Portable file-dialog contracts.
A file dialog selection is modeled as a token plus safe metadata. The UI/runtime can later request bytes via effects, keeping the contract portable to sandboxed environments.