afterpresets 0.2.0 → 0.4.0

package/native-runtime/src/platform_mac.mm

@@ -0,0 +1,314 @@
+// macOS platform layer: NSURLSession HTTP, NSWorkspace browser, IOKit hardware
+// UUID, getifaddrs MAC list, dladdr self path, quarantine removal.
+// Compiled with -fobjc-arc.
+#import <Foundation/Foundation.h>
+#import <AppKit/AppKit.h>
+#include <IOKit/IOKitLib.h>
+
+#include <dlfcn.h>
+#include <ifaddrs.h>
+#include <net/if.h>
+#include <net/if_dl.h>
+#include <pwd.h>
+#include <stdlib.h>
+#include <sys/xattr.h>
+#include <unistd.h>
+
+#include <map>
+#include <set>
+
+#include "dialog.hpp"
+#include "platform.hpp"
+
+#if !__has_feature(objc_arc)
+#error "platform_mac.mm must be compiled with -fobjc-arc"
+#endif
+
+// ------------------------------------------------------------------ HTTP
+
+@interface APNSessionDelegate : NSObject <NSURLSessionDataDelegate, NSURLSessionDownloadDelegate>
+@property(nonatomic) BOOL followRedirects;
+@property(nonatomic) uint64_t maxBytes;
+@property(nonatomic, copy) NSString *downloadPath;
+@property(nonatomic, strong) NSMutableData *body;
+@property(nonatomic, copy) NSString *error;
+@property(nonatomic) BOOL tooLarge;
+@property(nonatomic) BOOL moved;
+@property(nonatomic, strong) dispatch_semaphore_t done;
+@end
+
+@implementation APNSessionDelegate
+- (void)URLSession:(NSURLSession *)session
+                          task:(NSURLSessionTask *)task
+    willPerformHTTPRedirection:(NSHTTPURLResponse *)response
+                    newRequest:(NSURLRequest *)request
+             completionHandler:(void (^)(NSURLRequest *))completionHandler {
+    // POSTs never follow redirects (the JS runtime's Node client does not either);
+    // downloads follow https redirects (http only to the local machine, for development).
+    NSString *scheme = request.URL.scheme.lowercaseString;
+    NSString *host = request.URL.host.lowercaseString;
+    BOOL local = [host isEqualToString:@"127.0.0.1"] || [host isEqualToString:@"localhost"];
+    BOOL ok = self.followRedirects && ([scheme isEqualToString:@"https"] || ([scheme isEqualToString:@"http"] && local));
+    completionHandler(ok ? request : nil);
+}
+- (void)URLSession:(NSURLSession *)session dataTask:(NSURLSessionDataTask *)dataTask didReceiveData:(NSData *)data {
+    if (self.body.length + data.length > self.maxBytes) {
+        self.tooLarge = YES;
+        [dataTask cancel];
+        return;
+    }
+    [self.body appendData:data];
+}
+- (void)URLSession:(NSURLSession *)session
+                 downloadTask:(NSURLSessionDownloadTask *)downloadTask
+                 didWriteData:(int64_t)bytesWritten
+            totalBytesWritten:(int64_t)totalBytesWritten
+    totalBytesExpectedToWrite:(int64_t)totalBytesExpectedToWrite {
+    if ((uint64_t)totalBytesWritten > self.maxBytes) {
+        self.tooLarge = YES;
+        [downloadTask cancel];
+    }
+}
+- (void)URLSession:(NSURLSession *)session
+                 downloadTask:(NSURLSessionDownloadTask *)downloadTask
+    didFinishDownloadingToURL:(NSURL *)location {
+    // The temp file is deleted when this returns: move it now.
+    NSFileManager *fm = [NSFileManager defaultManager];
+    NSURL *dest = [NSURL fileURLWithPath:self.downloadPath];
+    [fm removeItemAtURL:dest error:nil];
+    NSError *err = nil;
+    self.moved = [fm moveItemAtURL:location toURL:dest error:&err];
+    if (!self.moved) self.error = @"could not save the download";
+}
+- (void)URLSession:(NSURLSession *)session task:(NSURLSessionTask *)task didCompleteWithError:(NSError *)error {
+    if (error && !self.error) {
+        // Domain/code only: localizedDescription can contain the URL.
+        self.error = [NSString stringWithFormat:@"%@ %ld", error.domain, (long)error.code];
+        if ([error.domain isEqualToString:NSURLErrorDomain]) {
+            switch (error.code) {
+                case NSURLErrorTimedOut: self.error = @"Request timed out."; break;
+                case NSURLErrorNotConnectedToInternet: self.error = @"Not connected to the internet."; break;
+                case NSURLErrorCannotFindHost: self.error = @"Host not found."; break;
+                case NSURLErrorCannotConnectToHost: self.error = @"Could not connect."; break;
+                case NSURLErrorCancelled: self.error = self.tooLarge ? @"Response too large." : @"Cancelled."; break;
+                default: break;
+            }
+        }
+    }
+    dispatch_semaphore_signal(self.done);
+}
+@end
+
+namespace apn {
+
+namespace {
+
+class MacHttp : public HttpClient {
+public:
+    explicit MacHttp(std::string ua) : ua_(std::move(ua)) {}
+
+    HttpResponse send(const HttpRequest &r, const std::atomic<bool> &cancel) override {
+        @autoreleasepool {
+            HttpResponse out;
+            NSURL *url = [NSURL URLWithString:[NSString stringWithUTF8String:r.url.c_str()]];
+            if (!url || !url.scheme) {
+                out.network_error = true;
+                out.error = "Unsupported URL.";
+                return out;
+            }
+            NSURLSessionConfiguration *cfg = [NSURLSessionConfiguration ephemeralSessionConfiguration];
+            cfg.HTTPCookieStorage = nil;
+            cfg.HTTPShouldSetCookies = NO;
+            cfg.URLCache = nil;
+            cfg.URLCredentialStorage = nil;
+            cfg.requestCachePolicy = NSURLRequestReloadIgnoringLocalCacheData;
+            cfg.timeoutIntervalForRequest = r.download_path.empty() ? r.timeout_ms / 1000.0 : 60;
+            cfg.timeoutIntervalForResource = r.timeout_ms / 1000.0;
+            cfg.waitsForConnectivity = NO;
+            APNSessionDelegate *d = [APNSessionDelegate new];
+            d.followRedirects = r.follow_redirects;
+            d.maxBytes = r.max_bytes;
+            d.body = [NSMutableData data];
+            d.done = dispatch_semaphore_create(0);
+            if (!r.download_path.empty()) d.downloadPath = [NSString stringWithUTF8String:r.download_path.c_str()];
+            NSOperationQueue *queue = [NSOperationQueue new];
+            queue.maxConcurrentOperationCount = 1;
+            NSURLSession *session = [NSURLSession sessionWithConfiguration:cfg delegate:d delegateQueue:queue];
+
+            NSMutableURLRequest *req = [NSMutableURLRequest requestWithURL:url];
+            req.HTTPMethod = [NSString stringWithUTF8String:r.method.c_str()];
+            [req setValue:@"application/json" forHTTPHeaderField:@"Accept"];
+            [req setValue:[NSString stringWithUTF8String:ua_.c_str()] forHTTPHeaderField:@"User-Agent"];
+            for (const auto &h : r.headers) {
+                [req setValue:[NSString stringWithUTF8String:h.second.c_str()]
+                    forHTTPHeaderField:[NSString stringWithUTF8String:h.first.c_str()]];
+            }
+            if (!r.body.empty()) req.HTTPBody = [NSData dataWithBytes:r.body.data() length:r.body.size()];
+
+            NSURLSessionTask *task = r.download_path.empty() ? [session dataTaskWithRequest:req]
+                                                             : [session downloadTaskWithRequest:req];
+            [task resume];
+            // Wait in slices so a shutdown can cancel promptly.
+            while (dispatch_semaphore_wait(d.done, dispatch_time(DISPATCH_TIME_NOW, 100 * NSEC_PER_MSEC)) != 0) {
+                if (cancel.load()) [task cancel];
+            }
+            [session finishTasksAndInvalidate];
+
+            NSHTTPURLResponse *resp = [task.response isKindOfClass:[NSHTTPURLResponse class]] ? (NSHTTPURLResponse *)task.response : nil;
+            if (d.error || !resp) {
+                out.network_error = true;
+                out.error = d.error ? std::string(d.error.UTF8String) : "No response.";
+                return out;
+            }
+            if (!r.download_path.empty() && resp.statusCode == 200 && !d.moved) {
+                out.network_error = true;
+                out.error = "could not save the download";
+                return out;
+            }
+            out.status = (int)resp.statusCode;
+            NSString *ct = resp.allHeaderFields[@"Content-Type"];
+            if (ct) out.content_type = ct.UTF8String;
+            if (r.download_path.empty()) out.body.assign((const char *)d.body.bytes, d.body.length);
+            return out;
+        }
+    }
+
+private:
+    std::string ua_;
+};
+
+std::string to_std(NSString *s) { return s ? std::string(s.UTF8String) : std::string(); }
+
+}  // namespace
+
+std::shared_ptr<HttpClient> make_platform_http(const std::string &user_agent) {
+    return std::make_shared<MacHttp>(user_agent);
+}
+
+std::string platform_data_root() {
+    // CEP's SystemPath.USER_DATA on macOS (the JS runtime's root).
+    const char *home = getenv("HOME");
+    std::string h = home && *home ? home : "";
+    if (h.empty()) {
+        struct passwd *pw = getpwuid(getuid());
+        if (pw && pw->pw_dir) h = pw->pw_dir;
+    }
+    return h.empty() ? "" : h + "/Library/Application Support";
+}
+
+std::optional<std::string> platform_hardware_fingerprint() {
+    io_service_t dev = IOServiceGetMatchingService(kIOMainPortDefault, IOServiceMatching("IOPlatformExpertDevice"));
+    if (!dev) return std::nullopt;
+    CFTypeRef value = IORegistryEntryCreateCFProperty(dev, CFSTR("IOPlatformUUID"), kCFAllocatorDefault, 0);
+    IOObjectRelease(dev);
+    if (!value) return std::nullopt;
+    std::string uuid;
+    if (CFGetTypeID(value) == CFStringGetTypeID()) uuid = to_std((__bridge NSString *)value);
+    CFRelease(value);
+    // The JS runtime's regex only accepts [0-9A-Fa-f-]+.
+    if (uuid.empty() || uuid.find_first_not_of("0123456789abcdefABCDEF-") != std::string::npos) return std::nullopt;
+    for (auto &c : uuid) c = (char)toupper((unsigned char)c);
+    return "mac:" + uuid;
+}
+
+std::optional<std::string> platform_mac_fingerprint() {
+    // Mirrors Node's os.networkInterfaces() (libuv): interfaces that are UP and
+    // RUNNING with an address, MAC taken from the AF_LINK entry of the same name.
+    struct ifaddrs *list = nullptr;
+    if (getifaddrs(&list) != 0) return std::nullopt;
+    std::map<std::string, std::string> macs;
+    std::map<std::string, bool> listed;  // name -> loopback
+    for (struct ifaddrs *a = list; a; a = a->ifa_next) {
+        if (!a->ifa_addr || !a->ifa_name) continue;
+        if (a->ifa_addr->sa_family == AF_LINK) {
+            auto *sdl = (struct sockaddr_dl *)a->ifa_addr;
+            if (sdl->sdl_alen == 6) {
+                const unsigned char *m = (const unsigned char *)LLADDR(sdl);
+                char buf[18];
+                snprintf(buf, sizeof buf, "%02x:%02x:%02x:%02x:%02x:%02x", m[0], m[1], m[2], m[3], m[4], m[5]);
+                macs[a->ifa_name] = buf;
+            }
+            continue;
+        }
+        if (!((a->ifa_flags & IFF_UP) && (a->ifa_flags & IFF_RUNNING))) continue;
+        listed[a->ifa_name] = (a->ifa_flags & IFF_LOOPBACK) != 0;
+    }
+    freeifaddrs(list);
+    std::vector<std::tuple<std::string, std::string, bool>> ifaces;
+    for (const auto &kv : listed) {
+        auto it = macs.find(kv.first);
+        ifaces.emplace_back(kv.first, it == macs.end() ? "00:00:00:00:00:00" : it->second, kv.second);
+    }
+    return mac_fingerprint_from(ifaces);
+}
+
+bool platform_open_url(const std::string &url) {
+    @autoreleasepool {
+        NSURL *u = [NSURL URLWithString:[NSString stringWithUTF8String:url.c_str()]];
+        NSString *scheme = u.scheme.lowercaseString;
+        if (!u || !([scheme isEqualToString:@"https"] || [scheme isEqualToString:@"http"])) return false;
+        // NSWorkspace is safe to call from any thread.
+        return [[NSWorkspace sharedWorkspace] openURL:u];
+    }
+}
+
+std::string platform_random_hex(size_t bytes) {
+    std::vector<unsigned char> buf(bytes);
+    arc4random_buf(buf.data(), bytes);
+    static const char digits[] = "0123456789abcdef";
+    std::string out;
+    for (unsigned char b : buf) {
+        out += digits[b >> 4];
+        out += digits[b & 15];
+    }
+    return out;
+}
+
+std::string platform_self_binary_path() {
+    Dl_info info;
+    if (dladdr((const void *)&platform_self_binary_path, &info) && info.dli_fname) {
+        char resolved[PATH_MAX];
+        if (realpath(info.dli_fname, resolved)) return resolved;
+        return info.dli_fname;
+    }
+    return "";
+}
+
+bool platform_strip_quarantine(const std::string &path) {
+    @autoreleasepool {
+        removexattr(path.c_str(), "com.apple.quarantine", XATTR_NOFOLLOW);
+        NSDirectoryEnumerator *e = [[NSFileManager defaultManager] enumeratorAtPath:[NSString stringWithUTF8String:path.c_str()]];
+        for (NSString *rel in e) {
+            std::string p = path + "/" + rel.UTF8String;
+            removexattr(p.c_str(), "com.apple.quarantine", XATTR_NOFOLLOW);
+        }
+        return true;
+    }
+}
+
+int platform_show_dialog(const DialogModel &m) {
+    // NSAlert must run on the main thread (PF_Cmd_DO_DIALOG is called there).
+    if (![NSThread isMainThread]) return -1;
+    @autoreleasepool {
+        NSAlert *alert = [NSAlert new];
+        alert.messageText = [NSString stringWithUTF8String:(m.title + ": " + m.message).c_str()] ?: @"";
+        alert.informativeText = [NSString stringWithUTF8String:m.details.c_str()] ?: @"";
+        alert.alertStyle = NSAlertStyleInformational;
+        for (const auto &b : m.buttons) [alert addButtonWithTitle:[NSString stringWithUTF8String:b.label.c_str()] ?: @"OK"];
+        NSModalResponse r = [alert runModal];
+        int index = (int)(r - NSAlertFirstButtonReturn);
+        return index >= 0 && index < (int)m.buttons.size() ? index : -1;
+    }
+}
+
+const char *platform_os() { return "macos"; }
+
+const char *platform_arch() {
+#if defined(__arm64__) || defined(__aarch64__)
+    return "arm64";
+#else
+    return "x64";
+#endif
+}
+
+}  // namespace apn

package/native-runtime/src/platform_win.cpp

@@ -0,0 +1,277 @@
+// Windows platform layer: WinHTTP, ShellExecuteW, MachineGuid, adapters, BCrypt.
+// UNVERIFIED: compiled (zig c++ -target x86_64-windows-gnu -fsyntax-only) but never
+// run on Windows. See docs/native-runtime-design.md, "Windows".
+#ifdef _WIN32
+
+#ifndef NOMINMAX
+#define NOMINMAX
+#endif
+#include <winsock2.h>
+#include <windows.h>
+#include <bcrypt.h>
+#include <iphlpapi.h>
+#include <shellapi.h>
+#include <shlobj.h>
+#include <winhttp.h>
+#include <commctrl.h>
+
+#include <cstdio>
+#include <fstream>
+#include <map>
+
+#include "dialog.hpp"
+#include "platform.hpp"
+
+namespace apn {
+
+namespace {
+
+std::wstring widen(const std::string &s) {
+    if (s.empty()) return std::wstring();
+    int n = MultiByteToWideChar(CP_UTF8, 0, s.data(), (int)s.size(), nullptr, 0);
+    std::wstring w((size_t)n, L'\0');
+    MultiByteToWideChar(CP_UTF8, 0, s.data(), (int)s.size(), &w[0], n);
+    return w;
+}
+
+std::string narrow(const std::wstring &w) {
+    if (w.empty()) return std::string();
+    int n = WideCharToMultiByte(CP_UTF8, 0, w.data(), (int)w.size(), nullptr, 0, nullptr, nullptr);
+    std::string s((size_t)n, '\0');
+    WideCharToMultiByte(CP_UTF8, 0, w.data(), (int)w.size(), &s[0], n, nullptr, nullptr);
+    return s;
+}
+
+struct Handle {
+    HINTERNET h = nullptr;
+    explicit Handle(HINTERNET v) : h(v) {}
+    ~Handle() { if (h) WinHttpCloseHandle(h); }
+    operator HINTERNET() const { return h; }
+};
+
+class WinHttp : public HttpClient {
+public:
+    explicit WinHttp(std::string ua) : ua_(widen(ua)) {}
+
+    HttpResponse send(const HttpRequest &r, const std::atomic<bool> &cancel) override {
+        HttpResponse out;
+        auto fail = [&](const char *why) {
+            out.network_error = true;
+            out.error = why;
+            return out;
+        };
+        std::wstring url = widen(r.url);
+        URL_COMPONENTS uc{};
+        uc.dwStructSize = sizeof uc;
+        wchar_t host[256], path[4096];
+        uc.lpszHostName = host;
+        uc.dwHostNameLength = 256;
+        uc.lpszUrlPath = path;
+        uc.dwUrlPathLength = 4096;
+        wchar_t extra[4096];
+        uc.lpszExtraInfo = extra;
+        uc.dwExtraInfoLength = 4096;
+        if (!WinHttpCrackUrl(url.c_str(), 0, 0, &uc)) return fail("Unsupported URL.");
+        bool https = uc.nScheme == INTERNET_SCHEME_HTTPS;
+        Handle session(WinHttpOpen(ua_.c_str(), WINHTTP_ACCESS_TYPE_AUTOMATIC_PROXY, WINHTTP_NO_PROXY_NAME,
+                                   WINHTTP_NO_PROXY_BYPASS, 0));
+        if (!session) return fail("Network unavailable.");
+        int t = r.download_path.empty() ? r.timeout_ms : 60000;
+        WinHttpSetTimeouts(session, t, t, t, t);
+        DWORD protocols = WINHTTP_FLAG_SECURE_PROTOCOL_TLS1_2 | 0x00002000 /* TLS 1.3 */;
+        WinHttpSetOption(session, WINHTTP_OPTION_SECURE_PROTOCOLS, &protocols, sizeof protocols);
+        Handle connect(WinHttpConnect(session, std::wstring(host, uc.dwHostNameLength).c_str(), uc.nPort, 0));
+        if (!connect) return fail("Could not connect.");
+        std::wstring object = std::wstring(path, uc.dwUrlPathLength) + std::wstring(extra, uc.dwExtraInfoLength);
+        Handle req(WinHttpOpenRequest(connect, widen(r.method).c_str(), object.c_str(), nullptr, WINHTTP_NO_REFERER,
+                                      WINHTTP_DEFAULT_ACCEPT_TYPES, https ? WINHTTP_FLAG_SECURE : 0));
+        if (!req) return fail("Could not connect.");
+        DWORD policy = r.follow_redirects ? WINHTTP_OPTION_REDIRECT_POLICY_DISALLOW_HTTPS_TO_HTTP
+                                          : WINHTTP_OPTION_REDIRECT_POLICY_NEVER;
+        WinHttpSetOption(req, WINHTTP_OPTION_REDIRECT_POLICY, &policy, sizeof policy);
+        DWORD no_cookies = WINHTTP_DISABLE_COOKIES;
+        WinHttpSetOption(req, WINHTTP_OPTION_DISABLE_FEATURE, &no_cookies, sizeof no_cookies);
+        std::wstring headers = L"Accept: application/json\r\n";
+        for (const auto &h : r.headers) headers += widen(h.first) + L": " + widen(h.second) + L"\r\n";
+        if (!WinHttpSendRequest(req, headers.c_str(), (DWORD)-1L, (LPVOID)(r.body.empty() ? nullptr : r.body.data()),
+                                (DWORD)r.body.size(), (DWORD)r.body.size(), 0) ||
+            !WinHttpReceiveResponse(req, nullptr)) {
+            return fail(GetLastError() == ERROR_WINHTTP_TIMEOUT ? "Request timed out." : "Could not connect.");
+        }
+        DWORD status = 0, size = sizeof status;
+        WinHttpQueryHeaders(req, WINHTTP_QUERY_STATUS_CODE | WINHTTP_QUERY_FLAG_NUMBER, WINHTTP_HEADER_NAME_BY_INDEX,
+                            &status, &size, WINHTTP_NO_HEADER_INDEX);
+        out.status = (int)status;
+        wchar_t ct[256];
+        DWORD ct_size = sizeof ct;
+        if (WinHttpQueryHeaders(req, WINHTTP_QUERY_CONTENT_TYPE, WINHTTP_HEADER_NAME_BY_INDEX, ct, &ct_size,
+                                WINHTTP_NO_HEADER_INDEX)) {
+            out.content_type = narrow(std::wstring(ct, ct_size / sizeof(wchar_t)));
+        }
+        std::ofstream file;
+        bool to_file = !r.download_path.empty() && status == 200;
+        if (to_file) {
+            file.open(widen(r.download_path), std::ios::binary | std::ios::trunc);
+            if (!file) return fail("could not save the download");
+        }
+        uint64_t total = 0;
+        for (;;) {
+            if (cancel.load()) return fail("Cancelled.");
+            DWORD avail = 0;
+            if (!WinHttpQueryDataAvailable(req, &avail)) return fail("Connection lost.");
+            if (avail == 0) break;
+            std::string chunk(avail, '\0');
+            DWORD read = 0;
+            if (!WinHttpReadData(req, &chunk[0], avail, &read)) return fail("Connection lost.");
+            total += read;
+            if (total > r.max_bytes) return fail("Response too large.");
+            if (to_file) file.write(chunk.data(), read);
+            else if (r.download_path.empty()) out.body.append(chunk.data(), read);
+        }
+        if (to_file) {
+            file.close();
+            if (file.fail()) return fail("could not save the download");
+        }
+        return out;
+    }
+
+private:
+    std::wstring ua_;
+};
+
+}  // namespace
+
+std::shared_ptr<HttpClient> make_platform_http(const std::string &user_agent) {
+    return std::make_shared<WinHttp>(user_agent);
+}
+
+std::string platform_data_root() {
+    // Non-roaming: a roaming profile must never carry the computer id or a
+    // computer-bound license token to another machine.
+    PWSTR path = nullptr;
+    std::string out;
+    if (SUCCEEDED(SHGetKnownFolderPath(FOLDERID_LocalAppData, 0, nullptr, &path))) out = narrow(path);
+    if (path) CoTaskMemFree(path);
+    return out;
+}
+
+std::optional<std::string> platform_hardware_fingerprint() {
+    wchar_t buf[128];
+    DWORD size = sizeof buf;
+    if (RegGetValueW(HKEY_LOCAL_MACHINE, L"SOFTWARE\\Microsoft\\Cryptography", L"MachineGuid",
+                     RRF_RT_REG_SZ | RRF_SUBKEY_WOW6464KEY, nullptr, buf, &size) != ERROR_SUCCESS) {
+        return std::nullopt;
+    }
+    std::string guid = narrow(buf);
+    if (guid.empty() || guid.find_first_not_of("0123456789abcdefABCDEF-") != std::string::npos) return std::nullopt;
+    for (auto &c : guid) c = (char)toupper((unsigned char)c);
+    return "win:" + guid;
+}
+
+std::optional<std::string> platform_mac_fingerprint() {
+    // Node (libuv) lists adapters that are up and have unicast addresses, named
+    // by FriendlyName, internal = loopback.
+    ULONG size = 16 * 1024;
+    std::vector<unsigned char> buf;
+    ULONG rc;
+    do {
+        buf.resize(size);
+        rc = GetAdaptersAddresses(AF_UNSPEC, GAA_FLAG_SKIP_ANYCAST | GAA_FLAG_SKIP_MULTICAST | GAA_FLAG_SKIP_DNS_SERVER,
+                                  nullptr, (PIP_ADAPTER_ADDRESSES)buf.data(), &size);
+    } while (rc == ERROR_BUFFER_OVERFLOW);
+    if (rc != NO_ERROR) return std::nullopt;
+    std::vector<std::tuple<std::string, std::string, bool>> ifaces;
+    for (auto *a = (PIP_ADAPTER_ADDRESSES)buf.data(); a; a = a->Next) {
+        if (a->OperStatus != IfOperStatusUp || !a->FirstUnicastAddress) continue;
+        char mac[18] = "00:00:00:00:00:00";
+        if (a->PhysicalAddressLength == 6) {
+            const unsigned char *m = a->PhysicalAddress;
+            snprintf(mac, sizeof mac, "%02x:%02x:%02x:%02x:%02x:%02x", m[0], m[1], m[2], m[3], m[4], m[5]);
+        }
+        ifaces.emplace_back(narrow(a->FriendlyName ? a->FriendlyName : L""), mac,
+                            a->IfType == IF_TYPE_SOFTWARE_LOOPBACK);
+    }
+    return mac_fingerprint_from(ifaces);
+}
+
+bool platform_open_url(const std::string &url) {
+    if (url.rfind("https://", 0) != 0 && url.rfind("http://", 0) != 0) return false;
+    HRESULT co = CoInitializeEx(nullptr, COINIT_APARTMENTTHREADED | COINIT_DISABLE_OLE1DDE);
+    HINSTANCE r = ShellExecuteW(nullptr, L"open", widen(url).c_str(), nullptr, nullptr, SW_SHOWNORMAL);
+    if (SUCCEEDED(co)) CoUninitialize();
+    return (INT_PTR)r > 32;
+}
+
+std::string platform_random_hex(size_t bytes) {
+    std::vector<unsigned char> buf(bytes);
+    BCryptGenRandom(nullptr, buf.data(), (ULONG)bytes, BCRYPT_USE_SYSTEM_PREFERRED_RNG);
+    static const char digits[] = "0123456789abcdef";
+    std::string out;
+    for (unsigned char b : buf) {
+        out += digits[b >> 4];
+        out += digits[b & 15];
+    }
+    return out;
+}
+
+std::string platform_self_binary_path() {
+    HMODULE module = nullptr;
+    if (!GetModuleHandleExW(GET_MODULE_HANDLE_EX_FLAG_FROM_ADDRESS | GET_MODULE_HANDLE_EX_FLAG_UNCHANGED_REFCOUNT,
+                            (LPCWSTR)(void *)&platform_self_binary_path, &module)) {
+        return "";
+    }
+    wchar_t path[32768];
+    DWORD n = GetModuleFileNameW(module, path, 32768);
+    return n ? narrow(std::wstring(path, n)) : "";
+}
+
+bool platform_strip_quarantine(const std::string &) { return true; }  // Mark-of-the-Web does not block DLL loads
+
+int platform_show_dialog(const DialogModel &m) {
+    // TaskDialogIndirect needs comctl32 v6 (After Effects loads it); looked up at
+    // run time so a missing export falls back to a plain message box.
+    std::wstring title = widen(m.title), main = widen(m.message), content = widen(m.details);
+    std::vector<std::wstring> labels;
+    for (const auto &b : m.buttons) labels.push_back(widen(b.label));
+    typedef HRESULT(WINAPI * TaskDialogIndirectFn)(const TASKDIALOGCONFIG *, int *, int *, BOOL *);
+    HMODULE comctl = LoadLibraryW(L"comctl32.dll");
+    auto fn = comctl ? (TaskDialogIndirectFn)(void *)GetProcAddress(comctl, "TaskDialogIndirect") : nullptr;
+    if (fn) {
+        std::vector<TASKDIALOG_BUTTON> buttons;
+        for (size_t i = 0; i < labels.size(); i++) buttons.push_back({(int)(100 + i), labels[i].c_str()});
+        TASKDIALOGCONFIG cfg{};
+        cfg.cbSize = sizeof cfg;
+        cfg.hwndParent = GetActiveWindow();
+        cfg.dwFlags = TDF_ALLOW_DIALOG_CANCELLATION | TDF_POSITION_RELATIVE_TO_WINDOW;
+        cfg.pszWindowTitle = title.c_str();
+        cfg.pszMainInstruction = main.c_str();
+        cfg.pszContent = content.c_str();
+        cfg.cButtons = (UINT)buttons.size();
+        cfg.pButtons = buttons.data();
+        cfg.nDefaultButton = 100;
+        int pressed = 0;
+        HRESULT hr = fn(&cfg, &pressed, nullptr, nullptr);
+        FreeLibrary(comctl);
+        if (SUCCEEDED(hr)) return pressed >= 100 && pressed < 100 + (int)buttons.size() ? pressed - 100 : -1;
+        return -1;
+    }
+    if (comctl) FreeLibrary(comctl);
+    // Fallback: OK / Cancel for the first button only.
+    std::wstring text = main + L"\n\n" + content + (labels.empty() ? L"" : L"\n\nOK: " + labels[0]);
+    int r = MessageBoxW(GetActiveWindow(), text.c_str(), title.c_str(), MB_OKCANCEL | MB_ICONINFORMATION);
+    return r == IDOK ? 0 : -1;
+}
+
+const char *platform_os() { return "windows"; }
+
+const char *platform_arch() {
+#if defined(_M_ARM64) || defined(__aarch64__)
+    return "arm64";
+#else
+    return "x64";
+#endif
+}
+
+}  // namespace apn
+
+#endif  // _WIN32