afterpresets 0.1.0 → 0.3.0

package/native-runtime/src/engine.cpp

@@ -0,0 +1,909 @@
+#include "engine.hpp"
+
+#include <algorithm>
+#include <climits>
+#include <cmath>
+#include <regex>
+
+#include "util.hpp"
+#include "zip.hpp"
+
+namespace apn {
+
+namespace {
+
+HttpResponse no_client() {
+    HttpResponse r;
+    r.network_error = true;
+    r.error = "no network client";
+    return r;
+}
+
+const char *const PROOF_PREFIX = "afterpresets-license-v1";
+const char *const RELEASE_PREFIX = "afterpresets-release-v1";
+
+std::string default_message(Status s) {
+    switch (s) {
+        case Status::Disabled: return "Licensing is off for this plugin.";
+        case Status::SignedOut: return "Sign in with your AfterPresets account to unlock this plugin.";
+        case Status::SigningIn: return "Finish signing in in your browser.";
+        case Status::Checking: return "Checking your license\xE2\x80\xA6";
+        case Status::Active: return "License active.";
+        case Status::NotOwned: return "This AfterPresets account does not own this plugin yet.";
+        case Status::Refunded: return "This purchase was refunded, so the license is no longer active.";
+        case Status::OfflineGrace:
+            return "You are offline. The plugin keeps working for a limited time; reconnect to verify your license.";
+        case Status::OfflineExpired: return "Connect to the internet to verify your license.";
+        case Status::Error: return "Something went wrong while checking your license.";
+    }
+    return "";
+}
+
+bool is_rejection_code(const std::string &code) {
+    return code == "invalid_token" || code == "not_owned" || code == "refunded" || code == "unknown_product";
+}
+
+std::string lower(std::string s) {
+    for (auto &c : s) c = (char)std::tolower((unsigned char)c);
+    return s;
+}
+
+std::string truncate(const std::string &s, size_t n) { return s.size() <= n ? s : s.substr(0, n); }
+
+// Same rule as the JS runtime's timestampOf for strings: Date.parse.
+std::optional<int64_t> timestamp_of(const Json &v) {
+    if (v.is_number() && std::isfinite(v.as_number())) return (int64_t)v.as_number();
+    if (v.is_string() && !v.as_string().empty()) return parse_iso8601(v.as_string());
+    return std::nullopt;
+}
+
+}  // namespace
+
+const char *status_name(Status s) {
+    switch (s) {
+        case Status::Disabled: return "disabled";
+        case Status::SignedOut: return "signed_out";
+        case Status::SigningIn: return "signing_in";
+        case Status::Checking: return "checking";
+        case Status::Active: return "active";
+        case Status::NotOwned: return "not_owned";
+        case Status::Refunded: return "refunded";
+        case Status::OfflineGrace: return "offline_grace";
+        case Status::OfflineExpired: return "offline_expired";
+        case Status::Error: return "error";
+    }
+    return "error";
+}
+
+const char *upd_status_name(UpdStatus s) {
+    switch (s) {
+        case UpdStatus::Idle: return "idle";
+        case UpdStatus::Checking: return "checking";
+        case UpdStatus::UpToDate: return "up_to_date";
+        case UpdStatus::Available: return "available";
+        case UpdStatus::Downloading: return "downloading";
+        case UpdStatus::Staged: return "staged";
+        case UpdStatus::Applied: return "applied";
+        case UpdStatus::Error: return "error";
+    }
+    return "error";
+}
+
+bool is_runnable(Status s) { return s == Status::Active || s == Status::OfflineGrace || s == Status::Disabled; }
+
+Paths Paths::make(const std::string &data_root, const std::string &bundle_id) {
+    Paths p;
+    p.data_dir = fsu::join(fsu::join(fsu::join(data_root, "AfterPresets"), "extensions"), bundle_id);
+    p.license = fsu::join(p.data_dir, "license.json");
+    p.updates = fsu::join(p.data_dir, "updates.json");
+    p.lock = fsu::join(p.data_dir, "update.lock");
+    p.updates_dir = fsu::join(p.data_dir, "updates");
+    p.staged = fsu::join(p.updates_dir, "staged");
+    p.staged_meta = fsu::join(p.updates_dir, "staged.json");
+    return p;
+}
+
+Engine::Engine(Settings settings, Env env, std::function<void()> on_change)
+    : s_(std::move(settings)), env_(std::move(env)), paths_(Paths::make(env_.data_root, s_.bundle_id)),
+      on_change_(std::move(on_change)) {
+    license_.status = s_.license_enabled ? Status::Checking : Status::Disabled;
+    license_.message = default_message(license_.status);
+    if (s_.license_enabled) {
+        cache_stamp_ = fsu::stamp(paths_.license);
+        watch_at_ = now() + CACHE_WATCH_MS;
+    }
+    // An update staged by an earlier session that was never applied.
+    auto meta_text = fsu::read(paths_.staged_meta, 1 << 20);
+    auto meta = meta_text ? Json::parse(*meta_text) : std::nullopt;
+    if (meta && meta->is_object() && fsu::is_dir(paths_.staged)) {
+        std::string v = (*meta)["version"].str();
+        if (v == s_.version) {
+            // Already running it (applied, then After Effects restarted).
+            fsu::remove_all(paths_.staged);
+            fsu::remove_file(paths_.staged_meta);
+        } else if (!v.empty()) {
+            update_.status = UpdStatus::Staged;
+            update_.version = v;
+            update_.direction = (*meta)["direction"].str("upgrade");
+            update_.change_log = truncate((*meta)["changeLog"].str(), 8000);
+        }
+    }
+    schedule_first_update_check();
+}
+
+void Engine::log(int level, const std::string &message) {
+    if (env_.log) env_.log(level, message);
+}
+
+std::string Engine::computer() {
+    if (computer_id_.empty()) computer_id_ = computer_id(env_);
+    return computer_id_;
+}
+
+void Engine::set_state(Status status, const std::string &message, int grace_days, const std::string &url) {
+    LicenseView next;
+    next.status = status;
+    next.message = message.empty() ? default_message(status) : message;
+    next.grace_days_left = grace_days;
+    next.sign_in_url = url;
+    next.username = username_;
+    if (next == license_) return;
+    license_ = next;
+    if (on_change_) on_change_();
+}
+
+void Engine::set_update(const UpdateView &view) {
+    if (view == update_) return;
+    update_ = view;
+    if (on_change_) on_change_();
+}
+
+ApiResult Engine::api(const std::string &suffix, const Json &body) {
+    ApiResult out;
+    std::string base = s_.api_base;
+    while (!base.empty() && base.back() == '/') base.pop_back();
+    HttpRequest req;
+    req.method = "POST";
+    req.url = base + "/v1/api/extensions/" + s_.bundle_id + suffix;
+    req.body = body.dump();
+    req.headers.emplace_back("Content-Type", "application/json");
+    static const std::atomic<bool> never{false};
+    HttpResponse res = env_.http ? env_.http->send(req, cancel_ ? *cancel_ : never) : no_client();
+    if (res.network_error) {
+        // The status says "could not reach"; the log keeps the cause (no body, no token, no URL).
+        log(2, "Request to " + suffix + " failed: " + res.error);
+        out.kind = ApiResult::Network;
+        out.message = res.error;
+        return out;
+    }
+    out.status = res.status;
+    std::optional<Json> json;
+    if (res.content_type.find("json") != std::string::npos || (!res.body.empty() && res.body[0] == '{')) {
+        json = Json::parse(res.body);
+    }
+    bool has_json = json && !json->is_null() && !(json->is_bool() && !json->as_bool());
+    if (res.status >= 200 && res.status < 300 && has_json) {
+        out.kind = ApiResult::Ok;
+        out.json = *json;
+        return out;
+    }
+    std::string code;
+    std::string message;
+    if (json) {
+        const Json &e = (*json)["error"];
+        if (e.is_object()) {
+            code = e["code"].str();
+            message = e["message"].str();
+        } else if (e.is_string()) {
+            code = e.as_string();
+        }
+    }
+    if (res.status >= 400 && res.status < 500 && res.status != 408 && res.status != 429 && !code.empty()) {
+        out.kind = ApiResult::Rejected;
+        out.code = code;
+        out.message = message.empty() ? code : message;
+        if (json) out.json = *json;
+        return out;
+    }
+    out.kind = ApiResult::Network;
+    out.message = "Server unavailable (HTTP " + std::to_string(res.status) + ").";
+    return out;
+}
+
+// ---------------------------------------------------------------- cache
+
+std::optional<Json> Engine::read_cache() {
+    auto text = fsu::read(paths_.license, 1 << 20);
+    if (!text) return std::nullopt;
+    auto data = Json::parse(*text);
+    if (!data || !data->is_object()) {
+        log(2, "Could not read license.json");
+        return std::nullopt;
+    }
+    const Json &token = (*data)["token"];
+    if (!token.is_string() || token.as_string().empty()) return std::nullopt;
+    return data;
+}
+
+bool Engine::write_cache(const Json &cache) {
+    bool ok = fsu::write_atomic(paths_.license, cache.dump(true), true);
+    if (!ok) log(3, "Could not save license.json");
+    remember_cache_stamp();
+    return ok;
+}
+
+void Engine::delete_cache() {
+    if (fsu::exists(paths_.license) && !fsu::remove_file(paths_.license)) log(2, "Could not delete license cache");
+    remember_cache_stamp();
+}
+
+void Engine::remember_cache_stamp() { cache_stamp_ = fsu::stamp(paths_.license); }
+
+std::optional<std::string> Engine::stored_token() {
+    auto cache = read_cache();
+    if (!cache) return std::nullopt;
+    return (*cache)["token"].as_string();
+}
+
+Json Engine::token_body(const std::string &token) {
+    Json body = Json::object();
+    body.set("license_token", Json::string(token));
+    body.set("computer_id", Json::string(computer()));
+    return body;
+}
+
+// ---------------------------------------------------------------- proofs
+
+std::optional<Engine::Check> Engine::trusted_check(const Json &cache) {
+    if (!s_.public_key) {
+        // Cannot verify (no key in this build): unsigned validatedAt for grace, never skip the online check.
+        auto legacy = timestamp_of(cache["validatedAt"]);
+        if (!legacy) return std::nullopt;
+        return Check{*legacy, std::nullopt};
+    }
+    const Json &proof = cache["proof"];
+    if (!proof.is_object() || !proof["signature"].is_string() || !proof["validatedAt"].is_string() ||
+        !proof["freshUntil"].is_string()) {
+        return std::nullopt;
+    }
+    auto validated_at = timestamp_of(proof["validatedAt"]);
+    auto fresh_until = timestamp_of(proof["freshUntil"]);
+    if (!validated_at || !fresh_until) return std::nullopt;
+    std::string payload = std::string(PROOF_PREFIX) + "\n" + s_.bundle_id + "\n" + computer() + "\n" +
+                          sha256_hex(cache["token"].as_string()) + "\n" + proof["validatedAt"].as_string() + "\n" +
+                          proof["freshUntil"].as_string();
+    if (!ed25519_verify(*s_.public_key, payload, proof["signature"].as_string())) return std::nullopt;
+    return Check{*validated_at, *fresh_until};
+}
+
+bool Engine::is_fresh(const std::optional<Check> &check) {
+    if (!check || !check->fresh_until) return false;
+    int64_t t = now();
+    return t >= check->validated_at - CLOCK_SKEW_MS && t < *check->fresh_until;
+}
+
+std::optional<int> Engine::grace_for(const Json &cache) {
+    auto check = trusted_check(cache);
+    if (!check) return std::nullopt;
+    int64_t elapsed = now() - check->validated_at;
+    int64_t limit = (int64_t)s_.grace_days * DAY_MS;
+    if (s_.grace_days <= 0 || elapsed < -CLOCK_SKEW_MS || elapsed >= limit) return std::nullopt;
+    int64_t remaining = limit - std::max<int64_t>(elapsed, 0);
+    int left = (int)((remaining + DAY_MS - 1) / DAY_MS);
+    return std::max(1, std::min(s_.grace_days, left));
+}
+
+// ---------------------------------------------------------------- outcomes
+
+void Engine::apply_network_failure(const Json &cache, const std::string &error) {
+    auto days = grace_for(cache);
+    if (days) {
+        set_state(Status::OfflineGrace,
+                  "You are offline. " + std::to_string(*days) + (*days == 1 ? " day" : " days") +
+                      " left before this plugin needs to verify your license online.",
+                  *days);
+    } else {
+        set_state(Status::OfflineExpired,
+                  default_message(Status::OfflineExpired) + (error.empty() ? "" : " (" + error + ")"));
+    }
+}
+
+void Engine::apply_rejection(const ApiResult &err, const std::optional<Json> &cache) {
+    clear_recheck();
+    if (err.code == "invalid_token") {
+        delete_cache();
+        username_.clear();
+        set_state(Status::SignedOut, "This computer was signed out. Sign in again to keep using this plugin.");
+        return;
+    }
+    if (is_rejection_code(err.code) && cache) {
+        Json kept = Json::object();
+        kept.set("token", (*cache)["token"]);
+        kept.set("validatedAt", Json::null());
+        const Json &user = (*cache)["username"];
+        kept.set("username", user.is_string() ? user : Json::null());
+        kept.set("proof", Json::null());
+        write_cache(kept);
+    }
+    if (err.code == "not_owned") {
+        set_state(Status::NotOwned, err.message);
+    } else if (err.code == "refunded") {
+        set_state(Status::Refunded, err.message);
+    } else if (err.code == "unknown_product") {
+        set_state(Status::Error, "This plugin is not registered with AfterPresets (" + err.message + ").");
+    } else {
+        set_state(Status::Error, err.message.empty() ? default_message(Status::Error) : err.message);
+    }
+}
+
+void Engine::on_active(const std::string &token, const Json &json) {
+    if (!json.is_object() || json["status"].str() != "active") {
+        set_state(Status::Error, "Unexpected license response.");
+        return;
+    }
+    const Json &user = json["user"];
+    username_ = user.is_object() && user["username"].is_string() ? user["username"].as_string() : "";
+    Json cache = Json::object();
+    cache.set("token", Json::string(token));
+    cache.set("validatedAt", Json::string(format_iso8601(now())));
+    cache.set("username", username_.empty() ? Json::null() : Json::string(username_));
+    const Json &proof = json["proof"];
+    if (proof.is_object()) {
+        Json p = Json::object();
+        p.set("validatedAt", Json::string(proof["validatedAt"].str()));
+        p.set("freshUntil", Json::string(proof["freshUntil"].str()));
+        p.set("signature", Json::string(proof["signature"].str()));
+        cache.set("proof", p);
+    } else {
+        cache.set("proof", Json::null());
+    }
+    write_cache(cache);
+    set_state(Status::Active);
+    schedule_recheck(trusted_check(cache));
+    if (waiting_for_sign_in_ && s_.update_mode != UpdateMode::Off && s_.update_mode != UpdateMode::Manual) {
+        waiting_for_sign_in_ = false;
+        update_at_ = now() + 5000;
+    }
+}
+
+void Engine::unlock_from_cache(const Json &cache) {
+    const Json &user = cache["username"];
+    username_ = user.is_string() ? user.as_string() : "";
+    set_state(Status::Active);
+}
+
+void Engine::schedule_recheck(const std::optional<Check> &check, int64_t delay) {
+    clear_recheck();
+    if (!s_.license_enabled) return;
+    if (delay == -2) delay = check && check->fresh_until ? *check->fresh_until - now() : -1;
+    if (delay < 0) return;
+    recheck_at_ = now() + std::max<int64_t>(delay, 1000);
+}
+
+// ---------------------------------------------------------------- license flows
+
+Engine::Launch Engine::launch_local() {
+    if (!s_.license_enabled) {
+        set_state(Status::Disabled);
+        return Launch::None;
+    }
+    if (pending_.active) return Launch::None;
+    auto cache = read_cache();
+    std::optional<Check> check = cache ? trusted_check(*cache) : std::nullopt;
+    if (!s_.background || !check || !check->fresh_until || is_fresh(check)) {
+        if (!cache) {
+            clear_recheck();
+            set_state(Status::SignedOut);
+            return Launch::None;
+        }
+        if (is_fresh(check)) {
+            unlock_from_cache(*cache);
+            schedule_recheck(check);
+            return Launch::None;
+        }
+        set_state(Status::Checking);
+        return Launch::Validate;
+    }
+    unlock_from_cache(*cache);
+    launch_token_ = (*cache)["token"].as_string();
+    return Launch::ValidateBehind;
+}
+
+void Engine::validate_stored() {
+    if (!s_.license_enabled || pending_.active) return;
+    auto cache = read_cache();
+    if (!cache) {
+        clear_recheck();
+        set_state(Status::SignedOut);
+        return;
+    }
+    auto check = trusted_check(*cache);
+    if (is_fresh(check)) {
+        unlock_from_cache(*cache);
+        schedule_recheck(check);
+        return;
+    }
+    set_state(Status::Checking);
+    std::string token = (*cache)["token"].as_string();
+    ApiResult r = api("/license/validate", token_body(token));
+    if (r.kind == ApiResult::Ok) on_active(token, r.json);
+    else if (r.kind == ApiResult::Network) apply_network_failure(*cache, r.message);
+    else apply_rejection(r, cache);
+}
+
+void Engine::validate_behind() {
+    if (!s_.license_enabled || pending_.active) return;
+    auto cache = read_cache();
+    if (!cache || launch_token_.empty()) return;
+    std::string token = launch_token_;
+    if ((*cache)["token"].as_string() != token) return;  // signed in or out elsewhere meanwhile
+    ApiResult r = api("/license/validate", token_body(token));
+    // Ignore a result that arrives after the buyer signed out or in elsewhere.
+    auto current = read_cache();
+    if (pending_.active || license_.status != Status::Active || !current || (*current)["token"].as_string() != token) {
+        return;
+    }
+    if (r.kind == ApiResult::Ok) on_active(token, r.json);
+    else if (r.kind == ApiResult::Network) apply_network_failure(*cache, r.message);
+    else apply_rejection(r, cache);
+}
+
+void Engine::recheck_quietly() {
+    if (!s_.license_enabled || pending_.active || license_.status != Status::Active) return;
+    auto cache = read_cache();
+    if (!cache) {
+        set_state(Status::SignedOut);
+        return;
+    }
+    std::string token = (*cache)["token"].as_string();
+    ApiResult r = api("/license/validate", token_body(token));
+    if (r.kind == ApiResult::Ok) on_active(token, r.json);
+    else if (r.kind == ApiResult::Network) schedule_recheck(std::nullopt, QUIET_RETRY_MS);
+    else apply_rejection(r, cache);
+}
+
+void Engine::sign_in() {
+    if (!s_.license_enabled) {
+        log(2, "Licensing is off for this plugin; sign-in was ignored.");
+        return;
+    }
+    if (pending_.active) return;
+    set_state(Status::Checking, "Starting sign-in\xE2\x80\xA6");
+    Json body = Json::object();
+    body.set("computer_id", Json::string(computer()));
+    ApiResult r = api("/license/sign-in", body);
+    const Json &j = r.json;
+    if (r.kind != ApiResult::Ok || !j["deviceCode"].is_string() || j["deviceCode"].as_string().empty() ||
+        !j["verificationUrl"].is_string() || !is_http_url(j["verificationUrl"].as_string())) {
+        if (r.kind == ApiResult::Network) {
+            set_state(Status::Error, "Could not reach AfterPresets. Check your internet connection and try again.");
+        } else if (r.kind == ApiResult::Rejected && r.code == "unknown_product") {
+            set_state(Status::Error, "This plugin is not registered with AfterPresets (" + r.message + ").");
+        } else {
+            set_state(Status::Error, r.kind == ApiResult::Rejected && !r.message.empty() ? r.message : "Could not start sign-in.");
+        }
+        return;
+    }
+    double expires_in = j["expiresIn"].as_number(0);
+    double interval = j["interval"].as_number(0);
+    if (!(expires_in > 0)) expires_in = 600;
+    if (!(interval > 0)) interval = 3;
+    pending_.active = true;
+    pending_.device_code = j["deviceCode"].as_string();
+    pending_.url = j["verificationUrl"].as_string();
+    pending_.expires_at = now() + (int64_t)(std::max(expires_in, 1.0) * 1000);
+    pending_.interval_ms = std::max<int64_t>((int64_t)(interval * 1000), MIN_POLL_MS);
+    pending_.poll_at = now() + pending_.interval_ms;
+    set_state(Status::SigningIn, "", 0, pending_.url);
+    if (env_.open_url && !env_.open_url(pending_.url)) log(2, "Could not open the browser for sign-in.");
+}
+
+void Engine::sign_in_failed(const std::string &message) {
+    stop_polling();
+    set_state(Status::SignedOut, message);
+}
+
+void Engine::poll_sign_in() {
+    if (!pending_.active) return;
+    if (now() >= pending_.expires_at) {
+        sign_in_failed("The sign-in expired. Click Sign in to try again.");
+        return;
+    }
+    std::string device_code = pending_.device_code;
+    pending_.poll_at = INT64_MAX;  // in flight
+    Json body = Json::object();
+    body.set("deviceCode", Json::string(device_code));
+    ApiResult r = api("/license/sign-in/poll", body);
+    if (!pending_.active || pending_.device_code != device_code) return;
+    if (r.kind == ApiResult::Ok) {
+        const Json &token = r.json["token"];
+        if (!token.is_string() || token.as_string().empty() || token.as_string().size() > 255) {
+            sign_in_failed("Unexpected sign-in response. Try again.");
+            return;
+        }
+        stop_polling();
+        on_active(token.as_string(), r.json);
+        return;
+    }
+    if (r.kind == ApiResult::Network || r.code == "authorization_pending") {
+        pending_.poll_at = now() + pending_.interval_ms;
+        return;
+    }
+    if (r.code == "expired_token") {
+        sign_in_failed("The sign-in was cancelled or expired. Click Sign in to try again.");
+        return;
+    }
+    sign_in_failed(r.message.empty() ? default_message(Status::Error) : r.message);
+}
+
+void Engine::cancel_sign_in() {
+    if (!s_.license_enabled || !pending_.active) return;
+    stop_polling();
+    set_state(Status::SignedOut);
+}
+
+void Engine::open_sign_in_page() {
+    if (pending_.active && !pending_.url.empty() && env_.open_url) env_.open_url(pending_.url);
+}
+
+void Engine::sign_out() {
+    if (!s_.license_enabled) {
+        log(2, "Licensing is off for this plugin; sign-out was ignored.");
+        return;
+    }
+    stop_polling();
+    clear_recheck();
+    auto cache = read_cache();
+    delete_cache();
+    username_.clear();
+    set_state(Status::SignedOut);
+    if (cache) api("/license/sign-out", token_body((*cache)["token"].as_string()));  // best effort
+}
+
+void Engine::check_cache_file() {
+    if (!s_.license_enabled) return;
+    auto st = fsu::stamp(paths_.license);
+    if (st.has_value() == cache_stamp_.has_value() && (!st || *st == *cache_stamp_)) return;
+    cache_stamp_ = st;
+    auto cache = read_cache();
+    // Another process (another After Effects, aerender, a second plugin of this bundle) signed in or out.
+    if (cache && is_runnable(license_.status)) return;
+    if (cache) stop_polling();  // the other process finished first
+    validate_stored();
+}
+
+// ---------------------------------------------------------------- updates
+
+Json Engine::read_update_settings() {
+    auto text = fsu::read(paths_.updates, 1 << 20);
+    auto json = text ? Json::parse(*text) : std::nullopt;
+    return json && json->is_object() ? *json : Json::object();
+}
+
+void Engine::write_update_settings(const Json &settings) {
+    if (!fsu::write_atomic(paths_.updates, settings.dump(true), false)) log(2, "Could not save updates.json");
+}
+
+void Engine::schedule_first_update_check() {
+    if (s_.update_mode != UpdateMode::Notify && s_.update_mode != UpdateMode::Background) return;
+    int64_t at = now() + s_.first_update_check_delay_ms;
+    // Several launches within 6 hours share one check, unless the last one found something.
+    Json st = read_update_settings();
+    auto last = timestamp_of(st["lastCheckAt"]);
+    if (last && st["lastResult"].str() == "up_to_date" && *last <= now() && *last + UPDATE_INTERVAL_MS > at) {
+        at = *last + UPDATE_INTERVAL_MS;
+    }
+    update_at_ = at;
+}
+
+bool Engine::acquire_lock() {
+    for (int attempt = 0; attempt < 2; attempt++) {
+        auto r = fsu::write_exclusive(paths_.lock, std::to_string(now()));
+        if (r == fsu::Excl::Ok) { lock_held_ = true; return true; }
+        if (r == fsu::Excl::Error) { log(2, "Update lock unavailable"); return false; }
+        int64_t age = fsu::age_ms(paths_.lock, now());
+        if (age >= 0 && age <= LOCK_STALE_MS) return false;
+        fsu::remove_file(paths_.lock);
+    }
+    return false;
+}
+
+void Engine::release_lock() {
+    if (lock_held_) fsu::remove_file(paths_.lock);
+    lock_held_ = false;
+}
+
+void Engine::check_updates(bool automatic) {
+    if (s_.update_mode == UpdateMode::Off) return;
+    if (automatic && s_.update_mode == UpdateMode::Manual) return;
+    if (update_.status == UpdStatus::Downloading) return;
+    UpdateView view = update_;
+    auto fail = [&](const std::string &code, const std::string &message) {
+        UpdateView v = update_;
+        // A staged or applied update stays visible; the error is reported alongside.
+        if (v.status != UpdStatus::Staged && v.status != UpdStatus::Applied) v.status = UpdStatus::Error;
+        v.error_code = code;
+        v.error_message = message;
+        set_update(v);
+    };
+    if (view.status != UpdStatus::Staged && view.status != UpdStatus::Applied) {
+        view.status = UpdStatus::Checking;
+        set_update(view);
+    }
+
+    Json body = Json::object();
+    body.set("currentVersion", Json::string(s_.version));
+    body.set("channel", Json::string(s_.channel));
+    // Native additions (ignored by the current API; see docs/native-runtime-design.md, "API additions").
+    body.set("platform", Json::string("native"));
+    body.set("os", Json::string(s_.os));
+    body.set("arch", Json::string(s_.arch));
+    if (s_.license_enabled) {
+        auto token = stored_token();
+        if (!token) {
+            waiting_for_sign_in_ = automatic;
+            fail("no_license", "Sign in to check for updates.");
+            return;
+        }
+        body.set("license_token", Json::string(*token));
+        body.set("computer_id", Json::string(computer()));
+    }
+    ApiResult r = api("/updates/check", body);
+
+    Json st = read_update_settings();
+    st.set("lastCheckAt", Json::string(format_iso8601(now())));
+    if (r.kind != ApiResult::Ok) {
+        st.set("lastResult", Json::string("error"));
+        write_update_settings(st);
+        if (s_.license_enabled && r.kind == ApiResult::Rejected && is_rejection_code(r.code)) {
+            apply_rejection(r, read_cache());
+        }
+        fail(r.kind == ApiResult::Network ? "network" : r.code, r.message);
+        return;
+    }
+    const Json &j = r.json;
+    if (!j["updateAvailable"].as_bool()) {
+        st.set("lastResult", Json::string("up_to_date"));
+        write_update_settings(st);
+        available_.reset();
+        if (update_.status != UpdStatus::Staged && update_.status != UpdStatus::Applied) {
+            UpdateView v;
+            v.status = UpdStatus::UpToDate;
+            set_update(v);
+        }
+        return;
+    }
+    st.set("lastResult", Json::string("available"));
+    write_update_settings(st);
+
+    UpdateInfo info;
+    info.version = j["targetVersion"].str(j["version"].str());
+    info.direction = j["direction"].str() == "downgrade" ? "downgrade" : "upgrade";
+    info.change_log = j["changeLog"].str();
+    info.download_url = j["downloadUrl"].str();
+    info.sha256 = lower(j["sha256"].str());
+    info.signature = j["signature"].str();
+    static const std::regex version_re("^[0-9A-Za-z.+-]{1,64}$");
+    static const std::regex sha_re("^[0-9a-f]{64}$");
+    if (!is_http_url(info.download_url) || !std::regex_match(info.sha256, sha_re) || info.signature.empty() ||
+        !std::regex_match(info.version, version_re)) {
+        fail("bad_update_info", "The update information is incomplete.");
+        return;
+    }
+    if ((update_.status == UpdStatus::Staged || update_.status == UpdStatus::Applied) && update_.version == info.version) {
+        return;  // already staged or applied; waiting for a restart
+    }
+    available_ = info;
+    UpdateView v;
+    v.status = UpdStatus::Available;
+    v.version = info.version;
+    v.direction = info.direction;
+    v.change_log = truncate(info.change_log, 8000);
+    set_update(v);
+    if (s_.update_mode != UpdateMode::Background || s_.dev) return;
+    if (automatic && failed_version_ == info.version) return;
+    download_update();
+}
+
+void Engine::download_update() {
+    if (!available_) return;
+    UpdateInfo info = *available_;
+    std::string code, message;
+    if (stage(info, code, message)) {
+        available_.reset();
+        UpdateView v;
+        v.status = UpdStatus::Staged;
+        v.version = info.version;
+        v.direction = info.direction;
+        v.change_log = truncate(info.change_log, 8000);
+        set_update(v);
+        if (s_.apply_when_staged) apply_now();
+        return;
+    }
+    if (code != "busy") failed_version_ = info.version;
+    UpdateView v = update_;
+    v.status = UpdStatus::Error;
+    v.error_code = code;
+    v.error_message = message;
+    set_update(v);
+}
+
+bool Engine::stage(const UpdateInfo &info, std::string &code, std::string &message) {
+    if (s_.dev) {
+        code = "dev_build";
+        message = "Updates are not installed in dev builds.";
+        return false;
+    }
+    if (!s_.public_key) {
+        code = "no_public_key";
+        message = "This build has no update signing key.";
+        return false;
+    }
+    // 1. The signature covers bundle id, version and checksum: verify before downloading anything.
+    std::string payload = std::string(RELEASE_PREFIX) + "\n" + s_.bundle_id + "\n" + info.version + "\n" + info.sha256;
+    if (!ed25519_verify(*s_.public_key, payload, info.signature)) {
+        code = "bad_signature";
+        message = "The update signature is not valid for this plugin. The update was not installed.";
+        return false;
+    }
+    if (!acquire_lock()) {
+        code = "busy";
+        message = "Another After Effects is installing this update.";
+        return false;
+    }
+    UpdateView v = update_;
+    v.status = UpdStatus::Downloading;
+    v.error_code.clear();
+    v.error_message.clear();
+    set_update(v);
+
+    struct Cleanup {
+        Engine *e;
+        std::string download, staging;
+        ~Cleanup() {
+            if (!download.empty()) fsu::remove_file(download);
+            if (!staging.empty()) fsu::remove_all(staging);
+            e->release_lock();
+        }
+    } cleanup{this, "", ""};
+
+    fsu::mkdirs(paths_.updates_dir);
+    std::string rand = env_.random_hex ? env_.random_hex(6) : std::to_string(now());
+    cleanup.download = fsu::join(paths_.updates_dir, "download-" + rand + ".zip");
+    HttpRequest req;
+    req.method = "GET";
+    req.url = info.download_url;
+    req.download_path = cleanup.download;
+    req.max_bytes = ZipLimits::MAX_TOTAL_BYTES + 16ULL * 1024 * 1024;  // the server caps releases at 400 MB unpacked
+    req.timeout_ms = 30 * 60 * 1000;
+    req.follow_redirects = true;
+    static const std::atomic<bool> never{false};
+    HttpResponse res = env_.http ? env_.http->send(req, cancel_ ? *cancel_ : never) : no_client();
+    if (res.network_error) {
+        code = "download_failed";
+        message = "Download failed: " + res.error;
+        return false;
+    }
+    if (res.status != 200) {
+        code = "download_failed";
+        message = "Download failed (HTTP " + std::to_string(res.status) + ").";
+        return false;
+    }
+    // 2. The file is the one that was signed.
+    auto sha = sha256_file_hex(cleanup.download);
+    if (!sha || !equal_ct(*sha, info.sha256)) {
+        code = "bad_checksum";
+        message = "The downloaded update is corrupted (checksum mismatch). Nothing was installed.";
+        return false;
+    }
+    auto archive = fsu::read(cleanup.download, req.max_bytes);
+    if (!archive) {
+        code = "install_failed";
+        message = "The downloaded update could not be read.";
+        return false;
+    }
+    // 3. Only this OS's plugin is extracted, every entry validated first.
+    cleanup.staging = fsu::join(paths_.updates_dir, "staging-" + rand);
+    ZipError zerr;
+    std::string plugin_name;
+    if (!zip_extract_plugin(*archive, s_.os, cleanup.staging, plugin_name, zerr)) {
+        code = "bad_zip";
+        message = zerr.message;
+        return false;
+    }
+    fsu::remove_all(paths_.staged);
+    fsu::remove_file(paths_.staged_meta);
+    if (!fsu::rename(cleanup.staging, paths_.staged)) {
+        code = "install_failed";
+        message = "The update could not be staged.";
+        return false;
+    }
+    cleanup.staging.clear();
+    Json meta = Json::object();
+    meta.set("version", Json::string(info.version));
+    meta.set("sha256", Json::string(info.sha256));
+    meta.set("plugin", Json::string(plugin_name));
+    meta.set("direction", Json::string(info.direction));
+    meta.set("changeLog", Json::string(truncate(info.change_log, 8000)));
+    meta.set("stagedAt", Json::string(format_iso8601(now())));
+    if (!fsu::write_atomic(paths_.staged_meta, meta.dump(true), false)) {
+        fsu::remove_all(paths_.staged);
+        code = "install_failed";
+        message = "The update could not be staged.";
+        return false;
+    }
+    log(1, "Update " + info.version + " verified and staged.");
+    return true;
+}
+
+void Engine::mark_applied(const std::string &version) {
+    UpdateView v = update_;
+    v.status = UpdStatus::Applied;
+    v.restart_required = true;
+    v.needs_manual_install = false;
+    v.version = version;
+    v.error_code.clear();
+    v.error_message.clear();
+    set_update(v);
+}
+
+ApplyResult Engine::apply_now() {
+    std::string version, error;
+    ApplyResult r = apply_staged_update(s_, env_, &version, &error);
+    if (r == ApplyResult::Ok) {
+        mark_applied(version);
+    } else if (r == ApplyResult::NotWritable || r == ApplyResult::NotInstalled) {
+        UpdateView v = update_;
+        v.needs_manual_install = true;
+        v.error_code = r == ApplyResult::NotWritable ? "not_writable" : "not_installed";
+        v.error_message = error;
+        set_update(v);
+    } else if (r == ApplyResult::Failed) {
+        UpdateView v = update_;
+        v.error_code = "install_failed";
+        v.error_message = error;
+        if (!fsu::exists(paths_.staged_meta)) v.status = UpdStatus::Error;  // the staged copy was discarded
+        set_update(v);
+    }
+    return r;
+}
+
+std::string Engine::notice() const {
+    const UpdateView &u = update_;
+    if (u.status == UpdStatus::Applied) return "Update installed: restart After Effects to use v" + u.version;
+    if (u.status == UpdStatus::Staged && u.needs_manual_install) {
+        return "Update v" + u.version + " is ready, but this plugin's folder is not writable: download it again from AfterPresets";
+    }
+    if (u.status == UpdStatus::Staged) return "Update v" + u.version + " downloaded: it installs when After Effects quits";
+    if (u.status == UpdStatus::Available) return "Update v" + u.version + " available";
+    return "";
+}
+
+// ---------------------------------------------------------------- timers
+
+void Engine::tick() {
+    if (pending_.active && now() >= pending_.poll_at) poll_sign_in();
+    if (recheck_at_ >= 0 && now() >= recheck_at_) {
+        recheck_at_ = -1;
+        recheck_quietly();
+    }
+    if (watch_at_ >= 0 && now() >= watch_at_) {
+        watch_at_ = now() + CACHE_WATCH_MS;
+        check_cache_file();
+    }
+    if (update_at_ >= 0 && now() >= update_at_) {
+        update_at_ = now() + UPDATE_INTERVAL_MS;
+        check_updates(true);
+    }
+}
+
+int64_t Engine::next_wake() const {
+    int64_t at = INT64_MAX;
+    if (pending_.active) at = std::min(at, pending_.poll_at);
+    if (recheck_at_ >= 0) at = std::min(at, recheck_at_);
+    if (watch_at_ >= 0) at = std::min(at, watch_at_);
+    if (update_at_ >= 0) at = std::min(at, update_at_);
+    return at;
+}
+
+}  // namespace apn