+//# sourceMappingURL=wake-lock.js.map

package/dist/native/wake-lock.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"wake-lock.js","sourceRoot":"","sources":["../../src/native/wake-lock.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,SAAS,CAAA;AAMzC;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB;IACzC,MAAM,EAAE,EAAE,EAAE,GAAG,MAAM,eAAe,CAAC,eAAe,EAAE,CAAA;IACtD,IAAI,OAAkC,CAAA;IAEtC,OAAO;QACL,OAAO;YACL,OAAO,KAAK,eAAe,CAAC,eAAe,CAAC,EAAE,EAAE,EAAE,CAAC,CAAA;YACnD,OAAO,OAAO,CAAA;QAChB,CAAC;KACF,CAAA;AACH,CAAC"}